guardian-framework 0.1.105 → 0.1.110

package/templates/pi/scripts/install_coverage_tools.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Install the project's real coverage tooling
+# (dispatcher)
+#
+# Delegates to languages/<lang>/install_coverage_tools.sh based on the
+# detected language. Run this before `.pi/scripts/coverage.sh --gate` in CI
+# or on a fresh checkout.
+#
+# Usage:
+#   bash .pi/scripts/install_coverage_tools.sh
+#
+# Exit codes:
+#   0 — tooling available / installed / not required
+#   1 — install failed
+# ============================================================================
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+detect_language() {
+    if [ -f "Cargo.lock" ] || [ -f "Cargo.toml" ]; then echo "rust"
+    elif [ -f "poetry.lock" ] || [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then echo "python"
+    elif [ -f "go.mod" ]; then echo "go"
+    elif [ -f "package.json" ]; then echo "typescript"
+    elif [ -f "pom.xml" ] || [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then echo "java"
+    else echo "unknown"; fi
+}
+
+LANG="$(detect_language)"
+
+if [ "$LANG" = "unknown" ]; then
+    echo "⚠️  No project language detected — nothing to install." >&2
+    exit 0
+fi
+
+LANG_SCRIPT="${SCRIPT_DIR}/languages/${LANG}/install_coverage_tools.sh"
+if [ ! -f "$LANG_SCRIPT" ]; then
+    echo "⚠️  No coverage installer for '${LANG}' yet (${LANG_SCRIPT})." >&2
+    exit 0
+fi
+
+exec bash "$LANG_SCRIPT" "$@"

package/templates/pi/scripts/languages/go/check_model_judgment.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — Go (ADR-008/009)
+# Deterministic hard gates:
+#   dip-domain           domain/ imports gorm/sqlx/gin/echo
+#   txn-placement        sql.Tx / BeginTx outside application/
+#   interface-ownership  (tactical) infra adapters without a domain interface
+#   adapter-purity       (adapter modules) model code in generic subdomains
+# Usage: bash check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+report() { echo "$1:$2: [$3] $4"; VIOLATIONS=$((VIOLATIONS + 1)); }
+[ -d src ] || { echo "model-judgment (go): no src/"; exit 0; }
+
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in */domain/*)
+        while IFS=: read -r ln rest; do
+            case "$rest" in
+                *gorm.io*|*database/sql*|*sqlx*|*gin-gonic*|*labstack*|*uptrace/bun*)
+                    report "$f" "$ln" "dip-domain" "domain imports persistence/web framework: $rest" ;;
+            esac
+        done < <(grep -nE '^\s*("|_ "|import )' "$f" | grep -E 'gorm|sqlx|database/sql|gin-gonic|labstack|bun' || true) ;;
+    esac
+    case "$f" in */application/*) ;; *)
+        if grep -qE "sql\.Tx|BeginTx|\.Commit\(\)" "$f" 2>/dev/null; then
+            report "$f" "1" "txn-placement" "transaction handling outside application layer"
+        fi ;;
+    esac
+done < <(find src -type f -name "*.go" 2>/dev/null | grep -vE "_test\.go$|/tests?/" || true)
+
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+        match_dir=""
+        while IFS= read -r d; do
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then match_dir="$d"; break; fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+        [ -n "$match_dir" ] || continue
+        if [ "$depth" = "adapter" ]; then
+            for layer in domain application; do
+                while IFS= read -r f; do [ -n "$f" ] || continue; report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"; done < <(find "$match_dir/$layer" -type f -name "*.go" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl" .go)"
+                stem="$(echo "$simple" | sed -E 's/Impl$//;s/impl$//')"
+                if ! grep -rqiE "type ${stem} interface|type ${simple} interface|${stem}" "$match_dir/domain" 2>/dev/null; then
+                    compact="$(printf '%s' "$simple" | tr -d '_-')"
+                    if [ -z "$compact" ] || ! grep -rqil "$compact" "$match_dir/domain" 2>/dev/null; then
+                        report "$impl" "1" "interface-ownership" "adapter without a domain/-owned interface (${simple})"
+                    fi
+                fi
+            done < <(find "$match_dir/infrastructure" -type f -name "*.go" 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "model-judgment (go): ${VIOLATIONS} violation(s)" >&2; exit 1; fi
+echo "model-judgment (go): all gates passed (dip-domain, txn-placement, interface-ownership, adapter-purity)"
+exit 0

package/templates/pi/scripts/languages/go/check_runtime_reachability.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — Go (ADR-009)
+#
+# Every service file under src/<module>/application/ must be referenced from
+# production code OUTSIDE its own module and OUTSIDE tests. Candidates: the
+# file stem (snake), its PascalCase type name, and the separator-stripped
+# form (case-insensitive).
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (go): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    stem="$(basename "$svc" .go)"
+    pascal="$(echo "$stem" | python3 -c 'import sys; s=sys.stdin.read().strip(); print("".join(w.capitalize() for w in s.split("_")) if s else "")' 2>/dev/null || echo "$stem")"
+    compact="$(echo "$stem" | tr -d '_-')"
+    refs="$(grep -rliE "\b(${pascal}|${stem}|${compact})\b" src 2>/dev/null | grep -vE "_test\.go$|/tests?/|/test/" | grep -v "^src/${mod}/" | grep -v "^${svc}$" | grep -cv '^$' || true)"
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.go" -type f 2>/dev/null | grep -vE "_test\.go$" || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "runtime-wiring (go): ${VIOLATIONS} unwired service(s)" >&2; exit 1; fi
+echo "runtime-reachability (go): all application services reachable from production code"
+exit 0

package/templates/pi/scripts/languages/go/coverage.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Go: real line coverage via `go test -coverprofile`
+#
+# Runs the full test suite with a coverage profile and reports total line
+# coverage from `go tool cover -func`.
+#
+# Usage (normally via the .pi/scripts/coverage.sh dispatcher):
+#   bash coverage.sh            # measure coverage
+#   bash coverage.sh --gate     # fail if lines < COVERAGE_THRESHOLD
+#   bash coverage.sh --lcov     # keep coverage.out profile artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60)
+# ============================================================================
+set -uo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-60}"
+GATE=0
+LCOV=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --gate) GATE=1 ;;
+        --lcov) LCOV=1 ;;
+        *) echo "unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Walk up from CWD to the module root (go.mod).
+ROOT="$(pwd)"
+while [ "$ROOT" != "/" ] && [ ! -f "$ROOT/go.mod" ]; do
+    ROOT="$(dirname "$ROOT")"
+done
+if [ ! -f "$ROOT/go.mod" ]; then
+    echo "✗ No go.mod found in this directory tree" >&2
+    exit 1
+fi
+cd "$ROOT" || exit 1
+
+if ! command -v go >/dev/null 2>&1; then
+    echo "✗ go toolchain not found on PATH" >&2
+    exit 1
+fi
+
+echo "═══ Coverage (go test -coverprofile) ═══"
+go test -coverprofile=coverage.out ./... 2>&1 | tail -10
+
+if [ ! -f "coverage.out" ]; then
+    echo "✗ No coverage profile generated (go test -coverprofile failed)" >&2
+    exit 1
+fi
+
+FUNC_OUT="$(go tool cover -func=coverage.out 2>/dev/null || true)"
+COVERAGE="$(echo "$FUNC_OUT" | awk '/^total:/{print $NF}' | tr -d '%')"
+echo ""
+echo "Line coverage: ${COVERAGE:-unavailable}% (threshold: ${COVERAGE_THRESHOLD}%)"
+
+if [ -z "$COVERAGE" ]; then
+    echo "✗ Could not extract total coverage from coverage profile" >&2
+    exit 1
+fi
+
+if [ "$LCOV" -eq 1 ]; then
+    echo "coverage profile artifact kept: coverage.out"
+else
+    rm -f coverage.out
+fi
+
+if [ "$GATE" -eq 1 ]; then
+    if awk "BEGIN { exit !($COVERAGE >= $COVERAGE_THRESHOLD) }"; then
+        echo "✓ Coverage gate passed"
+    else
+        echo "✗ Coverage below threshold (${COVERAGE}% < ${COVERAGE_THRESHOLD}%)" >&2
+        exit 1
+    fi
+fi
+exit 0

package/templates/pi/scripts/languages/go/install_coverage_tools.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Go: no extra install required
+#
+# `go test -coverprofile` is built into the Go toolchain. This script exists
+# so the language dispatcher is uniform; it only verifies the toolchain is
+# present.
+# ============================================================================
+set -euo pipefail
+
+if command -v go >/dev/null 2>&1; then
+    echo "Go coverage tooling is built-in (go version $(go version | awk '{print $3}'))."
+    exit 0
+fi
+
+echo "✗ go toolchain not found — install Go (https://go.dev/dl/) to use the coverage gate." >&2
+exit 1

package/templates/pi/scripts/languages/java/check_model_judgment.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment_java.sh — ADR-008 Java model-judgment HARD GATES
+#
+# Deterministic, language-scoped checks (contract §5). Fuzzy smells (anemic
+# model, LSP base classes, Helper/Utils, primitive obsession) are NOT gated
+# here — they surface as architecture-validator review questions instead.
+#
+# Rules (stable ids):
+#   txn-placement        @Transactional outside the application layer
+#   dip-domain           domain/ imports jakarta/javax.persistence,
+#                        springframework or hibernate
+#   interface-ownership  (tactical modules) repository implementation in
+#                        infrastructure/ without a domain/-owned interface
+#   adapter-purity       (adapter modules) production java under domain/ or
+#                        application/ of a generic subdomain
+#
+# Usage:
+#   bash check_model_judgment_java.sh [--root <dir>]     (default: cwd)
+# Output: one 'file:line: [rule-id] message' per violation.
+# Exit:   0 all pass ; 1 violations found.
+# ============================================================================
+set -uo pipefail
+
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then
+    ROOT="$2"
+fi
+cd "$ROOT" || exit 1
+
+VIOLATIONS=0
+
+report() { # file line rule message
+    echo "$1:$2: [$3] $4"
+    VIOLATIONS=$((VIOLATIONS + 1))
+}
+
+is_prod_java() { # path
+    case "$1" in
+        */test/*|*/src/test/*) return 1 ;;
+        *Test.java|*Tests.java) return 1 ;;
+    esac
+    return 0
+}
+
+# ── Rule 2: DIP — domain imports framework types ─────────────────────────────
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    is_prod_java "$f" || continue
+    case "$f" in
+        */domain/*)
+            while IFS=: read -r ln rest; do
+                case "$rest" in
+                    *jakarta.persistence*|*javax.persistence*|*org.springframework*|*org.hibernate*)
+                        imp="$(echo "$rest" | sed 's/^[[:space:]]*import[[:space:]]*//; s/;//')"
+                        report "$f" "$ln" "dip-domain" "domain layer imports framework type: $imp"
+                        ;;
+                esac
+            done < <(grep -nE '^[[:space:]]*import[[:space:]]+' "$f" || true)
+            ;;
+    esac
+done < <(find src -type f -name "*.java" 2>/dev/null || true)
+
+# ── Rule 1: transactions only in the application layer ───────────────────────
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    is_prod_java "$f" || continue
+    case "$f" in
+        */application/*) continue ;;
+    esac
+    while IFS=: read -r ln rest; do
+        case "$rest" in
+            *@Transactional*)
+                report "$f" "$ln" "txn-placement" "@Transactional must live on application-layer services (transaction boundaries)"
+                ;;
+        esac
+    done < <(grep -nE '@Transactional' "$f" || true)
+done < <(find src -type f -name "*.java" 2>/dev/null || true)
+
+# ── Rules 3 & 4: module docs drive depth-aware checks ─────────────────────────
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+
+        match_dir=""
+        while IFS= read -r d; do
+            [ -n "$d" ] || continue
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then
+                match_dir="$d"
+                break
+            fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+
+        [ -n "$match_dir" ] || continue
+
+        if [ "$depth" = "adapter" ]; then
+            # adapter-purity: no production java under domain/ or application/
+            for layer in domain application; do
+                while IFS= read -r f; do
+                    [ -n "$f" ] || continue
+                    is_prod_java "$f" || continue
+                    report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"
+                done < <(find "$match_dir/$layer" -type f -name "*.java" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            # interface-ownership: infra repository implementations need a
+            # domain/-owned interface of the same simple name.
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl")"
+                # Candidate interface names: as-is, Impl-suffix stripped, and
+                # common impl prefixes (Jpa/Jdbc/Hibernate/Spring) stripped.
+                candidates="$simple
+$(echo "$simple" | sed -E 's/Impl\.java$/.java/')
+$(echo "$simple" | sed -E 's/^(Jpa|Jdbc|Hibernate|Spring)([A-Z].*\.java)$/\2/')"
+                domain_iface=""
+                while IFS= read -r cand; do
+                    [ -n "$cand" ] || continue
+                    if [ -f "$match_dir/domain/$cand" ]; then
+                        domain_iface="$match_dir/domain/$cand"
+                        break
+                    fi
+                done <<< "$candidates"
+                if [ ! -f "$domain_iface" ]; then
+                    report "$impl" "1" "interface-ownership" "repository implementation without a domain/-owned interface (interface-ownership)"
+                fi
+            done < <(find "$match_dir/infrastructure" -type f -name "*Repository*.java" 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then
+    echo "model-judgment: ${VIOLATIONS} violation(s) found" >&2
+    exit 1
+fi
+
+echo "model-judgment (java): all gates passed (txn-placement, dip-domain, interface-ownership, adapter-purity)"
+exit 0

package/templates/pi/scripts/languages/java/check_runtime_reachability.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_runtime_reachability.sh — Java (ADR-009)
+#
+# Every application-layer class under src/<module>/application/ must be
+# referenced from production code OUTSIDE its own module and OUTSIDE tests.
+# Java file == public class: the candidate is the file stem.
+# Usage: bash check_runtime_reachability.sh [--root <dir>]
+# Exit:  0 all reachable ; 1 dead service(s)
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+[ -d src ] || { echo "runtime-reachability (java): no src/"; exit 0; }
+
+while IFS= read -r svc; do
+    [ -n "$svc" ] || continue
+    mod="$(echo "$svc" | sed 's|^src/||; s|/application/.*||')"
+    stem="$(basename "$svc" .java)"
+    refs="$(grep -rl "\b${stem}\b" src 2>/dev/null | grep -vE "src/test/|/tests?/|Test[s]?\.java$" | grep -v "^src/${mod}/" | grep -v "^${svc}$" | grep -cv '^$' || true)"
+    if [ "${refs:-0}" -eq 0 ]; then
+        echo "$svc: [runtime-reachability] application service has no production caller outside its module (tests-only callers don't count — ADR-009)"
+        VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+done < <(find src -path "*/application/*.java" -type f 2>/dev/null | grep -vE "Test[s]?\.java$" || true)
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "runtime-wiring (java): ${VIOLATIONS} unwired service(s)" >&2; exit 1; fi
+echo "runtime-reachability (java): all application services reachable from production code"
+exit 0

package/templates/pi/scripts/languages/java/coverage.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# ============================================================================
+# coverage.sh — Java: real line coverage via JaCoCo (maven/gradle)
+#
+# Runs tests and the JaCoCo report, then parses the TOTAL line-coverage
+# percentage from the generated HTML report.
+#
+# Usage (normally via the .pi/scripts/coverage.sh dispatcher):
+#   bash coverage.sh            # measure coverage
+#   bash coverage.sh --gate     # fail if lines < COVERAGE_THRESHOLD
+#   bash coverage.sh --lcov     # keep the jacoco.xml report artifact
+#
+# Env:
+#   COVERAGE_THRESHOLD  minimum line-coverage % (default: 60)
+# ============================================================================
+set -uo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-60}"
+GATE=0
+LCOV=0
+
+for arg in "$@"; do
+    case "$arg" in
+        --gate) GATE=1 ;;
+        --lcov) LCOV=1 ;;
+        *) echo "unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Walk up from CWD to the project root (pom.xml / build.gradle[.kts]).
+ROOT="$(pwd)"
+while [ "$ROOT" != "/" ] \
+    && [ ! -f "$ROOT/pom.xml" ] \
+    && [ ! -f "$ROOT/build.gradle" ] \
+    && [ ! -f "$ROOT/build.gradle.kts" ]; do
+    ROOT="$(dirname "$ROOT")"
+done
+if [ ! -f "$ROOT/pom.xml" ] && [ ! -f "$ROOT/build.gradle" ] \
+    && [ ! -f "$ROOT/build.gradle.kts" ]; then
+    echo "✗ No Maven/Gradle build file found in this directory tree" >&2
+    exit 1
+fi
+cd "$ROOT" || exit 1
+
+REPORT_HTML=""
+COVERAGE=""
+
+echo "═══ Coverage (JaCoCo) ═══"
+if [ -f "pom.xml" ]; then
+    if ! grep -q "jacoco" pom.xml; then
+        echo "✗ JaCoCo not configured in pom.xml — add org.jacoco:jacoco-maven-plugin (with jacoco:report) to enable the coverage gate." >&2
+        exit 1
+    fi
+    if ! command -v mvn >/dev/null 2>&1; then
+        echo "✗ mvn not found on PATH" >&2
+        exit 1
+    fi
+    mvn test -q >/dev/null 2>&1 || true
+    mvn jacoco:report -q >/dev/null 2>&1 || true
+    REPORT_HTML="target/site/jacoco/index.html"
+    XML_ARTIFACT="target/site/jacoco/jacoco.xml"
+elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+    if ! grep -q "jacoco" build.gradle build.gradle.kts 2>/dev/null; then
+        echo "✗ JaCoCo not configured in the Gradle build — add the org.gradle.jacoco plugin to enable the coverage gate." >&2
+        exit 1
+    fi
+    if ! command -v gradle >/dev/null 2>&1; then
+        echo "✗ gradle not found on PATH" >&2
+        exit 1
+    fi
+    gradle test jacocoTestReport -q >/dev/null 2>&1 || true
+    REPORT_HTML="build/reports/jacoco/test/html/index.html"
+    XML_ARTIFACT="build/reports/jacoco/test/jacocoTestReport.xml"
+fi
+
+if [ -f "$REPORT_HTML" ]; then
+    COVERAGE="$(grep -oP 'Total.*?([0-9]+)%' "$REPORT_HTML" 2>/dev/null | grep -oP '[0-9]+' | head -1 || echo "")"
+fi
+echo ""
+echo "Line coverage: ${COVERAGE:-unavailable}% (threshold: ${COVERAGE_THRESHOLD}%)"
+
+if [ -z "$COVERAGE" ]; then
+    echo "✗ JaCoCo report not found / percentage not detected at ${REPORT_HTML}" >&2
+    exit 1
+fi
+
+if [ "$LCOV" -eq 1 ]; then
+    if [ -f "$XML_ARTIFACT" ]; then
+        echo "jacoco report artifact kept: $XML_ARTIFACT"
+    else
+        echo "⚠️  jacoco.xml artifact not found at ${XML_ARTIFACT}" >&2
+    fi
+fi
+
+if [ "$GATE" -eq 1 ]; then
+    if [ "$COVERAGE" -ge "$COVERAGE_THRESHOLD" ] 2>/dev/null; then
+        echo "✓ Coverage gate passed"
+    else
+        echo "✗ Coverage below threshold (${COVERAGE}% < ${COVERAGE_THRESHOLD}%)" >&2
+        exit 1
+    fi
+fi
+exit 0

package/templates/pi/scripts/languages/java/install_coverage_tools.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# ============================================================================
+# install_coverage_tools.sh — Java: JaCoCo is configured in the build, not
+# installed
+#
+# Enables/verifies the JaCoCo plugin for Maven or Gradle. The coverage gate
+# (.pi/scripts/languages/java/coverage.sh) reads its HTML/XML reports.
+# ============================================================================
+set -euo pipefail
+
+if [ -f "pom.xml" ]; then
+    if grep -q "jacoco" pom.xml; then
+        echo "JaCoCo already configured in pom.xml."
+    else
+        echo "Adding org.jacoco:jacoco-maven-plugin to pom.xml requires an edit — add to <build><plugins>:"
+        cat <<'EOF'
+  <plugin>
+    <groupId>org.jacoco</groupId>
+    <artifactId>jacoco-maven-plugin</artifactId>
+    <version>0.8.12</version>
+    <executions><execution><goals><goal>prepare-agent</goal><goal>report</goal></goals></execution></executions>
+  </plugin>
+EOF
+        echo "✗ Not editing pom.xml automatically — apply the snippet above, then re-run." >&2
+        exit 1
+    fi
+elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+    if grep -q "jacoco" build.gradle build.gradle.kts 2>/dev/null; then
+        echo "JaCoCo already configured in the Gradle build."
+    else
+        echo "Add to build.gradle:  apply plugin: 'jacoco'   (then: gradle jacocoTestReport)" >&2
+        echo "✗ Not editing the Gradle build automatically — apply the plugin, then re-run." >&2
+        exit 1
+    fi
+else
+    echo "✗ No Maven/Gradle build file found" >&2
+    exit 1
+fi
+
+echo "JaCoCo coverage tooling ready."

package/templates/pi/scripts/languages/java/validate-architecture.sh

@@ -137,6 +137,26 @@ else
 fi
 
 # ---------------------------------------------------------------------------
+
+# ---------------------------------------------------------------------------
+# ADR-008 model-judgment hard gates (contract §5)
+# ---------------------------------------------------------------------------
+MJ_SCRIPT="$(dirname "$0")/check_model_judgment.sh"
+echo ""
+echo "--- Model Judgment (ADR-008) ---"
+if [ -f "$MJ_SCRIPT" ]; then
+    MJ_OUT="$(bash "$MJ_SCRIPT" --root "$(pwd)" 2>&1)" && MJ_EXIT=0 || MJ_EXIT=1
+    if [ "$MJ_EXIT" -eq 0 ]; then
+        pass "model-judgment hard gates (txn-placement, dip-domain, interface-ownership, adapter-purity)"
+    else
+        while IFS= read -r mj_line; do
+            [ -n "$mj_line" ] && fail "$mj_line"
+        done <<< "$MJ_OUT"
+    fi
+else
+    warn "check_model_judgment.sh not found — model-judgment gates skipped"
+fi
+
 # Summary
 # ---------------------------------------------------------------------------
 echo ""

package/templates/pi/scripts/languages/python/check_model_judgment.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# ============================================================================
+# check_model_judgment.sh — Python (ADR-008/009)
+# Deterministic hard gates:
+#   dip-domain           domain/ imports sqlalchemy/django/fastapi
+#   txn-placement        session.commit/transaction outside application/
+#   interface-ownership  (tactical) infra adapters without a domain Protocol/ABC
+#   adapter-purity       (adapter modules) model code in generic subdomains
+# Usage: bash check_model_judgment.sh [--root <dir>]
+# ============================================================================
+set -uo pipefail
+ROOT="$(pwd)"
+if [ "${1:-}" = "--root" ] && [ -n "${2:-}" ]; then ROOT="$2"; fi
+cd "$ROOT" || exit 1
+VIOLATIONS=0
+report() { echo "$1:$2: [$3] $4"; VIOLATIONS=$((VIOLATIONS + 1)); }
+[ -d src ] || { echo "model-judgment (python): no src/"; exit 0; }
+
+while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in */domain/*)
+        while IFS=: read -r ln rest; do
+            case "$rest" in
+                *sqlalchemy*|*django*|*fastapi*|*flask*|*peewee*|*tortoise*)
+                    report "$f" "$ln" "dip-domain" "domain imports framework/ORM: $rest" ;;
+            esac
+        done < <(grep -nE "^\s*(import|from) " "$f" || true) ;;
+    esac
+    case "$f" in */application/*) ;; *)
+        if grep -qE "\.session\.(commit|begin)|\.commit\(\)|begin_nested|\.atomic" "$f" 2>/dev/null; then
+            report "$f" "1" "txn-placement" "transaction/session handling outside application layer"
+        fi ;;
+    esac
+done < <(find src -type f -name "*.py" 2>/dev/null | grep -vE "/tests?/|test_.*\.py$|_test\.py$" || true)
+
+if [ -d ".pi/architecture/modules" ]; then
+    for doc in .pi/architecture/modules/*.md; do
+        [ -f "$doc" ] || continue
+        doc_name="$(basename "$doc" .md)"
+        depth="$(grep -m1 '^\*\*Modeling Depth:\*\*' "$doc" | sed 's/.*\*\*Modeling Depth:\*\* *//' | cut -d' ' -f1 || true)"
+        docnorm="$(echo "$doc_name" | sed 's/^module[-_]//' | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+        match_dir=""
+        while IFS= read -r d; do
+            norm="$(basename "$d" | tr '[:upper:]' '[:lower:]' | tr '-' '_')"
+            if [ "$norm" = "$docnorm" ]; then match_dir="$d"; break; fi
+        done < <(find src -mindepth 1 -maxdepth 1 -type d 2>/dev/null || true)
+        [ -n "$match_dir" ] || continue
+        if [ "$depth" = "adapter" ]; then
+            for layer in domain application; do
+                while IFS= read -r f; do [ -n "$f" ] || continue; report "$f" "1" "adapter-purity" "generic subdomain '${doc_name}' must not contain ${layer}/ model code (ADR-008)"; done < <(find "$match_dir/$layer" -type f -name "*.py" 2>/dev/null || true)
+            done
+        elif [ "$depth" = "tactical" ]; then
+            while IFS= read -r impl; do
+                [ -n "$impl" ] || continue
+                simple="$(basename "$impl" .py)"
+                stem="$(echo "$simple" | sed -E 's/_impl$//;s/Impl$//')"
+                if ! grep -rqiE "class ${stem}|class ${simple}|Protocol|ABC" "$match_dir/domain" 2>/dev/null; then
+                    report "$impl" "1" "interface-ownership" "adapter without a domain/-owned Protocol/ABC (${simple})"
+                fi
+            done < <(find "$match_dir/infrastructure" -type f -name "*.py" 2>/dev/null || true)
+        fi
+    done
+fi
+
+if [ "$VIOLATIONS" -gt 0 ]; then echo "model-judgment (python): ${VIOLATIONS} violation(s)" >&2; exit 1; fi
+echo "model-judgment (python): all gates passed (dip-domain, txn-placement, interface-ownership, adapter-purity)"
+exit 0