mandrel 2.59.0 → 2.61.0

package/.agents/scripts/check-generated-validator.js

@@ -1,202 +0,0 @@
-#!/usr/bin/env node
-/**
- * CLI: keep the committed `.agentrc` validator in step with its schema
- * (Story #5109).
- *
- * `getAgentrcValidator()` used to compile `AGENTRC_SCHEMA` with AJV in every
- * process that touched configuration — 36 of the 79 entry scripts, at ~35 ms
- * each — to produce a function that is a pure derivative of a literal already
- * committed to the repository. The compile is now done **once, here**, and its
- * output is committed as `lib/generated/agentrc-validator.js`; the runtime
- * imports that module and only falls back to a live compile behind
- * `MANDREL_AGENTRC_VALIDATOR=dynamic`.
- *
- * A generated artifact that nothing re-derives is a lie waiting to happen, so
- * this script joins the standalone-ratchet family — `check-arch-cycles.js`,
- * `check-cyclomatic.js`, `check-dead-exports.js` — and follows their contract:
- *
- *   - `--check` regenerates in memory and compares against the committed
- *     file. Exit 0 when they agree, exit 1 (naming the fix) when they do not.
- *     `npm run lint` runs this, so a schema edit that skips regeneration is
- *     refused before it can ship a validator that accepts the wrong config.
- *   - No flag rewrites the file. That is the sanctioned motion after a
- *     deliberate schema change.
- *
- * The comparison is over the exact bytes, which is what makes the gate
- * meaningful: AJV's standalone emit is deterministic for a given schema and
- * AJV version, so a diff means either the schema moved or the compiler did,
- * and both demand a fresh artifact.
- */
-
-import fs from 'node:fs';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import process from 'node:process';
-import { runAsCli } from './lib/cli-utils.js';
-import { AGENTRC_SCHEMA } from './lib/config-settings-schema.js';
-
-const require = createRequire(import.meta.url);
-
-/** Repo-relative home of the committed artifact. */
-export const GENERATED_VALIDATOR_PATH =
-  '.agents/scripts/lib/generated/agentrc-validator.js';
-
-/** The command that rewrites it — quoted in every failure message. */
-const REGEN_COMMAND = 'npm run validator:gen';
-
-/**
- * AJV options for the generated validator.
- *
- * `allErrors: true` MUST match the runtime fallback in
- * `config-settings-schema.js#getAgentrcValidator` — it is the difference
- * between reporting one error and reporting all of them, and every caller
- * that renders `validate.errors` would change behaviour if the two diverged.
- * `code.source` is what makes the instance emittable; `code.esm` selects the
- * ES-module emit. Neither touches validation semantics.
- */
-const AJV_OPTIONS = Object.freeze({
-  allErrors: true,
-  code: { source: true, esm: true },
-});
-
-/**
- * Banner prepended to the emitted module.
- *
- * The `createRequire` shim is load-bearing: AJV's `esm` emit still reaches for
- * its shared runtime helpers (`ajv/dist/runtime/*`) with `require(...)`, which
- * is not defined inside an ES module. Handing the generated code a real
- * `require` is the smallest fix that keeps the emit verbatim — rewriting those
- * calls into imports would mean re-deriving AJV's own codegen by hand, and
- * would silently rot the next time it changes shape.
- *
- * The coverage pragma matches `config-settings-schema.js`: generated code has
- * no branches anyone authored, so a coverage figure over it measures nothing.
- */
-const BANNER = `/* node:coverage ignore file -- generated artifact; see check-generated-validator.js */
-/**
- * GENERATED FILE — DO NOT EDIT.
- *
- * Precompiled AJV validator for \`AGENTRC_SCHEMA\`
- * (.agents/scripts/lib/config-settings-schema.js), emitted by
- * .agents/scripts/check-generated-validator.js.
- *
- * Regenerate with \`${REGEN_COMMAND}\`; \`npm run lint\` fails when this file
- * and the schema disagree.
- */
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-`;
-
-/**
- * Emit the standalone validator source for `AGENTRC_SCHEMA`.
- *
- * Exported so the parity test can assert the committed artifact and a fresh
- * emit agree without shelling out to this CLI.
- *
- * @returns {string} Complete module source, newline-terminated.
- */
-export function generateValidatorSource() {
-  const ajvModule = require('ajv');
-  const Ajv = ajvModule.default ?? ajvModule;
-  const standaloneModule = require('ajv/dist/standalone');
-  const standaloneCode = standaloneModule.default ?? standaloneModule;
-  const ajv = new Ajv(AJV_OPTIONS);
-  const validate = ajv.compile(AGENTRC_SCHEMA);
-  const body = standaloneCode(ajv, validate);
-  return `${BANNER}\n${body.trim()}\n`;
-}
-
-/**
- * Read the committed artifact, or `null` when it is absent.
- *
- * @param {string} absPath
- * @returns {string | null}
- */
-function readCommitted(absPath) {
-  try {
-    return fs.readFileSync(absPath, 'utf-8');
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Top-level CLI entry. Exported so tests can drive both modes through the
- * injected seams rather than by spawning a process.
- *
- * @param {{
- *   argv?: string[],
- *   cwd?: string,
- *   stdout?: { write: (s: string) => void },
- *   stderr?: { write: (s: string) => void },
- *   generateImpl?: () => string,
- *   writeFileImpl?: (p: string, data: string) => void,
- * }} [opts]
- * @returns {number} 0 = in step (or written); 1 = stale artifact.
- */
-export function runCli({
-  argv = process.argv.slice(2),
-  cwd = process.cwd(),
-  stdout = process.stdout,
-  stderr = process.stderr,
-  generateImpl = generateValidatorSource,
-  writeFileImpl = (p, data) => fs.writeFileSync(p, data),
-} = {}) {
-  const checkOnly = argv.includes('--check');
-  const absPath = path.resolve(cwd, GENERATED_VALIDATOR_PATH);
-  const expected = generateImpl();
-
-  if (!checkOnly) {
-    fs.mkdirSync(path.dirname(absPath), { recursive: true });
-    writeFileImpl(absPath, expected);
-    stdout.write(
-      `[generated-validator] wrote ${expected.length} bytes to ${GENERATED_VALIDATOR_PATH}\n`,
-    );
-    return 0;
-  }
-
-  const actual = readCommitted(absPath);
-  if (actual === null) {
-    stderr.write(
-      `[generated-validator] ❌ ${GENERATED_VALIDATOR_PATH} is missing — run \`${REGEN_COMMAND}\`\n`,
-    );
-    return 1;
-  }
-  if (actual !== expected) {
-    stderr.write(
-      `[generated-validator] ❌ ${GENERATED_VALIDATOR_PATH} is stale against AGENTRC_SCHEMA ` +
-        `(committed ${actual.length} bytes, regenerated ${expected.length}) — run \`${REGEN_COMMAND}\`\n`,
-    );
-    return 1;
-  }
-  stdout.write(
-    `[generated-validator] ✅ ${GENERATED_VALIDATOR_PATH} is in step with AGENTRC_SCHEMA\n`,
-  );
-  return 0;
-}
-
-async function main() {
-  return runCli();
-}
-
-runAsCli(import.meta.url, main, {
-  source: 'generated-validator',
-  propagateExitCode: true,
-  errorPrefix: '[generated-validator] ❌ Fatal error',
-  usage: {
-    invocation: 'node .agents/scripts/check-generated-validator.js [--check]',
-    summary:
-      'Regenerate the committed AJV validator for `AGENTRC_SCHEMA`, or (with --check) fail when the committed artifact is stale against the schema.',
-    flags: [
-      [
-        '--check',
-        'Compare only: exit 1 when the committed artifact differs from a fresh emit. Writes nothing.',
-      ],
-    ],
-    notes: [
-      'Exit codes:\n  0  artifact written, or already in step\n  1  committed artifact is missing or stale',
-      `Regenerate with \`${REGEN_COMMAND}\`. The runtime falls back to a live AJV compile when MANDREL_AGENTRC_VALIDATOR=dynamic.`,
-    ],
-  },
-});

package/.agents/scripts/check-knip-entries.js

@@ -1,159 +0,0 @@
-#!/usr/bin/env node
-
-// .agents/scripts/check-knip-entries.js — the guard #5001 left unbuilt.
-//
-// Story #5001 made two changes that are individually right and jointly unsafe:
-// it replaced knip's blanket `.agents/scripts/*.js!` entry glob with an
-// explicit list (so an uninvoked CLI surfaces as dead), and it promoted knip's
-// `files` rule to `error` (so whole-file death produces baseline rows). The
-// explicit list is hand-maintained; nothing checked it.
-//
-// So any CLI added after #5001 is, by default, invisible to knip: absent from
-// the entry list, it reads as unreachable, emits a `{ file, symbol: '*' }` row,
-// and drags every lib module only it imports into the dead set with it. Story
-// #5012 hit exactly this — 5 false rows — and the ratchet's natural remedy
-// (accept the diff) would have written live operator CLIs into
-// `baselines/dead-exports-production.json` as expected-dead, permanently. It
-// was caught by luck: a base-sync conflict forced a manual read of the diff.
-//
-// This gate removes the luck. It derives the invoked set from the executable
-// surfaces #5001's own acceptance criterion named — package.json scripts, husky
-// hooks, `.github/workflows`, `.agents` workflow/skill/agent/rule markdown, and
-// script-to-script spawns — and asserts it matches the entry array of whatever
-// configuration knip itself would load, in both directions. See
-// `lib/knip-entry-sync.js` for why liveness means *invoked* rather than
-// *present*, and why documentation prose does not count.
-//
-// Analysis-free by construction: knip's config resolver is loaded (a
-// `knip.config.ts` has to be evaluated, not parsed), but nothing is scanned —
-// no knip run, no scorer, no coverage artifact. Past that it is a directory
-// read and a handful of regexes, which is what keeps it cheap enough to sit in
-// the required-check set next to `check-baseline-scope.js`.
-//
-// Not-applicable is not failure (Story #5039). A repository with no knip
-// configuration at all — and one where `knip` is not installed — exits 0 with a
-// skip line, the same opt-in posture `qa.gherkinLint` uses. Without that, the
-// gate could not be wired into a consumer that does not run knip, and #5001's
-// guard stayed unbuilt everywhere it was most needed. A configuration that
-// EXISTS but cannot be resolved still exits 2: absence and breakage are
-// different answers.
-//
-// Exit codes:
-//   0  entry list matches the invoked set, or there is no configuration to check
-//   1  divergence — a missing, stale, phantom, or unsuffixed entry
-//   2  the check could not run (unresolvable configuration, unusable repository)
-
-import process from 'node:process';
-import { runAsCli } from './lib/cli-utils.js';
-import {
-  countDivergences,
-  renderEntrySyncReport,
-  resolveEntrySync,
-} from './lib/knip-entry-sync.js';
-
-const EXIT_PASS = 0;
-const EXIT_DIVERGED = 1;
-const EXIT_CANNOT_RUN = 2;
-
-const HELP = {
-  invocation:
-    'node .agents/scripts/check-knip-entries.js [--cwd <dir>] [--json]',
-  summary:
-    "Assert the explicit .agents/scripts entry list in knip's resolved configuration matches the set of CLIs something actually invokes.",
-  flags: [
-    ['--cwd <dir>', 'Repository root to check. Default: process.cwd().'],
-    ['--json', 'Emit the report as JSON instead of text.'],
-  ],
-  notes: [
-    'Resolves the config through knip itself, so every location knip supports works\n(knip.json/.jsonc, .knip.json(c), knip.ts/.js, knip.config.ts/.js,\npackage.json#knip). A TS config is evaluated, so a computed entry array reads\ncorrectly, and per-workspace entries count alongside the top-level array.',
-    'Exit codes:\n  0  entry list matches, or there is no config to check (skip)\n  1  divergence\n  2  the check could not run — a config that EXISTS but will not resolve',
-    'A missing entry is the dangerous one: knip calls the CLI dead, and accepting\nthe dead-exports diff would record a live CLI as expected-dead (Story #5012).',
-  ],
-};
-
-/**
- * The gate's single exit-code decision, shared by the text and `--json` paths.
- *
- * Kept in one place for the same reason `countDivergences` is: a direction
- * added to the report must not be able to change one path's verdict and not
- * the other's. Skip outranks error outranks divergence — a repository with no
- * configuration has nothing to diverge from.
- *
- * @param {Awaited<ReturnType<typeof resolveEntrySync>>} report
- * @returns {number}
- */
-function exitCodeFor(report) {
-  if (report.skipped) return EXIT_PASS;
-  if (report.error) return EXIT_CANNOT_RUN;
-  return countDivergences(report) > 0 ? EXIT_DIVERGED : EXIT_PASS;
-}
-
-/**
- * Parse argv into an options bag. An unknown flag is a config error rather than
- * a silent no-op, matching `check-baseline-scope.js`.
- *
- * @param {string[]} argv
- * @returns {{ cwd: string | null, json: boolean }}
- */
-export function parseArgs(argv = []) {
-  const out = { cwd: null, json: false };
-  let i = 0;
-  while (i < argv.length) {
-    const arg = argv[i];
-    i += 1;
-    if (arg === '--json') out.json = true;
-    else if (arg === '--cwd') {
-      out.cwd = argv[i];
-      i += 1;
-    } else throw new Error(`unknown flag "${arg}" (try --help)`);
-  }
-  return out;
-}
-
-/**
- * Top-level CLI entry. Exported so tests can drive it against a fixture tree
- * without spawning a process.
- *
- * @param {{
- *   argv?: string[],
- *   cwd?: string,
- *   stdout?: { write: (s: string) => void },
- *   stderr?: { write: (s: string) => void },
- * }} [opts]
- * @returns {Promise<number>} 0 pass, 1 divergence, 2 cannot run
- */
-export async function runCli({
-  argv = process.argv.slice(2),
-  cwd = process.cwd(),
-  stdout = process.stdout,
-  stderr = process.stderr,
-} = {}) {
-  let args;
-  try {
-    args = parseArgs(argv);
-  } catch (err) {
-    stderr.write(`[knip-entries] ❌ ${err?.message ?? String(err)}\n`);
-    return EXIT_CANNOT_RUN;
-  }
-  const report = await resolveEntrySync({ repoRoot: args.cwd ?? cwd });
-
-  if (args.json) {
-    stdout.write(
-      `${JSON.stringify({ kind: 'knip-entry-sync', ...report }, null, 2)}\n`,
-    );
-  } else if (report.skipped) {
-    stdout.write(`[knip-entries] ⏭️  not applicable: ${report.skipped}\n`);
-  } else if (report.error) {
-    stderr.write(`[knip-entries] ❌ ${report.error}\n`);
-  } else {
-    stdout.write(`\n--- knip-entries ---\n${renderEntrySyncReport(report)}\n`);
-  }
-  return exitCodeFor(report);
-}
-
-runAsCli(import.meta.url, async () => runCli(), {
-  source: 'knip-entries',
-  propagateExitCode: true,
-  errorPrefix: '[knip-entries] ❌ Fatal error',
-  usage: HELP,
-});

package/.agents/scripts/check-lifecycle-lint.js

@@ -1,294 +0,0 @@
-#!/usr/bin/env node
-/* node:coverage ignore file */
-
-/**
- * check-lifecycle-lint.js — enforce the lifecycle lint rules that biome's
- * stock ruleset cannot express.
- *
- * Rule 1 — "No Promise.all over the lifecycle surface".
- *   Files under `.agents/scripts/lib/orchestration/lifecycle/**` MUST NOT
- *   contain `Promise.all(`. The surface is the append-only ledger writer, and
- *   record ordering is the whole point of an append-only trail: a parallel
- *   write interleaves records and breaks the ordering a reader relies on.
- *   Tests under `tests/lifecycle/**` are exempt — fixtures that prove the rule
- *   bites need to carry the pattern.
- *
- *   (Story #5024 narrowed the rationale. It was "the bus is a strictly
- *   sequential mediator; parallelizing listeners breaks repeatability", which
- *   stopped being the reason when the bus was deleted. The rule still guards a
- *   real property of what remains.)
- *
- *   The old Rule 2 — "wildcard-observer firewall", gating any module under
- *   `lifecycle/listeners/**` that called `bus.on('*', …)` — was deleted by
- *   Story #5024 along with the bus. Both halves of its predicate became
- *   unsatisfiable in the same commit (the directory is gone and there is no
- *   `bus` to call `.on` on), so it returned zero violations by construction
- *   rather than by verification: a gate that cannot fire, of exactly the class
- *   Story #5004 retired `check-gherkin-placeholders.js` for.
- *
- * Rule 3 — "Auto-merge lockout" (Story #2253 / Task #2255, Epic #2172
- *   review High-1).
- *   String literals containing the substring `gh pr merge` MUST NOT
- *   appear in any file under `.agents/scripts/**` EXCEPT
- *   `lib/orchestration/single-story-close/phases/auto-merge.js` — the v2
- *   close path that replaced the Epic-era `AutomergeArmer` listener the rule
- *   was originally written against. The original safety hole was an
- *   unconditional `gh pr merge <pr> --auto --squash --delete-branch`
- *   call in `epic-deliver-finalize.js` that armed GitHub's native
- *   auto-merge BEFORE the framework's automerge predicate evaluated
- *   blocker / review state; the lockout backstops the deletion so a
- *   future refactor cannot quietly re-add it outside the armer.
- *
- *   The rule scans STRING LITERALS only (single-quoted, double-quoted,
- *   or back-ticked) — comments are exempt because the deletion site
- *   needs prose explaining what was removed and why.
- *
- *   The exempt path is matched by suffix so it bites even before the
- *   armer file lands (Wave 7); pre-existence is not required.
- *
- * Scan root:
- *   --root <dir>  Scan <dir> instead of this checkout. Both surfaces are
- *                 derived from it, so one flag moves the whole scan.
- *                 Defaults to the repository this script ships in, which is
- *                 what `npm run lint` gets by passing nothing.
- *
- *   The seam exists for tests (Story #5052). The CLI test that proves a
- *   violation is *caught* has to plant one, and it used to plant into the
- *   live `.agents/` tree — which `tests/e2e/sync-prune.integration.test.js`
- *   copies with the real binary, so the two raced: the sync either lost the
- *   file between enumeration and `copyfile` (ENOENT) or copied it once and
- *   pruned it on the second pass, tripping an idempotence assertion. Pointing
- *   the planting test at a temp root keeps what that test was written for —
- *   discovery is still the CLI's own walk, not an injected file list — while
- *   leaving the shared tree untouched. Mirrors the `--root` seam
- *   `check-test-temp-hygiene.js` already ships for the same reason.
- *
- * Exit codes:
- *   0 — clean.
- *   1 — at least one violation; offending file + line printed to stderr.
- *
- * This script ships as part of `npm run lint`. It is intentionally
- * Node-only (no ESLint dependency) because the repo's lint surface is
- * biome + markdownlint; a custom rule fits cleanly alongside.
- */
-
-import { readFileSync } from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { runAsCli } from './lib/cli-utils.js';
-import { walkFilesByExtension } from './lib/fs-walk.js';
-import { stripJsComments } from './lib/source-text/strip-js-comments.js';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-
-/** Rule 1's scan surface for a given repository root. */
-function lifecycleDirFor(root) {
-  return path.join(
-    root,
-    '.agents',
-    'scripts',
-    'lib',
-    'orchestration',
-    'lifecycle',
-  );
-}
-
-/** Rule 3's scan surface for a given repository root. */
-function scriptsDirFor(root) {
-  return path.join(root, '.agents', 'scripts');
-}
-
-/**
- * Files exempt from the merge-lockout rule. The path is matched by
- * suffix against the absolute file path so the entry bites even before
- * the file lands (Wave 7, Story #2256 / Task 8-3 adds
- * `automerge-armer.js`; the rule still has to be in place beforehand
- * so the lockout is enforced from the moment the deletion ships).
- *
- * Maintainers: do NOT widen this list without an architectural review
- * — every additional exempt path is a new place an unauthorized
- * auto-merge call could re-enter the codebase.
- */
-const MERGE_LOCKOUT_ALLOWED_SUFFIXES = Object.freeze([
-  // v2 Story close path — the sole production code path authorized to
-  // call `gh pr merge` after the Epic AutomergeArmer listener was removed.
-  path.join(
-    'lib',
-    'orchestration',
-    'single-story-close',
-    'phases',
-    'auto-merge.js',
-  ),
-]);
-
-/**
- * Files exempt from the merge-lockout rule because they ARE the rule
- * (fixtures + the lint runner itself necessarily carry the literal so
- * they can match against it). Maintainers: do NOT add production code
- * here — see `MERGE_LOCKOUT_ALLOWED_SUFFIXES`.
- */
-const MERGE_LOCKOUT_INFRASTRUCTURE_SUFFIXES = Object.freeze([
-  // The lint script itself (this file).
-  path.join('.agents', 'scripts', 'check-lifecycle-lint.js'),
-]);
-
-/**
- * Rule 1 enforcement. Returns an array of `{ file, line, hint }`
- * violations. Inline disable comments (`// lint-lifecycle-disable`) on
- * the same line opt out — but reviewers should require justification.
- */
-export function findPromiseAllViolations(
-  rootDir,
-  { read = readFileSync } = {},
-) {
-  const violations = [];
-  for (const file of walkFilesByExtension(rootDir, '.js')) {
-    const text = read(file, 'utf8');
-    const lines = text.split('\n');
-    for (let i = 0; i < lines.length; i += 1) {
-      const line = lines[i];
-      // skip lines explicitly opting out
-      if (line.includes('lint-lifecycle-disable')) continue;
-      if (/\bPromise\.all\s*\(/.test(line)) {
-        violations.push({
-          file,
-          line: i + 1,
-          hint: 'Promise.all on the lifecycle surface interleaves ledger writes. The ledger is append-only; writes must stay sequential.',
-        });
-      }
-    }
-  }
-  return violations;
-}
-
-/**
- * Rule 3 enforcement (Story #2253 / Task #2255, Epic #2172 review
- * High-1). Returns an array of `{ file, line, hint }` violations for
- * any file under `rootDir` (recursively) whose source — with comments
- * stripped — contains a string literal carrying the substring
- * `gh pr merge`. The allow-list (`automerge-armer.js`) and the
- * infrastructure list (the lint script + fixtures it owns) are
- * matched by absolute-path suffix.
- *
- * Exposed for unit tests so the lockout contract can be exercised
- * against synthetic fixture trees without polluting the live source.
- */
-export function findMergeLockoutViolations(
-  rootDir,
-  {
-    read = readFileSync,
-    allowSuffixes = MERGE_LOCKOUT_ALLOWED_SUFFIXES,
-    infrastructureSuffixes = MERGE_LOCKOUT_INFRASTRUCTURE_SUFFIXES,
-  } = {},
-) {
-  const violations = [];
-  // The literal we forbid. Kept in a constant so we can refer to it in
-  // the violation `hint` without the literal appearing as a string in
-  // arbitrary positions. The space matters — `gh-pr-merge` is not the
-  // CLI, only the space-delimited form is.
-  const FORBIDDEN = 'gh pr merge';
-  const lineRe = /(['"`])((?:\\.|(?!\1).)*)\1/g;
-  for (const file of walkFilesByExtension(rootDir, '.js')) {
-    // Skip the armer (intentional carrier) and the lint infrastructure.
-    const allExempt = [...allowSuffixes, ...infrastructureSuffixes];
-    if (allExempt.some((suffix) => file.endsWith(suffix))) continue;
-
-    const raw = read(file, 'utf8');
-    const rawLines = raw.split('\n');
-    const stripped = stripJsComments(raw);
-    const lines = stripped.split('\n');
-    for (let i = 0; i < lines.length; i += 1) {
-      const line = lines[i];
-      // Honour the opt-out marker; it lives in a comment (and is
-      // therefore stripped above), so consult the RAW line for the
-      // marker check. Kept consistent with Rule 1.
-      const rawLine = rawLines[i] ?? '';
-      if (rawLine.includes('lint-lifecycle-disable')) continue;
-      // Find every string literal on the (comment-stripped) line and
-      // inspect its body.
-      lineRe.lastIndex = 0;
-      let match = lineRe.exec(line);
-      while (match !== null) {
-        const literalBody = match[2];
-        if (literalBody.includes(FORBIDDEN)) {
-          violations.push({
-            file,
-            line: i + 1,
-            hint: `String literal containing '${FORBIDDEN}' is forbidden outside single-story-close/phases/auto-merge.js. Auto-merge enablement must flow through the Story close path.`,
-          });
-          break; // one violation per line is enough
-        }
-        match = lineRe.exec(line);
-      }
-    }
-  }
-  return violations;
-}
-
-/**
- * Parse the argument vector. The only option is the scan root; anything
- * else is ignored so an extra flag can never silently narrow the scan.
- *
- * @param {string[]} argv Arguments without the node/script entries.
- * @returns {{ root: string }}
- */
-function parseArgv(argv) {
-  let root = REPO_ROOT;
-  for (let i = 0; i < argv.length; i += 1) {
-    if (argv[i] === '--root') {
-      i += 1;
-      root = path.resolve(String(argv[i] ?? '.'));
-    }
-  }
-  return { root };
-}
-
-async function main() {
-  const { root } = parseArgv(process.argv.slice(2));
-  // Per-rule discovery. Both rules' exemptions match by absolute-path
-  // SUFFIX, which is what lets an injected root keep the same allow-list
-  // semantics as the live tree — do not re-anchor them to `root`.
-  const v1 = findPromiseAllViolations(lifecycleDirFor(root));
-  const v3 = findMergeLockoutViolations(scriptsDirFor(root));
-  const all = [
-    ...v1.map((v) => ({ rule: 'no-promise-all-lifecycle', ...v })),
-    ...v3.map((v) => ({ rule: 'merge-lockout', ...v })),
-  ];
-  if (all.length === 0) {
-    process.stdout.write(
-      '[lifecycle-lint] clean: no Promise.all on the lifecycle surface; no merge-lockout violations.\n',
-    );
-    return 0;
-  }
-  for (const v of all) {
-    // Both finders always stamp a 1-based `line`, so there is no file-only
-    // fallback to render — the ternary that used to guard this was an
-    // unreachable branch (Story #5024).
-    process.stderr.write(
-      `[lifecycle-lint][${v.rule}] ${v.file}:${v.line}\n  ${v.hint}\n`,
-    );
-  }
-  return 1;
-}
-
-await runAsCli(import.meta.url, main, {
-  source: 'check-lifecycle-lint',
-  propagateExitCode: true,
-  usage: {
-    invocation: 'node .agents/scripts/check-lifecycle-lint.js [--root <dir>]',
-    summary:
-      'Enforce the two lifecycle lint rules biome cannot express: no Promise.all on the append-only lifecycle surface, and the auto-merge lockout on string literals under .agents/scripts/.',
-    flags: [
-      [
-        '--root <dir>',
-        'Repository root to scan (default: the checkout this script ships in). Both rule surfaces derive from it; used by tests so a planted violation never touches the shared tree.',
-      ],
-    ],
-    notes: [
-      'Ships as part of `npm run lint`, which invokes it with no arguments.',
-      'Exit codes:\n  0  clean\n  1  at least one violation; offending file and line printed to stderr',
-    ],
-  },
-});