pumuki 6.3.7

package/integrations/evidence/writeEvidence.ts

@@ -0,0 +1,201 @@
+import { execFileSync } from 'node:child_process';
+import { writeFileSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve } from 'node:path';
+import type {
+  AiEvidenceV2_1,
+  CompatibilityViolation,
+  EvidenceLines,
+  LedgerEntry,
+  SnapshotFinding,
+} from './schema';
+import { normalizeHumanIntent } from './humanIntent';
+
+export type WriteEvidenceResult = {
+  ok: boolean;
+  path: string;
+  error?: string;
+};
+
+const EVIDENCE_FILE_NAME = '.ai_evidence.json';
+
+const normalizeLines = (lines?: EvidenceLines): EvidenceLines | undefined => {
+  if (typeof lines === 'undefined') {
+    return undefined;
+  }
+  if (typeof lines === 'string') {
+    const trimmed = lines.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+  }
+  if (typeof lines === 'number') {
+    return Number.isFinite(lines) ? Math.trunc(lines) : undefined;
+  }
+
+  const normalized = Array.from(
+    new Set(lines.filter((line) => Number.isFinite(line)).map((line) => Math.trunc(line)))
+  ).sort((a, b) => a - b);
+
+  return normalized.length > 0 ? normalized : undefined;
+};
+
+const linesKey = (lines?: EvidenceLines): string => {
+  if (typeof lines === 'undefined') {
+    return '';
+  }
+  if (typeof lines === 'string' || typeof lines === 'number') {
+    return String(lines);
+  }
+  return lines.join(',');
+};
+
+const findingKey = (finding: Pick<SnapshotFinding, 'ruleId' | 'file' | 'lines'>): string => {
+  return `${finding.ruleId}::${finding.file}::${linesKey(finding.lines)}`;
+};
+
+const ledgerKey = (entry: Pick<LedgerEntry, 'ruleId' | 'file' | 'lines'>): string => {
+  return `${entry.ruleId}::${entry.file}::${linesKey(entry.lines)}`;
+};
+
+const toRelativeRepoPath = (repoRoot: string, inputPath: string): string => {
+  const normalized = inputPath.replace(/\\/g, '/');
+  const absolutePath = isAbsolute(normalized)
+    ? normalized
+    : resolve(repoRoot, normalized);
+  const rel = relative(repoRoot, absolutePath).replace(/\\/g, '/');
+  if (rel.length > 0 && !rel.startsWith('..')) {
+    return rel;
+  }
+  return normalized;
+};
+
+const normalizeFindingPath = (
+  finding: SnapshotFinding,
+  repoRoot: string
+): SnapshotFinding => {
+  return {
+    ruleId: finding.ruleId,
+    severity: finding.severity,
+    code: finding.code,
+    message: finding.message,
+    file: toRelativeRepoPath(repoRoot, finding.file),
+    lines: normalizeLines(finding.lines),
+  };
+};
+
+const normalizeLedgerPath = (entry: LedgerEntry, repoRoot: string): LedgerEntry => {
+  return {
+    ruleId: entry.ruleId,
+    file: toRelativeRepoPath(repoRoot, entry.file),
+    lines: normalizeLines(entry.lines),
+    firstSeen: entry.firstSeen,
+    lastSeen: entry.lastSeen,
+  };
+};
+
+const toCompatibilityViolations = (
+  findings: ReadonlyArray<SnapshotFinding>
+): CompatibilityViolation[] => {
+  return findings.map((finding) => ({
+    ruleId: finding.ruleId,
+    level: finding.severity,
+    code: finding.code,
+    message: finding.message,
+    file: finding.file,
+    lines: finding.lines,
+  }));
+};
+
+const toStableEvidence = (
+  evidence: AiEvidenceV2_1,
+  repoRoot: string
+): AiEvidenceV2_1 => {
+  const normalizedFindings = evidence.snapshot.findings
+    .map((finding) => normalizeFindingPath(finding, repoRoot))
+    .sort((left, right) => findingKey(left).localeCompare(findingKey(right)));
+
+  const normalizedLedger = evidence.ledger
+    .map((entry) => normalizeLedgerPath(entry, repoRoot))
+    .sort((left, right) => ledgerKey(left).localeCompare(ledgerKey(right)));
+
+  const orderedPlatforms: AiEvidenceV2_1['platforms'] = {};
+  for (const platform of Object.keys(evidence.platforms).sort()) {
+    orderedPlatforms[platform] = {
+      detected: evidence.platforms[platform].detected,
+      confidence: evidence.platforms[platform].confidence,
+    };
+  }
+
+  const orderedRulesets = [...evidence.rulesets]
+    .map((ruleset) => ({
+      platform: ruleset.platform,
+      bundle: ruleset.bundle,
+      hash: ruleset.hash,
+    }))
+    .sort((left, right) => {
+      const byPlatform = left.platform.localeCompare(right.platform);
+      return byPlatform !== 0 ? byPlatform : left.bundle.localeCompare(right.bundle);
+    });
+
+  const bySeverity = {
+    CRITICAL: evidence.severity_metrics.by_severity.CRITICAL,
+    ERROR: evidence.severity_metrics.by_severity.ERROR,
+    WARN: evidence.severity_metrics.by_severity.WARN,
+    INFO: evidence.severity_metrics.by_severity.INFO,
+  };
+  const normalizedHumanIntent = normalizeHumanIntent(evidence.human_intent);
+
+  return {
+    version: '2.1',
+    timestamp: evidence.timestamp,
+    snapshot: {
+      stage: evidence.snapshot.stage,
+      outcome: evidence.snapshot.outcome,
+      findings: normalizedFindings,
+    },
+    ledger: normalizedLedger,
+    platforms: orderedPlatforms,
+    rulesets: orderedRulesets,
+    human_intent: normalizedHumanIntent,
+    ai_gate: {
+      status: evidence.ai_gate.status,
+      violations: toCompatibilityViolations(normalizedFindings),
+      human_intent: normalizedHumanIntent,
+    },
+    severity_metrics: {
+      gate_status: evidence.severity_metrics.gate_status,
+      total_violations: evidence.severity_metrics.total_violations,
+      by_severity: bySeverity,
+    },
+  };
+};
+
+const resolveRepoRoot = (): string => {
+  try {
+    return execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      encoding: 'utf8',
+    }).trim();
+  } catch {
+    return process.cwd();
+  }
+};
+
+export function writeEvidence(evidence: AiEvidenceV2_1): WriteEvidenceResult {
+  const repoRoot = resolveRepoRoot();
+  const outputPath = join(repoRoot, EVIDENCE_FILE_NAME);
+
+  try {
+    const stableEvidence = toStableEvidence(evidence, repoRoot);
+    writeFileSync(outputPath, `${JSON.stringify(stableEvidence, null, 2)}\n`, 'utf8');
+    return {
+      ok: true,
+      path: outputPath,
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`[ai-evidence] ${message}`);
+    return {
+      ok: false,
+      path: outputPath,
+      error: message,
+    };
+  }
+}

package/integrations/gate/stagePolicies.ts

@@ -0,0 +1,295 @@
+import { createHash } from 'node:crypto';
+import type { GatePolicy } from '../../core/gate/GatePolicy';
+import type { GateStage } from '../../core/gate/GateStage';
+import type { RuleSet } from '../../core/rules/RuleSet';
+import {
+  createSkillsPolicyDeterministicHash,
+  loadSkillsPolicy,
+} from '../config/skillsPolicy';
+import type { SkillsStage } from '../config/skillsLock';
+
+const promotedHeuristicRuleIds = new Set<string>([
+  'heuristics.ts.console-log.ast',
+  'heuristics.ts.console-error.ast',
+  'heuristics.ts.eval.ast',
+  'heuristics.ts.function-constructor.ast',
+  'heuristics.ts.set-timeout-string.ast',
+  'heuristics.ts.set-interval-string.ast',
+  'heuristics.ts.new-promise-async.ast',
+  'heuristics.ts.with-statement.ast',
+  'heuristics.ts.process-exit.ast',
+  'heuristics.ts.delete-operator.ast',
+  'heuristics.ts.inner-html.ast',
+  'heuristics.ts.document-write.ast',
+  'heuristics.ts.insert-adjacent-html.ast',
+  'heuristics.ts.child-process-import.ast',
+  'heuristics.ts.process-env-mutation.ast',
+  'heuristics.ts.hardcoded-secret-token.ast',
+  'heuristics.ts.weak-crypto-hash.ast',
+  'heuristics.ts.insecure-token-math-random.ast',
+  'heuristics.ts.insecure-token-date-now.ast',
+  'heuristics.ts.weak-token-randomuuid.ast',
+  'heuristics.ts.jwt-decode-without-verify.ast',
+  'heuristics.ts.jwt-verify-ignore-expiration.ast',
+  'heuristics.ts.jwt-sign-no-expiration.ast',
+  'heuristics.ts.tls-reject-unauthorized-false.ast',
+  'heuristics.ts.dynamic-shell-invocation.ast',
+  'heuristics.ts.tls-env-override.ast',
+  'heuristics.ts.child-process-shell-true.ast',
+  'heuristics.ts.vm-dynamic-code-execution.ast',
+  'heuristics.ts.child-process-exec-file-untrusted-args.ast',
+  'heuristics.ts.buffer-alloc-unsafe.ast',
+  'heuristics.ts.buffer-alloc-unsafe-slow.ast',
+  'heuristics.ts.fs-write-file-sync.ast',
+  'heuristics.ts.fs-rm-sync.ast',
+  'heuristics.ts.fs-mkdir-sync.ast',
+  'heuristics.ts.fs-readdir-sync.ast',
+  'heuristics.ts.fs-read-file-sync.ast',
+  'heuristics.ts.fs-stat-sync.ast',
+  'heuristics.ts.fs-statfs-sync.ast',
+  'heuristics.ts.fs-realpath-sync.ast',
+  'heuristics.ts.fs-lstat-sync.ast',
+  'heuristics.ts.fs-exists-sync.ast',
+  'heuristics.ts.fs-access-sync.ast',
+  'heuristics.ts.fs-utimes-sync.ast',
+  'heuristics.ts.fs-rename-sync.ast',
+  'heuristics.ts.fs-copy-file-sync.ast',
+  'heuristics.ts.fs-unlink-sync.ast',
+  'heuristics.ts.fs-truncate-sync.ast',
+  'heuristics.ts.fs-rmdir-sync.ast',
+  'heuristics.ts.fs-chmod-sync.ast',
+  'heuristics.ts.fs-chown-sync.ast',
+  'heuristics.ts.fs-fchown-sync.ast',
+  'heuristics.ts.fs-fchmod-sync.ast',
+  'heuristics.ts.fs-fstat-sync.ast',
+  'heuristics.ts.fs-ftruncate-sync.ast',
+  'heuristics.ts.fs-futimes-sync.ast',
+  'heuristics.ts.fs-lutimes-sync.ast',
+  'heuristics.ts.fs-readv-sync.ast',
+  'heuristics.ts.fs-writev-sync.ast',
+  'heuristics.ts.fs-write-sync.ast',
+  'heuristics.ts.fs-fsync-sync.ast',
+  'heuristics.ts.fs-fdatasync-sync.ast',
+  'heuristics.ts.fs-close-sync.ast',
+  'heuristics.ts.fs-read-sync.ast',
+  'heuristics.ts.fs-readlink-sync.ast',
+  'heuristics.ts.fs-symlink-sync.ast',
+  'heuristics.ts.fs-link-sync.ast',
+  'heuristics.ts.fs-cp-sync.ast',
+  'heuristics.ts.fs-open-sync.ast',
+  'heuristics.ts.fs-opendir-sync.ast',
+  'heuristics.ts.fs-mkdtemp-sync.ast',
+  'heuristics.ts.child-process-exec-sync.ast',
+  'heuristics.ts.child-process-exec.ast',
+  'heuristics.ts.child-process-spawn-sync.ast',
+  'heuristics.ts.child-process-spawn.ast',
+  'heuristics.ts.child-process-fork.ast',
+  'heuristics.ts.child-process-exec-file-sync.ast',
+  'heuristics.ts.fs-append-file-sync.ast',
+  'heuristics.ts.fs-promises-write-file.ast',
+  'heuristics.ts.fs-promises-append-file.ast',
+  'heuristics.ts.fs-promises-rm.ast',
+  'heuristics.ts.fs-promises-unlink.ast',
+  'heuristics.ts.fs-promises-read-file.ast',
+  'heuristics.ts.fs-promises-readdir.ast',
+  'heuristics.ts.fs-promises-mkdir.ast',
+  'heuristics.ts.fs-promises-stat.ast',
+  'heuristics.ts.fs-promises-copy-file.ast',
+  'heuristics.ts.fs-promises-rename.ast',
+  'heuristics.ts.fs-promises-access.ast',
+  'heuristics.ts.fs-promises-chmod.ast',
+  'heuristics.ts.fs-promises-chown.ast',
+  'heuristics.ts.fs-promises-utimes.ast',
+  'heuristics.ts.fs-promises-lstat.ast',
+  'heuristics.ts.fs-promises-realpath.ast',
+  'heuristics.ts.fs-promises-symlink.ast',
+  'heuristics.ts.fs-promises-link.ast',
+  'heuristics.ts.fs-promises-readlink.ast',
+  'heuristics.ts.fs-promises-open.ast',
+  'heuristics.ts.fs-promises-opendir.ast',
+  'heuristics.ts.fs-promises-cp.ast',
+  'heuristics.ts.fs-promises-mkdtemp.ast',
+  'heuristics.ts.fs-utimes-callback.ast',
+  'heuristics.ts.fs-watch-callback.ast',
+  'heuristics.ts.fs-watch-file-callback.ast',
+  'heuristics.ts.fs-unwatch-file-callback.ast',
+  'heuristics.ts.fs-read-file-callback.ast',
+  'heuristics.ts.fs-exists-callback.ast',
+  'heuristics.ts.fs-write-file-callback.ast',
+  'heuristics.ts.fs-append-file-callback.ast',
+  'heuristics.ts.fs-readdir-callback.ast',
+  'heuristics.ts.fs-mkdir-callback.ast',
+  'heuristics.ts.fs-rmdir-callback.ast',
+  'heuristics.ts.fs-rm-callback.ast',
+  'heuristics.ts.fs-rename-callback.ast',
+  'heuristics.ts.fs-copy-file-callback.ast',
+  'heuristics.ts.fs-stat-callback.ast',
+  'heuristics.ts.fs-statfs-callback.ast',
+  'heuristics.ts.fs-lstat-callback.ast',
+  'heuristics.ts.fs-realpath-callback.ast',
+  'heuristics.ts.fs-access-callback.ast',
+  'heuristics.ts.fs-chmod-callback.ast',
+  'heuristics.ts.fs-chown-callback.ast',
+  'heuristics.ts.fs-lchown-callback.ast',
+  'heuristics.ts.fs-lchmod-callback.ast',
+  'heuristics.ts.fs-unlink-callback.ast',
+  'heuristics.ts.fs-readlink-callback.ast',
+  'heuristics.ts.fs-symlink-callback.ast',
+  'heuristics.ts.fs-fsync-callback.ast',
+  'heuristics.ts.fs-fdatasync-callback.ast',
+  'heuristics.ts.fs-fchown-callback.ast',
+  'heuristics.ts.fs-fchmod-callback.ast',
+  'heuristics.ts.fs-fstat-callback.ast',
+  'heuristics.ts.fs-ftruncate-callback.ast',
+  'heuristics.ts.fs-truncate-callback.ast',
+  'heuristics.ts.fs-futimes-callback.ast',
+  'heuristics.ts.fs-lutimes-callback.ast',
+  'heuristics.ts.fs-link-callback.ast',
+  'heuristics.ts.fs-mkdtemp-callback.ast',
+  'heuristics.ts.fs-opendir-callback.ast',
+  'heuristics.ts.fs-open-callback.ast',
+  'heuristics.ts.fs-cp-callback.ast',
+  'heuristics.ts.fs-close-callback.ast',
+  'heuristics.ts.fs-read-callback.ast',
+  'heuristics.ts.fs-readv-callback.ast',
+  'heuristics.ts.fs-writev-callback.ast',
+  'heuristics.ts.fs-write-callback.ast',
+  'heuristics.ts.child-process-exec-file.ast',
+  'heuristics.ts.explicit-any.ast',
+  'heuristics.ts.debugger.ast',
+  'heuristics.ios.force-unwrap.ast',
+  'heuristics.ios.anyview.ast',
+  'heuristics.ios.force-try.ast',
+  'heuristics.ios.force-cast.ast',
+  'heuristics.ios.callback-style.ast',
+  'heuristics.android.thread-sleep.ast',
+  'heuristics.android.globalscope.ast',
+  'heuristics.android.run-blocking.ast',
+]);
+
+const shouldPromoteHeuristicRule = (ruleId: string, stage: GateStage): boolean => {
+  if (stage !== 'PRE_PUSH' && stage !== 'CI') {
+    return false;
+  }
+  return promotedHeuristicRuleIds.has(ruleId);
+};
+
+export type ResolvedStagePolicy = {
+  policy: GatePolicy;
+  trace: {
+    source: 'default' | 'skills.policy';
+    bundle: string;
+    hash: string;
+  };
+};
+
+const defaultPolicyByStage: Record<SkillsStage, GatePolicy> = {
+  PRE_COMMIT: {
+    stage: 'PRE_COMMIT',
+    blockOnOrAbove: 'CRITICAL',
+    warnOnOrAbove: 'ERROR',
+  },
+  PRE_PUSH: {
+    stage: 'PRE_PUSH',
+    blockOnOrAbove: 'ERROR',
+    warnOnOrAbove: 'WARN',
+  },
+  CI: {
+    stage: 'CI',
+    blockOnOrAbove: 'ERROR',
+    warnOnOrAbove: 'WARN',
+  },
+};
+
+const createPolicyTraceHash = (params: {
+  stage: SkillsStage;
+  source: 'default' | 'skills.policy';
+  blockOnOrAbove: GatePolicy['blockOnOrAbove'];
+  warnOnOrAbove: GatePolicy['warnOnOrAbove'];
+  sourcePolicyHash?: string;
+}): string => {
+  return createHash('sha256')
+    .update(
+      JSON.stringify({
+        stage: params.stage,
+        source: params.source,
+        blockOnOrAbove: params.blockOnOrAbove,
+        warnOnOrAbove: params.warnOnOrAbove,
+        sourcePolicyHash: params.sourcePolicyHash ?? null,
+      })
+    )
+    .digest('hex');
+};
+
+export const resolvePolicyForStage = (
+  stage: SkillsStage,
+  repoRoot: string = process.cwd()
+): ResolvedStagePolicy => {
+  const defaults = defaultPolicyByStage[stage];
+  const loadedPolicy = loadSkillsPolicy(repoRoot);
+  const stageOverride = loadedPolicy?.stages[stage];
+
+  if (!stageOverride) {
+    return {
+      policy: defaults,
+      trace: {
+        source: 'default',
+        bundle: `gate-policy.default.${stage}`,
+        hash: createPolicyTraceHash({
+          stage,
+          source: 'default',
+          blockOnOrAbove: defaults.blockOnOrAbove,
+          warnOnOrAbove: defaults.warnOnOrAbove,
+        }),
+      },
+    };
+  }
+
+  const resolvedPolicy: GatePolicy = {
+    stage: defaults.stage,
+    blockOnOrAbove: stageOverride.blockOnOrAbove,
+    warnOnOrAbove: stageOverride.warnOnOrAbove,
+  };
+
+  return {
+    policy: resolvedPolicy,
+    trace: {
+      source: 'skills.policy',
+      bundle: `gate-policy.skills.policy.${stage}`,
+      hash: createPolicyTraceHash({
+        stage,
+        source: 'skills.policy',
+        blockOnOrAbove: resolvedPolicy.blockOnOrAbove,
+        warnOnOrAbove: resolvedPolicy.warnOnOrAbove,
+        sourcePolicyHash: createSkillsPolicyDeterministicHash(loadedPolicy),
+      }),
+    },
+  };
+};
+
+export const applyHeuristicSeverityForStage = (
+  rules: RuleSet,
+  stage: GateStage
+): RuleSet => {
+  return rules.map((rule) => {
+    if (!shouldPromoteHeuristicRule(rule.id, stage)) {
+      return rule;
+    }
+    return {
+      ...rule,
+      severity: 'ERROR',
+    };
+  });
+};
+
+export const policyForPreCommit = (): GatePolicy => {
+  return defaultPolicyByStage.PRE_COMMIT;
+};
+
+export const policyForPrePush = (): GatePolicy => {
+  return defaultPolicyByStage.PRE_PUSH;
+};
+
+export const policyForCI = (): GatePolicy => {
+  return defaultPolicyByStage.CI;
+};

package/integrations/git/EvidenceService.ts

@@ -0,0 +1,111 @@
+import { createHash } from 'node:crypto';
+import type { RuleSet } from '../../core/rules/RuleSet';
+import { stableStringify } from '../../core/utils/stableStringify';
+import { readEvidence } from '../evidence/readEvidence';
+import type { AiEvidenceV2_1, PlatformState, RulesetState } from '../evidence/schema';
+import type { GatePolicy } from '../../core/gate/GatePolicy';
+import type { ResolvedStagePolicy } from '../gate/stagePolicies';
+import { detectPlatformsFromFacts } from '../platform/detectPlatforms';
+
+export type BaselineRuleSetEntry = {
+  platform: string;
+  bundle: string;
+  rules: RuleSet;
+};
+
+
+export interface IEvidenceService {
+  loadPreviousEvidence(repoRoot: string): AiEvidenceV2_1 | undefined;
+  toDetectedPlatformsRecord(
+    detected: ReturnType<typeof detectPlatformsFromFacts>
+  ): Record<string, PlatformState>;
+  buildRulesetState(params: {
+    baselineRuleSets: ReadonlyArray<BaselineRuleSetEntry>;
+    projectRules: RuleSet;
+    heuristicRules: RuleSet;
+    heuristicsBundle: string;
+    skillsBundles: ReadonlyArray<{ name: string; version: string; hash: string }>;
+    policyTrace?: ResolvedStagePolicy['trace'];
+    stage: GatePolicy['stage'];
+  }): RulesetState[];
+}
+
+export class EvidenceService implements IEvidenceService {
+  loadPreviousEvidence(repoRoot: string): AiEvidenceV2_1 | undefined {
+    return readEvidence(repoRoot);
+  }
+
+  toDetectedPlatformsRecord(
+    detected: ReturnType<typeof detectPlatformsFromFacts>
+  ): Record<string, PlatformState> {
+    const result: Record<string, PlatformState> = {};
+    for (const [platform, state] of Object.entries(detected)) {
+      if (!state) {
+        continue;
+      }
+      result[platform] = state;
+    }
+    return result;
+  }
+
+  buildRulesetState(params: {
+    baselineRuleSets: ReadonlyArray<BaselineRuleSetEntry>;
+    projectRules: RuleSet;
+    heuristicRules: RuleSet;
+    heuristicsBundle: string;
+    skillsBundles: ReadonlyArray<{ name: string; version: string; hash: string }>;
+    policyTrace?: ResolvedStagePolicy['trace'];
+    stage: GatePolicy['stage'];
+  }): RulesetState[] {
+    const states: RulesetState[] = [];
+
+    for (const entry of params.baselineRuleSets) {
+      states.push({
+        platform: entry.platform,
+        bundle: entry.bundle,
+        hash: createHash('sha256')
+          .update(stableStringify(entry.rules))
+          .digest('hex'),
+      });
+    }
+
+    if (params.projectRules.length > 0) {
+      states.push({
+        platform: 'project',
+        bundle: 'project-rules',
+        hash: createHash('sha256')
+          .update(stableStringify(params.projectRules))
+          .digest('hex'),
+      });
+    }
+
+    if (params.heuristicRules.length > 0) {
+      states.push({
+        platform: 'heuristics',
+        bundle: params.heuristicsBundle,
+        hash: createHash('sha256')
+          .update(`stage:${params.stage}`)
+          .update(stableStringify(params.heuristicRules))
+          .digest('hex'),
+      });
+    }
+
+    for (const bundle of params.skillsBundles) {
+      states.push({
+        platform: 'skills',
+        bundle: `${bundle.name}@${bundle.version}`,
+        hash: bundle.hash,
+      });
+    }
+
+    if (params.policyTrace) {
+      states.push({
+        platform: 'policy',
+        bundle: params.policyTrace.bundle,
+        hash: params.policyTrace.hash,
+      });
+    }
+
+    return states;
+  }
+}

package/integrations/git/GitService.ts

@@ -0,0 +1,35 @@
+import { execFileSync } from 'node:child_process';
+import type { Fact } from '../../core/facts/Fact';
+import { parseNameStatus, hasAllowedExtension, buildFactsFromChanges } from './gitDiffUtils';
+export { parseNameStatus } from './gitDiffUtils';
+
+export interface IGitService {
+  runGit(args: ReadonlyArray<string>, cwd?: string): string;
+  getStagedFacts(extensions: ReadonlyArray<string>): ReadonlyArray<Fact>;
+  resolveRepoRoot(): string;
+}
+
+export class GitService implements IGitService {
+  runGit(args: ReadonlyArray<string>, cwd?: string): string {
+    return execFileSync('git', args, { cwd, encoding: 'utf8' });
+  }
+
+  getStagedFacts(extensions: ReadonlyArray<string>): ReadonlyArray<Fact> {
+    const nameStatus = this.runGit(['diff', '--cached', '--name-status']);
+    const changes = parseNameStatus(nameStatus).filter((change) =>
+      hasAllowedExtension(change.path, extensions)
+    );
+
+    return buildFactsFromChanges(changes, 'git:staged', (filePath) =>
+      this.runGit(['show', `:${filePath}`])
+    );
+  }
+
+  resolveRepoRoot(): string {
+    try {
+      return this.runGit(['rev-parse', '--show-toplevel']).trim();
+    } catch {
+      return process.cwd();
+    }
+  }
+}

package/integrations/git/baselineRuleSets.ts

@@ -0,0 +1,58 @@
+import { androidRuleSet } from '../../core/rules/presets/androidRuleSet';
+import { backendRuleSet } from '../../core/rules/presets/backendRuleSet';
+import { frontendRuleSet } from '../../core/rules/presets/frontendRuleSet';
+import { iosEnterpriseRuleSet } from '../../core/rules/presets/iosEnterpriseRuleSet';
+import { rulePackVersions } from '../../core/rules/presets/rulePackVersions';
+import type { RuleSet } from '../../core/rules/RuleSet';
+import type { DetectedPlatforms } from '../platform/detectPlatforms';
+import type { BaselineRuleSetEntry } from './EvidenceService';
+
+export const buildCombinedBaselineRules = (detected: DetectedPlatforms): RuleSet => {
+  const rules: RuleSet[number][] = [];
+  if (detected.ios) {
+    rules.push(...iosEnterpriseRuleSet);
+  }
+  if (detected.backend) {
+    rules.push(...backendRuleSet);
+  }
+  if (detected.frontend) {
+    rules.push(...frontendRuleSet);
+  }
+  if (detected.android) {
+    rules.push(...androidRuleSet);
+  }
+  return rules;
+};
+
+export const buildBaselineRuleSetEntries = (detected: DetectedPlatforms): BaselineRuleSetEntry[] => {
+  const entries: BaselineRuleSetEntry[] = [];
+  if (detected.ios) {
+    entries.push({
+      platform: 'ios',
+      bundle: `iosEnterpriseRuleSet@${rulePackVersions.iosEnterpriseRuleSet}`,
+      rules: iosEnterpriseRuleSet,
+    });
+  }
+  if (detected.backend) {
+    entries.push({
+      platform: 'backend',
+      bundle: `backendRuleSet@${rulePackVersions.backendRuleSet}`,
+      rules: backendRuleSet,
+    });
+  }
+  if (detected.frontend) {
+    entries.push({
+      platform: 'frontend',
+      bundle: `frontendRuleSet@${rulePackVersions.frontendRuleSet}`,
+      rules: frontendRuleSet,
+    });
+  }
+  if (detected.android) {
+    entries.push({
+      platform: 'android',
+      bundle: `androidRuleSet@${rulePackVersions.androidRuleSet}`,
+      rules: androidRuleSet,
+    });
+  }
+  return entries;
+};