redlinegate 0.0.1 → 0.0.2

package/dist/ui/wizard.js

@@ -0,0 +1,179 @@
+import { RUNGS } from "../enforce/ladder.js";
+// Plain-English, at the moment of choosing. Every one of these was a term the
+// operator met for the first time in output that assumed they knew it.
+const RUNG_HINTS = {
+    observe: 'comments only — the check is always green. Start here',
+    warn: 'comments and labels the PR — still never blocks a merge',
+    'block-blocker': 'a BLOCKER finding fails the check and stops the merge',
+    'block-high': 'BLOCKER and HIGH both stop the merge — the strictest rung',
+};
+const CAPABILITY_HINTS = {
+    gate: 'the pull request check that runs the review',
+    'merge-policy': 'branch protection requiring the check and an approval',
+    labels: 'the labels the gate uses to mark and exempt a pull request',
+    'review-ownership': 'seeds CODEOWNERS — off unless you ask, it can block every PR',
+};
+// Which Redline check a tool the repository already runs makes redundant.
+// Phrased as what the operator would otherwise get twice, because "stands down
+// the dependencies job" means nothing to someone meeting Redline today.
+const STAND_DOWN_LABEL = {
+    secrets: 'secret scanning',
+    dependencies: 'dependency vulnerability review',
+    policy: 'static analysis',
+};
+function profileChoices(manifest, detected) {
+    const ids = Object.keys(manifest.profiles).sort((a, b) => {
+        if (a === detected)
+            return -1;
+        if (b === detected)
+            return 1;
+        return a.localeCompare(b);
+    });
+    return ids.map((id) => {
+        // The stacks' own titles, not their ids. `JavaScript, React (web)` tells an
+        // operator what they are choosing; `javascript, react` makes them guess at
+        // the difference between two profiles that share a prefix.
+        const stacks = (manifest.profiles[id] ?? []).map((stack) => manifest.stacks[stack]?.title ?? stack);
+        return {
+            value: id,
+            label: id,
+            hint: stacks.join(', ') + (id === detected ? '   (detected)' : ''),
+        };
+    });
+}
+// Every vendor the standards know about, including the ones this organisation
+// has switched off — shown greyed with the reason rather than filtered out.
+//
+// Hiding them was wrong for the same reason hiding a covered capability would
+// be: an operator looking for Cursor and not finding it cannot tell whether
+// Redline forgot about Cursor, does not support it, or was told not to render
+// for it here. Only the last is true, and only the last is something they can
+// go and change.
+function vendorChoices(manifest) {
+    return Object.entries(manifest.vendors).map(([id, vendor]) => ({
+        value: id,
+        label: id,
+        ...(vendor.enabled
+            ? { hint: vendor.title }
+            : // Reason first: a long vendor title truncates, and the half worth
+                // keeping is the part that says why the row cannot be picked.
+                { disabled: `not enabled for this organisation — ${vendor.title}` }),
+    }));
+}
+/**
+ * Run the menu.
+ *
+ * Every question is skippable in the sense that it has a preselected answer;
+ * none is skippable in the sense of being hidden. A capability the repository
+ * already covers is still shown — deselected, with the tool that covers it
+ * named — because an operator who cannot see a decision cannot overrule it,
+ * and this repository's detection is wrong often enough that overruling has to
+ * stay one keystroke away.
+ */
+export async function runWizard(p, facts) {
+    const { manifest, survey, recorded } = facts;
+    p.intro('Redline');
+    // Multi-select, because a repository is routinely more than one bundle: a
+    // React application with its own Terraform beside it is `web,infra`, and a
+    // single-choice question made it pick the half that fitted worst.
+    //
+    // `.redline.json` still records one string — resolveProfile takes the list
+    // and sorts it — so nothing downstream had to learn a new shape.
+    const recordedProfiles = recorded?.profile?.split(',').map((s) => s.trim());
+    const profiles = await p.multiselect('Which standards apply here?', profileChoices(manifest, facts.detectedProfile), recordedProfiles ?? [facts.detectedProfile]);
+    // Deselecting everything renders no rules at all, which is never what the
+    // operator meant by "none of these" — they meant they could not find theirs.
+    // Falling back to what was detected keeps the run useful and keeps the answer
+    // visible in the summary, where it can be changed.
+    const profile = profiles.length > 0 ? profiles.join(',') : facts.detectedProfile;
+    const hostChoices = [
+        {
+            value: 'github',
+            label: 'GitHub',
+            hint: 'GitHub.com or GitHub Enterprise Server' + (facts.detectedHost === 'github' ? '   (detected)' : ''),
+        },
+        {
+            value: 'azure',
+            label: 'Azure DevOps',
+            // Deliberately no hostnames: cli/platforms/__tests__/boundary.test.ts
+            // holds the line that only an adapter knows what a host's URLs look like,
+            // and a menu hint is not an adapter.
+            hint: 'Azure Repos' + (facts.detectedHost === 'azure' ? '   (detected)' : ''),
+        },
+    ];
+    const host = await p.select('Where does this repository live?', hostChoices, facts.detectedHost ?? 'github');
+    // Asked separately from the host because the two genuinely come apart: every
+    // VFUK repository is on github.com and built by Azure Pipelines. Deriving the
+    // pipeline from the host is what put a GitHub Actions caller into a repo
+    // whose real gate is `cicd/pre-merge.yaml`.
+    const pipelineChoices = [
+        {
+            value: 'github-actions',
+            label: 'GitHub Actions',
+            hint: 'a workflow under .github/workflows',
+        },
+        {
+            value: 'azure-pipelines',
+            label: 'Azure Pipelines',
+            hint: facts.existingPipeline === null
+                ? 'a stage in an Azure pipeline definition'
+                : `a stage added to ${facts.existingPipeline}   (detected)`,
+        },
+    ];
+    const pipeline = await p.select('What runs your pull request checks?', pipelineChoices, facts.existingPipeline !== null ? 'azure-pipelines' : 'github-actions');
+    const vendors = await p.multiselect('Which assistants should read the standards?', vendorChoices(manifest), [...(recorded?.vendors ?? facts.detectedVendors)]);
+    const contexts = await p.multiselect('Extra context to render beside the rules', [
+        {
+            value: 'speckit',
+            label: 'Spec-driven development',
+            hint: 'how to work from a spec — dropped automatically if you already run Spec Kit',
+        },
+        {
+            value: 'tmf',
+            label: 'TM Forum',
+            hint: 'resource naming, @type, paging, error bodies. Only if you implement TMF APIs',
+        },
+    ], ['speckit']);
+    // A capability a detected tool already covers starts deselected and says
+    // which tool. `standDown` is advisory: nothing here is decided for the
+    // operator, only defaulted.
+    const covered = new Map();
+    for (const tool of survey.tools) {
+        if (tool.standsDown === null)
+            continue;
+        covered.set(tool.standsDown, tool.label);
+    }
+    const capabilityChoices = Object.entries(CAPABILITY_HINTS).map(([id, hint]) => ({ value: id, label: id, hint }));
+    const capabilities = await p.multiselect('What should Redline install?', capabilityChoices, ['gate', 'merge-policy', 'labels']);
+    if (covered.size > 0) {
+        const named = [...covered]
+            .map(([job, label]) => `${label} already covers ${STAND_DOWN_LABEL[job] ?? job}`)
+            .join('; ');
+        p.note(`${named}. Redline adds its own on top rather than replacing them.`);
+    }
+    const rung = await p.select('How hard should the check bite?', RUNGS.map((value) => ({ value, label: value, hint: RUNG_HINTS[value] })), recorded?.rung ?? 'observe');
+    const action = await p.select('Ready?', [
+        {
+            value: 'dry-run',
+            label: 'Dry run',
+            hint: 'print the plan — writes nothing, contacts no host, needs no credential',
+        },
+        {
+            value: 'apply',
+            label: 'Apply',
+            hint: 'write the files and open a pull request on redline/onboard',
+        },
+    ], 'dry-run');
+    return {
+        profile,
+        vendors,
+        host,
+        pipeline,
+        speckit: contexts.includes('speckit'),
+        tmf: contexts.includes('tmf'),
+        capabilities,
+        rung,
+        action,
+    };
+}
+//# sourceMappingURL=wizard.js.map

package/dist/ui/wizard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../cli/ui/wizard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAa,MAAM,sBAAsB,CAAC;AAyDxD,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,UAAU,GAAyB;IACvC,OAAO,EAAE,uDAAuD;IAChE,IAAI,EAAE,yDAAyD;IAC/D,eAAe,EAAE,uDAAuD;IACxE,YAAY,EAAE,2DAA2D;CAC1E,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,IAAI,EAAE,6CAA6C;IACnD,cAAc,EAAE,uDAAuD;IACvE,MAAM,EAAE,4DAA4D;IACpE,kBAAkB,EAAE,8DAA8D;CACnF,CAAC;AAEF,0EAA0E;AAC1E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,gBAAgB,GAA2B;IAC/C,OAAO,EAAE,iBAAiB;IAC1B,YAAY,EAAE,iCAAiC;IAC/C,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvD,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,4EAA4E;QAC5E,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,KAAK,CAClD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,iBAAiB;AACjB,SAAS,aAAa,CAAC,QAAkB;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;QACT,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE;YACxB,CAAC,CAAC,kEAAkE;gBAClE,8DAA8D;gBAC9D,EAAE,QAAQ,EAAE,uCAAuC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;KACzE,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAW,EAAE,KAAkB;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE7C,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEnB,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,EAAE;IACF,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAClC,6BAA6B,EAC7B,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,EAC/C,gBAAgB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAC5C,CAAC;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,mDAAmD;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAEjF,MAAM,WAAW,GAAmB;QAClC;YACE,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,wCAAwC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1G;QACD;YACE,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,cAAc;YACrB,sEAAsE;YACtE,0EAA0E;YAC1E,qCAAqC;YACrC,IAAI,EAAE,aAAa,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E;KACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CACzB,kCAAkC,EAClC,WAAW,EACX,KAAK,CAAC,YAAY,IAAI,QAAQ,CAC/B,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,eAAe,GAAuB;QAC1C;YACE,KAAK,EAAE,gBAAgB;YACvB,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,oCAAoC;SAC3C;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE,iBAAiB;YACxB,IAAI,EACF,KAAK,CAAC,gBAAgB,KAAK,IAAI;gBAC7B,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,eAAe;SAChE;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,CAC7B,qCAAqC,EACrC,eAAe,EACf,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,WAAW,CACjC,6CAA6C,EAC7C,aAAa,CAAC,QAAQ,CAAC,EACvB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAClD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAClC,0CAA0C,EAC1C;QACE;YACE,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,6EAA6E;SACpF;QACD;YACE,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,8EAA8E;SACrF;KACF,EACD,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,yEAAyE;IACzE,uEAAuE;IACvE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,SAAS;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,iBAAiB,GAAqB,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC9E,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CACjD,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,WAAW,CACtC,8BAA8B,EAC9B,iBAAiB,EACjB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CACnC,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC;aACvB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,mBAAmB,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;aAChF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,2DAA2D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CACzB,iCAAiC,EACjC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACxE,QAAQ,EAAE,IAAI,IAAI,SAAS,CAC5B,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAC3B,QAAQ,EACR;QACE;YACE,KAAK,EAAE,SAAkB;YACzB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,wEAAwE;SAC/E;QACD;YACE,KAAK,EAAE,OAAgB;YACvB,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,4DAA4D;SACnE;KACF,EACD,SAAS,CACV,CAAC;IAEF,OAAO;QACL,OAAO;QACP,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7B,YAAY;QACZ,IAAI;QACJ,MAAM;KACP,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,10 +1,18 @@
 {
   "name": "redlinegate",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Engineering control plane for AI-assisted development: standards, merge gates and evidence across GitHub and Azure DevOps",
   "type": "module",
   "license": "MIT",
   "homepage": "https://redline-gate.vercel.app",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/moelzanaty3/redline.git"
+  },
+  "bugs": {
+    "url": "https://github.com/moelzanaty3/redline/issues"
+  },
+  "author": "Mohamed Elzanaty (https://github.com/moelzanaty3)",
   "keywords": [
     "code-review",
     "ai-code-review",
@@ -28,6 +36,7 @@
     "redlinegate": "dist/bin/redline.js"
   },
   "files": [
+    "README.md",
     "LICENSE",
     "dist/",
     "scripts/",

package/platforms/azure/gate-template-github.yml

@@ -0,0 +1,152 @@
+# Managed by Redline; regenerate with `redline init` rather than editing here.
+# Redline merge gate for a GitHub-hosted repository built by Azure Pipelines.
+#
+# This is the combination the estate actually runs: the code lives on GitHub,
+# the pull request checks are Azure Pipelines. Neither of Redline's two original
+# paths fitted it — the GitHub path writes an Actions workflow the repository
+# never runs, and the Azure path installs a Build Validation policy against an
+# Azure Repos repository that does not exist here.
+#
+# CONTRACT: this pipeline reports to GitHub as a check named after its own
+# pipeline definition, published by the Azure Pipelines GitHub App. There is no
+# status POST here, unlike the Azure Repos template beside it: on a GitHub-hosted
+# repository the build result IS the check, and posting to the Azure Repos
+# statuses API would address a pull request that does not exist. The name a
+# branch ruleset must require is therefore the pipeline's name in Azure DevOps —
+# `redline init` prints it, and `redline verify` reads the reported names back.
+#
+# A `pr:` block IS honoured here. Azure Pipelines ignores `pr:` triggers only
+# for Azure *Repos*; for a GitHub-hosted repository they are the trigger
+# mechanism, which is why the Azure Repos template beside this one has none.
+
+pr:
+  branches:
+    include:
+      - main
+      - master
+
+trigger: none
+
+pool:
+  vmImage: ubuntu-latest
+
+variables:
+  ADR_DIFF_THRESHOLD: 300
+  FAIL_ON_DEPENDENCY_SEVERITY: high
+  SOFT_FAIL_LABELS: redline-exempt,redline-sync
+  # Declared with a default so the final step can read it even when the scan
+  # passed and never set it. An undeclared Azure variable interpolates as the
+  # literal string "$(NAME)" rather than empty, which is the kind of quiet
+  # wrong answer this gate exists to prevent.
+  REDLINE_SECURITY_FAILED: 'false'
+  # Pinned by image digest, not by tag: a tag is mutable and this scans the diff
+  # of every pull request in the repository. The version in the trailing comment
+  # is what scripts/check-pins.mjs re-resolves the digest against, exactly as it
+  # does for the SHA-pinned actions on the GitHub side of the gate.
+  TRUFFLEHOG_IMAGE: trufflesecurity/trufflehog@sha256:deb2af10659a488a14d262a323addcde099d99827a1cf1dc4e93c17915c39f08 # 3.97.1
+
+steps:
+  - checkout: self
+    fetchDepth: 0
+
+  - task: NodeTool@0
+    displayName: Node 22
+    inputs:
+      versionSpec: '22.x'
+
+  # No substitute in Mend or SonarQube: both scan a state of the tree, and a
+  # credential committed and reverted inside one pull request is still in the
+  # history the moment it merges. This scans the RANGE.
+  #
+  # `--results=verified` only: `unknown` produces false positives and this
+  # check cannot be waived by a label.
+  - script: |
+      set -euo pipefail
+      target="${SYSTEM_PULLREQUEST_TARGETBRANCH#refs/heads/}"
+      # The PR build checks out a merge commit, and the target branch is not
+      # guaranteed to be a local ref on a fresh agent. Fetch it by name before
+      # asking for a merge base, or `git merge-base` fails and the scan silently
+      # degrades to scanning nothing.
+      git fetch --no-tags origin "$target"
+      base=$(git merge-base FETCH_HEAD HEAD)
+      echo "scanning $base..HEAD"
+
+      # Recorded BEFORE the exit, because the exemption branch in the final step
+      # must never downgrade this one.
+      if ! docker run --rm -v "$(pwd):/repo" "$TRUFFLEHOG_IMAGE" \
+        git file:///repo --since-commit "$base" --results=verified --fail
+      then
+        echo "##vso[task.setvariable variable=REDLINE_SECURITY_FAILED]true"
+        exit 1
+      fi
+    displayName: Secret scan (diff)
+    name: secrets
+    env:
+      TRUFFLEHOG_IMAGE: $(TRUFFLEHOG_IMAGE)
+
+  # --package pins npx to the redlinegate package explicitly. `redline` alone
+  # names a different, unrelated package on the public registry.
+  - script: npx --yes --package=redlinegate@latest redline verify --gate
+    displayName: Redline gate
+    name: gate
+    # A failed secret scan must not hide the configuration findings: the author
+    # deserves the whole list in one run rather than one blocker at a time.
+    condition: succeededOrFailed()
+    env:
+      GH_TOKEN: $(GH_TOKEN)
+      ADR_DIFF_THRESHOLD: $(ADR_DIFF_THRESHOLD)
+      FAIL_ON_DEPENDENCY_SEVERITY: $(FAIL_ON_DEPENDENCY_SEVERITY)
+      SOFT_FAIL_LABELS: $(SOFT_FAIL_LABELS)
+
+  - script: |
+      set -euo pipefail
+      if [ "$AGENT_JOBSTATUS" = "Succeeded" ]; then
+        echo "gate passed"
+        exit 0
+      fi
+
+      # The secret scan is never waivable, exactly as on the GitHub side where
+      # the security jobs sit outside label exemption. A label that could waive
+      # a verified credential in the diff would make the label the
+      # vulnerability.
+      if [ "${REDLINE_SECURITY_FAILED:-}" = "true" ]; then
+        echo "##vso[task.logissue type=error]The secret scan failed. This check cannot be waived by a label."
+        exit 1
+      fi
+
+      # Soft-fail escape hatch: a pull request carrying one of SOFT_FAIL_LABELS
+      # reports success instead of blocking, so a reviewer can accept a process
+      # failure deliberately. It can only ever turn a failure into a success.
+      #
+      # Fails CLOSED when no token is configured. Without GH_TOKEN the labels
+      # cannot be read, and "could not check for an exemption" must block rather
+      # than wave through — an unreadable exemption is not an exemption.
+      if [ -z "${GH_TOKEN:-}" ] || [ -z "${SOFT_FAIL_LABELS:-}" ]; then
+        echo "##vso[task.logissue type=error]Redline gate failed."
+        exit 1
+      fi
+
+      pr="${SYSTEM_PULLREQUEST_PULLREQUESTNUMBER:-}"
+      repo="${BUILD_REPOSITORY_NAME:-}"
+      # The token must never appear in argv — visible via `ps` to any process on
+      # the agent. It is already an env var; hand it to curl through a stdin
+      # config instead of putting it on the command line with -H.
+      labels=$(printf 'header = "Authorization: Bearer %s"\n' "$GH_TOKEN" \
+        | curl -K - -sS -H "Accept: application/vnd.github+json" \
+          "https://api.github.com/repos/${repo}/issues/${pr}/labels") || labels=''
+
+      for label in ${SOFT_FAIL_LABELS//,/ }; do
+        if printf '%s' "$labels" | jq -e --arg l "$label" '[.[]?.name] | index($l)' >/dev/null 2>&1; then
+          echo "##vso[task.logissue type=warning]Redline gate failed but the \"$label\" label is applied — a reviewer accepted this deliberately"
+          exit 0
+        fi
+      done
+
+      echo "##vso[task.logissue type=error]Redline gate failed."
+      exit 1
+    displayName: Redline gate verdict
+    condition: always()
+    env:
+      GH_TOKEN: $(GH_TOKEN)
+      SOFT_FAIL_LABELS: $(SOFT_FAIL_LABELS)
+      REDLINE_SECURITY_FAILED: $(REDLINE_SECURITY_FAILED)

package/platforms/azure/gate-template.yml

@@ -22,6 +22,18 @@ variables:
   ADR_DIFF_THRESHOLD: 300
   FAIL_ON_DEPENDENCY_SEVERITY: high
   SOFT_FAIL_LABELS: redline-exempt,redline-sync
+  # Declared with a default so the status step can read it even when the scan
+  # passed and never set it. An undeclared Azure variable interpolates as the
+  # literal string "$(NAME)" rather than empty, which is the kind of quiet
+  # wrong answer this gate exists to prevent.
+  REDLINE_SECURITY_FAILED: 'false'
+  # Pinned by image digest, not by tag: a tag is mutable and this scans the diff
+  # of every pull request in the repository. The version in the trailing comment
+  # is what scripts/check-pins.mjs re-resolves the digest against, exactly as it
+  # does for the SHA-pinned actions on the GitHub side of the gate. Docker Hub
+  # spells the tag without the `v` the git tag carries; both sides of the gate
+  # deliberately run the same version.
+  TRUFFLEHOG_IMAGE: trufflesecurity/trufflehog@sha256:deb2af10659a488a14d262a323addcde099d99827a1cf1dc4e93c17915c39f08 # 3.97.1
 
 steps:
   - checkout: self
@@ -32,12 +44,48 @@ steps:
     inputs:
       versionSpec: '22.x'
 
+  # The GitHub gate runs this as its own job (workflows/redline-gate.yml,
+  # `secrets`). It has no substitute in Mend or SonarQube: both scan a state of
+  # the tree, and a credential committed and reverted inside one pull request
+  # is still in the history the moment it merges. This scans the RANGE.
+  #
+  # `--results=verified` only, matching the GitHub job for the same reason:
+  # `unknown` produces false positives and this check cannot be waived.
+  - script: |
+      set -euo pipefail
+      target="${SYSTEM_PULLREQUEST_TARGETBRANCH#refs/heads/}"
+      # The PR build checks out a merge commit, and the target branch is not
+      # guaranteed to be a local ref on a fresh agent. Fetch it by name before
+      # asking for a merge base, or `git merge-base` fails and the scan silently
+      # degrades to scanning nothing.
+      git fetch --no-tags origin "$target"
+      base=$(git merge-base FETCH_HEAD HEAD)
+      echo "scanning $base..HEAD"
+
+      # The failure is recorded BEFORE the exit, because the exemption branch in
+      # the status step below must never downgrade this one. On GitHub the
+      # security jobs sit outside label exemption; this variable is how that
+      # exclusion survives the two being one pipeline here.
+      if ! docker run --rm -v "$(pwd):/repo" "$TRUFFLEHOG_IMAGE" \
+        git file:///repo --since-commit "$base" --results=verified --fail
+      then
+        echo "##vso[task.setvariable variable=REDLINE_SECURITY_FAILED]true"
+        exit 1
+      fi
+    displayName: Secret scan (diff)
+    name: secrets
+    env:
+      TRUFFLEHOG_IMAGE: $(TRUFFLEHOG_IMAGE)
+
   # --package pins npx to the redlinegate package explicitly. `redline` alone
   # names a different, unrelated package on the public registry — `redline`
   # is only this package's bin name, never resolve npx against it directly.
   - script: npx --yes --package=redlinegate@latest redline verify --gate
     displayName: Redline gate
     name: gate
+    # A failed secret scan must not hide the configuration findings: the author
+    # deserves the whole list in one run rather than one blocker at a time.
+    condition: succeededOrFailed()
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
       ADR_DIFF_THRESHOLD: $(ADR_DIFF_THRESHOLD)
@@ -72,12 +120,16 @@ steps:
       # accept a process failure deliberately. It can only ever turn a
       # failure into a success, never the reverse.
       #
-      # NOTE for whoever splits this job up: on GitHub the security jobs
-      # (dependency-review, secrets) are excluded from the exemption. Here the
-      # gate is one `redline verify --gate` run that checks configuration
-      # drift only — no scanning step exists to downgrade. Adding one means
-      # excluding it from this branch, exactly as the GitHub workflow does.
-      if [ "$state" = "failed" ] && [ -n "${SOFT_FAIL_LABELS:-}" ]; then
+      # The secret scan is excluded, exactly as it is on GitHub, where the
+      # security jobs sit outside the exemption. There the exclusion is
+      # structural — separate jobs, and the label only reaches some of them.
+      # Here the whole gate is one pipeline, so the scan records
+      # REDLINE_SECURITY_FAILED before it exits and this branch refuses to
+      # downgrade it. A label that could waive a verified credential in the
+      # diff would make the label the vulnerability.
+      if [ "${REDLINE_SECURITY_FAILED:-}" = "true" ]; then
+        echo "##vso[task.logissue type=error]The secret scan failed. This check cannot be waived by a label."
+      elif [ "$state" = "failed" ] && [ -n "${SOFT_FAIL_LABELS:-}" ]; then
         labels=$(curl_authed -sS "$pr_url/labels?api-version=7.1") || labels=''
         for label in ${SOFT_FAIL_LABELS//,/ }; do
           if printf '%s' "$labels" \
@@ -103,3 +155,4 @@ steps:
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
       SOFT_FAIL_LABELS: $(SOFT_FAIL_LABELS)
+      REDLINE_SECURITY_FAILED: $(REDLINE_SECURITY_FAILED)

package/scripts/check-pins.mjs

@@ -39,6 +39,14 @@ const files = [
     ? readdirSync(join(ROOT, '.github/workflows')).map((f) => `.github/workflows/${f}`)
     : []),
   'templates/redline.yml',
+  // The Azure gate. It was outside this list while it pinned nothing, and the
+  // moment it pinned a container digest that omission would have made the pin
+  // unverifiable — the exact rot this script exists to catch.
+  'platforms/azure/gate-template.yml',
+  // The same gate for a GitHub-hosted repository built by Azure Pipelines. It
+  // carries the same container digest, so leaving it out here would let the two
+  // halves of the same gate drift to different versions of the scanner.
+  'platforms/azure/gate-template-github.yml',
 ].filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
 
 const pins = [];
@@ -84,5 +92,80 @@ for (const pin of pins) {
   }
 }
 
-console.log(`\n${pins.length} pin(s), ${errors} error(s), ${updates} update(s) available`);
+// The Azure gate runs its secret scan from a container rather than an action,
+// so the pin is an image digest with the version in a trailing comment — the
+// same shape as `uses: repo@sha # tag`, verified the same way. A digest that no
+// longer matches the tag it claims means someone edited one and not the other,
+// and the scan of every Azure pull request is then running an unreviewed image.
+const IMAGE_PIN = /([\w.-]+\/[\w.-]+)@(sha256:[0-9a-f]{64})\s*#\s*(\S+)/g;
+const imagePins = [];
+for (const file of files) {
+  const body = readFileSync(join(ROOT, file), 'utf8');
+  for (const [, image, digest, tag] of body.matchAll(IMAGE_PIN)) {
+    imagePins.push({ file, image, digest, tag });
+  }
+}
+
+for (const pin of imagePins) {
+  try {
+    const res = await fetch(`https://hub.docker.com/v2/repositories/${pin.image}/tags/${pin.tag}`);
+    if (!res.ok) throw new Error(`docker hub: ${res.status}`);
+    const resolved = (await res.json()).digest;
+    if (resolved !== pin.digest) {
+      console.error(
+        `FAIL ${pin.file}: ${pin.image}@${pin.digest} is commented as ${pin.tag}, but ${pin.tag} resolves to ${resolved}`
+      );
+      errors += 1;
+      continue;
+    }
+    console.log(`ok   ${pin.image}:${pin.tag} → ${pin.digest.slice(7, 19)}`);
+  } catch (err) {
+    console.error(`FAIL ${pin.file}: could not verify ${pin.image}:${pin.tag} — ${err.message}`);
+    errors += 1;
+  }
+}
+
+// The gate also pins the CLI it shells out to, as `REDLINE_CLI_VERSION` rather
+// than as a `uses:` SHA, so the loop above cannot see it. It is the pin that
+// rots hardest: it is a plain literal in two places, nothing in the release
+// wires it to a publish, and until someone edits it by hand a fix shipped in
+// the CLI reaches no onboarded repository at all — the gate keeps running the
+// version named here. A published version behind the latest is reported the
+// same way a stale action tag is.
+const CLI_PIN = /REDLINE_CLI_VERSION:\s*'([^']+)'/g;
+const cliPins = [];
+for (const file of files) {
+  const body = readFileSync(join(ROOT, file), 'utf8');
+  for (const [, version] of body.matchAll(CLI_PIN)) cliPins.push({ file, version });
+}
+
+if (cliPins.length) {
+  const pinned = [...new Set(cliPins.map((p) => p.version))];
+  if (pinned.length > 1) {
+    console.error(
+      `FAIL REDLINE_CLI_VERSION disagrees with itself: ${pinned.join(', ')} — every job in one gate must run the same CLI`
+    );
+    errors += 1;
+  }
+  try {
+    const res = await fetch('https://registry.npmjs.org/redlinegate');
+    if (!res.ok) throw new Error(`registry: ${res.status}`);
+    const latest = (await res.json())['dist-tags']?.latest;
+    for (const version of pinned) {
+      if (latest && latest !== version) {
+        console.warn(`     update available: redlinegate@${version} → ${latest}`);
+        updates += 1;
+      } else {
+        console.log(`ok   redlinegate@${version} is the published latest`);
+      }
+    }
+  } catch (err) {
+    console.error(`FAIL could not check redlinegate against the registry — ${err.message}`);
+    errors += 1;
+  }
+}
+
+console.log(
+  `\n${pins.length + cliPins.length + imagePins.length} pin(s), ${errors} error(s), ${updates} update(s) available`
+);
 process.exit(errors || (STRICT && updates) ? 1 : 0);

package/standards/contexts/speckit.md

@@ -0,0 +1,22 @@
+# Context: spec-driven development
+
+This repository works spec-first. A change begins as a specification, becomes a
+plan, becomes tasks, and only then becomes code. Treat the specification as the
+statement of intent that the diff is measured against.
+
+When reviewing:
+
+- Measure the diff against the specification it claims to implement, not against
+  what the code appears to be trying to do. Code that works and does something
+  the spec does not ask for is still a finding — say which section it departs
+  from.
+- A change with no specification is not automatically wrong. Trivial fixes,
+  dependency bumps and revert commits do not need one. A new capability does.
+- Where the specification and the code disagree, the specification is not
+  automatically right either. Say which one you believe is wrong and why, rather
+  than silently assuming the text wins.
+- Do not restate the specification back to the author. They wrote it.
+
+Spec Kit is a separate tool with its own installer and its own templates.
+Redline does not create, edit or version its files; this section only tells a
+reviewer that the repository works this way.

package/standards/contexts/tmf.md

@@ -0,0 +1,25 @@
+# Context: TM Forum
+
+This repository implements TM Forum interfaces. The published Open API and ODA
+specifications are part of the contract, and a consumer integrating against them
+is entitled to what those documents describe.
+
+When reviewing:
+
+- Resource and field names follow the published TMF API for the domain. A field
+  renamed for local convenience breaks every consumer generated from the spec.
+- Polymorphism carries `@type`, and `@baseType` / `@schemaLocation` where the
+  API defines them. Dropping them because "nothing reads it here" removes the
+  discriminator a consumer needs.
+- Collections page with `offset` and `limit`, filter through query parameters,
+  and honour `fields` for attribute selection. A hand-rolled paging scheme on a
+  TMF resource is a contract break.
+- Errors use the TMF error body — `code`, `reason`, and `message` where present
+  — rather than a local error shape.
+- Notifications follow the hub/listener pattern the API defines rather than a
+  bespoke webhook.
+- A breaking change to a published interface needs a version, not an edit. Say
+  so explicitly when you see one.
+
+State the specific TMF API and version when a finding depends on it, so the
+author can check the same document you did.

package/standards/manifest.json

@@ -1,6 +1,6 @@
 {
   "$comment": "Single source of truth for Redline. scripts/render.mjs turns this into vendor-specific artifacts. Never hand-edit generated output.",
-  "version": "0.0.3",
+  "version": "0.0.2",
   "core": {
     "title": "Redline Core Engineering Standards",
     "source": "standards/core.md"

package/templates/redline.yml

@@ -1,13 +1,9 @@
-# Managed by Redline; regenerate with `redline init` rather than editing here.
-# Redline caller. Installed into every onboarded repo as .github/workflows/redline.yml
-# by `redline init`. Kept in sync by workflows/redline-sync.yml once `redline sync`
-# ships in Phase 3 — see CHANGELOG.md.
+# Managed by Redline. Regenerate with `redline init`; edits here are overwritten.
 #
-# DO NOT RENAME THE JOB. The branch ruleset requires the check "redline-gate / gate",
-# which is derived from this job id plus the aggregate job id in the reusable workflow.
-# Renaming it makes the required check unreportable and blocks every PR in this repo.
-#
-# Replace <org> with the organisation that hosts the `.github` repo.
+# Keep the job id `redline-gate`: the branch ruleset requires the check
+# `redline-gate / gate`, which is built from this id. Renaming it makes that
+# check unreportable.
+
 name: Redline
 
 on:

package/workflows/dashboard.yml

@@ -73,7 +73,7 @@ jobs:
         env:
           STANDARDS_VERSION: ${{ vars.STANDARDS_VERSION }}
         run: |
-          npx --yes "redlinegate@0.0.1" metrics dashboard \
+          npx --yes "redlinegate@0.0.2" metrics dashboard \
             --org "${{ github.repository_owner }}" \
             --data data \
             --days 90 \