redlinegate 0.0.1 → 0.0.3

package/dist/ui/wizard.js

@@ -0,0 +1,293 @@
+import { RedlineError } from "../core/errors.js";
+import { TOOL_PROBES } from "../detect/existing.js";
+import { RUNGS } from "../enforce/ladder.js";
+// Plain-English, at the moment of choosing. Every one of these was a term the
+// operator met for the first time in output that assumed they knew it.
+const RUNG_HINTS = {
+    observe: 'comments only — the check is always green. Start here',
+    warn: 'comments and labels the PR — still never blocks a merge',
+    'block-blocker': 'a BLOCKER finding fails the check and stops the merge',
+    'block-high': 'BLOCKER and HIGH both stop the merge — the strictest rung',
+};
+const CAPABILITY_HINTS = {
+    gate: 'the pull request check that runs the review',
+    'merge-policy': 'branch protection requiring the check and an approval',
+    labels: 'the labels the gate uses to mark and exempt a pull request',
+    'review-ownership': 'seeds CODEOWNERS — off unless you ask, it can block every PR',
+};
+// Which Redline check a tool the repository already runs makes redundant.
+// Phrased as what the operator would otherwise get twice, because "stands down
+// the dependencies job" means nothing to someone meeting Redline today.
+const STAND_DOWN_LABEL = {
+    secrets: 'secret scanning',
+    dependencies: 'dependency vulnerability review',
+    policy: 'static analysis',
+};
+/**
+ * The profile list, ordered by how much detection actually knows.
+ *
+ * A confident detection — the repository's own manifest naming its framework —
+ * is hoisted to the top and marked, because it is almost always the answer. A
+ * guess is not: hoisting it puts it on the first row with the cursor already on
+ * it, which reads as chosen no matter how carefully it is left unticked. So a
+ * guess sorts alphabetically with everything else and says what it is.
+ */
+function profileChoices(manifest, detected, confidence) {
+    // Alphabetical, always. Hoisting the detected profile to the first row put the
+    // cursor on it before anything was typed, which reads as chosen no matter how
+    // carefully it is left unticked.
+    const ids = Object.keys(manifest.profiles).sort((a, b) => a.localeCompare(b));
+    return ids.map((id) => {
+        // The stacks' own titles, not their ids. `JavaScript, React (web)` tells an
+        // operator what they are choosing; `javascript, react` makes them guess at
+        // the difference between two profiles that share a prefix.
+        const stacks = (manifest.profiles[id] ?? []).map((stack) => manifest.stacks[stack]?.title ?? stack);
+        return {
+            value: id,
+            label: id,
+            hint: stacks.join(', ') +
+                (id === detected
+                    ? confidence === 'high'
+                        ? '   — looks like this repository, but pick it yourself'
+                        : '   — a guess; nothing here names this framework'
+                    : ''),
+        };
+    });
+}
+// Every vendor the standards know about, including the ones this organisation
+// has switched off — shown greyed with the reason rather than filtered out.
+//
+// Hiding them was wrong for the same reason hiding a covered capability would
+// be: an operator looking for Cursor and not finding it cannot tell whether
+// Redline forgot about Cursor, does not support it, or was told not to render
+// for it here. Only the last is true, and only the last is something they can
+// go and change.
+function vendorChoices(manifest) {
+    return Object.entries(manifest.vendors).map(([id, vendor]) => ({
+        value: id,
+        label: id,
+        ...(vendor.enabled
+            ? { hint: vendor.title }
+            : // Reason first: a long vendor title truncates, and the half worth
+                // keeping is the part that says why the row cannot be picked.
+                { disabled: `not enabled for this organisation — ${vendor.title}` }),
+    }));
+}
+/**
+ * Run the menu.
+ *
+ * Every question is skippable in the sense that it has a preselected answer;
+ * none is skippable in the sense of being hidden. A capability the repository
+ * already covers is still shown — deselected, with the tool that covers it
+ * named — because an operator who cannot see a decision cannot overrule it,
+ * and this repository's detection is wrong often enough that overruling has to
+ * stay one keystroke away.
+ */
+export async function runWizard(p, facts) {
+    const { manifest, survey, recorded } = facts;
+    const defaultOwner = facts.defaultOwner ?? 'the platform team';
+    p.intro('Redline');
+    // Multi-select, because a repository is routinely more than one bundle: a
+    // React application with its own Terraform beside it is `web,infra`, and a
+    // single-choice question made it pick the half that fitted worst.
+    //
+    // `.redline.json` still records one string — resolveProfile takes the list
+    // and sorts it — so nothing downstream had to learn a new shape.
+    // Detection never ticks a row. Which standards a repository is held to is the
+    // one answer here that changes what every future pull request is judged
+    // against, and a ticked row is consent — an operator pressing enter through
+    // the menu has agreed to whatever was ticked, whether or not they read it.
+    // Detection earns a label on the row and nothing more.
+    //
+    // What the repository already recorded is different: that is a decision a
+    // person made here before, and re-asking for it from scratch on every run
+    // would be its own kind of rude.
+    const recordedProfiles = recorded?.profile?.split(',').map((s) => s.trim());
+    let profiles = await p.multiselect('Which standards apply here?', profileChoices(manifest, facts.detectedProfile, facts.detectedConfidence), recordedProfiles ?? []);
+    // And if nothing is chosen, ask once more rather than choose something.
+    // Falling back to the detected profile is how "I did not pick anything"
+    // quietly became "Redline picked for me", which is the whole complaint.
+    //
+    // Once, not until-they-comply: a loop here never ends against a caller that
+    // keeps answering nothing, and a prompt that cannot be escaped is worse than
+    // one that gives up and says how to pass the answer as a flag.
+    if (profiles.length === 0) {
+        p.note('Nothing selected — Redline needs at least one profile to know which rules apply here. ' +
+            `The checkout looks like ${facts.detectedProfile}; take that, or take another.`);
+        profiles = await p.multiselect('Which standards apply here?', profileChoices(manifest, facts.detectedProfile, facts.detectedConfidence), []);
+    }
+    if (profiles.length === 0) {
+        throw new RedlineError('usage', 'no profile chosen, so there are no rules to render', `pick one from the menu, or name it outright: redline init --profile ${facts.detectedProfile}`);
+    }
+    const profile = profiles.join(',');
+    const hostChoices = [
+        {
+            value: 'github',
+            label: 'GitHub',
+            hint: 'GitHub.com or GitHub Enterprise Server' + (facts.detectedHost === 'github' ? '   (detected)' : ''),
+        },
+        {
+            value: 'azure',
+            label: 'Azure DevOps',
+            // Deliberately no hostnames: cli/platforms/__tests__/boundary.test.ts
+            // holds the line that only an adapter knows what a host's URLs look like,
+            // and a menu hint is not an adapter.
+            hint: 'Azure Repos' + (facts.detectedHost === 'azure' ? '   (detected)' : ''),
+        },
+    ];
+    const host = await p.select('Where does this repository live?', hostChoices, facts.detectedHost ?? 'github');
+    // Asked separately from the host because the two genuinely come apart: every
+    // VFUK repository is on github.com and built by Azure Pipelines. Deriving the
+    // pipeline from the host is what put a GitHub Actions caller into a repo
+    // whose real gate is `cicd/pre-merge.yaml`.
+    const pipelineChoices = [
+        {
+            value: 'github-actions',
+            label: 'GitHub Actions',
+            hint: 'a workflow under .github/workflows',
+        },
+        {
+            value: 'azure-pipelines',
+            label: 'Azure Pipelines',
+            hint: facts.existingPipeline === null
+                ? 'a stage in an Azure pipeline definition'
+                : `a stage added to ${facts.existingPipeline}   (detected)`,
+        },
+    ];
+    const pipeline = await p.select('What runs your pull request checks?', pipelineChoices, facts.existingPipeline !== null ? 'azure-pipelines' : 'github-actions');
+    const vendors = await p.multiselect('Which assistants should read the standards?', vendorChoices(manifest), [...(recorded?.vendors ?? facts.detectedVendors)]);
+    const contexts = await p.multiselect('Extra context to render beside the rules', [
+        {
+            value: 'speckit',
+            label: 'Spec-driven development',
+            hint: 'how to work from a spec — dropped automatically if you already run Spec Kit',
+        },
+        {
+            value: 'tmf',
+            label: 'TM Forum',
+            hint: 'resource naming, @type, paging, error bodies. Only if you implement TMF APIs',
+        },
+    ], ['speckit']);
+    // What Redline should set up, not what it noticed. A question whose only
+    // outcome was a sentence in the report earned nothing: the operator read a
+    // list of tools, ticked the ones they had, and nothing happened differently.
+    //
+    // Only controls Redline can install with no account and no token appear here,
+    // and only on a host where they mean something — on Azure DevOps the list is
+    // empty and the question does not get asked at all. What the repository
+    // already runs is still detected, and still stands Redline's own gate jobs
+    // down; it just does not need a question to do it.
+    const already = new Set(facts.recorded?.integrations?.length
+        ? facts.recorded.integrations
+        : survey.tools.map((tool) => tool.id));
+    const setupChoices = facts.offerable.map((offer) => ({
+        value: offer.id,
+        label: offer.label,
+        ...(already.has(offer.id)
+            ? { disabled: `already here — ${offer.evidence ?? 'detected in this repository'}` }
+            : { hint: offer.hint }),
+    }));
+    const setup = setupChoices.length > 0
+        ? await p.multiselect('What should Redline set up alongside its own checks?', setupChoices, [])
+        : [];
+    // The recorded list stays what the repository RUNS — detection plus anything
+    // stated with --integrations — and gains whatever was just installed, because
+    // after this run it does run it.
+    const integrations = [...new Set([...already, ...setup])];
+    // A capability a detected tool already covers starts deselected and says
+    // which tool. `standDown` is advisory: nothing here is decided for the
+    // operator, only defaulted.
+    const covered = new Map();
+    for (const id of integrations) {
+        const probe = TOOL_PROBES.find((candidate) => candidate.id === id);
+        if (probe === undefined || probe.standsDown === null)
+            continue;
+        covered.set(probe.standsDown, probe.label);
+    }
+    const capabilityChoices = Object.entries(CAPABILITY_HINTS).map(([id, hint]) => ({ value: id, label: id, hint }));
+    const capabilities = await p.multiselect('What should Redline install?', capabilityChoices, ['gate', 'merge-policy', 'labels']);
+    // Asked here, and asked blind: the wizard runs before the platform is
+    // resolved, so nothing yet knows whether this organisation publishes a gate.
+    // That is why it defaults to `org` and why the mid-run offer still exists —
+    // this question is the operator's preference, and the later one is the same
+    // question asked once the host has actually answered. An operator who already
+    // knows their organisation has nothing can say so here and never see it.
+    const gateSource = capabilities.includes('gate')
+        ? await p.select('Where should the merge gate live?', [
+            {
+                value: 'org',
+                label: 'in the organisation',
+                hint: 'one shared workflow; a pull request cannot edit the gate that judges it',
+            },
+            {
+                value: 'local',
+                label: 'in this repository',
+                hint: 'no organisation setup needed — weaker: a PR can edit its own gate',
+            },
+        ], 'org')
+        : 'org';
+    // Asked only when the capability was taken. GitHub silently ignores an owner
+    // it cannot resolve, so a CODEOWNERS seeded with a team that does not exist
+    // reports as installed and enforces nothing — the one failure mode worth a
+    // question, and only for the operators who will actually get a file.
+    const reviewOwners = capabilities.includes('review-ownership')
+        ? (await p.text('Who owns the paths Redline protects?', {
+            placeholder: `${defaultOwner} — the default, which may not exist here`,
+            hint: 'a team, a user or an email; several separated by commas. GitHub ignores an owner it cannot resolve',
+        }))
+            .split(',')
+            .map((owner) => owner.trim())
+            .filter((owner) => owner !== '')
+        : [];
+    if (covered.size > 0) {
+        const named = [...covered]
+            .map(([job, label]) => `${label} already covers ${STAND_DOWN_LABEL[job] ?? job}`)
+            .join('; ');
+        p.note(`${named}. Those gate jobs are stood down rather than run a second time — ` +
+            'the rest of the gate still runs.');
+    }
+    else {
+        // The other half of that question, and the half that was missing: what
+        // happens when the answer is "none of these". Redline turns on what the
+        // host itself provides, and is plain that it does not install anybody
+        // else's scanner — offering to would be a promise it cannot keep.
+        p.note('Nothing ticked — Redline will switch on the host controls itself: secret scanning, ' +
+            'push protection and dependency alerts. It does not install third-party scanners ' +
+            '(SonarQube, Snyk, Mend). Add one when you want it, then re-run ' +
+            '`redline init --integrations <id>` and the gate stops duplicating what it covers.');
+    }
+    const rung = await p.select('How hard should the check bite?', RUNGS.map((value) => ({ value, label: value, hint: RUNG_HINTS[value] })), recorded?.rung ?? 'observe');
+    const action = await p.select('Ready?', [
+        {
+            value: 'dry-run',
+            label: 'Dry run',
+            hint: 'print the plan — writes nothing, contacts no host, needs no credential',
+        },
+        {
+            value: 'no-commit',
+            label: 'Write the files only',
+            hint: 'writes into your working tree, uncommitted — no host changes, no pull request',
+        },
+        {
+            value: 'apply',
+            label: 'Apply',
+            hint: 'write the files and open a pull request on redline/onboard',
+        },
+    ], 'dry-run');
+    return {
+        profile,
+        vendors,
+        host,
+        pipeline,
+        speckit: contexts.includes('speckit'),
+        tmf: contexts.includes('tmf'),
+        capabilities,
+        integrations,
+        setup,
+        reviewOwners,
+        rung,
+        gateSource,
+        action,
+    };
+}
+//# sourceMappingURL=wizard.js.map

package/dist/ui/wizard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../cli/ui/wizard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAmB,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAa,MAAM,sBAAsB,CAAC;AAuFxD,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,UAAU,GAAyB;IACvC,OAAO,EAAE,uDAAuD;IAChE,IAAI,EAAE,yDAAyD;IAC/D,eAAe,EAAE,uDAAuD;IACxE,YAAY,EAAE,2DAA2D;CAC1E,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,IAAI,EAAE,6CAA6C;IACnD,cAAc,EAAE,uDAAuD;IACvE,MAAM,EAAE,4DAA4D;IACpE,kBAAkB,EAAE,8DAA8D;CACnF,CAAC;AAEF,0EAA0E;AAC1E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,gBAAgB,GAA2B;IAC/C,OAAO,EAAE,iBAAiB;IAC1B,YAAY,EAAE,iCAAiC;IAC/C,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,cAAc,CACrB,QAAkB,EAClB,QAAgB,EAChB,UAA0B;IAE1B,+EAA+E;IAC/E,8EAA8E;IAC9E,iCAAiC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,4EAA4E;QAC5E,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,KAAK,CAClD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBACjB,CAAC,EAAE,KAAK,QAAQ;oBACd,CAAC,CAAC,UAAU,KAAK,MAAM;wBACrB,CAAC,CAAC,uDAAuD;wBACzD,CAAC,CAAC,iDAAiD;oBACrD,CAAC,CAAC,EAAE,CAAC;SACV,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,iBAAiB;AACjB,SAAS,aAAa,CAAC,QAAkB;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;QACT,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE;YACxB,CAAC,CAAC,kEAAkE;gBAClE,8DAA8D;gBAC9D,EAAE,QAAQ,EAAE,uCAAuC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;KACzE,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAW,EAAE,KAAkB;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAE/D,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEnB,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,EAAE;IACF,2EAA2E;IAC3E,iEAAiE;IACjE,8EAA8E;IAC9E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,uDAAuD;IACvD,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,iCAAiC;IACjC,MAAM,gBAAgB,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAChC,6BAA6B,EAC7B,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,kBAAkB,CAAC,EACzE,gBAAgB,IAAI,EAAE,CACvB,CAAC;IAEF,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CACJ,wFAAwF;YACtF,2BAA2B,KAAK,CAAC,eAAe,+BAA+B,CAClF,CAAC;QACF,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAC5B,6BAA6B,EAC7B,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,kBAAkB,CAAC,EACzE,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CACpB,OAAO,EACP,oDAAoD,EACpD,uEAAuE,KAAK,CAAC,eAAe,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,WAAW,GAAmB;QAClC;YACE,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,wCAAwC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1G;QACD;YACE,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,cAAc;YACrB,sEAAsE;YACtE,0EAA0E;YAC1E,qCAAqC;YACrC,IAAI,EAAE,aAAa,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E;KACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CACzB,kCAAkC,EAClC,WAAW,EACX,KAAK,CAAC,YAAY,IAAI,QAAQ,CAC/B,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,eAAe,GAAuB;QAC1C;YACE,KAAK,EAAE,gBAAgB;YACvB,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,oCAAoC;SAC3C;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE,iBAAiB;YACxB,IAAI,EACF,KAAK,CAAC,gBAAgB,KAAK,IAAI;gBAC7B,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,eAAe;SAChE;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,CAC7B,qCAAqC,EACrC,eAAe,EACf,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,WAAW,CACjC,6CAA6C,EAC7C,aAAa,CAAC,QAAQ,CAAC,EACvB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAClD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAClC,0CAA0C,EAC1C;QACE;YACE,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,6EAA6E;SACpF;QACD;YACE,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,8EAA8E;SACrF;KACF,EACD,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM;QAClC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY;QAC7B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CACxC,CAAC;IACF,MAAM,YAAY,GAAqB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,KAAK,EAAE,KAAK,CAAC,EAAE;QACf,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,KAAK,CAAC,QAAQ,IAAI,6BAA6B,EAAE,EAAE;YACnF,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC1B,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GACT,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,sDAAsD,EAAE,YAAY,EAAE,EAAE,CAAC;QAC/F,CAAC,CAAC,EAAE,CAAC;IAET,6EAA6E;IAC7E,8EAA8E;IAC9E,iCAAiC;IACjC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE1D,yEAAyE;IACzE,uEAAuE;IACvE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,SAAS;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,iBAAiB,GAAqB,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC9E,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CACjD,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,WAAW,CACtC,8BAA8B,EAC9B,iBAAiB,EACjB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CACnC,CAAC;IAEF,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CACZ,mCAAmC,EACnC;YACE;gBACE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,qBAAqB;gBAC5B,IAAI,EAAE,yEAAyE;aAChF;YACD;gBACE,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,mEAAmE;aAC1E;SACF,EACD,KAAK,CACN;QACH,CAAC,CAAC,KAAK,CAAC;IAEV,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC5D,CAAC,CAAC,CACE,MAAM,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE;YACnD,WAAW,EAAE,GAAG,YAAY,0CAA0C;YACtE,IAAI,EAAE,oGAAoG;SAC3G,CAAC,CACH;aACE,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC;aACvB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,mBAAmB,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;aAChF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CACJ,GAAG,KAAK,mEAAmE;YACzE,kCAAkC,CACrC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,CAAC,CAAC,IAAI,CACJ,qFAAqF;YACnF,kFAAkF;YAClF,iEAAiE;YACjE,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CACzB,iCAAiC,EACjC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACxE,QAAQ,EAAE,IAAI,IAAI,SAAS,CAC5B,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAC3B,QAAQ,EACR;QACE;YACE,KAAK,EAAE,SAAkB;YACzB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,wEAAwE;SAC/E;QACD;YACE,KAAK,EAAE,WAAoB;YAC3B,KAAK,EAAE,sBAAsB;YAC7B,IAAI,EAAE,+EAA+E;SACtF;QACD;YACE,KAAK,EAAE,OAAgB;YACvB,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,4DAA4D;SACnE;KACF,EACD,SAAS,CACV,CAAC;IAEF,OAAO;QACL,OAAO;QACP,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7B,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,YAAY;QACZ,IAAI;QACJ,UAAU;QACV,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/verify/remote.js

@@ -1,6 +1,8 @@
 import { isRedlineError } from "../core/errors.js";
 import { renderForTarget, managedPaths } from "../sync/render.js";
 export const CALLER_WORKFLOW = '.github/workflows/redline.yml';
+import { VENDORED_GATE_PATH, stampedVersion } from "../platforms/github/vendor.js";
+export { VENDORED_GATE_PATH } from "../platforms/github/vendor.js";
 // Verify a repository without a checkout.
 //
 // Every check that can be sourced from the host is, and every check that cannot
@@ -70,6 +72,37 @@ export async function verifyRemote(host, ref, opts) {
                 : machinery.publishes !== machinery.expected
                     ? `${machinery.path} publishes ${machinery.publishes}, but the policy requires ${machinery.expected}`
                     : `publishes ${machinery.publishes}`);
+    // --- vendored gate ---------------------------------------------------------
+    // A gate referenced from the organisation updates itself: one merge there
+    // reaches every repository that points at it. A vendored one does not — it is
+    // a copy, and a copy is only as current as the run that wrote it. Nothing
+    // else in this report would notice a repository sitting three releases behind
+    // on the workflow that decides whether its pull requests can merge.
+    //
+    // Reported against the CLI running the check rather than against npm: this is
+    // the same comparison `redline init --repair` would act on, so a repository
+    // told it is behind can always be brought level by the binary that told it.
+    if (gateOwned && config.gateSource === 'local') {
+        const vendored = await host.readRemoteFile(ref, VENDORED_GATE_PATH);
+        const pin = vendored === null ? null : stampedVersion(vendored.content);
+        if (vendored === null) {
+            add('gate-vendored', false, `${VENDORED_GATE_PATH} is missing, but .redline.json says the gate is vendored here — ` +
+                'the caller workflow references a file that is not in this repository');
+        }
+        else if (pin === null || config.gateVersion === '') {
+            // One of the two sides has no version to compare. That is not drift, and
+            // reporting it as stale would file work against a repository whose gate
+            // may be perfectly current — a development build writes no stamp on
+            // purpose. Unknown, with the reason, is the honest answer.
+            add('gate-vendored', true, 'vendored, version not recorded — cannot tell current from stale here', true);
+        }
+        else {
+            add('gate-vendored', pin === opts.cliVersion, pin === opts.cliVersion
+                ? `vendored, current with redlinegate ${pin}`
+                : `vendored at redlinegate ${pin}, but this check runs ${opts.cliVersion} — ` +
+                    're-run redline init --repair in that repository to bring the gate level');
+        }
+    }
     // --- merge policy ----------------------------------------------------------
     const policy = await host.readPolicy(ref);
     if (!config.capabilities.mergePolicy) {

package/dist/verify/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../cli/verify/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAyBlE,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,0CAA0C;AAC1C,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,GAAY,EACZ,IAAyB;IAEzB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAW,EAAE,MAAc,EAAE,OAAO,GAAG,KAAK,EAAQ,EAAE;QAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAEtC,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,4EAA4E;QAC5E,kCAAkC;QAClC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,iDAAiD,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,MAAM,CAAC,OAAO,gBAAgB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3F,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ;SACT,CAAC,CAAC;QACH,GAAG,CACD,WAAW,EACX,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,8BAA8B,IAAI,CAAC,gBAAgB,EAAE;YACvD,CAAC,CAAC,4BAA4B,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,KAAK;iBACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CACD,WAAW,EACX,IAAI,EACJ,oCAAoC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC3F,IAAI,CACL,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;IAC3C,GAAG,CACD,gBAAgB,EAChB,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ,CAAC,EAC/E,CAAC,SAAS;QACR,CAAC,CAAC,SAAS,CAAC,OAAO;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,SAAS,IAAI,SAAS,EAAE;YAClH,CAAC,CAAC,gEAAgE;QACpE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;YAClB,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,QAAQ,EAAE;YACjF,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI;gBAC5B,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,kGAAkG;gBACrH,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ;oBAC1C,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,cAAc,SAAS,CAAC,SAAS,6BAA6B,SAAS,CAAC,QAAQ,EAAE;oBACrG,CAAC,CAAC,aAAa,SAAS,CAAC,SAAS,EAAE,CAC7C,CAAC;IAEF,8EAA8E;IAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QACrC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,mEAAmE,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,qEAAqE;YACrE,wEAAwE;YACxE,QAAQ,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,eAAe,SAAS,CAAC,QAAQ,iDAAiD;gBAChF,qFAAqF,CACxF,CAAC;QACJ,CAAC;QACD,GAAG,CACD,cAAc,EACd,QAAQ,CAAC,MAAM,KAAK,CAAC,EACrB,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,iBAAiB,uBAAuB;YAClG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnD,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnF,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,2BAA2B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4DAA4D;QAC5D,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,mBAAmB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAChG,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC/D,CAAC;IAED,8EAA8E;IAC9E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,GAAG,CACD,qBAAqB,EACrB,CAAC,SAAS,IAAI,KAAK,EACnB,CAAC,SAAS;YACR,CAAC,CAAC,4DAA4D;YAC9D,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,oBAAoB,EAAE,EAAE;gBAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,4BAA4B,EAAE,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,GAAG,CACD,eAAe,EACf,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAChC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../cli/verify/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AA8BlE,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,0CAA0C;AAC1C,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,GAAY,EACZ,IAAyB;IAEzB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAW,EAAE,MAAc,EAAE,OAAO,GAAG,KAAK,EAAQ,EAAE;QAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAEtC,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,4EAA4E;QAC5E,kCAAkC;QAClC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,iDAAiD,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,MAAM,CAAC,OAAO,gBAAgB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3F,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ;SACT,CAAC,CAAC;QACH,GAAG,CACD,WAAW,EACX,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,8BAA8B,IAAI,CAAC,gBAAgB,EAAE;YACvD,CAAC,CAAC,4BAA4B,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,KAAK;iBACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CACD,WAAW,EACX,IAAI,EACJ,oCAAoC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC3F,IAAI,CACL,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;IAC3C,GAAG,CACD,gBAAgB,EAChB,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ,CAAC,EAC/E,CAAC,SAAS;QACR,CAAC,CAAC,SAAS,CAAC,OAAO;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,SAAS,IAAI,SAAS,EAAE;YAClH,CAAC,CAAC,gEAAgE;QACpE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;YAClB,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,QAAQ,EAAE;YACjF,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI;gBAC5B,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,kGAAkG;gBACrH,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ;oBAC1C,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,cAAc,SAAS,CAAC,SAAS,6BAA6B,SAAS,CAAC,QAAQ,EAAE;oBACrG,CAAC,CAAC,aAAa,SAAS,CAAC,SAAS,EAAE,CAC7C,CAAC;IAEF,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,oEAAoE;IACpE,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,GAAG,CACD,eAAe,EACf,KAAK,EACL,GAAG,kBAAkB,kEAAkE;gBACrF,sEAAsE,CACzE,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YACrD,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,2DAA2D;YAC3D,GAAG,CACD,eAAe,EACf,IAAI,EACJ,sEAAsE,EACtE,IAAI,CACL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CACD,eAAe,EACf,GAAG,KAAK,IAAI,CAAC,UAAU,EACvB,GAAG,KAAK,IAAI,CAAC,UAAU;gBACrB,CAAC,CAAC,sCAAsC,GAAG,EAAE;gBAC7C,CAAC,CAAC,2BAA2B,GAAG,yBAAyB,IAAI,CAAC,UAAU,KAAK;oBACzE,yEAAyE,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QACrC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,mEAAmE,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,qEAAqE;YACrE,wEAAwE;YACxE,QAAQ,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,eAAe,SAAS,CAAC,QAAQ,iDAAiD;gBAChF,qFAAqF,CACxF,CAAC;QACJ,CAAC;QACD,GAAG,CACD,cAAc,EACd,QAAQ,CAAC,MAAM,KAAK,CAAC,EACrB,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,iBAAiB,uBAAuB;YAClG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnD,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnF,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,2BAA2B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4DAA4D;QAC5D,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,mBAAmB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAChG,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC/D,CAAC;IAED,8EAA8E;IAC9E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,GAAG,CACD,qBAAqB,EACrB,CAAC,SAAS,IAAI,KAAK,EACnB,CAAC,SAAS;YACR,CAAC,CAAC,4DAA4D;YAC9D,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,oBAAoB,EAAE,EAAE;gBAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,4BAA4B,EAAE,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,GAAG,CACD,eAAe,EACf,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAChC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC"}

package/package.json

@@ -1,10 +1,18 @@
 {
   "name": "redlinegate",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "Engineering control plane for AI-assisted development: standards, merge gates and evidence across GitHub and Azure DevOps",
   "type": "module",
   "license": "MIT",
   "homepage": "https://redline-gate.vercel.app",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/moelzanaty3/redline.git"
+  },
+  "bugs": {
+    "url": "https://github.com/moelzanaty3/redline/issues"
+  },
+  "author": "Mohamed Elzanaty (https://github.com/moelzanaty3)",
   "keywords": [
     "code-review",
     "ai-code-review",
@@ -28,6 +36,7 @@
     "redlinegate": "dist/bin/redline.js"
   },
   "files": [
+    "README.md",
     "LICENSE",
     "dist/",
     "scripts/",
@@ -41,6 +50,9 @@
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "prepack": "npm run build",
+    "stars": "node scripts/fetch-stars.mjs",
+    "publish:local": "node scripts/publish-local.mjs",
+    "publish:local:clean": "npm rm -g redlinegate",
     "test": "node --test 'cli/**/__tests__/*.test.ts' 'scripts/**/__tests__/*.test.mjs'",
     "typecheck": "tsc --noEmit"
   },

package/platforms/azure/gate-template-github.yml

@@ -0,0 +1,152 @@
+# Managed by Redline; regenerate with `redline init` rather than editing here.
+# Redline merge gate for a GitHub-hosted repository built by Azure Pipelines.
+#
+# This is the combination the estate actually runs: the code lives on GitHub,
+# the pull request checks are Azure Pipelines. Neither of Redline's two original
+# paths fitted it — the GitHub path writes an Actions workflow the repository
+# never runs, and the Azure path installs a Build Validation policy against an
+# Azure Repos repository that does not exist here.
+#
+# CONTRACT: this pipeline reports to GitHub as a check named after its own
+# pipeline definition, published by the Azure Pipelines GitHub App. There is no
+# status POST here, unlike the Azure Repos template beside it: on a GitHub-hosted
+# repository the build result IS the check, and posting to the Azure Repos
+# statuses API would address a pull request that does not exist. The name a
+# branch ruleset must require is therefore the pipeline's name in Azure DevOps —
+# `redline init` prints it, and `redline verify` reads the reported names back.
+#
+# A `pr:` block IS honoured here. Azure Pipelines ignores `pr:` triggers only
+# for Azure *Repos*; for a GitHub-hosted repository they are the trigger
+# mechanism, which is why the Azure Repos template beside this one has none.
+
+pr:
+  branches:
+    include:
+      - main
+      - master
+
+trigger: none
+
+pool:
+  vmImage: ubuntu-latest
+
+variables:
+  ADR_DIFF_THRESHOLD: 300
+  FAIL_ON_DEPENDENCY_SEVERITY: high
+  SOFT_FAIL_LABELS: redline-exempt,redline-sync
+  # Declared with a default so the final step can read it even when the scan
+  # passed and never set it. An undeclared Azure variable interpolates as the
+  # literal string "$(NAME)" rather than empty, which is the kind of quiet
+  # wrong answer this gate exists to prevent.
+  REDLINE_SECURITY_FAILED: 'false'
+  # Pinned by image digest, not by tag: a tag is mutable and this scans the diff
+  # of every pull request in the repository. The version in the trailing comment
+  # is what scripts/check-pins.mjs re-resolves the digest against, exactly as it
+  # does for the SHA-pinned actions on the GitHub side of the gate.
+  TRUFFLEHOG_IMAGE: trufflesecurity/trufflehog@sha256:deb2af10659a488a14d262a323addcde099d99827a1cf1dc4e93c17915c39f08 # 3.97.1
+
+steps:
+  - checkout: self
+    fetchDepth: 0
+
+  - task: NodeTool@0
+    displayName: Node 22
+    inputs:
+      versionSpec: '22.x'
+
+  # No substitute in Mend or SonarQube: both scan a state of the tree, and a
+  # credential committed and reverted inside one pull request is still in the
+  # history the moment it merges. This scans the RANGE.
+  #
+  # `--results=verified` only: `unknown` produces false positives and this
+  # check cannot be waived by a label.
+  - script: |
+      set -euo pipefail
+      target="${SYSTEM_PULLREQUEST_TARGETBRANCH#refs/heads/}"
+      # The PR build checks out a merge commit, and the target branch is not
+      # guaranteed to be a local ref on a fresh agent. Fetch it by name before
+      # asking for a merge base, or `git merge-base` fails and the scan silently
+      # degrades to scanning nothing.
+      git fetch --no-tags origin "$target"
+      base=$(git merge-base FETCH_HEAD HEAD)
+      echo "scanning $base..HEAD"
+
+      # Recorded BEFORE the exit, because the exemption branch in the final step
+      # must never downgrade this one.
+      if ! docker run --rm -v "$(pwd):/repo" "$TRUFFLEHOG_IMAGE" \
+        git file:///repo --since-commit "$base" --results=verified --fail
+      then
+        echo "##vso[task.setvariable variable=REDLINE_SECURITY_FAILED]true"
+        exit 1
+      fi
+    displayName: Secret scan (diff)
+    name: secrets
+    env:
+      TRUFFLEHOG_IMAGE: $(TRUFFLEHOG_IMAGE)
+
+  # --package pins npx to the redlinegate package explicitly. `redline` alone
+  # names a different, unrelated package on the public registry.
+  - script: npx --yes --package=redlinegate@latest redline verify --gate
+    displayName: Redline gate
+    name: gate
+    # A failed secret scan must not hide the configuration findings: the author
+    # deserves the whole list in one run rather than one blocker at a time.
+    condition: succeededOrFailed()
+    env:
+      GH_TOKEN: $(GH_TOKEN)
+      ADR_DIFF_THRESHOLD: $(ADR_DIFF_THRESHOLD)
+      FAIL_ON_DEPENDENCY_SEVERITY: $(FAIL_ON_DEPENDENCY_SEVERITY)
+      SOFT_FAIL_LABELS: $(SOFT_FAIL_LABELS)
+
+  - script: |
+      set -euo pipefail
+      if [ "$AGENT_JOBSTATUS" = "Succeeded" ]; then
+        echo "gate passed"
+        exit 0
+      fi
+
+      # The secret scan is never waivable, exactly as on the GitHub side where
+      # the security jobs sit outside label exemption. A label that could waive
+      # a verified credential in the diff would make the label the
+      # vulnerability.
+      if [ "${REDLINE_SECURITY_FAILED:-}" = "true" ]; then
+        echo "##vso[task.logissue type=error]The secret scan failed. This check cannot be waived by a label."
+        exit 1
+      fi
+
+      # Soft-fail escape hatch: a pull request carrying one of SOFT_FAIL_LABELS
+      # reports success instead of blocking, so a reviewer can accept a process
+      # failure deliberately. It can only ever turn a failure into a success.
+      #
+      # Fails CLOSED when no token is configured. Without GH_TOKEN the labels
+      # cannot be read, and "could not check for an exemption" must block rather
+      # than wave through — an unreadable exemption is not an exemption.
+      if [ -z "${GH_TOKEN:-}" ] || [ -z "${SOFT_FAIL_LABELS:-}" ]; then
+        echo "##vso[task.logissue type=error]Redline gate failed."
+        exit 1
+      fi
+
+      pr="${SYSTEM_PULLREQUEST_PULLREQUESTNUMBER:-}"
+      repo="${BUILD_REPOSITORY_NAME:-}"
+      # The token must never appear in argv — visible via `ps` to any process on
+      # the agent. It is already an env var; hand it to curl through a stdin
+      # config instead of putting it on the command line with -H.
+      labels=$(printf 'header = "Authorization: Bearer %s"\n' "$GH_TOKEN" \
+        | curl -K - -sS -H "Accept: application/vnd.github+json" \
+          "https://api.github.com/repos/${repo}/issues/${pr}/labels") || labels=''
+
+      for label in ${SOFT_FAIL_LABELS//,/ }; do
+        if printf '%s' "$labels" | jq -e --arg l "$label" '[.[]?.name] | index($l)' >/dev/null 2>&1; then
+          echo "##vso[task.logissue type=warning]Redline gate failed but the \"$label\" label is applied — a reviewer accepted this deliberately"
+          exit 0
+        fi
+      done
+
+      echo "##vso[task.logissue type=error]Redline gate failed."
+      exit 1
+    displayName: Redline gate verdict
+    condition: always()
+    env:
+      GH_TOKEN: $(GH_TOKEN)
+      SOFT_FAIL_LABELS: $(SOFT_FAIL_LABELS)
+      REDLINE_SECURITY_FAILED: $(REDLINE_SECURITY_FAILED)