redlinegate 0.0.1 → 0.0.3

package/platforms/azure/gate-template.yml

@@ -22,6 +22,18 @@ variables:
   ADR_DIFF_THRESHOLD: 300
   FAIL_ON_DEPENDENCY_SEVERITY: high
   SOFT_FAIL_LABELS: redline-exempt,redline-sync
+  # Declared with a default so the status step can read it even when the scan
+  # passed and never set it. An undeclared Azure variable interpolates as the
+  # literal string "$(NAME)" rather than empty, which is the kind of quiet
+  # wrong answer this gate exists to prevent.
+  REDLINE_SECURITY_FAILED: 'false'
+  # Pinned by image digest, not by tag: a tag is mutable and this scans the diff
+  # of every pull request in the repository. The version in the trailing comment
+  # is what scripts/check-pins.mjs re-resolves the digest against, exactly as it
+  # does for the SHA-pinned actions on the GitHub side of the gate. Docker Hub
+  # spells the tag without the `v` the git tag carries; both sides of the gate
+  # deliberately run the same version.
+  TRUFFLEHOG_IMAGE: trufflesecurity/trufflehog@sha256:deb2af10659a488a14d262a323addcde099d99827a1cf1dc4e93c17915c39f08 # 3.97.1
 
 steps:
   - checkout: self
@@ -32,12 +44,48 @@ steps:
     inputs:
       versionSpec: '22.x'
 
+  # The GitHub gate runs this as its own job (workflows/redline-gate.yml,
+  # `secrets`). It has no substitute in Mend or SonarQube: both scan a state of
+  # the tree, and a credential committed and reverted inside one pull request
+  # is still in the history the moment it merges. This scans the RANGE.
+  #
+  # `--results=verified` only, matching the GitHub job for the same reason:
+  # `unknown` produces false positives and this check cannot be waived.
+  - script: |
+      set -euo pipefail
+      target="${SYSTEM_PULLREQUEST_TARGETBRANCH#refs/heads/}"
+      # The PR build checks out a merge commit, and the target branch is not
+      # guaranteed to be a local ref on a fresh agent. Fetch it by name before
+      # asking for a merge base, or `git merge-base` fails and the scan silently
+      # degrades to scanning nothing.
+      git fetch --no-tags origin "$target"
+      base=$(git merge-base FETCH_HEAD HEAD)
+      echo "scanning $base..HEAD"
+
+      # The failure is recorded BEFORE the exit, because the exemption branch in
+      # the status step below must never downgrade this one. On GitHub the
+      # security jobs sit outside label exemption; this variable is how that
+      # exclusion survives the two being one pipeline here.
+      if ! docker run --rm -v "$(pwd):/repo" "$TRUFFLEHOG_IMAGE" \
+        git file:///repo --since-commit "$base" --results=verified --fail
+      then
+        echo "##vso[task.setvariable variable=REDLINE_SECURITY_FAILED]true"
+        exit 1
+      fi
+    displayName: Secret scan (diff)
+    name: secrets
+    env:
+      TRUFFLEHOG_IMAGE: $(TRUFFLEHOG_IMAGE)
+
   # --package pins npx to the redlinegate package explicitly. `redline` alone
   # names a different, unrelated package on the public registry — `redline`
   # is only this package's bin name, never resolve npx against it directly.
   - script: npx --yes --package=redlinegate@latest redline verify --gate
     displayName: Redline gate
     name: gate
+    # A failed secret scan must not hide the configuration findings: the author
+    # deserves the whole list in one run rather than one blocker at a time.
+    condition: succeededOrFailed()
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
       ADR_DIFF_THRESHOLD: $(ADR_DIFF_THRESHOLD)
@@ -72,12 +120,16 @@ steps:
       # accept a process failure deliberately. It can only ever turn a
       # failure into a success, never the reverse.
       #
-      # NOTE for whoever splits this job up: on GitHub the security jobs
-      # (dependency-review, secrets) are excluded from the exemption. Here the
-      # gate is one `redline verify --gate` run that checks configuration
-      # drift only — no scanning step exists to downgrade. Adding one means
-      # excluding it from this branch, exactly as the GitHub workflow does.
-      if [ "$state" = "failed" ] && [ -n "${SOFT_FAIL_LABELS:-}" ]; then
+      # The secret scan is excluded, exactly as it is on GitHub, where the
+      # security jobs sit outside the exemption. There the exclusion is
+      # structural — separate jobs, and the label only reaches some of them.
+      # Here the whole gate is one pipeline, so the scan records
+      # REDLINE_SECURITY_FAILED before it exits and this branch refuses to
+      # downgrade it. A label that could waive a verified credential in the
+      # diff would make the label the vulnerability.
+      if [ "${REDLINE_SECURITY_FAILED:-}" = "true" ]; then
+        echo "##vso[task.logissue type=error]The secret scan failed. This check cannot be waived by a label."
+      elif [ "$state" = "failed" ] && [ -n "${SOFT_FAIL_LABELS:-}" ]; then
         labels=$(curl_authed -sS "$pr_url/labels?api-version=7.1") || labels=''
         for label in ${SOFT_FAIL_LABELS//,/ }; do
           if printf '%s' "$labels" \
@@ -103,3 +155,4 @@ steps:
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
       SOFT_FAIL_LABELS: $(SOFT_FAIL_LABELS)
+      REDLINE_SECURITY_FAILED: $(REDLINE_SECURITY_FAILED)

package/scripts/check-pins.mjs

@@ -39,6 +39,14 @@ const files = [
     ? readdirSync(join(ROOT, '.github/workflows')).map((f) => `.github/workflows/${f}`)
     : []),
   'templates/redline.yml',
+  // The Azure gate. It was outside this list while it pinned nothing, and the
+  // moment it pinned a container digest that omission would have made the pin
+  // unverifiable — the exact rot this script exists to catch.
+  'platforms/azure/gate-template.yml',
+  // The same gate for a GitHub-hosted repository built by Azure Pipelines. It
+  // carries the same container digest, so leaving it out here would let the two
+  // halves of the same gate drift to different versions of the scanner.
+  'platforms/azure/gate-template-github.yml',
 ].filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
 
 const pins = [];
@@ -84,5 +92,80 @@ for (const pin of pins) {
   }
 }
 
-console.log(`\n${pins.length} pin(s), ${errors} error(s), ${updates} update(s) available`);
+// The Azure gate runs its secret scan from a container rather than an action,
+// so the pin is an image digest with the version in a trailing comment — the
+// same shape as `uses: repo@sha # tag`, verified the same way. A digest that no
+// longer matches the tag it claims means someone edited one and not the other,
+// and the scan of every Azure pull request is then running an unreviewed image.
+const IMAGE_PIN = /([\w.-]+\/[\w.-]+)@(sha256:[0-9a-f]{64})\s*#\s*(\S+)/g;
+const imagePins = [];
+for (const file of files) {
+  const body = readFileSync(join(ROOT, file), 'utf8');
+  for (const [, image, digest, tag] of body.matchAll(IMAGE_PIN)) {
+    imagePins.push({ file, image, digest, tag });
+  }
+}
+
+for (const pin of imagePins) {
+  try {
+    const res = await fetch(`https://hub.docker.com/v2/repositories/${pin.image}/tags/${pin.tag}`);
+    if (!res.ok) throw new Error(`docker hub: ${res.status}`);
+    const resolved = (await res.json()).digest;
+    if (resolved !== pin.digest) {
+      console.error(
+        `FAIL ${pin.file}: ${pin.image}@${pin.digest} is commented as ${pin.tag}, but ${pin.tag} resolves to ${resolved}`
+      );
+      errors += 1;
+      continue;
+    }
+    console.log(`ok   ${pin.image}:${pin.tag} → ${pin.digest.slice(7, 19)}`);
+  } catch (err) {
+    console.error(`FAIL ${pin.file}: could not verify ${pin.image}:${pin.tag} — ${err.message}`);
+    errors += 1;
+  }
+}
+
+// The gate also pins the CLI it shells out to, as `REDLINE_CLI_VERSION` rather
+// than as a `uses:` SHA, so the loop above cannot see it. It is the pin that
+// rots hardest: it is a plain literal in two places, nothing in the release
+// wires it to a publish, and until someone edits it by hand a fix shipped in
+// the CLI reaches no onboarded repository at all — the gate keeps running the
+// version named here. A published version behind the latest is reported the
+// same way a stale action tag is.
+const CLI_PIN = /REDLINE_CLI_VERSION:\s*'([^']+)'/g;
+const cliPins = [];
+for (const file of files) {
+  const body = readFileSync(join(ROOT, file), 'utf8');
+  for (const [, version] of body.matchAll(CLI_PIN)) cliPins.push({ file, version });
+}
+
+if (cliPins.length) {
+  const pinned = [...new Set(cliPins.map((p) => p.version))];
+  if (pinned.length > 1) {
+    console.error(
+      `FAIL REDLINE_CLI_VERSION disagrees with itself: ${pinned.join(', ')} — every job in one gate must run the same CLI`
+    );
+    errors += 1;
+  }
+  try {
+    const res = await fetch('https://registry.npmjs.org/redlinegate');
+    if (!res.ok) throw new Error(`registry: ${res.status}`);
+    const latest = (await res.json())['dist-tags']?.latest;
+    for (const version of pinned) {
+      if (latest && latest !== version) {
+        console.warn(`     update available: redlinegate@${version} → ${latest}`);
+        updates += 1;
+      } else {
+        console.log(`ok   redlinegate@${version} is the published latest`);
+      }
+    }
+  } catch (err) {
+    console.error(`FAIL could not check redlinegate against the registry — ${err.message}`);
+    errors += 1;
+  }
+}
+
+console.log(
+  `\n${pins.length + cliPins.length + imagePins.length} pin(s), ${errors} error(s), ${updates} update(s) available`
+);
 process.exit(errors || (STRICT && updates) ? 1 : 0);

package/scripts/fetch-stars.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/**
+ * Refreshes web/lib/github-stars.json.
+ *
+ * Star counts drift. Rather than pretend otherwise we snapshot them, record the
+ * date the snapshot was taken, and render that date next to the number. The
+ * build never calls the network: if this file is stale, the site says so; if a
+ * repo is missing from it, the site omits the count for that repo rather than
+ * guessing.
+ *
+ * Run: node scripts/fetch-stars.mjs   (needs an authenticated `gh`)
+ */
+import { execFile } from "node:child_process";
+import { readFile, writeFile } from "node:fs/promises";
+import { promisify } from "node:util";
+
+const run = promisify(execFile);
+
+const SOURCE = new URL("../web/lib/skills-catalog.ts", import.meta.url);
+const OUT = new URL("../web/lib/github-stars.json", import.meta.url);
+
+/** Pull every `owner`/`repo` pair out of the PUBLISHERS table. */
+function repoSlugs(src) {
+  const re = /owner:\s*"([^"]+)",\s*\n\s*repo:\s*"([^"]+)"/g;
+  const slugs = new Set();
+  for (const m of src.matchAll(re)) slugs.add(`${m[1]}/${m[2]}`);
+  return [...slugs].sort();
+}
+
+async function stars(slug) {
+  // execFile, not exec: `slug` goes in as one argv entry, never through a shell.
+  const { stdout } = await run("gh", [
+    "api",
+    `repos/${slug}`,
+    "--jq",
+    ".stargazers_count",
+  ]);
+  const n = Number.parseInt(stdout.trim(), 10);
+  if (!Number.isFinite(n)) throw new Error(`unparseable count for ${slug}`);
+  return n;
+}
+
+const src = await readFile(SOURCE, "utf8");
+const slugs = repoSlugs(src);
+if (slugs.length === 0) {
+  console.error("No owner/repo pairs found — did PUBLISHERS move?");
+  process.exit(1);
+}
+
+const previous = await readFile(OUT, "utf8").then(
+  (t) => JSON.parse(t).stars ?? {},
+  () => ({}),
+);
+
+const next = {};
+let failed = 0;
+for (const slug of slugs) {
+  try {
+    next[slug] = await stars(slug);
+    console.log(`  ${String(next[slug]).padStart(7)}  ${slug}`);
+  } catch (err) {
+    failed += 1;
+    // Drop the repo rather than carry the previous run's number forward. Every
+    // value in this file is stamped with one shared fetchedAt, so a carried
+    // number would be published under a date on which nobody counted it —
+    // the exact misstatement the dated snapshot exists to prevent. A repo with
+    // no number simply renders without the stars fact, which is honest.
+    console.warn(`  failed: ${slug} — ${err.message.split("\n")[0]}`);
+  }
+}
+
+if (failed === slugs.length) {
+  console.error("Every request failed; leaving the existing snapshot alone.");
+  process.exit(1);
+}
+
+const payload = {
+  fetchedAt: new Date().toISOString().slice(0, 10),
+  stars: Object.fromEntries(Object.entries(next).sort(([a], [b]) => a.localeCompare(b))),
+};
+
+const dropped = Object.keys(previous).filter((slug) => !(slug in next));
+if (dropped.length) {
+  console.warn(
+    `\n${dropped.length} repo(s) in the previous snapshot have no number this run ` +
+      `and were dropped rather than re-dated: ${dropped.join(", ")}.\n` +
+      `Re-run to restore them; their pages render without a stars fact meanwhile.`,
+  );
+}
+
+await writeFile(OUT, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+console.log(`\nWrote ${Object.keys(payload.stars).length} repos to lib/github-stars.json`);

package/scripts/lib/rules.d.mts

@@ -0,0 +1,18 @@
+// Types for the CI rule parser, so cli/rules/__tests__/catalogue.test.ts can hold
+// the CLI's own reader against it without an untyped import. The runtime module
+// stays plain .mjs: it is run by node directly, never built.
+export interface ScriptRule {
+  id: string;
+  stack: string;
+  severity: 'BLOCKER' | 'HIGH' | 'SUGGESTION';
+  text: string;
+  source: string;
+  line: number;
+}
+
+export declare const ROOT: string;
+export declare const SEVERITIES: readonly string[];
+export declare const RANK: Record<string, number>;
+export declare const RULE_ID: RegExp;
+export declare const RESERVED_RULE_IDS: ReadonlySet<string>;
+export declare function loadRules(root?: string): Map<string, ScriptRule>;

package/scripts/publish-local.mjs

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+// Build, pack and install this CLI globally, so `redline` on PATH is the working tree.
+//
+// The whole reason this is a script and not a one-line npm chain: which `npm` runs
+// the global install decides whether the install is visible at all.
+//
+// Under pnpm, `npm` resolves to ./node_modules/.bin/npm — a locally installed npm
+// that is not shimmed by Volta. Its `npm i -g` writes into its own global prefix,
+// while the `redline` command on PATH is a Volta shim pointing at Volta's package
+// image. The install reports success, the tarball is correct, and the binary you
+// run is still the old one. That failure is silent and costs an hour.
+//
+// So: resolve npm explicitly, never through a node_modules/.bin that a package
+// manager put in front, and verify afterwards that the binary on PATH is actually
+// the build we just made.
+
+import { execFileSync, execSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+// Present only in a current build: the check at the end greps the installed
+// binary's own help for it.
+const MARKER = 'redline status';
+
+const run = (file, args, opts = {}) =>
+  execFileSync(file, args, { cwd: ROOT, stdio: 'inherit', ...opts });
+
+// Volta sets _VOLTA_TOOL_RECURSION on anything it launches, and its shims skip
+// their own hook when they see it — sensible, since it stops a tool Volta ran
+// from re-entering Volta forever. It also means a global install performed from
+// inside a script Volta started never updates the shim: the files land, npm says
+// "added 1 package", and the `redline` on PATH keeps running the old build. That
+// single variable is why every publish this session appeared to succeed and
+// changed nothing. Clearing it for the install restores the behaviour of typing
+// the command in a shell.
+const withoutVoltaGuard = () => {
+  const env = { ...process.env };
+  delete env['_VOLTA_TOOL_RECURSION'];
+  return env;
+};
+
+const quiet = (command) => {
+  try {
+    return execSync(command, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+  } catch {
+    return '';
+  }
+};
+
+/**
+ * The npm that a global install has to go through.
+ *
+ * Under Volta this is `~/.volta/bin/npm` — the SHIM. Not `volta which npm`,
+ * which returns the image binary underneath it: installing through that writes
+ * the package into the node image and never triggers the hook that builds the
+ * package image the `redline` shim actually executes. The install reports
+ * success, the files land, and the command keeps running the old build.
+ *
+ * Then any npm on PATH that is not inside a node_modules — that is one a package
+ * manager shadowed, as pnpm does with the npm semantic-release depends on.
+ */
+function resolveNpm() {
+  const shim = join(process.env.HOME ?? '', '.volta', 'bin', 'npm');
+  if (existsSync(shim)) return shim;
+
+  for (const dir of (process.env.PATH ?? '').split(':')) {
+    if (dir === '' || dir.includes('node_modules')) continue;
+    const candidate = join(dir, 'npm');
+    if (existsSync(candidate)) return candidate;
+  }
+  return 'npm';
+}
+
+/**
+ * The `redline` a person actually gets when they type it.
+ *
+ * PATH first. Falling back to Volta's shim matters because a non-interactive
+ * shell does not always carry ~/.volta/bin, and reporting "not installed" to
+ * somebody whose terminal runs it perfectly well is worse than useless.
+ */
+function liveBinary() {
+  // The shim first, when there is one. It is what a person's interactive shell
+  // runs, and it is the copy that goes stale — `command -v redline` in a
+  // non-interactive shell can easily resolve to a different, fresher copy and
+  // report success for a binary nobody types.
+  const shim = join(process.env.HOME ?? '', '.volta', 'bin', 'redline');
+  if (existsSync(shim)) return shim;
+  return quiet('command -v redline') !== '' ? 'redline' : '';
+}
+
+const npm = resolveNpm();
+console.log(`  using npm at ${npm}`);
+
+// A unique version per publish, and this is the load-bearing part.
+//
+// package.json carries 0.0.0-development permanently — semantic-release sets the
+// real version at publish time. Both npm and Volta key a global package by
+// name@version, so every local publish looked identical to the last one and was
+// served from cache: the tarball was rebuilt, the install reported success, and
+// Volta restored the SAME old package image behind the shim. Each publish was
+// actively downgrading the binary back to whatever was cached first.
+//
+// Stamping a timestamp version defeats both caches, and has a second use: the
+// version `redline --version` prints is now the moment it was installed, so a
+// stale binary is visible without any of this archaeology.
+const manifestPath = join(ROOT, 'package.json');
+const original = readFileSync(manifestPath, 'utf8');
+const manifest = JSON.parse(original);
+const localVersion = `0.0.0-local.${Math.floor(Date.now() / 1000)}`;
+const tarball = `redlinegate-${localVersion}.tgz`;
+
+// Clear Volta's entry first, and before anything else.
+//
+// Volta keeps its own copy of a global package — the one its shim runs — apart
+// from the node image npm writes to. While it holds an entry, `npm i -g` updates
+// only the node image and the shim keeps executing the old code. Order matters:
+// clearing it after the pack leaves the shim deleted and not recreated, which is
+// how `redline` kept vanishing from PATH.
+const hasVolta = quiet('volta --version') !== '';
+if (hasVolta) {
+  try {
+    execFileSync('volta', ['uninstall', 'redlinegate'], {
+      stdio: 'ignore',
+      env: withoutVoltaGuard(),
+    });
+  } catch {
+    // Not installed through Volta. Nothing to clear.
+  }
+}
+
+try {
+  writeFileSync(
+    manifestPath,
+    JSON.stringify({ ...manifest, version: localVersion }, null, 2) + '\n',
+    'utf8'
+  );
+
+  run(npm, ['run', 'build']);
+  run(npm, ['pack']);
+
+  run(npm, ['i', '-g', `./${tarball}`], { env: withoutVoltaGuard() });
+} finally {
+  // The real version is semantic-release's to set. Restoring it has to survive a
+  // failed build, or a crash here leaves a timestamp version committed.
+  writeFileSync(manifestPath, original, 'utf8');
+  rmSync(join(ROOT, tarball), { force: true });
+}
+
+// Verify by RUNNING both and comparing what they print.
+//
+// Every other way of checking this was wrong at least once. A marker string in
+// --help stays true across builds, so it passed while the installed copy was
+// three changes behind. Comparing files means guessing which of the copies the
+// command resolves to — and under Volta there are two, in different places,
+// only one of which the shim executes. Executing it answers the only question
+// that matters: does the command a person types run the code just built.
+const binary = liveBinary();
+if (binary === '') {
+  console.error('\n  redline is not on PATH after installing. Check your shell PATH.\n');
+  process.exit(1);
+}
+
+const live = quiet(`${binary} --help`);
+const built = quiet(`node "${join(ROOT, 'dist', 'bin', 'redline.js')}" --help`);
+const digest = (text) => createHash('sha256').update(text).digest('hex').slice(0, 12);
+
+if (live === '' || built === '') {
+  console.error('\n  Could not run redline to compare builds.\n');
+  process.exit(1);
+}
+if (live !== built) {
+  console.error('\n  The installed redline is STALE: it runs older code than this build.');
+  console.error(`    installed ${digest(live)}   built ${digest(built)}`);
+  console.error('\n  Under Volta the package image is cached by name@version, and this version');
+  console.error('  never changes. Clear it and install again:');
+  console.error('    volta uninstall redlinegate');
+  console.error('    ~/.volta/bin/npm i -g ./redlinegate-<version>.tgz\n');
+  process.exit(1);
+}
+console.log(`  installed redline runs this build (${digest(built)})`);

package/standards/contexts/speckit.md

@@ -0,0 +1,22 @@
+# Context: spec-driven development
+
+This repository works spec-first. A change begins as a specification, becomes a
+plan, becomes tasks, and only then becomes code. Treat the specification as the
+statement of intent that the diff is measured against.
+
+When reviewing:
+
+- Measure the diff against the specification it claims to implement, not against
+  what the code appears to be trying to do. Code that works and does something
+  the spec does not ask for is still a finding — say which section it departs
+  from.
+- A change with no specification is not automatically wrong. Trivial fixes,
+  dependency bumps and revert commits do not need one. A new capability does.
+- Where the specification and the code disagree, the specification is not
+  automatically right either. Say which one you believe is wrong and why, rather
+  than silently assuming the text wins.
+- Do not restate the specification back to the author. They wrote it.
+
+Spec Kit is a separate tool with its own installer and its own templates.
+Redline does not create, edit or version its files; this section only tells a
+reviewer that the repository works this way.

package/standards/contexts/tmf.md

@@ -0,0 +1,25 @@
+# Context: TM Forum
+
+This repository implements TM Forum interfaces. The published Open API and ODA
+specifications are part of the contract, and a consumer integrating against them
+is entitled to what those documents describe.
+
+When reviewing:
+
+- Resource and field names follow the published TMF API for the domain. A field
+  renamed for local convenience breaks every consumer generated from the spec.
+- Polymorphism carries `@type`, and `@baseType` / `@schemaLocation` where the
+  API defines them. Dropping them because "nothing reads it here" removes the
+  discriminator a consumer needs.
+- Collections page with `offset` and `limit`, filter through query parameters,
+  and honour `fields` for attribute selection. A hand-rolled paging scheme on a
+  TMF resource is a contract break.
+- Errors use the TMF error body — `code`, `reason`, and `message` where present
+  — rather than a local error shape.
+- Notifications follow the hub/listener pattern the API defines rather than a
+  bespoke webhook.
+- A breaking change to a published interface needs a version, not an edit. Say
+  so explicitly when you see one.
+
+State the specific TMF API and version when a finding depends on it, so the
+author can check the same document you did.

package/standards/manifest.json

@@ -28,6 +28,60 @@
         "apps/**/src/**/*.ts"
       ]
     },
+    "angular": {
+      "title": "Angular",
+      "source": "standards/stacks/angular.md",
+      "globs": [
+        "**/*.component.ts",
+        "**/*.component.html",
+        "**/*.service.ts",
+        "**/*.directive.ts",
+        "**/*.pipe.ts",
+        "**/*.guard.ts",
+        "**/*.interceptor.ts",
+        "src/app/**",
+        "apps/**/src/app/**",
+        "packages/**/src/app/**"
+      ]
+    },
+    "vue": {
+      "title": "Vue",
+      "source": "standards/stacks/vue.md",
+      "globs": [
+        "**/*.vue",
+        "composables/**",
+        "pages/**",
+        "server/**/*.ts",
+        "src/**/*.ts",
+        "app/**/*.ts",
+        "apps/**/src/**/*.ts",
+        "packages/**/src/**/*.ts"
+      ]
+    },
+    "svelte": {
+      "title": "Svelte / SvelteKit",
+      "source": "standards/stacks/svelte.md",
+      "globs": [
+        "**/*.svelte",
+        "**/*.svelte.ts",
+        "**/*.svelte.js",
+        "src/routes/**",
+        "src/lib/**",
+        "apps/**/src/routes/**",
+        "apps/**/src/lib/**",
+        "packages/**/src/lib/**"
+      ]
+    },
+    "dom": {
+      "title": "Browser / DOM",
+      "source": "standards/stacks/dom.md",
+      "globs": [
+        "**/*.js",
+        "**/*.mjs",
+        "**/*.ts",
+        "**/*.html"
+      ]
+    },
     "react-native": {
       "title": "React Native",
       "source": "standards/stacks/react-native.md",
@@ -126,10 +180,26 @@
     "tooling": [
       "javascript"
     ],
-    "web": [
+    "web-react": [
       "javascript",
       "react"
     ],
+    "web-angular": [
+      "javascript",
+      "angular"
+    ],
+    "web-vue": [
+      "javascript",
+      "vue"
+    ],
+    "web-svelte": [
+      "javascript",
+      "svelte"
+    ],
+    "web-vanilla": [
+      "javascript",
+      "dom"
+    ],
     "mobile-rn": [
       "javascript",
       "react",
@@ -174,6 +244,7 @@
   },
   "$aliasComment": "Legacy profile names accepted by sync-targets.txt for backwards compatibility.",
   "profileAliases": {
+    "web": "web-react",
     "mobile": "mobile-rn",
     "java": "service-java",
     "go": "service-go",
@@ -190,18 +261,18 @@
       "title": "AGENTS.md (OpenAI Codex, Copilot coding agent, Jules, Cursor agent, Devin)",
       "enabled": true
     },
+    "codex": {
+      "$comment": "Renders AGENTS.md, the same file the \"agents\" vendor writes — that is the file OpenAI Codex reads, and inventing a second Codex-specific path would render rules nothing looks for. Listed separately because an operator looking for Codex should find it by name; selecting either produces the same artifact, and selecting both writes it once.",
+      "title": "OpenAI Codex (AGENTS.md)",
+      "enabled": true
+    },
     "claude": {
       "title": "Claude Code / Claude in GitHub",
       "enabled": true
     },
     "cursor": {
       "title": "Cursor rules",
-      "enabled": false
-    },
-    "skills": {
-      "$comment": "Ships off. It renders the same rules as the claude vendor in a different shape, and a repository selecting both loads every stack twice. Select it INSTEAD of claude where per-stack loading is wanted: redline init --vendors skills,copilot,agents.",
-      "title": "Claude skills (per-stack, loaded on demand)",
-      "enabled": false
+      "enabled": true
     }
   },
   "$deterministicComment": "Rules a checker decides without a model. The classification lives HERE and not in the markdown deliberately: standards/*.md is what a reviewer reads, and removing a rule from it because a checker also covers it would narrow what the model considers. Every rule is classified by construction \u2014 listed here means deterministic, absent means judgement. Ids are permanent and are never rewritten by this list. scripts/validate.mjs fails the build if an id here has no implementation in cli/policy/checks.ts, which is the failure mode where a rule is silently enforced by nobody.",