redlinegate 0.0.1

package/rulesets/redline-ruleset.json

@@ -0,0 +1,49 @@
+{
+  "name": "Redline",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": [
+        "~DEFAULT_BRANCH"
+      ],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": true,
+        "automatic_copilot_code_review_enabled": true,
+        "allowed_merge_methods": [
+          "squash",
+          "merge"
+        ]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {
+            "context": "redline-gate / gate"
+          }
+        ]
+      }
+    }
+  ],
+  "bypass_actors": []
+}

package/scripts/assign-rule-ids.mjs

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+// Assigns a stable `<stack>/<slug>` id to every normative rule in standards/ that does
+// not already have one, and rewrites the source file in place.
+//
+//   node scripts/assign-rule-ids.mjs            # assign missing ids
+//   node scripts/assign-rule-ids.mjs --check    # fail if any rule is missing an id
+//
+// Ids are written into the source markdown, not derived at render time, because a
+// derived id changes whenever someone rewords the rule — and then every historical
+// telemetry record for that rule silently orphans. Once written, an id is permanent:
+// edit the prose freely, never the id.
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const CHECK = process.argv.includes('--check');
+const manifest = JSON.parse(readFileSync(join(ROOT, 'standards/manifest.json'), 'utf8'));
+
+// Headings whose bullets are normative rules. "What NOT to flag" is deliberately absent:
+// those are anti-rules and are never reported as findings.
+const RULE_HEADING = /^#{2,3}\s+(BLOCKER|HIGH|SUGGESTION|Security|Type safety|Error handling|General correctness|Scope discipline)\b/i;
+const ANY_HEADING = /^#{1,6}\s/;
+const HAS_ID = /^-\s+`[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*`\s+—\s/;
+const BULLET = /^-\s+(.*)$/;
+
+const STOP = new Set([
+  'the', 'a', 'an', 'and', 'or', 'of', 'in', 'on', 'to', 'for', 'with', 'without',
+  'that', 'this', 'is', 'are', 'be', 'no', 'not', 'new', 'code', 'inside', 'from',
+  'where', 'when', 'must', 'any', 'all', 'its', 'it', 'as', 'at', 'by',
+]);
+
+function slugFor(text) {
+  // Prefer the bold lead-in — it is the rule's name. Fall back to the first sentence.
+  const bold = /^\*\*(.+?)\*\*/s.exec(text);
+  const source = bold ? bold[1] : text.split(/[.—:]/)[0];
+  const words = source
+    .replace(/`([^`]*)`/g, ' $1 ')
+    .replace(/[^A-Za-z0-9\s.+#-]/g, ' ')
+    .replace(/\./g, ' ')
+    .split(/\s+/)
+    .map((w) => w.toLowerCase().replace(/^-+|-+$/g, ''))
+    .filter(Boolean);
+
+  const kept = [];
+  for (const word of words) {
+    if (kept.length >= 4) break;
+    if (STOP.has(word) && kept.length) continue;
+    if (STOP.has(word) && !kept.length && words.length > 1) continue;
+    kept.push(word.replace(/\+\+/g, 'pp').replace(/#/g, 'sharp').replace(/[^a-z0-9-]/g, ''));
+  }
+  const slug = kept.filter(Boolean).join('-').replace(/-+/g, '-').replace(/^-|-$/g, '');
+  return slug || 'rule';
+}
+
+const targets = [
+  ['core', 'standards/core.md'],
+  ...Object.entries(manifest.stacks).map(([id, s]) => [id, s.source]),
+];
+
+const seen = new Map(); // id -> "file:line"
+const missing = [];
+let assigned = 0;
+
+for (const [prefix, relPath] of targets) {
+  const path = join(ROOT, relPath);
+  const lines = readFileSync(path, 'utf8').split('\n');
+  const used = new Set();
+  let inRules = false;
+  let inFence = false;
+  let changed = false;
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+
+    if (/^```/.test(line.trim())) inFence = !inFence;
+    if (inFence) continue;
+
+    if (ANY_HEADING.test(line)) {
+      inRules = RULE_HEADING.test(line);
+      continue;
+    }
+    if (!inRules) continue;
+
+    const bullet = BULLET.exec(line);
+    if (!bullet) continue;
+
+    if (HAS_ID.test(line)) {
+      const id = /^-\s+`([^`]+)`/.exec(line)[1];
+      if (seen.has(id)) {
+        console.error(`FAIL duplicate rule id "${id}" at ${relPath}:${i + 1} and ${seen.get(id)}`);
+        process.exitCode = 1;
+      }
+      seen.set(id, `${relPath}:${i + 1}`);
+      used.add(id);
+      continue;
+    }
+
+    if (CHECK) {
+      missing.push(`${relPath}:${i + 1}  ${bullet[1].slice(0, 70)}`);
+      continue;
+    }
+
+    let slug = slugFor(bullet[1]);
+    let id = `${prefix}/${slug}`;
+    let n = 2;
+    while (used.has(id) || seen.has(id)) id = `${prefix}/${slug}-${n++}`;
+    used.add(id);
+    seen.set(id, `${relPath}:${i + 1}`);
+
+    lines[i] = `- \`${id}\` — ${bullet[1]}`;
+    changed = true;
+    assigned += 1;
+  }
+
+  if (changed) writeFileSync(path, lines.join('\n'));
+}
+
+if (CHECK) {
+  if (missing.length) {
+    console.error(`${missing.length} rule(s) missing an id:`);
+    missing.forEach((m) => console.error(`  ${m}`));
+    process.exit(1);
+  }
+  console.log(`all ${seen.size} rules have ids`);
+} else {
+  console.log(`assigned ${assigned} new id(s); ${seen.size} rules total`);
+}

package/scripts/build-baseline.mjs

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+// Computes the Phase 0 baseline: the numbers every later phase in the roadmap is
+// judged against.
+//
+// Run once, by the owner, with org credentials. Every figure it cannot source is
+// reported as unavailable WITH ITS REASON rather than as zero — a zero that means
+// "nobody measured this" reads as a finding, and makes every later comparison
+// look like progress that did not happen.
+//
+// The roadmap's Phase 0 acceptance list, and where each figure comes from:
+//   repositories onboarded ......... registry.json (the derived register)
+//   today's acted-on rate .......... collected telemetry under data/
+//   findings per week .............. collected telemetry
+//   merge rate on Redline's own PRs  the GitHub search API (needs ORG + token)
+//   SARIF producers in use ......... a scan of each repo's workflows (needs token)
+//   token spend per review ......... the AI vendor's own usage reporting, which
+//                                    this script cannot read — supply it with
+//                                    SPEND_TOTAL/SPEND_CURRENCY/SPEND_GRAIN
+//
+// Env: [DATA_DIR=data], [REGISTRY=registry.json], [DAYS=90], [OUT=baseline.json],
+//      [GH_TOKEN + ORG] to survey Redline's own PRs and SARIF producers,
+//      [SPEND_TOTAL, SPEND_CURRENCY=USD, SPEND_GRAIN=org]
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { loadRecords, aggregate } from './lib/metrics.mjs';
+import { buildBaseline, formatBaseline } from './lib/baseline.mjs';
+
+const {
+  DATA_DIR = 'data',
+  REGISTRY = 'registry.json',
+  DAYS = '90',
+  OUT = 'baseline.json',
+  GH_TOKEN,
+  ORG,
+  SPEND_TOTAL,
+  SPEND_CURRENCY = 'USD',
+  SPEND_GRAIN = 'org',
+} = process.env;
+
+const windowDays = Number(DAYS);
+const since = new Date(Date.now() - windowDays * 86400000).toISOString();
+
+const { records, problems } = loadRecords(DATA_DIR, since);
+for (const problem of problems) console.warn(`  ${problem}`);
+
+const registry = existsSync(REGISTRY)
+  ? JSON.parse(readFileSync(REGISTRY, 'utf8'))
+  : null;
+
+async function gh(path) {
+  const response = await fetch(`https://api.github.com${path}`, {
+    headers: {
+      authorization: `Bearer ${GH_TOKEN}`,
+      accept: 'application/vnd.github+json',
+      'user-agent': 'redlinegate',
+    },
+  });
+  if (!response.ok) throw new Error(`GitHub ${path} returned ${response.status}`);
+  return response.json();
+}
+
+// Redline's own pull requests across the estate — the guardrail that catches the
+// estate quietly declining while every other number looks fine.
+let ownPullRequests = null;
+if (GH_TOKEN && ORG) {
+  try {
+    const query = encodeURIComponent(`org:${ORG} is:pr head:redline/ created:>${since.slice(0, 10)}`);
+    const result = await gh(`/search/issues?q=${query}&per_page=100`);
+    ownPullRequests = (result.items ?? []).map((pr) => ({ merged: Boolean(pr.pull_request?.merged_at) }));
+  } catch (error) {
+    console.warn(`  could not survey Redline's own pull requests: ${error.message}`);
+  }
+}
+
+// Which SARIF producers the estate already runs — roadmap open question 1, and
+// the input that decides whether Phase 1 is the right first move at all.
+let sarifProducers = null;
+if (GH_TOKEN && ORG && registry) {
+  sarifProducers = {};
+  const KNOWN = [
+    ['codeql-action', 'CodeQL'],
+    ['snyk', 'Snyk'],
+    ['semgrep', 'Semgrep'],
+    ['sonarsource', 'SonarQube'],
+    ['trivy', 'Trivy'],
+    ['checkmarx', 'Checkmarx'],
+    ['upload-sarif', 'other (uploads SARIF)'],
+  ];
+  for (const entry of registry.entries ?? []) {
+    const repo = `${entry.org}/${entry.repo}`;
+    try {
+      const listing = await gh(`/repos/${repo}/contents/.github/workflows`);
+      const tools = new Set();
+      for (const file of listing) {
+        if (!/\.ya?ml$/.test(file.name)) continue;
+        const body = await gh(`/repos/${repo}/contents/${file.path}`);
+        const text = Buffer.from(body.content ?? '', 'base64').toString('utf8').toLowerCase();
+        for (const [needle, name] of KNOWN) if (text.includes(needle)) tools.add(name);
+      }
+      if (tools.size > 0) sarifProducers[repo] = [...tools];
+    } catch {
+      // A repository whose workflows this token cannot list is not evidence that
+      // it runs no scanner. Skipping it undercounts; claiming zero would be a
+      // stronger and wronger statement.
+    }
+  }
+}
+
+const spend = SPEND_TOTAL
+  ? { total: Number(SPEND_TOTAL), currency: SPEND_CURRENCY, grain: SPEND_GRAIN }
+  : null;
+
+const baseline = buildBaseline({
+  aggregate: aggregate(records),
+  windowDays,
+  registry,
+  ownPullRequests,
+  sarifProducers,
+  spend,
+});
+
+writeFileSync(OUT, `${JSON.stringify(baseline, null, 2)}\n`);
+console.log(formatBaseline(baseline));
+console.log(`\nWritten to ${OUT}.`);

package/scripts/build-correlation.mjs

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+// Research: does ignoring a finding cost anything?
+//
+// Redline can say a rule was ignored. It cannot say ignoring it mattered. Where a
+// finding was left unresolved and the same file's repository later attracted a
+// revert or a hotfix, that is evidence the rule earns its place — from git and
+// merged-pull-request history alone, with no incident feed, which is what keeps it
+// inside the roadmap's non-goals.
+//
+// The roadmap calls this the most speculative item on the list and says to cut it
+// without regret if the signal is too weak. So the output is a verdict on the
+// experiment as much as on any rule: below the sample threshold it reports that it
+// cannot say, rather than a number. A correlation quoted without its sample size
+// is how a plausible story becomes a policy nobody can unwind.
+//
+// Env: [DATA_DIR=data], [DAYS=180], [WINDOW_DAYS=30], [MIN_SAMPLE=10], [OUT=correlation.json]
+
+import { writeFileSync } from 'node:fs';
+import { loadRecords } from './lib/metrics.mjs';
+import { correlate, MIN_SAMPLE } from './lib/correlate.mjs';
+
+const {
+  DATA_DIR = 'data',
+  DAYS = '180',
+  WINDOW_DAYS = '30',
+  MIN_SAMPLE: MIN = String(MIN_SAMPLE),
+  OUT = 'correlation.json',
+} = process.env;
+
+const since = new Date(Date.now() - Number(DAYS) * 86400000).toISOString();
+const { records, problems } = loadRecords(DATA_DIR, since);
+for (const problem of problems) console.warn(`  ${problem}`);
+
+const result = correlate(records, {
+  windowDays: Number(WINDOW_DAYS),
+  minSample: Number(MIN),
+});
+
+writeFileSync(OUT, `${JSON.stringify(result, null, 2)}\n`);
+
+console.log(`Ignored-finding correlation — ${DAYS}-day history, ${result.windowDays}-day remediation window\n`);
+
+if (!result.verdict.reportable) {
+  console.log(`  NOT REPORTABLE. ${result.verdict.reason}`);
+  if (result.rules.length > 0) {
+    console.log('\n  What was seen, and withheld:');
+    for (const rule of result.rules.slice(0, 10)) {
+      console.log(`    ${rule.ruleId.padEnd(40)} ${rule.ignored} ignored — ${rule.reason}`);
+    }
+  }
+  console.log(
+    '\n  This is the honest output of a weak experiment, not a failure of it. The roadmap\n' +
+      '  sequences this piece last and says to cut it without regret if the signal stays thin.'
+  );
+} else {
+  console.log('  rule                                     ignored   followed by a revert/hotfix');
+  for (const rule of result.rules.filter((r) => r.reportable)) {
+    console.log(
+      `  ${rule.ruleId.padEnd(40)} ${String(rule.ignored).padStart(7)}   ${(rule.rate * 100).toFixed(0)}%`
+    );
+  }
+  if (result.verdict.rulesWithheld > 0) {
+    console.log(`\n  ${result.verdict.rulesWithheld} rule(s) withheld: too few ignored findings to mean anything.`);
+  }
+  console.log(`\n  ${result.verdict.caveat}`);
+}
+
+if (result.unattributable > 0) {
+  console.log(
+    `\n  ${result.unattributable} ignored finding(s) sat on a revert or hotfix itself and were not attributed: ` +
+      'a remediation\'s own findings say nothing about the change it remedied.'
+  );
+}
+console.log(`\nWritten to ${OUT}.`);