redlinegate 0.0.1

package/templates/CODEOWNERS

@@ -0,0 +1,29 @@
+# Reference shape only. `redline init` builds equivalent content in code and never reads
+# this file — it writes .github/CODEOWNERS only on a repository that has none yet, and
+# leaves an existing one untouched.
+#
+# The branch ruleset sets require_code_owner_review: true. Without a CODEOWNERS file that
+# rule is a silent no-op, so the platform team must own at minimum the enforcement surface
+# below — otherwise any contributor can weaken their own gate in a self-approved PR.
+#
+# Replace <org>/<team> placeholders before installing by hand.
+
+# Default owner for everything not matched below.
+*                                   @<org>/<owning-team>
+
+# --- Enforcement surface: platform team must approve any change here -------------------
+# Editing the caller workflow, the ruleset, or the review standards changes what this
+# repo is allowed to merge. These are the paths an attacker or a rushed engineer would
+# touch to make the gate stop failing.
+/.github/workflows/                 @<org>/platform-engineering
+/.github/CODEOWNERS                 @<org>/platform-engineering
+/.github/copilot-instructions.md    @<org>/platform-engineering
+/.github/instructions/              @<org>/platform-engineering
+/AGENTS.md                          @<org>/platform-engineering
+/CLAUDE.md                          @<org>/platform-engineering
+
+# --- Security-sensitive paths ---------------------------------------------------------
+/infra/                             @<org>/platform-engineering
+/terraform/                         @<org>/platform-engineering
+Dockerfile                          @<org>/platform-engineering
+/.github/dependabot.yml             @<org>/platform-engineering

package/templates/azure/pull_request_template.md

@@ -0,0 +1,72 @@
+# Summary
+
+<!-- What and why, 2-3 sentences. Link the ticket. -->
+
+Ticket:
+
+## Change type
+
+<!-- Tick the one that applies. This section is NOT gated — pick one and move on. -->
+
+- [ ] Feature
+- [ ] Bugfix
+- [ ] Refactor (approved beforehand)
+- [ ] Chore/config
+
+<!-- REDLINE:BEGIN — generated by Redline. Do not edit inside this block. -->
+
+## Launch readiness
+
+<!--
+GATED SECTION. `redline-gate` fails while any box here is unticked.
+If an item genuinely does not apply, delete the line and say why in the Summary.
+Do not delete the heading — the gate fails if the section is missing.
+-->
+
+- [ ] No secrets, keys, or customer data in code, logs, or fixtures
+- [ ] Input validated at boundaries touched by this change
+- [ ] Typecheck and lint pass with no new errors
+- [ ] Tested on: <!-- iOS / Android / web / staging -->
+- [ ] Error states handled (network failure, empty, loading)
+- [ ] Rollback is safe (no destructive migration, no breaking contract change)
+- [ ] No unrelated changes in the diff
+
+## Architecture decision
+
+<!-- If this PR makes a non-obvious technical choice, add an ADR and link it. Otherwise delete this section. -->
+
+ADR: `docs/adr/NNNN-*.md`
+
+## Redline exemption
+
+<!--
+Only fill this in if a process check above is failing and you are asking to merge anyway.
+Delete the whole section otherwise. A label alone no longer exempts anything: the gate
+reads THIS block, and an exemption with no reason and no end date is an opt-out, not an
+exemption.
+
+  - reason:  what is being accepted and why, in a sentence a reader in three months
+             can act on. "Needed for release" is not one.
+  - until:   YYYY-MM-DD, at most 90 days out. Longer than that is a standards change,
+             not an exemption — raise it in the Redline source repo.
+  - scope:   which checks it covers (checklist, adr). Omit to cover both.
+
+This can never exempt dependency review or the secret scan. Those do not soft-fail.
+-->
+
+- reason:
+- until:
+- scope:
+
+<!-- REDLINE:END -->
+
+## Automated review
+
+- [ ] Review comments addressed, or dismissed in-thread with a reason
+
+<!--
+Gate stuck on a process check you cannot satisfy? Add the `redline-exempt` label to
+this pull request and leave a comment explaining why. That downgrades the checklist
+and ADR checks to warnings. It does NOT bypass dependency review or the secret scan —
+those never soft-fail.
+-->

package/templates/github/pull_request_template.md

@@ -0,0 +1,72 @@
+# Summary
+
+<!-- What and why, 2-3 sentences. Link the ticket. -->
+
+Ticket:
+
+## Change type
+
+<!-- Tick the one that applies. This section is NOT gated — pick one and move on. -->
+
+- [ ] Feature
+- [ ] Bugfix
+- [ ] Refactor (approved beforehand)
+- [ ] Chore/config
+
+<!-- REDLINE:BEGIN — generated by Redline. Do not edit inside this block. -->
+
+## Launch readiness
+
+<!--
+GATED SECTION. `redline-gate` fails while any box here is unticked.
+If an item genuinely does not apply, delete the line and say why in the Summary.
+Do not delete the heading — the gate fails if the section is missing.
+-->
+
+- [ ] No secrets, keys, or customer data in code, logs, or fixtures
+- [ ] Input validated at boundaries touched by this change
+- [ ] Typecheck and lint pass with no new errors
+- [ ] Tested on: <!-- iOS / Android / web / staging -->
+- [ ] Error states handled (network failure, empty, loading)
+- [ ] Rollback is safe (no destructive migration, no breaking contract change)
+- [ ] No unrelated changes in the diff
+
+## Architecture decision
+
+<!-- If this PR makes a non-obvious technical choice, add an ADR and link it. Otherwise delete this section. -->
+
+ADR: `docs/adr/NNNN-*.md`
+
+## Redline exemption
+
+<!--
+Only fill this in if a process check above is failing and you are asking to merge anyway.
+Delete the whole section otherwise. A label alone no longer exempts anything: the gate
+reads THIS block, and an exemption with no reason and no end date is an opt-out, not an
+exemption.
+
+  - reason:  what is being accepted and why, in a sentence a reader in three months
+             can act on. "Needed for release" is not one.
+  - until:   YYYY-MM-DD, at most 90 days out. Longer than that is a standards change,
+             not an exemption — raise it in the Redline source repo.
+  - scope:   which checks it covers (checklist, adr). Omit to cover both.
+
+This can never exempt dependency review or the secret scan. Those do not soft-fail.
+-->
+
+- reason:
+- until:
+- scope:
+
+<!-- REDLINE:END -->
+
+## Automated review
+
+- [ ] Review comments addressed, or dismissed in-thread with a reason
+
+<!--
+Gate stuck on a process check you cannot satisfy? Apply the `redline-exempt` label AND
+fill in the `## Redline exemption` section above. The label says a check was waived; the
+block says who accepted what, why, and until when — and the gate reads the block.
+It does NOT bypass dependency review or the secret scan — those never soft-fail.
+-->

package/templates/redline.yml

@@ -0,0 +1,35 @@
+# Managed by Redline; regenerate with `redline init` rather than editing here.
+# Redline caller. Installed into every onboarded repo as .github/workflows/redline.yml
+# by `redline init`. Kept in sync by workflows/redline-sync.yml once `redline sync`
+# ships in Phase 3 — see CHANGELOG.md.
+#
+# DO NOT RENAME THE JOB. The branch ruleset requires the check "redline-gate / gate",
+# which is derived from this job id plus the aggregate job id in the reusable workflow.
+# Renaming it makes the required check unreportable and blocks every PR in this repo.
+#
+# Replace <org> with the organisation that hosts the `.github` repo.
+name: Redline
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited, labeled, unlabeled, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: redline-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  redline-gate:
+    uses: <org>/.github/.github/workflows/redline-gate.yml@main
+    with:
+      adr-diff-threshold: 300
+      fail-on-dependency-severity: high
+      soft-fail-labels: redline-exempt,redline-sync
+      # Written by `redline init --rung`. observe and warn report without blocking;
+      # block-blocker and block-high stop a merge. The security floor — dependency
+      # review and the secret scan — is not on this ladder and blocks at every rung.
+      rung: observe

package/templates/repo-context.md

@@ -0,0 +1,64 @@
+# Project context
+
+<!--
+TEMPLATE. Copy the content of this file to the TOP of the target repo's AGENTS.md,
+above the `<!-- REDLINE:BEGIN -->` marker, and fill the bracketed sections.
+
+Everything above the marker is owned by your team and is never overwritten by
+Redline sync. Everything inside the marker block is generated — do not edit it.
+
+Why this file matters: review quality is bounded by context. A reviewer that does
+not know FlashList is the standard cannot flag FlatList.
+-->
+
+## What this repo is
+
+[One paragraph: product name, what it does, who uses it, which market. e.g. "Customer
+self-care app for <market>, React Native (Expo) plus shared web components."]
+
+## Architecture
+
+- **App shell:** [Expo SDK NN / Next.js NN / Spring Boot N.N / NestJS NN]
+- **State:** server state via [TanStack Query]; client UI state via [Zustand]. No Redux.
+- **Navigation:** [expo-router / react-navigation native-stack]
+- **Styling:** [StyleSheet.create / Nativewind / styled-components]
+- **API layer:** [BFF at `src/api/`; types generated from OpenAPI into `src/api/types/`]
+- **Persistence:** [Postgres via Prisma / JPA + Flyway]
+- **Messaging:** [Kafka topics owned: ...]
+- **Lists:** [FlashList is the standard; FlatList only for legacy screens.]
+- **Images:** [expo-image everywhere.]
+
+## Directory map
+
+```
+src/
+  api/          # BFF client + generated types — do not hand-edit generated files
+  components/   # shared UI, design-system components
+  screens/      # one folder per screen
+  hooks/        # shared hooks
+  utils/        # pure functions only, no framework imports
+```
+
+## Team conventions
+
+- [TypeScript strict mode; `noUncheckedIndexedAccess` on.]
+- Error handling only at boundaries (API calls, storage, native modules, user input).
+- Comments only for non-obvious WHY, never WHAT.
+- Minimal diffs; no drive-by refactors in feature PRs.
+- Architecture decisions recorded as ADRs in `docs/adr/NNNN-title.md`.
+
+## Deliberate deviations from Redline
+
+<!--
+List rules this repo knowingly does not follow, with the reason. Reviewers should not
+re-raise these. If the list grows past a few entries, the standard is wrong — raise it
+in the Redline source repo instead of accumulating exceptions here.
+-->
+
+- [e.g. "`any` permitted in `src/legacy/**` until MIG-4412 completes."]
+
+## Review context
+
+- PRs may be authored by AI coding agents or contractors — review with the same rigour.
+- Merge requires one human approval plus green required checks. Automated review is
+  advisory input to the human reviewer; it never approves.

package/workflows/dashboard.yml

@@ -0,0 +1,119 @@
+# Lives in the redline-metrics repo. Rebuilds the Redline dashboard from collected
+# telemetry and publishes it to GitHub Pages.
+#
+# SECURITY: the page lists repo names, rule ids and finding counts. Set the Pages site to
+# private or internal visibility BEFORE enabling this. The build refuses to run until
+# PAGES_VISIBILITY_ACKNOWLEDGED is set as a repository variable.
+name: Redline Dashboard
+
+on:
+  schedule:
+    - cron: '30 5 * * *'
+  workflow_dispatch:
+  workflow_run:
+    # Rebuild as soon as new telemetry lands, so the page is never a day behind the data.
+    workflows: [Redline Collect, Redline Seed Canary]
+    types: [completed]
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: dashboard
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Confirm Pages visibility was reviewed
+        env:
+          ACK: ${{ vars.PAGES_VISIBILITY_ACKNOWLEDGED }}
+        run: |
+          if [[ "${ACK:-}" != "private" && "${ACK:-}" != "internal" ]]; then
+            echo "::error::Set the repository variable PAGES_VISIBILITY_ACKNOWLEDGED to 'private' or 'internal' after confirming the Pages site is not public. This page exposes org-wide delivery detail."
+            exit 1
+          fi
+
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Count onboarded repos
+        id: coverage
+        env:
+          GH_TOKEN: ${{ secrets.REDLINE_ORG_READ_TOKEN }}
+          SOURCE: ${{ vars.REDLINE_SOURCE || format('{0}/redline', github.repository_owner) }}
+        run: |
+          set -euo pipefail
+          # registry.json is the derived register of onboarded repositories, refreshed
+          # nightly by the source repo's Redline Registry workflow. Coverage is
+          # instrumented-vs-onboarded, so partial coverage cannot read as health. A
+          # failed read omits the figure rather than reporting zero — absent is honest,
+          # zero is a lie that looks like a finding.
+          # Written to a file rather than counted here: the dashboard reads the whole
+          # register for the enforcement ladder, not just its length, and a count
+          # alone cannot say how much of the estate is actually enforcing.
+          if gh api "repos/$SOURCE/contents/registry.json" --jq '.content' 2>/dev/null | base64 -d > registry.json; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            rm -f registry.json
+            echo "found=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::Could not read registry.json from $SOURCE — coverage and the ladder will be omitted."
+          fi
+
+      # No checkout of the Redline source, and no copy of its scripts in this
+      # repository. The command ships in the package; this repo owns its data and
+      # nothing else.
+      - name: Build dashboard
+        env:
+          STANDARDS_VERSION: ${{ vars.STANDARDS_VERSION }}
+        run: |
+          npx --yes "redlinegate@0.0.1" metrics dashboard \
+            --org "${{ github.repository_owner }}" \
+            --data data \
+            --days 90 \
+            --out dist \
+            --registry registry.json
+
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: dist
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4
+
+  alert:
+    needs: [build, deploy]
+    if: failure()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Open or update a failure issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          title="Redline dashboard build is failing"
+          existing=$(gh issue list --repo "$REPO" --state open --search "$title in:title" --json number --jq '.[0].number // ""')
+          if [[ -n "$existing" ]]; then
+            gh issue comment "$existing" --repo "$REPO" --body "Still failing: $RUN"
+          else
+            gh issue create --repo "$REPO" --title "$title" \
+              --body "The dashboard build failed, so the published page is now stale. Run: $RUN"
+          fi

package/workflows/inbox.yml

@@ -0,0 +1,97 @@
+# Lives in the Redline source repo. Rebuilds the org-wide PR inbox on a schedule and
+# publishes it to GitHub Pages.
+#
+# SECURITY: the page lists PR titles, authors and repo names. Set the Pages site to
+# private or internal visibility (Settings > Pages > Visibility) BEFORE enabling this.
+# On a public Pages site this publishes internal delivery detail to the internet. The
+# build refuses to run until PAGES_VISIBILITY_ACKNOWLEDGED is set as a repo variable.
+name: Redline Inbox
+
+on:
+  schedule:
+    - cron: '*/30 6-19 * * 1-5'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: inbox
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Confirm Pages visibility was reviewed
+        env:
+          ACK: ${{ vars.PAGES_VISIBILITY_ACKNOWLEDGED }}
+        run: |
+          if [[ "${ACK:-}" != "private" && "${ACK:-}" != "internal" ]]; then
+            echo "::error::Set the repository variable PAGES_VISIBILITY_ACKNOWLEDGED to 'private' or 'internal' after confirming the Pages site is not public. This page exposes org-wide PR titles and authors."
+            exit 1
+          fi
+
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install and build
+        run: |
+          npm ci
+          npm run build
+
+      # This one runs in the source repo, so it uses the build it is about to
+      # ship rather than the last published package: a broken inbox here is a
+      # broken command, and finding that out from the release is too late.
+      - name: Build inbox
+        env:
+          GH_TOKEN: ${{ secrets.REDLINE_ORG_READ_TOKEN }}
+        run: |
+          node dist/bin/redline.js metrics inbox \
+            --org "${{ github.repository_owner }}" \
+            --out dist
+
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: dist
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4
+
+  # A silently stale inbox is worse than no inbox: people trust a page that stopped
+  # updating three weeks ago. Surface the failure where someone will see it.
+  alert:
+    needs: [build, deploy]
+    if: failure()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Open or update a failure issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          title="Redline inbox build is failing"
+          existing=$(gh issue list --repo "$REPO" --state open --search "$title in:title" --json number --jq '.[0].number // ""')
+          if [[ -n "$existing" ]]; then
+            gh issue comment "$existing" --repo "$REPO" --body "Still failing: $RUN"
+          else
+            gh issue create --repo "$REPO" --title "$title" \
+              --body "The scheduled inbox build failed. The published page is now stale. Run: $RUN"
+          fi

package/workflows/redline-collect.yml

@@ -0,0 +1,61 @@
+# Lives in the redline-metrics repo. Pulls review outcomes for merged PRs across the org
+# and commits them as monthly JSONL.
+#
+# Replaces the old per-repo telemetry workflow: no Redline secret is stored in any
+# product repo, so onboarding a repo grants Redline no write access to anything.
+name: Redline Collect
+
+on:
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      days:
+        description: Look-back window in days
+        type: string
+        default: '8'
+
+permissions:
+  contents: write
+
+concurrency:
+  group: redline-collect
+  cancel-in-progress: false
+
+jobs:
+  collect:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Collect telemetry
+        env:
+          # Read-only: repo metadata + pull requests across the org. No write scope.
+          # The token travels as an environment variable rather than a flag: a
+          # command line is visible in the process table.
+          GH_TOKEN: ${{ secrets.REDLINE_ORG_READ_TOKEN }}
+        run: |
+          npx --yes "redlinegate@0.0.1" metrics collect \
+            --org "${{ github.repository_owner }}" \
+            --days "${{ inputs.days || '8' }}" \
+            --out data
+
+      - name: Commit
+        run: |
+          set -euo pipefail
+          if git diff --quiet -- data; then
+            echo "no telemetry changes" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          git config user.name  "redline-bot"
+          git config user.email "redline-bot@users.noreply.github.com"
+          git add data
+          git commit -m "data: telemetry through $(date -u +%Y-%m-%d)"
+          # Another run (or a digest commit) may have landed since checkout.
+          git pull --rebase origin "${GITHUB_REF_NAME}"
+          git push origin "HEAD:${GITHUB_REF_NAME}"
+          git diff --stat HEAD~1 -- data >> "$GITHUB_STEP_SUMMARY"