redlinegate 0.0.2 → 0.0.3

package/standards/manifest.json

@@ -1,6 +1,6 @@
 {
   "$comment": "Single source of truth for Redline. scripts/render.mjs turns this into vendor-specific artifacts. Never hand-edit generated output.",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "core": {
     "title": "Redline Core Engineering Standards",
     "source": "standards/core.md"
@@ -28,6 +28,60 @@
         "apps/**/src/**/*.ts"
       ]
     },
+    "angular": {
+      "title": "Angular",
+      "source": "standards/stacks/angular.md",
+      "globs": [
+        "**/*.component.ts",
+        "**/*.component.html",
+        "**/*.service.ts",
+        "**/*.directive.ts",
+        "**/*.pipe.ts",
+        "**/*.guard.ts",
+        "**/*.interceptor.ts",
+        "src/app/**",
+        "apps/**/src/app/**",
+        "packages/**/src/app/**"
+      ]
+    },
+    "vue": {
+      "title": "Vue",
+      "source": "standards/stacks/vue.md",
+      "globs": [
+        "**/*.vue",
+        "composables/**",
+        "pages/**",
+        "server/**/*.ts",
+        "src/**/*.ts",
+        "app/**/*.ts",
+        "apps/**/src/**/*.ts",
+        "packages/**/src/**/*.ts"
+      ]
+    },
+    "svelte": {
+      "title": "Svelte / SvelteKit",
+      "source": "standards/stacks/svelte.md",
+      "globs": [
+        "**/*.svelte",
+        "**/*.svelte.ts",
+        "**/*.svelte.js",
+        "src/routes/**",
+        "src/lib/**",
+        "apps/**/src/routes/**",
+        "apps/**/src/lib/**",
+        "packages/**/src/lib/**"
+      ]
+    },
+    "dom": {
+      "title": "Browser / DOM",
+      "source": "standards/stacks/dom.md",
+      "globs": [
+        "**/*.js",
+        "**/*.mjs",
+        "**/*.ts",
+        "**/*.html"
+      ]
+    },
     "react-native": {
       "title": "React Native",
       "source": "standards/stacks/react-native.md",
@@ -126,10 +180,26 @@
     "tooling": [
       "javascript"
     ],
-    "web": [
+    "web-react": [
       "javascript",
       "react"
     ],
+    "web-angular": [
+      "javascript",
+      "angular"
+    ],
+    "web-vue": [
+      "javascript",
+      "vue"
+    ],
+    "web-svelte": [
+      "javascript",
+      "svelte"
+    ],
+    "web-vanilla": [
+      "javascript",
+      "dom"
+    ],
     "mobile-rn": [
       "javascript",
       "react",
@@ -174,6 +244,7 @@
   },
   "$aliasComment": "Legacy profile names accepted by sync-targets.txt for backwards compatibility.",
   "profileAliases": {
+    "web": "web-react",
     "mobile": "mobile-rn",
     "java": "service-java",
     "go": "service-go",
@@ -190,18 +261,18 @@
       "title": "AGENTS.md (OpenAI Codex, Copilot coding agent, Jules, Cursor agent, Devin)",
       "enabled": true
     },
+    "codex": {
+      "$comment": "Renders AGENTS.md, the same file the \"agents\" vendor writes — that is the file OpenAI Codex reads, and inventing a second Codex-specific path would render rules nothing looks for. Listed separately because an operator looking for Codex should find it by name; selecting either produces the same artifact, and selecting both writes it once.",
+      "title": "OpenAI Codex (AGENTS.md)",
+      "enabled": true
+    },
     "claude": {
       "title": "Claude Code / Claude in GitHub",
       "enabled": true
     },
     "cursor": {
       "title": "Cursor rules",
-      "enabled": false
-    },
-    "skills": {
-      "$comment": "Ships off. It renders the same rules as the claude vendor in a different shape, and a repository selecting both loads every stack twice. Select it INSTEAD of claude where per-stack loading is wanted: redline init --vendors skills,copilot,agents.",
-      "title": "Claude skills (per-stack, loaded on demand)",
-      "enabled": false
+      "enabled": true
     }
   },
   "$deterministicComment": "Rules a checker decides without a model. The classification lives HERE and not in the markdown deliberately: standards/*.md is what a reviewer reads, and removing a rule from it because a checker also covers it would narrow what the model considers. Every rule is classified by construction \u2014 listed here means deterministic, absent means judgement. Ids are permanent and are never rewritten by this list. scripts/validate.mjs fails the build if an id here has no implementation in cli/policy/checks.ts, which is the failure mode where a rule is silently enforced by nobody.",

package/standards/stacks/angular.md

@@ -0,0 +1,57 @@
+# Angular Review Rules
+
+**Scope:** Angular 16+ applications and libraries — components, services, guards,
+interceptors and templates. Where a rule exists in both the core standard and here,
+the core rule wins and this file names only the Angular-specific shape of it.
+
+Templates are reviewable code. A `.component.html` file is where change detection,
+injection sinks and dead subscriptions actually become visible.
+
+## BLOCKER — request changes
+
+- `angular/bypass-security-trust` — **`DomSanitizer.bypassSecurityTrust*` on a value derived from external input.** The call exists to switch Angular's sanitiser off; passing a URL, a query param or an API field through it is an injection sink with the guard removed.
+
+  ```ts
+  // WRONG
+  this.html = this.sanitizer.bypassSecurityTrustHtml(comment.body);
+  // RIGHT — leave sanitisation on; bind the raw string
+  this.html = comment.body; // [innerHTML] sanitises it
+  ```
+
+- `angular/open-redirect-navigation` — **`router.navigateByUrl`, `location.href` or `[routerLink]` fed a user-controlled URL.** An `?next=` param that reaches navigation without an allow-list is an open redirect, and on `location.href` a `javascript:` URL is script execution.
+- `angular/dynamic-template-compilation` — **A component, template or `NgModule` compiled from a string that came from outside.** There is no sanitiser on this path — the string is code.
+- `angular/guard-as-only-auth` — **A route guard treated as the authorisation check.** Guards decide what gets rendered, never what gets served: every endpoint behind the route re-checks, or the data is one `curl` away.
+- `angular/secret-in-environment-file` — **A secret in `environment.ts` / `environment.prod.ts`.** These files are compiled into the browser bundle. Anything in them is public, whatever the filename suggests.
+- `angular/unsubscribed-subscription` — **`.subscribe()` with no teardown.** Use the `async` pipe, `takeUntilDestroyed()`, or unsubscribe in `ngOnDestroy` — a long-lived stream holds the component, its template and everything they close over.
+
+  ```ts
+  // WRONG
+  ngOnInit() { this.socket.messages$.subscribe((m) => this.messages.push(m)); }
+  // RIGHT
+  private readonly messages$ = this.socket.messages$.pipe(takeUntilDestroyed());
+  ```
+
+- `angular/uncancelled-request-race` — **A request per keystroke or per navigation that is not cancelled when it is superseded.** With `mergeMap` the responses land out of order and the slower, older one wins; with `concatMap` they stay ordered but queue, so the view shows an answer to a query the user has already moved on from. `switchMap` cancels the superseded request.
+- `angular/timer-not-cleared` — **`setInterval`, `setTimeout` or a manual event listener not torn down in `ngOnDestroy`.** It keeps firing against a destroyed view.
+
+## HIGH
+
+- `angular/function-call-in-template` — Method or getter invoked from a template binding (`{{ total() }}`, `*ngIf="isReady()"`) — it re-runs on every change-detection cycle, including ones triggered by unrelated events. Precompute, or use a signal or `computed`.
+- `angular/default-change-detection-hot-component` — A list, table or frequently-updated component left on default change detection. Require `ChangeDetectionStrategy.OnPush` where the inputs are immutable.
+- `angular/manual-change-detection` — `detectChanges()` / `markForCheck()` called to make the view update. It is a symptom: the state was mutated in place, or the work escaped the zone. Fix the source.
+- `angular/nested-subscribe` — `subscribe()` inside `subscribe()` — no cancellation, no error propagation, no ordering guarantee. Flatten with `switchMap`/`concatMap`.
+- `angular/duplicate-http-subscription` — The same cold `HttpClient` observable subscribed twice (two `async` pipes, or a `subscribe` plus a pipe) — that is two identical requests. `shareReplay({ bufferSize: 1, refCount: true })`.
+- `angular/input-object-mutation` — A child mutating an object it received as `@Input()`. The parent owns it; with `OnPush` the parent never learns it changed.
+- `angular/service-scope-mismatch` — `providedIn: 'root'` for state that must be per-component, or component `providers` for state that must be shared — one gives every consumer the same instance, the other silently gives each a fresh one.
+- `angular/effect-writes-own-signal` — An `effect()` writing a signal it also reads, or reaching for `allowSignalWrites` to make that legal. That is a cycle; `computed()` is what derived state is for.
+- `angular/missing-trackby` — `*ngFor` / `@for` over a list that reorders or re-fetches without `trackBy` (or `track`) — Angular destroys and rebuilds every row, losing focus and element state.
+- `angular/interceptor-swallows-error` — An `HttpInterceptor` or `catchError` returning `of(null)` / `EMPTY` so the caller sees a successful empty response. The failure is now indistinguishable from no data.
+- `angular/unvalidated-route-param` — A route param or query param consumed as a typed value (`+id`, `as Status`) with no validation — it is external input and a user types what they like.
+
+## SUGGESTION
+
+- `angular/prefer-async-pipe` — `async` pipe over a manual subscribe with a component field; subscription teardown comes free.
+- `angular/prefer-signal-over-behaviorsubject` — Signals for synchronous component state in new code; keep RxJS for streams that are genuinely asynchronous.
+- `angular/prefer-standalone-component` — Standalone components for new work rather than a new `NgModule`.
+- `angular/prefer-inject-function` — `inject()` over constructor parameter injection in new code — it composes inside functions and base classes.
+- `angular/oversized-component` — Component beyond ~300 lines, or a template beyond ~150 — suggest a split.

package/standards/stacks/dom.md

@@ -0,0 +1,61 @@
+# Browser / DOM Review Rules
+
+**Scope:** browser code with no component framework — progressive-enhancement scripts,
+widgets, embeds, web components, and anything talking to the DOM directly. A framework
+repository does not install these rules: React, Angular, Vue and Svelte each close most
+of these holes by default, and repeating them there is noise.
+
+These are the failures a framework normally hides. Without one, they are the whole
+attack surface.
+
+## BLOCKER — request changes
+
+- `dom/innerhtml-sink` — **`innerHTML` / `outerHTML` assigned anything not a hard-coded literal.** Concatenated markup around a variable is the sink, even when the variable "comes from our own API". Build nodes, or set `textContent`.
+
+  ```js
+  // WRONG
+  el.innerHTML = `<a href="${url}">${name}</a>`;
+  // RIGHT
+  const a = document.createElement('a');
+  a.href = url;          // still validate the scheme
+  a.textContent = name;
+  ```
+
+- `dom/insert-adjacent-html-sink` — **`insertAdjacentHTML`, `document.write`, or `Range.createContextualFragment` on a built string.** Same sink as `innerHTML`, with less scrutiny.
+- `dom/set-attribute-event-handler` — **`setAttribute` of an `on*` handler, or a `src`/`href` whose scheme is not checked.** `javascript:` and `data:text/html` both execute; an allow-list of `https:` (and `mailto:` where meant) is the check.
+- `dom/postmessage-no-origin-check` — **A `message` listener that reads `event.data` without first comparing `event.origin` to an expected origin.** Any page that can get a handle to the window can post to it.
+
+  ```js
+  // WRONG
+  window.addEventListener('message', (e) => apply(e.data));
+  // RIGHT
+  window.addEventListener('message', (e) => {
+    if (e.origin !== TRUSTED_ORIGIN) return;
+    apply(e.data);
+  });
+  ```
+
+- `dom/postmessage-wildcard-target` — **`postMessage(data, '*')`.** The payload goes to whatever document currently occupies that frame. Name the target origin.
+- `dom/url-input-into-sink` — **`location.hash`, `location.search` or a `data-*` attribute reaching markup, navigation or `eval` without validation.** It is the most attacker-controllable input a page has.
+- `dom/open-redirect` — **`location.href` / `location.assign` / `window.open` given a user-supplied URL** with no same-origin or allow-list check.
+- `dom/dynamic-script-injection` — **A `<script>` element whose `src` is built from external input**, or `new Function` / `eval` over fetched content.
+
+## HIGH
+
+- `dom/listener-never-removed` — `addEventListener` on `window`, `document` or a long-lived node with no matching `removeEventListener` (or `{ signal }`) when the widget is torn down. The handler keeps the whole closure alive and fires against detached state.
+- `dom/observer-never-disconnected` — `IntersectionObserver`, `ResizeObserver`, `MutationObserver` or `matchMedia` listener created without a `disconnect()` path.
+- `dom/timer-never-cleared` — `setInterval`/`setTimeout` retained past teardown.
+- `dom/fetch-no-abort` — A `fetch` that can be superseded (search-as-you-type, tab switch, re-render) started without an `AbortController` — the stale response arrives last and wins.
+- `dom/unparsed-json-boundary` — `JSON.parse` of a `data-*` attribute, a storage value or a response body with no `try`/`catch` and no shape check. All three are external input; a throw here takes the whole script down.
+- `dom/layout-thrash` — Reading a layout property (`offsetHeight`, `getBoundingClientRect`) and writing a style in the same loop. Each pair forces a synchronous reflow; batch reads, then writes, inside `requestAnimationFrame`.
+- `dom/document-wide-query-in-loop` — `document.querySelectorAll` (or `getElementById`) re-run per iteration or per event. Hoist the lookup; the DOM is not a cache.
+- `dom/scroll-resize-unthrottled` — `scroll`, `resize`, `mousemove` or `pointermove` handlers doing layout or network work with no throttle and no `{ passive: true }` — this is jank you can measure.
+- `dom/form-submit-not-prevented` — An `submit`/`click` handler doing async work without `preventDefault`, or preventing it without ever re-enabling the control — double submits or a permanently dead button.
+
+## SUGGESTION
+
+- `dom/prefer-event-delegation` — One delegated listener on a container over one per row for lists that change.
+- `dom/prefer-classlist` — `classList.add`/`toggle` over string surgery on `className`.
+- `dom/prefer-abort-signal-timeout` — `AbortSignal.timeout(ms)` over a manual `setTimeout` plus `controller.abort()`.
+- `dom/prefer-target-blank-noopener` — `rel="noopener"` on `target="_blank"` links; also state it explicitly on `window.open`.
+- `dom/prefer-dataset` — `el.dataset.x` over `getAttribute('data-x')`.

package/standards/stacks/svelte.md

@@ -0,0 +1,45 @@
+# Svelte Review Rules
+
+**Scope:** Svelte 4 and 5 components, stores, runes, and SvelteKit routes. Rules that
+name a rune (`$state`, `$derived`, `$effect`) apply to Svelte 5 files; the store and
+`$:` rules apply to Svelte 4 files and to Svelte 5 files still using them.
+
+SvelteKit's load functions are the sharpest edge here: a file's name decides whether its
+code runs only on the server or also in the browser, and nothing about the code says so.
+
+## BLOCKER — request changes
+
+- `svelte/html-tag-sink` — **`{@html}` with a value that was not sanitised server-side.** Svelte does no escaping inside it. Markdown output, a CMS field and a translation string are all attacker-reachable often enough to count.
+- `svelte/private-env-in-shared-code` — **`$env/static/private` or `$env/dynamic/private` imported from a component, a universal `+page.js`, or anything under `$lib` that a component imports.** The build fails when it notices; when it does not notice, the secret ships to the browser.
+- `svelte/secret-in-universal-load` — **A secret, a database handle or an internal-only URL used in `+page.js` / `+layout.js`.** Universal load runs on the server *and* again in the browser. Server-only work belongs in `+page.server.js`.
+
+  ```js
+  // WRONG — +page.js, also runs in the browser
+  export const load = async () => db.query('select * from orders');
+  // RIGHT — +page.server.js
+  export const load = async () => ({ orders: await db.query('select * from orders') });
+  ```
+
+- `svelte/module-context-shared-state` — **Mutable state in `<script context="module">` (Svelte 5: `<script module>`), or at the top level of a `$lib` module.** It is shared by every component instance, and on the server by every request — one user's data in another user's page.
+- `svelte/endpoint-missing-auth` — **A form action or `+server.js` handler with no authorisation check.** The route being reachable only from a guarded page is not a check; the endpoint is a public URL.
+- `svelte/unvalidated-form-data` — **`await request.formData()` fields consumed without validation.** A form action is an HTTP endpoint: field presence, type and length are all attacker-chosen.
+
+## HIGH
+
+- `svelte/reactive-statement-side-effect` — A `$:` block performing a fetch, a mutation or navigation. Its dependencies are inferred from what it reads, so an unrelated assignment re-runs it — and a value it writes can re-trigger it.
+- `svelte/store-not-unsubscribed` — `store.subscribe()` called manually without keeping and calling the returned unsubscriber. The `$store` auto-subscription form handles this; hand-rolled subscriptions in `onMount` usually do not.
+- `svelte/effect-for-derived-state` — `$effect` writing a `$state` that is computable from other state. `$derived` cannot go stale, cannot loop, and needs no cleanup.
+- `svelte/effect-missing-cleanup` — `$effect` (or `onMount`) starting a timer, listener, observer or request with no teardown returned — it survives the component.
+- `svelte/each-missing-key` — `{#each}` over a list that reorders or filters, with no `(item.id)` key — Svelte reuses nodes positionally and component state follows position.
+- `svelte/load-waterfall` — Sequential `await`s in `load` for independent data. They serialise the whole page's time-to-first-byte; use `Promise.all`, or return the promises and stream them.
+- `svelte/global-fetch-in-load` — `load` using global `fetch` instead of the `fetch` from its event argument. The event's version forwards cookies, resolves relative URLs on the server and lets the SSR response be reused on hydration — the global one silently does none of that.
+- `svelte/error-swallowed-in-load` — `load` catching a failure and returning empty data instead of `error(status, …)`. The page renders as if there were no orders, rather than as an error.
+- `svelte/state-mutation-across-boundary` — Mutating a `$state` object passed into a child, or a prop object, from that child. Ownership is the parent's; with `$props()` the write is not propagated back.
+- `svelte/unvalidated-url-param` — `params` / `url.searchParams` consumed as a typed value with no validation.
+
+## SUGGESTION
+
+- `svelte/prefer-runes` — Runes (`$state`, `$derived`, `$props`) over `export let` and `$:` in new Svelte 5 components — the dependency graph stops being positional.
+- `svelte/prefer-snippets-over-slots` — Snippets over slots in new Svelte 5 code; they are typed and can take parameters.
+- `svelte/prefer-derived-by` — `$derived.by` for multi-statement derivations instead of an effect plus a `$state`.
+- `svelte/oversized-component` — Component beyond ~300 lines — suggest extracting a child or a `.svelte.js` module.

package/standards/stacks/vue.md

@@ -0,0 +1,54 @@
+# Vue Review Rules
+
+**Scope:** Vue 3 single-file components, composables, and Nuxt applications. Options-API
+files are reviewed against the same rules — the reactivity model is shared even where the
+syntax is not.
+
+Losing reactivity is the failure mode this file exists for: nothing throws, nothing logs,
+the screen simply stops matching the data.
+
+## BLOCKER — request changes
+
+- `vue/v-html-sink` — **`v-html` bound to anything not sanitised on the server.** Vue does not sanitise it. A comment, a CMS field or a translation string rendered this way is script execution.
+- `vue/dynamic-component-from-input` — **`<component :is>` resolved from a user-supplied string.** It selects which component runs; an attacker choosing that is an injection sink.
+- `vue/ssr-module-scope-state` — **Mutable state declared at module scope in an SSR app.** On the server the module is shared by every request, so one user's data renders in another user's response. State belongs in `setup()`, a store factory, or `useState()` in Nuxt.
+
+  ```ts
+  // WRONG — one `cart` for the whole server process
+  const cart = reactive({ items: [] });
+  export const useCart = () => cart;
+  // RIGHT
+  export const useCart = () => useState('cart', () => ({ items: [] }));
+  ```
+
+- `vue/public-env-secret` — **A secret read through `import.meta.env.VITE_*` or Nuxt `runtimeConfig.public`.** Both are inlined into the client bundle by design. Server-only values go in `runtimeConfig` without `public`.
+- `vue/reactivity-lost-on-destructure` — **A `reactive()` object or `props` destructured into plain variables.** The binding is a one-time copy: the value freezes at its first read and the view silently stops updating. Use `toRefs()`, or keep the object.
+
+  ```ts
+  // WRONG
+  const { count } = reactive({ count: 0 });
+  // RIGHT
+  const { count } = toRefs(state);
+  ```
+
+- `vue/prop-mutation` — **A child writing to a prop, or mutating an object it received as one.** The parent owns that value; the write is lost on the next parent render and the two trees disagree until then.
+
+## HIGH
+
+- `vue/lifecycle-after-await` — `onMounted`/`onUnmounted` registered after an `await` in `setup()`. Registration is synchronous — past the first await there is no active instance, so the hook never runs and its cleanup never runs either.
+- `vue/watcher-missing-cleanup` — A `watch`/`watchEffect` that starts a timer, a listener or a request without `onWatcherCleanup` / `onScopeDispose` — the previous run keeps going and its late response overwrites the current one.
+- `vue/watch-instead-of-computed` — A `watch` whose only job is assigning to another ref. That is derived state: `computed()` recomputes correctly, cannot go stale, and needs no cleanup.
+- `vue/reactive-reassignment` — Reassigning a whole `reactive()` array or object (`state.items = next`) where callers captured the original reference — they keep the old proxy. Mutate in place, or use `ref()` and assign `.value`.
+- `vue/deep-watch-large-object` — `{ deep: true }` over a large structure or an entire store. Every mutation anywhere inside re-runs the handler; watch the specific getter instead.
+- `vue/v-for-index-key` — `:key="index"` on a list that reorders, inserts or deletes — Vue reuses the wrong node and component state follows the index, not the item.
+- `vue/v-if-with-v-for` — `v-if` and `v-for` on the same element. The precedence is not what it reads like and the filter re-runs per item; filter in a `computed`.
+- `vue/async-setup-without-suspense` — `async setup()` in a component not wrapped in `<Suspense>` — it renders nothing, with no error, until the promise settles.
+- `vue/composable-called-conditionally` — A composable called inside a condition, a loop or a callback. Like hooks, they bind to the active instance at call time.
+- `vue/unvalidated-route-param` — `route.params` / `route.query` consumed as a typed value with no validation — external input, whatever the router's types claim.
+
+## SUGGESTION
+
+- `vue/prefer-script-setup` — `<script setup>` over the options object in new components — less ceremony and better type inference.
+- `vue/prefer-typed-defineprops` — Type-based `defineProps<T>()` over the runtime object form where the project is TypeScript.
+- `vue/prefer-shallowref` — `shallowRef` for large immutable payloads that are replaced rather than edited — deep proxying them costs on every access.
+- `vue/oversized-sfc` — Single-file component beyond ~300 lines — suggest extracting a composable.

package/templates/redline.yml

@@ -29,3 +29,7 @@ jobs:
       # block-blocker and block-high stop a merge. The security floor — dependency
       # review and the secret scan — is not on this ladder and blocks at every rung.
       rung: observe
+      # Gate jobs another tool in this repository already covers, written by
+      # `redline init` from the tools you declared. A stood-down job is skipped
+      # and the aggregate reads a skip as a pass. Empty runs every job.
+      stand-down: ''

package/workflows/redline-gate.yml

@@ -39,6 +39,16 @@ on:
           which refuses a promotion the repository's recorded evidence does not support.
         type: string
         default: observe
+      stand-down:
+        description: >-
+          Comma-separated gate jobs another tool in the calling repository already covers:
+          `policy`, `dependencies`, `secrets`. A stood-down job is skipped and the
+          aggregate below reads a skip as a pass. Written by `redline init` from the tools
+          the repository DECLARED, never from detection alone — `dependencies` and
+          `secrets` are the two jobs no label can waive, so a wrong guess here is the one
+          that removes a security check nobody asked to remove. Empty runs every job.
+        type: string
+        default: ''
       exemption-enforcement:
         description: >-
           What a soft-fail label without a valid "## Redline exemption" block does.
@@ -111,6 +121,7 @@ jobs:
           fi
 
   policy:
+    if: ${{ !contains(format(',{0},', inputs.stand-down), ',policy,') }}
     # The deterministic tier: the rules a checker can decide, evaluated with no
     # model call. They cost nothing to run and they cannot hallucinate, which is
     # the point — an author cannot argue with a model about whether the word TODO
@@ -151,6 +162,7 @@ jobs:
             --diff-file /tmp/redline.diff --fail-on "$fail_on"
 
   dependency-review:
+    if: ${{ !contains(format(',{0},', inputs.stand-down), ',dependencies,') }}
     name: Dependency review
     runs-on: ubuntu-latest
     steps:
@@ -161,6 +173,7 @@ jobs:
           comment-summary-in-pr: on-failure
 
   secrets:
+    if: ${{ !contains(format(',{0},', inputs.stand-down), ',secrets,') }}
     name: Secret scan (diff)
     runs-on: ubuntu-latest
     steps:
@@ -215,10 +228,21 @@ jobs:
           # Security checks can never be downgraded by a label.
           HARD_JOBS='["dependency-review","secrets"]'
 
-          hard_failed=$(jq -r --argjson hard "$HARD_JOBS" \
-            'to_entries[] | select(.value.result != "success") | select(.key as $k | $hard | index($k)) | .key' <<<"$RESULTS")
-          soft_failed=$(jq -r --argjson hard "$HARD_JOBS" \
-            'to_entries[] | select(.value.result != "success") | select(.key as $k | $hard | index($k) | not) | .key' <<<"$RESULTS")
+          # `skipped` is a pass. None of these jobs has `needs`, so the only thing
+          # that skips one is its own stand-down guard above — a deliberate
+          # instruction from the calling repository, not a job that fell over.
+          # Without this the aggregate failed every repository that narrowed the
+          # gate, which is the opposite of what narrowing it asks for.
+          PASSED='["success","skipped"]'
+
+          # `.value.result as $r` first: inside `$passed | index(...)` the input
+          # is $passed, so referring to `.value.result` there indexes the array
+          # with a string and jq exits 5 — which `set -e` turns into a gate that
+          # fails every pull request.
+          hard_failed=$(jq -r --argjson hard "$HARD_JOBS" --argjson passed "$PASSED" \
+            'to_entries[] | .value.result as $r | select($passed | index($r) | not) | select(.key as $k | $hard | index($k)) | .key' <<<"$RESULTS")
+          soft_failed=$(jq -r --argjson hard "$HARD_JOBS" --argjson passed "$PASSED" \
+            'to_entries[] | .value.result as $r | select($passed | index($r) | not) | select(.key as $k | $hard | index($k) | not) | .key' <<<"$RESULTS")
 
           labelled=false
           for label in ${SOFT_FAIL_LABELS//,/ }; do

package/scripts/measure-context.mjs

@@ -1,101 +0,0 @@
-#!/usr/bin/env node
-// Measures what the skills render target actually saves, per profile.
-//
-// The roadmap makes this piece conditional on the measurement: it is a cost
-// optimisation, it is rated the highest-exposure item in the plan, and it dies if
-// the reduction is marginal. So the number is produced by a script anyone can
-// re-run rather than asserted once in a changelog.
-//
-// What is compared:
-//   composed  — AGENTS.md, which a Claude session loads in full every turn for the
-//               life of the session, whatever file is being edited
-//   per-stack — the core skill plus the ONE stack whose files are in play, which
-//               is what a skills-rendered repository loads instead
-//
-// Env: [ROOT=.], [OUT] (write JSON here as well as printing)
-
-import { cpSync, existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
-import { render } from '../dist/render/standards.js';
-
-const { ROOT = process.cwd(), OUT } = process.env;
-
-// This measures the standards package, so it needs one. Running it in a product
-// repository is a reasonable mistake — the command surface does not hide that it
-// exists — and an ENOENT stack trace is the worst possible answer to it.
-if (!existsSync(join(ROOT, 'standards/manifest.json'))) {
-  console.error(`No standards/manifest.json under ${resolve(ROOT)}.`);
-  console.error('This measures the Redline standards themselves, so it runs in the source repo.');
-  console.error('Point it somewhere else with --root <path>.');
-  process.exit(2);
-}
-
-// A scratch root whose manifest has skills enabled, so the measurement does not
-// depend on whether the org has switched it on yet.
-const root = mkdtempSync(join(tmpdir(), 'redline-measure-'));
-cpSync(join(ROOT, 'standards'), join(root, 'standards'), { recursive: true });
-const manifestPath = join(root, 'standards/manifest.json');
-const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
-manifest.vendors.skills.enabled = true;
-writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
-
-const rows = [];
-for (const profile of Object.keys(manifest.profiles)) {
-  const skillsOut = mkdtempSync(join(tmpdir(), 'redline-skills-'));
-  render({ root, profile, out: skillsOut, vendors: ['skills'] });
-  const dir = join(skillsOut, '.claude/skills');
-  const size = (name) => readFileSync(join(dir, name, 'SKILL.md'), 'utf8').length;
-  const names = readdirSync(dir);
-  const core = size('redline-core');
-  const stacks = names.filter((n) => n !== 'redline-core');
-  // The mean stack, not the smallest: quoting the best case would be marketing.
-  const perStack =
-    core + (stacks.length ? Math.round(stacks.reduce((a, n) => a + size(n), 0) / stacks.length) : 0);
-
-  const composedOut = mkdtempSync(join(tmpdir(), 'redline-composed-'));
-  render({ root, profile, out: composedOut, vendors: ['claude', 'agents'] });
-  const composed = readFileSync(join(composedOut, 'AGENTS.md'), 'utf8').length;
-
-  rows.push({
-    profile,
-    stacks: stacks.length,
-    composedBytes: composed,
-    perStackBytes: perStack,
-    reduction: 1 - perStack / composed,
-  });
-
-  rmSync(skillsOut, { recursive: true, force: true });
-  rmSync(composedOut, { recursive: true, force: true });
-}
-rmSync(root, { recursive: true, force: true });
-
-rows.sort((a, b) => b.reduction - a.reduction);
-
-const pct = (n) => `${(n * 100).toFixed(1)}%`;
-console.log('profile           stacks   composed   per-stack   reduction');
-for (const row of rows) {
-  console.log(
-    `${row.profile.padEnd(17)}${String(row.stacks).padStart(6)}   ${String(row.composedBytes).padStart(8)}   ${String(row.perStackBytes).padStart(9)}   ${pct(row.reduction).padStart(9)}`
-  );
-}
-
-// The finding, stated rather than left for a reader to notice: a single-stack
-// profile pays the skill frontmatter and gains nothing, because there is no
-// second stack to avoid loading. Selecting skills there makes the repository
-// worse, and no amount of rollout enthusiasm changes that.
-const helped = rows.filter((r) => r.reduction > 0);
-const hurt = rows.filter((r) => r.reduction <= 0);
-console.log('');
-console.log(`Helps ${helped.length} profile(s): ${pct(Math.min(...helped.map((r) => r.reduction)))} to ${pct(Math.max(...helped.map((r) => r.reduction)))}.`);
-if (hurt.length > 0) {
-  console.log(
-    `Costs ${hurt.length} profile(s) — all single-stack (${hurt.map((r) => r.profile).join(', ')}): ` +
-      'there is no second stack to avoid loading, so the frontmatter is pure overhead. Do not select skills there.'
-  );
-}
-
-if (OUT) {
-  writeFileSync(OUT, `${JSON.stringify({ generatedAt: new Date().toISOString(), rows }, null, 2)}\n`);
-  console.log(`\nWritten to ${OUT}.`);
-}