trae-coding-engine 0.1.0

package/templates/scripts/check-mr-size.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# Hard guardrail: block MRs whose diff exceeds 8000 lines of human-authored
+# change against the target branch.
+#
+# Rationale: large MRs are unreviewable in practice. AGENTS.md / vibe-coding.html
+# already recommend splitting at 200 lines; this script enforces a non-negotiable
+# ceiling at the MR layer. Generated files (lockfiles, auto-gen typings,
+# i18n locales, vendored assets) are excluded from the count -- they routinely
+# balloon legitimately and should not block review.
+#
+# Usage:
+#   scripts/check-mr-size.sh                     # diff against origin/release
+#   scripts/check-mr-size.sh --base main         # diff against another base
+#
+# Exit codes:
+#   0  under ceiling
+#   1  over ceiling -- MR creation should be aborted
+#   2  bad usage / missing dependency
+
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+# shellcheck source=scripts/lib/cli-args.sh
+. scripts/lib/cli-args.sh
+
+MAX_LINES=8000
+
+BASE=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --base) BASE=$(require_value --base "${2:-}"); shift 2 ;;
+    --base=*) BASE="${1#--base=}"; shift ;;
+    -h|--help)
+      sed -n '2,20p' "$0"; exit 0 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+# Default base: prefer origin/release (project convention per open-mr.sh),
+# fall back to origin/main, then main.
+if [ -z "$BASE" ]; then
+  for candidate in origin/release origin/main main; do
+    if git rev-parse --verify --quiet "$candidate" >/dev/null; then
+      BASE="$candidate"; break
+    fi
+  done
+fi
+if [ -z "$BASE" ]; then
+  echo "error: could not resolve a base branch; pass --base <ref>" >&2
+  exit 2
+fi
+
+# Validate BASE resolves to a commit. Without this, an invalid ref (typo,
+# unfetched remote branch) makes `git diff` fail under `< <(...)`, where
+# `set -euo pipefail` does NOT propagate the failure -- awk's END block
+# then emits "0 0" and the guardrail silently passes, defeating its purpose.
+if ! git rev-parse --verify --quiet "${BASE}^{commit}" >/dev/null; then
+  echo "error: base ref does not resolve to a commit: ${BASE}" >&2
+  echo "       did you forget to 'git fetch origin'?" >&2
+  exit 2
+fi
+
+# Three-dot diff -- count changes introduced on this branch since it forked
+# from BASE, NOT changes that landed on BASE in the meantime.
+#
+# Exclusions: lockfiles, auto-generated typings, i18n locale bundles, vendored
+# build artifacts, generated Go / API-doc bundles, and generated deployment SQL.
+# Keep this list narrow -- every exclusion is a hole. The Go-codegen + openapi
+# patterns mirror the "generated code" set already used by
+# scripts/check-comment-i18n.sh and .golangci.yml; regenerating from a source
+# (IDL / go:generate / redocly / migration SQL) legitimately balloons these and
+# must not count against review size.
+EXCLUDES=(
+  ':(exclude)**/pnpm-lock.yaml'
+  ':(exclude)**/package-lock.json'
+  ':(exclude)**/yarn.lock'
+  ':(exclude)**/go.sum'
+  ':(exclude)**/Cargo.lock'
+  ':(exclude)web/packages/api/src/bam-auto-gen/**'
+  ':(exclude)web/apps/*/locales/**'
+  ':(exclude)**/*.snap'
+  ':(exclude)**/testdata/**'
+  ':(exclude)**/vendor/**'
+  ':(exclude)**/dist/**'
+  ':(exclude)**/build/**'
+  ':(exclude)**/thrift_gen/**'
+  ':(exclude)**/*.pb.go'
+  ':(exclude)**/*_gen.go'
+  ':(exclude)**/mock_*.go'
+  ':(exclude)**/mocks/**'
+  ':(exclude)**/zz_generated*'
+  ':(exclude)docs/openapi/openapi.yaml'
+  ':(exclude)docs/openapi/*.html'
+  ':(exclude)deployments/coding-engine/sql/**'
+)
+
+# numstat: <added>\t<deleted>\t<path>. Binary files emit '-'; treat as 0.
+read -r ADDED DELETED < <(
+  git diff --numstat "${BASE}...HEAD" -- . "${EXCLUDES[@]}" \
+    | awk '
+        $1 == "-" { next }
+        { a += $1; d += $2 }
+        END { printf "%d %d\n", a+0, d+0 }
+      '
+)
+TOTAL=$((ADDED + DELETED))
+
+printf "  base:        %s\n" "$BASE"
+printf "  added:       %d\n" "$ADDED"
+printf "  deleted:     %d\n" "$DELETED"
+printf "  total:       %d (excluding generated files)\n" "$TOTAL"
+printf "  ceiling:     %d\n" "$MAX_LINES"
+
+if [ "$TOTAL" -le "$MAX_LINES" ]; then
+  echo "  [OK]  under MR size ceiling"
+  exit 0
+fi
+
+cat >&2 <<EOF
+
+  [BLOCK] MR diff is ${TOTAL} lines, exceeding ceiling of ${MAX_LINES}.
+
+  Large MRs are unreviewable. Split this branch into reviewable slices:
+    - separate refactor commits from behavior changes
+    - extract pure-mechanical renames into their own MR
+    - land scaffolding before features that depend on it
+EOF
+exit 1

package/templates/scripts/check-mr-title.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Hard guardrail: block MRs whose title doesn't follow Conventional Commits.
+#
+# Same format every commit on main/release already uses. Pairs with
+# scripts/check-mr-desc.sh; both are invoked from .gitlab-ci.yml on every MR
+# pipeline.
+#
+# Title source, checked in order:
+#   1. --title "<text>"             (local)
+#   2. $CI_MERGE_REQUEST_TITLE env  (GitLab built-in; not truncated)
+#
+# Rules (medium-strictness):
+#   - Length: <= 72 chars (after stripping any "Draft: " / "WIP: " prefix)
+#   - No trailing '.'
+#   - Format: <type>(<scope>)?!?: <subject>
+#   - Subject: >= 5 chars
+#   - Exception: GitLab default revert titles `Revert "..."` are exempt
+#
+# Exit codes:
+#   0  title is acceptable
+#   1  title fails one or more checks -- MR should be blocked
+#   2  bad usage / no title provided
+
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+# shellcheck source=scripts/lib/cli-args.sh
+. scripts/lib/cli-args.sh
+# shellcheck source=scripts/lib/mr-conventions.sh
+. scripts/lib/mr-conventions.sh
+
+TITLE_MAX_LEN=72
+SUBJECT_MIN_LEN=5
+SCOPE_RE='(\([a-z0-9._-]+\))?'
+TITLE_RE="^${CC_TYPE_RE}${SCOPE_RE}!?: .{${SUBJECT_MIN_LEN},}\$"
+
+TITLE=""
+source_label=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --title)
+      TITLE=$(require_value --title "${2:-}"); shift 2 ;;
+    --title=*)
+      TITLE="${1#--title=}"; shift ;;
+    -h|--help)
+      sed -n '2,23p' "$0"; exit 0 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+if [ -n "$TITLE" ]; then
+  source_label="arg"
+elif [ -n "${CI_MERGE_REQUEST_TITLE:-}" ]; then
+  TITLE="$CI_MERGE_REQUEST_TITLE"
+  source_label="env:CI_MERGE_REQUEST_TITLE"
+elif [ -n "${CI_MERGE_REQUEST_IID:-}" ]; then
+  echo "error: running on an MR pipeline but \$CI_MERGE_REQUEST_TITLE is unset." >&2
+  exit 2
+else
+  echo "error: not running on an MR pipeline and no --title given." >&2
+  echo "       see --help for local usage." >&2
+  exit 2
+fi
+
+# Strip GitLab's auto-prepended draft prefixes before validation; draft status
+# is metadata, not part of the title the author chose.
+stripped="$TITLE"
+stripped="${stripped#Draft: }"
+stripped="${stripped#WIP: }"
+# POSIX whitespace strip via parameter expansion -- no subshell, no awk fork.
+stripped="${stripped#"${stripped%%[![:space:]]*}"}"
+stripped="${stripped%"${stripped##*[![:space:]]}"}"
+
+len=${#stripped}
+
+printf "  source:      %s\n" "$source_label"
+printf "  title:       %s\n" "$TITLE"
+printf "  length:      %d (max %d)\n" "$len" "$TITLE_MAX_LEN"
+
+# Exempt: `Revert "..."` titles created by the GitLab "Revert" button. The
+# revert commit preserves the original conventional title in its body; the
+# wrapping is not under the author's control.
+if [[ "$stripped" == Revert\ \"*\" ]]; then
+  echo "  [OK]  revert title -- exempt from format check"
+  exit 0
+fi
+
+failures=()
+
+if [ "$len" -gt "$TITLE_MAX_LEN" ]; then
+  failures+=("title is ${len} chars; max is ${TITLE_MAX_LEN}")
+fi
+
+if [[ "$stripped" == *. ]]; then
+  failures+=("title ends with '.' -- drop the trailing period")
+fi
+
+if ! [[ "$stripped" =~ $TITLE_RE ]]; then
+  failures+=("title does not match Conventional Commits: <type>(<scope>)?!?: <subject> (subject >= ${SUBJECT_MIN_LEN} chars)")
+fi
+
+if [ "${#failures[@]}" -eq 0 ]; then
+  echo "  [OK]  MR title passes lint"
+  exit 0
+fi
+
+{
+  echo
+  echo "  [BLOCK] MR title failed ${#failures[@]} check(s):"
+  for f in "${failures[@]}"; do
+    echo "    - $f"
+  done
+  echo
+  echo "  Allowed types: ${CC_TYPES}"
+  echo "  Examples:"
+  echo "    feat(ci): add MR title lint"
+  echo "    fix(redislane): skip own consumer PEL to stop self-claim storm"
+  echo "    refactor!: drop deprecated v1 client"
+  echo
+  echo "  How to fix: edit the title in the GitLab MR UI, or"
+  echo "    bytedcli codebase mr update --number <N> --title \"<new title>\""
+} >&2
+exit 1

package/templates/scripts/check-openapi.py

@@ -0,0 +1,221 @@
+#!/usr/bin/env python3
+"""Generate OpenAPI docs from Coding TOP-style Thrift IDL.
+
+The source IDL uses TOP actions, while thrift-gen-http-swagger expects Hertz
+HTTP annotations. This script creates a temporary OpenAPI-only Thrift file with
+synthetic `api.post` and `api.body` annotations, delegates schema/path
+generation to thrift-gen-http-swagger, then uses Redocly to render the HTML.
+The synthetic paths are documentation-only TOP Action examples.
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+
+METHOD_RE = re.compile(
+    r"^(?P<indent>\s*)"
+    r"(?P<response>[A-Za-z_][A-Za-z0-9_.<>]*)\s+"
+    r"(?P<name>[A-Za-z_][A-Za-z0-9_]*)"
+    r"\(1:\s*(?P<request>[A-Za-z_][A-Za-z0-9_.<>]*)\s+[A-Za-z_][A-Za-z0-9_]*\)"
+    r"\s+throws\s+\([^)]*\)\s*"
+    r"\((?P<annotations>.*)\)\s*$"
+)
+
+INSTALL_HINTS = {
+    "thriftgo": "go install github.com/cloudwego/thriftgo@v0.4.5",
+    "thrift-gen-http-swagger": (
+        "go install github.com/hertz-contrib/swagger-generate/thrift-gen-http-swagger@latest"
+    ),
+    "redocly": "npm install -g @redocly/cli@2.31.6",
+}
+
+
+def run(cmd: list[str], cwd: Path) -> None:
+    try:
+        subprocess.run(cmd, cwd=cwd, check=True)
+    except FileNotFoundError as exc:
+        executable = Path(exc.filename or cmd[0]).name
+        print(f"missing executable: {executable}", file=sys.stderr)
+        if hint := INSTALL_HINTS.get(executable):
+            print(f"install it with: {hint}", file=sys.stderr)
+        raise SystemExit(1) from exc
+    except subprocess.CalledProcessError as exc:
+        print(f"command failed ({exc.returncode}): {' '.join(cmd)}", file=sys.stderr)
+        raise SystemExit(exc.returncode) from exc
+
+
+def ensure_executable(command: str, tool_name: str) -> None:
+    if shutil.which(command) is not None:
+        return
+    print(f"missing executable for {tool_name}: {command}", file=sys.stderr)
+    if hint := INSTALL_HINTS.get(tool_name):
+        print(f"install it with: {hint}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+def parse_command(command: str, tool_name: str) -> list[str]:
+    parts = shlex.split(command)
+    if not parts:
+        print(f"missing executable for {tool_name}: {command}", file=sys.stderr)
+        if hint := INSTALL_HINTS.get(tool_name):
+            print(f"install it with: {hint}", file=sys.stderr)
+        raise SystemExit(1)
+    ensure_executable(parts[0], tool_name)
+    return parts
+
+
+def rewrite_server_idl(source: Path, destination: Path, top_version: str) -> None:
+    wrappers: list[str] = []
+    rewritten: list[str] = []
+    for line in source.read_text(encoding="utf-8").splitlines():
+        match = METHOD_RE.match(line)
+        if match is None:
+            rewritten.append(line)
+            continue
+
+        name = match.group("name")
+        request_type = match.group("request")
+        response_type = match.group("response")
+        request_wrapper = f"{name}OpenAPIRequest"
+        response_wrapper = f"{name}OpenAPIResponse"
+        wrappers.extend(
+            [
+                f"struct {request_wrapper} {{",
+                f'    1: {request_type} Body (api.body = "body")',
+                "}",
+                "",
+                f"struct {response_wrapper} {{",
+                f'    1: {response_type} Body (api.body = "body")',
+                "}",
+                "",
+            ]
+        )
+        rewritten.append(
+            f"{match.group('indent')}{response_wrapper} {name}"
+            f"(1: {request_wrapper} req) throws (1: base.Error err) "
+            f"({match.group('annotations')}, api.post=\"/?Action={name}&Version={top_version}\")"
+        )
+
+    text = "\n".join(rewritten) + "\n"
+    insert_at = text.find("// Agent 管理接口")
+    if insert_at < 0:
+        print("cannot find insertion point in server thrift", file=sys.stderr)
+        raise SystemExit(1)
+    destination.write_text(text[:insert_at] + "\n".join(wrappers) + text[insert_at:], encoding="utf-8")
+
+
+def prepare_workdir(idl: Path, workdir: Path, top_version: str) -> Path:
+    idl_dir = idl.parent
+    for thrift_file in idl_dir.glob("*.thrift"):
+        shutil.copy2(thrift_file, workdir / thrift_file.name)
+
+    rewritten = workdir / idl.name
+    rewrite_server_idl(idl, rewritten, top_version)
+    return rewritten
+
+
+def customize_openapi_info(path: Path) -> None:
+    text = path.read_text(encoding="utf-8")
+    text = text.replace(
+        "    title: API generated by thrift-gen-http-swagger\n"
+        "    description: API description\n",
+        "    title: Coding API 文档\n"
+        "    description: Coding Engine TOP API reference generated from Thrift IDL. "
+        "Paths are illustrative TOP Action examples.\n",
+        1,
+    )
+    path.write_text(text, encoding="utf-8")
+
+
+def generate_openapi(
+    idl: Path,
+    yaml_path: Path,
+    html_path: Path,
+    redocly_config: Path,
+    top_version: str,
+    thriftgo: str,
+    swagger_plugin: str,
+    redocly: str,
+) -> None:
+    ensure_executable(thriftgo, "thriftgo")
+    ensure_executable(swagger_plugin, "thrift-gen-http-swagger")
+    redocly_cmd = parse_command(redocly, "redocly")
+
+    with tempfile.TemporaryDirectory(prefix="coding-openapi-") as tmp:
+        workdir = Path(tmp)
+        rewritten = prepare_workdir(idl, workdir, top_version)
+        generated_dir = workdir / "swagger"
+        generated_dir.mkdir()
+
+        run(
+            [
+                thriftgo,
+                "-i",
+                ".",
+                "-o",
+                "gen",
+                "-g",
+                "go:skip_go_gen",
+                "-p",
+                f"http-swagger={swagger_plugin}:OutputDir={generated_dir}",
+                rewritten.name,
+            ],
+            cwd=workdir,
+        )
+
+        generated_yaml = generated_dir / "openapi.yaml"
+        if not generated_yaml.exists():
+            print("thrift-gen-http-swagger did not produce openapi.yaml", file=sys.stderr)
+            raise SystemExit(1)
+
+        customize_openapi_info(generated_yaml)
+        yaml_path.parent.mkdir(parents=True, exist_ok=True)
+        html_path.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy2(generated_yaml, yaml_path)
+        run(redocly_cmd + ["lint", str(yaml_path), "--config", str(redocly_config)], cwd=Path.cwd())
+        run(
+            redocly_cmd + ["build-docs", str(yaml_path), "-o", str(html_path), "--config", str(redocly_config)],
+            cwd=Path.cwd(),
+        )
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="Generate OpenAPI docs from Thrift IDL.")
+    parser.add_argument("--idl", default="api/idl/server.thrift", help="entry thrift file")
+    parser.add_argument("--yaml", default="docs/openapi/openapi.yaml", help="OpenAPI YAML output")
+    parser.add_argument("--html", default="docs/openapi/coding-engine-api.html", help="Redocly HTML output")
+    parser.add_argument("--redocly-config", default="redocly.yaml")
+    parser.add_argument("--top-version", default="2026-04-23", help="TOP API Version query value")
+    parser.add_argument("--thriftgo", default="thriftgo")
+    parser.add_argument("--swagger-plugin", default="thrift-gen-http-swagger")
+    parser.add_argument("--redocly", default="redocly")
+    args = parser.parse_args()
+
+    idl = Path(args.idl)
+    if not idl.exists():
+        print(f"{idl} not found", file=sys.stderr)
+        raise SystemExit(1)
+
+    generate_openapi(
+        idl=idl,
+        yaml_path=Path(args.yaml),
+        html_path=Path(args.html),
+        redocly_config=Path(args.redocly_config),
+        top_version=args.top_version,
+        thriftgo=args.thriftgo,
+        swagger_plugin=args.swagger_plugin,
+        redocly=args.redocly,
+    )
+    print(f"updated {args.yaml} and {args.html}")
+
+
+if __name__ == "__main__":
+    main()

package/templates/scripts/check-rdb-structured-queries.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="${1:-.}"
+paths=(
+  "$root/internal/adapters/outbound/persistence/rdb/repository"
+  "$root/mem-svc/internal/adapters/outbound/persistence/rdb/repository"
+)
+
+existing=()
+for path in "${paths[@]}"; do
+  if [[ -d "$path" ]]; then
+    existing+=("$path")
+  fi
+done
+
+if [[ ${#existing[@]} -eq 0 ]]; then
+  exit 0
+fi
+
+python3 - "$root" "${existing[@]}" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+_, root, *dirs = sys.argv
+root_path = Path(root).resolve()
+violations = []
+
+db_branch_re = re.compile(
+    r'\b(?:Dialector\.Name|driver|dbType|databaseType)\b.*(?:==|!=|switch|case)'
+    r'|\b(?:if|switch|case)\b.*\b(?:Dialector\.Name|driver|dbType|databaseType)\b'
+)
+raw_call_re = re.compile(r'\.(?:Raw|Exec)\s*\(')
+direct_join_re = re.compile(r'\.Joins\s*\(\s*(?:"|`)JOIN\s+(?!\?)', re.IGNORECASE)
+select_literal_re = re.compile(r'\.Select\s*\(\s*(?P<quote>"|`)(?P<body>.*)', re.IGNORECASE)
+where_literal_re = re.compile(r'\.Where\s*\(\s*(?P<quote>"|`)(?P<body>.*)', re.IGNORECASE)
+def allowed(lines, index):
+    current = lines[index]
+    previous = lines[index - 1] if index > 0 else ""
+    return "coding:allow-raw-sql" in current or "coding:allow-raw-sql" in previous
+
+def literal_body(lines, start, quote):
+    text = lines[start].split(quote, 1)[1]
+    if quote == '"' and quote in text:
+        return text.split(quote, 1)[0]
+    if quote == '`' and '`' in text:
+        return text.split('`', 1)[0]
+    for line in lines[start + 1:]:
+        text += "\n" + line
+        if quote in line:
+            return text.split(quote, 1)[0]
+    return text
+
+for directory in dirs:
+    for path in Path(directory).rglob("*.go"):
+        if path.name.endswith("_test.go"):
+            continue
+        lines = path.read_text().splitlines()
+        rel = path.resolve().relative_to(root_path)
+        for i, line in enumerate(lines):
+            if db_branch_re.search(line):
+                violations.append(f"{rel}:{i + 1}: repository code must not branch on database driver/type")
+            if allowed(lines, i):
+                continue
+            if raw_call_re.search(line):
+                violations.append(f"{rel}:{i + 1}: repository code must not use Raw/Exec; use GORM clauses or explicit migrations")
+            if direct_join_re.search(line):
+                violations.append(f"{rel}:{i + 1}: Join table names must use JOIN ? with clause.Table and clause.Column")
+
+            select_match = select_literal_re.search(line)
+            if select_match:
+                quote = select_match.group("quote")
+                body = literal_body(lines, i, quote).strip()
+                if not body.startswith("?"):
+                    violations.append(f"{rel}:{i + 1}: Select field lists must use clause.Column placeholders, not raw SQL strings")
+
+            match = where_literal_re.search(line)
+            if not match:
+                continue
+            quote = match.group("quote")
+            body = literal_body(lines, i, quote).strip()
+            upper = " ".join(body.upper().split())
+            if upper in {"EXISTS (?)", "NOT EXISTS (?)"}:
+                continue
+            violations.append(f"{rel}:{i + 1}: Where predicates must use clause.Expr/clause.Eq/clause.And helpers, not raw SQL strings")
+
+if violations:
+    print("\n".join(violations), file=sys.stderr)
+    print(
+        "\nRDB repositories must use structured GORM queries so every dialect quotes identifiers consistently.\n"
+        "Use clause.Table/clause.Column for joins and clause.Eq/IN/And/Or or repository helpers for predicates.\n"
+        "Do not branch on database type in repository code. If a rare raw SQL escape is unavoidable, add\n"
+        "'// coding:allow-raw-sql <reason>' on the previous line and explain why structured clauses cannot model it.",
+        file=sys.stderr,
+    )
+    sys.exit(1)
+PY

package/templates/scripts/check-repository-transactions.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="${1:-.}"
+patterns='\.(Transaction|Begin|Commit|Rollback|BeginTx|CommitTx|RollbackTx)\('
+legacy_tx_probe='rdb\.DB\([^)]*,[[:space:]]*nil\)'
+paths=(
+  "$root/internal/adapters/outbound/persistence/rdb/repository"
+  "$root/mem-svc/internal/adapters/outbound/persistence/rdb/repository"
+)
+
+existing=()
+for path in "${paths[@]}"; do
+  if [[ -d "$path" ]]; then
+    existing+=("$path")
+  fi
+done
+
+if [[ ${#existing[@]} -eq 0 ]]; then
+  exit 0
+fi
+
+if matches="$(grep -rn --include='*.go' -E "$patterns" "${existing[@]}" 2>&1)"; then
+  status=0
+else
+  status=$?
+fi
+
+if [[ $status -eq 0 ]]; then
+  printf '%s\n' "$matches"
+  printf '\nRepository layer must not open or control transactions. Use port.TransactionManager from application services.\n' >&2
+  exit 1
+fi
+
+if [[ $status -gt 1 ]]; then
+  printf '%s\n' "$matches" >&2
+  exit "$status"
+fi
+
+if legacy_matches="$(grep -rn --include='*.go' -E "$legacy_tx_probe" "${existing[@]}" 2>&1)"; then
+  status=0
+else
+  status=$?
+fi
+
+if [[ $status -eq 0 ]]; then
+  printf '%s\n' "$legacy_matches"
+  printf '\nRepository transaction-required checks must use rdb.RequireTransaction(ctx), not rdb.DB(ctx, nil).\n' >&2
+  exit 1
+fi
+
+if [[ $status -gt 1 ]]; then
+  printf '%s\n' "$legacy_matches" >&2
+  exit "$status"
+fi
+
+python3 - "$root" "${existing[@]}" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+_, root, *dirs = sys.argv
+violations = []
+func_re = re.compile(r'^func\s+(?:\([^)]*\)\s*)?([A-Za-z_][A-Za-z0-9_]*)\s*\(')
+
+for directory in dirs:
+    for path in Path(directory).rglob("*.go"):
+        if path.name.endswith("_test.go"):
+            continue
+        lines = path.read_text().splitlines()
+        i = 0
+        while i < len(lines):
+            match = func_re.match(lines[i])
+            if not match:
+                i += 1
+                continue
+            start = i
+            depth = 0
+            seen_open = False
+            body = []
+            while i < len(lines):
+                line = lines[i]
+                body.append(line)
+                depth += line.count("{")
+                if "{" in line:
+                    seen_open = True
+                depth -= line.count("}")
+                i += 1
+                if seen_open and depth == 0:
+                    break
+            text = "\n".join(body)
+            if "clause.Locking" in text and "rdb.RequireTransaction(" not in text:
+                rel = path.relative_to(root)
+                violations.append(f"{rel}:{start + 1}: {match.group(1)} uses clause.Locking without rdb.RequireTransaction")
+
+if violations:
+    print("\n".join(violations), file=sys.stderr)
+    print("\nRepository methods that issue row locks must require an application-layer transaction.", file=sys.stderr)
+    sys.exit(1)
+PY