code-standards 8.12.1__tar.gz → 8.13.1__tar.gz

{code_standards-8.12.1 → code_standards-8.13.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.12.1
+Version: 8.13.1
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/
@@ -27,10 +27,10 @@ Requires-Dist: pydantic==2.13.5
 Requires-Dist: pyyaml==6.0.3
 Requires-Dist: repo-standards==6.2.0
 Requires-Dist: ruff==0.16.9
-Requires-Dist: sarj-iac-lint==0.16.1
-Requires-Dist: sarj-python-lint==1.8.0
-Requires-Dist: sarj-rule-contracts==0.1.1
-Requires-Dist: sarj-sql-lint==0.18.3
+Requires-Dist: sarj-iac-lint==0.17.0
+Requires-Dist: sarj-python-lint==1.8.2
+Requires-Dist: sarj-rule-contracts==0.2.0
+Requires-Dist: sarj-sql-lint==0.18.4
 Requires-Dist: semgrep==1.178.0
 Requires-Dist: shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')
 Requires-Dist: typer==0.27.2
@@ -57,7 +57,9 @@ code-standards doctor
 code-standards update
 ```
 
-Use repeatable `check --rule ENGINE:ID` selectors to check only selected Sarj custom rules. Exclusions, baselines, and severities still apply; upstream rules such as Ruff IDs are not supported. Native linters and ESLint execute only selected rules. ESLint retains configured parsers, options, severities, and suppression directives.
+Use repeatable `check --rule ENGINE:ID` selectors to select native rules, ESLint rules, or managed security audits. Exclusions, baselines, and severities still apply; Ruff selectors are not supported. Native linters and ESLint execute only selected rules. ESLint retains configured parsers, options, severities, and suppression directives.
+
+Terraform, Kubernetes, and GitHub Actions adoption adds isolated Checkov 3.3.20 and zizmor 1.30.1 runtimes. Setup and generated CI prewarm these tools; checks run offline with packaged policy. Use `--rule checkov:CKV_GCP_95` or `--rule zizmor:template-injection` to select upstream audits. Their findings start as warnings, use the canonical diagnostic baseline, and retain upstream IDs. Checkov honors its inline suppression directives; zizmor ignore comments are disabled. Explicit zizmor selectors include auditor-persona checks; online-only audits cannot run offline. Parsing or execution failures leave the analysis incomplete. Image digest evidence for source templates is deferred to their rendered deployment artifacts.
 
 `check --jobs 2` overlaps native analysis with the external-tool pipeline. The default is `--jobs 1`; external tools remain sequential and report ordering is deterministic.
 

code_standards-8.13.1/README.md

@@ -0,0 +1,28 @@
+<!-- Generated by `code-standards maintain docs sync`; do not edit. -->
+
+# code-standards
+
+One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
+
+```bash
+uv tool install --python 3.14 code-standards
+```
+
+Adopt the repository once with `code-standards setup`. It installs one canonical staged gate that includes semantic lint and repository policy, plus commit-message and pull-request history enforcement. Do not install Repo Standards separately.
+
+```bash
+code-standards setup
+code-standards check
+code-standards check --rule python:no-excessive-cognitive-complexity src/
+code-standards fix
+code-standards doctor
+code-standards update
+```
+
+Use repeatable `check --rule ENGINE:ID` selectors to select native rules, ESLint rules, or managed security audits. Exclusions, baselines, and severities still apply; Ruff selectors are not supported. Native linters and ESLint execute only selected rules. ESLint retains configured parsers, options, severities, and suppression directives.
+
+Terraform, Kubernetes, and GitHub Actions adoption adds isolated Checkov 3.3.20 and zizmor 1.30.1 runtimes. Setup and generated CI prewarm these tools; checks run offline with packaged policy. Use `--rule checkov:CKV_GCP_95` or `--rule zizmor:template-injection` to select upstream audits. Their findings start as warnings, use the canonical diagnostic baseline, and retain upstream IDs. Checkov honors its inline suppression directives; zizmor ignore comments are disabled. Explicit zizmor selectors include auditor-persona checks; online-only audits cannot run offline. Parsing or execution failures leave the analysis incomplete. Image digest evidence for source templates is deferred to their rendered deployment artifacts.
+
+`check --jobs 2` overlaps native analysis with the external-tool pipeline. The default is `--jobs 1`; external tools remain sequential and report ordering is deterministic.
+
+[Documentation](https://code-standards.sarj.ai/) · [Source](https://github.com/sarj-ai/code-standards)

{code_standards-8.12.1 → code_standards-8.13.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.12.1"
+version = "8.13.1"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -16,7 +16,7 @@ classifiers = [
   "Topic :: Software Development :: Quality Assurance",
 ]
 dependencies = [
-  "sarj-rule-contracts==0.1.1",
+  "sarj-rule-contracts==0.2.0",
   "pathspec==1.1.1",
   "basedpyright==1.40.1",
   "deptry==0.25.1",
@@ -29,9 +29,9 @@ dependencies = [
   "ruff==0.16.9",
   "semgrep==1.178.0",
   "shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')",
-  "sarj-iac-lint==0.16.1",
-  "sarj-python-lint==1.8.0",
-  "sarj-sql-lint==0.18.3",
+  "sarj-iac-lint==0.17.0",
+  "sarj-python-lint==1.8.2",
+  "sarj-sql-lint==0.18.4",
   "typer==0.27.2",
 ]
 
@@ -66,6 +66,12 @@ dev = [
   "jsonschema==4.25.1",
   "pytest>=9.1.1",
 ]
+
+[tool.uv]
+# Semgrep 1.178.0 requires vulnerable PyJWT 2.13.x. Remove this override when
+# its upstream requirement admits the patched version.
+override-dependencies = ["pyjwt[crypto]==2.15.1"]
+
 [tool.uv.sources]
 sarj-rule-contracts = { path = "../contracts", editable = true }
 # Development uses the sibling packages while wheel smoke tests resolve the

{code_standards-8.12.1 → code_standards-8.13.1}/src/sarj_standards/api.py

@@ -635,7 +635,13 @@ def _selected_external_analysis(
         if rule_selection is not None
         else None
     )
-    run_eslint = rule_selection is None or RuleEngine.ESLINT in rule_selection.engines
+    external_engines = frozenset({RuleEngine.ESLINT, RuleEngine.CHECKOV, RuleEngine.ZIZMOR})
+    selected_capabilities = (
+        frozenset(engine.value for engine in rule_selection.engines & external_engines)
+        if rule_selection is not None
+        else None
+    )
+    run_external = rule_selection is None or not rule_selection.engines.isdisjoint(external_engines)
     external_reports = (
         (
             analyze_external(
@@ -644,10 +650,11 @@ def _selected_external_analysis(
                 trust=normalized_trust,
                 policy=selection_policy,
                 capabilities=(
-                    frozenset({"eslint"}) if rule_selection is not None else frozenset(adopted.enabled_capabilities)
+                    selected_capabilities if rule_selection is not None else frozenset(adopted.enabled_capabilities)
                 ),
                 grouped=selected_groups,
                 rule_ids=rule_ids,
+                security_selection=rule_selection,
                 include_react_doctor=include_react_doctor and rule_selection is None,
                 force_react_doctor=react_doctor_triggered,
                 react_doctor_staged=staged,
@@ -660,9 +667,10 @@ def _selected_external_analysis(
                 active_selected,
                 root=root,
                 trust=normalized_trust,
-                capabilities=frozenset({"eslint"}) if rule_selection is not None else None,
+                capabilities=selected_capabilities,
                 grouped=selected_groups,
                 rule_ids=rule_ids,
+                security_selection=rule_selection,
                 include_react_doctor=include_react_doctor and rule_selection is None,
                 force_react_doctor=react_doctor_triggered,
                 react_doctor_staged=staged,
@@ -671,7 +679,7 @@ def _selected_external_analysis(
                 python_type_check=python_type_check,
             )
         )
-        if run_eslint
+        if run_external
         else ()
     )
     if rule_selection is not None:
@@ -785,6 +793,9 @@ def _rule_selection(values: Sequence[str | RuleSelector] | None) -> RuleSelectio
     if isinstance(values, str):
         msg = "rules must be a sequence of canonical selectors, not one string"
         raise TypeError(msg)
+    from sarj_standards.libs.linting import (  # ruff: ignore[import-outside-top-level] -- load the upstream selectors with the catalog.
+        security_tools,
+    )
     from sarj_standards.libs.repository import (  # ruff: ignore[import-outside-top-level]
         rule_catalog_artifact,
     )
@@ -792,6 +803,8 @@ def _rule_selection(values: Sequence[str | RuleSelector] | None) -> RuleSelectio
     catalog = rule_catalog_artifact.load()
     raw_rules = _object_list(catalog.get("rules"), "shipped rule catalog rules")
     live: set[RuleSelector] = set()
+    live.update(RuleSelector(RuleEngine.CHECKOV, RuleId(rule)) for rule in security_tools.CHECKOV_CHECKS)
+    live.update(RuleSelector(RuleEngine.ZIZMOR, RuleId(rule)) for rule in security_tools.ZIZMOR_RULES)
     for value in raw_rules:
         key = value.get("key") if is_object_mapping(value) else None
         if isinstance(key, str):
@@ -799,6 +812,9 @@ def _rule_selection(values: Sequence[str | RuleSelector] | None) -> RuleSelectio
     selected: set[RuleSelector] = set()
     for value in values:
         selector = value if isinstance(value, RuleSelector) else RuleSelector.parse(value)
+        if selector.engine is RuleEngine.ZIZMOR and selector.rule_id in security_tools.ZIZMOR_ONLINE_ONLY:
+            msg = f"{selector} cannot run in offline analysis; choose an offline audit"
+            raise ValueError(msg)
         if selector not in live:
             msg = f"unknown or invalid rule selector: {value}"
             raise ValueError(msg)
@@ -822,6 +838,8 @@ def _routed_for_selection(grouped: object, selected: RuleSelection | None) -> se
         routed.update(grouped.sql)
     if RuleEngine.IAC in engines:
         routed.update(grouped.iac)
+    if not engines.isdisjoint({RuleEngine.CHECKOV, RuleEngine.ZIZMOR}):
+        routed.update(grouped.iac)
     if RuleEngine.TEXT in engines:
         routed.update(grouped.text)
     if RuleEngine.ESLINT in engines:
@@ -836,7 +854,7 @@ def _filter_report_selectors(
     report: ToolReport,
     selected: RuleSelection,
 ) -> ToolReport:
-    engine = RuleEngine.ESLINT if report.name == "eslint" else None
+    engine = RuleEngine(report.name) if report.name in {"eslint", "zizmor", "checkov"} else None
     allowed: frozenset[str] = frozenset() if engine is None else selected.native_ids_for(engine)
     return ToolReport(
         report.name,
@@ -908,6 +926,8 @@ def _engine_for_diagnostic(item: Diagnostic) -> RuleEngine | None:
         "iac": RuleEngine.IAC,
         "text": RuleEngine.TEXT,
         "eslint": RuleEngine.ESLINT,
+        "checkov": RuleEngine.CHECKOV,
+        "zizmor": RuleEngine.ZIZMOR,
     }.get(item.source)
 
 

{code_standards-8.12.1 → code_standards-8.13.1}/src/sarj_standards/cli/main.py

@@ -2628,6 +2628,7 @@ class _ProfileChoice(StrEnum):
 
 
 class _ConfigChoice(StrEnum):
+    CHECKOV = "checkov"
     DETEKT = "detekt"
     ESLINT = "eslint"
     KTLINT = "ktlint"
@@ -2640,6 +2641,7 @@ class _ConfigChoice(StrEnum):
     SWIFTLINT = "swiftlint"
     TAPLO = "taplo"
     YAMLLINT = "yamllint"
+    ZIZMOR = "zizmor"
 
 
 class _DiagnosticFormat(StrEnum):

code_standards-8.13.1/src/sarj_standards/configs/checkov.strict.yml

@@ -0,0 +1,15 @@
+# Checkov is isolated from the Standards runtime and never downloads modules.
+framework:
+  - terraform
+  - kubernetes
+check:
+  - CKV_GCP_41
+  - CKV_GCP_95
+  - CKV_GCP_97
+  - CKV_K8S_10
+  - CKV_K8S_12
+  - CKV_K8S_13
+  - CKV_K8S_43
+download-external-modules: false
+skip-download: true
+output: json

code_standards-8.13.1/src/sarj_standards/configs/cli-reference.v1.json

@@ -0,0 +1 @@
+{"commands":[{"commands":[],"name":"commit-message","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"COMMIT_MSG_FILE","names":["message_file"],"repeatable":false,"required":true,"summary":"Git commit-message file supplied by the commit-msg hook"}],"path":["commit-message"],"summary":"enforce [(i/N) ][TICKET] type(scope)!: description with safe mechanical fixes","usage":"code-standards commit-message [-h] COMMIT_MSG_FILE"},{"commands":[],"name":"doctor","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["text","json"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":"output format (default: text)"},{"choices":[],"kind":"option","metavar":null,"names":["--repair"],"repeatable":false,"required":false,"summary":"transactionally repair safe drift with the executing bundle, then re-diagnose"},{"choices":[],"kind":"option","metavar":null,"names":["--no-install"],"repeatable":false,"required":false,"summary":"with --repair, update configuration without installing dependencies or hooks"}],"path":["doctor"],"summary":"diagnose adoption health and optionally repair safe drift","usage":"code-standards doctor [-h] [--format OUTPUT_FORMAT] [--repair] [--no-install]"},{"commands":[],"name":"setup","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["pre-commit","lefthook","none"],"kind":"option","metavar":"HOOKS","names":["--hooks"],"repeatable":false,"required":false,"summary":"hook manager (default: detect Lefthook, otherwise pre-commit)"},{"choices":[],"kind":"option","metavar":"PYTHON_DEST","names":["--python-dest"],"repeatable":false,"required":false,"summary":"the directory that owns pyproject.toml (default: detected)"},{"choices":[],"kind":"option","metavar":"TYPESCRIPT_DEST","names":["--typescript-dest"],"repeatable":false,"required":false,"summary":"the directory that owns the npm lockfile (default: detected)"},{"choices":[],"kind":"option","metavar":"SWIFT_DEST","names":["--swift-dest"],"repeatable":false,"required":false,"summary":"the directory that owns one reviewed Swift project (default: mobile project detection)"},{"choices":[],"kind":"option","metavar":"KOTLIN_DEST","names":["--kotlin-dest"],"repeatable":false,"required":false,"summary":"the directory that owns one reviewed Android/KMP project (default: detected)"},{"choices":[],"kind":"option","metavar":null,"names":["--dry-run"],"repeatable":false,"required":false,"summary":"print the complete plan without writing"},{"choices":[],"kind":"option","metavar":null,"names":["--force"],"repeatable":false,"required":false,"summary":"replace conflicting generated lint configuration after review"},{"choices":[],"kind":"option","metavar":null,"names":["--no-install"],"repeatable":false,"required":false,"summary":"write wiring without installing dependencies or hooks"},{"choices":[],"kind":"option","metavar":null,"names":["--commit-policy-only"],"repeatable":false,"required":false,"summary":"adopt only commit-message and PR-history policy without changing language tooling"},{"choices":["checkov","detekt","eslint","ktlint","markdownlint","mobile-security","pyright","ruff","shellcheck","swiftformat","swiftlint","taplo","yamllint","zizmor"],"kind":"option","metavar":"ONLY","names":["--config"],"repeatable":true,"required":false,"summary":"select one config explicitly (repeatable)"}],"path":["setup"],"summary":"adopt or converge the repository in one idempotent operation","usage":"code-standards setup [-h] [--hooks HOOKS] [--python-dest PYTHON_DEST] [--typescript-dest TYPESCRIPT_DEST] [--swift-dest SWIFT_DEST] [--kotlin-dest KOTLIN_DEST] [--dry-run] [--force] [--no-install] [--commit-policy-only] [--config ONLY ...]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow executable repository ESLint configuration (generated hooks and CI set this explicitly)"},{"choices":[],"kind":"option","metavar":"JOBS","names":["--jobs"],"repeatable":false,"required":false,"summary":"overlap native and external analysis (default: 1)"},{"choices":[],"kind":"option","metavar":null,"names":["--skip-python-type-check"],"repeatable":false,"required":false,"summary":"leave BasedPyright to the repository's own required CI; configs stay managed"},{"choices":[],"kind":"option","metavar":null,"names":["--staged"],"repeatable":false,"required":false,"summary":"run custom rules on hook-supplied paths, or discover staged files when none are supplied"},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"check only this custom ENGINE:ID rule (repeatable)"},{"choices":["text","json","sarif","github"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"write JSON or SARIF atomically to PATH"},{"choices":[],"kind":"option","metavar":"MAX_ANNOTATIONS_PER_LEVEL","names":["--max-annotations-per-level"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected paths; when omitted, check the complete repository"}],"path":["check"],"summary":"run the complete quality gate or check selected paths or custom rules","usage":"code-standards check [-h] [--trust-repository-code] [--jobs JOBS] [--skip-python-type-check] [--staged] [--rule SELECTED_RULES ...] [--format OUTPUT_FORMAT] [--output OUTPUT] [--max-annotations-per-level MAX_ANNOTATIONS_PER_LEVEL] [FILES ...]"},{"commands":[],"name":"validate-slack-automations","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"PATH","names":["slack_catalog"],"repeatable":false,"required":true,"summary":""}],"path":["validate-slack-automations"],"summary":"validate a versioned Slack automation catalog","usage":"code-standards validate-slack-automations [-h] PATH"},{"commands":[],"name":"observe","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":true,"summary":"canonical ENGINE:ID selector (repeatable)"},{"choices":["text","json","sarif","github"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow repository ESLint configuration to execute"},{"choices":[],"kind":"option","metavar":"MAX_ANNOTATIONS_PER_LEVEL","names":["--max-annotations-per-level"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected paths; defaults to adopted verification paths"}],"path":["observe"],"summary":"report warning-stage findings with exit 0; invalid input or execution still exits 2","usage":"code-standards observe [-h] --rule SELECTED_RULES ... [--format OUTPUT_FORMAT] [--output OUTPUT] [--trust-repository-code] [--max-annotations-per-level MAX_ANNOTATIONS_PER_LEVEL] [FILES ...]"},{"commands":[],"name":"fix","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--staged"],"repeatable":false,"required":false,"summary":"fix only files staged in Git"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected paths; when omitted, fix the complete repository"}],"path":["fix"],"summary":"apply safe formatting and lint fixes","usage":"code-standards fix [-h] [--staged] [FILES ...]"},{"commands":[],"name":"update","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"preview without writing; exit 1 when changes exist"},{"choices":[],"kind":"option","metavar":null,"names":["--offline"],"repeatable":false,"required":false,"summary":"reconverge the executing bundle and skip every network-dependent install; does not resolve latest"},{"choices":[],"kind":"option","metavar":"VERSION","names":["--to"],"repeatable":false,"required":false,"summary":"resolve and apply exactly this immutable coherent bundle version"},{"choices":[],"kind":"option","metavar":null,"names":["--no-install"],"repeatable":false,"required":false,"summary":"do not install dependencies or hooks"}],"path":["update"],"summary":"upgrade to the latest published coherent Standards bundle","usage":"code-standards update [-h] [--check] [--offline] [--to VERSION] [--no-install]"},{"commands":[{"commands":[],"name":"init","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"baseline JSON (default: diagnostic-baseline.json)"},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"run repository-local analyzers that execute project code"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"paths to analyze (default: the whole repository)"}],"path":["baseline","init"],"summary":"record the first diagnostic baseline","usage":"code-standards baseline init [-h] [--output OUTPUT] [--trust-repository-code] [FILES ...]"},{"commands":[],"name":"update","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"baseline JSON (default: diagnostic-baseline.json)"},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"run repository-local analyzers that execute project code"},{"choices":[],"kind":"option","metavar":"BASELINE_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"replace debt only for this newly promoted rule (repeatable; source:RULE is also accepted)"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"paths to analyze (default: the whole repository)"}],"path":["baseline","update"],"summary":"re-record the diagnostic baseline after reviewed cleanup","usage":"code-standards baseline update [-h] [--output OUTPUT] [--trust-repository-code] [--rule BASELINE_RULES ...] [FILES ...]"}],"name":"baseline","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["baseline"],"summary":"grandfather today's findings so only new ones fail","usage":"code-standards baseline [-h] {init,update}"},{"commands":[{"commands":[],"name":"init","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"}],"path":["ratchet","init"],"summary":"create the first suppression budget","usage":"code-standards ratchet init [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"}],"path":["ratchet","check"],"summary":"fail when suppression debt grows","usage":"code-standards ratchet check [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...]"},{"commands":[],"name":"status","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"}],"path":["ratchet","status"],"summary":"show current suppression debt and available reductions","usage":"code-standards ratchet status [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...]"},{"commands":[],"name":"update","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"},{"choices":[],"kind":"option","metavar":null,"names":["--allow-increase"],"repeatable":false,"required":false,"summary":"permit a reviewed increase in suppression debt"}],"path":["ratchet","update"],"summary":"lock in reviewed suppression-budget changes","usage":"code-standards ratchet update [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...] [--allow-increase]"}],"name":"ratchet","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["ratchet"],"summary":"keep the Python suppression budget from growing","usage":"code-standards ratchet [-h] {init,check,status,update}"},{"commands":[{"commands":[],"name":"list","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["exclude","list"],"summary":"list the complete denylist","usage":"code-standards exclude list [-h]"},{"commands":[],"name":"add","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["path","rule"],"kind":"positional","metavar":"{path,rule}","names":["exclude_kind"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"positional","metavar":"VALUE","names":["value"],"repeatable":false,"required":true,"summary":"repository-relative glob or canonical engine:rule selector"}],"path":["exclude","add"],"summary":"add one exact denylist entry","usage":"code-standards exclude add [-h] {path,rule} VALUE"},{"commands":[],"name":"remove","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["path","rule"],"kind":"positional","metavar":"{path,rule}","names":["exclude_kind"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"positional","metavar":"VALUE","names":["value"],"repeatable":false,"required":true,"summary":"repository-relative glob or canonical engine:rule selector"}],"path":["exclude","remove"],"summary":"remove one exact denylist entry","usage":"code-standards exclude remove [-h] {path,rule} VALUE"}],"name":"exclude","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["exclude"],"summary":"inspect or change explicit path and rule exclusions","usage":"code-standards exclude [-h] {list,add,remove}"},{"commands":[{"commands":[],"name":"state","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","state"],"summary":"print detected adoption state as JSON","usage":"code-standards show state [-h]"},{"commands":[],"name":"configs","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","configs"],"summary":"list bundled configurations","usage":"code-standards show configs [-h]"},{"commands":[],"name":"config","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["checkov","detekt","eslint","ktlint","markdownlint","mobile-security","pyright","ruff","shellcheck","swiftformat","swiftlint","taplo","yamllint","zizmor"],"kind":"positional","metavar":"NAME","names":["name"],"repeatable":false,"required":true,"summary":""}],"path":["show","config"],"summary":"print one bundled configuration path","usage":"code-standards show config [-h] NAME"},{"commands":[],"name":"peers","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","peers"],"summary":"show tested ESLint peer dependencies and install command","usage":"code-standards show peers [-h]"},{"commands":[],"name":"rules","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","rules"],"summary":"print the machine-readable custom-rule inventory","usage":"code-standards show rules [-h]"},{"commands":[],"name":"ci","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"write a managed workflow inside the repository"}],"path":["show","ci"],"summary":"print a complete versioned GitHub Actions standards workflow","usage":"code-standards show ci [-h] [--output OUTPUT]"}],"name":"show","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show"],"summary":"print read-only package and adoption information","usage":"code-standards show [-h] {state,configs,config,peers,rules,ci}"},{"commands":[{"commands":[],"name":"setup","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"print the deterministic setup plan without executing it"}],"path":["maintain","setup"],"summary":"install every standards development environment and repository hook","usage":"code-standards maintain setup [-h] [--check]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["ci-history","file-conventions","private-refs","versions"],"kind":"option","metavar":"REPO_ONLY","names":["--only"],"repeatable":true,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"COMMITS","names":["--commits"],"repeatable":false,"required":false,"summary":"also inspect commit messages in this revision range"},{"choices":[],"kind":"option","metavar":"POLICY_DEST","names":["--policy-root"],"repeatable":false,"required":false,"summary":"trusted repository policy root (default: --root)"},{"choices":[],"kind":"option","metavar":"PRIVATE_REFS_FILE","names":["--private-refs-file"],"repeatable":false,"required":false,"summary":"private-reference TOML outside the scanned repository"},{"choices":[],"kind":"option","metavar":null,"names":["--quiet"],"repeatable":false,"required":false,"summary":"hide finding details"}],"path":["maintain","check"],"summary":"run repository policy gates","usage":"code-standards maintain check [-h] [--only REPO_ONLY ...] [--commits COMMITS] [--policy-root POLICY_DEST] [--private-refs-file PRIVATE_REFS_FILE] [--quiet]"},{"commands":[],"name":"sync-ledger","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report drift without writing"}],"path":["maintain","sync-ledger"],"summary":"synchronize the rule compatibility ledger","usage":"code-standards maintain sync-ledger [-h] [--check]"},{"commands":[],"name":"comment-corpus","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"ROOTS","names":["roots"],"repeatable":true,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"PRIVATE_JSONL","names":["--include-text"],"repeatable":false,"required":false,"summary":"write sensitive comment text to a new owner-readable file"}],"path":["maintain","comment-corpus"],"summary":"extract comments for calibration","usage":"code-standards maintain comment-corpus [-h] ROOTS ... [--include-text PRIVATE_JSONL]"},{"commands":[{"commands":[],"name":"check-tag","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"TAG","names":["tag"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","check-tag"],"summary":"require a release tag to match its package manifest","usage":"code-standards maintain release check-tag [-h] TAG"},{"commands":[],"name":"verify-tags","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"RELEASE_COMMIT","names":["--commit"],"repeatable":false,"required":false,"summary":"also require existing tags to match this publishing commit or an unchanged package tree"}],"path":["maintain","release","verify-tags"],"summary":"verify all manifest release tags on origin","usage":"code-standards maintain release verify-tags [-h] [--commit RELEASE_COMMIT]"},{"commands":[],"name":"create-tags","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["contracts","typescript","bootstrap","python","sql","iac","standards","tsconfig"],"kind":"positional","metavar":"RELEASE_TARGETS","names":["release_targets"],"repeatable":true,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"RELEASE_COMMIT","names":["--commit"],"repeatable":false,"required":true,"summary":"exact commit that was published"},{"choices":[],"kind":"option","metavar":"ATTEMPTS","names":["--attempts"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"DELAY_SECONDS","names":["--delay-seconds"],"repeatable":false,"required":false,"summary":""}],"path":["maintain","release","create-tags"],"summary":"create and push manifest release tags","usage":"code-standards maintain release create-tags [-h] RELEASE_TARGETS ... --commit RELEASE_COMMIT [--attempts ATTEMPTS] [--delay-seconds DELAY_SECONDS]"},{"commands":[],"name":"changes","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BEFORE","names":["--before"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"AFTER","names":["--after"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"GITHUB_OUTPUT","names":["--github-output"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","changes"],"summary":"emit package version changes between Git revisions","usage":"code-standards maintain release changes [-h] --before BEFORE --after AFTER --github-output GITHUB_OUTPUT"},{"commands":[],"name":"causality","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BEFORE","names":["--before"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"AFTER","names":["--after"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","causality"],"summary":"require every publishable package change to bump its version","usage":"code-standards maintain release causality [-h] --before BEFORE --after AFTER"},{"commands":[],"name":"lock-age","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"LOCKFILE","names":["lockfile"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"MINIMUM_AGE","names":["--minimum-days"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"RELEASE_EXCLUDE","names":["--exclude"],"repeatable":true,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"RELEASE_EXCLUDE_FILE","names":["--exclude-file"],"repeatable":true,"required":false,"summary":"line-oriented exact package@version exceptions (repeatable)"}],"path":["maintain","release","lock-age"],"summary":"enforce npm lockfile minimum release age","usage":"code-standards maintain release lock-age [-h] LOCKFILE [--minimum-days MINIMUM_AGE] [--exclude RELEASE_EXCLUDE ...] [--exclude-file RELEASE_EXCLUDE_FILE ...]"},{"commands":[],"name":"typescript","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["check","pack","publish"],"kind":"positional","metavar":"RELEASE_MODE","names":["release_mode"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"artifact directory (required for pack)"}],"path":["maintain","release","typescript"],"summary":"check, pack, or publish the TypeScript package","usage":"code-standards maintain release typescript [-h] RELEASE_MODE [--output OUTPUT]"},{"commands":[],"name":"verify-wheel","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"WHEELS","names":["wheels"],"repeatable":true,"required":true,"summary":""}],"path":["maintain","release","verify-wheel"],"summary":"require non-empty license text in built Python wheels","usage":"code-standards maintain release verify-wheel [-h] WHEELS ..."},{"commands":[],"name":"verify-publications","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"ATTEMPTS","names":["--attempts"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"DELAY_SECONDS","names":["--delay-seconds"],"repeatable":false,"required":false,"summary":""}],"path":["maintain","release","verify-publications"],"summary":"wait for every exact sibling publication required by Standards","usage":"code-standards maintain release verify-publications [-h] [--attempts ATTEMPTS] [--delay-seconds DELAY_SECONDS]"},{"commands":[],"name":"publish","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["contracts","typescript","bootstrap","python","sql","iac","standards","tsconfig"],"kind":"positional","metavar":"RELEASE_TARGET","names":["release_target"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","publish"],"summary":"build and publish one package through its native client","usage":"code-standards maintain release publish [-h] RELEASE_TARGET"}],"name":"release","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","release"],"summary":"validate and build publishable release artifacts","usage":"code-standards maintain release [-h] {check-tag,verify-tags,create-tags,changes,causality,lock-age,typescript,verify-wheel,verify-publications,publish}"},{"commands":[{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","docs","check"],"summary":"","usage":"code-standards maintain docs check [-h]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","docs","sync"],"summary":"","usage":"code-standards maintain docs sync [-h]"}],"name":"docs","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","docs"],"summary":"check or synchronize source-derived documentation","usage":"code-standards maintain docs [-h] {check,sync}"},{"commands":[{"commands":[],"name":"install","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","hooks","install"],"summary":"install Lefthook","usage":"code-standards maintain hooks install [-h]"}],"name":"hooks","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","hooks"],"summary":"manage the pinned repository hooks","usage":"code-standards maintain hooks [-h] {install}"},{"commands":[{"commands":[],"name":"manifest","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules","manifest"],"summary":"print the shipped rule inventory","usage":"code-standards maintain rules manifest [-h]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules","check"],"summary":"verify the shipped rule inventory matches live registries","usage":"code-standards maintain rules check [-h]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules","sync"],"summary":"update the shipped rule inventory from live registries","usage":"code-standards maintain rules sync [-h]"},{"commands":[],"name":"new","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":["architecture","correctness","maintainability","performance","security","style","testing"],"kind":"option","metavar":"RULE_CATEGORY","names":["--category"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"RULE_SUMMARY","names":["--summary"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":null,"names":["--apply"],"repeatable":false,"required":false,"summary":"create the planned files"}],"path":["maintain","rules","new"],"summary":"plan or create author-owned rule and test skeletons","usage":"code-standards maintain rules new [-h] SELECTOR --category RULE_CATEGORY --summary RULE_SUMMARY [--apply]"},{"commands":[],"name":"stage-warning","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report required staging without writing"}],"path":["maintain","rules","stage-warning"],"summary":"prepare one registered rule for warning-first publication","usage":"code-standards maintain rules stage-warning [-h] SELECTOR [--check]"},{"commands":[],"name":"promote-error","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report required promotion without writing"}],"path":["maintain","rules","promote-error"],"summary":"promote one warning-staged rule to blocking error severity","usage":"code-standards maintain rules promote-error [-h] SELECTOR [--check]"},{"commands":[],"name":"prepare","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report required preparation without writing"}],"path":["maintain","rules","prepare"],"summary":"validate and prepare one registered rule for warning-first publication","usage":"code-standards maintain rules prepare [-h] SELECTOR [--check]"},{"commands":[],"name":"verify","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"}],"path":["maintain","rules","verify"],"summary":"validate one registered rule's authored files and public examples","usage":"code-standards maintain rules verify [-h] SELECTOR"},{"commands":[],"name":"bench","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":true,"summary":"Python files or directories"},{"choices":[],"kind":"option","metavar":"REPEATS","names":["--repeats"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"python:ID selector; defaults to all Python rules"}],"path":["maintain","rules","bench"],"summary":"measure native Python analysis with diagnostic and source digests","usage":"code-standards maintain rules bench [-h] FILES ... [--repeats REPEATS] [--rule SELECTED_RULES ...]"},{"commands":[],"name":"changes","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BEFORE","names":["--before"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"AFTER","names":["--after"],"repeatable":false,"required":true,"summary":""},{"choices":["json","text"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":["warning"],"kind":"option","metavar":"REQUIRED_ADDED_LEVEL","names":["--require-added-level"],"repeatable":false,"required":false,"summary":"fail when an added rule does not start at this level"}],"path":["maintain","rules","changes"],"summary":"compare rule inventory and policy between two Git revisions","usage":"code-standards maintain rules changes [-h] --before BEFORE --after AFTER [--format OUTPUT_FORMAT] [--require-added-level REQUIRED_ADDED_LEVEL]"},{"commands":[],"name":"evaluate","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":true,"summary":"canonical ENGINE:ID selector (repeatable)"},{"choices":[],"kind":"option","metavar":"CORPUS_MANIFEST","names":["--corpus-manifest"],"repeatable":false,"required":false,"summary":"evaluate immutable repositories declared by a public corpus manifest"},{"choices":[],"kind":"option","metavar":"PRIVATE_OVERLAY","names":["--private-overlay"],"repeatable":false,"required":false,"summary":"merge an owner-readable private corpus overlay (requires --corpus-manifest)"},{"choices":["corpus","effective"],"kind":"option","metavar":"EVALUATION_SCOPE","names":["--scope"],"repeatable":false,"required":false,"summary":"corpus ignores baselines/rule exclusions; effective applies adopted repository policy"},{"choices":["json","text"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow executable repository ESLint configuration"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":""}],"path":["maintain","rules","evaluate"],"summary":"calibrate selected custom rules; findings exit 1 and invalid input or execution exits 2","usage":"code-standards maintain rules evaluate [-h] --rule SELECTED_RULES ... [--corpus-manifest CORPUS_MANIFEST] [--private-overlay PRIVATE_OVERLAY] [--scope EVALUATION_SCOPE] [--format OUTPUT_FORMAT] [--output OUTPUT] [--trust-repository-code] [FILES ...]"}],"name":"rules","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules"],"summary":"inspect live custom rules","usage":"code-standards maintain rules [-h] {manifest,check,sync,new,stage-warning,promote-error,prepare,verify,bench,changes,evaluate}"},{"commands":[{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--typescript-built"],"repeatable":false,"required":false,"summary":"reuse the TypeScript build completed by this verification run"}],"path":["maintain","catalog","check"],"summary":"verify the public catalog matches every live rule","usage":"code-standards maintain catalog check [-h] [--typescript-built]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","catalog","sync"],"summary":"update the public catalog from source-owned rule metadata","usage":"code-standards maintain catalog sync [-h]"}],"name":"catalog","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","catalog"],"summary":"maintain the source-derived public rule catalog","usage":"code-standards maintain catalog [-h] {check,sync}"},{"commands":[{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","cli-reference","check"],"summary":"verify the shipped reference matches the parser graph","usage":"code-standards maintain cli-reference check [-h]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","cli-reference","sync"],"summary":"update the shipped reference from the parser graph","usage":"code-standards maintain cli-reference sync [-h]"}],"name":"cli-reference","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","cli-reference"],"summary":"maintain the source-derived CLI reference","usage":"code-standards maintain cli-reference [-h] {check,sync}"}],"name":"maintain","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain"],"summary":"repository policy, hooks, rule ledgers, and releases","usage":"code-standards maintain [-h] {setup,check,sync-ledger,comment-corpus,release,docs,hooks,rules,catalog,cli-reference}"}],"epilog":"Start with `code-standards setup`, then use `code-standards check`.","globalOptions":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"DEST","names":["--root"],"repeatable":false,"required":false,"summary":"repository root shared by the selected command (default: current directory)"},{"choices":[],"kind":"option","metavar":null,"names":["--version"],"repeatable":false,"required":false,"summary":""}],"launcher":{"install":"uv tool install --python 3.14 code-standards","runLatest":"uvx --no-config --isolated --python 3.14 --from code-standards code-standards"},"program":"code-standards","schemaVersion":1,"summary":"Adopt, check, fix, diagnose, and update sarj-ai standards (v8.13.1).","version":"8.13.1"}

code_standards-8.13.1/src/sarj_standards/configs/zizmor.strict.yml

@@ -0,0 +1,2 @@
+# Local offline audits use upstream IDs; canonical Standards baselines own triage.
+rules: {}

{code_standards-8.12.1 → code_standards-8.13.1}/src/sarj_standards/libs/adoption/configs.py

@@ -22,6 +22,8 @@ CONFIG_NAMES: Final[Mapping[str, tuple[str, str]]] = MappingProxyType(
         "taplo": ("taplo.strict.toml", ".taplo.toml"),
         "yamllint": ("yamllint.strict.yaml", ".yamllint.yaml"),
         "shellcheck": ("shellcheck.strict.rc", ".shellcheckrc"),
+        "zizmor": ("zizmor.strict.yml", "zizmor.yml"),
+        "checkov": ("checkov.strict.yml", ".checkov.yml"),
     }
 )
 

{code_standards-8.12.1 → code_standards-8.13.1}/src/sarj_standards/libs/adoption/doctor.py

@@ -169,6 +169,8 @@ _CONFIG_TARGETS: Final = MappingProxyType(
         "shellcheck": ("shellcheck.strict.rc", "shellcheck.strict.rc", ".shellcheckrc", "root"),
         "taplo": ("taplo.strict.toml", "taplo.strict.toml", ".taplo.toml", "root"),
         "yamllint": ("yamllint.strict.yaml", "yamllint.strict.yaml", ".yamllint.yaml", "root"),
+        "zizmor": ("zizmor.strict.yml", "zizmor.strict.yml", "zizmor.yml", "root"),
+        "checkov": ("checkov.strict.yml", "checkov.strict.yml", ".checkov.yml", "root"),
     }
 )
 

{code_standards-8.12.1 → code_standards-8.13.1}/src/sarj_standards/libs/adoption/lifecycle.py

@@ -17,7 +17,7 @@ from typing import TYPE_CHECKING, NamedTuple
 
 from sarj_standards.libs.filesystem import is_link_like
 from sarj_standards.libs.json_boundary import parse_json
-from sarj_standards.libs.linting import runner
+from sarj_standards.libs.linting import runner, security_tools
 
 from . import manifest, packagemanager, scaffold, transaction
 
@@ -73,6 +73,12 @@ def install_commands(
     hook_manager: manifest.HookManager = "pre-commit",
 ) -> list[Command]:
     commands: list[Command] = []
+    for name in security_tools.TOOLS:
+        enabled = ecosystems.actions if name == "zizmor" else ecosystems.infrastructure
+        if enabled:
+            commands.append(
+                Command(f"prepare pinned {name}", (*security_tools.command(name, offline=False), "--version"), root)
+            )
     if ecosystems.typescript_root is not None:
         install_root = ecosystems.typescript_install_root or ecosystems.typescript_root
         # Setup writes pnpm-workspace.yaml before this command executes because

{code_standards-8.12.1 → code_standards-8.13.1}/src/sarj_standards/libs/adoption/manifest.py

@@ -39,8 +39,10 @@ _TOML_COLUMN_WIDTH: Final = 80  # Taplo's default; the shipped strict config doe
 
 
 class _UpstreamRuleEngine(StrEnum):
+    CHECKOV = "checkov"
     ESLINT = "eslint"
     SHELLCHECK = "shellcheck"
+    ZIZMOR = "zizmor"
 
 
 #: Sibling distributions pinned exactly by `code-standards`.
@@ -91,6 +93,7 @@ SWIFT_CONFIGS: Final = ("swiftformat", "swiftlint")
 KOTLIN_CONFIGS: Final = ("ktlint", "detekt")
 MOBILE_CONFIGS: Final = ("mobile-security",)
 SHARED_CONFIGS: Final = ("markdownlint", "shellcheck", "taplo", "yamllint")
+SECURITY_CONFIGS: Final = ("zizmor", "checkov")
 _SCHEMA_THREE_CONFIGS: Final = (*PYTHON_CONFIGS, *TYPESCRIPT_CONFIGS, *SHARED_CONFIGS)
 ALL_CONFIGS: Final = (
     *PYTHON_CONFIGS,
@@ -99,6 +102,7 @@ ALL_CONFIGS: Final = (
     *KOTLIN_CONFIGS,
     *MOBILE_CONFIGS,
     *SHARED_CONFIGS,
+    *SECURITY_CONFIGS,
 )
 ALL_CAPABILITIES: Final = (*ALL_CONFIGS, *PYTHON_ANALYZERS)
 DEFAULT_DURABLE_ARTIFACTS: Final = (
@@ -218,8 +222,14 @@ def default_configs(
     has_swift: bool = False,
     has_kotlin: bool = False,
     has_mobile: bool = False,
+    has_actions: bool = False,
+    has_infrastructure: bool = False,
 ) -> tuple[str, ...]:
     selected: set[str] = set(SHARED_CONFIGS)
+    if has_actions:
+        selected.add("zizmor")
+    if has_infrastructure:
+        selected.add("checkov")
     if has_python:
         selected.update(PYTHON_CONFIGS)
     if has_typescript:
@@ -237,6 +247,7 @@ def default_configs(
         *KOTLIN_CONFIGS,
         *MOBILE_CONFIGS,
         *SHARED_CONFIGS,
+        *SECURITY_CONFIGS,
     )
     return tuple(name for name in order if name in selected)
 
@@ -273,7 +284,6 @@ def _load_schema(  # ruff: ignore[too-many-locals] - one validation boundary kee
     raw_profile = data.get("profile", "standard")
     capabilities_table = _manifest_table(data, "capabilities")
     disabled = _string_list(capabilities_table, "disable", label="manifest [capabilities].disable")
-    supported_configs = ALL_CONFIGS if expected_schema == MANIFEST_SCHEMA else _SCHEMA_THREE_CONFIGS
     supported_capabilities = ALL_CAPABILITIES if expected_schema == MANIFEST_SCHEMA else _SCHEMA_THREE_CONFIGS
     unknown_capabilities = sorted(set(disabled) - set(supported_capabilities))
     if unknown_capabilities:
@@ -282,17 +292,7 @@ def _load_schema(  # ruff: ignore[too-many-locals] - one validation boundary kee
     if declared is None:
         msg = f"{path} must set a string `bundle` declaration"
         raise TypeError(msg)
-    try:
-        bundle_version = Version(declared)
-    except InvalidVersion as exc:
-        msg = f"{path} `bundle` must be a valid PEP 440 version"
-        raise ValueError(msg) from exc
-    enabled_configs = (
-        _SCHEMA_THREE_CONFIGS
-        if expected_schema == MANIFEST_SCHEMA and bundle_version < Version("7.8.0")
-        else supported_configs
-    )
-    names = [name for name in enabled_configs if name not in disabled]
+    names = tuple(name for name in _bundle_configs(declared, path, expected_schema) if name not in disabled)
     if not isinstance(raw_profile, str) or raw_profile not in PROFILES:
         msg = f"{path} `profile` must be one of: {', '.join(PROFILES)}"
         raise ValueError(msg)
@@ -314,7 +314,7 @@ def _load_schema(  # ruff: ignore[too-many-locals] - one validation boundary kee
     hook_manager: HookManager = raw_hook_manager
     return Manifest(
         version=declared,
-        configs=tuple(names),
+        configs=names,
         python_dest=_dest_value(dest_table, "python"),
         typescript_dest=_dest_value(dest_table, "typescript"),
         swift_dest=_dest_value(dest_table, "swift", root=root),
@@ -348,6 +348,19 @@ def _load_schema(  # ruff: ignore[too-many-locals] - one validation boundary kee
     )
 
 
+def _bundle_configs(declared: str, path: Path, schema: int) -> tuple[str, ...]:
+    try:
+        version = Version(declared)
+    except InvalidVersion as exc:
+        msg = f"{path} `bundle` must be a valid PEP 440 version"
+        raise ValueError(msg) from exc
+    if schema != MANIFEST_SCHEMA or version < Version("7.8.0"):
+        return _SCHEMA_THREE_CONFIGS
+    if version < Version("8.13.0"):
+        return tuple(name for name in ALL_CONFIGS if name not in SECURITY_CONFIGS)
+    return ALL_CONFIGS
+
+
 def _check_manifest_schema(data: Mapping[str, object], path: Path, expected_schema: int) -> None:
     raw_schema = data.get("schema")
     if type(raw_schema) is not int or raw_schema != expected_schema:
@@ -546,7 +559,7 @@ def validate_excluded_rule(selector: str) -> str:
     engine, separator, rule = selector.partition(":")
     if (
         not separator
-        or engine not in {"ruff", "basedpyright", "eslint", "shellcheck", "python", "sql", "iac", "text"}
+        or engine not in {"ruff", "basedpyright", *_UpstreamRuleEngine, *_SARJ_RULE_ENGINES}
         or not rule
         or rule != rule.strip()
     ):
@@ -592,10 +605,8 @@ def _validate_known_rule(engine: str, rule: str, selector: str) -> None:
         upstream = _UpstreamRuleEngine(engine)
     except ValueError:
         return
-    if upstream is _UpstreamRuleEngine.SHELLCHECK:
-        if re.fullmatch(r"SC[0-9]{4}", rule) is None:
-            msg = f"unknown Standards rule exclusion: {selector}"
-            raise ValueError(msg)
+    if upstream is not _UpstreamRuleEngine.ESLINT:
+        _validate_source_tool_rule(upstream, rule, selector)
         return
     if rule.startswith("@sarj/"):
         known = frozenset(f"@sarj/{name}" for name in shipped.rules.get(ledger.ESLINT, ()))
@@ -609,6 +620,21 @@ def _validate_known_rule(engine: str, rule: str, selector: str) -> None:
         raise ValueError(msg)
 
 
+def _validate_source_tool_rule(engine: _UpstreamRuleEngine, rule: str, selector: str) -> None:
+    from sarj_standards.libs.linting import (  # ruff: ignore[import-outside-top-level] -- defer analyzer imports while adoption initializes.
+        security_tools,
+    )
+
+    if engine is _UpstreamRuleEngine.SHELLCHECK:
+        valid = re.fullmatch(r"SC[0-9]{4}", rule) is not None
+    else:
+        known = security_tools.CHECKOV_CHECKS if engine is _UpstreamRuleEngine.CHECKOV else security_tools.ZIZMOR_RULES
+        valid = rule in known
+    if not valid:
+        msg = f"unknown Standards rule exclusion: {selector}"
+        raise ValueError(msg)
+
+
 def _exclusion_overrides(
     root: Path,
     table: Mapping[str, object],