code-standards 8.120.0__tar.gz → 8.122.0__tar.gz

{code_standards-8.120.0 → code_standards-8.122.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.120.0
+Version: 8.122.0
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/
@@ -105,7 +105,7 @@ Unused private Python test helpers require `reportUnusedFunction` set to `warnin
 
 DevOps execution blocks may sequence existing commands without helper scripts. Keep interpreter source, control flow, logical chains, pipelines and substitutions in independently linted files; Python `-m` and script paths, and jq/awk `-f` files remain supported. SARJ310 is an error, including short inline programs. Cloud Build SARJ315 checks YAML and JSON for unique IDs, ordered step dependencies, script/argv exclusivity and untrusted substitutions in shell source; pass substitutions as quoted arguments to external scripts. JSON configs are discovered in operational directories or with `cloudbuild` in their filename; JSON syntax must be strict, with unique keys and finite numbers. Files named with `cloudbuild`, and Build-shaped files under a `cloudbuild` directory, use the bundled, digest-verified Google Build v1 field schema for field names, types, enums and protobuf durations/integers. The offline schema rejects output-only fields; trigger expansion, resource access and hosted admission require the deployment environment.
 
-The source gate uses pinned actionlint, shared ShellCheck, offline Zizmor, Hadolint and Skaffold v4beta7 schema validation. Every selected `action.yml`/`action.yaml` uses GitHub's pinned action parser and converter offline, including composite steps, expression syntax and available contexts, runtime requirements, step IDs and action-reference forms. This uses the core Node runtime and needs no referencing workflow, consumer npm setup or security capability. Cloud Deploy validation is a documented partial structural contract. Terraform validation and TFLint require explicit repository trust and prepared local providers; analysis never initializes or downloads them. Compose requires an exact consumer `[devops].compose_version`; its source check does not resolve environment inputs.
+The source gate uses pinned actionlint, shared ShellCheck, offline Zizmor, Hadolint and Skaffold v4beta7 schema validation. Every selected `action.yml`/`action.yaml` uses GitHub's pinned action parser and converter offline, including composite steps, expression syntax and available contexts, runtime requirements, step IDs and action-reference forms. This uses the core Node runtime and needs no referencing workflow, consumer npm setup or security capability. Cloud Deploy validation is a documented partial structural contract. Terraform validation and TFLint require explicit repository trust and prepared local providers; analysis never initializes or downloads them. Compose requires an exact consumer `[devops].compose_version`; its source check does not resolve environment inputs. Declare `compose_projects = [["base.yaml", "overlays/production.yaml"]]` in `[devops]` to validate custom filenames and overlays in invocation order. Selecting any member checks the whole project; declared fragments are not checked independently. Undeclared conventional filenames remain standalone projects. Missing inputs and native field errors fail coverage. Source checks use Compose's partially resolved model; full consistency requires the actual deployment environment.
 
 File discovery, enabled capabilities and native validation each determine coverage. Check the selected paths and tool reports; a syntax check does not establish deployment validity.
 
@@ -117,12 +117,14 @@ File discovery, enabled capabilities and native validation each determine covera
 | Actions workflows and action metadata | actionlint for workflows; pinned GitHub action parser for all `action.yml`/`action.yaml` files, including composite steps; Zizmor and shared execution checks | Offline validation covers structure and expression syntax/contexts; expression values and runtime availability require GitHub; security capabilities may be disabled |
 | Cloud Build YAML/JSON | Pinned Google Build v1 field schema, SARJ315 and shared execution checks | Schema selection uses a `cloudbuild` filename or Build-shaped source in that directory; trigger inputs and hosted admission remain external |
 | Dockerfile variants | Hadolint and executable-field checks | Image-default entrypoints are not inferred |
-| `compose.yaml`, `compose.yml`, `docker-compose.yaml`, `docker-compose.yml` | Pinned native Compose source validation | Overlays and custom filenames need assembled native validation; embedded programs are checked by content |
+| Conventional Compose filenames and declared `compose_projects` | Pinned native Compose validation of ordered file groups | Environment interpolation/resolution stays disabled; deployment must supply its actual environment inputs |
 | Skaffold and Cloud Deploy YAML | Pinned Skaffold schema; partial Cloud Deploy structure | Generated resources need prepared validation |
 | Helm charts, Kubernetes and CRDs | Prepared Helm lint/render, kubeconform and kube-linter | Receipts must bind the rendered artifacts and local schema closure |
-| Templates, systemd units, service-specific `.conf`/`.cfg` | Text rules for recognized templates and `.conf`/`.cfg`; units are not routed | Render templates and run the service's native validator; no general semantic coverage is claimed |
+| Templates, systemd units, Nginx, Kamailio, Prometheus and Compose configs | Prepared native validation of rendered files with the matching runtime | Declare prepared targets and hash their authored inputs, rendered files and include closure; other service formats need their own application validator |
 
-Release gates use `code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID`. Declare exact `prepared_targets` under `[devops]` with an authored `source` path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 4.3.1 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
+Native prepared targets use `kind` values `systemd`, `nginx`, `kamailio`, `prometheus-config`, `prometheus-rules` or `compose`, plus `native_version`, `manifests` and `artifacts`. `native_version` is the exact first version-output line of the installed validator; Nginx writes it to stderr. Compose instead uses its exact semantic version and requires a hashed `environment_file`; ordered `manifests` run through native `config --quiet` with full interpolation and consistency checks. List executable artifacts under `executables` when unit validation requires them. Render templates first and bind template/variable inputs with `source_inputs`. The gate verifies hashes, stages a private copy and invokes only the service's check mode. Native service validation requires explicit repository trust and the deployment's matching runtime, including any referenced modules or runtime files; it never installs or starts a service. Systemd disables generators and verifies against the staged root. Other validators may resolve absolute runtime paths on the validation host; this is not a filesystem sandbox.
+
+Release gates use `code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID`; add `--trust-repository-code` for native service and Compose targets. Declare exact `prepared_targets` under `[devops]` with an authored `source` path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 4.3.1 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
 
 Prepared YAML rejects duplicate parsed keys and cyclic aliases. Each document must stay below depth 64 and at or below 100,000 expanded nodes, including repeated aliases.
 

{code_standards-8.120.0 → code_standards-8.122.0}/README.md

@@ -65,7 +65,7 @@ Unused private Python test helpers require `reportUnusedFunction` set to `warnin
 
 DevOps execution blocks may sequence existing commands without helper scripts. Keep interpreter source, control flow, logical chains, pipelines and substitutions in independently linted files; Python `-m` and script paths, and jq/awk `-f` files remain supported. SARJ310 is an error, including short inline programs. Cloud Build SARJ315 checks YAML and JSON for unique IDs, ordered step dependencies, script/argv exclusivity and untrusted substitutions in shell source; pass substitutions as quoted arguments to external scripts. JSON configs are discovered in operational directories or with `cloudbuild` in their filename; JSON syntax must be strict, with unique keys and finite numbers. Files named with `cloudbuild`, and Build-shaped files under a `cloudbuild` directory, use the bundled, digest-verified Google Build v1 field schema for field names, types, enums and protobuf durations/integers. The offline schema rejects output-only fields; trigger expansion, resource access and hosted admission require the deployment environment.
 
-The source gate uses pinned actionlint, shared ShellCheck, offline Zizmor, Hadolint and Skaffold v4beta7 schema validation. Every selected `action.yml`/`action.yaml` uses GitHub's pinned action parser and converter offline, including composite steps, expression syntax and available contexts, runtime requirements, step IDs and action-reference forms. This uses the core Node runtime and needs no referencing workflow, consumer npm setup or security capability. Cloud Deploy validation is a documented partial structural contract. Terraform validation and TFLint require explicit repository trust and prepared local providers; analysis never initializes or downloads them. Compose requires an exact consumer `[devops].compose_version`; its source check does not resolve environment inputs.
+The source gate uses pinned actionlint, shared ShellCheck, offline Zizmor, Hadolint and Skaffold v4beta7 schema validation. Every selected `action.yml`/`action.yaml` uses GitHub's pinned action parser and converter offline, including composite steps, expression syntax and available contexts, runtime requirements, step IDs and action-reference forms. This uses the core Node runtime and needs no referencing workflow, consumer npm setup or security capability. Cloud Deploy validation is a documented partial structural contract. Terraform validation and TFLint require explicit repository trust and prepared local providers; analysis never initializes or downloads them. Compose requires an exact consumer `[devops].compose_version`; its source check does not resolve environment inputs. Declare `compose_projects = [["base.yaml", "overlays/production.yaml"]]` in `[devops]` to validate custom filenames and overlays in invocation order. Selecting any member checks the whole project; declared fragments are not checked independently. Undeclared conventional filenames remain standalone projects. Missing inputs and native field errors fail coverage. Source checks use Compose's partially resolved model; full consistency requires the actual deployment environment.
 
 File discovery, enabled capabilities and native validation each determine coverage. Check the selected paths and tool reports; a syntax check does not establish deployment validity.
 
@@ -77,12 +77,14 @@ File discovery, enabled capabilities and native validation each determine covera
 | Actions workflows and action metadata | actionlint for workflows; pinned GitHub action parser for all `action.yml`/`action.yaml` files, including composite steps; Zizmor and shared execution checks | Offline validation covers structure and expression syntax/contexts; expression values and runtime availability require GitHub; security capabilities may be disabled |
 | Cloud Build YAML/JSON | Pinned Google Build v1 field schema, SARJ315 and shared execution checks | Schema selection uses a `cloudbuild` filename or Build-shaped source in that directory; trigger inputs and hosted admission remain external |
 | Dockerfile variants | Hadolint and executable-field checks | Image-default entrypoints are not inferred |
-| `compose.yaml`, `compose.yml`, `docker-compose.yaml`, `docker-compose.yml` | Pinned native Compose source validation | Overlays and custom filenames need assembled native validation; embedded programs are checked by content |
+| Conventional Compose filenames and declared `compose_projects` | Pinned native Compose validation of ordered file groups | Environment interpolation/resolution stays disabled; deployment must supply its actual environment inputs |
 | Skaffold and Cloud Deploy YAML | Pinned Skaffold schema; partial Cloud Deploy structure | Generated resources need prepared validation |
 | Helm charts, Kubernetes and CRDs | Prepared Helm lint/render, kubeconform and kube-linter | Receipts must bind the rendered artifacts and local schema closure |
-| Templates, systemd units, service-specific `.conf`/`.cfg` | Text rules for recognized templates and `.conf`/`.cfg`; units are not routed | Render templates and run the service's native validator; no general semantic coverage is claimed |
+| Templates, systemd units, Nginx, Kamailio, Prometheus and Compose configs | Prepared native validation of rendered files with the matching runtime | Declare prepared targets and hash their authored inputs, rendered files and include closure; other service formats need their own application validator |
 
-Release gates use `code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID`. Declare exact `prepared_targets` under `[devops]` with an authored `source` path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 4.3.1 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
+Native prepared targets use `kind` values `systemd`, `nginx`, `kamailio`, `prometheus-config`, `prometheus-rules` or `compose`, plus `native_version`, `manifests` and `artifacts`. `native_version` is the exact first version-output line of the installed validator; Nginx writes it to stderr. Compose instead uses its exact semantic version and requires a hashed `environment_file`; ordered `manifests` run through native `config --quiet` with full interpolation and consistency checks. List executable artifacts under `executables` when unit validation requires them. Render templates first and bind template/variable inputs with `source_inputs`. The gate verifies hashes, stages a private copy and invokes only the service's check mode. Native service validation requires explicit repository trust and the deployment's matching runtime, including any referenced modules or runtime files; it never installs or starts a service. Systemd disables generators and verifies against the staged root. Other validators may resolve absolute runtime paths on the validation host; this is not a filesystem sandbox.
+
+Release gates use `code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID`; add `--trust-repository-code` for native service and Compose targets. Declare exact `prepared_targets` under `[devops]` with an authored `source` path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 4.3.1 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
 
 Prepared YAML rejects duplicate parsed keys and cyclic aliases. Each document must stay below depth 64 and at or below 100,000 expanded nodes, including repeated aliases.
 

{code_standards-8.120.0 → code_standards-8.122.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.120.0"
+version = "8.122.0"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"

{code_standards-8.120.0 → code_standards-8.122.0}/src/sarj_standards/api.py

@@ -278,7 +278,7 @@ class Standards:
             return _failed_analysis(self.root, "invalid-input", str(exc))
         if prepared_only:
             return _prepared_only_analysis(
-                self.root, adopted, prepared_devops, prepared_targets, paths=paths, rules=rules
+                self.root, adopted, prepared_devops, prepared_targets, paths=paths, rules=rules, trust=normalized_trust
             )
         try:
             selection_policy = _selection_policy(self.root, adopted, normalized_mode)
@@ -309,7 +309,7 @@ class Standards:
                 native = _with_library_policy(self.root, native, active_selected, selection_policy)
             if rule_selection is None and normalized_mode is AnalysisMode.POLICY:
                 native = _with_repository_analysis(self.root, native, staged=staged)
-            prepared = _prepared_reports(self.root, adopted, prepared_devops, prepared_targets)
+            prepared = _prepared_reports(self.root, adopted, prepared_devops, prepared_targets, trust=normalized_trust)
             return (*native.tools, *prepared)
 
         coverage = _selection_coverage(
@@ -624,6 +624,7 @@ def _prepared_only_analysis(
     *,
     paths: Sequence[str] | None,
     rules: Sequence[str | RuleSelector] | None,
+    trust: TrustMode,
 ) -> AnalysisReport:
     if not receipts or paths or rules:
         return _failed_analysis(
@@ -631,16 +632,23 @@ def _prepared_only_analysis(
             "invalid-input",
             "prepared-only analysis requires receipts and cannot include source paths or rule selectors",
         )
-    return report_from_tools(root, _prepared_reports(root, adopted, receipts, targets))
+    return report_from_tools(root, _prepared_reports(root, adopted, receipts, targets, trust=trust))
 
 
 def _prepared_reports(
-    root: Path, adopted: Manifest | None, receipts: Sequence[Path], targets: Sequence[str]
+    root: Path,
+    adopted: Manifest | None,
+    receipts: Sequence[Path],
+    targets: Sequence[str],
+    *,
+    trust: TrustMode = TrustMode.SAFE,
 ) -> tuple[ToolReport, ...]:
     if not receipts and not targets:
         return ()
     declared = adopted.prepared_targets if adopted is not None else ()
-    return analyze_prepared(receipts, root=root, declared=declared, selected=targets)
+    return analyze_prepared(
+        receipts, root=root, declared=declared, selected=targets, trust_repository_code=trust is TrustMode.TRUSTED
+    )
 
 
 def _prepared_coverage(adopted: Manifest | None, receipts: Sequence[Path]) -> tuple[CoverageNotice, ...]:

{code_standards-8.120.0 → code_standards-8.122.0}/src/sarj_standards/cli/main.py

@@ -3078,7 +3078,7 @@ def build_app(handler: Callable[[_Args], int] = _dispatch) -> typer.Typer:
         ] = False,
         trust_repository_code: Annotated[
             bool,
-            typer.Option("--trust-repository-code", help="allow prepared local Terraform provider/plugin validation"),
+            typer.Option("--trust-repository-code", help="allow native validation that may execute repository code"),
         ] = False,
         prepared_devops: Annotated[
             list[Path] | None, typer.Option("--prepared-devops", help="data-only preparation receipt (repeatable)")

code_standards-8.122.0/src/sarj_standards/configs/cli-reference.v1.json

@@ -0,0 +1 @@
+{"commands":[{"commands":[],"name":"commit-message","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"COMMIT_MSG_FILE","names":["message_file"],"repeatable":false,"required":true,"summary":"Git commit-message file supplied by the commit-msg hook"}],"path":["commit-message"],"summary":"enforce [(i/N) ][TICKET] type(scope)!: description with safe mechanical fixes","usage":"code-standards commit-message [-h] COMMIT_MSG_FILE"},{"commands":[],"name":"doctor","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["text","json"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":"output format (default: text)"},{"choices":[],"kind":"option","metavar":null,"names":["--repair"],"repeatable":false,"required":false,"summary":"transactionally repair safe drift with the executing bundle, then re-diagnose"},{"choices":[],"kind":"option","metavar":null,"names":["--no-install"],"repeatable":false,"required":false,"summary":"with --repair, update configuration without installing dependencies or hooks"}],"path":["doctor"],"summary":"diagnose adoption health and optionally repair safe drift","usage":"code-standards doctor [-h] [--format OUTPUT_FORMAT] [--repair] [--no-install]"},{"commands":[],"name":"setup","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["pre-commit","lefthook","none"],"kind":"option","metavar":"HOOKS","names":["--hooks"],"repeatable":false,"required":false,"summary":"hook manager (default: detect Lefthook, otherwise pre-commit)"},{"choices":[],"kind":"option","metavar":"PYTHON_DEST","names":["--python-dest"],"repeatable":false,"required":false,"summary":"the directory that owns pyproject.toml (default: detected)"},{"choices":[],"kind":"option","metavar":"TYPESCRIPT_DEST","names":["--typescript-dest"],"repeatable":false,"required":false,"summary":"the directory that owns the npm lockfile (default: detected); new ESLint entrypoints use TypeScript"},{"choices":[],"kind":"option","metavar":"SWIFT_DEST","names":["--swift-dest"],"repeatable":false,"required":false,"summary":"the directory that owns one reviewed Swift project (default: mobile project detection)"},{"choices":[],"kind":"option","metavar":"KOTLIN_DEST","names":["--kotlin-dest"],"repeatable":false,"required":false,"summary":"the directory that owns one reviewed Android/KMP project (default: detected)"},{"choices":[],"kind":"option","metavar":null,"names":["--dry-run"],"repeatable":false,"required":false,"summary":"print the complete plan without writing"},{"choices":[],"kind":"option","metavar":null,"names":["--force"],"repeatable":false,"required":false,"summary":"replace conflicting generated lint configuration after review"},{"choices":[],"kind":"option","metavar":null,"names":["--no-install"],"repeatable":false,"required":false,"summary":"write wiring without installing dependencies or hooks"},{"choices":[],"kind":"option","metavar":null,"names":["--tools-only"],"repeatable":false,"required":false,"summary":"install and attest pinned native tools for an adopted repository"},{"choices":[],"kind":"option","metavar":null,"names":["--commit-policy-only"],"repeatable":false,"required":false,"summary":"adopt only commit-message and PR-history policy without changing language tooling"},{"choices":["checkov","detekt","eslint","ktlint","markdownlint","mobile-security","pyright","ruff","shellcheck","swiftformat","swiftlint","taplo","yamllint","zizmor"],"kind":"option","metavar":"ONLY","names":["--config"],"repeatable":true,"required":false,"summary":"select one config explicitly (repeatable)"},{"choices":[],"kind":"option","metavar":"ENABLE_REPOSITORY_RULE","names":["--enable-repository-rule"],"repeatable":true,"required":false,"summary":"explicitly enable one reviewed, installed error-stage repository rule (repeatable); preserve existing rules and capped exceptions"}],"path":["setup"],"summary":"adopt or converge the repository in one idempotent operation","usage":"code-standards setup [-h] [--hooks HOOKS] [--python-dest PYTHON_DEST] [--typescript-dest TYPESCRIPT_DEST] [--swift-dest SWIFT_DEST] [--kotlin-dest KOTLIN_DEST] [--dry-run] [--force] [--no-install] [--tools-only] [--commit-policy-only] [--config ONLY ...] [--enable-repository-rule ENABLE_REPOSITORY_RULE ...]"},{"commands":[],"name":"analyze","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--external"],"repeatable":false,"required":false,"summary":"run pinned upstream analyzers"},{"choices":[],"kind":"option","metavar":null,"names":["--prepared-only"],"repeatable":false,"required":false,"summary":"validate prepared artifacts; source analysis stays in the CI source gate"},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow native validation that may execute repository code"},{"choices":[],"kind":"option","metavar":"PREPARED_DEVOPS","names":["--prepared-devops"],"repeatable":true,"required":false,"summary":"data-only preparation receipt (repeatable)"},{"choices":[],"kind":"option","metavar":"PREPARED_TARGET","names":["--prepared-target"],"repeatable":true,"required":false,"summary":"select an exact declared target (repeatable)"},{"choices":["text","json","sarif","github"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected source paths"}],"path":["analyze"],"summary":"emit canonical diagnostics, including prepared DevOps artifacts","usage":"code-standards analyze [-h] [--external] [--prepared-only] [--trust-repository-code] [--prepared-devops PREPARED_DEVOPS ...] [--prepared-target PREPARED_TARGET ...] [--format OUTPUT_FORMAT] [--output OUTPUT] [FILES ...]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow executable repository ESLint configuration (generated hooks and CI set this explicitly)"},{"choices":[],"kind":"option","metavar":"JOBS","names":["--jobs"],"repeatable":false,"required":false,"summary":"overlap native and external analysis (default: 2; 1 for serial debugging)"},{"choices":[],"kind":"option","metavar":null,"names":["--skip-python-type-check"],"repeatable":false,"required":false,"summary":"leave BasedPyright to the repository's own required CI; configs stay managed"},{"choices":[],"kind":"option","metavar":null,"names":["--skip-eslint"],"repeatable":false,"required":false,"summary":"leave ESLint to the repository's own required CI; configs stay managed and React Doctor still runs"},{"choices":[],"kind":"option","metavar":null,"names":["--staged"],"repeatable":false,"required":false,"summary":"run the complete gate on staged files; optional paths narrow the staged selection"},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"check only this custom ENGINE:ID rule (repeatable)"},{"choices":["text","json","sarif","github"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"write JSON or SARIF atomically to PATH"},{"choices":[],"kind":"option","metavar":"MAX_ANNOTATIONS_PER_LEVEL","names":["--max-annotations-per-level"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected paths; when omitted, check the complete repository"}],"path":["check"],"summary":"run the complete quality gate or check selected paths or custom rules","usage":"code-standards check [-h] [--trust-repository-code] [--jobs JOBS] [--skip-python-type-check] [--skip-eslint] [--staged] [--rule SELECTED_RULES ...] [--format OUTPUT_FORMAT] [--output OUTPUT] [--max-annotations-per-level MAX_ANNOTATIONS_PER_LEVEL] [FILES ...]"},{"commands":[],"name":"validate-slack-automations","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"PATH","names":["slack_catalog"],"repeatable":false,"required":true,"summary":""}],"path":["validate-slack-automations"],"summary":"validate a versioned Slack automation catalog","usage":"code-standards validate-slack-automations [-h] PATH"},{"commands":[],"name":"observe","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"canonical ENGINE:ID selector (repeatable)"},{"choices":[],"kind":"option","metavar":null,"names":["--test-value"],"repeatable":false,"required":false,"summary":"report curated test-oracle and redundancy advisories"},{"choices":[],"kind":"option","metavar":"BASE","names":["--base"],"repeatable":false,"required":false,"summary":"observe existing paths changed from this Git base"},{"choices":["text","json","sarif","github"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow repository ESLint configuration to execute"},{"choices":[],"kind":"option","metavar":"MAX_ANNOTATIONS_PER_LEVEL","names":["--max-annotations-per-level"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected paths; defaults to adopted verification paths"}],"path":["observe"],"summary":"report warning-stage findings with exit 0; invalid input or execution still exits 2","usage":"code-standards observe [-h] [--rule SELECTED_RULES ...] [--test-value] [--base BASE] [--format OUTPUT_FORMAT] [--output OUTPUT] [--trust-repository-code] [--max-annotations-per-level MAX_ANNOTATIONS_PER_LEVEL] [FILES ...]"},{"commands":[],"name":"fix","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--staged"],"repeatable":false,"required":false,"summary":"fix only files staged in Git"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected paths; when omitted, fix the complete repository"}],"path":["fix"],"summary":"apply safe formatting and lint fixes","usage":"code-standards fix [-h] [--staged] [FILES ...]"},{"commands":[],"name":"update","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"preview without writing; exit 1 when changes exist"},{"choices":[],"kind":"option","metavar":null,"names":["--offline"],"repeatable":false,"required":false,"summary":"reconverge the executing bundle and skip every network-dependent install; does not resolve latest"},{"choices":[],"kind":"option","metavar":"VERSION","names":["--to"],"repeatable":false,"required":false,"summary":"resolve and apply exactly this immutable coherent bundle version"},{"choices":[],"kind":"option","metavar":null,"names":["--no-install"],"repeatable":false,"required":false,"summary":"do not install dependencies or hooks"}],"path":["update"],"summary":"upgrade to the latest published coherent Standards bundle","usage":"code-standards update [-h] [--check] [--offline] [--to VERSION] [--no-install]"},{"commands":[{"commands":[],"name":"init","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"JOBS","names":["--jobs"],"repeatable":false,"required":false,"summary":"overlap independent baseline scans"},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"baseline JSON (default: diagnostic-baseline.json)"},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"run repository-local analyzers that execute project code"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"paths to analyze (default: the whole repository)"}],"path":["baseline","init"],"summary":"record the first diagnostic baseline","usage":"code-standards baseline init [-h] [--jobs JOBS] [--output OUTPUT] [--trust-repository-code] [FILES ...]"},{"commands":[],"name":"update","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"JOBS","names":["--jobs"],"repeatable":false,"required":false,"summary":"overlap independent baseline scans"},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"baseline JSON (default: diagnostic-baseline.json)"},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"run repository-local analyzers that execute project code"},{"choices":[],"kind":"option","metavar":"BASELINE_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"replace debt only for this newly promoted rule (repeatable; source:RULE is also accepted)"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"paths to analyze (default: the whole repository)"}],"path":["baseline","update"],"summary":"re-record the diagnostic baseline after reviewed cleanup","usage":"code-standards baseline update [-h] [--jobs JOBS] [--output OUTPUT] [--trust-repository-code] [--rule BASELINE_RULES ...] [FILES ...]"}],"name":"baseline","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["baseline"],"summary":"grandfather today's findings so only new ones fail","usage":"code-standards baseline [-h] {init,update}"},{"commands":[{"commands":[],"name":"init","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"}],"path":["ratchet","init"],"summary":"create the first suppression budget","usage":"code-standards ratchet init [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"}],"path":["ratchet","check"],"summary":"fail when suppression debt grows","usage":"code-standards ratchet check [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...]"},{"commands":[],"name":"status","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"}],"path":["ratchet","status"],"summary":"show current suppression debt and available reductions","usage":"code-standards ratchet status [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...]"},{"commands":[],"name":"update","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"},{"choices":[],"kind":"option","metavar":null,"names":["--allow-increase"],"repeatable":false,"required":false,"summary":"permit a reviewed increase in suppression debt"}],"path":["ratchet","update"],"summary":"lock in reviewed suppression-budget changes","usage":"code-standards ratchet update [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...] [--allow-increase]"}],"name":"ratchet","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["ratchet"],"summary":"keep the Python suppression budget from growing","usage":"code-standards ratchet [-h] {init,check,status,update}"},{"commands":[{"commands":[],"name":"list","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["exclude","list"],"summary":"list the complete denylist","usage":"code-standards exclude list [-h]"},{"commands":[],"name":"add","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["path","rule"],"kind":"positional","metavar":"{path,rule}","names":["exclude_kind"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"positional","metavar":"VALUE","names":["value"],"repeatable":false,"required":true,"summary":"repository-relative glob or canonical engine:rule selector"}],"path":["exclude","add"],"summary":"add one exact denylist entry","usage":"code-standards exclude add [-h] {path,rule} VALUE"},{"commands":[],"name":"remove","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["path","rule"],"kind":"positional","metavar":"{path,rule}","names":["exclude_kind"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"positional","metavar":"VALUE","names":["value"],"repeatable":false,"required":true,"summary":"repository-relative glob or canonical engine:rule selector"}],"path":["exclude","remove"],"summary":"remove one exact denylist entry","usage":"code-standards exclude remove [-h] {path,rule} VALUE"}],"name":"exclude","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["exclude"],"summary":"inspect or change explicit path and rule exclusions","usage":"code-standards exclude [-h] {list,add,remove}"},{"commands":[{"commands":[],"name":"state","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","state"],"summary":"print detected adoption state as JSON","usage":"code-standards show state [-h]"},{"commands":[],"name":"configs","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","configs"],"summary":"list bundled configurations","usage":"code-standards show configs [-h]"},{"commands":[],"name":"config","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["checkov","detekt","eslint","ktlint","markdownlint","mobile-security","pyright","ruff","shellcheck","swiftformat","swiftlint","taplo","yamllint","zizmor"],"kind":"positional","metavar":"NAME","names":["name"],"repeatable":false,"required":true,"summary":""}],"path":["show","config"],"summary":"print one bundled configuration path","usage":"code-standards show config [-h] NAME"},{"commands":[],"name":"peers","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","peers"],"summary":"show tested ESLint peer dependencies and install command","usage":"code-standards show peers [-h]"},{"commands":[],"name":"rules","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","rules"],"summary":"print the machine-readable custom-rule inventory","usage":"code-standards show rules [-h]"},{"commands":[],"name":"ci","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"write a managed workflow inside the repository"}],"path":["show","ci"],"summary":"print a complete versioned GitHub Actions standards workflow","usage":"code-standards show ci [-h] [--output OUTPUT]"}],"name":"show","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show"],"summary":"print read-only package and adoption information","usage":"code-standards show [-h] {state,configs,config,peers,rules,ci}"},{"commands":[{"commands":[],"name":"setup","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"print the deterministic setup plan without executing it"}],"path":["maintain","setup"],"summary":"install every standards development environment and repository hook","usage":"code-standards maintain setup [-h] [--check]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["ci-history","file-conventions","private-refs","versions"],"kind":"option","metavar":"REPO_ONLY","names":["--only"],"repeatable":true,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"COMMITS","names":["--commits"],"repeatable":false,"required":false,"summary":"also inspect commit messages in this revision range"},{"choices":[],"kind":"option","metavar":"POLICY_DEST","names":["--policy-root"],"repeatable":false,"required":false,"summary":"trusted repository policy root (default: --root)"},{"choices":[],"kind":"option","metavar":"PRIVATE_REFS_FILE","names":["--private-refs-file"],"repeatable":false,"required":false,"summary":"private-reference TOML outside the scanned repository"},{"choices":[],"kind":"option","metavar":null,"names":["--quiet"],"repeatable":false,"required":false,"summary":"hide finding details"}],"path":["maintain","check"],"summary":"run repository policy gates","usage":"code-standards maintain check [-h] [--only REPO_ONLY ...] [--commits COMMITS] [--policy-root POLICY_DEST] [--private-refs-file PRIVATE_REFS_FILE] [--quiet]"},{"commands":[],"name":"sync-ledger","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report drift without writing"}],"path":["maintain","sync-ledger"],"summary":"synchronize the rule compatibility ledger","usage":"code-standards maintain sync-ledger [-h] [--check]"},{"commands":[],"name":"comment-corpus","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"ROOTS","names":["roots"],"repeatable":true,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"PRIVATE_JSONL","names":["--include-text"],"repeatable":false,"required":false,"summary":"write sensitive comment text to a new owner-readable file"}],"path":["maintain","comment-corpus"],"summary":"extract comments for calibration","usage":"code-standards maintain comment-corpus [-h] ROOTS ... [--include-text PRIVATE_JSONL]"},{"commands":[{"commands":[],"name":"check-tag","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"TAG","names":["tag"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","check-tag"],"summary":"require a release tag to match its package manifest","usage":"code-standards maintain release check-tag [-h] TAG"},{"commands":[],"name":"verify-tags","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"RELEASE_COMMIT","names":["--commit"],"repeatable":false,"required":false,"summary":"also require existing tags to match this publishing commit or an unchanged package tree"}],"path":["maintain","release","verify-tags"],"summary":"verify all manifest release tags on origin","usage":"code-standards maintain release verify-tags [-h] [--commit RELEASE_COMMIT]"},{"commands":[],"name":"create-tags","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["contracts","typescript","bootstrap","python","sql","iac","standards","tsconfig"],"kind":"positional","metavar":"RELEASE_TARGETS","names":["release_targets"],"repeatable":true,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"RELEASE_COMMIT","names":["--commit"],"repeatable":false,"required":true,"summary":"exact commit that was published"},{"choices":[],"kind":"option","metavar":"ATTEMPTS","names":["--attempts"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"DELAY_SECONDS","names":["--delay-seconds"],"repeatable":false,"required":false,"summary":""}],"path":["maintain","release","create-tags"],"summary":"create and push manifest release tags","usage":"code-standards maintain release create-tags [-h] RELEASE_TARGETS ... --commit RELEASE_COMMIT [--attempts ATTEMPTS] [--delay-seconds DELAY_SECONDS]"},{"commands":[],"name":"changes","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BEFORE","names":["--before"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"AFTER","names":["--after"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"GITHUB_OUTPUT","names":["--github-output"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","changes"],"summary":"emit package version changes between Git revisions","usage":"code-standards maintain release changes [-h] --before BEFORE --after AFTER --github-output GITHUB_OUTPUT"},{"commands":[],"name":"causality","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BEFORE","names":["--before"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"AFTER","names":["--after"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","causality"],"summary":"require every publishable package change to bump its version","usage":"code-standards maintain release causality [-h] --before BEFORE --after AFTER"},{"commands":[],"name":"lock-age","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"LOCKFILE","names":["lockfile"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"MINIMUM_AGE","names":["--minimum-days"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"RELEASE_EXCLUDE","names":["--exclude"],"repeatable":true,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"RELEASE_EXCLUDE_FILE","names":["--exclude-file"],"repeatable":true,"required":false,"summary":"line-oriented exact package@version exceptions (repeatable)"}],"path":["maintain","release","lock-age"],"summary":"enforce npm lockfile minimum release age","usage":"code-standards maintain release lock-age [-h] LOCKFILE [--minimum-days MINIMUM_AGE] [--exclude RELEASE_EXCLUDE ...] [--exclude-file RELEASE_EXCLUDE_FILE ...]"},{"commands":[],"name":"typescript","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["check","pack","publish"],"kind":"positional","metavar":"RELEASE_MODE","names":["release_mode"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"artifact directory (required for pack)"}],"path":["maintain","release","typescript"],"summary":"check, pack, or publish the TypeScript package","usage":"code-standards maintain release typescript [-h] RELEASE_MODE [--output OUTPUT]"},{"commands":[],"name":"verify-wheel","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"WHEELS","names":["wheels"],"repeatable":true,"required":true,"summary":""}],"path":["maintain","release","verify-wheel"],"summary":"require non-empty license text in built Python wheels","usage":"code-standards maintain release verify-wheel [-h] WHEELS ..."},{"commands":[],"name":"status","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"RELEASE_COMMIT","names":["--commit"],"repeatable":false,"required":false,"summary":""},{"choices":["json","text"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""}],"path":["maintain","release","status"],"summary":"show release stages and queue time for an exact revision","usage":"code-standards maintain release status [-h] [--commit RELEASE_COMMIT] [--format OUTPUT_FORMAT]"},{"commands":[],"name":"verify-publications","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"ATTEMPTS","names":["--attempts"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"DELAY_SECONDS","names":["--delay-seconds"],"repeatable":false,"required":false,"summary":""}],"path":["maintain","release","verify-publications"],"summary":"wait for every exact sibling publication required by Standards","usage":"code-standards maintain release verify-publications [-h] [--attempts ATTEMPTS] [--delay-seconds DELAY_SECONDS]"},{"commands":[],"name":"publish","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["contracts","typescript","bootstrap","python","sql","iac","standards","tsconfig"],"kind":"positional","metavar":"RELEASE_TARGET","names":["release_target"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","publish"],"summary":"build and publish one package through its native client","usage":"code-standards maintain release publish [-h] RELEASE_TARGET"}],"name":"release","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","release"],"summary":"validate and build publishable release artifacts","usage":"code-standards maintain release [-h] {check-tag,verify-tags,create-tags,changes,causality,lock-age,typescript,verify-wheel,status,verify-publications,publish}"},{"commands":[{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","docs","check"],"summary":"","usage":"code-standards maintain docs check [-h]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","docs","sync"],"summary":"","usage":"code-standards maintain docs sync [-h]"}],"name":"docs","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","docs"],"summary":"check or synchronize source-derived documentation","usage":"code-standards maintain docs [-h] {check,sync}"},{"commands":[{"commands":[],"name":"install","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","hooks","install"],"summary":"install Lefthook","usage":"code-standards maintain hooks install [-h]"}],"name":"hooks","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","hooks"],"summary":"manage the pinned repository hooks","usage":"code-standards maintain hooks [-h] {install}"},{"commands":[{"commands":[],"name":"manifest","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules","manifest"],"summary":"print the shipped rule inventory","usage":"code-standards maintain rules manifest [-h]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules","check"],"summary":"verify the shipped rule inventory matches live registries","usage":"code-standards maintain rules check [-h]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules","sync"],"summary":"update the shipped rule inventory from live registries","usage":"code-standards maintain rules sync [-h]"},{"commands":[],"name":"new","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":["architecture","correctness","maintainability","performance","security","style","testing"],"kind":"option","metavar":"RULE_CATEGORY","names":["--category"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"RULE_SUMMARY","names":["--summary"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":null,"names":["--apply"],"repeatable":false,"required":false,"summary":"create the planned files"}],"path":["maintain","rules","new"],"summary":"plan or create author-owned rule and test skeletons","usage":"code-standards maintain rules new [-h] SELECTOR --category RULE_CATEGORY --summary RULE_SUMMARY [--apply]"},{"commands":[],"name":"stage-warning","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report required staging without writing"}],"path":["maintain","rules","stage-warning"],"summary":"prepare one registered rule for warning-first publication","usage":"code-standards maintain rules stage-warning [-h] SELECTOR [--check]"},{"commands":[],"name":"promote-error","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report required promotion without writing"}],"path":["maintain","rules","promote-error"],"summary":"promote one warning-staged rule to blocking error severity","usage":"code-standards maintain rules promote-error [-h] SELECTOR [--check]"},{"commands":[],"name":"prepare","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report required preparation without writing"}],"path":["maintain","rules","prepare"],"summary":"validate and prepare one registered rule for warning-first publication","usage":"code-standards maintain rules prepare [-h] SELECTOR [--check]"},{"commands":[],"name":"verify","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"}],"path":["maintain","rules","verify"],"summary":"validate one registered rule's authored files and public examples","usage":"code-standards maintain rules verify [-h] SELECTOR"},{"commands":[],"name":"bench","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":true,"summary":"Python files or directories"},{"choices":[],"kind":"option","metavar":"REPEATS","names":["--repeats"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"python:ID selector; defaults to all Python rules"}],"path":["maintain","rules","bench"],"summary":"measure native Python analysis with diagnostic and source digests","usage":"code-standards maintain rules bench [-h] FILES ... [--repeats REPEATS] [--rule SELECTED_RULES ...]"},{"commands":[],"name":"changes","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BEFORE","names":["--before"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"AFTER","names":["--after"],"repeatable":false,"required":true,"summary":""},{"choices":["json","text"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":["warning"],"kind":"option","metavar":"REQUIRED_ADDED_LEVEL","names":["--require-added-level"],"repeatable":false,"required":false,"summary":"fail when an added rule does not start at this level"}],"path":["maintain","rules","changes"],"summary":"compare rule inventory and policy between two Git revisions","usage":"code-standards maintain rules changes [-h] --before BEFORE --after AFTER [--format OUTPUT_FORMAT] [--require-added-level REQUIRED_ADDED_LEVEL]"},{"commands":[],"name":"evaluate","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":true,"summary":"canonical ENGINE:ID selector (repeatable)"},{"choices":[],"kind":"option","metavar":"CORPUS_MANIFEST","names":["--corpus-manifest"],"repeatable":false,"required":false,"summary":"evaluate immutable repositories declared by a public corpus manifest"},{"choices":[],"kind":"option","metavar":"PRIVATE_OVERLAY","names":["--private-overlay"],"repeatable":false,"required":false,"summary":"merge an owner-readable private corpus overlay (requires --corpus-manifest)"},{"choices":["corpus","effective"],"kind":"option","metavar":"EVALUATION_SCOPE","names":["--scope"],"repeatable":false,"required":false,"summary":"corpus ignores baselines/rule exclusions; effective applies adopted repository policy"},{"choices":["json","text"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow executable repository ESLint configuration"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":""}],"path":["maintain","rules","evaluate"],"summary":"calibrate selected custom rules; findings exit 1 and invalid input or execution exits 2","usage":"code-standards maintain rules evaluate [-h] --rule SELECTED_RULES ... [--corpus-manifest CORPUS_MANIFEST] [--private-overlay PRIVATE_OVERLAY] [--scope EVALUATION_SCOPE] [--format OUTPUT_FORMAT] [--output OUTPUT] [--trust-repository-code] [FILES ...]"}],"name":"rules","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules"],"summary":"inspect live custom rules","usage":"code-standards maintain rules [-h] {manifest,check,sync,new,stage-warning,promote-error,prepare,verify,bench,changes,evaluate}"},{"commands":[{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--typescript-built"],"repeatable":false,"required":false,"summary":"reuse the TypeScript build completed by this verification run"}],"path":["maintain","catalog","check"],"summary":"verify the public catalog matches every live rule","usage":"code-standards maintain catalog check [-h] [--typescript-built]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","catalog","sync"],"summary":"update the public catalog from source-owned rule metadata","usage":"code-standards maintain catalog sync [-h]"}],"name":"catalog","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","catalog"],"summary":"maintain the source-derived public rule catalog","usage":"code-standards maintain catalog [-h] {check,sync}"},{"commands":[{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","cli-reference","check"],"summary":"verify the shipped reference matches the parser graph","usage":"code-standards maintain cli-reference check [-h]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","cli-reference","sync"],"summary":"update the shipped reference from the parser graph","usage":"code-standards maintain cli-reference sync [-h]"}],"name":"cli-reference","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","cli-reference"],"summary":"maintain the source-derived CLI reference","usage":"code-standards maintain cli-reference [-h] {check,sync}"}],"name":"maintain","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain"],"summary":"repository policy, hooks, rule ledgers, and releases","usage":"code-standards maintain [-h] {setup,check,sync-ledger,comment-corpus,release,docs,hooks,rules,catalog,cli-reference}"}],"epilog":"Start with `code-standards setup`, then use `code-standards check`.","globalOptions":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"DEST","names":["--root"],"repeatable":false,"required":false,"summary":"repository root shared by the selected command (default: current directory)"},{"choices":[],"kind":"option","metavar":null,"names":["--version"],"repeatable":false,"required":false,"summary":""}],"launcher":{"install":"uv tool install --python 3.15.0 code-standards","runLatest":"uvx --no-config --isolated --python 3.15.0 --from code-standards code-standards"},"program":"code-standards","schemaVersion":1,"summary":"Adopt, check, fix, diagnose, and update sarj-ai standards (v8.122.0).","version":"8.122.0"}

{code_standards-8.120.0 → code_standards-8.122.0}/src/sarj_standards/libs/adoption/devops.py

@@ -31,6 +31,10 @@ def required_tools(
     names: set[str] = set()
     for path in files:
         names.update(_file_tools(path, path.relative_to(root).as_posix(), selected))
+    if "compose" in selected:
+        adopted = manifest.load_for_setup(root)
+        if adopted is not None and adopted.compose_projects:
+            names.add("docker")
     if prepared:
         names.update({"helm", "kubeconform", "kube-linter"})
     names.update(selected & set(manifest.QUALITY_ANALYZERS))

{code_standards-8.120.0 → code_standards-8.122.0}/src/sarj_standards/libs/adoption/manifest.py

@@ -162,6 +162,7 @@ class Manifest:
     ci_bootstrap: tuple[str, ...] = ()
     prepared_targets: tuple[PreparedTarget, ...] = ()
     compose_version: str | None = None
+    compose_projects: tuple[tuple[str, ...], ...] = ()
     ci_runner: str | None = None
     ci_commit_policy: CommitPolicyCi = "workflow"
     knip_application: bool = False
@@ -219,8 +220,7 @@ class Manifest:
             if self.ci_runner is not None:
                 ci_fields += f"runner = {_toml_string(self.ci_runner)}\n"
             sections.append(f"\n[ci]\n{ci_fields}")
-        if self.compose_version is not None:
-            sections.append(f"\n[devops]\ncompose_version = {_toml_string(self.compose_version)}\n")
+        sections.append(self._compose_section())
         if self.knip_application:
             sections.append("\n[knip]\napplication = true\n")
         sections.extend(
@@ -229,6 +229,15 @@ class Manifest:
         )
         return "".join(sections)
 
+    def _compose_section(self) -> str:
+        fields: list[str] = []
+        if self.compose_version is not None:
+            fields.append(f"compose_version = {_toml_string(self.compose_version)}\n")
+        if self.compose_projects:
+            projects = ", ".join(json.dumps(list(files), ensure_ascii=False) for files in self.compose_projects)
+            fields.append(f"compose_projects = [{projects}]\n")
+        return "\n[devops]\n" + "".join(fields) if fields else ""
+
 
 def as_table(value: object) -> dict[str, object]:
     if not is_object_mapping(value):
@@ -381,12 +390,38 @@ def _load_schema(  # ruff: ignore[too-many-locals] - one validation boundary kee
         ci_bootstrap=_ci_bootstrap(ci_table),
         prepared_targets=_prepared_targets(root, _manifest_table(data, "devops")),
         compose_version=_compose_version(_manifest_table(data, "devops")),
+        compose_projects=_compose_projects(root, _manifest_table(data, "devops")),
         ci_runner=_ci_runner(ci_table),
         ci_commit_policy=_ci_commit_policy(ci_table),
         knip_application=_knip_application(_manifest_table(data, "knip")),
     )
 
 
+def _compose_projects(root: Path, table: Mapping[str, object]) -> tuple[tuple[str, ...], ...]:
+    raw = table.get("compose_projects", [])
+    if not is_object_list(raw):
+        message = "manifest devops.compose_projects must be an array of ordered file arrays"
+        raise ValueError(message)
+    projects: list[tuple[str, ...]] = []
+    for item in raw:
+        if not is_object_list(item) or not item or any(not isinstance(name, str) or not name for name in item):
+            message = "Compose projects require nonempty file paths in invocation order"
+            raise ValueError(message)
+        files = tuple(name for name in item if isinstance(name, str))
+        for name in files:
+            path = Path(name)
+            if (
+                path.is_absolute()
+                or ".." in path.parts
+                or "\\" in name
+                or not (root / path).resolve().is_relative_to(root.resolve())
+            ):
+                message = "Compose project files must be repository-relative paths"
+                raise ValueError(message)
+        projects.append(files)
+    return tuple(dict.fromkeys(projects))
+
+
 def _compose_version(table: Mapping[str, object]) -> str | None:
     value = table.get("compose_version")
     if value is None:
@@ -398,8 +433,8 @@ def _compose_version(table: Mapping[str, object]) -> str | None:
 
 
 def _prepared_targets(root: Path, table: Mapping[str, object]) -> tuple[PreparedTarget, ...]:
-    if set(table) - {"prepared_targets", "compose_version"}:
-        msg = "manifest [devops] supports only prepared_targets and compose_version"
+    if set(table) - {"prepared_targets", "compose_version", "compose_projects"}:
+        msg = "manifest [devops] supports only prepared_targets, compose_version and compose_projects"
         raise ValueError(msg)
     raw = table.get("prepared_targets", [])
     if not is_object_list(raw):

{code_standards-8.120.0 → code_standards-8.122.0}/src/sarj_standards/libs/adoption/scaffold.py

@@ -1134,6 +1134,7 @@ def _desired_manifest(root: Path, plan: Plan, current: manifest.Manifest | None)
         ci_bootstrap=() if current is None else current.ci_bootstrap,
         prepared_targets=() if current is None else current.prepared_targets,
         compose_version=_new_compose_version(root) if current is None else current.compose_version,
+        compose_projects=() if current is None else current.compose_projects,
         ci_runner=None if current is None else current.ci_runner,
         ci_commit_policy="workflow" if current is None else current.ci_commit_policy,
         knip_application=False if current is None else current.knip_application,

{code_standards-8.120.0 → code_standards-8.122.0}/src/sarj_standards/libs/linting/devops_source.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 from dataclasses import dataclass, replace
 import json
+import os
 from pathlib import Path
 import re
 import shutil
@@ -29,6 +30,7 @@ if TYPE_CHECKING:
     from collections.abc import Callable
 
     from sarj_standards.libs.linting.devops_tools import NativeTool
+    from sarj_standards.libs.linting.policy import Policy
 
 SUPPORTED: Final = frozenset({"actionlint", "hadolint", "terraform", "tflint", "compose"})
 _ACTION_FORMAT: Final = "{{json .}}"
@@ -45,7 +47,6 @@ class SourcePaths:
     dockerfiles: tuple[Path, ...]
     terraform: tuple[Path, ...]
     terraform_format: tuple[Path, ...]
-    compose: tuple[Path, ...]
 
 
 def analyze_sources(
@@ -57,6 +58,8 @@ def analyze_sources(
     runner: ProcessRunner = run_process,
     compose_version: str | None = None,
     shared_shellcheck: bool = False,
+    scope: tuple[str, ...] | None = None,
+    policy: Policy | None = None,
 ) -> tuple[ToolReport, ...]:
     root = root.resolve()
     sources = _select_sources(root, paths)
@@ -95,7 +98,7 @@ def analyze_sources(
     if "tflint" in selected and sources.terraform:
         reports.extend(_tflint_reports(root, sources.terraform, runner, trust_repository_code=trust_repository_code))
     if "compose" in selected:
-        reports.extend(_compose_reports(root, sources.compose, runner, version=compose_version))
+        reports.extend(_compose_reports(root, paths, runner, version=compose_version, scope=scope, policy=policy))
     return tuple(reports)
 
 
@@ -119,25 +122,63 @@ def _select_sources(root: Path, paths: tuple[str, ...]) -> SourcePaths:
         ),
         terraform=tuple(path for path in inputs if path.suffix == ".tf" or path.name.endswith(".tf.json")),
         terraform_format=tuple(path for path in inputs if path.name.endswith((".tf", ".tfvars", ".tftest.hcl"))),
-        compose=tuple(
-            path
-            for path in inputs
-            if path.name in {"compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"}
-        ),
     )
 
 
 def _compose_reports(
-    root: Path, paths: tuple[Path, ...], runner: ProcessRunner, *, version: str | None
+    root: Path,
+    paths: tuple[str, ...],
+    runner: ProcessRunner,
+    *,
+    version: str | None,
+    scope: tuple[str, ...] | None,
+    policy: Policy | None,
 ) -> tuple[ToolReport, ...]:
-    if not paths:
+    if not paths and not scope:
         return ()
-    if version is None:
-        from sarj_standards.libs.adoption import manifest  # ruff: ignore[import-outside-top-level] -- resolve the consumer contract after adoption initialization.
+    from sarj_standards.libs.adoption import manifest  # ruff: ignore[import-outside-top-level] -- resolve the consumer contract after adoption initialization.
 
+    try:
         adopted = manifest.load(root)
-        version = None if adopted is None else adopted.compose_version
-    return tuple(_compose_report(root, path, runner, version=version) for path in paths)
+        declared = () if adopted is None else adopted.compose_projects
+        if version is None and adopted is not None:
+            version = adopted.compose_version
+        projects = _compose_inputs(root, paths, declared, scope=scope, policy=policy)
+    except (OSError, ValueError) as error:
+        return (_failed("compose-static", error, len(paths)),)
+    return tuple(_compose_report(root, project, runner, version=version) for project in projects)
+
+
+def _compose_inputs(
+    root: Path,
+    paths: tuple[str, ...],
+    declared: tuple[tuple[str, ...], ...],
+    *,
+    scope: tuple[str, ...] | None,
+    policy: Policy | None,
+) -> tuple[tuple[Path, ...], ...]:
+    scopes = tuple((root / name).resolve() for name in (paths if scope is None else scope))
+    members: set[Path] = set()
+    projects: list[tuple[Path, ...]] = []
+    for files in declared:
+        project = tuple((root / name).resolve() for name in files)
+        members.update(project)
+        if _compose_selected(project, scopes, policy=policy):
+            projects.append(tuple(_contained(root, name) for name in files))
+    projects.extend(
+        (path,)
+        for path in sorted({(root / name).resolve() for name in paths} - members)
+        if path.name in {"compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"}
+    )
+    return tuple(projects)
+
+
+def _compose_selected(project: tuple[Path, ...], scopes: tuple[Path, ...], *, policy: Policy | None) -> bool:
+    return any(
+        (policy is None or policy.allows_path(path))
+        and any(path == selected or (selected.is_dir() and path.is_relative_to(selected)) for selected in scopes)
+        for path in project
+    )
 
 
 def _actionlint_report(
@@ -464,15 +505,26 @@ def _tflint_report(root: Path, project: Path, paths: tuple[Path, ...], runner: P
     )
 
 
-def _compose_report(root: Path, path: Path, runner: ProcessRunner, *, version: str | None) -> ToolReport:
+def _compose_report(root: Path, paths: tuple[Path, ...], runner: ProcessRunner, *, version: str | None) -> ToolReport:
     try:  # ruff: ignore[too-many-statements-in-try-clause] -- one boundary owns static Compose output coverage.
         if version is None:
             message = "Compose static validation requires an explicit manifest [devops].compose_version consumer pin"
             raise NativeToolError(message)
         tool = checked_tool("docker", root=root, runner=runner, expected_version=version)
+        files = tuple(argument for path in paths for argument in ("-f", str(path)))
         output = invoke(
             replace(tool, finding_exits=frozenset()),
-            ("compose", "-f", str(path), "config", "--no-interpolate", "--no-env-resolution", "--format", "json"),
+            (
+                "compose",
+                "--env-file",
+                os.devnull,
+                *files,
+                "config",
+                "--no-interpolate",
+                "--no-env-resolution",
+                "--format",
+                "json",
+            ),
             root=root,
             runner=runner,
         )
@@ -480,9 +532,9 @@ def _compose_report(root: Path, path: Path, runner: ProcessRunner, *, version: s
         if not is_object_mapping(report.get("services")):
             message = "Compose static output must contain a services mapping"
             raise NativeToolError(message)
-        return ToolReport("compose-static", Completion.COMPLETE, version=tool.version, file_count=1)
+        return ToolReport("compose-static", Completion.COMPLETE, version=tool.version, file_count=len(paths))
     except (OSError, ValueError, subprocess.SubprocessError) as error:
-        return _failed("compose-static", error, 1)
+        return _failed("compose-static", error, len(paths))
 
 
 def _diagnostic(