code-standards 8.121.0__tar.gz → 8.122.0__tar.gz

{code_standards-8.121.0 → code_standards-8.122.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.121.0
+Version: 8.122.0
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/
@@ -120,9 +120,11 @@ File discovery, enabled capabilities and native validation each determine covera
 | Conventional Compose filenames and declared `compose_projects` | Pinned native Compose validation of ordered file groups | Environment interpolation/resolution stays disabled; deployment must supply its actual environment inputs |
 | Skaffold and Cloud Deploy YAML | Pinned Skaffold schema; partial Cloud Deploy structure | Generated resources need prepared validation |
 | Helm charts, Kubernetes and CRDs | Prepared Helm lint/render, kubeconform and kube-linter | Receipts must bind the rendered artifacts and local schema closure |
-| Templates, systemd units, service-specific `.conf`/`.cfg` | Text rules for recognized templates and `.conf`/`.cfg`; units are not routed | Render templates and run the service's native validator; no general semantic coverage is claimed |
+| Templates, systemd units, Nginx, Kamailio, Prometheus and Compose configs | Prepared native validation of rendered files with the matching runtime | Declare prepared targets and hash their authored inputs, rendered files and include closure; other service formats need their own application validator |
 
-Release gates use `code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID`. Declare exact `prepared_targets` under `[devops]` with an authored `source` path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 4.3.1 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
+Native prepared targets use `kind` values `systemd`, `nginx`, `kamailio`, `prometheus-config`, `prometheus-rules` or `compose`, plus `native_version`, `manifests` and `artifacts`. `native_version` is the exact first version-output line of the installed validator; Nginx writes it to stderr. Compose instead uses its exact semantic version and requires a hashed `environment_file`; ordered `manifests` run through native `config --quiet` with full interpolation and consistency checks. List executable artifacts under `executables` when unit validation requires them. Render templates first and bind template/variable inputs with `source_inputs`. The gate verifies hashes, stages a private copy and invokes only the service's check mode. Native service validation requires explicit repository trust and the deployment's matching runtime, including any referenced modules or runtime files; it never installs or starts a service. Systemd disables generators and verifies against the staged root. Other validators may resolve absolute runtime paths on the validation host; this is not a filesystem sandbox.
+
+Release gates use `code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID`; add `--trust-repository-code` for native service and Compose targets. Declare exact `prepared_targets` under `[devops]` with an authored `source` path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 4.3.1 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
 
 Prepared YAML rejects duplicate parsed keys and cyclic aliases. Each document must stay below depth 64 and at or below 100,000 expanded nodes, including repeated aliases.
 

{code_standards-8.121.0 → code_standards-8.122.0}/README.md

@@ -80,9 +80,11 @@ File discovery, enabled capabilities and native validation each determine covera
 | Conventional Compose filenames and declared `compose_projects` | Pinned native Compose validation of ordered file groups | Environment interpolation/resolution stays disabled; deployment must supply its actual environment inputs |
 | Skaffold and Cloud Deploy YAML | Pinned Skaffold schema; partial Cloud Deploy structure | Generated resources need prepared validation |
 | Helm charts, Kubernetes and CRDs | Prepared Helm lint/render, kubeconform and kube-linter | Receipts must bind the rendered artifacts and local schema closure |
-| Templates, systemd units, service-specific `.conf`/`.cfg` | Text rules for recognized templates and `.conf`/`.cfg`; units are not routed | Render templates and run the service's native validator; no general semantic coverage is claimed |
+| Templates, systemd units, Nginx, Kamailio, Prometheus and Compose configs | Prepared native validation of rendered files with the matching runtime | Declare prepared targets and hash their authored inputs, rendered files and include closure; other service formats need their own application validator |
 
-Release gates use `code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID`. Declare exact `prepared_targets` under `[devops]` with an authored `source` path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 4.3.1 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
+Native prepared targets use `kind` values `systemd`, `nginx`, `kamailio`, `prometheus-config`, `prometheus-rules` or `compose`, plus `native_version`, `manifests` and `artifacts`. `native_version` is the exact first version-output line of the installed validator; Nginx writes it to stderr. Compose instead uses its exact semantic version and requires a hashed `environment_file`; ordered `manifests` run through native `config --quiet` with full interpolation and consistency checks. List executable artifacts under `executables` when unit validation requires them. Render templates first and bind template/variable inputs with `source_inputs`. The gate verifies hashes, stages a private copy and invokes only the service's check mode. Native service validation requires explicit repository trust and the deployment's matching runtime, including any referenced modules or runtime files; it never installs or starts a service. Systemd disables generators and verifies against the staged root. Other validators may resolve absolute runtime paths on the validation host; this is not a filesystem sandbox.
+
+Release gates use `code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID`; add `--trust-repository-code` for native service and Compose targets. Declare exact `prepared_targets` under `[devops]` with an authored `source` path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 4.3.1 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
 
 Prepared YAML rejects duplicate parsed keys and cyclic aliases. Each document must stay below depth 64 and at or below 100,000 expanded nodes, including repeated aliases.
 

{code_standards-8.121.0 → code_standards-8.122.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.121.0"
+version = "8.122.0"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"

{code_standards-8.121.0 → code_standards-8.122.0}/src/sarj_standards/api.py

@@ -278,7 +278,7 @@ class Standards:
             return _failed_analysis(self.root, "invalid-input", str(exc))
         if prepared_only:
             return _prepared_only_analysis(
-                self.root, adopted, prepared_devops, prepared_targets, paths=paths, rules=rules
+                self.root, adopted, prepared_devops, prepared_targets, paths=paths, rules=rules, trust=normalized_trust
             )
         try:
             selection_policy = _selection_policy(self.root, adopted, normalized_mode)
@@ -309,7 +309,7 @@ class Standards:
                 native = _with_library_policy(self.root, native, active_selected, selection_policy)
             if rule_selection is None and normalized_mode is AnalysisMode.POLICY:
                 native = _with_repository_analysis(self.root, native, staged=staged)
-            prepared = _prepared_reports(self.root, adopted, prepared_devops, prepared_targets)
+            prepared = _prepared_reports(self.root, adopted, prepared_devops, prepared_targets, trust=normalized_trust)
             return (*native.tools, *prepared)
 
         coverage = _selection_coverage(
@@ -624,6 +624,7 @@ def _prepared_only_analysis(
     *,
     paths: Sequence[str] | None,
     rules: Sequence[str | RuleSelector] | None,
+    trust: TrustMode,
 ) -> AnalysisReport:
     if not receipts or paths or rules:
         return _failed_analysis(
@@ -631,16 +632,23 @@ def _prepared_only_analysis(
             "invalid-input",
             "prepared-only analysis requires receipts and cannot include source paths or rule selectors",
         )
-    return report_from_tools(root, _prepared_reports(root, adopted, receipts, targets))
+    return report_from_tools(root, _prepared_reports(root, adopted, receipts, targets, trust=trust))
 
 
 def _prepared_reports(
-    root: Path, adopted: Manifest | None, receipts: Sequence[Path], targets: Sequence[str]
+    root: Path,
+    adopted: Manifest | None,
+    receipts: Sequence[Path],
+    targets: Sequence[str],
+    *,
+    trust: TrustMode = TrustMode.SAFE,
 ) -> tuple[ToolReport, ...]:
     if not receipts and not targets:
         return ()
     declared = adopted.prepared_targets if adopted is not None else ()
-    return analyze_prepared(receipts, root=root, declared=declared, selected=targets)
+    return analyze_prepared(
+        receipts, root=root, declared=declared, selected=targets, trust_repository_code=trust is TrustMode.TRUSTED
+    )
 
 
 def _prepared_coverage(adopted: Manifest | None, receipts: Sequence[Path]) -> tuple[CoverageNotice, ...]:

{code_standards-8.121.0 → code_standards-8.122.0}/src/sarj_standards/cli/main.py

@@ -3078,7 +3078,7 @@ def build_app(handler: Callable[[_Args], int] = _dispatch) -> typer.Typer:
         ] = False,
         trust_repository_code: Annotated[
             bool,
-            typer.Option("--trust-repository-code", help="allow prepared local Terraform provider/plugin validation"),
+            typer.Option("--trust-repository-code", help="allow native validation that may execute repository code"),
         ] = False,
         prepared_devops: Annotated[
             list[Path] | None, typer.Option("--prepared-devops", help="data-only preparation receipt (repeatable)")

code_standards-8.122.0/src/sarj_standards/configs/cli-reference.v1.json

@@ -0,0 +1 @@
+{"commands":[{"commands":[],"name":"commit-message","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"COMMIT_MSG_FILE","names":["message_file"],"repeatable":false,"required":true,"summary":"Git commit-message file supplied by the commit-msg hook"}],"path":["commit-message"],"summary":"enforce [(i/N) ][TICKET] type(scope)!: description with safe mechanical fixes","usage":"code-standards commit-message [-h] COMMIT_MSG_FILE"},{"commands":[],"name":"doctor","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["text","json"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":"output format (default: text)"},{"choices":[],"kind":"option","metavar":null,"names":["--repair"],"repeatable":false,"required":false,"summary":"transactionally repair safe drift with the executing bundle, then re-diagnose"},{"choices":[],"kind":"option","metavar":null,"names":["--no-install"],"repeatable":false,"required":false,"summary":"with --repair, update configuration without installing dependencies or hooks"}],"path":["doctor"],"summary":"diagnose adoption health and optionally repair safe drift","usage":"code-standards doctor [-h] [--format OUTPUT_FORMAT] [--repair] [--no-install]"},{"commands":[],"name":"setup","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["pre-commit","lefthook","none"],"kind":"option","metavar":"HOOKS","names":["--hooks"],"repeatable":false,"required":false,"summary":"hook manager (default: detect Lefthook, otherwise pre-commit)"},{"choices":[],"kind":"option","metavar":"PYTHON_DEST","names":["--python-dest"],"repeatable":false,"required":false,"summary":"the directory that owns pyproject.toml (default: detected)"},{"choices":[],"kind":"option","metavar":"TYPESCRIPT_DEST","names":["--typescript-dest"],"repeatable":false,"required":false,"summary":"the directory that owns the npm lockfile (default: detected); new ESLint entrypoints use TypeScript"},{"choices":[],"kind":"option","metavar":"SWIFT_DEST","names":["--swift-dest"],"repeatable":false,"required":false,"summary":"the directory that owns one reviewed Swift project (default: mobile project detection)"},{"choices":[],"kind":"option","metavar":"KOTLIN_DEST","names":["--kotlin-dest"],"repeatable":false,"required":false,"summary":"the directory that owns one reviewed Android/KMP project (default: detected)"},{"choices":[],"kind":"option","metavar":null,"names":["--dry-run"],"repeatable":false,"required":false,"summary":"print the complete plan without writing"},{"choices":[],"kind":"option","metavar":null,"names":["--force"],"repeatable":false,"required":false,"summary":"replace conflicting generated lint configuration after review"},{"choices":[],"kind":"option","metavar":null,"names":["--no-install"],"repeatable":false,"required":false,"summary":"write wiring without installing dependencies or hooks"},{"choices":[],"kind":"option","metavar":null,"names":["--tools-only"],"repeatable":false,"required":false,"summary":"install and attest pinned native tools for an adopted repository"},{"choices":[],"kind":"option","metavar":null,"names":["--commit-policy-only"],"repeatable":false,"required":false,"summary":"adopt only commit-message and PR-history policy without changing language tooling"},{"choices":["checkov","detekt","eslint","ktlint","markdownlint","mobile-security","pyright","ruff","shellcheck","swiftformat","swiftlint","taplo","yamllint","zizmor"],"kind":"option","metavar":"ONLY","names":["--config"],"repeatable":true,"required":false,"summary":"select one config explicitly (repeatable)"},{"choices":[],"kind":"option","metavar":"ENABLE_REPOSITORY_RULE","names":["--enable-repository-rule"],"repeatable":true,"required":false,"summary":"explicitly enable one reviewed, installed error-stage repository rule (repeatable); preserve existing rules and capped exceptions"}],"path":["setup"],"summary":"adopt or converge the repository in one idempotent operation","usage":"code-standards setup [-h] [--hooks HOOKS] [--python-dest PYTHON_DEST] [--typescript-dest TYPESCRIPT_DEST] [--swift-dest SWIFT_DEST] [--kotlin-dest KOTLIN_DEST] [--dry-run] [--force] [--no-install] [--tools-only] [--commit-policy-only] [--config ONLY ...] [--enable-repository-rule ENABLE_REPOSITORY_RULE ...]"},{"commands":[],"name":"analyze","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--external"],"repeatable":false,"required":false,"summary":"run pinned upstream analyzers"},{"choices":[],"kind":"option","metavar":null,"names":["--prepared-only"],"repeatable":false,"required":false,"summary":"validate prepared artifacts; source analysis stays in the CI source gate"},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow native validation that may execute repository code"},{"choices":[],"kind":"option","metavar":"PREPARED_DEVOPS","names":["--prepared-devops"],"repeatable":true,"required":false,"summary":"data-only preparation receipt (repeatable)"},{"choices":[],"kind":"option","metavar":"PREPARED_TARGET","names":["--prepared-target"],"repeatable":true,"required":false,"summary":"select an exact declared target (repeatable)"},{"choices":["text","json","sarif","github"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected source paths"}],"path":["analyze"],"summary":"emit canonical diagnostics, including prepared DevOps artifacts","usage":"code-standards analyze [-h] [--external] [--prepared-only] [--trust-repository-code] [--prepared-devops PREPARED_DEVOPS ...] [--prepared-target PREPARED_TARGET ...] [--format OUTPUT_FORMAT] [--output OUTPUT] [FILES ...]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow executable repository ESLint configuration (generated hooks and CI set this explicitly)"},{"choices":[],"kind":"option","metavar":"JOBS","names":["--jobs"],"repeatable":false,"required":false,"summary":"overlap native and external analysis (default: 2; 1 for serial debugging)"},{"choices":[],"kind":"option","metavar":null,"names":["--skip-python-type-check"],"repeatable":false,"required":false,"summary":"leave BasedPyright to the repository's own required CI; configs stay managed"},{"choices":[],"kind":"option","metavar":null,"names":["--skip-eslint"],"repeatable":false,"required":false,"summary":"leave ESLint to the repository's own required CI; configs stay managed and React Doctor still runs"},{"choices":[],"kind":"option","metavar":null,"names":["--staged"],"repeatable":false,"required":false,"summary":"run the complete gate on staged files; optional paths narrow the staged selection"},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"check only this custom ENGINE:ID rule (repeatable)"},{"choices":["text","json","sarif","github"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"write JSON or SARIF atomically to PATH"},{"choices":[],"kind":"option","metavar":"MAX_ANNOTATIONS_PER_LEVEL","names":["--max-annotations-per-level"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected paths; when omitted, check the complete repository"}],"path":["check"],"summary":"run the complete quality gate or check selected paths or custom rules","usage":"code-standards check [-h] [--trust-repository-code] [--jobs JOBS] [--skip-python-type-check] [--skip-eslint] [--staged] [--rule SELECTED_RULES ...] [--format OUTPUT_FORMAT] [--output OUTPUT] [--max-annotations-per-level MAX_ANNOTATIONS_PER_LEVEL] [FILES ...]"},{"commands":[],"name":"validate-slack-automations","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"PATH","names":["slack_catalog"],"repeatable":false,"required":true,"summary":""}],"path":["validate-slack-automations"],"summary":"validate a versioned Slack automation catalog","usage":"code-standards validate-slack-automations [-h] PATH"},{"commands":[],"name":"observe","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"canonical ENGINE:ID selector (repeatable)"},{"choices":[],"kind":"option","metavar":null,"names":["--test-value"],"repeatable":false,"required":false,"summary":"report curated test-oracle and redundancy advisories"},{"choices":[],"kind":"option","metavar":"BASE","names":["--base"],"repeatable":false,"required":false,"summary":"observe existing paths changed from this Git base"},{"choices":["text","json","sarif","github"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow repository ESLint configuration to execute"},{"choices":[],"kind":"option","metavar":"MAX_ANNOTATIONS_PER_LEVEL","names":["--max-annotations-per-level"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected paths; defaults to adopted verification paths"}],"path":["observe"],"summary":"report warning-stage findings with exit 0; invalid input or execution still exits 2","usage":"code-standards observe [-h] [--rule SELECTED_RULES ...] [--test-value] [--base BASE] [--format OUTPUT_FORMAT] [--output OUTPUT] [--trust-repository-code] [--max-annotations-per-level MAX_ANNOTATIONS_PER_LEVEL] [FILES ...]"},{"commands":[],"name":"fix","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--staged"],"repeatable":false,"required":false,"summary":"fix only files staged in Git"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"selected paths; when omitted, fix the complete repository"}],"path":["fix"],"summary":"apply safe formatting and lint fixes","usage":"code-standards fix [-h] [--staged] [FILES ...]"},{"commands":[],"name":"update","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"preview without writing; exit 1 when changes exist"},{"choices":[],"kind":"option","metavar":null,"names":["--offline"],"repeatable":false,"required":false,"summary":"reconverge the executing bundle and skip every network-dependent install; does not resolve latest"},{"choices":[],"kind":"option","metavar":"VERSION","names":["--to"],"repeatable":false,"required":false,"summary":"resolve and apply exactly this immutable coherent bundle version"},{"choices":[],"kind":"option","metavar":null,"names":["--no-install"],"repeatable":false,"required":false,"summary":"do not install dependencies or hooks"}],"path":["update"],"summary":"upgrade to the latest published coherent Standards bundle","usage":"code-standards update [-h] [--check] [--offline] [--to VERSION] [--no-install]"},{"commands":[{"commands":[],"name":"init","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"JOBS","names":["--jobs"],"repeatable":false,"required":false,"summary":"overlap independent baseline scans"},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"baseline JSON (default: diagnostic-baseline.json)"},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"run repository-local analyzers that execute project code"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"paths to analyze (default: the whole repository)"}],"path":["baseline","init"],"summary":"record the first diagnostic baseline","usage":"code-standards baseline init [-h] [--jobs JOBS] [--output OUTPUT] [--trust-repository-code] [FILES ...]"},{"commands":[],"name":"update","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"JOBS","names":["--jobs"],"repeatable":false,"required":false,"summary":"overlap independent baseline scans"},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"baseline JSON (default: diagnostic-baseline.json)"},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"run repository-local analyzers that execute project code"},{"choices":[],"kind":"option","metavar":"BASELINE_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"replace debt only for this newly promoted rule (repeatable; source:RULE is also accepted)"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":"paths to analyze (default: the whole repository)"}],"path":["baseline","update"],"summary":"re-record the diagnostic baseline after reviewed cleanup","usage":"code-standards baseline update [-h] [--jobs JOBS] [--output OUTPUT] [--trust-repository-code] [--rule BASELINE_RULES ...] [FILES ...]"}],"name":"baseline","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["baseline"],"summary":"grandfather today's findings so only new ones fail","usage":"code-standards baseline [-h] {init,update}"},{"commands":[{"commands":[],"name":"init","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"}],"path":["ratchet","init"],"summary":"create the first suppression budget","usage":"code-standards ratchet init [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"}],"path":["ratchet","check"],"summary":"fail when suppression debt grows","usage":"code-standards ratchet check [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...]"},{"commands":[],"name":"status","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"}],"path":["ratchet","status"],"summary":"show current suppression debt and available reductions","usage":"code-standards ratchet status [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...]"},{"commands":[],"name":"update","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BASELINE","names":["--baseline"],"repeatable":false,"required":false,"summary":"budget JSON (default: suppression-baseline.json)"},{"choices":[],"kind":"option","metavar":"PACKAGE","names":["--package"],"repeatable":true,"required":false,"summary":"Python package root (repeatable)"},{"choices":[],"kind":"option","metavar":"EXCLUDE_SUBTREE","names":["--exclude-subtree"],"repeatable":true,"required":false,"summary":"generated or vendored subtree to persistently exclude (repeatable)"},{"choices":[],"kind":"option","metavar":null,"names":["--allow-increase"],"repeatable":false,"required":false,"summary":"permit a reviewed increase in suppression debt"}],"path":["ratchet","update"],"summary":"lock in reviewed suppression-budget changes","usage":"code-standards ratchet update [-h] [--baseline BASELINE] [--package PACKAGE ...] [--exclude-subtree EXCLUDE_SUBTREE ...] [--allow-increase]"}],"name":"ratchet","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["ratchet"],"summary":"keep the Python suppression budget from growing","usage":"code-standards ratchet [-h] {init,check,status,update}"},{"commands":[{"commands":[],"name":"list","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["exclude","list"],"summary":"list the complete denylist","usage":"code-standards exclude list [-h]"},{"commands":[],"name":"add","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["path","rule"],"kind":"positional","metavar":"{path,rule}","names":["exclude_kind"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"positional","metavar":"VALUE","names":["value"],"repeatable":false,"required":true,"summary":"repository-relative glob or canonical engine:rule selector"}],"path":["exclude","add"],"summary":"add one exact denylist entry","usage":"code-standards exclude add [-h] {path,rule} VALUE"},{"commands":[],"name":"remove","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["path","rule"],"kind":"positional","metavar":"{path,rule}","names":["exclude_kind"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"positional","metavar":"VALUE","names":["value"],"repeatable":false,"required":true,"summary":"repository-relative glob or canonical engine:rule selector"}],"path":["exclude","remove"],"summary":"remove one exact denylist entry","usage":"code-standards exclude remove [-h] {path,rule} VALUE"}],"name":"exclude","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["exclude"],"summary":"inspect or change explicit path and rule exclusions","usage":"code-standards exclude [-h] {list,add,remove}"},{"commands":[{"commands":[],"name":"state","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","state"],"summary":"print detected adoption state as JSON","usage":"code-standards show state [-h]"},{"commands":[],"name":"configs","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","configs"],"summary":"list bundled configurations","usage":"code-standards show configs [-h]"},{"commands":[],"name":"config","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["checkov","detekt","eslint","ktlint","markdownlint","mobile-security","pyright","ruff","shellcheck","swiftformat","swiftlint","taplo","yamllint","zizmor"],"kind":"positional","metavar":"NAME","names":["name"],"repeatable":false,"required":true,"summary":""}],"path":["show","config"],"summary":"print one bundled configuration path","usage":"code-standards show config [-h] NAME"},{"commands":[],"name":"peers","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","peers"],"summary":"show tested ESLint peer dependencies and install command","usage":"code-standards show peers [-h]"},{"commands":[],"name":"rules","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show","rules"],"summary":"print the machine-readable custom-rule inventory","usage":"code-standards show rules [-h]"},{"commands":[],"name":"ci","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"write a managed workflow inside the repository"}],"path":["show","ci"],"summary":"print a complete versioned GitHub Actions standards workflow","usage":"code-standards show ci [-h] [--output OUTPUT]"}],"name":"show","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["show"],"summary":"print read-only package and adoption information","usage":"code-standards show [-h] {state,configs,config,peers,rules,ci}"},{"commands":[{"commands":[],"name":"setup","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"print the deterministic setup plan without executing it"}],"path":["maintain","setup"],"summary":"install every standards development environment and repository hook","usage":"code-standards maintain setup [-h] [--check]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["ci-history","file-conventions","private-refs","versions"],"kind":"option","metavar":"REPO_ONLY","names":["--only"],"repeatable":true,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"COMMITS","names":["--commits"],"repeatable":false,"required":false,"summary":"also inspect commit messages in this revision range"},{"choices":[],"kind":"option","metavar":"POLICY_DEST","names":["--policy-root"],"repeatable":false,"required":false,"summary":"trusted repository policy root (default: --root)"},{"choices":[],"kind":"option","metavar":"PRIVATE_REFS_FILE","names":["--private-refs-file"],"repeatable":false,"required":false,"summary":"private-reference TOML outside the scanned repository"},{"choices":[],"kind":"option","metavar":null,"names":["--quiet"],"repeatable":false,"required":false,"summary":"hide finding details"}],"path":["maintain","check"],"summary":"run repository policy gates","usage":"code-standards maintain check [-h] [--only REPO_ONLY ...] [--commits COMMITS] [--policy-root POLICY_DEST] [--private-refs-file PRIVATE_REFS_FILE] [--quiet]"},{"commands":[],"name":"sync-ledger","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report drift without writing"}],"path":["maintain","sync-ledger"],"summary":"synchronize the rule compatibility ledger","usage":"code-standards maintain sync-ledger [-h] [--check]"},{"commands":[],"name":"comment-corpus","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"ROOTS","names":["roots"],"repeatable":true,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"PRIVATE_JSONL","names":["--include-text"],"repeatable":false,"required":false,"summary":"write sensitive comment text to a new owner-readable file"}],"path":["maintain","comment-corpus"],"summary":"extract comments for calibration","usage":"code-standards maintain comment-corpus [-h] ROOTS ... [--include-text PRIVATE_JSONL]"},{"commands":[{"commands":[],"name":"check-tag","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"TAG","names":["tag"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","check-tag"],"summary":"require a release tag to match its package manifest","usage":"code-standards maintain release check-tag [-h] TAG"},{"commands":[],"name":"verify-tags","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"RELEASE_COMMIT","names":["--commit"],"repeatable":false,"required":false,"summary":"also require existing tags to match this publishing commit or an unchanged package tree"}],"path":["maintain","release","verify-tags"],"summary":"verify all manifest release tags on origin","usage":"code-standards maintain release verify-tags [-h] [--commit RELEASE_COMMIT]"},{"commands":[],"name":"create-tags","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["contracts","typescript","bootstrap","python","sql","iac","standards","tsconfig"],"kind":"positional","metavar":"RELEASE_TARGETS","names":["release_targets"],"repeatable":true,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"RELEASE_COMMIT","names":["--commit"],"repeatable":false,"required":true,"summary":"exact commit that was published"},{"choices":[],"kind":"option","metavar":"ATTEMPTS","names":["--attempts"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"DELAY_SECONDS","names":["--delay-seconds"],"repeatable":false,"required":false,"summary":""}],"path":["maintain","release","create-tags"],"summary":"create and push manifest release tags","usage":"code-standards maintain release create-tags [-h] RELEASE_TARGETS ... --commit RELEASE_COMMIT [--attempts ATTEMPTS] [--delay-seconds DELAY_SECONDS]"},{"commands":[],"name":"changes","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BEFORE","names":["--before"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"AFTER","names":["--after"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"GITHUB_OUTPUT","names":["--github-output"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","changes"],"summary":"emit package version changes between Git revisions","usage":"code-standards maintain release changes [-h] --before BEFORE --after AFTER --github-output GITHUB_OUTPUT"},{"commands":[],"name":"causality","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BEFORE","names":["--before"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"AFTER","names":["--after"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","causality"],"summary":"require every publishable package change to bump its version","usage":"code-standards maintain release causality [-h] --before BEFORE --after AFTER"},{"commands":[],"name":"lock-age","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"LOCKFILE","names":["lockfile"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"MINIMUM_AGE","names":["--minimum-days"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"RELEASE_EXCLUDE","names":["--exclude"],"repeatable":true,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"RELEASE_EXCLUDE_FILE","names":["--exclude-file"],"repeatable":true,"required":false,"summary":"line-oriented exact package@version exceptions (repeatable)"}],"path":["maintain","release","lock-age"],"summary":"enforce npm lockfile minimum release age","usage":"code-standards maintain release lock-age [-h] LOCKFILE [--minimum-days MINIMUM_AGE] [--exclude RELEASE_EXCLUDE ...] [--exclude-file RELEASE_EXCLUDE_FILE ...]"},{"commands":[],"name":"typescript","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["check","pack","publish"],"kind":"positional","metavar":"RELEASE_MODE","names":["release_mode"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":"artifact directory (required for pack)"}],"path":["maintain","release","typescript"],"summary":"check, pack, or publish the TypeScript package","usage":"code-standards maintain release typescript [-h] RELEASE_MODE [--output OUTPUT]"},{"commands":[],"name":"verify-wheel","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"WHEELS","names":["wheels"],"repeatable":true,"required":true,"summary":""}],"path":["maintain","release","verify-wheel"],"summary":"require non-empty license text in built Python wheels","usage":"code-standards maintain release verify-wheel [-h] WHEELS ..."},{"commands":[],"name":"status","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"RELEASE_COMMIT","names":["--commit"],"repeatable":false,"required":false,"summary":""},{"choices":["json","text"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""}],"path":["maintain","release","status"],"summary":"show release stages and queue time for an exact revision","usage":"code-standards maintain release status [-h] [--commit RELEASE_COMMIT] [--format OUTPUT_FORMAT]"},{"commands":[],"name":"verify-publications","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"ATTEMPTS","names":["--attempts"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"DELAY_SECONDS","names":["--delay-seconds"],"repeatable":false,"required":false,"summary":""}],"path":["maintain","release","verify-publications"],"summary":"wait for every exact sibling publication required by Standards","usage":"code-standards maintain release verify-publications [-h] [--attempts ATTEMPTS] [--delay-seconds DELAY_SECONDS]"},{"commands":[],"name":"publish","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":["contracts","typescript","bootstrap","python","sql","iac","standards","tsconfig"],"kind":"positional","metavar":"RELEASE_TARGET","names":["release_target"],"repeatable":false,"required":true,"summary":""}],"path":["maintain","release","publish"],"summary":"build and publish one package through its native client","usage":"code-standards maintain release publish [-h] RELEASE_TARGET"}],"name":"release","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","release"],"summary":"validate and build publishable release artifacts","usage":"code-standards maintain release [-h] {check-tag,verify-tags,create-tags,changes,causality,lock-age,typescript,verify-wheel,status,verify-publications,publish}"},{"commands":[{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","docs","check"],"summary":"","usage":"code-standards maintain docs check [-h]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","docs","sync"],"summary":"","usage":"code-standards maintain docs sync [-h]"}],"name":"docs","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","docs"],"summary":"check or synchronize source-derived documentation","usage":"code-standards maintain docs [-h] {check,sync}"},{"commands":[{"commands":[],"name":"install","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","hooks","install"],"summary":"install Lefthook","usage":"code-standards maintain hooks install [-h]"}],"name":"hooks","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","hooks"],"summary":"manage the pinned repository hooks","usage":"code-standards maintain hooks [-h] {install}"},{"commands":[{"commands":[],"name":"manifest","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules","manifest"],"summary":"print the shipped rule inventory","usage":"code-standards maintain rules manifest [-h]"},{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules","check"],"summary":"verify the shipped rule inventory matches live registries","usage":"code-standards maintain rules check [-h]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules","sync"],"summary":"update the shipped rule inventory from live registries","usage":"code-standards maintain rules sync [-h]"},{"commands":[],"name":"new","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":["architecture","correctness","maintainability","performance","security","style","testing"],"kind":"option","metavar":"RULE_CATEGORY","names":["--category"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"RULE_SUMMARY","names":["--summary"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":null,"names":["--apply"],"repeatable":false,"required":false,"summary":"create the planned files"}],"path":["maintain","rules","new"],"summary":"plan or create author-owned rule and test skeletons","usage":"code-standards maintain rules new [-h] SELECTOR --category RULE_CATEGORY --summary RULE_SUMMARY [--apply]"},{"commands":[],"name":"stage-warning","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report required staging without writing"}],"path":["maintain","rules","stage-warning"],"summary":"prepare one registered rule for warning-first publication","usage":"code-standards maintain rules stage-warning [-h] SELECTOR [--check]"},{"commands":[],"name":"promote-error","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report required promotion without writing"}],"path":["maintain","rules","promote-error"],"summary":"promote one warning-staged rule to blocking error severity","usage":"code-standards maintain rules promote-error [-h] SELECTOR [--check]"},{"commands":[],"name":"prepare","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"},{"choices":[],"kind":"option","metavar":null,"names":["--check"],"repeatable":false,"required":false,"summary":"report required preparation without writing"}],"path":["maintain","rules","prepare"],"summary":"validate and prepare one registered rule for warning-first publication","usage":"code-standards maintain rules prepare [-h] SELECTOR [--check]"},{"commands":[],"name":"verify","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"SELECTOR","names":["selector"],"repeatable":false,"required":true,"summary":"canonical ENGINE:ID selector"}],"path":["maintain","rules","verify"],"summary":"validate one registered rule's authored files and public examples","usage":"code-standards maintain rules verify [-h] SELECTOR"},{"commands":[],"name":"bench","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":true,"summary":"Python files or directories"},{"choices":[],"kind":"option","metavar":"REPEATS","names":["--repeats"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":false,"summary":"python:ID selector; defaults to all Python rules"}],"path":["maintain","rules","bench"],"summary":"measure native Python analysis with diagnostic and source digests","usage":"code-standards maintain rules bench [-h] FILES ... [--repeats REPEATS] [--rule SELECTED_RULES ...]"},{"commands":[],"name":"changes","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"BEFORE","names":["--before"],"repeatable":false,"required":true,"summary":""},{"choices":[],"kind":"option","metavar":"AFTER","names":["--after"],"repeatable":false,"required":true,"summary":""},{"choices":["json","text"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":["warning"],"kind":"option","metavar":"REQUIRED_ADDED_LEVEL","names":["--require-added-level"],"repeatable":false,"required":false,"summary":"fail when an added rule does not start at this level"}],"path":["maintain","rules","changes"],"summary":"compare rule inventory and policy between two Git revisions","usage":"code-standards maintain rules changes [-h] --before BEFORE --after AFTER [--format OUTPUT_FORMAT] [--require-added-level REQUIRED_ADDED_LEVEL]"},{"commands":[],"name":"evaluate","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"SELECTED_RULES","names":["--rule"],"repeatable":true,"required":true,"summary":"canonical ENGINE:ID selector (repeatable)"},{"choices":[],"kind":"option","metavar":"CORPUS_MANIFEST","names":["--corpus-manifest"],"repeatable":false,"required":false,"summary":"evaluate immutable repositories declared by a public corpus manifest"},{"choices":[],"kind":"option","metavar":"PRIVATE_OVERLAY","names":["--private-overlay"],"repeatable":false,"required":false,"summary":"merge an owner-readable private corpus overlay (requires --corpus-manifest)"},{"choices":["corpus","effective"],"kind":"option","metavar":"EVALUATION_SCOPE","names":["--scope"],"repeatable":false,"required":false,"summary":"corpus ignores baselines/rule exclusions; effective applies adopted repository policy"},{"choices":["json","text"],"kind":"option","metavar":"OUTPUT_FORMAT","names":["--format"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":"OUTPUT","names":["--output"],"repeatable":false,"required":false,"summary":""},{"choices":[],"kind":"option","metavar":null,"names":["--trust-repository-code"],"repeatable":false,"required":false,"summary":"allow executable repository ESLint configuration"},{"choices":[],"kind":"positional","metavar":"FILES","names":["files"],"repeatable":true,"required":false,"summary":""}],"path":["maintain","rules","evaluate"],"summary":"calibrate selected custom rules; findings exit 1 and invalid input or execution exits 2","usage":"code-standards maintain rules evaluate [-h] --rule SELECTED_RULES ... [--corpus-manifest CORPUS_MANIFEST] [--private-overlay PRIVATE_OVERLAY] [--scope EVALUATION_SCOPE] [--format OUTPUT_FORMAT] [--output OUTPUT] [--trust-repository-code] [FILES ...]"}],"name":"rules","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","rules"],"summary":"inspect live custom rules","usage":"code-standards maintain rules [-h] {manifest,check,sync,new,stage-warning,promote-error,prepare,verify,bench,changes,evaluate}"},{"commands":[{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":null,"names":["--typescript-built"],"repeatable":false,"required":false,"summary":"reuse the TypeScript build completed by this verification run"}],"path":["maintain","catalog","check"],"summary":"verify the public catalog matches every live rule","usage":"code-standards maintain catalog check [-h] [--typescript-built]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","catalog","sync"],"summary":"update the public catalog from source-owned rule metadata","usage":"code-standards maintain catalog sync [-h]"}],"name":"catalog","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","catalog"],"summary":"maintain the source-derived public rule catalog","usage":"code-standards maintain catalog [-h] {check,sync}"},{"commands":[{"commands":[],"name":"check","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","cli-reference","check"],"summary":"verify the shipped reference matches the parser graph","usage":"code-standards maintain cli-reference check [-h]"},{"commands":[],"name":"sync","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","cli-reference","sync"],"summary":"update the shipped reference from the parser graph","usage":"code-standards maintain cli-reference sync [-h]"}],"name":"cli-reference","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain","cli-reference"],"summary":"maintain the source-derived CLI reference","usage":"code-standards maintain cli-reference [-h] {check,sync}"}],"name":"maintain","options":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."}],"path":["maintain"],"summary":"repository policy, hooks, rule ledgers, and releases","usage":"code-standards maintain [-h] {setup,check,sync-ledger,comment-corpus,release,docs,hooks,rules,catalog,cli-reference}"}],"epilog":"Start with `code-standards setup`, then use `code-standards check`.","globalOptions":[{"choices":[],"kind":"option","metavar":null,"names":["-h","--help"],"repeatable":false,"required":false,"summary":"Show this message and exit."},{"choices":[],"kind":"option","metavar":"DEST","names":["--root"],"repeatable":false,"required":false,"summary":"repository root shared by the selected command (default: current directory)"},{"choices":[],"kind":"option","metavar":null,"names":["--version"],"repeatable":false,"required":false,"summary":""}],"launcher":{"install":"uv tool install --python 3.15.0 code-standards","runLatest":"uvx --no-config --isolated --python 3.15.0 --from code-standards code-standards"},"program":"code-standards","schemaVersion":1,"summary":"Adopt, check, fix, diagnose, and update sarj-ai standards (v8.122.0).","version":"8.122.0"}

{code_standards-8.121.0 → code_standards-8.122.0}/src/sarj_standards/libs/linting/devops_tools.py

@@ -29,6 +29,7 @@ class NativeTool:
     finding_exits: frozenset[int] = frozenset({1})
     executable: Path | None = None
     standalone_compose: bool = False
+    version_stderr: bool = False
 
 
 TOOLS: Final = MappingProxyType(
@@ -101,12 +102,20 @@ def checked_tool(
             message = "Only Compose accepts a consumer-specific exact semantic version"
             raise NativeToolError(message)
         tool = replace(tool, version=expected_version)
+    return _installed_tool(tool, root=root, runner=runner, managed=True)
+
+
+def checked_runtime_tool(tool: NativeTool, *, root: Path, runner: ProcessRunner = run_process) -> NativeTool:
+    return _installed_tool(tool, root=root, runner=runner, managed=False)
+
+
+def _installed_tool(tool: NativeTool, *, root: Path, runner: ProcessRunner, managed: bool) -> NativeTool:
     # Injected runners implement the native-tool protocol directly. Production
     # resolves an immutable absolute executable before attesting its version.
     if runner is not run_process:
         return _attest(tool, root=root, runner=runner)
-    adjacent = shutil.which(name, path=str(Path(sys.executable).parent))
-    candidates = dict.fromkeys((adjacent, shutil.which(name)))
+    adjacent = shutil.which(tool.name, path=str(Path(sys.executable).parent))
+    candidates = dict.fromkeys((adjacent, shutil.which(tool.name)))
     first_error: OSError | NativeToolError | None = None
     for candidate in candidates:
         if candidate is None:
@@ -117,6 +126,11 @@ def checked_tool(
         except (OSError, NativeToolError) as error:
             if first_error is None:
                 first_error = error
+    if not managed:
+        if first_error is not None:
+            raise first_error
+        message = f"{tool.name} is missing; run prepared validation in its matching installed runtime"
+        raise NativeToolMissingError(message)
     try:
         installed = _mise_tool(tool, root=root, runner=runner)
     except NativeToolMissingError:
@@ -128,7 +142,7 @@ def checked_tool(
 
 def _attest(tool: NativeTool, *, root: Path, runner: ProcessRunner) -> NativeTool:
     output = _version_output(_argv(tool, tool.version_args), root=root, runner=runner)
-    actual = _version(tool, output.stdout)
+    actual = _version(tool, output.stderr if tool.version_stderr else output.stdout)
     if output.returncode or actual != tool.version:
         msg = f"{tool.name} {actual} is installed; exact version {tool.version} is required"
         raise NativeToolError(msg)

{code_standards-8.121.0 → code_standards-8.122.0}/src/sarj_standards/libs/linting/prepared_devops.py

@@ -48,7 +48,7 @@ if TYPE_CHECKING:
 
 
 _MAX_RECEIPT_BYTES = 2 * 1024 * 1024
-_MAX_MANIFEST_BYTES = 2 * 1024 * 1024
+MAX_MANIFEST_BYTES = 2 * 1024 * 1024
 _SHA256_LENGTH = 64
 _HELM_RELEASE_LENGTH = 53
 _TARGET_FIELDS = frozenset(
@@ -73,6 +73,9 @@ _TARGET_FIELDS = frozenset(
         "schema_bindings",
         "artifacts",
         "exceptions",
+        "native_version",
+        "executables",
+        "environment_file",
     }
 )
 
@@ -116,7 +119,7 @@ def contained_file(directory: Path, name: str) -> Path:
     return cursor
 
 
-def _verify_hash(path: Path, digest: str) -> None:
+def verify_artifact_hash(path: Path, digest: str) -> None:
     if len(digest) == _SHA256_LENGTH:
         with path.open("rb") as stream:
             if digest == file_digest(stream, sha256).hexdigest():
@@ -132,9 +135,17 @@ def analyze_prepared(
     declared: Sequence[PreparedTarget],
     selected: Sequence[str] = (),
     runner: ProcessRunner = run_process,
+    trust_repository_code: bool = False,
 ) -> tuple[ToolReport, ...]:
     try:
-        return _analyze_receipts(receipts, root=root, declared=declared, selected=selected, runner=runner)
+        return _analyze_receipts(
+            receipts,
+            root=root,
+            declared=declared,
+            selected=selected,
+            runner=runner,
+            trust_repository_code=trust_repository_code,
+        )
     except (OSError, TypeError, ValueError, yaml.YAMLError, subprocess.SubprocessError, RecursionError) as exc:
         return (
             ToolReport(
@@ -152,6 +163,7 @@ def _analyze_receipts(
     declared: Sequence[PreparedTarget],
     selected: Sequence[str],
     runner: ProcessRunner,
+    trust_repository_code: bool,
 ) -> tuple[ToolReport, ...]:
     wanted = set(selected) if selected else {target.id for target in declared}
     if not wanted:
@@ -171,7 +183,10 @@ def _analyze_receipts(
     if missing := wanted - targets.keys():
         msg = f"missing prepared targets: {', '.join(sorted(missing))}"
         raise ValueError(msg)
-    return tuple(_analyze_target(*targets[identifier], root=root, runner=runner) for identifier in sorted(wanted))
+    return tuple(
+        _analyze_target(*targets[identifier], root=root, runner=runner, trust_repository_code=trust_repository_code)
+        for identifier in sorted(wanted)
+    )
 
 
 def _receipt(path: Path, root: Path, declared: Sequence[PreparedTarget]) -> dict[str, dict[str, object]]:
@@ -198,14 +213,14 @@ def _receipt(path: Path, root: Path, declared: Sequence[PreparedTarget]) -> dict
         if identifier in result or allowed.get(identifier) != source:
             msg = f"prepared target is duplicated, undeclared, or bound to the wrong source: {identifier}"
             raise ValueError(msg)
-        _verify_hash(contained_file(root, source), _text(target, "source_sha256"))
+        verify_artifact_hash(contained_file(root, source), _text(target, "source_sha256"))
         if "source_inputs" in target:
             inputs = _table(target["source_inputs"], "prepared authored input hashes")
             if inputs.get(source) != target.get("source_sha256"):
                 msg = "prepared authored inputs must include the declared source hash"
                 raise ValueError(msg)
             for name in inputs:
-                _verify_hash(contained_file(root, name), _text(inputs, name))
+                verify_artifact_hash(contained_file(root, name), _text(inputs, name))
         _verify_artifacts(path.parent, target)
         result[identifier] = target
     return result
@@ -214,16 +229,20 @@ def _receipt(path: Path, root: Path, declared: Sequence[PreparedTarget]) -> dict
 def _verify_artifacts(directory: Path, target: Mapping[str, object]) -> None:
     artifacts = _table(target.get("artifacts"), "prepared artifact hashes")
     required = (*_strings(target.get("values", []), "values"), *_strings(target.get("manifests", []), "manifests"))
-    bindings = _table(target.get("schema_bindings"), "prepared schema bindings")
+    if "environment_file" in target:
+        required = (*required, _text(target, "environment_file"))
+    bindings = _table(target.get("schema_bindings", {}), "prepared schema bindings")
     for name in (*required, *bindings.values()):
         if not isinstance(name, str) or name not in artifacts:
             msg = f"prepared artifact lacks its content hash: {name}"
             raise ValueError(msg)
     for name in artifacts:
-        _verify_hash(contained_file(directory, name), _text(artifacts, name))
+        verify_artifact_hash(contained_file(directory, name), _text(artifacts, name))
 
 
-def _analyze_target(directory: Path, target: Mapping[str, object], *, root: Path, runner: ProcessRunner) -> ToolReport:
+def _analyze_target(
+    directory: Path, target: Mapping[str, object], *, root: Path, runner: ProcessRunner, trust_repository_code: bool
+) -> ToolReport:
     identifier = _text(target, "id")
     source = _text(target, "source")
     try:
@@ -233,7 +252,9 @@ def _analyze_target(directory: Path, target: Mapping[str, object], *, root: Path
                 item,
                 fingerprint=sha256(f"{input_hash}:{item.source}:{item.rule_id}:{item.message}".encode()).hexdigest(),
             )
-            for item in _target_diagnostics(directory, target, root=root, runner=runner)
+            for item in _target_diagnostics(
+                directory, target, root=root, runner=runner, trust_repository_code=trust_repository_code
+            )
         )
         return ToolReport(f"prepared-devops:{identifier}", Completion.COMPLETE, diagnostics=diagnostics, file_count=1)
     except (OSError, TypeError, ValueError, yaml.YAMLError, subprocess.SubprocessError, RecursionError) as exc:
@@ -245,12 +266,13 @@ def _analyze_target(directory: Path, target: Mapping[str, object], *, root: Path
 
 
 def _target_diagnostics(
-    directory: Path, target: Mapping[str, object], *, root: Path, runner: ProcessRunner
+    directory: Path, target: Mapping[str, object], *, root: Path, runner: ProcessRunner, trust_repository_code: bool
 ) -> tuple[Diagnostic, ...]:
     kind = _text(target, "kind")
     if kind not in {"helm", "kubernetes", "cloud-run"}:
-        msg = f"prepared target kind requires an explicit schema adapter: {kind}"
-        raise ValueError(msg)
+        from .prepared_native import validate_native  # ruff: ignore[import-outside-top-level] -- native service adapters reuse the receipt's verified artifact boundary.
+
+        return validate_native(directory, target, root=root, runner=runner, trust_repository_code=trust_repository_code)
     with tempfile.TemporaryDirectory(prefix="sarj-devops-") as temporary:
         manifests = (
             _render_helm(directory, target, root=root, runner=runner)
@@ -265,7 +287,7 @@ def _target_diagnostics(
 
 
 def _validate_cloudrun(manifests: str, target: Mapping[str, object], *, directory: Path) -> tuple[Diagnostic, ...]:
-    if len(manifests.encode()) > _MAX_MANIFEST_BYTES:
+    if len(manifests.encode()) > MAX_MANIFEST_BYTES:
         msg = "Cloud Run manifests exceed 2 MiB"
         raise ValueError(msg)
     objects = [item for item in parse_yaml_documents(manifests) if item is not None]
@@ -311,7 +333,7 @@ def _render_helm(directory: Path, target: Mapping[str, object], *, root: Path, r
         msg = "prepared Helm version differs from checked tool"
         raise ValueError(msg)
     archive = contained_file(directory, _text(target, "archive"))
-    _verify_hash(archive, _text(target, "archive_sha256"))
+    verify_artifact_hash(archive, _text(target, "archive_sha256"))
     validate_chart_schemas(archive)
     values = _strings(target.get("values", []), "values")
     args: list[str] = []
@@ -389,7 +411,7 @@ def _render_helm(directory: Path, target: Mapping[str, object], *, root: Path, r
 def _validate_manifests(
     manifests: str, target: Mapping[str, object], *, directory: Path, work: Path, root: Path, runner: ProcessRunner
 ) -> tuple[Diagnostic, ...]:
-    if len(manifests.encode()) > _MAX_MANIFEST_BYTES:
+    if len(manifests.encode()) > MAX_MANIFEST_BYTES:
         msg = "prepared manifest exceeds the bounded 2 MiB validation input"
         raise ValueError(msg)
     objects = _resources(manifests, namespace=_target_namespace(target))
@@ -554,7 +576,7 @@ def _closed_schema(
     if key in visited:
         return
     visited.add(key)
-    if path.stat().st_size > _MAX_MANIFEST_BYTES:
+    if path.stat().st_size > MAX_MANIFEST_BYTES:
         msg = "local schema exceeds 2 MiB"
         raise ValueError(msg)
     data = parse_unique_json(path.read_text(encoding="utf-8"))
@@ -573,5 +595,5 @@ def _closed_schema(
         artifact = posixpath.normpath((path.parent / name).relative_to(directory).as_posix())
         hashes = _table(target.get("artifacts"), "artifact hashes")
         child = contained_file(directory, artifact)
-        _verify_hash(child, _text(hashes, artifact))
+        verify_artifact_hash(child, _text(hashes, artifact))
         _closed_schema(child, directory, target, visited, reference.partition("#")[2])