feat(scripts): ecosystem-wide rule violation scanner + baseline report
Adds scripts/check-rule-violations.sh: a marker-based, repo-agnostic
scanner that audits every repo in repos.txt for violations of the
canonical rules in AI.dev/SKILLS/agent-behavior-guidelines.md plus
common per-repo MUST NOT rules.
Rules currently scanned (7):
- b4-console-log \\ console.log in non-test, non-script TS/JS
- b4-swift-print \\ print() in non-test Swift
- b4-python-print \\ print() in src/tools/backend-python (CLIs excluded)
- ts-any-type \\ any type in non-test TS source
- web-hardcoded-hex \\ #rgb / #rrggbb literals outside design-tokens
- b5-hardcoded-product-id \\ literal product ID strings outside config
- b7-emoji-in-code \\ decorative emojis (faces/food/etc.) in source
Precision filters baked in:
- Cross-product UI in common_plat dashboards exempted from product-id rule
- TS literal type definitions exempted from product-id rule
- JSDoc/docstring comment lines exempted from product-id rule
- scripts/ directories exempted from console.log/print rules (CLIs print)
- CLI entrypoint files (cli.py, __main__.py) exempted from python-print
- Sandbox dirs (__LOCAL_LLMs, chat-history, __experiments) excluded
- Unicode 'Miscellaneous Symbols' block (✓✗⚠★☐) NOT flagged as emoji
(universally used as UI status indicators, not decorative)
Bash 3.2 compatible (no associative arrays). Runs in ~13 seconds across
19 repos.
Output:
- reports/rule-violations-YYYY-MM-DD.md (human-readable, dated, gitignored)
- reports/rule-violations-YYYY-MM-DD.json (machine-readable, dated, gitignored)
- reports/rule-violations-baseline.md (this commit's snapshot, committed)
Baseline (2026-05-23) totals:
Total findings: 2548 across 19 repos
- critical: 13 (real hardcoded product IDs in non-canonical locations)
- major: 1821 (mostly hardcoded hex colors + console.log)
- minor: 714 (any type, decorative emojis)
By rule:
web-hardcoded-hex 1370
b7-emoji-in-code 465
b4-python-print 351
ts-any-type 249
b4-console-log 93
b5-hardcoded-product-id 13
b4-swift-print 7
Repos clean (0 findings):
- learning_ai_smart_auth (docs-only)
- learning_ai_auth_app (small native scaffolding only)
Repos with highest finding counts:
- learning_ai_mac_tooling: 585 (Python backend + React dashboard)
- learning_ai_common_plat: 521 (large shared platform)
- learning_ai_fastgap: 409
- learning_ai_multimodal: 312
Next phase: per-repo triage and fix, processing repos in order of
ascending complexity per the roadmap (see prior planning conversation).
The scanner is the gating tool for that work.
4967b125fd