- resolveScanRoots recognizes the orchestrator layout (backend/go.mod +
frontend/src) so backendDir resolves to backend/ — fixes the go.mod check,
classifies the frontend as a standalone app (not a plugin), and routes tsc
through the plain typecheck. Clears three orchestrator false-positives.
- check 2 (RBAC): only require MethodRoles for proto services a target actually
serves (mounted connect handler). The orchestrator carries but does not serve
the blockninja.v1 surface (714 false 'missing' -> 0). Exclude cli
(definitions-only, vendors a registry client) from check 2.
- Skip buf-generated gen/ output in the placeholder check (real proto enum
COMING_SOON values are not TODO debt).
- Normalize the color allowlist path so theme-card.tsx swatch previews match
regardless of scan root.
- Whitelist the gitignored, tool-regenerated styles/package-lock.json.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Check 2 (RPC methods registered in RBAC interceptor) fired FAIL on core,
flagging all 926 shared procedures as "NOT in MethodRoles". Core is the
shared Go SDK: it carries the canonical proto (blockninja.v1, orchestrator.v1,
helpdesk.v1) but serves nothing and has no interceptor, so there is no
MethodRoles map to match against and every procedure looked missing.
RBAC is genuinely enforced where these procedures are actually served, and
check 2 already validates it there: cms covers blockninja.v1 (green) and
orchestrator covers orchestrator.v1 (0 missing). The abi.v1 protos declare no
services, and helpdesk.v1 is unmounted definitions. So scanning the SDK in
isolation is a not-applicable result, not a finding.
Detect the core SDK target (no serving package prefix, no interceptor.go,
module path == core) and SKIP check 2 for it instead of folding its shared
procedures into the missing-set. Serving backends (cms/orchestrator) and
plugins are untouched — the guard short-circuits the moment a target has a
package prefix or an interceptor.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Reporter is now a collector: checks declare a verdict (OK/Skip/Warn/Fail/
Fatal) plus findings, and a single central render() prints output. Default
output is silent on pass/skip — only FAIL/WARN/ERR checks print, followed by
one tally line, so a clean run is two lines. --verbose restores full per-check
output. All ~30 checks were converted to this API; orphaned guidance/label
helpers (printPerTargetOKLines, per-check *Help blocks, colors_format.go) were
removed.
The any-usage check (2e) now defaults to only the unstaged working-tree diff
(changed lines), via a new per-repo git-diff index in changedlines.go; --all-any
restores the full scan. Not-a-git-repo / no-diff warns on nothing.
Golden fixtures regenerated; integration tests updated to the new format; added
unit tests for the diff index.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Static safety/lint runner for the BlockNinja codebase. ~25 invariant
checks across Go and frontend sources. Was at git.dev.alexdunmow.com:block/ninja
in backend/cmd/check-safety/ until the 2026-06-06 consolidation moved
the BlockNinja repos under a shared ~/src/blockninja/ parent.
This repo is the standalone extraction:
- Own go.mod (git.dev.alexdunmow.com/block/check-safety, go 1.26.4)
- Vendored internal/{helpers,theme} from CMS (Go's internal/ rule
blocks cross-module imports; vendoring is the workaround)
- CLI contract unchanged: `check-safety <target-dir> [--flags]`
- CMS Makefile shells into ../check-safety for safety-check /
install-safety-checker targets
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
