Import boundary now covers the whole first-party tree, not just block/cms:
block/core and block/orchestrator imports are violations too, with an
explicit carve-out for the packages that deliberately stayed core after
the pluginsdk extraction (core/captcha, core/backup — calcomblock uses
captcha today). The .templ import scan gets the same rule.
defaultScanTargetDir: --plugin-dir with no positional target used to
leave targetDir at cwd, so the checker scanned its own repo and
self-reported failures while never scanning the plugin. It now targets
the first plugin root, matching the positional form.
Verified green across cms + all 11 v0.2.1 fleet repos (bidmasters still
fails the version anchor as expected — it pins v0.2.0 on a detached
HEAD, unrelated to these changes).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
extractRBACMethodRoles matched only a map literal named MethodRoles. The CMS now
keeps its RBAC table behind an atomic-pointer copy-on-write live table, with the
static literal renamed to methodRolesSeed -- so the validator read an empty table
and reported 641 phantom "missing RBAC entry" methods, blinding the gate to any
genuine unregistered RPC. Match methodRolesSeed as well as MethodRoles, and add a
regression test (TestExtractRBACMethodRolesParsesSeedTable).
resolveScanRoots: also resolve a `backend` directory containing go.mod whose
parent holds buf.yaml or proto/, so the checker targets that layout correctly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Static safety/lint runner for the BlockNinja codebase. ~25 invariant
checks across Go and frontend sources. Was at git.dev.alexdunmow.com:block/ninja
in backend/cmd/check-safety/ until the 2026-06-06 consolidation moved
the BlockNinja repos under a shared ~/src/blockninja/ parent.
This repo is the standalone extraction:
- Own go.mod (git.dev.alexdunmow.com/block/check-safety, go 1.26.4)
- Vendored internal/{helpers,theme} from CMS (Go's internal/ rule
blocks cross-module imports; vendoring is the workaround)
- CLI contract unchanged: `check-safety <target-dir> [--flags]`
- CMS Makefile shells into ../check-safety for safety-check /
install-safety-checker targets
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
