(running checks in FIXTURE_DIR)

=== Check 1: Secret env var reads outside config.Load() ===
  OK: No secret env var reads outside config.Load()

=== Check 2: RPC methods registered in RBAC interceptor ===
  SKIP: no proto-backed RPC procedures found in scanned target(s)

=== Check 2b: Plugin proto ownership ===
  OK: Plugin proto ownership is clean

=== Check 2c: Standalone plugin SDK import boundaries ===
  OK: FIXTURE_DIR/go.mod does not locally replace git.dev.alexdunmow.com/block/core

=== Check 2d: sqlc UUID overrides in plugins and cmd ===
  SKIP: no plugin or cmd sqlc configs found

=== Check 2e: Warn on any usage in Go and TypeScript ===
  OK: No any usage found in scanned Go or TypeScript sources

=== Check 2f: sqlc compile and buf generate ===
  SKIP: no sqlc or buf codegen targets found

=== Check 3: Go code compiles and passes go fix, golangci-lint --fix, go vet, and strict lint ===
  OK: Go lint pipeline clean for 1 module(s)
    - .

=== Check 3b: Orchestrator backend tests ===
  SKIP: orchestrator backend not found or not part of this scan

=== Check 4: Frontend auto-format, lint, and typecheck ===
  SKIP: no frontend sources found

=== Check 5: Frontend uses generated ConnectRPC hooks ===
  SKIP: no frontend sources found

=== Check 6: No hardcoded colors in frontend (use theme tokens) ===
  OK: No hardcoded colors in .templ files

=== Check 7: No useState for tab state in routes (use URL ?tab= params) ===
  SKIP: no frontend sources found

=== Check 8: Import @block-ninja/api from subpaths only ===
  SKIP: no frontend sources found

=== Check 9: No npm/yarn lockfiles (pnpm only) ===
  OK: Only pnpm lockfiles present

=== Check 10: Button automation attributes ===
  SKIP: no frontend sources found

=== Check 10b: No eslint-disable-next-line comments ===
  SKIP: no frontend sources found

=== Check 11: No placeholder code; only shipped features ===
  OK: No placeholder code found

=== Check 12: No reinvented utilities (use helpers) ===
  OK: No reinvented utilities detected

=== Check 13: RPC query/mutation error handling ===
  SKIP: no frontend sources found

=== Check 14: No raw SQL outside sqlc/Bob ===
  OK: No raw SQL outside sqlc/Bob

=== Check 15: No err.Error() leaked to HTTP clients ===
  OK: No err.Error() leaked to HTTP clients

=== Check 16: Services and handlers in correct directories ===
  OK: All services and handlers in correct directories

=== Check 17: No TODO markers in production code ===
  OK: No TODO markers found in production code

=== Check 18: Plugin segmentation (safety-rules.yml) ===
  OK: No plugins define safety-rules.yml segmentation rules

=== Check 19: Bearer token precedence over cookies in auth middleware ===
  OK: Bearer token takes precedence over cookies in all auth extraction

=== Check 20: Tailwind v4 configuration (PostCSS, CSS directives, @config) ===
  SKIP: no frontend sources found

=== Check 21: Plugin presets.json validation ===
  OK: No presets.json files found in scanned targets

=== Check 22: No hand-rolled HTML sanitization (use bluemonday) ===
  OK: No hand-rolled HTML sanitization detected