chore(agileplus): bootstrap .agileplus/specs, .phenotype, scorecard, FUNDING - #522

#!/bin/bash
set -euo pipefail

if test -e AgilePlus/bin/ptrace; then
  echo "Configured CLI path exists"
else
  echo "Configured CLI path is missing: AgilePlus/bin/ptrace"
fi

git ls-files | rg -n '(^|/)(AgilePlus|agileplus)/.*ptrace$' || true

#!/bin/bash
set -euo pipefail

printf '%s\n' 'Configured entry:'
sed -n '1,20p' .phenotype/ai-traceability.yaml

printf '%s\n' 'Matching tracked paths:'
git ls-files | rg -n -i '(^|/)(agileplus|ptrace)(/|$)' || true

printf '%s\n' 'Matching filesystem paths:'
find . -type f \( -path '*/ptrace' -o -iname 'ptrace' \) -print 2>/dev/null || true

#!/bin/bash
set -euo pipefail

for action in \
  actions/checkout@v4 \
  gitleaks/gitleaks-action@v2 \
  github/codeql-action@v3
do
  repository="${action%@*}"
  tag="${action#*@}"
  printf '%s: ' "$action"
  gh api "repos/${repository}/commits/${tag}" --jq '.sha'
done

set -euo pipefail

printf '%s\n' '--- workflow ---'
cat -n .github/workflows/gitleaks.yml

printf '%s\n' '--- action references ---'
rg -n '^[[:space:]]*uses:' .github/workflows/gitleaks.yml

resolve_tag() {
  local repo="$1" tag="$2" ref object_type object_sha
  ref="$(gh api "repos/${repo}/git/ref/tags/${tag}")"
  object_type="$(jq -r '.object.type' <<<"$ref")"
  object_sha="$(jq -r '.object.sha' <<<"$ref")"
  if [[ "$object_type" == "tag" ]]; then
    object_sha="$(gh api "repos/${repo}/git/tags/${object_sha}" --jq '.object.sha')"
  fi
  gh api "repos/${repo}/commits/${object_sha}" --jq '.sha'
}

for spec in \
  'actions/checkout v4' \
  'gitleaks/gitleaks-action v2' \
  'github/codeql-action v3'
do
  read -r repo tag <<<"$spec"
  printf '%s@%s resolves to ' "$repo" "$tag"
  resolve_tag "$repo" "$tag"
done

#!/bin/bash
set -eu
printf '%s\n' '--- relevant files ---'
git ls-files 'CLAUDE.md' 'Cargo.toml' 'crates/sl-daemon/Cargo.toml' 'rust-toolchain.toml'
printf '%s\n' '--- CLAUDE.md lines 1-65 ---'
cat -n CLAUDE.md | sed -n '1,65p'
printf '%s\n' '--- root Cargo workspace ---'
sed -n '1,180p' Cargo.toml
printf '%s\n' '--- daemon Cargo manifest ---'
cat -n crates/sl-daemon/Cargo.toml | sed -n '1,180p'
printf '%s\n' '--- workspace manifests ---'
find . -name Cargo.toml -not -path './target/*' -print | sort

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import tomllib

root = tomllib.loads(Path("Cargo.toml").read_text())
daemon = tomllib.loads(Path("crates/sl-daemon/Cargo.toml").read_text())

root_ws = root.get("workspace", {})
daemon_ws = daemon.get("workspace", {})
print("root workspace members:", root_ws.get("members"))
print("root workspace exclude:", root_ws.get("exclude"))
print("daemon has workspace table:", bool(daemon_ws))
print("daemon package name:", daemon.get("package", {}).get("name"))
print("daemon manifest path exists:", Path("crates/sl-daemon/Cargo.toml").is_file())
PY

printf '%s\n' '--- documented Cargo commands ---'
rg -n -C 3 'cargo (build|test|clippy|fmt)|sl-daemon|manifest-path|workspace' CLAUDE.md

#!/bin/bash
set -eu
printf '%s\n' '--- lockfiles ---'
git ls-files '*Cargo.lock' | sort
printf '%s\n' '--- daemon-related validation references ---'
rg -n -C 2 'sl-daemon|manifest-path.*sl-daemon|cargo (build|test|clippy|fmt)' \
  .github CLAUDE.md README.md llms.txt docs 2>/dev/null || true
printf '%s\n' '--- Cargo availability ---'
command -v cargo || true
cargo --version 2>/dev/null || true
printf '%s\n' '--- root workspace metadata ---'
cargo metadata --no-deps --format-version 1 --manifest-path Cargo.toml 2>/dev/null \
  | python3 -c '
import json, sys
d=json.load(sys.stdin)
print("workspace_root:", d["workspace_root"])
print("workspace_members:", d["workspace_members"])
for p in d["packages"]:
    print("package:", p["name"], "manifest:", p["manifest_path"])
' || true
printf '%s\n' '--- daemon workspace metadata ---'
cargo metadata --no-deps --format-version 1 \
  --manifest-path crates/sl-daemon/Cargo.toml 2>/dev/null \
  | python3 -c '
import json, sys
d=json.load(sys.stdin)
print("workspace_root:", d["workspace_root"])
print("workspace_members:", d["workspace_members"])
for p in d["packages"]:
    print("package:", p["name"], "manifest:", p["manifest_path"])
' || true

#!/bin/bash
set -eu

printf '%s\n' '--- gitleaks.toml ---'
cat -n gitleaks.toml

printf '%s\n' '--- Gitleaks configuration references ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
  'GITLEAKS_CONFIG|gitleaks\.toml|gitleaks' .

printf '%s\n' '--- Repository status ---'
git status --short

#!/bin/bash
set -eu

printf '%s\n' '--- Gitleaks workflow and hook configuration ---'
cat -n .github/workflows/gitleaks.yml
sed -n '75,92p' .pre-commit-config.yaml
sed -n '55,88p' .github/workflows/security.yml
sed -n '175,190p' .github/workflows/ci.yml

printf '%s\n' '--- TOML parser availability and duplicate-key behavior ---'
python3 - <<'PY'
from pathlib import Path
import tomllib

path = Path("gitleaks.toml")
try:
    data = tomllib.loads(path.read_text())
except Exception as exc:
    print(f"{type(exc).__name__}: {exc}")
else:
    print("parsed successfully")
    print(f"top-level keys: {sorted(data)}")
    print(f"allowlist.paths type: {type(data.get('allowlist', {}).get('paths')).__name__}")
PY

#!/bin/bash
set -eu

python3 - <<'PY'
from pathlib import Path

text = Path("gitleaks.toml").read_text().splitlines()
for i, line in enumerate(text, 1):
    if line.strip() == "[allowlist]" or line.strip().startswith("[[allowlist.paths]]"):
        print(f"{i}: {line}")
    if line.strip().startswith("description ="):
        print(f"{i}: {line}")
PY

printf '%s\n' '--- Gitleaks configuration documentation references in repository ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
  'useDefault|extend|default ruleset|custom configuration' \
  gitleaks.toml .github SECURITY.md CONTRIBUTING.md docs audit || true

#!/bin/bash
set -u

printf '%s\n' '--- Available Gitleaks/TOML tools ---'
command -v gitleaks || true
gitleaks version 2>/dev/null || true
command -v ruby || true
command -v go || true
command -v cargo || true

printf '%s\n' '--- Structural TOML checks for gitleaks.toml ---'
python3 - <<'PY'
from pathlib import Path
import re

lines = Path("gitleaks.toml").read_text().splitlines()
current = None
top_tables = []
array_table_paths = []
allowlist_paths_assignment = None
duplicate_keys = []

for number, raw in enumerate(lines, 1):
    line = raw.split("#", 1)[0].strip()
    if not line:
        continue

    if line.startswith("[[") and line.endswith("]]"):
        current = line[2:-2].strip()
        array_table_paths.append((number, current))
        continue
    if line.startswith("[") and line.endswith("]"):
        current = line[1:-1].strip()
        top_tables.append((number, current))
        continue

    match = re.match(r"([A-Za-z0-9_-]+)\s*=", line)
    if not match:
        continue
    key = match.group(1)
    if current == "allowlist" and key == "paths":
        allowlist_paths_assignment = number
    if current == "rules.allowlist" and key == "description":
        duplicate_keys.append(number)

print(f"allowlist.paths array assignment: line {allowlist_paths_assignment}")
print("allowlist.paths array-of-tables declarations:", array_table_paths)
print("duplicate rules.allowlist.description lines:", duplicate_keys)
print("structural conflict:",
      allowlist_paths_assignment is not None and
      any(path == "allowlist.paths" for _, path in array_table_paths))
print("duplicate key present:", len(duplicate_keys) > 1)
PY

#!/bin/bash
set -eu

printf '%s\n' '--- Relevant Gitleaks configuration documentation ---'
curl -L --fail --silent --show-error \
  https://raw.githubusercontent.com/gitleaks/gitleaks/master/README.md |
  rg -n -A12 -B4 'useDefault|--config|custom config|default config' || true

printf '%s\n' '--- Action documentation for GITLEAKS_CONFIG ---'
curl -L --fail --silent --show-error \
  https://raw.githubusercontent.com/gitleaks/gitleaks-action/master/README.md |
  rg -n -A8 -B4 'GITLEAKS_CONFIG|config' || true

#!/bin/bash
set +e

printf '%s\n' '--- Gitleaks config validation ---'
gitleaks dir --config gitleaks.toml --no-banner --exit-code 0 . 2>&1
status=$?
printf 'gitleaks exit status: %s\n' "$status"
exit 0

#!/bin/bash
set -eu

printf '%s\n' '--- tracked scorecard files ---'
git ls-files | rg '(^|/)(user-scorecard\.json|.*scorecard.*|.*rubric.*)$' || true

printf '%s\n' '--- scorecard contents ---'
if [ -f user-scorecard.json ]; then
  cat -n user-scorecard.json
else
  printf '%s\n' 'user-scorecard.json not found'
fi

printf '%s\n' '--- tier and pillar references ---'
rg -n -i 'tier|threshold|pillar|scorecard|0\.\.3|64\.4|total_pillars|max_possible' . \
  -g '!node_modules' -g '!dist' -g '!build' \
  | head -250

#!/bin/bash
set -eu

python3 - <<'PY'
import json
from pathlib import Path

scorecard = json.loads(Path("user-scorecard.json").read_text())
scoring = scorecard["scoring"]
pillars = scorecard["pillar_scores"]

computed_total = sum(item["score"] for item in pillars)
computed_max = sum(item["max_score"] for item in pillars)
computed_percentage = round(100 * computed_total / computed_max, 1)
ids = [item["pillar"] for item in pillars]

print({
    "pillar_count": len(pillars),
    "declared_total_pillars": scoring["total_pillars"],
    "computed_total": computed_total,
    "declared_total_score": scoring["total_score"],
    "computed_max": computed_max,
    "declared_max_possible": scoring["max_possible"],
    "computed_percentage": computed_percentage,
    "declared_percentage": scoring["percentage"],
    "tier": scoring["tier"],
    "pillar_ids": ids,
})

text = Path("user-scorecard.json").read_text().lower()
mapping_terms = ("tier_threshold", "tier_mapping", "grade_threshold", "rubric")
print({
    "mapping_fields_in_user_scorecard": [
        term for term in mapping_terms if term in text
    ]
})
PY

printf '%s\n' '--- relevant audit scorecard header ---'
cat -n audit_scorecard.json | sed -n '1,35p'

#!/bin/bash
set -e
printf '%s\n' '--- candidate files ---'
git ls-files | rg '(^|/)(user-scorecard\.json|README|.*scorecard.*|.*objective.*)$' || true
printf '%s\n' '--- references to pillar count/objective ---'
rg -n -i '32 pillars|30 pillars|user scorecard|total_pillars|max_possible|pillar_scores' . --glob '!node_modules' --glob '!dist' --glob '!build' | head -200
printf '%s\n' '--- scorecard structure ---'
python3 - <<'PY'
import json
from pathlib import Path
p = Path("user-scorecard.json")
print("exists:", p.exists())
if p.exists():
    data = json.loads(p.read_text())
    print("top-level keys:", list(data))
    print("repo_path:", data.get("repo_path"))
    print("scoring:", data.get("scoring"))
    pillars = data.get("pillar_scores")
    print("pillar_scores type:", type(pillars).__name__)
    print("pillar count:", len(pillars) if isinstance(pillars, list) else None)
    if isinstance(pillars, list):
        ids = [x.get("id") for x in pillars if isinstance(x, dict)]
        print("ids:", ids)
        print("unique ids:", len(set(ids)))
        print("missing L0..L29:", [f"L{i}" for i in range(30) if f"L{i}" not in ids])
        scores = [x.get("score") for x in pillars if isinstance(x, dict)]
        print("score sum:", sum(scores) if all(isinstance(x, (int,float)) for x in scores) else scores)
PY

#!/bin/bash
set -e
printf '%s\n' '--- user-scorecard.json ---'
cat -n user-scorecard.json
printf '%s\n' '--- audit_scorecard.json summary and pillar shape ---'
python3 - <<'PY'
import json
for name in ("audit_scorecard.json", "user-scorecard.json"):
    with open(name) as f:
        data = json.load(f)
    print(name)
    print("scoring:", data.get("scoring"))
    pillars = data.get("pillar_scores", [])
    print("pillar count:", len(pillars))
    for i, pillar in enumerate(pillars[:3]):
        print(f"pillar[{i}]:", pillar)
    print()
PY
printf '%s\n' '--- all repository references to L0/L29/L30/L31 and scorecard objectives ---'
rg -n -i '\bL(0|29|30|31)\b|32[ -]?pillars|total_pillars|pillar_scores|scorecard' . --glob '!node_modules' --glob '!dist' --glob '!build'

#!/bin/bash
set -e
printf '%s\n' '--- repository state ---'
git status --short
printf '%s\n' '--- scorecard file history/state relative to origin/main ---'
git diff --stat origin/main -- user-scorecard.json 2>/dev/null || true
git diff -- user-scorecard.json 2>/dev/null | sed -n '1,220p'
printf '%s\n' '--- audit scorecard definition ---'
sed -n '1,75p' audit_scorecard.json
printf '%s\n' '--- independent consistency check ---'
python3 - <<'PY'
import json, re
from pathlib import Path

d = json.loads(Path("user-scorecard.json").read_text())
items = d["pillar_scores"]
sc = d["scoring"]
numbers = [int(re.match(r"L(\d+)_", x["pillar"]).group(1)) for x in items]
scores = [x["score"] for x in items]
max_scores = [x["max_score"] for x in items]
checks = {
    "entries_equal_total_pillars": len(items) == sc["total_pillars"],
    "IDs contiguous L0..L29": numbers == list(range(len(items))),
    "max_possible_matches_entries": sc["max_possible"] == sum(max_scores),
    "total_score_matches_entries": sc["total_score"] == sum(scores),
    "percentage_matches_score": sc["percentage"] == round(100 * sc["total_score"] / sc["max_possible"], 1),
}
for k, v in checks.items():
    print(f"{k}: {v}")
print("entry_count:", len(items), "id_range:", (min(numbers), max(numbers)))
print("sum_scores:", sum(scores), "sum_max_scores:", sum(max_scores))
PY