CI gate commands
These are the deterministic, per-change gates — the spine of Valinor's enforcement. Each is offline, reads your OWN repo from the working directory (path-agnostic), and fails closed (non-zero exit) on any drift, error, or unreadable input. A scaffolded repo's CI runs them on every PR.
Each gate reads its severity dial from governance.config.yml's gates.<id> entry — error blocks, warn reports (CI stays green), off skips. The opt-in gates scaffold at severity: off.
doctrine-check
Verify the given agent-doc carries the portable Valinor Doctrine block — present (anchors), version parseable + current (>= the bundled canonical version), and the block body un-drifted from the canonical doctrine. The consumer-facing wrapper over the same validator as scripts/check-doctrine.mjs.
- Name
path- Type
- string
- Description
The agent-doc to check. Default:
AGENTS.md.
Verify doctrine
npx @cmbrcreative/valinor doctrine-check AGENTS.md
check-agent-file-principles
The deterministic complement of doctrine-check. Where doctrine-check is byte-identity on the propagated block, this inspects the prose outside it and flags any README-owned section header (project / stack / commands / install / usage / license) carried out-of-block — the doctrine's "no README duplication" principle. Reads its severity from gates.agent-file-principles.
- Name
path- Type
- string
- Description
The agent file to validate. Default:
AGENTS.md.
Check agent-file principles
npx @cmbrcreative/valinor check-agent-file-principles AGENTS.md
check-doc-freshness
Scans your repo's docs for deterministic rot: dead internal links, dead tracked-config refs, dead valinor <cmd> / npm run <script> prose refs, and a CLI generate-diff (documented commands vs the enumerable src/cli.ts registry, both directions). The temporal complement to the doc-accuracy Greptile rule. Takes no argument — it scans the working directory.
Check doc freshness
npx @cmbrcreative/valinor check-doc-freshness
check-docs-coverage
The exhaustiveness/accounting axis of your docs corpus: no orphans, no stubs. By default it uses a generic manifest (it never false-flags a doc as an orphan — it only floors near-empty placeholders). Declare your own doc-types under gates.docs-coverage.manifest to enable the stricter govern-or-remove orphan check. Scans the working directory.
Check docs coverage
npx @cmbrcreative/valinor check-docs-coverage
check-dependency-health
The OWASP A06 gate — checks your lockfile is present + valid, npm audit reports no critical/high vulnerabilities, and no dependency carries an unbounded version specifier or a denylisted package. Reads failOn / denylist overrides from governance.config.yml.
Requires audit-report.json to exist first — a CI step must run
npm audit --json > audit-report.json before this gate (the scaffolded workflow
wires that in). A missing report fails closed.
Check dependency health
npm audit --json > audit-report.json
npx @cmbrcreative/valinor check-dependency-health
check-change-narrative
When a PR's src/ diff is substantial (more than ~30 added/removed .ts/.tsx lines), it requires at least one new bullet under your CHANGELOG.md's ## [Unreleased] section. Resolves the base ref from GITHUB_BASE_REF (falling back to origin/main); on a local / non-PR run with no resolvable base it skips.
Check change narrative
npx @cmbrcreative/valinor check-change-narrative
Opt-in gates
These propagate into a consumer's gates workflow but default to severity: off — a capability, not a coercion. Flip the dial in governance.config.yml to enable.
check-research-ledger
Validates your docs/research/ ledger's integrity (well-formed entries, valid status vocab, resolving supersession, index ↔ file consistency). Passes (no-op) when docs/research/ is absent.
npx @cmbrcreative/valinor check-research-ledger
check-plans
Validates your docs/plans/ lifecycle (frontmatter status vocab, completed ⇒ pruned-to-a-pointer, index ↔ file consistency). Passes (no-op) when docs/plans/ is absent.
npx @cmbrcreative/valinor check-plans
check-no-empty-catch
The silent-failure deterministic companion (JS/TS). Scans your src/ + scripts/ for empty catch blocks (an absent root is skipped, not an error). A JS/TS repo flips it to error / warn.
npx @cmbrcreative/valinor check-no-empty-catch