Code Integrity

Run a deterministic inventory before interpreting findings:

node "$SKILL_DIR/scripts/code-integrity-scan.mjs" <path> --mode all --format text
node "$SKILL_DIR/scripts/code-integrity-scan.mjs" <path> --mode hardcode --format json
node "$SKILL_DIR/scripts/code-integrity-scan.mjs" <path> --mode mocks --format text

Resolve $SKILL_DIR to this skill directory. Keep the audit read-only. Do not install dependencies or execute target-project code.

Workflow

1. Detect repository languages, frontend/backend boundaries, i18n infrastructure, test roots, generated files, and vendor directories.
2. Run the scanner in the requested mode. Add --include-test only when the user asks to inventory legitimate test doubles too.
3. Inspect every candidate in source context. A regex hit is evidence to review, not automatically a defect.
4. Apply $hardcode-detection to hardcode candidates and $mock-data-detection to mock/fake-data candidates.
5. Report only confirmed production-path findings. Keep uncertain candidates in a separate review section.
6. For significant findings, include scope, severity, file:line, rule, evidence, remediation and an implementation owner in the report. Do not create tracker tasks in report-only mode.

Read references/language-routing.md when the repository is not primarily TypeScript/JavaScript or has mixed server/client languages.

Evidence contract

For each finding include:

[severity] [Frontend|Backend|Mobile|Shared] file:line
Rule: <stable rule id>
Evidence: <short source excerpt>
Why production: <entry point/import/build-path evidence>
Root cause: <why a real boundary was replaced or bypassed>
Remediation: <specific production integration or localization change>
Confidence: high|medium|low

Never claim completeness from text matching alone. State scanned roots, excluded roots, languages observed, scanner mode, and limitations.