Feature/behavior regression review

.code-polishy.json

@@ -29,6 +29,15 @@
       "paths": ["internal/runner/**"],
       "dependsOn": ["policy"]
     },
+    {
+      "name": "gaterun",
+      "paths": ["internal/gaterun/**"]
+    },
+    {
+      "name": "behaviorreview",
+      "paths": ["internal/behaviorreview/**"],
+      "dependsOn": ["gaterun", "policy", "repository", "runner"]
+    },
     {
       "name": "agents",
       "paths": ["internal/agents/**"]
@@ -85,10 +94,13 @@
         "agents",
         "architecture",
         "artifactsecurity",
+        "behaviorreview",
+        "gaterun",
         "policy",
         "policymodule",
         "portability",
         "quality",
+        "release",
         "repository",
         "runner",
         "supplychain",
@@ -126,6 +138,8 @@
         "policy",
         "repository",
         "runner",
+        "gaterun",
+        "behaviorreview",
         "agents",
         "release",
         "javascript",
@@ -159,113 +173,127 @@
         "kind": "unit",
         "scope": "module",
         "modules": ["policy"],
-        "argv": ["./scripts/test.sh", "./internal/policy/..."]
+        "argv": ["go", "test", "-count=1", "./internal/policy/..."]
       },
       {
         "name": "repository-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["repository"],
-        "argv": ["./scripts/test.sh", "./internal/repository/..."]
+        "argv": ["go", "test", "-count=1", "./internal/repository/..."]
       },
       {
         "name": "runner-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["runner"],
-        "argv": ["./scripts/test.sh", "./internal/runner/..."]
+        "argv": ["go", "test", "-count=1", "./internal/runner/..."]
+      },
+      {
+        "name": "gaterun-unit",
+        "kind": "unit",
+        "scope": "module",
+        "modules": ["gaterun"],
+        "argv": ["go", "test", "-count=1", "./internal/gaterun/..."]
+      },
+      {
+        "name": "behaviorreview-unit",
+        "kind": "unit",
+        "scope": "module",
+        "modules": ["behaviorreview"],
+        "argv": ["go", "test", "-count=1", "./internal/behaviorreview/..."]
       },
       {
         "name": "agents-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["agents"],
-        "argv": ["./scripts/test.sh", "./internal/agents/..."]
+        "argv": ["go", "test", "-count=1", "./internal/agents/..."]
       },
       {
         "name": "release-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["release"],
-        "argv": ["./scripts/test.sh", "./internal/release/..."]
+        "argv": ["go", "test", "-count=1", "./internal/release/..."]
       },
       {
         "name": "javascript-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["javascript"],
-        "argv": ["./scripts/test.sh", "./internal/javascript/..."]
+        "argv": ["go", "test", "-count=1", "./internal/javascript/..."]
       },
       {
         "name": "quality-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["quality"],
-        "argv": ["./scripts/test.sh", "./internal/quality/..."]
+        "argv": ["go", "test", "-count=1", "./internal/quality/..."]
       },
       {
         "name": "architecture-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["architecture"],
-        "argv": ["./scripts/test.sh", "./internal/architecture/..."]
+        "argv": ["go", "test", "-count=1", "./internal/architecture/..."]
       },
       {
         "name": "testing-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["testing"],
-        "argv": ["./scripts/test.sh", "./internal/testing/..."]
+        "argv": ["go", "test", "-count=1", "./internal/testing/..."]
       },
       {
         "name": "supplychain-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["supplychain"],
-        "argv": ["./scripts/test.sh", "./internal/supplychain/..."]
+        "argv": ["go", "test", "-count=1", "./internal/supplychain/..."]
       },
       {
         "name": "artifactsecurity-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["artifactsecurity"],
-        "argv": ["./scripts/test.sh", "./internal/artifactsecurity/..."]
+        "argv": ["go", "test", "-count=1", "./internal/artifactsecurity/..."]
       },
       {
         "name": "policymodule-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["policymodule"],
-        "argv": ["./scripts/test.sh", "./internal/policymodule/..."]
+        "argv": ["go", "test", "-count=1", "./internal/policymodule/..."]
       },
       {
         "name": "portability-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["portability"],
-        "argv": ["./scripts/test.sh", "./internal/portability/..."]
+        "argv": ["go", "test", "-count=1", "./internal/portability/..."]
       },
       {
         "name": "engine-unit",
         "kind": "unit",
         "scope": "module",
         "modules": ["engine"],
-        "argv": ["./scripts/test.sh", "./internal/engine/..."]
+        "argv": ["go", "test", "-count=1", "./internal/engine/..."]
       },
       {
         "name": "cli-contract",
         "kind": "contract",
         "scope": "module",
         "modules": ["cli"],
-        "argv": ["./scripts/test.sh", "./cmd/code-polishy/..."],
+        "argv": ["go", "test", "-count=1", "./cmd/code-polishy/..."],
         "runOn": ["focused", "recommended", "full"]
       },
       {
         "name": "launcher-contract",
         "kind": "contract",
         "scope": "module",
         "modules": ["launcher"],
-        "argv": ["./scripts/test.sh", "./cmd/code-polishy-launcher/..."],
+        "argv": ["go", "test", "-count=1", "./cmd/code-polishy-launcher/..."],
         "runOn": ["focused", "recommended", "full"]
       },
       {
@@ -281,7 +309,7 @@
         "kind": "contract",
         "scope": "repository",
         "cost": "standard",
-        "argv": ["./scripts/test.sh", "./..."],
+        "argv": ["go", "test", "-count=1", "./..."],
         "runOn": ["full"]
       },
       {
@@ -314,6 +342,26 @@
         "runOn": ["supplemental"],
         "timeoutSeconds": 3600
       },
+      {
+        "name": "gaterun-mutation",
+        "kind": "mutation",
+        "scope": "module",
+        "cost": "expensive",
+        "modules": ["gaterun"],
+        "argv": ["./scripts/go-mutation.sh", "./internal/gaterun"],
+        "runOn": ["supplemental"],
+        "timeoutSeconds": 3600
+      },
+      {
+        "name": "behaviorreview-mutation",
+        "kind": "mutation",
+        "scope": "module",
+        "cost": "expensive",
+        "modules": ["behaviorreview"],
+        "argv": ["./scripts/go-mutation.sh", "./internal/behaviorreview"],
+        "runOn": ["supplemental"],
+        "timeoutSeconds": 3600
+      },
       {
         "name": "agents-mutation",
         "kind": "mutation",
@@ -526,19 +574,6 @@
         "owner": "code-polishy-maintainer",
         "reviewed": "2026-08-26",
         "expires": "2026-09-12"
-      },
-      {
-        "id": "js-yaml-4-3-1-fix",
-        "ecosystem": "pnpm",
-        "package": "js-yaml",
-        "version": "4.3.1",
-        "scope": "tools/javascript/pnpm-lock.yaml",
-        "category": "security-fix",
-        "evidence": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj",
-        "reason": "js-yaml 4.3.1 is the first 4.x release fixing GHSA-5p4m-2wfm-xmqj, and every older 4.x release the hard minimum would allow is affected.",
-        "owner": "code-polishy-maintainer",
-        "reviewed": "2026-08-15",
-        "expires": "2026-08-30"
       }
     ]
   },