Engineering Standards

# N. <Decision, as a short noun phrase>

Date: YYYY-MM-DD
Deciders: <names or teams>

## Status

Proposed | Accepted | Rejected | Deprecated | Superseded by [ADR n](…)

## Context

The forces at play, as neutral facts: requirements, constraints, numbers,
what exists today, what's changed. Link the issue, incident or design doc.

## Options considered (optional)

1. <Option> — pros / cons
2. <Option> — pros / cons

## Decision

We will … (active voice, specific enough to implement and review).

## Consequences

What becomes easier, what becomes harder, new risks and costs, follow-up
work, and what would make us revisit this decision.

// A CI check for docs/adr/: every record has Nygard's sections and a known status, numbers are
// sequential and never reused, and "superseded" records point at a record that exists.
// It writes four sample ADRs to a temporary folder and checks them like a real repository would.
import { mkdtempSync, mkdirSync, writeFileSync, readdirSync, readFileSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

const root = mkdtempSync(join(tmpdir(), "adr-"));
const adrDir = join(root, "docs/adr");
mkdirSync(adrDir, { recursive: true });
const adr = (file, title, status, extra = "") =>
  writeFileSync(join(adrDir, file), `# ${title}\n\n## Status\n\n${status}\n\n## Context\n\n…\n\n## Decision\n\n…\n${extra}`);
adr("0001-record-architecture-decisions.md", "1. Record architecture decisions", "Accepted", "\n## Consequences\n\n…\n");
adr("0002-poll-device-status.md", "2. Poll device status every 30 s", "Superseded by [ADR 4](0004-push-device-status-over-sse.md)", "\n## Consequences\n\n…\n");
adr("0003-use-openapi-first.md", "3. Write the OpenAPI document before the code", "Accepted"); // forgot Consequences
adr("0004-push-device-status-over-sse.md", "4. Push device status over server-sent events", "Proposed", "\n## Consequences\n\n…\n");
adr("0006-feature-flags.md", "6. Use feature flags for unfinished work", "Acepted", "\n## Consequences\n\n…\n"); // typo, and 5 is missing

const STATUSES = /^(Proposed|Accepted|Rejected|Deprecated|Superseded by \[ADR (\d+)\]\(.+\))$/;
const REQUIRED = ["Status", "Context", "Decision", "Consequences"];
const problems = [];
try {
  const files = readdirSync(adrDir).filter((f) => /^\d{4}-[a-z0-9-]+\.md$/.test(f)).sort();
  const records = files.map((file) => {
    const text = readFileSync(join(adrDir, file), "utf8");
    const status = (text.match(/## Status\n\n(.+)\n/) || [])[1] ?? "";
    return { file, number: Number(file.slice(0, 4)), text, status, title: text.split("\n")[0].replace(/^# \d+\. /, "") };
  });
  const byNumber = new Map(records.map((r) => [r.number, r]));
  records.forEach((r, i) => {
    if (r.number !== i + 1) problems.push(`${r.file}: expected number ${i + 1} (numbers are sequential, never reused)`);
    const sections = [...r.text.matchAll(/^## (.+)$/gm)].map((m) => m[1]);
    for (const s of REQUIRED) if (!sections.includes(s)) problems.push(`${r.file}: missing "## ${s}"`);
    const m = r.status.match(STATUSES);
    if (!m) problems.push(`${r.file}: unknown status "${r.status}"`);
    else if (m[2]) {
      const next = byNumber.get(Number(m[2]));
      if (!next) problems.push(`${r.file}: superseded by ADR ${m[2]}, which doesn't exist`);
      else if (next.status !== "Accepted") problems.push(`${r.file}: superseded by ADR ${m[2]}, which is still "${next.status}"`);
    }
  });
  console.log("| ADR | Title | Status |\n|---|---|---|");
  for (const r of records) console.log(`| ${r.file.slice(0, 4)} | ${r.title} | ${r.status.replace(/\]\(.+\)/, "]")} |`);
  // A real CI step would end with process.exit(problems.length ? 1 : 0); this model only prints.
  console.log(problems.length ? `\n${problems.length} problems:\n- ${problems.join("\n- ")}` : "\nAll ADRs OK");
} finally {
  rmSync(root, { recursive: true, force: true });
}

| ADR | Title | Status |
|---|---|---|
| 0001 | Record architecture decisions | Accepted |
| 0002 | Poll device status every 30 s | Superseded by [ADR 4] |
| 0003 | Write the OpenAPI document before the code | Accepted |
| 0004 | Push device status over server-sent events | Proposed |
| 0006 | Use feature flags for unfinished work | Acepted |

4 problems:
- 0002-poll-device-status.md: superseded by ADR 4, which is still "Proposed"
- 0003-use-openapi-first.md: missing "## Consequences"
- 0006-feature-flags.md: expected number 5 (numbers are sequential, never reused)
- 0006-feature-flags.md: unknown status "Acepted"

// A definition-of-done gate: automated checks come from the CI summary, human items from the
// pull request's checklist. A PR is mergeable only when both are complete.
const gates = [
  ["build", (ci) => ci.build === "pass", () => "build failed"],
  ["unit + integration tests", (ci) => ci.failedTests === 0, (ci) => `${ci.failedTests} failing tests`],
  ["lint (0 errors)", (ci) => ci.lintErrors === 0, (ci) => `${ci.lintErrors} lint errors`],
  ["coverage of changed lines >= 80%", (ci) => ci.changedLineCoverage >= 80, (ci) => `changed-line coverage ${ci.changedLineCoverage}%`],
  ["no new high/critical vulnerabilities", (ci) => ci.newHighVulns === 0, (ci) => `${ci.newHighVulns} new high/critical vulnerabilities`],
  ["bundle within budget (+5%)", (ci) => ci.bundleKb <= ci.budgetKb * 1.05, (ci) => `bundle ${ci.bundleKb} KB > ${ci.budgetKb * 1.05} KB`],
  ["API change => OpenAPI updated", (ci) => !ci.touchesApi || ci.touchesOpenApi, () => "src/api changed but openapi.yaml did not"],
];
const humanItems = ["Acceptance criteria demoed to the PO", "Docs/runbook updated", "Reviewed by a code owner"];

function evaluate(pr) {
  const failures = gates.filter(([, ok]) => !ok(pr.ci)).map(([, , why]) => why(pr.ci));
  const ticked = new Set([...pr.body.matchAll(/^- \[x\] (.+)$/gim)].map((m) => m[1].trim()));
  const unticked = humanItems.filter((item) => !ticked.has(item));
  return { failures, unticked, done: failures.length === 0 && unticked.length === 0 };
}

const allTicked = humanItems.map((i) => `- [x] ${i}`).join("\n");
const prs = [
  { id: 101, ci: { build: "pass", failedTests: 0, lintErrors: 0, changedLineCoverage: 91, newHighVulns: 0, bundleKb: 208, budgetKb: 200, touchesApi: true, touchesOpenApi: true }, body: allTicked },
  { id: 102, ci: { build: "pass", failedTests: 0, lintErrors: 0, changedLineCoverage: 64, newHighVulns: 0, bundleKb: 190, budgetKb: 200, touchesApi: true, touchesOpenApi: false }, body: allTicked },
  { id: 103, ci: { build: "pass", failedTests: 2, lintErrors: 0, changedLineCoverage: 88, newHighVulns: 1, bundleKb: 240, budgetKb: 200, touchesApi: false, touchesOpenApi: false },
    body: "- [x] Acceptance criteria demoed to the PO\n- [ ] Docs/runbook updated\n- [x] Reviewed by a code owner" },
];

for (const pr of prs) {
  const { failures, unticked, done } = evaluate(pr);
  console.log(`PR #${pr.id}: ${done ? "DONE - can merge" : "NOT DONE"}`);
  for (const f of failures) console.log(`  gate:  ${f}`);
  for (const u of unticked) console.log(`  human: "${u}" not ticked`);
}

PR #101: DONE - can merge
PR #102: NOT DONE
  gate:  changed-line coverage 64%
  gate:  src/api changed but openapi.yaml did not
PR #103: NOT DONE
  gate:  2 failing tests
  gate:  1 new high/critical vulnerabilities
  gate:  bundle 240 KB > 210 KB
  human: "Docs/runbook updated" not ticked

## What and why
<!-- One or two sentences. Link the ticket: DEV-1234 -->

## How to test
<!-- Steps a reviewer can follow, or "covered by tests in …" -->

## Screenshots / recordings
<!-- UI changes: before and after. Device-facing: which device/firmware -->

## Definition of done
- [ ] Acceptance criteria demoed to the PO
- [ ] Docs/runbook updated
- [ ] Reviewed by a code owner
- [ ] Feature flag noted (name, default, removal ticket) or N/A

extends:
  - recommended
rules:
  operation-operationId: error
  operation-4xx-response: error
  operation-tag-defined: error
  no-server-example.com: off # our docs use example.com on purpose

validating bad.yaml...
bad.yaml:
  46:5   error    operation-operationId   Operation object should contain `operationId` field.
  47:14  error    operation-tag-defined   Operation tags should be defined in global tags.
  46:5   error    operation-summary       Operation object should contain `summary` field.
  48:7   error    operation-4xx-response  Operation must have at least one `4XX` response.

bad.yaml: validated in 20ms

❌ Validation failed with 4 errors.
run `redocly lint --generate-ignore-file` to add all problems to the ignore file.

// A team API style guide written as code: a few rules checked against an OpenAPI 3.1 document,
// reported the way linters such as Spectral or Redocly report them (path, severity, message).
const spec = {
  openapi: "3.1.0",
  info: { title: "Device API", version: "1.4.0" },
  paths: {
    "/v1/devices": {
      get: { operationId: "listDevices", summary: "List devices", tags: ["devices"],
        parameters: [{ name: "limit", in: "query" }, { name: "cursor", in: "query" }],
        responses: { 200: {}, 400: { content: { "application/problem+json": {} } } } },
    },
    "/v1/devices/{deviceId}/reboot": {
      post: { operationId: "rebootDevice", summary: "Reboot a device", tags: ["devices"],
        responses: { 202: {}, 404: { content: { "application/problem+json": {} } } } },
    },
    "/v1/calls": {
      get: { operationId: "listCalls", summary: "List calls", tags: ["calls"], parameters: [{ name: "page", in: "query" }],
        responses: { 200: {}, 400: { content: { "application/problem+json": {} } } } },
    },
    "/v1/getCallHistory": {
      get: { operationId: "get_call_history", tags: ["calls"], responses: { 200: {} } },
    },
  },
};

const VERBS = /^(get|create|update|delete|fetch|list)[A-Z]/;
const rules = [
  ["path-kebab-case", "error", (path) => path.split("/").filter((s) => s && !s.startsWith("{")).every((s) => /^[a-z0-9-]+$/.test(s)), "path segments must be lower kebab-case"],
  ["path-no-verbs", "error", (path) => !path.split("/").some((s) => VERBS.test(s)), "use a resource noun; the HTTP method is the verb"],
  ["operation-id-camel", "error", (_, op) => /^[a-z][a-zA-Z0-9]*$/.test(op.operationId ?? ""), "operationId must be camelCase (it becomes the SDK method name)"],
  ["operation-summary", "warn", (_, op) => Boolean(op.summary), "every operation needs a summary (it is the docs heading)"],
  ["problem-details", "error", (_, op) => Object.entries(op.responses).some(([code, r]) => code >= 400 && r.content?.["application/problem+json"]), "declare at least one 4xx/5xx response as application/problem+json (RFC 9457)"],
  ["list-paginated", "warn", (path, op, method) => method !== "get" || path.endsWith("}") || !/s$/.test(path) || ["limit", "cursor"].every((p) => op.parameters?.some((x) => x.name === p)), "collection GETs take limit and cursor"],
];

let errors = 0, warnings = 0;
for (const [path, item] of Object.entries(spec.paths)) {
  for (const [method, op] of Object.entries(item)) {
    for (const [name, severity, ok, message] of rules) {
      if (ok(path, op, method)) continue;
      severity === "error" ? errors++ : warnings++;
      console.log(`${severity.padEnd(5)}  ${`${method.toUpperCase()} ${path}`.padEnd(26)} ${name.padEnd(19)} ${message}`);
    }
  }
}
console.log(`\n${errors} errors, ${warnings} warnings`);

warn   GET /v1/calls              list-paginated      collection GETs take limit and cursor
error  GET /v1/getCallHistory     path-kebab-case     path segments must be lower kebab-case
error  GET /v1/getCallHistory     path-no-verbs       use a resource noun; the HTTP method is the verb
error  GET /v1/getCallHistory     operation-id-camel  operationId must be camelCase (it becomes the SDK method name)
warn   GET /v1/getCallHistory     operation-summary   every operation needs a summary (it is the docs heading)
error  GET /v1/getCallHistory     problem-details     declare at least one 4xx/5xx response as application/problem+json (RFC 9457)

4 errors, 2 warnings

# device-status-gateway

Pushes device status changes to the web UI over server-sent events (ADR 4).

## Run it locally
npm ci && npm run dev   # needs Node 24 and a local event bus: docker compose up bus

## Test
npm test                # unit + integration; npm run test:e2e for the browser suite

## Configuration
| Variable | Default | Meaning |
|---|---|---|
| BUS_URL | nats://localhost:4222 | event bus to subscribe to |
| REPLAY_WINDOW_S | 300 | how far back Last-Event-ID replay goes |

## Owners and links
@acme/api-team · runbook: docs/runbook.md · API: openapi.yaml · ADRs: docs/adr/

## Alert: SSE gateway connections dropping

**Means:** more than 5% of fleet pages reconnected in the last 10 minutes.
**Impact:** status on the fleet page may lag; no data loss (UI reloads on gaps).
**Check:** dashboard "SSE gateway" → reconnect rate, LB idle timeout errors.
**Likely causes:** gateway restart loop; load balancer idle timeout below 25 s
heartbeat; event bus disconnect.
**Fix:** roll back the last gateway deploy (`deploy rollback sse-gateway`), or
raise the LB idle timeout. Escalate to @acme/api-team on-call after 30 min.

{
  "printWidth": 100,
  "singleQuote": false,
  "trailingComma": "all"
}

root = true

[*]
charset = utf-8
end_of_line = lf
indent_style = space
indent_size = 2
insert_final_newline = true
trim_trailing_whitespace = true

[*.md]
trim_trailing_whitespace = false

$ npx prettier --check src
Checking formatting...
[warn] src/retry.ts
[warn] Code style issues found in the above file. Run Prettier with --write to fix.
(exit code 1)

$ npx prettier --write src/retry.ts
src/retry.ts 16ms

$ cat src/retry.ts
export const retryPolicy = { maxAttempts: 3, backoffMs: [200, 400, 800] };

$ npx prettier --check src
Checking formatting...
All matched files use Prettier code style!
(exit code 0)

{
  "scripts": {
    "prepare": "husky"
  },
  "lint-staged": {
    "*.{ts,tsx,js,mjs}": ["eslint --fix --max-warnings=0", "prettier --write"],
    "*.{json,md,yml,css,html}": "prettier --write"
  }
}

$ git add src/retry.ts && git commit -m "feat: retry policy"
⋯ Backing up original state…
✔ Done backing up original state (3743608)!
⋯ Running tasks for staged files…
    *.{ts,tsx,js,mjs} — 1 file
      ⋯ eslint --fix --max-warnings=0
      ⋯ prettier --write

✔ eslint --fix --max-warnings=0
✔ prettier --write

✔ Done running tasks for staged files!
⋯ Staging changes from tasks…
✔ Done staging changes from tasks!
⋯ Cleaning up temporary files…
✔ Done cleaning up temporary files!
[main cabef20] feat: retry policy
 1 file changed, 1 insertion(+)
 create mode 100644 src/retry.ts

$ git add src/status.ts && git commit -m "feat: online check"
⋯ Backing up original state…
✔ Done backing up original state (7dd8378)!
⋯ Running tasks for staged files…
    *.{ts,tsx,js,mjs} — 1 file
      ⋯ eslint --fix --max-warnings=0
      ⋯ prettier --write

✖ eslint --fix --max-warnings=0
↓ prettier --write

✖ Failed to run tasks for staged files!
↓ Skipped staging changes from tasks…
⋯ Reverting to original state because of errors…
✔ Done reverting to original state!
⋯ Cleaning up temporary files…
✔ Done cleaning up temporary files!

✖ eslint --fix --max-warnings=0:

/…/device-ui/src/status.ts
  2:17  error  Expected '===' and instead saw '=='  eqeqeq

✖ 1 problem (1 error, 0 warnings)
(exit code 1, no commit created)

name: standards

on:
  pull_request:
    types: [opened, edited, synchronize, reopened]

permissions:
  contents: read

concurrency:
  group: standards-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  standards:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # the policy step diffs against the base branch

      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - run: npm ci

      - name: Format (Prettier)
        run: npx prettier --check .

      - name: Lint (ESLint, warnings fail too)
        run: npx eslint . --max-warnings=0

      - name: Types
        run: npx tsc --noEmit

      - name: PR title follows Conventional Commits
        env:
          TITLE: ${{ github.event.pull_request.title }}
        run: |
          echo "$TITLE" | grep -Eq '^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([a-z0-9-]+\))?!?: .+' \
            || { echo "::error::PR title must look like 'type(scope): summary'"; exit 1; }

      - name: ADRs and API style guide
        run: |
          node scripts/adr-check.mjs docs/adr
          node scripts/api-lint.mjs openapi.yaml

      - name: Pull request policy
        env:
          BASE_REF: ${{ github.base_ref }}
        run: node scripts/pr-policy.mjs "origin/$BASE_REF"

# Default owners for everything
*                @acme/web-leads

# Docs: the docs group (last match wins, so this beats *)
*.md             @acme/docs

# The API and its contract
/src/api/        @acme/api-team
/openapi.yaml    @acme/api-team

# Schema migrations need the API team and a DBA
/db/migrations/  @acme/api-team @acme/dba

// Standards as a CI step: read what a pull request changed (git diff against main), work out the
// required code owners (CODEOWNERS: the last matching pattern wins) and apply the team's rules.
// Real git in a throwaway repository with fixed names and dates (Git 2.54).
import { execFileSync } from "node:child_process";
import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
import { tmpdir } from "node:os";
import { join, dirname } from "node:path";

const dir = mkdtempSync(join(tmpdir(), "git-demo-"));
let minute = 0;
const git = (...args) => {
  const date = `${1767603600 + 60 * minute++} +0000`;
  return execFileSync("git", args, {
    cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"],
    env: { ...process.env, LC_ALL: "C", GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_NOSYSTEM: "1",
      GIT_AUTHOR_NAME: "Asha", GIT_AUTHOR_EMAIL: "asha@example.com", GIT_AUTHOR_DATE: date,
      GIT_COMMITTER_NAME: "Asha", GIT_COMMITTER_EMAIL: "asha@example.com", GIT_COMMITTER_DATE: date },
  }).trimEnd();
};
const write = (file, text) => { mkdirSync(join(dir, dirname(file)), { recursive: true }); writeFileSync(join(dir, file), text); };

const CODEOWNERS = `*                @acme/web-leads
*.md             @acme/docs
/src/api/        @acme/api-team
/db/migrations/  @acme/api-team @acme/dba`;
const owners = (file) => {
  let match = [];
  for (const line of CODEOWNERS.split("\n")) {
    const [pattern, ...who] = line.trim().split(/\s+/);
    const hit = pattern === "*" || (pattern.startsWith("*.") && file.endsWith(pattern.slice(1)))
      || (pattern.startsWith("/") && file.startsWith(pattern.slice(1)));
    if (hit) match = who; // later lines override earlier ones
  }
  return match.join(" ");
};

try {
  git("-c", "init.defaultBranch=main", "init", "-q");
  for (const f of ["src/api/devices.js", "openapi.yaml", "package.json", "package-lock.json", "README.md"]) write(f, "v1\n");
  git("add", "."); git("commit", "-q", "-m", "chore: initial commit");
  git("switch", "-q", "-c", "feature/serials");
  write("src/api/devices.js", "v1\n" + "serial handling\n".repeat(420));
  write("db/migrations/0042_add_serial.sql", "ALTER TABLE devices ADD serial TEXT;\n");
  write("package.json", "v2\n"); // new dependency, but no lockfile change
  write("README.md", "v1\nserials\n");
  git("add", "."); git("commit", "-q", "-m", "feat(api): device serial numbers");

  const changed = git("diff", "--name-only", "main...HEAD").split("\n");
  const lines = git("diff", "--numstat", "main...HEAD").split("\n").reduce((n, l) => n + Number(l.split("\t")[0]) + Number(l.split("\t")[1]), 0);
  console.log("Changed files and required reviewers:");
  for (const f of changed) console.log(`  ${f.padEnd(34)} ${owners(f)}`);
  const touched = (p) => changed.some((f) => f.startsWith(p));
  const findings = [];
  if (touched("src/api/") && !touched("openapi.yaml")) findings.push("FAIL src/api/ changed but openapi.yaml did not (API-first rule)");
  if (touched("package.json") && !touched("package-lock.json")) findings.push("FAIL package.json changed without package-lock.json");
  if (touched("db/migrations/") && !touched("docs/adr/")) findings.push("WARN schema migration without an ADR: link the decision in the PR");
  if (lines > 400) findings.push(`WARN ${lines} lines changed; aim for under 400 so it can be reviewed in one sitting`);
  console.log(`\nPolicy check:\n  ${findings.join("\n  ")}`);
} finally {
  rmSync(dir, { recursive: true, force: true });
}

Changed files and required reviewers:
  README.md                          @acme/docs
  db/migrations/0042_add_serial.sql  @acme/api-team @acme/dba
  package.json                       @acme/web-leads
  src/api/devices.js                 @acme/api-team

Policy check:
  FAIL src/api/ changed but openapi.yaml did not (API-first rule)
  FAIL package.json changed without package-lock.json
  WARN schema migration without an ADR: link the decision in the PR
  WARN 424 lines changed; aim for under 400 so it can be reviewed in one sitting

$ npx eslint . --suppress-all
/…/device-ui/src/devices.ts
  9:3  warning  Unexpected console statement. Only these console methods are allowed: warn, error  no-console

✖ 1 problem (0 errors, 1 warning)

$ cat eslint-suppressions.json
{
  "src/devices.ts": {
    "@typescript-eslint/no-floating-promises": {
      "count": 1
    },
    "@typescript-eslint/no-unused-vars": {
      "count": 1
    },
    "eqeqeq": {
      "count": 1
    }
  }
}

$ echo 'export const isAdmin = (role: string) => role == "admin";' >> src/devices.ts
$ npx eslint .
/…/device-ui/src/devices.ts
   9:3   warning  Unexpected console statement. Only these console methods are allowed: warn, error  no-console
  10:41  error    Expected '===' and instead saw '=='                                                eqeqeq
  16:47  error    Expected '===' and instead saw '=='                                                eqeqeq

✖ 3 problems (2 errors, 1 warning)
(exit code 1)

// Turning on a strict rule in an old codebase without fixing 1,200 warnings first: a "ratchet".
// CI compares this PR's lint counts per rule with a committed baseline; counts may only go down.
const baseline = { "@typescript-eslint/no-explicit-any": 1214, "@typescript-eslint/no-floating-promises": 87, eqeqeq: 40 };

function ratchet(baseline, current) {
  const report = [];
  const next = { ...baseline };
  for (const rule of Object.keys({ ...baseline, ...current })) {
    const before = baseline[rule] ?? 0;
    const now = current[rule] ?? 0;
    if (now > before) report.push(`FAIL ${rule}: ${before} -> ${now} (+${now - before}); new code must not add violations`);
    else if (now < before) { report.push(`ok   ${rule}: ${before} -> ${now}; baseline tightened`); next[rule] = now; }
  }
  return { failed: report.some((l) => l.startsWith("FAIL")), report, next };
}

const prs = [
  ["PR #210 (adds a typed API client)", { "@typescript-eslint/no-explicit-any": 1214, "@typescript-eslint/no-floating-promises": 87, eqeqeq: 40 }],
  ["PR #211 (fixes promises in sync.ts)", { "@typescript-eslint/no-explicit-any": 1214, "@typescript-eslint/no-floating-promises": 79, eqeqeq: 40 }],
  ["PR #212 (copy-pastes an old module)", { "@typescript-eslint/no-explicit-any": 1221, "@typescript-eslint/no-floating-promises": 79, eqeqeq: 41 }],
];

let current = baseline;
for (const [name, counts] of prs) {
  const { failed, report, next } = ratchet(current, counts);
  console.log(`${name}: ${failed ? "blocked" : "passes"}`);
  for (const line of report) console.log(`  ${line}`);
  if (!failed) current = next; // the merged PR commits the tightened baseline
}
console.log(`\nbaseline now: ${JSON.stringify(current)}`);

PR #210 (adds a typed API client): passes
PR #211 (fixes promises in sync.ts): passes
  ok   @typescript-eslint/no-floating-promises: 87 -> 79; baseline tightened
PR #212 (copy-pastes an old module): blocked
  FAIL @typescript-eslint/no-explicit-any: 1214 -> 1221 (+7); new code must not add violations
  FAIL eqeqeq: 40 -> 41 (+1); new code must not add violations

baseline now: {"@typescript-eslint/no-explicit-any":1214,"@typescript-eslint/no-floating-promises":79,"eqeqeq":40}