test: strengthen coding-standards guardrails

[cursor]

Summary

Reviewed the codebase against docs/coding-standards.md (triggered by PR #597 schema sync). The existing 80-test pnpm standards:check suite already enforces the registry-driven architecture; this PR strengthens coverage and fixes one minor standards violation.

Changes

• tests/coding-standards/constants.ts — single source of truth for the 11 consolidated MCP tool names (shared across guardrail tests)
• tests/coding-standards/agents-consistency.test.ts — keeps AGENTS.md aligned with canonical docs (11 tools, Zod v4, pnpm standards:check)
• tests/coding-standards/security.test.ts — enforces §9 safety rules: secret metadata never exposes values, no secret field mapping in toolsets, IDP workflow api_key_secret not echoed in API body, RateLimiter in HarnessClient
• src/registry/extractors.ts — moved scorecardStatsExtract from inline idp.ts (shared extractor rule §3)
• Refactored architecture.test.ts and docs-consistency.test.ts to use shared constants

Review findings

Area	Status
11 consolidated tool handlers (not 10)	✅ Enforced
No new registerTool() / server.tool() calls	✅ Enforced
Pure-data toolsets (no HarnessClient/Registry/logger)	✅ Enforced
No console.log() (stdio safety)	✅ Clean
Singleton HarnessClient + no raw fetch() in handlers/toolsets	✅ Enforced
Zod v4 + .describe() on all input params	✅ Enforced
Scope injection model	✅ Enforced
Write ops require confirm + elicitation	✅ Enforced
CI runs pnpm standards:check	✅ Already in ci.yml

Note: The standards snapshot in the automation prompt lists 10 tools and Zod v3 — the canonical docs (docs/coding-standards.md, AGENTS.md) correctly document 11 tools (including harness_schema) and Zod v4.

Verification

• pnpm standards:check — 88 tests (was 80)
• pnpm build
• pnpm typecheck
• pnpm test — 2486 tests

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ thisrohangupta
❌ cursoragent
_{You have signed the CLA already but the status is still pending? Let us recheck it.}