rebar
A checker that runs against any repository, a scanner for known prompt-injection signatures, a gate that blocks the commit when a rule is ignored, and a generator that starts your next project passing.
npx github:Navesz/rebar .The problem, measured across 161 commits
A forensic pass over six repositories, 2026-08-25: 3 had no CI, and the same 3 had a broken lint. The one with the most governance paperwork — AGENTS.md, SECURITY.md, GOVERNANCE.md — had 35 lint errors.
A rule written in markdown is followed almost never
That repository had a check script chaining format, lint, types, tests and build. Nothing ever ran it. If a rule can move down from prose to enforcement, it should — and enforcement has to be the more reliable of the two.
The checker: a scoreboard for any repository
npx github:Navesz/rebar . — nothing installed, and not one line written into the repository under audit. A rule that does not apply leaves the denominator, because a score that counts what isn't there is a score that lies.
The gate: hook, CI on both systems, and the server
What CI runs is the same sequence you run before it, in a single command. Above it, a GitHub ruleset whose bypass list is empty — not even the owner gets through. Below it, the hook, on your machine.
The generator: this page came out of it
npx github:Navesz/rebar new my-site creates a static Next app with the gate already inside and an MCP server that serves the rules to whatever AI opens the project. Then it runs the checker on what it just made.
What is not proven yet
rebar is enforced in one repository: itself. The written target was two by D+30, and it stands at 1 of 2. One rule still only warns, because close to 12% of what it flags is noise. If that doesn't turn, the abandon criterion says stop.
How to use it
Three states instead of two, and the third is what keeps the score honest: whatever does not apply leaves the denominator. An empty folder does not get a good grade.
The scoreboard for one repository
npx github:Navesz/rebar .rebar-check · prumo ✓ editorconfig has an .editorconfig ✓ dependabot automated dependency updates ✓ ci has CI ✗ ci-gates the CI reaches the verification the repository has the CI does not reach: lint – orphan-schema no orphan JSON Schema no .schema.json in the repository 14 of 17 · 1 not applicable · 2 warning(s)output The dash is the third state. Before it existed, an empty folder with an empty .git/ scored 8 of 14 and tied with rebar itself. An excerpt: five of the rules and the closing line, from a real run on 2026-09-17 against another repository of mine.
Several repositories at once
npx github:Navesz/rebar ../a ../b ../cA comparable summary comes out at the end. This is how the forensic pass over 161 commits in six repositories was put together.
One rule at a time, to fix without noise
npx github:Navesz/rebar --rule=ci-gates .The filter is for fixing, not for passing: run it without the filter before you commit.
Structured output, for CI
npx github:Navesz/rebar --json .Every rule comes out with an id, a class, a level and a state. That is what the CI step consumes.
Heuristics failing the build too
npx github:Navesz/rebar --heuristics .By default a heuristic only informs. A wrong automatic rule costs more than a missing one — one of them was measured at seven hits and zero true positives.