[devin-ai-integration]

Summary

Ports the COG-GTM/-C-Code-Standards-Compliance-Framework (v1.0) to AgentLab as a self-contained, additive and non-breaking code-standards/ drop-in. It keeps the source framework's patterns — the three-tier severity model, the Rule-ID numbering (Critical 20–26, Major 30–35, Minor 40–46), the rule-severity-mapping.yaml schema (version: "1.0"), the tiered validate.sh exit codes, and the Windsurf trigger: always_on reviewer — and only swaps the concrete tooling for Python equivalents.

Tool mapping preserved from the C/C++ framework:

Framework role	C/C++ tool	Python tool	Config
Formatting	clang-format	ruff format (Black-compatible)	code-standards/ruff.toml [format]
Static analysis	clang-tidy	ruff check	code-standards/ruff.toml [lint]
Language server	clangd	pyright	code-standards/pyrightconfig.json
Critical gate (WarningsAsErrors)	clang-tidy errors	ruff check --select <critical codes> in validate.sh	—

Example Python rule adaptations: Rule 20 bare/blind except (E722,BLE001), Rule 23 unclosed files (SIM115), Rule 24 mutable default args (B006/B008), Rule 26 insecure APIs (eval/pickle/yaml.load/weak-hash/insecure-random → S307/S301/S506/S324/S311), Rule 44 else-after-return (RET505), Rule 45 modern syntax (UP, the "use nullptr" analog).

What's included

code-standards/
├── ruff.toml                       # format + lint (clang-format + clang-tidy analog)
├── pyrightconfig.json              # language server (clangd analog)
├── rule-severity-mapping.yaml      # Critical/Major/Minor mapping, version "1.0"
├── windsurf/python-safety-critical-rules.md   # trigger: always_on
├── examples/{compliant,violations}.py         # pass / one-violation-per-rule
├── scripts/validate.sh             # exit: 0 pass / 1 format / 2 critical / 3 both
├── tests/test_compliance.py        # pytest (23 tests) validating the configs
├── vscode-settings.json.template
├── docs/{rule-reference,setup}.md
└── README.md
.github/workflows/code_standards.yml

Non-breaking by design

• Lives entirely under code-standards/; ruff.toml is only applied when invoked with --config, so it does not fight the repo's existing Black/darglint CI.
• line-length = 100 matches the repo's Black config.
• No changes to src/, pyproject.toml, or uv.lock.

CI (code_standards.yml)

• Blocking: compliant.py must pass ruff format --check + ruff check; the 23 compliance tests must pass.
• Advisory (continue-on-error): validate.sh src/ prints the tiered report. AgentLab's existing src/ currently has ~110 findings under the Critical gate, so enforcing it as blocking on the baseline is intentionally deferred — the framework surfaces them without blocking merges.

Verified

• Full PR CI is green (8/8), including the new code-standards job.
• compliant.py → passes format + lint; violations.py → 16 findings (5 critical).
• validate.sh on a clean dir → exit 0; compliance suite → 23 passed.

Link to Devin session: https://app.devin.ai/sessions/c22160077dda4f029eb079180b749755
Requested by: @joao-cognition

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring