skrewww

Guard

Beta

v0.1.0-beta.1

Skrewww Guard is an offline, local CLI that validates selected Skrewww canonical-contract claims — deterministically, without uploading source, calling an LLM, or connecting to Figma.

Guard’s own release stage is Beta. It does not replace TypeScript, accessibility review, Figma parity checks, or visual QA.

Install

Prefer the beta dist-tag until a stable release:

npm install --save-dev @skrewww/guard@beta

Run

npx skrewww-guard .
npx skrewww-guard path/to/file.tsx
npx skrewww-guard path --claims claims.json

Or use the local binary after install: skrewww-guard. Zero-config happy path — no .guardrc, no severity overrides, no suppressions. Claims JSON is input data, not Guard configuration.

Package: @skrewww/guard on npm. Source and release notes: GitHub Release guard-v0.1.0-beta.1. Changelog entry: /changelog.

Public consumer rules (exactly 3)

  1. component/nonexistent-slug — ERROR when a Skrewww-origin claim names a component slug that is not in the packaged consumer facts.
  2. maturity/false-stable-claim — ERROR when structured claims say a component is Stable but its canonical status is not.
  3. distribution/false-installable-claim — ERROR when structured claims say a component is installable via the Skrewww registry but it is deliberately not distributed.

The Guard engine also implements three Skrewww-repo internal invariants. Those are not part of this public consumer CLI.

Exit codes

  • 0 — no ERROR findings
  • 1 — one or more Guard ERROR findings
  • 2 — tool / parse / input / facts failure

Provenance

Guard only treats files that carry a generated @skrewww-component <slug> origin marker (injected into Skrewww registry install payloads) as Skrewww-origin.

  • Meaning: originated from a Skrewww registry installation
  • Not: still byte-identical to canonical Skrewww (local edits are OK)
  • Installs created before markers shipped may be unrecognized until components are reinstalled or updated
  • Unmarked local components (even named Button under components/ui) → unknown → no false ERROR

Import path or component name alone never establishes a claim.

What Guard does not validate

  • Arbitrary React props / TypeScript correctness
  • Accessibility or WCAG compliance
  • Shape or Surface mode
  • Figma parity or visual quality
  • Arbitrary design-system correctness beyond the three public rules

Prop inventiveness (api/nonexistent-prop) remains deferred — Guard is not a prop-type checker.

Privacy / offline

  • Runs locally after install
  • No source upload, no telemetry
  • No LLM, Figma, or network required for validation after installation
  • Diagnostics use project-relative paths; no source dumps

CI adoption

Publishing Guard does not make it a required Skrewww CI gate. Adoption is intentional and staged: observe → optional → required only after Beta evidence.