# Run all architectural validations
./scripts/ci/architectural-validation.sh

# Check for placeholder implementations
python3 scripts/ci/parse-validation-patterns.py \
  scripts/ci/validation-patterns.toml placeholder_patterns

# Check for unwrap/expect/panic
rg "\.unwrap\(\)|\.expect\(|panic!\(" src/ --type rust -n | \
  grep -v "^tests/" | \
  grep -v "^src/bin/" | \
  grep -v "// Safe:"

# Check for anyhow::anyhow! (FORBIDDEN per CLAUDE.md)
rg "anyhow::anyhow!|\\banyhow!\(" src/ --type rust -n

# Verify structured error types
rg "#\[derive.*thiserror::Error" src/ --type rust -A 5 | head -30

# Detect hardcoded algorithm formulas
python3 scripts/ci/parse-validation-patterns.py \
  scripts/ci/validation-patterns.toml algorithm_di_patterns

# Verify enum-based algorithm dispatch
rg "pub enum.*Algorithm" src/intelligence/algorithms/ --type rust -A 10

# Check for direct resource creation (should use DI)
rg "AuthManager::new|OAuthManager::new|TenantOAuthManager::new" src/ --type rust -n | \
  grep -v "^tests/" | \
  grep -v "^src/bin/"

# Check for fake ServerResources (test-only pattern)
rg "Arc::new\(ServerResources" src/ --type rust -n | \
  grep -v "^tests/"

# ZERO tolerance for unsafe (except approved locations)
rg "unsafe " src/ --type rust -n | \
  grep -v "^src/health.rs" && \
  echo "❌ Unauthorized unsafe code!" || \
  echo "✓ Unsafe code properly isolated"

// ❌ FORBIDDEN patterns
"Implementation would..."
"TODO: Implementation"
"stub implementation"
"placeholder implementation"
unimplemented!()
todo!()

// ❌ FORBIDDEN
.unwrap()  // except tests/bins with "// Safe:"
.expect()  // except tests/bins with "// Safe:"
panic!()   // except tests only
anyhow::anyhow!()  // ZERO TOLERANCE

// ✅ REQUIRED
Result<T, E>
AppError or specific error types
thiserror::Error enums

// ❌ FORBIDDEN (hardcoded formula outside algorithms/)
let max_hr = 220.0 - age;  // In random module

// ✅ CORRECT (enum-based DI)
let max_hr = MaxHrAlgorithm::Fox.calculate(age)?;  // In algorithms/maxhr.rs

// ❌ FORBIDDEN (direct resource creation)
let auth = AuthManager::new(config);  // Should use DI

// ✅ CORRECT (dependency injection)
pub struct MyService {
    resources: Arc<ServerResources>,  // Contains auth_manager
}

// ❌ String allocation anti-patterns
.to_string().as_str()  // Unnecessary round-trip
String::from("text").as_str()

// ✅ Use &str directly
"text"

// ❌ Iterator anti-patterns
let mut vec = Vec::new();
for item in items {
    vec.push(process(item));
}

// ✅ Use functional style
let vec: Vec<_> = items.iter().map(process).collect();

✓ No placeholder implementations found
✓ No unwrap/expect/panic in production code
✓ No anyhow::anyhow! usage (using structured errors)
✓ Algorithm formulas properly isolated
✓ Resource creation uses dependency injection
✓ Unsafe code limited to approved files
✓ No development artifacts (TODO/FIXME)
✓ Clone usage within threshold (600 max)

ARCHITECTURAL VALIDATION: PASSED

❌ Found 3 placeholder implementations:
  src/new_feature.rs:45: "stub implementation"
  src/new_feature.rs:67: "TODO: Implementation"

❌ Found 2 unwrap() calls in production:
  src/routes/new_endpoint.rs:123: .unwrap()
  src/services/processor.rs:89: .unwrap()

❌ Found 1 anyhow::anyhow! usage (FORBIDDEN):
  src/error_handler.rs:56: anyhow::anyhow!("Error")

❌ Found hardcoded formula:
  src/intelligence/new_module.rs:34: 220.0 - age

ARCHITECTURAL VALIDATION: FAILED

# Check for format! SQL construction (FORBIDDEN per CLAUDE.md Security Rules)
echo "🛡️ Checking for format! SQL injection risks..."
rg "format!\(.*(?:SELECT|INSERT|UPDATE|DELETE|CREATE|DROP|ALTER)" src/ --type rust -n && \
  echo "❌ SECURITY: format! used in SQL query construction!" || \
  echo "✓ No format! SQL injection risks"

# Verify all SQL uses parameterized queries
rg "sqlx::query(?:_as|_scalar)?\(" src/ --type rust -n | wc -l
echo "Parameterized query count (safe)"

# Check for raw string interpolation in HTML output
echo "🛡️ Checking HTML template safety..."
rg "format!\(.*<.*>.*\{" src/ --type rust -n | \
  rg -v "html_escape|encode_text" && \
  echo "⚠️  Potential XSS: HTML with unescaped interpolation" || \
  echo "✓ HTML output properly escaped"

# Verify html_escape usage
rg "html_escape::encode_text|html_escape::encode_double_quoted_attribute" src/ --type rust -n | wc -l
echo "HTML escape function calls (safe)"

# Check for global OAuth config (should be per-tenant)
echo "🛡️ Checking tenant isolation in non-DB code..."
rg "static.*OAuth|static.*Config|LazyLock.*OAuth" src/ --type rust -n | \
  rg -v "test|DEFAULT" && \
  echo "⚠️  Global OAuth/Config state (should be per-tenant)" || \
  echo "✓ No global OAuth/Config state"