feat: add SAM eslint plugin boundary rules

[simple-agent-manager]

Summary

• Adds unpublished local package @simple-agent-manager/eslint-plugin-sam under packages/eslint-plugin-sam only.
• Implements three advisory SAM ESLint rules: no-unvalidated-request-json, no-unsafe-json-parse-assertion, and no-local-record-guard.
• Adds fixture-backed RuleTester coverage, rule docs, and rules.manifest.json lifecycle metadata for deterministic quality rollout.
• Commit: 7fec2b76b5ff719a7b85b136afc28a891c0697f6.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test
• Additional validation run (if applicable)
• N/A: no sweep/cron/alarm candidate-selection changes.

Validation actually run within owned workspace:

• pnpm --filter @simple-agent-manager/eslint-plugin-sam test — PASS, 16 tests passed.
• pnpm --filter @simple-agent-manager/eslint-plugin-sam typecheck — PASS.
• pnpm --filter @simple-agent-manager/eslint-plugin-sam lint — PASS.
• Isolated temp package install with eslint@9.39.1, @typescript-eslint/parser@8.65.0, vitest@4.1.5, typescript@5.9.3, then npm test — PASS, 16 tests passed.

Full-root lint/typecheck/test were not run because this child task has exclusive ownership of packages/eslint-plugin-sam/** and must not modify root workspace wiring or lockfile.

Staging Verification (REQUIRED for all code changes — merge-blocking)

All checkboxes below are mandatory for any PR that changes runtime code (.ts, .tsx, .go, etc.). Write N/A: docs-only ONLY if the PR contains zero runtime code changes. See .claude/rules/13-staging-verification.md.

• Staging deployment green — explicitly skipped by user instruction: "Do not deploy to staging."
• Live app verified via Playwright — explicitly skipped by user instruction; plugin package has no runtime app surface.
• Existing workflows confirmed working — explicitly skipped by user instruction.
• New feature/fix verified on staging — explicitly skipped by user instruction; validated locally with RuleTester.
• Infrastructure verification completed — N/A: no infra changes.
• Mobile and desktop verification notes added for UI changes — N/A: no UI changes.

Staging Verification Evidence

N/A by explicit task constraint: do not deploy to staging. This PR only adds an unpublished local ESLint plugin package and fixture tests; it does not alter deployed application behavior.

UI Compliance Checklist (Required for UI changes)

• N/A: no UI changes.

End-to-End Verification (Required for multi-component changes)

• N/A: single package-local quality-tooling change.

Data Flow Trace

N/A: no application data flow. The plugin exports ESLint rule objects from packages/eslint-plugin-sam/src/index.js and tests invoke the rules with ESLint RuleTester in packages/eslint-plugin-sam/tests/rules.test.js.

Untested Gaps

Root integration is intentionally not wired in this child PR because the task grants exclusive ownership only for packages/eslint-plugin-sam/**. Integration branch should add workspace/root config and lockfile wiring separately.

Post-Mortem (Required for bug fix PRs)

N/A: not a bug fix.

Specialist Review Evidence (Required for agent-authored PRs)

• All local reviewers completed and findings addressed before merge
• If any reviewer did NOT complete: needs-human-review label added and merge deferred to human

Reviewer	Status	Outcome
test-engineer	PASS	Fixture-backed RuleTester corpus covers requested true positives, representative safe negatives, comments/strings/multiline, aliases/near misses, and two-plus negative edge cases per rule.
constitution-validator	PASS	No configurable runtime/business values introduced; static docs URLs are ESLint metadata links.
task-completion-validator	PASS	Requested package-local rules, docs, manifest, fixtures, tests, and validation evidence are present within the exclusive ownership boundary.

Exceptions (If any)

• Scope: Staging verification.
• Rationale: User explicitly instructed not to deploy to staging; change is unpublished package-local quality tooling with no app runtime path.
• Expiration: This child PR only; final integration PR should follow its coordinated staging plan.

Agent Preflight (Required)

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

N/A: no external API change. ESLint 9 compatibility was verified by isolated local install and RuleTester execution.

Codebase Impact Analysis

Affected components and paths:

• packages/eslint-plugin-sam/src/rules/* — advisory AST matchers for request JSON, JSON.parse assertions, and local record guards.
• packages/eslint-plugin-sam/tests/fixtures/* — fixture corpus for true positives, safe negatives, comments/strings/multiline, aliases, and near misses.
• packages/eslint-plugin-sam/docs/rules/* and packages/eslint-plugin-sam/rules.manifest.json — rule docs and lifecycle ownership metadata.

Documentation & Specs

• Added package-local rule docs under packages/eslint-plugin-sam/docs/rules/.
• Added packages/eslint-plugin-sam/rules.manifest.json with owner, matcher version, advisory stage, gate owner, evidence incident, baseline/backlog link, dates, false-positive samples, and expiring exemptions.
• No public docs updated; this is unpublished internal quality tooling.

Constitution & Risk Check

Checked Principle XI (No Hardcoded Values) and file-size limits. No deployment config/timeouts/limits/identifiers were added. Rule files remain below the repository file-size threshold. Suggestions are advisory only and do not declare meta.fixable.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud