strict-toolchain-audit

namespace	aiwg
name	strict-toolchain-audit
platforms	["all"]
description	Check build and CI configuration for warning-as-error, strict typechecking, and language-specific compiler/linter floors
requires	[{"project-files":"build files or CI workflows for at least one supported language"}]
ensures	[{"report":"strictness gaps per language and remediation commands"},{"exit-code":"non-zero when --fail-on-missing is set and required strictness is absent"}]
errors	[{"no-supported-language":"no supported language/build signal detected"}]
invariants	["gradual-adoption baselines are allowed only when new warnings still fail","sanitizer jobs do not count as replacement for strict compiler/linter gates"]
commandHint	{"argumentHint":"[--language c|cpp|rust|go|python|typescript|auto] [--fail-on-missing] [--format text|json]","allowedTools":"Read, Bash, Grep","model":"haiku","category":"security","orchestration":false,"modelRole":"efficiency","modelTier":"economy"}

Strict Toolchain Audit

Inspect build and CI configuration for the strict-toolchain rule. This maps curl Practice 13 into a reusable AIWG security-engineering audit.

Checks

• C/C++: compiler flags include -Wall, -Wextra, -Werror, -pedantic; recommended hardening flags are reported when absent.
• Rust: cargo clippy -- -D warnings or equivalent CI gate.
• Go: go vet ./... and staticcheck ./... fail CI.
• Python: ruff check and mypy strictness are configured.
• TypeScript: strict: true and noUncheckedIndexedAccess: true.

Gradual Adoption

Legacy projects may keep a baseline, but the audit must confirm that new warnings fail the build. A baseline without a ratchet is reported as a finding.

References

• agentic/code/frameworks/security-engineering/rules/strict-toolchain.md
• agentic/code/frameworks/security-engineering/skills/sanitizer-in-ci/SKILL.md