ci(wifi-veil): add honesty / anti-slop guard

Add scripts/ci-guard.sh and a `guard` CI job that statically enforce the
project's honesty invariants so they cannot silently regress:

- no telemetry (.claude-flow/), build artifacts, lockfile, or scratch/probe
  files committed;
- no debug / mock-probe / slop markers in source
  (panic!("probe...), dbg!, println!("DEBUG, TODO(ai), LOREM IPSUM, ...);
- the SYNTHETIC evidence label present on every firmware provider README, and
  the "never jamming" compliance disclaimer present in the root + firmware READMEs;
- no dishonest hardware-validation claims — honest negated / TODO(hw) /
  build-only mentions are explicitly allowed (negation-aware);
- no stale monorepo crate/harness identifiers in the code/manifest surface.

Scans only git-tracked files under the tree, so it works both in-monorepo and
in the extracted standalone repo, and never trips on untracked local scratch or
target/. Documented in CONTRIBUTING.md; passes clean on the current tree.

Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01WEXNqzs7UsfNFBcP5yW21p

wifi-veil/.github/workflows/ci.yml

@@ -10,6 +10,14 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  guard:
+    name: Honesty / anti-slop guard
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Enforce honesty / anti-slop invariants
+        run: bash scripts/ci-guard.sh
+
   rust:
     name: Rust (test + lint + wasm)
     runs-on: ubuntu-latest

wifi-veil/CONTRIBUTING.md

@@ -31,6 +31,19 @@ cd firmware/core && make test     # portable C core host test
 node harness/bin/cli.js guidance --topic overview   # harness (dependency-free)
 ```
 
+Run the honesty / anti-slop guard before pushing (CI runs it too):
+
+```bash
+bash scripts/ci-guard.sh
+```
+
+It statically enforces the invariants that keep this project honest: no
+telemetry / build artifacts / lockfile / scratch files committed; no debug or
+mock-probe markers in source; the `SYNTHETIC` evidence label present on every
+firmware provider README; the "never jamming" compliance disclaimer present; no
+dishonest hardware-validation claims (honest negated/`TODO(hw)` mentions are
+fine); and no stale monorepo identifiers in the code surface.
+
 CI (`.github/workflows/ci.yml`) runs the same gates. Keep changes the smallest
 coherent unit, read before editing, and never commit telemetry (`.claude-flow/`),
 build artifacts, credentials, or CSI/person data.

wifi-veil/scripts/ci-guard.sh

@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+# WiFi Veil CI guard — enforces the project's honesty / anti-slop invariants so
+# they cannot silently regress. This is a STATIC scan; the deterministic proof
+# witness, tests, clippy, and the C-core test run in the main CI jobs.
+#
+# It scans only git-tracked files under the current tree, so untracked local
+# scratch never fails CI and build outputs (target/) are ignored. Run locally
+# from the repo root:  bash scripts/ci-guard.sh
+#
+# Every check prints PASS/FAIL; the script exits non-zero if any check fails.
+set -u
+
+fail=0
+pass() { printf 'PASS  %s\n' "$1"; }
+bad()  { printf 'FAIL  %s\n' "$1"; fail=1; }
+
+# All tracked files under cwd (works both in-monorepo-subdir and standalone).
+mapfile -t TRACKED < <(git ls-files -- .)
+# Convenience filtered lists.
+code_files()  { printf '%s\n' "${TRACKED[@]}" | grep -E '\.(rs|c|h|js|ts)$' || true; }
+doc_files()   { printf '%s\n' "${TRACKED[@]}" | grep -E '\.md$' || true; }
+
+# ---------------------------------------------------------------------------
+# 1. No forbidden artifacts / telemetry / scratch committed.
+# ---------------------------------------------------------------------------
+artifacts=$(printf '%s\n' "${TRACKED[@]}" | grep -E \
+  '(^|/)(\.claude-flow/|node_modules/|target/)|\.o$|(^|/)test_veil_shield$|(^|/)Cargo\.lock$|(^|/)tests/probe.*\.rs$|(^|/)(tmp_|scratch_).*' \
+  || true)
+if [ -n "$artifacts" ]; then
+  bad "forbidden artifacts/telemetry/scratch are tracked:"
+  printf '        %s\n' $artifacts
+else
+  pass "no telemetry / build artifacts / lockfile / scratch files tracked"
+fi
+
+# ---------------------------------------------------------------------------
+# 2. No debug/scratch leftovers in source (mock-probe / slop markers).
+# ---------------------------------------------------------------------------
+markers='panic!\("probe|dbg!\(|println!\("DEBUG|console\.log\("DEBUG|TODO\(ai\)|FIXME\(slop\)|XXX SLOP|LOREM IPSUM'
+hits=$(code_files | xargs -r grep -nEI "$markers" 2>/dev/null || true)
+if [ -n "$hits" ]; then
+  bad "debug/scratch/slop markers in source:"
+  printf '        %s\n' "$hits"
+else
+  pass "no debug/scratch/slop markers in source"
+fi
+
+# ---------------------------------------------------------------------------
+# 3. Honesty labels present where evidence discipline requires them.
+#    Every firmware provider README must carry the SYNTHETIC label; the top
+#    firmware README and the root README must carry the compliance disclaimer.
+# ---------------------------------------------------------------------------
+for p in firmware/openwifi firmware/openwrt firmware/nexmon firmware/esp32; do
+  if [ -f "$p/README.md" ]; then
+    if grep -qi 'SYNTHETIC' "$p/README.md"; then
+      pass "$p/README.md carries SYNTHETIC evidence label"
+    else
+      bad "$p/README.md is missing the SYNTHETIC evidence label"
+    fi
+  fi
+done
+for f in firmware/README.md README.md; do
+  if [ -f "$f" ]; then
+    if grep -qiE 'never jamming|not jamming|not a jammer' "$f"; then
+      pass "$f carries the 'never jamming' compliance disclaimer"
+    else
+      bad "$f is missing the 'never jamming' compliance disclaimer"
+    fi
+  fi
+done
+
+# ---------------------------------------------------------------------------
+# 4. No dishonest hardware-success claims. Honest 'not yet MEASURED / TODO(hw) /
+#    build-only' language is REQUIRED elsewhere; here we forbid only phrases that
+#    assert silicon validation that does not exist. (Conservative denylist to
+#    avoid false positives on the many honest negated mentions.)
+# ---------------------------------------------------------------------------
+dishonest='hardware[- ]validated|validated on (real )?silicon|flashed and verified|[^n]verified on silicon|confirmed on hardware|MEASURED on (real )?hardware'
+# Exclude honest negated/hedged mentions (the discipline itself): "not/never
+# validated on silicon", "NOT hardware-validated", "unverified", "nothing is
+# validated", "SYNTHETIC ... not hardware-validated", roadmap/TODO framing, etc.
+negation='\bnot\b|\bnever\b|\bno\b|\bnothing\b|\bwithout\b|unverified|unvalidated|\bwould\b|\bplanned\b|\bbefore\b|not yet|TODO|SYNTHETIC'
+hwhits=$( { doc_files; code_files; } | xargs -r grep -nEiI "$dishonest" 2>/dev/null \
+  | grep -viE "$negation" || true)
+if [ -n "$hwhits" ]; then
+  bad "dishonest hardware-success claim(s) (no captured log exists):"
+  printf '        %s\n' "$hwhits"
+else
+  pass "no dishonest hardware-validation claims"
+fi
+
+# ---------------------------------------------------------------------------
+# 5. No stale monorepo identifiers in the standalone code surface. The crate is
+#    `wifi-veil` (lib `wifi_veil`); the old `wifi-densepose-privshield` name must
+#    not survive in code / manifests (docs may cite the historical ADR filename).
+# ---------------------------------------------------------------------------
+codeset=$(printf '%s\n' "${TRACKED[@]}" | grep -E '\.(rs|toml)$|harness/(bin|src)/.*\.(js|ts)$|harness/package\.json$|harness/\.harness/manifest\.json$' || true)
+if [ -n "$codeset" ]; then
+  stale=$(printf '%s\n' "$codeset" | xargs -r grep -nEI 'wifi[_-]densepose[_-]privshield' 2>/dev/null || true)
+  if [ -n "$stale" ]; then
+    bad "stale monorepo crate/harness identifier in code/manifests:"
+    printf '        %s\n' "$stale"
+  else
+    pass "no stale monorepo identifiers in code/manifests"
+  fi
+fi
+
+echo
+if [ "$fail" -ne 0 ]; then
+  echo "ci-guard: FAILED"
+  exit 1
+fi
+echo "ci-guard: all invariants hold"