# Scruple

> Scruple turns engineering judgment into named, tested code checks that run from the command line.

Use these docs to install and configure Scruple, choose rules and providers, or build plugins and provider adapters.

## Table of Contents

### Getting started

- [Introduction](https://scruple.dev/guide/introduction.md)
- [Quickstart](https://scruple.dev/guide/quickstart.md)
- [Configuration](https://scruple.dev/guide/configuration.md)
- [Agent skills](https://scruple.dev/guide/agent-skills.md)

### Core concepts

- [How Scruple works](https://scruple.dev/concepts/how-it-works.md)
- [Evidence and decisions](https://scruple.dev/concepts/evidence-and-decisions.md)

### Custom rules

- [Write a plugin](https://scruple.dev/guide/writing-a-plugin.md)

### Providers

- [Providers](https://scruple.dev/providers.md)
- [Decider provider](https://scruple.dev/providers/decider.md)
- [Jev provider](https://scruple.dev/providers/jev.md)

### Plugins

- [Plugins](https://scruple.dev/plugins.md)
- [API Contracts](https://scruple.dev/plugins/api-contracts.md)
- [Async](https://scruple.dev/plugins/async.md)
- [Comments](https://scruple.dev/plugins/comments.md)
- [Errors](https://scruple.dev/plugins/errors.md)
- [Observability](https://scruple.dev/plugins/observability.md)
- [Relational Databases](https://scruple.dev/plugins/relational-databases.md)
- [Resources](https://scruple.dev/plugins/resources.md)
- [Security](https://scruple.dev/plugins/security.md)
- [Tests](https://scruple.dev/plugins/tests.md)

### Reference

- [CLI reference](https://scruple.dev/reference/cli.md)
- [Configuration API](https://scruple.dev/reference/configuration.md)
- [Benchmarks](https://scruple.dev/reference/benchmarks.md)

### Other

- [api-contracts/no-ambiguous-failure-contracts](https://scruple.dev/rules/api-contracts/no-ambiguous-failure-contracts.md): Disallow overlapping public failure channels.
- [api-contracts/no-ignored-significant-results](https://scruple.dev/rules/api-contracts/no-ignored-significant-results.md): Do not discard meaningful call results.
- [api-contracts/no-misleading-function-names](https://scruple.dev/rules/api-contracts/no-misleading-function-names.md): Disallow names that contradict visible behavior.
- [api-contracts/no-misleading-http-status](https://scruple.dev/rules/api-contracts/no-misleading-http-status.md): Disallow statuses that contradict visible outcomes.
- [api-contracts/no-side-effects-in-safe-http-methods](https://scruple.dev/rules/api-contracts/no-side-effects-in-safe-http-methods.md): Disallow requested mutation through safe HTTP methods.
- [api-contracts/require-input-validation](https://scruple.dev/rules/api-contracts/require-input-validation.md): Require validation of untrusted boundary input.
- [async/no-async-initialization](https://scruple.dev/rules/async/no-async-initialization.md): Disallow async work hidden in initialization.
- [async/no-serial-independent-work](https://scruple.dev/rules/async/no-serial-independent-work.md): Do not run independent awaits in series.
- [async/no-unbounded-concurrency](https://scruple.dev/rules/async/no-unbounded-concurrency.md): Disallow potentially unbounded promise fan-out.
- [async/no-unobserved-async-work](https://scruple.dev/rules/async/no-unobserved-async-work.md): Do not leave started async work unobserved.
- [async/require-abort-listener-cleanup](https://scruple.dev/rules/async/require-abort-listener-cleanup.md): Require cleanup of abort listeners.
- [async/require-cancellation-propagation](https://scruple.dev/rules/async/require-cancellation-propagation.md): Require accepted cancellation to be forwarded.
- [async/require-race-loser-cleanup](https://scruple.dev/rules/async/require-race-loser-cleanup.md): Require cleanup of locally owned race losers.
- [comments/no-change-history-comments](https://scruple.dev/rules/comments/no-change-history-comments.md): Disallow obsolete change narration.
- [comments/no-commented-out-code](https://scruple.dev/rules/comments/no-commented-out-code.md): Disallow disabled executable implementation.
- [comments/no-misleading-comments](https://scruple.dev/rules/comments/no-misleading-comments.md): Disallow claims contradicted by visible code.
- [comments/no-useless-comments](https://scruple.dev/rules/comments/no-useless-comments.md): Disallow comments with no maintenance value.
- [comments/prefer-concise-comments](https://scruple.dev/rules/comments/prefer-concise-comments.md): Prefer useful but concise comment prose.
- [comments/require-actionable-deprecations](https://scruple.dev/rules/comments/require-actionable-deprecations.md): Require migration guidance in deprecations.
- [comments/require-actionable-todos](https://scruple.dev/rules/comments/require-actionable-todos.md): Require actionable TODO, FIXME, and HACK markers.
- [comments/require-justified-suppressions](https://scruple.dev/rules/comments/require-justified-suppressions.md): Require explanations for tool suppressions.
- [errors/no-lossy-error-wrapping](https://scruple.dev/rules/errors/no-lossy-error-wrapping.md): Disallow replacement errors that lose the original cause.
- [errors/no-message-based-error-dispatch](https://scruple.dev/rules/errors/no-message-based-error-dispatch.md): Disallow control flow coupled to exception prose.
- [errors/no-swallowed-errors](https://scruple.dev/rules/errors/no-swallowed-errors.md): Disallow silently suppressed unexpected failures.
- [errors/no-useless-catch-boundaries](https://scruple.dev/rules/errors/no-useless-catch-boundaries.md): Disallow catch handlers that add no behavior.
- [observability/no-duplicate-error-reporting](https://scruple.dev/rules/observability/no-duplicate-error-reporting.md): Do not report the same caught failure twice.
- [observability/no-sensitive-logs](https://scruple.dev/rules/observability/no-sensitive-logs.md): Disallow sensitive values emitted without redaction.
- [observability/no-unactionable-errors](https://scruple.dev/rules/observability/no-unactionable-errors.md): Require operation and failure evidence in error events.
- [observability/require-operation-context](https://scruple.dev/rules/observability/require-operation-context.md): Require a stable operation identity in events.
- [observability/require-stable-telemetry-names](https://scruple.dev/rules/observability/require-stable-telemetry-names.md): Require stable event, span, and metric names.
- [relational-databases/no-query-in-loop](https://scruple.dev/rules/relational-databases/no-query-in-loop.md): Disallow per-item relational queries.
- [relational-databases/prefer-database-join](https://scruple.dev/rules/relational-databases/prefer-database-join.md): Prefer joining related query results in the database.
- [relational-databases/require-deterministic-pagination-order](https://scruple.dev/rules/relational-databases/require-deterministic-pagination-order.md): Require visible ordering for pagination.
- [relational-databases/require-transaction-scoped-client](https://scruple.dev/rules/relational-databases/require-transaction-scoped-client.md): Require transaction-scoped database clients.
- [resources/no-leaked-resources](https://scruple.dev/rules/resources/no-leaked-resources.md): Disallow owned resources left unreleased.
- [resources/require-bounded-retries](https://scruple.dev/rules/resources/require-bounded-retries.md): Require a finite bound on retry behavior.
- [resources/require-cleanup-on-failure](https://scruple.dev/rules/resources/require-cleanup-on-failure.md): Require cleanup that is safe on failure.
- [resources/require-complete-resource-cleanup](https://scruple.dev/rules/resources/require-complete-resource-cleanup.md): Require complete cleanup of multiple resources.
- [resources/require-retry-backoff-with-jitter](https://scruple.dev/rules/resources/require-retry-backoff-with-jitter.md): Require retry backoff with jitter.
- [resources/require-retry-time-budget](https://scruple.dev/rules/resources/require-retry-time-budget.md): Require an overall deadline for retry work.
- [security/no-sensitive-data-exposure](https://scruple.dev/rules/security/no-sensitive-data-exposure.md): Disallow sensitive data sent through output sinks.
- [security/no-unsafe-redirect](https://scruple.dev/rules/security/no-unsafe-redirect.md): Disallow request-controlled redirect targets.
- [security/no-untrusted-command-execution](https://scruple.dev/rules/security/no-untrusted-command-execution.md): Disallow request data reaching command or code execution.
- [security/no-untrusted-mass-assignment](https://scruple.dev/rules/security/no-untrusted-mass-assignment.md): Disallow wholesale persistence of request objects.
- [security/no-user-controlled-authorization](https://scruple.dev/rules/security/no-user-controlled-authorization.md): Disallow authorization based on attacker-controlled claims.
- [tests/no-fixed-delay-synchronization](https://scruple.dev/rules/tests/no-fixed-delay-synchronization.md): Disallow sleeps used to synchronize tests.
- [tests/no-nondeterministic-tests](https://scruple.dev/rules/tests/no-nondeterministic-tests.md): Disallow uncontrolled inputs that make tests flaky.
- [tests/no-vacuous-tests](https://scruple.dev/rules/tests/no-vacuous-tests.md): Disallow tests with no effective behavior verification.
- [tests/require-specific-error-assertions](https://scruple.dev/rules/tests/require-specific-error-assertions.md): Require assertions that identify the expected failure.