Checks — How Checks Dispatch

[[checks]] is generic: the behavior is selected automatically by the command basename, so the same config surface covers every tool. Unknown commands run as a custom shell check.

Command Table

`command` basename	Behavior	Files
`clang-format`	In-place formatting; reports `Formatted`/`Clean` per file; exit `0` after applying fixes	once (batched), C/C++ only
`clang-tidy`	Static analysis; requires `.clang-tidy` or `--config-file=`	once (batched)
`gcc`, `g++`, `clang`, `clang++`, `cc`, `c++`	Syntax-only compile; `-fsyntax-only` forced unless `args` already set `-c`/`-S`/`-E`	per-file
`cppcheck`	Static analysis via cppcheck; batches all files	once (batched)
`gcc-analyzer`	GCC static analyzer (`-fanalyzer`)	per-file
`clang-static-analyzer`	Clang static analyzer	per-file
`include-what-you-use`, `iwyu`	Include-what-you-use analysis	per-file
`cmake`	Build command (e.g. `cmake --build build`); file list omitted	once
`git`	e.g. `git diff --check`; runs against the whole working tree; file list omitted	once
`metis-security`	Scans for hardcoded secrets (`password=`, `api_key=`, tokens, …); match fails the check	per-file
`metis-dep-security`	Vulnerability scan of dependencies via `osv-scanner` (falls back to `grype`); needs either installed	once
anything else	Custom shell command; file list appended	per-file (batched for `clang-format`, `clang-tidy`, `grep`, `egrep`, `rg`, `cppcheck`)

Notes

grep/rg exit codes are inverted: exit 0 (match found) fails the check, exit 1 (no match) passes.
clang-format always runs with -i (a user-supplied -i is stripped) and needs .clang-format or _clang-format, otherwise it fails before anything runs. Stage fixes with git add -u.
clang-tidy fails before execution if .clang-tidy is missing, unless args includes --config-file=<path>. A bare -- in args separates tidy options from compiler flags (e.g. args = ["--quiet", "--", "-std=c++20", "-Iinclude"]); source files are inserted between them.
compiler checks compile each file with -fsyntax-only, so no object files ever land in the repo.
Dispatch matches clang-format/clang-tidy/cmake/git by exact basename; clang-format-17 falls back to a custom shell check. Compilers are the exception: gcc-14 still routes to the compiler check.
timeout is validated but not yet enforced; severity is stored but does not yet change the exit code. ponytail: these are parsed but inert — wire them into the runner when enforcement is wanted.

Security Checks

Enable via metis init --enable-security-checks, which adds metis-security and metis-dep-security entries to .metis.toml.