Add cognitive complexity linting with baseline

[loks0n]

Summary

• add Slevomat's cognitive-complexity rule with a maximum of 20 for production code
• integrate the PHPCS scan into bin/monorepo check and the root toolchain
• baseline all 49 existing violations above 20 by file, class, function, and current value
• fail checks for new over-limit functions or increases above a baselined value
• add bin/monorepo complexity <name...> --generate-baseline for intentional baseline updates
• make complexity configuration changes fan out to all packages in CI and document the workflow

Initial findings

At the limit of 20, the cognitive-complexity baseline contains 49 violations across 18 packages. The largest concentrations are dns (10), vcs (7), and messaging (7).

Verification

• bin/monorepo complexity — passes with 49 existing violations ignored
• removed a baseline entry — corresponding cognitive-complexity violation failed as new
• verified every baseline value is strictly above 20
• composer validate --strict --no-check-publish
• php -l bin/monorepo
• xmllint --noout phpcs.xml
• bin/monorepo validate
• vale README.md CONTRIBUTING.md CLAUDE.md docs packages — 0 errors (7 existing advisory warnings)
• git diff --check

[abnegate]

Love the idea. In my experience complexity tools miss a lot of context, what do you think about making it non-fatal? Imagine you add one new method to a class and it overflows 20->21 functions, I don't think it should block a release. In most cases, it's a better solution than moving the method to a different scope or some other re-architecture

[loks0n]

Love the idea. In my experience complexity tools miss a lot of context, what do you think about making it non-fatal? Imagine you add one new method to a class and it overflows 20->21 functions, I don't think it should block a release. In most cases, it's a better solution than moving the method to a different scope or some other re-architecture

How to surface it without making it non-fatal?