enola-guides 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4da894ee2a8bbae62bfd0c91d741184cb544ab52c7daa172cc4d29d6760b0e88
-  data.tar.gz: 57a1e3127acc18cfae45d00e8d68d980ca5884dea25c0edd616fff96816b4c02
+  metadata.gz: df9b7b5b2b3fc6589f9353c4f2198b08283fe80fafd2dacda91dea2d66c5a2fb
+  data.tar.gz: 20172bf3167db5fb3d690d401f3313d38861d10f86f7010607c4ccae98353b68
 SHA512:
-  metadata.gz: 30fbd5e723192833b38e5e7108cdfab7dc48c8604a614c58a07c1d3c39c8fef2c3f4c941667fd67011fa93865d75891d0804479cbf79b909d3d42cad41c014c4
-  data.tar.gz: 8cb01c56994da025c7493b7c8e7ecfa9197b5f19a331c4722cbe9776e2a32d713514251ce1d6d0cae437b24707bf38b901682e0db101f20222281693833d5ba6
+  metadata.gz: f705dc88218a61a94d6261b624e6744d8fd14212e6524b062f2f9f9520751013968f4a208382861516265ac4ca41db11ca483e09acf52792120aa704f01251a0
+  data.tar.gz: 65b0c4c5cd94ca30b85d3528737489c83c0ff73b8a7b3402dd2d39c45742af8ca679cfaef2ec04ea8837e3ac5d92a1881960b2a7429df198e758ef7b7d8c8435

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.1.2 (2026-08-22)
+
+One law per file: the Rails shop, the cluster laws, the maintenance-task laws
+and the starter each put every law in a file of its own that declares the parts it
+speaks about, so a reader finds a law by its name and a reviewer sees one
+law per diff.
+
+## 0.1.1 (2026-08-22)
+
+The laws catalogue: `examples/laws/`, twenty-six complete declarations one
+directory each, nineteen proven by enola's benchmark suite and seven
+generalised from daily use (foreign keys, maintenance tasks, a public tool
+prefix, one door to a schema, readers that read the store only, cluster
+laws), each with a README and verified with `constraints lint`.
+
 ## 0.1.0 (2026-08-22)
 
 First content. Eight guides (start here, a Rails application, an Ember

data/README.md

@@ -18,11 +18,13 @@ gem contents enola-guides
 ## Start with an example
 
 [`examples/rails-shop`](examples/rails-shop): a Rails application declaring
-thirteen laws in the Ruby DSL, from "jobs never invoke controller code" to
+thirteen laws in the Ruby DSL, one file each, from "jobs never invoke controller code" to
 "billing keeps to its own tables" and "a mutating action is authorized",
 with Prism and Rubydex configured as providers beside the extractors.
 [`examples/ember-app`](examples/ember-app): an Ember application bound to
-the conventions recipe in one block.
+the conventions recipe in one block. [`examples/laws`](examples/laws/README.md):
+twenty-six laws, one directory each, from foreign keys on a tenant column
+to parts that may not cycle, each a complete declaration you copy and run.
 
 ## Guides
 

data/examples/laws/README.md

@@ -0,0 +1,32 @@
+# Laws, one directory each
+
+Every directory holds a complete declaration you can copy into a repository's
+`enola/` and run. Most are proven by enola's own benchmark suite; the rest are
+generalised from laws in daily use on a multi-repository estate.
+
+- [`governed-code`](governed-code/README.md): The knowledge pages compile into the graph as anchors, and a law demands that every file of a part has one.
+- [`rails-forbidden-names`](rails-forbidden-names/README.md): A naming convention phrased as a prohibition.
+- [`rails-mutations-are-authorized`](rails-mutations-are-authorized/README.md): The code behind a mutating route is selected by the route's method through the handled_by edge the Rails binder draws, and must reach a policy.
+- [`rails-request-boundaries`](rails-request-boundaries/README.md): The Rails laws a team actually writes.
+- [`rails-strict-arrangement`](rails-strict-arrangement/README.md): The strict Rails arrangement: the Rails laws, no circle among the parts, and concerns that stay independent of their includers.
+- [`clean-rings`](clean-rings/README.md): Four rings.
+- [`cqrs-queries-never-write`](cqrs-queries-never-write/README.md): A command-query split.
+- [`instantiation`](instantiation/README.md): What Ruby code constructs, as a fact.
+- [`mixins-stay-independent`](mixins-stay-independent/README.md): A module never reaches the classes that include it.
+- [`naming-conventions`](naming-conventions/README.md): Ruby naming conventions: no get_, set_ or is_ prefixes; a predicate ends in a question mark and has_ is fine.
+- [`one-owner-per-table`](one-owner-per-table/README.md): unique_across compares the members of different repositories; with the storage facts of one repository there is nobody to share a table with, so the rule refuses by name rather than reporting every table as unique.
+- [`paired-names`](paired-names/README.md): A naming pair: every with_ method has a without_ twin.
+- [`parts-never-cycle`](parts-never-cycle/README.md): Parts that may not depend on each other in a circle.
+- [`protocol-any-of`](protocol-any-of/README.md): A protocol satisfied by one of several methods.
+- [`public-surface`](public-surface/README.md): A path-defined public surface.
+- [`receiverless-request-api`](receiverless-request-api/README.md): A literal far end narrowed to receiver-less calls.
+- [`resolved-ancestry`](resolved-ancestry/README.md): Ancestry a provider resolved, and a component selected by it.
+- [`routes-have-consumers`](routes-have-consumers/README.md): A law across repositories refuses by name inside one.
+- [`storage-stays-home`](storage-stays-home/README.md): A part keeps to the tables it owns.
+- [`vanilla-rails-stays-empty`](vanilla-rails-stays-empty/README.md): Plain Rails: the extra directories must stay empty, each with a stated reason.
+- [`foreign-keys`](foreign-keys/README.md): A foreign-key law reads the storage facts the schema yields: every table carrying a tenant column must declare the foreign key to the tenant table.
+- [`maintenance-tasks`](maintenance-tasks/README.md): Two laws for a maintenance-tasks directory: a naming convention the runner depends on, and a boundary against controller code that has no request to read.
+- [`public-tool-prefix`](public-tool-prefix/README.md): A naming law on an externally exposed surface: every class in the public tools directory carries the prefix, so the surface stays greppable and a public class can never shadow an internal one.
+- [`one-door`](one-door/README.md): A boundary with one sanctioned crossing: controllers may not reach the GraphQL schema, except the single execute action, named as an exemption with its owner and reason so the carve-out is a decision and not a hole.
+- [`readers-read-the-store-only`](readers-read-the-store-only/README.md): The allow form: a part's calls may land only in the named parts.
+- [`cluster-laws`](cluster-laws/README.md): Laws that only a cluster snapshot can answer: a table owned by two repositories, mutating actions selected through the routes they handle, and routes no loaded client calls.

data/examples/laws/clean-rings/README.md

@@ -0,0 +1,10 @@
+# clean rings
+
+Four rings. An entity that calls a use case and a use case that calls an
+adapter both point outward; the controller calling inward is the direction the
+arrangement allows. The shipped clean recipe names the two outward reaches.
+
+Declaration: `enola/constraints/clean.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/clean-rings/enola/constraints/clean.yaml

@@ -0,0 +1,8 @@
+use_recipe:
+  - recipe: clean
+    as: clean
+    bind:
+      frameworks: { match: ["app/controllers/**"] }
+      interface-adapters: { match: ["app/adapters/**"] }
+      use-cases: { match: ["app/use_cases/**"] }
+      entities: { match: ["app/entities/**"] }

data/examples/laws/cluster-laws/README.md

@@ -0,0 +1,9 @@
+# cluster laws
+
+Laws that only a cluster snapshot can answer: a table owned by two
+repositories, mutating actions selected through the routes they handle, and
+routes no loaded client calls. Each refuses by name in a single-repository
+snapshot rather than reporting silence as compliance.
+
+One file per law under `enola/constraints/`, each file declaring the parts it speaks about. Copy it, run `enola constraints lint .`,
+then `enola --generate . && enola check .`.

data/examples/laws/cluster-laws/enola/constraints/a-mutating-action-is-authorized.rb

@@ -0,0 +1,10 @@
+Enola.architecture "platform" do
+  part :mutating_actions, service: :backend, files: "app/controllers/**", handles: [:post, :put, :patch, :delete]
+  part :policies, service: :backend, files: "app/policies/**"
+
+  law "a mutating action is authorized" do
+    mutating_actions.must_reach :policies
+    why "an action behind a POST, PUT, PATCH or DELETE route changes state, and the policy call is the one place the change is authorized"
+    mode :advisory
+  end
+end

data/examples/laws/cluster-laws/enola/constraints/every-api-route-has-a-consumer.rb

@@ -0,0 +1,9 @@
+Enola.architecture "platform" do
+  part :api, service: :backend, files: "config/**", kind: :route
+
+  law "every api route has a consumer" do
+    api.must_have_consumer
+    why "a route nobody calls is a surface nobody maintains"
+    mode :advisory
+  end
+end

data/examples/laws/cluster-laws/enola/constraints/one-owner-per-table.rb

@@ -0,0 +1,9 @@
+Enola.architecture "platform" do
+  part :tables, files: "app/models/**", kind: :storage
+
+  law "one owner per table" do
+    tables.must_be_unique_across by: :table
+    why "a table two repositories both model is written by two codebases that never see each other's validations or callbacks"
+    mode :advisory
+  end
+end

data/examples/laws/cqrs-queries-never-write/README.md

@@ -0,0 +1,11 @@
+# cqrs queries never write
+
+A command-query split. A query that calls update_all writes; a read model that
+issues a command is a feedback loop; a query that only counts is clean. The
+shipped cqrs recipe names the two breaches by the mutating method and the
+command reached.
+
+Declaration: `enola/constraints/cqrs.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/cqrs-queries-never-write/enola/constraints/cqrs.yaml

@@ -0,0 +1,7 @@
+use_recipe:
+  - recipe: cqrs
+    as: cqrs
+    bind:
+      commands: { match: ["app/commands/**"] }
+      queries: { match: ["app/queries/**"] }
+      read-models: { match: ["app/read_models/**"] }

data/examples/laws/foreign-keys/README.md

@@ -0,0 +1,10 @@
+# foreign keys
+
+A foreign-key law reads the storage facts the schema yields: every table
+carrying a tenant column must declare the foreign key to the tenant table. The
+require form verdicts what a member fact carries, with a when antecedent
+narrowing to the tables the law is about, so a table without the column is
+never asked.
+
+Declaration under `enola/constraints/`. Copy it, run `enola constraints lint .`,
+then `enola --generate . && enola check .`.

data/examples/laws/foreign-keys/enola/constraints/foreign-keys.yaml

@@ -0,0 +1,12 @@
+components:
+  - name: tables
+    match: ["db/structure.sql", "db/schema.rb", "app/models/**"]
+    kind: storage
+
+rules:
+  - id: account-fk
+    require: tables
+    when_prop_contains: { prop: columns, value: account_id }
+    must_prop_contain: { prop: fk_constraints, value: "account_id->accounts" }
+    mode: advisory
+    because: "A table carrying account_id references an account, so the database should say so with a foreign key. Advisory while a backfill path that ships the column before the constraint is reconciled with the rule; the verdict names every table that carries the column without the key."

data/examples/laws/governed-code/README.md

@@ -0,0 +1,11 @@
+# governed code
+
+The knowledge pages compile into the graph as anchors, and a law demands that
+every file of a part has one. The charge service is anchored by the decision
+page; the refund service is not, and is named. Without any compiled page the
+rule would refuse rather than call everything ungoverned.
+
+Declaration: `enola/constraints/governance.rb`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/governed-code/enola/constraints/governance.rb

@@ -0,0 +1,8 @@
+Enola.architecture "shop" do
+  part :billing, files: "app/billing/**"
+
+  law "billing is governed" do
+    billing.must_be_governed
+    why "code under a decision needs the page that decided it"
+  end
+end

data/examples/laws/instantiation/README.md

@@ -0,0 +1,14 @@
+# instantiation
+
+What Ruby code constructs, as a fact. `new` on a literal constant is an
+instantiates relation from the calling member to the class, which is the one
+call whose result has a knowable type; `new` on a variable receiver names no
+class and records nothing. A construction whose result is immediately sent a
+message is the one-shot ceremony, named on the calling member as Class.method,
+so a component can select the members that perform it and a rule can forbid
+it. A construction bound to a local first is not the ceremony.
+
+Declaration: `enola/constraints/ceremony.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/instantiation/enola/constraints/ceremony.yaml

@@ -0,0 +1,11 @@
+components:
+  - name: one-shot-builders
+    kind: symbol
+    match: ["app/services/**"]
+    where:
+      one_shot_call: "Payments::Charge.call"
+
+rules:
+  - id: no-one-shot-charge
+    forbid_fact: one-shot-builders
+    because: "a charge is built and called in one breath, so nobody can hold it to test it"

data/examples/laws/maintenance-tasks/README.md

@@ -0,0 +1,9 @@
+# maintenance tasks
+
+Two laws for a maintenance-tasks directory: a naming convention the runner
+depends on, and a boundary against controller code that has no request to
+read. Both were mined from a codebase where they already held, which is the
+right moment to declare a law.
+
+One file per law under `enola/constraints/`, each file declaring the parts it speaks about. Copy it, run `enola constraints lint .`,
+then `enola --generate . && enola check .`.

data/examples/laws/maintenance-tasks/enola/constraints/a-maintenance-task-never-invokes-controller-code.rb

@@ -0,0 +1,9 @@
+Enola.architecture "app" do
+  part :tasks, files: "app/tasks/**"
+  part :controllers, files: "app/controllers/**"
+
+  law "a maintenance task never invokes controller code" do
+    tasks.must_not_call controllers
+    why "a task runs from the runner or the console with no request around it, so controller code reached from one has nothing to read"
+  end
+end

data/examples/laws/maintenance-tasks/enola/constraints/every-maintenance-task-lives-in-the-maintenance-namespace.rb

@@ -0,0 +1,8 @@
+Enola.architecture "app" do
+  part :maintenance_tasks, files: "app/tasks/**", kind: :symbol, where: { symbol_kind: "class" }
+
+  law "every maintenance task lives in the Maintenance namespace" do
+    maintenance_tasks.names_must_match "Maintenance::*"
+    why "the task runner resolves task constants from that namespace, so a task declared outside it never appears in the runner and cannot be run by anyone"
+  end
+end

data/examples/laws/mixins-stay-independent/README.md

@@ -0,0 +1,11 @@
+# mixins stay independent
+
+A module never reaches the classes that include it. Taggable calls Post, which
+includes it; Auditable calls Ledger, which does not. Who includes whom comes
+from the resolved ancestry the rubydex provider emits, so the rule refuses
+with a named cause on a snapshot without it and names Taggable on one with it.
+
+Declaration: `enola/constraints/concerns.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/mixins-stay-independent/enola/constraints/concerns.yaml

@@ -0,0 +1,9 @@
+components:
+  - name: concerns
+    match: ["app/models/concerns/**"]
+    kind: symbol
+    where: { symbol_kind: interface }
+rules:
+  - id: mixins-stay-independent
+    independent: concerns
+    because: "a mixin that knows its includer is half a class in hiding"

data/examples/laws/naming-conventions/README.md

@@ -0,0 +1,10 @@
+# naming conventions
+
+Ruby naming conventions: no get_, set_ or is_ prefixes; a predicate ends in a
+question mark and has_ is fine. Three offenders and two clean names in one
+class.
+
+Declaration: `enola/constraints/naming.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/naming-conventions/enola/constraints/naming.yaml

@@ -0,0 +1,5 @@
+use_recipe:
+  - recipe: ruby-conventions
+    as: ruby
+    bind:
+      code: { match: ["app/**"], kind: symbol, where: { symbol_kind: method } }

data/examples/laws/one-door/README.md

@@ -0,0 +1,8 @@
+# one door
+
+A boundary with one sanctioned crossing: controllers may not reach the GraphQL
+schema, except the single execute action, named as an exemption with its owner
+and reason so the carve-out is a decision and not a hole.
+
+Declaration under `enola/constraints/`. Copy it, run `enola constraints lint .`,
+then `enola --generate . && enola check .`.

data/examples/laws/one-door/enola/constraints/one-door.yaml

@@ -0,0 +1,18 @@
+components:
+  - name: controllers
+    match: ["app/controllers/**"]
+  - name: schema
+    match: ["app/graphql/**"]
+
+rules:
+  - id: controllers-reach-the-schema-through-one-door
+    forbid: controllers
+    to: schema
+    via: calls
+    mode: advisory
+    exempt:
+      - witness: "Api::GraphqlController#execute -> AppSchema.execute via calls"
+        owner: platform
+        since: "2026-08-22"
+        because: "the one sanctioned entry point"
+    because: "Controllers reach the schema through exactly one door, the execute action; every other controller stays out of it. A second door is a second place to forget authentication."

data/examples/laws/one-owner-per-table/README.md

@@ -0,0 +1,12 @@
+# one owner per table
+
+unique_across compares the members of different repositories; with the storage
+facts of one repository there is nobody to share a table with, so the rule
+refuses by name rather than reporting every table as unique. The verdict that
+names two owners needs the cluster, which the harness measures per repository
+by design.
+
+Declaration: `enola/constraints/tables.rb`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/one-owner-per-table/enola/constraints/tables.rb

@@ -0,0 +1,8 @@
+Enola.architecture "shop" do
+  part :tables, files: "app/models/**", kind: :storage
+
+  law "one owner per table" do
+    tables.must_be_unique_across by: :table
+    why "two writers to one table disagree in the end"
+  end
+end

data/examples/laws/paired-names/README.md

@@ -0,0 +1,9 @@
+# paired names
+
+A naming pair: every with_ method has a without_ twin. with_history has its
+twin, with_guests does not, archive is outside the pattern and never asked.
+
+Declaration: `enola/constraints/pairs.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/paired-names/enola/constraints/pairs.yaml

@@ -0,0 +1,11 @@
+components:
+  - name: chat
+    match: ["app/chat/**"]
+    kind: symbol
+    where: { symbol_kind: method }
+rules:
+  - id: paired-scopes
+    require_name: chat
+    pattern: "with_*"
+    requires: "without_*"
+    because: "a reader who finds with_ expects without_ beside it"

data/examples/laws/parts-never-cycle/README.md

@@ -0,0 +1,12 @@
+# parts never cycle
+
+Parts that may not depend on each other in a circle. Jobs reach models and
+models reach jobs, so the two form a cycle at the part level; mailers sit
+downstream of models only. The rule contracts the module graph to one node per
+declared part, admits the symbol-rollup edges Ruby has, and names the circle;
+the downstream part is not in it.
+
+Declaration: `enola/constraints/cycles.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/parts-never-cycle/enola/constraints/cycles.yaml

@@ -0,0 +1,12 @@
+components:
+  - name: jobs
+    match: ["app/jobs/**"]
+  - name: models
+    match: ["app/models/**"]
+  - name: mailers
+    match: ["app/mailers/**"]
+rules:
+  - id: parts-never-cycle
+    forbid_cycles: jobs
+    among: [models, mailers]
+    because: "parts that reach each other in a circle cannot be taken apart"

data/examples/laws/protocol-any-of/README.md

@@ -0,0 +1,10 @@
+# protocol any of
+
+A protocol satisfied by one of several methods. Charge defines call, Refund
+defines run, Reconcile defines neither; any_of accepts either door and names
+the class with none, listing what would have satisfied it.
+
+Declaration: `enola/constraints/entry.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/protocol-any-of/enola/constraints/entry.yaml

@@ -0,0 +1,8 @@
+components:
+  - name: services
+    match: ["app/services/**"]
+rules:
+  - id: entry-point
+    require_defines: services
+    any_of: [call, run]
+    because: "a service answers to one of two doors; a class with neither is one nobody can invoke"

data/examples/laws/public-surface/README.md

@@ -0,0 +1,11 @@
+# public surface
+
+A path-defined public surface. Ruby has no visibility keyword the extractor
+can read at the file level, so a component names the files that are its public
+surface; reaching a public file from outside is fine and reaching an internal
+one is the breach.
+
+Declaration: `enola/constraints/surface.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/public-surface/enola/constraints/surface.yaml

@@ -0,0 +1,10 @@
+components:
+  - name: billing
+    match: ["app/billing/**"]
+    public: ["app/billing/public/**"]
+  - name: orders
+    match: ["app/orders/**"]
+rules:
+  - id: billing-surface
+    private: billing
+    because: "billing is reached through its public files; the rest is implementation"

data/examples/laws/public-tool-prefix/README.md

@@ -0,0 +1,8 @@
+# public tool prefix
+
+A naming law on an externally exposed surface: every class in the public tools
+directory carries the prefix, so the surface stays greppable and a public
+class can never shadow an internal one.
+
+Declaration under `enola/constraints/`. Copy it, run `enola constraints lint .`,
+then `enola --generate . && enola check .`.

data/examples/laws/public-tool-prefix/enola/constraints/public-tools.rb

@@ -0,0 +1,8 @@
+Enola.architecture "app" do
+  part :public_tools, files: "app/public_tools/**", kind: :symbol, where: { symbol_kind: "class" }
+
+  law "public tools carry the Public prefix" do
+    public_tools.names_must_match "Public*"
+    why "an externally exposed tool class is greppable by its prefix and cannot shadow an internal one"
+  end
+end

data/examples/laws/rails-forbidden-names/README.md

@@ -0,0 +1,14 @@
+# rails forbidden names
+
+A naming convention phrased as a prohibition. require_name demands a pattern
+and has no negative, so "no get_ prefixes on a model's public surface" could
+not be declared. forbid_name takes the same bounded pattern dialect, tries it
+against a method's bare name after its owner, and with surface: exported
+judges the public surface only: the exported get_total is the breach, the
+private get_lines is not the convention's surface, and total is outside the
+pattern.
+
+Declaration: `enola/constraints/naming.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/rails-forbidden-names/enola/constraints/naming.yaml

@@ -0,0 +1,13 @@
+components:
+  - name: model-methods
+    kind: symbol
+    match: ["app/models/**"]
+    where:
+      symbol_kind: method
+
+rules:
+  - id: no-getter-prefixes
+    forbid_name: model-methods
+    pattern: "get_*"
+    surface: exported
+    because: "a reader is a noun; get_ says the class is a bag of fields"

data/examples/laws/rails-mutations-are-authorized/README.md

@@ -0,0 +1,11 @@
+# rails mutations are authorized
+
+The code behind a mutating route is selected by the route's method through the
+handled_by edge the Rails binder draws, and must reach a policy. create does
+and update does not; index handles a GET and is never asked. The handles key
+is what lets the law speak about routes without naming a single action.
+
+Declaration: `enola/constraints/authorization.rb`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/rails-mutations-are-authorized/enola/constraints/authorization.rb

@@ -0,0 +1,9 @@
+Enola.architecture "shop" do
+  part :mutating_actions, files: "app/controllers/**", handles: [:post, :put, :patch, :delete]
+  part :policies, files: "app/policies/**"
+
+  law "a mutating action is authorized" do
+    mutating_actions.must_reach :policies
+    why "every write passes a policy before it touches a record"
+  end
+end

data/examples/laws/rails-request-boundaries/README.md

@@ -0,0 +1,12 @@
+# rails request boundaries
+
+The Rails laws a team actually writes. A model reads session and calls a
+helper; a service reads params; another service calls only itself. The shipped
+rails-conventions recipe, with its optional helpers and services roles bound,
+names the model's helper call, the model's session read and the service's
+params read, and leaves the clean service alone.
+
+Declaration: `enola/constraints/rails.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/rails-request-boundaries/enola/constraints/rails.yaml

@@ -0,0 +1,13 @@
+use_recipe:
+  - recipe: rails-conventions
+    as: rails
+    bind:
+      controllers: { match: ["app/controllers/**"] }
+      jobs: { match: ["app/jobs/**"] }
+      models: { match: ["app/models/**"] }
+      mailers: { match: ["app/mailers/**"] }
+      policies: { match: ["app/policies/**"] }
+      serializers: { match: ["app/serializers/**"] }
+      view-components: { match: ["app/components/**"] }
+      helpers: { match: ["app/helpers/**"] }
+      services: { match: ["app/services/**"] }

data/examples/laws/rails-strict-arrangement/README.md

@@ -0,0 +1,10 @@
+# rails strict arrangement
+
+The strict Rails arrangement: the Rails laws, no circle among the parts, and
+concerns that stay independent of their includers. Jobs and models reach each
+other, which is the circle; Taggable reaches Invoice, which includes it.
+
+Declaration: `enola/constraints/strict.yaml`.
+
+Verify it on your own tree: copy `enola/` into the repository, run
+`enola constraints lint .`, then `enola --generate . && enola check .`.

data/examples/laws/rails-strict-arrangement/enola/constraints/strict.yaml

@@ -0,0 +1,12 @@
+use_recipe:
+  - recipe: rails-strict
+    as: strict
+    bind:
+      controllers: { match: ["app/controllers/**"] }
+      jobs: { match: ["app/jobs/**"] }
+      models: { match: ["app/models/**"] }
+      mailers: { match: ["app/mailers/**"] }
+      policies: { match: ["app/policies/**"] }
+      serializers: { match: ["app/serializers/**"] }
+      view-components: { match: ["app/components/**"] }
+      concerns: { match: ["app/models/concerns/**"], kind: symbol, where: { symbol_kind: interface } }

data/examples/laws/readers-read-the-store-only/README.md

@@ -0,0 +1,7 @@
+# readers read the store only
+
+The allow form: a part's calls may land only in the named parts. Here readers
+that must stay replayable may reach the store and nothing else.
+
+Declaration under `enola/constraints/`. Copy it, run `enola constraints lint .`,
+then `enola --generate . && enola check .`.

data/examples/laws/readers-read-the-store-only/enola/constraints/readers.yaml

@@ -0,0 +1,13 @@
+components:
+  - name: readers
+    match: ["internal/readers/**"]
+  - name: store
+    match: ["internal/store/**"]
+
+rules:
+  - id: readers-read-the-store-only
+    allow: readers
+    only: [store]
+    via: calls
+    mode: advisory
+    because: "A reader derives its answer from the store alone, which is what keeps every reader replayable against a snapshot; a reader that reaches anything else answers differently on a different machine."