@afokapu/atdd-bun 0.1.0

package/planner-nodes/nodes/planner.theme.must-be-canonical.convention.yaml

@@ -0,0 +1,38 @@
+schema_version: 1.1.0
+rule_id: planner.theme.must-be-canonical
+kind: rule
+status: active
+name: Theme must be repository-declared
+statement: Every wagon, train, interlocking, and contract theme MUST resolve to a value in the
+  repository-owned plan/_themes.yaml registry. The package provides no default taxonomy.
+implementation:
+  type: validator
+  ref: planner.static.validators.bun
+source:
+  legacy_path: src/atdd/planner/conventions/theme.convention.yaml
+  legacy_section: rules
+  legacy_sha: 2ae106d04d77b06e
+  extraction_mode: high_fidelity
+  legacy_rule_id: planner.theme.must-be-canonical
+content:
+  normative_text: A repository may choose any kebab-case name except that index 0 is reserved
+    for commons. An undeclared theme is a plan error, not a package-default lookup.
+metadata:
+  aliases:
+  - PLANNER-THEME-CANONICAL-001
+  severity: 3
+  disposition: strict
+parity:
+  source_fragments_preserved: true
+  examples_preserved: false
+  implementation_preserved: true
+  fix_hint_preserved: false
+  reviewed_at: '2026-06-16'
+terms:
+- term_id: canonical_resolution
+  text: a theme resolving to a value in plan/_themes.yaml.
+  values:
+    source: plan/_themes.yaml
+    package_defaults: none
+    consumer_repo: declares its own names
+notes: The package never supplies a game or toolkit vocabulary.

package/planner-nodes/nodes/planner.theme.theme-zero-mandatory.convention.yaml

@@ -0,0 +1,39 @@
+schema_version: 1.1.0
+rule_id: planner.theme.theme-zero-mandatory
+kind: constraint
+status: active
+name: Theme zero is mandatory
+statement: 'plan/_themes.yaml MUST declare commons at theme index 0. Repositories may add any
+  valid theme at other indexes, but may not replace or remove the commons floor.'
+implementation:
+  type: validator
+  ref: planner.static.validators.bun
+source:
+  legacy_path: src/atdd/planner/conventions/theme.convention.yaml
+  legacy_section: rules + taxonomy.theme_zero_token
+  legacy_sha: 2ae106d04d77b06e
+  extraction_mode: high_fidelity
+  legacy_rule_id: planner.theme.theme-zero-mandatory
+content:
+  normative_text: The repository-owned map is authoritative. It has no package-supplied entries
+    except its required index-0 value, commons.
+metadata:
+  aliases:
+  - PLANNER-THEME-ZERO-001
+  severity: 4
+  # 'block' was a pre-existing authoring error (it is the gate BEHAVIOR that
+  # `strict` maps to, not a disposition value — schema enum is strict/
+  # suppress-and-clean/advisory/documentation-only). Corrected to strict (#1225).
+  disposition: strict
+parity:
+  source_fragments_preserved: true
+  examples_preserved: false
+  implementation_preserved: true
+  fix_hint_preserved: false
+  reviewed_at: '2026-06-16'
+terms:
+- term_id: resolved_theme_set
+  text: the theme map declared in plan/_themes.yaml.
+  values:
+    floor: commons at digit 0
+    removable: false

package/planner-nodes/nodes/planner.theme.urn-namespace-matches.convention.yaml

@@ -0,0 +1,34 @@
+schema_version: 1.1.0
+rule_id: planner.theme.urn-namespace-matches
+kind: rule
+status: active
+name: URN theme-prefix matches wagon theme
+statement: A themed wagon's produced artifact, contract, and telemetry identity prefix MUST equal
+  the wagon theme.
+implementation:
+  type: validator
+  ref: planner.static.validators.bun
+source:
+  legacy_path: src/atdd/planner/conventions/theme.convention.yaml
+  legacy_section: rules
+  legacy_sha: 2ae106d04d77b06e
+  extraction_mode: high_fidelity
+  legacy_rule_id: planner.theme.urn-namespace-matches
+content:
+  normative_text: This is namespace consistency only. It makes no claim about runtime module
+    ownership, agent roles, or domain vocabulary.
+metadata:
+  aliases:
+  - PLANNER-THEME-URN-001
+  severity: 3
+  disposition: strict
+parity:
+  source_fragments_preserved: true
+  examples_preserved: false
+  implementation_preserved: true
+  fix_hint_preserved: false
+  reviewed_at: '2026-06-16'
+terms:
+- term_id: urn_theme_prefix
+  text: the leading theme segment of a produced URN, which must equal the wagon theme.
+notes: A wagon without a declared theme is not subject to this cross-field predicate.

package/planner-nodes/nodes/planner.train.acceptance-commit-failures-covered.convention.yaml

@@ -0,0 +1,10 @@
+schema_version: 1.1.0
+rule_id: planner.train.acceptance-commit-failures-covered
+kind: rule
+status: draft
+name: Acceptance commit failures covered
+statement: Every platform:acceptance:commit-failure.cause (version_conflict, authorization_refused, idempotency_conflict, authority_unavailable) MUST be reachable, registered in the dispatch graph, resolvable, and terminating - or an explicit tracked-and-expiring deferral. Pending binding - validator owned by D5 (#1089).
+terms:
+- term_id: commit_failure_coverage
+  label: Commit-failure coverage
+  text: the four acceptance commit-failure causes are each reachable+resolvable+terminating, extending coverage to the Acceptance Authority boundary.

package/planner-nodes/nodes/planner.train.acceptances.convention.yaml

@@ -0,0 +1,85 @@
+schema_version: 1.1.0
+rule_id: planner.train.acceptances
+kind: rule
+status: active
+name: Train-level acceptances
+statement: A train may carry an optional acceptances block (WMBT acceptance shape);
+  each contributes a derived repo rule via the rule-binding walker.
+terms:
+- term_id: train_acceptance
+  text: an optional train-level acceptance.
+  values:
+    rule_id_derivation: acc:<train-id>:<slug> -> repo.<train-id>.acc-<slug>
+- term_id: authorable_example
+  label: The copy-paste train acceptance
+  text: "The exact train-level acceptance a human copies when authoring one. It must\
+    \ satisfy the acc URN grammar, parse as a valid typed-train parent, and validate\
+    \ against the train schema's acceptance definition \u2014 #1548 was exactly this\
+    \ exemplar carrying the URN scheme retired by #1421, so following the documentation\
+    \ produced an invalid artifact."
+  values:
+    acceptance:
+      identity:
+        urn: acc:train:self-compliance:validate-lifecycle:idempotent-on-retry
+        id: AC-SMOKE-001
+        purpose: Re-running the train with the same idempotency key produces no duplicate
+          side effects
+        phase: SMOKE
+      harness:
+        type: e2e
+      signal:
+        metric: duplicate_side_effects_on_retry
+        threshold: 0
+notes: "#1548: the node declared four constraints and bound nothing \u2014 no implementation,\
+  \ no validation block. It is now enforced by a real validator whose every constraint\
+  \ has a fault-injection test, because the real-repo baseline is 0 only for want\
+  \ of data (16 trains, 0 with acceptances; #1551 backfills), and a clean baseline\
+  \ over an empty selection proves nothing. #1639: the authorable exemplar moved here\
+  \ from the deleted train.convention.yaml monolith."
+implementation:
+  type: validator
+  ref: test_train_acceptances_wellformed::test_train_acceptances_are_wellformed
+source:
+  legacy_path: src/atdd/planner/conventions/train.convention.yaml
+  legacy_section: acceptances
+  legacy_sha: 825602729f11a3a4
+  extraction_mode: high_fidelity
+content:
+  normative_text: "rule_id derivation (spec v12 \xA73.3): acc:<train-id>:<slug> ->\
+    \ repo.<train-id>.acc-<slug>. Walker: atdd.coach.utils.rule_binding.find_repo_rules."
+  constraints:
+  - identity.urn matches URNBuilder.PATTERNS['acc'] (train-acceptance shape)
+  - identity.purpose populated (becomes RuleMetadata.description)
+  - identity.phase populated (RED|GREEN|SMOKE|REFACTOR)
+  - "EITHER harness.type OR (signal.metric AND signal.threshold) populated (measurability\
+    \ invariant \xA74.3)"
+  exceptions:
+  - "id: at acceptance-block top level (rule-id derives mechanically \u2014 see \xA7\
+    3.3)"
+  - "disposition: anywhere in repo YAML (walker sets to 'strict' per \xA74.4)"
+metadata:
+  severity: 3
+  disposition: strict
+parity:
+  source_fragments_preserved: true
+  examples_preserved: true
+  implementation_preserved: true
+  fix_hint_preserved: false
+  reviewed_at: '2026-07-29'
+validation:
+  family: presence
+  template: required_field_presence
+  variant: planner_train_acceptances_wellformed
+  phase: CONFIRM
+  enforcement: confirm-blocking
+  subject_kind: train_acceptance
+  selector: train files under plan/_trains/ (flat or subject-nested) declaring an
+    acceptances[] block
+  traversal: train file -> acceptances[] -> identity/harness/signal fields
+  invariant: identity.urn matches the acc grammar, purpose and phase are populated,
+    and the block is measurable via harness.type or signal.metric+threshold
+  failure_evidence:
+  - train_file
+  - acceptance_urn
+  - constraint
+  - detail

package/planner-nodes/nodes/planner.train.artifact-flow.convention.yaml

@@ -0,0 +1,31 @@
+schema_version: 1.1.0
+rule_id: planner.train.artifact-flow
+kind: rule
+status: active
+name: Train artifact flow
+statement: Artifacts flow between participants as {domain}:{resource}; they must be produced before consumed
+  and be defined in participant wagon manifests.
+source:
+  legacy_path: src/atdd/planner/conventions/train.convention.yaml
+  legacy_section: artifact_flow
+  legacy_sha: 825602729f11a3a4
+  extraction_mode: high_fidelity
+content:
+  examples:
+  - material:raw-story
+  - scenario:material.steps
+  - match:dilemma.current
+parity:
+  source_fragments_preserved: true
+  examples_preserved: true
+  implementation_preserved: false
+  fix_hint_preserved: false
+  reviewed_at: '2026-06-16'
+terms:
+- term_id: artifact
+  text: a domain:resource artifact in the flow.
+  values:
+    pattern: ^[a-z][a-z0-9-]*:[a-z][a-z0-9.-]*$
+    rules:
+    - produced before consumed
+    - defined in participant wagons

package/planner-nodes/nodes/planner.train.categories.convention.yaml

@@ -0,0 +1,34 @@
+schema_version: 1.1.0
+rule_id: planner.train.categories
+kind: family
+status: active
+name: Train test categories
+statement: "The category FIELD classifies a train as nominal, error, alternate, or exception. It is
+  metadata on the train, never encoded in its identity, so reclassifying a train
+  changes a field and not its name."
+source:
+  legacy_path: src/atdd/planner/conventions/train.convention.yaml
+  legacy_section: numbering.categories
+  legacy_sha: 825602729f11a3a4
+  extraction_mode: high_fidelity
+parity:
+  source_fragments_preserved: false
+  examples_preserved: true
+  implementation_preserved: false
+  fix_hint_preserved: false
+  reviewed_at: '2026-07-28'
+  divergence_note: >-
+    The four glosses are deliberately reworded away from the extraction (#1634).
+    The legacy numbering.categories section no longer exists in
+    train.convention.yaml, so this node is the sole definition and fidelity to
+    the retired source is no longer checkable. Value keys and the closed set are
+    unchanged.
+terms:
+- term_id: category
+  label: Test categories
+  text: name -> description. The four values of the train's `category` field.
+  values:
+    nominal: The intended journey - the domain runs to completion and returns the outcome the job exists to produce
+    error: Failure originating outside the modelled domain - the domain never ran, so no verdict exists and no domain postcondition holds; the identical request may succeed once the fault clears (crashes, collaborator unavailability, infrastructure faults)
+    alternate: A different in-domain route to a successful outcome - another input mode, channel, configuration or persona; still a success, not a failure
+    exception: An in-domain refusal - the domain ran, evaluated the request and rendered a negative verdict, so the refusal is the business rule working; the identical request is refused identically on retry (validation failures, business rule violations, policy denials)

package/planner-nodes/nodes/planner.train.definition.convention.yaml

@@ -0,0 +1,34 @@
+schema_version: 1.1.0
+rule_id: planner.train.definition
+kind: family
+status: draft
+name: Train — advisory semantic anchor
+statement: A train is an executable end-to-end system/user journey — a strictly-linear,
+  ordered sequence of steps that moves artifacts across a set of wagons from a declared
+  initial input to exactly one terminal contract, telling ONE coherent journey. This
+  is a planner domain-decomposition artifact naming WHAT journey the domain must support;
+  how the journey is run and whether it holds state at runtime are coder/tester concerns.
+  This node is an advisory semantic anchor — it enforces nothing directly; the enforceable
+  parts of this meaning are decomposed into the constraint/rule nodes that require it.
+terms:
+- term_id: semantic_anchor
+  label: Advisory semantic anchor
+  text: a definitional node that gives the artifact a stable meaning but is not itself
+    bound to a validator; it is transitively protected by the enforceable constraint/rule
+    nodes that require it.
+- term_id: train
+  label: Train
+  text: train -> {executable, linear, single-outcome, wagon-composed, initial-input,
+    single-terminal-contract}.
+  values:
+    executable: an end-to-end journey the domain can run, not a fragment.
+    linear: strictly sequential steps, no loops/routes/branching (see planner.train.linearity).
+    single-outcome: tells ONE coherent journey, 2 min / 3-7 sweet-spot wagons (see
+      planner.train.scope).
+    wagon-composed: an ordered sequence of steps between declared participants (see
+      planner.train.sequence, planner.train.participants).
+    initial-input: starts from a declared initial input and moves artifacts along (see
+      planner.train.initial-cargo-inputs-declared, planner.train.artifact-flow).
+    single-terminal-contract: the terminal step declares exactly one primary artifact,
+      the source of truth for family (see planner.train.terminal-contract, planner.train.family,
+      planner.train.family-matches-terminal-contract).

package/planner-nodes/nodes/planner.train.dependencies.convention.yaml

@@ -0,0 +1,28 @@
+schema_version: 1.1.0
+rule_id: planner.train.dependencies
+kind: rule
+status: active
+name: Train dependencies
+statement: A train references prerequisite trains as train:{train_id}; foundation (commons) trains often
+  precede others; data-flow consumers depend on producers; circular dependencies are forbidden.
+source:
+  legacy_path: src/atdd/planner/conventions/train.convention.yaml
+  legacy_section: dependencies
+  legacy_sha: 825602729f11a3a4
+  extraction_mode: high_fidelity
+content:
+  examples:
+  - train:00-auth-session before train:30-match-solo (foundation_first)
+  - train:30-match-solo depends on train:21-scenario-curation (data_flow)
+parity:
+  source_fragments_preserved: true
+  examples_preserved: true
+  implementation_preserved: false
+  fix_hint_preserved: false
+  reviewed_at: '2026-06-16'
+terms:
+- term_id: dependency
+  text: a prerequisite train reference.
+  values:
+    pattern: ^train:[0-9]{2}-[a-z][a-z0-9-]*$
+    circular: forbidden

package/planner-nodes/nodes/planner.train.dispatch-composite-key-exceptional.convention.yaml

@@ -0,0 +1,17 @@
+schema_version: 1.0.0
+rule_id: planner.train.dispatch-composite-key-exceptional
+kind: rule
+status: draft
+statement: 'A composite (artifact_urn, discriminant) -> train_id dispatch key is exceptional:
+  permitted only with a behavioral_difference justification, discriminant exactly
+  one field:value.'
+terms:
+- term_id: composite_key
+  text: ''
+implementation:
+  type: validator
+  ref: conventions/schema/test_dispatch_map_is_registry::test_fault_caught_by_convention
+metadata:
+  severity: 3
+  disposition: strict
+  introduced_in: 3.127.0

package/planner-nodes/nodes/planner.train.dispatch-map-is-registry.convention.yaml

@@ -0,0 +1,17 @@
+schema_version: 1.0.0
+rule_id: planner.train.dispatch-map-is-registry
+kind: rule
+status: draft
+statement: The divergence dispatch map is a declared, schema-valid registry (artifact_urn
+  -> train_id) that the Station Master reads; routing is never an imperative in-code
+  map.
+terms:
+- term_id: dispatch_registry
+  text: ''
+implementation:
+  type: validator
+  ref: conventions/schema/test_dispatch_map_is_registry::test_fault_caught_by_convention
+metadata:
+  severity: 3
+  disposition: strict
+  introduced_in: 3.127.0

package/planner-nodes/nodes/planner.train.family-matches-terminal-contract.convention.yaml

@@ -0,0 +1,17 @@
+schema_version: 1.1.0
+rule_id: planner.train.family-matches-terminal-contract
+kind: rule
+status: draft
+name: Family matches terminal contract
+statement: The declared family MUST agree with the declared terminal contract - family:delivery iff the terminal requires an Acceptance Authority commit AND the terminal primary is platform:acceptance:commit-receipt; family:behavior otherwise; a missing family field is invalid. Pending binding - validator owned by D1 (#1085).
+terms:
+- term_id: family_consistency
+  label: Family consistency
+  text: declared family <-> declared terminal contract; controlled redundancy, not a second source of truth.
+implementation:
+  type: validator
+  ref: conventions/coherence/test_train_family_matches_terminal_contract::test_fault_injection
+metadata:
+  severity: 3
+  disposition: strict
+  introduced_in: 3.127.0

package/planner-nodes/nodes/planner.train.family.convention.yaml

@@ -0,0 +1,17 @@
+schema_version: 1.1.0
+rule_id: planner.train.family
+kind: family
+status: draft
+name: Train families
+statement: The family classifies a train as behavior or delivery, orthogonal to the variant category (0-3). The declared terminal contract is the source of truth; the family field is the validator-checked assertion and is never encoded in the train ID.
+rationale: Behavior trains express and exercise a capability (no authority commit); delivery trains govern accepted-system state via a durable Acceptance Authority commit. family and variant are two orthogonal classification axes (see #1083).
+terms:
+- term_id: family
+  label: Train families
+  text: train -> {family, definition}; family is orthogonal to the variant category (planner.train.categories, 0-3).
+  values:
+    behavior: Observe, exercise, classify, validate, recommend, or report a capability against a system under examination; produces no authority commit.
+    delivery: Govern accepted-system state through a durable Acceptance Authority commit; the declared terminal contract returns a platform:acceptance:commit-receipt.
+- term_id: family_source_of_truth
+  label: Terminal-contract source of truth
+  text: family is derived from the declared terminal contract -- requires an Acceptance Authority commit and terminates in platform:acceptance:commit-receipt => delivery, otherwise behavior. The family field is a mandatory, validator-checked assertion (planner.train.family-matches-terminal-contract), not a second source of truth, and is never an ID digit.

package/planner-nodes/nodes/planner.train.initial-cargo-inputs-declared.convention.yaml

@@ -0,0 +1,10 @@
+schema_version: 1.1.0
+rule_id: planner.train.initial-cargo-inputs-declared
+kind: rule
+status: draft
+name: Initial Cargo inputs declared
+statement: A train MUST declare every artifact Cargo may be seeded with - inputs.caller (caller-provided) and inputs.spec_materialized (deterministically materialized from the spec). Undeclared or missing required initial inputs are rejected before step 1. Pending binding - validator owned by D2 (#1086).
+terms:
+- term_id: initial_inputs
+  label: Declared initial inputs
+  text: inputs.{caller, spec_materialized}; seeded into Cargo and validated before the first wagon step.

package/planner-nodes/nodes/planner.train.interlocking-does-not-carry-cargo.convention.yaml

@@ -0,0 +1,28 @@
+schema_version: 1.0.0
+rule_id: planner.train.interlocking-does-not-carry-cargo
+kind: constraint
+status: active
+name: Interlocking does not carry cargo
+statement: Interlockings select routes and declare payload contract identities; they
+  must not contain Cargo runtime values or artifact data.
+terms:
+- term_id: no_cargo
+  text: interlockings select routes and declare payload contract identities; they
+    must not contain Cargo runtime values or artifact data
+implementation:
+  type: validator
+  ref: test_sequence_diagram_sanity::test_interlocking_schema_rejects_cargo_runtime_values
+metadata:
+  severity: 4
+  disposition: strict
+validation:
+  family: policy
+  template: forbidden_construct_absence
+  variant: planner_train_interlocking_does_not_carry_cargo
+  phase: CONFIRM
+  enforcement: confirm-blocking
+  subject_kind: interlocking
+  failure_evidence:
+  - interlocking_id
+  - field_path
+  - forbidden_value_kind

package/planner-nodes/nodes/planner.train.interlocking-entrypoint-shape.convention.yaml

@@ -0,0 +1,30 @@
+schema_version: 1.0.0
+rule_id: planner.train.interlocking-entrypoint-shape
+kind: rule
+status: active
+name: Interlocking entrypoint shape
+statement: Every interlocking declares whether it is runtime-exposed and which Station
+  Master actions are expected to reach it.
+terms:
+- term_id: entrypoint_shape
+  text: exposed:true requires actions>=1; exposed:false requires reason; actions are
+    Station Master action names not train IDs; planner validates shape only
+implementation:
+  type: validator
+  ref: test_sequence_diagram_sanity::test_interlocking_entrypoint_shape_valid
+metadata:
+  severity: 3
+  disposition: strict
+validation:
+  family: schema
+  template: required_field_presence
+  variant: planner_train_interlocking_entrypoint_shape
+  phase: CONFIRM
+  enforcement: confirm-blocking
+  subject_kind: interlocking
+  failure_evidence:
+  - interlocking_id
+  - exposed
+  - actions
+  - reason
+  - field_path

package/planner-nodes/nodes/planner.train.interlocking-fragment-acceptance-binding.convention.yaml

@@ -0,0 +1,30 @@
+schema_version: 1.0.0
+rule_id: planner.train.interlocking-fragment-acceptance-binding
+kind: constraint
+status: active
+name: Interlocking fragment acceptance binding
+statement: Every guarded alt/opt fragment binds to acceptance(s), and flow-branch
+  acceptances bind back to guards/fragments.
+terms:
+- term_id: fragment_binding
+  text: every guarded alt/opt fragment binds to acceptances and flow-branch acceptances
+    bind back to guards/fragments
+implementation:
+  type: validator
+  ref: test_sequence_diagram_sanity::test_guarded_fragments_bind_acceptances
+metadata:
+  severity: 4
+  disposition: strict
+validation:
+  family: coverage
+  template: source_has_required_target
+  variant: planner_train_interlocking_fragment_acceptance_binding
+  phase: CONFIRM
+  enforcement: confirm-blocking
+  subject_kind: interlocking
+  failure_evidence:
+  - interlocking_id
+  - fragment_id
+  - guard_id
+  - acceptance_ref
+  - missing_side

package/planner-nodes/nodes/planner.train.interlocking-guard-coverage.convention.yaml

@@ -0,0 +1,29 @@
+schema_version: 1.0.0
+rule_id: planner.train.interlocking-guard-coverage
+kind: constraint
+status: active
+name: Interlocking guard coverage
+statement: Every executable guard path in an interlocking maps to exactly one train
+  route, unless explicitly classified as structural residual.
+terms:
+- term_id: guard_coverage
+  text: each executable guard path maps to exactly one route, or is explicitly classified
+    as a structural residual
+implementation:
+  type: validator
+  ref: test_sequence_diagram_sanity::test_every_executable_guard_projects_to_train
+metadata:
+  severity: 4
+  disposition: strict
+validation:
+  family: coverage
+  template: projection_covers_source
+  variant: planner_train_interlocking_guard_coverage
+  phase: CONFIRM
+  enforcement: confirm-blocking
+  subject_kind: interlocking
+  failure_evidence:
+  - interlocking_id
+  - guard_id
+  - route_id
+  - coverage_status

package/planner-nodes/nodes/planner.train.interlocking-guard-grammar.convention.yaml

@@ -0,0 +1,31 @@
+schema_version: 1.0.0
+rule_id: planner.train.interlocking-guard-grammar
+kind: rule
+status: active
+name: Interlocking guard grammar
+statement: Interlocking guards are declarative, deterministic, side-effect-free expressions;
+  raw Python eval is forbidden.
+terms:
+- term_id: guard_grammar
+  text: allowed inputs are action/request inputs, explicit state snapshot, completed
+    TrainResult only at declared route boundaries; allowed operators are == != < <=
+    > >= and or not exists(field) in
+implementation:
+  type: validator
+  ref: test_sequence_diagram_sanity::test_interlocking_guard_grammar_is_safe
+metadata:
+  severity: 3
+  disposition: strict
+validation:
+  family: grammar
+  template: identifier_grammar_conformance
+  variant: planner_train_interlocking_guard_grammar
+  phase: CONFIRM
+  enforcement: confirm-blocking
+  subject_kind: interlocking
+  failure_evidence:
+  - interlocking_id
+  - guard_id
+  - expression
+  - invalid_token
+  - reason

package/planner-nodes/nodes/planner.train.interlocking-home.convention.yaml

@@ -0,0 +1,29 @@
+schema_version: 1.0.0
+rule_id: planner.train.interlocking-home
+kind: rule
+status: active
+name: Interlocking home
+statement: Interlocking artifacts live under plan/_trains/_interlockings/ and are
+  registered in plan/_trains/_interlockings.yaml.
+terms:
+- term_id: interlocking_home
+  text: interlocking artifacts live under plan/_trains/_interlockings/ with a registry
+    index at plan/_trains/_interlockings.yaml
+implementation:
+  type: validator
+  ref: test_sequence_diagram_sanity::test_interlocking_home_under_trains
+metadata:
+  severity: 3
+  disposition: strict
+validation:
+  family: presence
+  template: required_field_presence
+  variant: planner_train_interlocking_home
+  phase: CONFIRM
+  enforcement: confirm-blocking
+  subject_kind: interlocking
+  failure_evidence:
+  - interlocking_id
+  - path
+  - expected_home
+  - actual_home

package/planner-nodes/nodes/planner.train.interlocking-message-payload-typed.convention.yaml

@@ -0,0 +1,28 @@
+schema_version: 1.0.0
+rule_id: planner.train.interlocking-message-payload-typed
+kind: rule
+status: active
+name: Interlocking message payload typed
+statement: Every interlocking message declares a payload contract or an explicit no-payload
+  reason.
+terms:
+- term_id: payload_typed
+  text: each message declares payload.contract or payload.no_payload_reason
+implementation:
+  type: validator
+  ref: test_sequence_diagram_sanity::test_every_message_has_payload_contract_or_no_payload_reason
+metadata:
+  severity: 3
+  disposition: strict
+validation:
+  family: presence
+  template: conditional_requirement
+  variant: planner_train_interlocking_message_payload_typed
+  phase: CONFIRM
+  enforcement: confirm-blocking
+  subject_kind: interlocking
+  failure_evidence:
+  - interlocking_id
+  - message_id
+  - payload
+  - reason

package/planner-nodes/nodes/planner.train.interlocking-payload-contract-body-required.convention.yaml

@@ -0,0 +1,28 @@
+schema_version: 1.0.0
+rule_id: planner.train.interlocking-payload-contract-body-required
+kind: rule
+status: active
+name: Interlocking payload contract body required
+statement: A payload contract identity referenced by an interlocking message must
+  resolve to a contract schema body.
+terms:
+- term_id: contract_body
+  text: a payload contract identity must resolve to a contract schema body on disk
+implementation:
+  type: validator
+  ref: test_sequence_diagram_sanity::test_payload_contracts_have_schema_bodies
+metadata:
+  severity: 3
+  disposition: strict
+validation:
+  family: resolution
+  template: artifact_reference_resolution
+  variant: planner_train_interlocking_payload_contract_body_required
+  phase: CONFIRM
+  enforcement: confirm-blocking
+  subject_kind: interlocking
+  failure_evidence:
+  - interlocking_id
+  - message_id
+  - contract
+  - expected_schema_path