@agentsfleet/orly 0.6.5 → 0.6.6

package/audits/ufs.sh

@@ -4,6 +4,12 @@
 # Dispatch façade: dispatch/write_any.md (UFS Gate)
 # Fires in: make lint, CONFORM.
 #
+# Languages read: Zig, TypeScript, JavaScript, Rust, Go (see `is_source`, which
+# carries the pack that owns each extension and the reasons `.py` / `.sh` are
+# held out). The set is pinned against the dispatch facade by the engine
+# dispatch-coverage audit — a facade that fires on a language its leaf cannot
+# read is a gate that prints green over an unscanned file.
+#
 # Generic detection — no manifest of known literals, so the audit scales
 # as the codebase grows. Three classes of violation:
 #
@@ -15,9 +21,11 @@
 #
 # Carve-out: any `// pin test: literal is the contract` comment on or
 # above the offending line excludes that line from numeric-suspect.
-# A `const` / `pub const` / `export const` declaration line is likewise
-# exempt for both per-file checks (is_const_decl + its string-dup mirror
-# below) — binding the literal to a name on a const line clears the hit.
+# A `const` / `pub const` / `export const` / `static` declaration line is
+# likewise exempt for both per-file checks (is_const_decl + its string-dup
+# mirror below) — binding the literal to a name on that line clears the hit.
+# Go states the keyword once for a whole `const ( ... )` group; the string-dup
+# lane tracks the group so its members are read as the declarations they are.
 #
 # Staged-scope semantics: --staged narrows WHICH FILES are scanned, not
 # how much of each — a staged file is audited in FULL, so staging a file
@@ -69,14 +77,34 @@ ok()     { printf "OK:   %s\n" "$*"; }
 
 # ── File scope ──────────────────────────────────────────────────────────────
 
+# The extension set is the CONTRACT the dispatch façade already advertises:
+# dispatch/write_any.sh's `dispatch_init "ANY" ...` list is what fires the gate,
+# and this list is what the gate then reads. When the two disagree the façade
+# runs, prints green, and has scanned nothing — which is exactly how a Rust
+# crate carried `const S_PING = "PING"` past a gate that claimed to cover it.
+# The engine fails its own dispatch-coverage audit on that drift now, so a
+# language added to the façade must land here, or be named out of scope with a
+# reason, before that audit goes green again.
+#
+#   .zig                     language.zig
+#   .ts .tsx                 language.typescript
+#   .js .jsx                 language.javascript
+#   .rs                      language.rust
+#   .go                      language.go
+#
+# Out of scope, deliberately — the engine keeps the machine-readable twin of
+# this list: `.py` (single-quoted literals dominate and the
+# double-quote matcher below would report partial coverage as full), `.sh`
+# (a repeated `"$var"` is interpolation, not a magic string — measured at 59%
+# of hits on a real tree), `.sql` (its own gate, dispatch/write_sql.sh).
 is_source() {
   local f="$1"
   case "$f" in
     vendor/*|third_party/*|.zig-cache/*|*/node_modules/*|evals/dispatch/fixtures/*|*.tsbuildinfo) return 1 ;;
-    *_test.zig|*.test.ts|*.test.tsx|*.test.js|*.test.jsx|*.unit.test.js|*.spec.ts) ;; # tests in scope
+    *_test.zig|*.test.ts|*.test.tsx|*.test.js|*.test.jsx|*.unit.test.js|*.spec.ts|*_test.go) ;; # tests in scope
   esac
   case "$f" in
-    *.zig|*.ts|*.tsx|*.js|*.jsx) return 0 ;;
+    *.zig|*.ts|*.tsx|*.js|*.jsx|*.rs|*.go) return 0 ;;
     *) return 1 ;;
   esac
 }
@@ -112,9 +140,21 @@ while IFS= read -r row; do
 done < <(awk '
   FNR == 1 {
     prev_file = FILENAME
+    # Language lane. Each lane below carves out what its syntax makes
+    # UNFIXABLE — a literal a named const cannot legally replace. Anything
+    # a const CAN replace stays in scope, in every language.
+    lang = "other"
+    if (FILENAME ~ /\.zig$/)             lang = "zig"
+    else if (FILENAME ~ /\.rs$/)         lang = "rust"
+    else if (FILENAME ~ /\.go$/)         lang = "go"
     # Test files: repetition is fixture data, not magic strings.
     # Skip string-dup-file for tests; other checks still apply.
-    is_test = (FILENAME ~ /(_test\.zig|\.test\.|\.spec\.|\.unit\.test|\.integration\.test|\/test\/|\/tests\/)/)
+    is_test = (FILENAME ~ /(_test\.zig|_test\.go|\.test\.|\.spec\.|\.unit\.test|\.integration\.test|\/test\/|\/tests\/)/)
+    # Directory-shaped test and benchmark trees. Rust puts both at the CRATE
+    # ROOT (`tests/`, `benches/`) with no leading slash, so the `\/tests\/`
+    # form above — which needs a parent directory — walked straight past them
+    # and audited 100 fixture hits as production literals.
+    if (FILENAME ~ "(^|/)(test|tests|benches|__tests__)/") is_test = 1
   }
   is_test { next }
   # ui/ files: extracting class-strings or short literals to file-local
@@ -126,7 +166,7 @@ done < <(awk '
   # ("nonterminated character class"); use a dynamic-regex STRING — identical
   # match on gawk, portable on BWK awk (the macOS default). Do not re-inline.
   FILENAME ~ "^ui/packages/[^/]+/(src|app|tests|components|lib|hooks)/" { next }
-  FNR == 1 { in_test_block = 0; test_depth = 0; in_block_comment = 0 }
+  FNR == 1 { in_test_block = 0; test_depth = 0; in_block_comment = 0; in_rs_test = 0; rs_open = 0; rs_depth = 0; in_go_const = 0 }
   {
     line = $0
     # Block-comment exclusion (TS/JS/Zig non-applicable): skip lines inside /* ... */
@@ -139,9 +179,9 @@ done < <(awk '
       next
     }
     # Zig multi-line string literal — lines start with `\\` after whitespace.
-    if (FILENAME ~ /\.zig$/ && line ~ /^[[:space:]]*\\\\/) next
+    if (lang == "zig" && line ~ /^[[:space:]]*\\\\/) next
     # Inline-test exclusion (Zig): track depth across `test "..." {` blocks.
-    if (FILENAME ~ /\.zig$/) {
+    if (lang == "zig") {
       if (in_test_block) {
         test_depth += gsub(/\{/, "{", line) - gsub(/\}/, "}", line)
         if (test_depth <= 0) in_test_block = 0
@@ -156,6 +196,54 @@ done < <(awk '
         next
       }
     }
+    # Inline-test exclusion (Rust): Rust keeps its unit tests INSIDE the file
+    # they cover, under `#[cfg(test)] mod tests { ... }`, so without this the
+    # fixture keys of a well-tested module read as the worst literal debt in
+    # the production half of that same file — a real crate reported `"key1"`
+    # 15 times from one such block. Same brace-depth shape as the Zig branch.
+    if (lang == "rust") {
+      if (in_rs_test) {
+        tmp = line
+        rs_depth += gsub(/\{/, "{", tmp) - gsub(/\}/, "}", tmp)
+        if (!rs_open && index(line, "{") > 0) rs_open = 1
+        if (rs_open && rs_depth <= 0) in_rs_test = 0
+        else if (!rs_open && line ~ /;[[:space:]]*$/) in_rs_test = 0
+        next
+      }
+      # Three ways Rust marks a block as fixture data, not shipped behaviour:
+      # `#[cfg(test)]`, a `#[test]`/`#[tokio::test]` function, and a
+      # FEATURE-GATED test seam — `#[cfg(feature = "test-util")]`, the
+      # convention for a helper that must compile into the crate so an
+      # integration test in a sibling file can call it (a `one_of_each_kind`
+      # error-surface enumerator is the usual shape). The feature name is
+      # matched narrowly, `test` as a whole word or a `-`/`_` segment, so a
+      # production gate like `#[cfg(feature = "redis")]` still counts and
+      # `"latest"` is not mistaken for a test seam.
+      if (line ~ /^[[:space:]]*#\[cfg\(test\)\]/ ||
+          line ~ /^[[:space:]]*#\[[A-Za-z_:]*test\]/ ||
+          line ~ /^[[:space:]]*#\[cfg\(.*feature[[:space:]]*=[[:space:]]*"([A-Za-z0-9]+[-_])?test(ing)?([-_][A-Za-z0-9_-]+)?"/) {
+        in_rs_test = 1; rs_open = 0; rs_depth = 0
+        next
+      }
+      # Attribute literals are UNFIXABLE, not undisciplined. `#[serde(rename =
+      # "...")]`, `#[cfg(feature = "...")]` and `#[doc = "..."]` take a literal
+      # token by language rule — a const is not accepted there, so naming one
+      # cannot resolve the hit and reporting it only teaches people to ignore
+      # the gate. Ordered after the cfg(test) branch, which is also a `#[`.
+      if (line ~ /^[[:space:]]*#!?\[/) next
+    }
+    # Grouped-const exclusion (Go): `const ( ... )` states the binding keyword
+    # ONCE, on the opening line, so a member like `metaKeyQoS = "conf_..."` is
+    # a definition carrying no `const` for the binding carve-out below to see.
+    # `var (` groups are deliberately NOT tracked — the carve-out is const-only
+    # in every other language and widening it here would be a silent divergence.
+    if (lang == "go") {
+      if (in_go_const) {
+        if (line ~ /^[[:space:]]*\)/) { in_go_const = 0; next }
+        if (line ~ /^[[:space:]]*[A-Za-z_][A-Za-z0-9_]*([[:space:]]+[A-Za-z0-9_.\[\]*]+)?[[:space:]]*=/) next
+      }
+      else if (line ~ /^[[:space:]]*const[[:space:]]*\([[:space:]]*$/) { in_go_const = 1; next }
+    }
     sub(/\/\/.*$/, "", line)
     # Strip single-line /* ... */ inline block comments (jsdoc/etc) so
     # literals inside them are not counted.
@@ -171,11 +259,23 @@ done < <(awk '
     # like any other use. (A prior line-level skip exempted those too and silently
     # gutted the check for most Zig code; the ufs_dup_string eval fixture pins the
     # binding-level semantic.)
-    if (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const)[[:space:]]+[A-Za-z_$][A-Za-z0-9_$]*([[:space:]]*:[^=]*)?[[:space:]]*=[[:space:]]*"((\\.)|[^\\"])+"[[:space:]]*(as[[:space:]]+const)?[[:space:]]*[;,]?[[:space:]]*$/) next
+    # `static` joins the keyword set for Rust: `static NAME: &str = "..."` binds
+    # a literal to a name exactly as `const` does, and the leading
+    # `(^|[[:space:]])` anchor already carries the `pub`/`pub(crate)` prefixes.
+    # The second type slot belongs to Go, which spells the type with no colon
+    # (`const name string = "..."`), which the colon-only slot could not see.
+    if (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const|static)[[:space:]]+[A-Za-z_$][A-Za-z0-9_$]*([[:space:]]*:[^=]*|[[:space:]]+[A-Za-z_][A-Za-z0-9_.\[\]*]*)?[[:space:]]*=[[:space:]]*"((\\.)|[^\\"])+"[[:space:]]*(as[[:space:]]+const)?[[:space:]]*[;,]?[[:space:]]*$/) next
     rest = line
     # Strip Zig identifier-escape syntax @"name" — body is an identifier,
     # not a string literal, but the regex below would otherwise match it.
     gsub(/@"[^"]*"/, "", rest)
+    # Strip Go backtick runs. They are overwhelmingly struct tags
+    # (`json:"id" yaml:"id"`), whose quoted halves are tag SYNTAX addressed by
+    # reflection — a const cannot appear inside one, so the repeat is unfixable.
+    # This also drops single-line Go raw strings, which is the accepted cost:
+    # the alternative reports every `json:"id"` in a wire struct as a violation.
+    # A backtick run spanning lines is not tracked (best-effort, as documented).
+    if (lang == "go") gsub(/`[^`]*`/, "", rest)
     # Strip empty string literals so the regex below cannot fuse
     # two adjacent Zig literals through their inner gap.
     gsub(/""/, "", rest)
@@ -229,7 +329,7 @@ done < <(awk -v re="$NUMERIC_RE" '
     line = $0
     is_pin_now   = (line ~ /pin test: literal is the contract/)
     is_pin_above = (prev ~ /pin test: literal is the contract/)
-    is_const_decl = (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const)[[:space:]]/)
+    is_const_decl = (line ~ /(^|[[:space:]])(pub[[:space:]]+const|export[[:space:]]+const|const|static)[[:space:]]/)
     stripped = line
     sub(/\/\/.*$/, "", stripped)
     sub(/#.*$/, "", stripped)

package/dispatch/write_any.md

@@ -343,7 +343,13 @@ ERROR REGISTRY GATE: <file>
 **Family:** Constant discipline. **Source:** `AGENTS.md` conformance enforcement
 + the selected language façade's Uniform Free Strings (UFS) clauses.
 
-**Triggers** — every `Edit`/`Write` to source files under `src/`, `ui/packages/*/src/`, `ui/packages/*/app/`, `ui/packages/*/lib/`, `ui/packages/*/components/`, `ui/packages/*/pages/`, `ui/packages/*/tests/`, `agentsfleet/src/`, `agentsfleet/test/` matching `*.zig`, `*.ts`, `*.tsx`, `*.js`, `*.jsx`. Excluded: `vendor/`, `third_party/`, `.zig-cache/`, `node_modules/`, `*.tsbuildinfo`.
+**Triggers** — every `Edit`/`Write` to a source file under the repository's own source surfaces — the `surfaces.user` prefixes it declares in `.oracle/orly.json`, or its source roots where it declares none — matching `*.zig`, `*.ts`, `*.tsx`, `*.js`, `*.jsx`, `*.rs`, `*.go`. Excluded: `vendor/`, `third_party/`, `.zig-cache/`, `node_modules/`, `*.tsbuildinfo`. `*.py` and `*.sh` fire this façade but are held out of the UFS leaf — see Scope. Each repository binds its own prefixes; naming one repository's layout here is what sends every other repository a trigger list it cannot match.
+
+<!-- oracle-packs:start product.agentsfleet -->
+In this repository those surfaces are `src/` (Zig), `rustd/crates/*/src/` (Rust), `cli/src/` and `ui/packages/*/{src,app,lib,components,pages,tests}/` (TypeScript).
+
+`agentsfleet/src/` and `agentsfleet/test/` were listed here until they stopped existing. A trigger path that resolves to nothing is the same silent green this card's gate exists to prevent — and the identical stale prefix in `ufs.sh`'s cross-runtime parity scan means its JavaScript half reads zero files today.
+<!-- oracle-packs:end -->
 
 **Override:** `UFS GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit. **User-only**; auto-mode does not cover.
 
@@ -376,12 +382,16 @@ Before saving an edit that introduces or relocates a literal:
 
 1. **Same-file repeat?** Grep within the file for the literal value. If it appears ≥1 time already, define a const at the top of the file (or in the module's `constants.ts`/`constants.zig`) and replace all occurrences.
 
-2. **Same-module repeat?** Grep within the module/package (`ui/packages/app/`, `agentsfleet/src/`, `src/`). If repeated, define in the module's canonical types/constants file (`lib/types.ts`, `src/state/<topic>.zig`, `agentsfleet/src/constants/<topic>.js`).
+2. **Same-module repeat?** Grep within the module or package that owns the file. If repeated, define it in that module's canonical constants file and replace every occurrence.
 
-3. **Cross-runtime sibling?** When the literal is a wire-format string or unit-conversion numeric, grep all three runtimes for an existing matching name. If found, reuse the name. If not, define in every runtime that uses the same value, same commit.
+3. **Cross-runtime sibling?** When the literal is a wire-format string or unit-conversion numeric, grep **every runtime this repository ships** for an existing matching name. If found, reuse it verbatim. If not, define it in each runtime that carries the value, same commit. A single-runtime repository answers this in one grep — the check is about the runtimes that exist, not a fixed count.
 
 4. **Carve-out check?** If the literal IS the contract a pin test verifies, write the `// pin test: literal is the contract` comment on or above the line. Otherwise, name it.
 
+<!-- oracle-packs:start product.agentsfleet -->
+Concretely here: modules are `src/` (Zig), `rustd/crates/*/` (Rust), `cli/src/` and `ui/packages/*/` (TypeScript), and their canonical constants files are `src/state/<topic>.zig`, the crate's own `constants.rs`, and `lib/types.ts`. The runtimes to grep in step 3 are Zig, TypeScript and Rust.
+<!-- oracle-packs:end -->
+
 #### Required output (per Edit/Write — one line by default)
 
 > [DETERMINISTIC → UFS]
@@ -411,6 +421,19 @@ The previous `--diff` (`BASE...HEAD`) default was retired with M70. The forcing
 
 `--all` is accepted as a back-compat alias for the default. `--diff` is rejected with exit 2 + a pointer to this section.
 
+**Languages the leaf reads.** Zig, TypeScript, JavaScript, Rust and Go. The rule is one rule, but each language hides its literals differently, so each gets a lane in `is_source` + the string-dup pass:
+
+| Language | Held out of the count, and why |
+|---|---|
+| Rust | `#[cfg(test)]` / `#[test]` blocks (unit tests live *inside* the file they cover), feature-gated test seams (`#[cfg(feature = "test-util")]` — a helper that must compile into the crate so a sibling integration test can call it), `#[…]` attribute literals (`#[serde(rename = "…")]` takes a literal token by language rule — no const is legal there), `static` bindings alongside `const` |
+| Go | `const ( … )` group members (the keyword is stated once, on the opening line), backtick struct tags (`json:"id"` is read by reflection; a const cannot appear inside one) |
+
+The test-seam match is deliberately narrow — `test` as a whole word or a `-`/`_` segment — so a production gate like `#[cfg(feature = "redis")]` still counts and `"latest"` is not mistaken for a seam. `ufs_feature_gate.rs` pins that: widening it turns the fixture green.
+
+`*.py` and `*.sh` are **out of scope on purpose**, and the engine pins the reason in its own dispatch-coverage audit: Python writes ~14% of its literals in single quotes the matcher does not read, so it would report partial coverage as full; and a repeated `"$var"` in shell is interpolation, not a magic string — 59% of hits on a real tree, with no `const` to bind to. Adding either means building its lane first, not widening the glob.
+
+**A façade that fires on a language its leaf cannot read is a silent green.** `write_any.sh` has declared `*.rs` and `*.go` since those packs existed while `ufs.sh` read neither, so the gate printed a green UFS row over a file it never opened — and a Rust crate shipped a bare, twice-spelled wire verb under it. The engine now fails its dispatch-coverage audit on that divergence: every extension the façade claims is read by the leaf, or carries a written reason it is not.
+
 #### Self-audit (end-of-turn / CONFORM)
 
 > [DETERMINISTIC → UFS]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",

package/packs/language/go/rules.md

@@ -20,5 +20,13 @@ a working value.
 Table-driven tests are the default shape. Concurrency work needs a `-race` run,
 and a deterministic contention test rather than a sleep.
 
+A string literal repeated in one file becomes a named constant — `audits/ufs.sh`
+reads `*.go` and enforces it. Two Go shapes are held out, because no rename can
+fix them: members of a `const ( … )` group, which state the binding keyword once
+on the opening line rather than per member, and backtick struct tags, whose
+quoted halves (`json:"id"`) are addressed by reflection and cannot hold a const.
+Both are carve-outs for what the *language* makes unfixable, not permission —
+a flag name or a label spelled inline twice is still the rule.
+
 The repository owns formatting, vet, lint, build, and test commands — it
 declares them in `.oracle/orly.json`.

package/packs/language/rust/rules.md

@@ -31,6 +31,35 @@ Local convention wins on conflict, but the divergence is named in the review
 output. Refresh the copy when the user asks or a cited rule looks stale
 (re-run the fetch; upstream updates continuously).
 
+## Constant discipline (RULE UFS)
+
+`audits/ufs.sh` reads `*.rs`. It did not until this pack said so, and the cost
+was concrete: a crate spelled a wire verb inline twice — `pong == "PONG" ||
+pong.contains("PONG")` — while `write_any.sh` printed a green UFS row over the
+file, because the façade had always declared `*.rs` and the leaf had never read
+it. Bind the repeated literal to a `const` or `static` and use the name.
+
+Four Rust shapes are held out of the count, because no rename can fix them:
+
+- **`#[cfg(test)]` and `#[test]` blocks.** Rust keeps unit tests inside the file
+  they cover, so fixture keys would otherwise read as that file's worst debt.
+- **Feature-gated test seams** — `#[cfg(feature = "test-util")]`. A helper that
+  hands a sibling integration test one of each error kind has to compile into
+  the crate, which is the only reason it is not behind `cfg(test)`; its contents
+  are fixture data all the same. The match is narrow on purpose: `test` as a
+  whole word or a `-`/`_` segment, so `#[cfg(feature = "redis")]` still counts.
+- **Attribute literals** — `#[serde(rename = "…")]`, `#[cfg(feature = "…")]`,
+  `#[doc = "…"]`. An attribute takes a literal token by language rule; a const
+  is not accepted in that position.
+- **`tests/` and `benches/`** at the crate root, which are fixture trees.
+
+Everything else counts, including `examples/` — not because it compiles, but
+because what repeats there is coupling, not demonstration. A cache namespace
+declared at the top of a walkthrough and matched ninety lines below it, or a
+fixture id that is both the fake store's match arm and the key five call sites
+pass, breaks silently when one end moves. That is the drift RULE UFS exists to
+catch, and example code is where a reader copies it from.
+
 ## Evolution
 
 This pack is young next to the Zig façade and grows the same way: a Rust