@agentsfleet/orly 0.7.0 → 0.8.0

package/AGENTS.md

@@ -61,7 +61,7 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 - **Skip hooks/signing.** Never `--no-verify`/`--no-gpg-sign`/`-c commit.gpgsign=false`. Hook fails → fix cause.
 - **Plaintext secrets in entity tables.** Store vault `key_name` ref, resolve via `crypto_store.load()`.
 - **Static strings in SQL schema.** No `DEFAULT 'value'`/`CHECK (col IN ('a','b'))`. Enforce in app via named constants.
-- **Resolving/printing credentials.** `op read 'op://...'` at runtime — never paste/log.
+- **Resolving/printing credentials.** `op read 'op://...'` at runtime — never paste/log. Vault names come from the environment, never from a rules file.
 - **Force-push default branch** (`main`/`master`).
 - **Install-process launches in core paths.** Native SDKs. Exception: personal dev tools (`op`/`gh`/`glab`/`oracle`).
 
@@ -83,14 +83,14 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 - **Symlinked edits land in the repository that owns the file.** A file whose `readlink` resolves outside this checkout — into a dotfiles or config repository — is an edit to *that* repository, not this one. Detect via `readlink` BEFORE editing. After: `cd` to the resolved repository, `git add <files> && git commit && git push` on its default branch. Never leave uncommitted.
 - **Docs-repo edits on own branch.** `~/Projects/docs/` is shared across milestones: check `git status` first; from `main` (checkout or worktree off `main`) commit on `chore/m{N}-{slug}-changelog`; recovery = stash, re-apply on a fresh branch.
 - Other dotfiles (`.zshrc`/`.gitconfig`/etc.): timestamped backup; minimal edits.
+- **Check a sibling repository for an existing pattern in the same language before inventing one.** A shape shipping next door is prior art; a new one needs a reason.
+- **Read the reference implementation before designing.** Where the language's dispatch page names a canonical external source, that read is mandatory in review and its guideline identifiers are cited — applied or diverged from. "Broken for us" means the delta was missed: diff our call site against theirs before blaming the principle.
 - Before commit/push: `gitleaks` must pass.
 - No new `make` targets without a distinct caller (CI job, spec-mandated gate, or a workflow existing targets can't express) — check `make/*.mk` first; extend over near-duplicate wrappers.
 - `*.zig` → read `dispatch/write_zig.md`; ZIG GATE fires.
 - Auth-flow (token-minting handlers, credential-typed spec dimensions, the repository's auth directories) → read the repository's `docs/AUTH.md` first, where it exists.
 - `conn.query()` requires `.drain()` in same fn before `deinit()`. Verify `make lint-governance`. Use `conn.exec()` for no-rows.
-- **Vault (1Password `op`).** Resolve secrets via the `op` CLI, never hand-paste/log. Vault names come from the environment, never from a rules file.
-- Check a sibling repository under `$HOME/Projects/` for an existing pattern in the same language before inventing one.
-- **Reference canon (read before designing):** TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop` + Microsoft's Rust guidelines (`oss/rust-guidelines/all.txt`, fetch if absent; mandatory in review). Missing checkout → ask, then clone into `~/Projects/oss/`. "Broken for us" → call-site diff first.
+- **Indy's reference checkouts** (the machine-local half of the rule above): TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop`. Missing checkout → ask, then clone into `~/Projects/oss/`.
 
 **Forge detection:** `github.com` → `gh`; `gitlab.com` → `glab`. Check `git remote -v`.
 
@@ -180,7 +180,9 @@ Non-trivial (full lifecycle) if it: touches >1 file · new abstraction · data m
 
 **With spec:** `CHORE(open) → PLAN → EXECUTE → CONFORM → VERIFY → REVIEW → DOCUMENT → COMMIT → CHORE(close)`. **Without spec** (bug fix/config/refactor): `PLAN → EXECUTE → CONFORM → VERIFY → REVIEW → DOCUMENT → COMMIT`. CHORE bookends iff work creates/continues a spec under `docs/v*/{active,pending}/`. Stage runbooks (checklists, recipes, formats): `dispatch/lifecycle.md`.
 
-**Anchor invariant — `orly gate` proves the boundary.** No PR opens unless every `orly gate pr` criterion is green or carries an `Orly-Override` trailer the user recorded with a reason. `orly gate` runs `work → verify → pr`, stops at the first red group, and only reads; green unlocks CHORE(close) but never performs it. No spec → spec criteria skip, quality gates still run. Slow suites (`verify.integration`, `verify.memory`) run only when the branch carries code. A user-surface change without a docs change is red until docs land or an override says why not.
+**Anchor invariant — `orly gate` proves the boundary.** No PR opens unless every `orly gate pr` criterion is green or carries an `Orly-Override` trailer the user recorded with a reason.
+
+**One gate per cadence, each tier run once.** `work` = the declared `conform` command, no git state (a commit hook's tree is dirty by construction). `verify` = spec dimensions, docs language, the fast `verify.*` set. `pr` = branch shape, clean tree, pushed branch, every spec criterion, the slow suites. `orly gate pr` is the command CHORE(close) runs; `git.pushed` proves HEAD is exactly what the pre-push `orly gate verify` already graded. A bare `orly gate` chains all three, for a branch whose earlier gates never ran. Stage map: `dispatch/lifecycle.md`. Both stop at the first red group and only read; green unlocks CHORE(close) but never performs it. No spec → spec criteria skip, quality gates still run. Slow suites (`verify.integration`, `verify.memory`) run only when the branch carries code. A user-surface change without a docs change is red until docs land or an override says why not.
 
 **LAND (after merge, or when the user confirms it merged):** pull the default branch, prune the merged worktree + branch, `make down` where defined.
 
@@ -203,13 +205,13 @@ Edit only approved scope; no opportunistic refactors. Stay in active worktree. C
 
 ### CONFORM
 
-Runs after EXECUTE, before VERIFY. Invokes the `conform` commands the repository declares in `.oracle/orly.json` and aggregates every gate verdict. Any 🔴 returns to EXECUTE; the lifecycle does not advance.
+Runs after EXECUTE, before VERIFY. Invokes the `conform` commands the repository declares in `.oracle/orly.json` and aggregates every gate verdict. Any 🔴 returns to EXECUTE; the lifecycle does not advance. This is the `work` gate's tier and the pre-commit hook runs it at every commit: declare a `conform` costing seconds, not minutes.
 In `agentsfleet` this stage is `make harness-verify`; its output block and end-of-turn audit detail live in `docs/HARNESS_VERIFY_OUTPUT.md`. Required rows: FILE SHAPE, PUB GATE, LENGTH GATE, MILESTONE-ID GATE, ZIG GATE, UI GATE, DESIGN TOKEN GATE, UFS GATE, SCHEMA GUARD, GREPTILE GATE, Architecture consult, Coverage, and `/orly-write-unit-test`.
 
 ### VERIFY
 
-Run the repository's declared `verify.*` commands from `.oracle/orly.json`. A package-scoped command never replaces a listed one.
-The `agentsfleet` output block and exact tiers live in `docs/VERIFY_TIERS.md`. **FIRST: `/orly-write-unit-test`** audits diff coverage. **LAST: the Test Delta row** compares against the CHORE(open) baseline; zero or negative unit growth on a code-adding diff needs justification or a return to EXECUTE. Paste memory-leak evidence into PR Session Notes or cite its Continuous Integration (CI) URL. After refactors, list newly dead code before removing it.
+**Two cadences, one boundary.** Inside a Section, run CONFORM plus the declared lane covering the surface the Section touched — enough to prove a Section, reported as a Section claim. The repository's full declared `verify.*` set runs ONCE, at the milestone boundary, before the PR. A package-scoped command never replaces a listed one at either cadence, and a Section lane never satisfies a "tests pass" claim about the repository.
+The `agentsfleet` output block and both cadences live in `docs/VERIFY_TIERS.md`. **FIRST: `/orly-write-unit-test`** audits diff coverage. **LAST: the Test Delta row** compares against the CHORE(open) baseline; zero or negative unit growth on a code-adding diff needs justification or a return to EXECUTE. Paste memory-leak evidence into PR Session Notes or cite its Continuous Integration (CI) URL. After refactors, list newly dead code before removing it.
 
 ### REVIEW
 
@@ -235,7 +237,7 @@ Required when spec involved — after last COMMIT, before PR. Also runs when par
 
 | # | When | Skill |
 |---|---|---|
-| 1 | VERIFY | `/orly-write-unit-test`, then `/orly-write-integration-test` — both before the PR, never skipped, never deferred |
+| 1 | VERIFY | `/orly-write-unit-test` once per Section over that Section's diff, and again at the boundary — never skipped, never deferred. Then `/orly-write-integration-test` at the boundary **when the diff crosses a module boundary with real input/output**; otherwise record `N/A — <reason>` in Session Notes. |
 | 2 | REVIEW | gstack `/review` — every runtime, same route; address findings or record a user-acked deferral; reviewer unavailable → Session Notes: *"skipped — <reason> <ts>; rerun before merge"* |
 | 3 | After every push | `orly-babysit-prs` — CI check runs + greptile inline threads + PR-level summary; stops on two consecutive empty polls with CI green; never `gh pr checks --watch` for greptile |
 
@@ -294,7 +296,10 @@ Optimise for one thing: he never has to ask twice.
   justification clauses, importance puffery, em-dash rhythm crutches, and
   fake-profound kickers. End on the clearest concrete sentence. The banned-word
   list lives in `docs/DOCUMENTATION_RULES.md` §DOC-05, §DOC-07, §DOC-14b, and
-  `orly gate verify` enforces it.
+  `orly gate verify` REPORTS it — `docs.language` prints its findings and stays
+  green, because the corpus predates the rule and a red on day one gets switched
+  off by the end of the week. Nobody fails a build over this, so the prose is
+  mine to get right.
 
 ## Reading Indy
 
@@ -370,5 +375,5 @@ Optimise for one thing: he never has to ask twice.
 
 | Responsibility | Commands |
 |---|---|
-| `conform` | `make audit` |
+| `conform` | `make conform` |
 | `verify.unit` | `bun test src` |

package/SOUL.md

@@ -44,7 +44,10 @@ Optimise for one thing: he never has to ask twice.
   justification clauses, importance puffery, em-dash rhythm crutches, and
   fake-profound kickers. End on the clearest concrete sentence. The banned-word
   list lives in `docs/DOCUMENTATION_RULES.md` §DOC-05, §DOC-07, §DOC-14b, and
-  `orly gate verify` enforces it.
+  `orly gate verify` REPORTS it — `docs.language` prints its findings and stays
+  green, because the corpus predates the rule and a red on day one gets switched
+  off by the end of the week. Nobody fails a build over this, so the prose is
+  mine to get right.
 
 ## Reading Indy
 

package/audits/agents-md.md

@@ -95,6 +95,7 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 | 4.23 (Documentation) | Before published Markdown JSX (MDX), reusable snippets, customer readme, or public OpenAPI prose, must the agent read `dispatch/write_documentation.md` and `docs/DOCUMENTATION_RULES.md` before any narrower guide? | YES |
 | 4.24 (Documentation) | Are page, snippet, generated API, and changelog scopes distinct, with repository-owned pre-commit checks enforcing the mechanical rules? | YES |
 | 4.25 (Rust) | Do `*.rs` edits route to `dispatch/write_rust.md` — ownership, error variants, feature combinations, deterministic contention tests — with Microsoft's Pragmatic Rust Guidelines (`~/Projects/oss/rust-guidelines/all.txt`, fetched when absent) read sectioned and its `M-…` IDs cited in every Rust review? | YES | <!-- oracle-packs:language.rust -->
+| 4.25b (Rust errors) | Is RULE ERR-RS deterministic where a machine can decide it — `dispatch/write_rust.sh` running `audits/rust-error.sh` over staged `*.rs` to block a `map_err` that stringifies its own cause and an error type with no `pub type Result<…>` in its crate — while `source()` shape and whether a context addition is warranted stay the agent's call? | YES | <!-- oracle-packs:language.rust -->
 | 4.25a (Go) | Do `*.go` edits route to `dispatch/write_go.md`, with wrapped errors, goroutine exit paths, context-first signatures, defer-at-acquire, and `-race` verification? | YES | <!-- oracle-packs:language.go -->
 | 4.26 (Python) | Do `*.py` edits route to `dispatch/write_python.md`, with parse-boundary validation and context-managed resources? | YES |
 | 4.27 (Shell) | Do `*.sh` edits route to `dispatch/write_shell.md`, with quoted expansions, array arguments, cleanup, and compatibility requirements? | YES |

package/audits/logging.sh

@@ -9,7 +9,7 @@
 #   - agentsfleet scope-prefix format from LOGGING_STANDARD §7 (the
 #     `log.scoped(...)` API path under `src/logging/`)
 #   - `UZ-XXX-NNN` as the `error_code=` substring per LOGGING_STANDARD §5
-#   - `src/` + `rustd/` + `agentsfleet/src/` as the scan roots
+#   - `src/` + `agentsfleet/src/` as the Zig and TypeScript scan roots
 # A parameterised version that reads prefix + scope-api path + scan
 # roots from a per-project config is the right long-term shape; not
 # done yet. Today, this script lives in dotfiles so the gate body and
@@ -19,7 +19,9 @@
 #   BLOCK  — exits 1, must fix:
 #            - `std.debug.print(` in non-test source under src/.
 #            - `println!` / `eprintln!` / `dbg!`, missing `event`, or positional
-#              tracing formatting in non-test Rust source under rustd/.
+#              tracing formatting in runtime Rust source. Direct stream writes
+#              may carry `// logging: <reason>` on or immediately above the
+#              emit when stdout or stderr is the intended program interface.
 #            - `console.log/debug/info/warn/error` in agentsfleet/src outside tests.
 #   INFO   — surfaced for reviewer/agent attention, doesn't block:
 #            - `std.log.scoped(...)` outside `src/logging/` (LOGGING_STANDARD §7
@@ -31,7 +33,8 @@
 #
 # Modes:
 #   --staged   diff-scope: only files in `git diff --cached`
-#   --all      (default) full src/ + rustd/ + agentsfleet/src/ scan
+#   --all      (default) full src/ + every tracked/unignored *.rs +
+#              agentsfleet/src/ scan
 #   --strict   promote every INFO finding to BLOCK (post-migration use)
 #
 # Exits 0 clean, 1 on BLOCK findings.
@@ -81,9 +84,9 @@ is_test_zig() {
   return 1
 }
 
-is_test_rust_path() {
+is_non_runtime_rust_path() {
   case "$1" in
-    */tests/*|*/benches/*) return 0 ;;
+    build.rs|*/build.rs|tests/*|*/tests/*|benches/*|*/benches/*|examples/*|*/examples/*) return 0 ;;
   esac
   return 1
 }
@@ -95,11 +98,13 @@ gather_paths() {
   case "$MODE" in
     --staged)
       git diff --cached --name-only --diff-filter=ACMRT \
-        | grep -E '^(src/.*\.zig$|rustd/.*\.rs$|agentsfleet/src/.*\.(js|jsx|ts|tsx)$)' || true
+        | grep -E '(^src/.*\.zig$|\.rs$|^agentsfleet/src/.*\.(js|jsx|ts|tsx)$)' || true
       ;;
     --all)
       find src -type f -name '*.zig' 2>/dev/null || true
-      find rustd -type f -name '*.rs' 2>/dev/null || true
+      while IFS= read -r path; do
+        [[ -f "$path" ]] && printf '%s\n' "$path"
+      done < <(git ls-files --cached --others --exclude-standard -- '*.rs')
       find agentsfleet/src -type f \( -name '*.js' -o -name '*.jsx' -o -name '*.ts' -o -name '*.tsx' \) 2>/dev/null || true
       ;;
   esac
@@ -116,12 +121,13 @@ fi
 # single awk/grep passes.
 zig_nontest=()
 rust_nontest=()
+rust_candidates=()
 js_nontest=()
 for f in "${FILES[@]}"; do
   if [[ "$f" == *.zig ]] && ! is_test_zig "$f"; then
     zig_nontest+=("$f")
   fi
-  if [[ "$f" == *.rs ]] && ! is_test_rust_path "$f"; then
+  if [[ "$f" == *.rs ]] && ! is_non_runtime_rust_path "$f"; then
     rust_nontest+=("$f")
   fi
   case "$f" in
@@ -132,6 +138,10 @@ for f in "${FILES[@]}"; do
   esac
 done
 
+if [[ ${#rust_nontest[@]} -gt 0 ]]; then
+  mapfile -t rust_candidates < <(grep -lE '(^|[^[:alnum:]_])(println|eprintln|dbg)!|tracing::(error|warn|info|debug|trace)!' "${rust_nontest[@]}" 2>/dev/null || true)
+fi
+
 # ---------------------------------------------------------------------------
 # 2. BLOCKING: std.debug.print in non-test Zig source.
 # ---------------------------------------------------------------------------
@@ -146,10 +156,40 @@ if [[ ${#zig_nontest[@]} -gt 0 ]]; then
     fail "$f:$ln — \`std.debug.print\` in non-test source (LOGGING_STANDARD §10A.L1)"
     debug_print_hits=$((debug_print_hits + 1))
   done < <(awk '
-    FNR == 1 { in_test = 0 }
-    /^test "/ { in_test = 1; next }
-    /^}/ { in_test = 0; next }
-    /(^|[^A-Za-z0-9_])std\.debug\.print\(/ { if (!in_test) printf "%s:%d\n", FILENAME, FNR }
+    function comment_text(text, output, cursor, char, escaped, quoted) {
+      escaped = 0
+      quoted = 0
+      for (cursor = 1; cursor <= length(text); cursor++) {
+        char = substr(text, cursor, 1)
+        if (quoted) {
+          if (escaped) escaped = 0
+          else if (char == "\\") escaped = 1
+          else if (char == "\"") quoted = 0
+          continue
+        }
+        if (char == "\"") {
+          quoted = 1
+          continue
+        }
+        if (char == "/" && substr(text, cursor + 1, 1) == "/")
+          return substr(text, cursor + 2)
+      }
+      return ""
+    }
+    function has_logging_reason(text, comment) {
+      if (text ~ /^[[:space:]]*\\\\/) return 0
+      comment = comment_text(text)
+      return comment ~ /^[[:space:]]*logging:[[:space:]]*[^[:space:]]/
+    }
+    FNR == 1 { in_test = 0; previous_annotation = 0 }
+    {
+      annotated = has_logging_reason($0) || previous_annotation
+      if ($0 ~ /^test "/) in_test = 1
+      else if ($0 ~ /^}/) in_test = 0
+      else if ($0 ~ /(^|[^A-Za-z0-9_])std\.debug\.print\(/ && !in_test && !annotated)
+        printf "%s:%d\n", FILENAME, FNR
+      previous_annotation = has_logging_reason($0)
+    }
   ' "${zig_nontest[@]}")
 fi
 
@@ -160,7 +200,7 @@ fi
 rust_direct_hits=0
 rust_missing_event_hits=0
 rust_positional_hits=0
-if [[ ${#rust_nontest[@]} -gt 0 ]]; then
+if [[ ${#rust_candidates[@]} -gt 0 ]]; then
   while IFS='|' read -r kind f ln; do
     [[ -z "$kind" ]] && continue
     case "$kind" in
@@ -227,6 +267,30 @@ if [[ ${#rust_nontest[@]} -gt 0 ]]; then
       }
       return output
     }
+    function comment_text(text, cursor, char, escaped, quoted) {
+      escaped = 0
+      quoted = 0
+      for (cursor = 1; cursor <= length(text); cursor++) {
+        char = substr(text, cursor, 1)
+        if (quoted) {
+          if (escaped) escaped = 0
+          else if (char == "\\") escaped = 1
+          else if (char == "\"") quoted = 0
+          continue
+        }
+        if (char == "\"") {
+          quoted = 1
+          continue
+        }
+        if (char == "/" && substr(text, cursor + 1, 1) == "/")
+          return substr(text, cursor + 2)
+      }
+      return ""
+    }
+    function has_logging_reason(text, comment) {
+      comment = comment_text(text)
+      return comment ~ /^[[:space:]]*logging:[[:space:]]*[^[:space:]]/
+    }
     function check_emit() {
       if (emit_code !~ /event[[:space:]]*=/ && emit_code !~ /[(,][[:space:]]*event[[:space:]]*[,)]/)
         printf "event|%s|%d\n", FILENAME, emit_line
@@ -244,15 +308,21 @@ if [[ ${#rust_nontest[@]} -gt 0 ]]; then
       emit_parens = 0
       emit_code = ""
       emit_source = ""
+      previous_annotation = 0
     }
     {
+      current_annotation = has_logging_reason($0)
       code = code_only($0)
-      if (!in_emit && code ~ /^[[:space:]]*$/) next
+      if (!in_emit && code ~ /^[[:space:]]*$/) {
+        previous_annotation = current_annotation
+        next
+      }
       opens = count_char(code, "\\{")
       closes = count_char(code, "\\}")
       if (test_depth > 0) {
         depth += opens - closes
         if (depth < test_depth) test_depth = 0
+        previous_annotation = current_annotation
         next
       }
       if (code ~ /^[[:space:]]*#\[cfg\(test\)\]/) {
@@ -261,6 +331,7 @@ if [[ ${#rust_nontest[@]} -gt 0 ]]; then
           depth += opens - closes
           if (depth < test_depth) test_depth = 0
         } else cfg_test = 1
+        previous_annotation = current_annotation
         next
       }
       if (cfg_test) {
@@ -270,9 +341,10 @@ if [[ ${#rust_nontest[@]} -gt 0 ]]; then
           if (depth < test_depth) test_depth = 0
           cfg_test = 0
         } else if (code ~ /;/) cfg_test = 0
+        previous_annotation = current_annotation
         next
       }
-      if (code ~ /(^|[^[:alnum:]_])(println|eprintln|dbg)!/)
+      if (code ~ /(^|[^[:alnum:]_])(println|eprintln|dbg)!/ && !current_annotation && !previous_annotation)
         printf "direct|%s|%d\n", FILENAME, FNR
       if (!in_emit && match(code, /tracing::(error|warn|info|debug|trace)!/)) {
         in_emit = 1
@@ -288,8 +360,9 @@ if [[ ${#rust_nontest[@]} -gt 0 ]]; then
       }
       if (in_emit && emit_parens <= 0) check_emit()
       depth += opens - closes
+      previous_annotation = current_annotation
     }
-  ' "${rust_nontest[@]}")
+  ' "${rust_candidates[@]}")
 fi
 
 # ---------------------------------------------------------------------------
@@ -363,6 +436,7 @@ fi
 ok "scanned ${#FILES[@]} files; std.debug.print=$debug_print_hits rust-direct=$rust_direct_hits rust-missing-event=$rust_missing_event_hits rust-positional=$rust_positional_hits console.*=$console_hits std.log.scoped=$scoped_hits missing-error_code=$missing_code_hits"
 if [[ $FAIL -ne 0 ]]; then
   printf "\n🔴 LOGGING GATE: blocking violations. See dispatch/write_any.md (Logging Gate).\n" >&2
+  printf "Intentional direct Zig or Rust stream output requires '// logging: <reason>' on or immediately above the emit; the reason must be non-empty.\n" >&2
   exit 1
 fi
 [[ $INFO_COUNT -gt 0 ]] && note "$INFO_COUNT informational findings; not blocking. Use --strict to enforce."

package/audits/rust-error.sh

@@ -0,0 +1,228 @@
+#!/usr/bin/env bash
+# rust-error.sh — the mechanical half of RULE ERR-RS (Rust error discipline).
+#
+# Dispatch façade: dispatch/write_rust.md (Error discipline). Pairs with
+# dispatch/write_rust.sh, which is what runs it.
+#
+# The rule has four clauses. Two of them a machine can decide from the text
+# alone, and only those two live here:
+#
+#   1. LOSSY MAP_ERR — `map_err` whose closure converts its own cause through
+#      `to_string()` or `format!`. The rule allows `map_err` to ADD context the
+#      call site alone knows; it forbids stringifying the cause on the way into
+#      an error type, because `to_string()` destroys the `source()` chain. The
+#      closure's BINDING is what makes this decidable: `.map_err(|e| Mine::Db(
+#      e.to_string()))` stringifies the cause, while `.map_err(|e| Mine::Read {
+#      source: e, path: path.to_string() })` stringifies a path and is correct.
+#      Only a `to_string()` or `format!` applied to the closure's own parameter
+#      is a finding.
+#
+#   2. MISSING RESULT ALIAS — a crate declaring `pub enum Error` or
+#      `pub struct Error` with no `pub type Result<` anywhere beside it. The
+#      rule is "one error type per crate, and a `Result` alias beside it": a
+#      reader must never have to check WHICH error a signature returns.
+#
+# The other two clauses stay JUDGMENT and are not attempted here. Whether a
+# `source()` implementation returns its own kind needs the Display body read
+# beside it, and whether a context addition is warranted is a call-site
+# question. A gate that guesses at those gets switched off within a week, and a
+# switched-off gate protects nothing — partial mechanisation stated honestly is
+# the whole design (the same call audits/doc-read.sh makes about its record).
+#
+# Carve-outs match audits/logging.sh exactly, so one Rust scope answers to both
+# leaves: build scripts, `tests/`, `benches/`, `examples/`, and `#[cfg(test)]`
+# modules are fixture code, where a stringified error in a test assertion is
+# not a production error path.
+#
+# Modes:
+#   --staged   diff-scope: only *.rs in `git diff --cached`
+#   --all      (default) every tracked/unignored *.rs
+#
+# Exits 0 clean, 1 on findings.
+
+set -euo pipefail
+
+MODE_STAGED="--staged"
+MODE_ALL="--all"
+RULE="ERR-RS"
+FACADE="dispatch/write_rust.md"
+# The closure body window. A `map_err` closure that has not closed its
+# parentheses within this many lines is a block long enough that its conversion
+# is no longer a one-liner, and the rule's subject is the one-liner.
+MAX_CLOSURE_LINES=12
+CARGO_MANIFEST="Cargo.toml"
+RESULT_ALIAS_PATTERN='^[[:space:]]*pub[[:space:]]+type[[:space:]]+Result[[:space:]]*<'
+ERROR_TYPE_PATTERN='^[[:space:]]*pub[[:space:]]+(enum|struct)[[:space:]]+Error[[:space:]]*[<{(;]'
+
+MODE="$MODE_ALL"
+for arg in "$@"; do
+  case "$arg" in
+    --staged|staged) MODE="$MODE_STAGED" ;;
+    --all|all)       MODE="$MODE_ALL" ;;
+    -h|--help)
+      printf 'usage: %s [--staged|--all]\n' "$0"
+      exit 0
+      ;;
+    *) printf 'unknown arg: %s\n' "$arg" >&2; exit 64 ;;
+  esac
+done
+
+ROOT="$(git rev-parse --show-toplevel)"
+cd "$ROOT"
+
+FAIL=0
+fail() { printf 'FAIL: %s\n' "$*" >&2; FAIL=1; }
+ok()   { printf 'OK:   %s\n' "$*"; }
+
+# Non-runtime Rust paths, identical to audits/logging.sh's carve-out list.
+is_non_runtime_rust_path() {
+  case "$1" in
+    build.rs|*/build.rs|tests/*|*/tests/*|benches/*|*/benches/*|examples/*|*/examples/*) return 0 ;;
+  esac
+  return 1
+}
+
+gather_paths() {
+  case "$MODE" in
+    "$MODE_STAGED")
+      git diff --cached --name-only --diff-filter=ACMRT -- '*.rs' || true
+      ;;
+    "$MODE_ALL")
+      git ls-files --cached --others --exclude-standard -- '*.rs' || true
+      ;;
+  esac
+}
+
+FILES=()
+while IFS= read -r path; do
+  [[ -n "$path" && -f "$path" ]] || continue
+  is_non_runtime_rust_path "$path" && continue
+  FILES+=("$path")
+done < <(gather_paths)
+
+if [[ ${#FILES[@]} -eq 0 ]]; then
+  ok "$RULE: no runtime Rust files in scope ($MODE)"
+  exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# 1. Scan every in-scope file once, emitting both signals.
+# ---------------------------------------------------------------------------
+# One pass, one carve-out. Both halves need the same `#[cfg(test)]` skip, and
+# implementing it twice is how the two halves would come to disagree about what
+# a test module is — so the scanner emits `LOSSY:` and `ERRTYPE:` records from a
+# single walk and the shell decides what to do with each.
+#
+# The lossy scanner accumulates a map_err closure from its opening parenthesis
+# until the parentheses balance, so a conversion split over several lines reads
+# the same as a one-liner.
+signals="$(awk -v maxlines="$MAX_CLOSURE_LINES" -v errtype="$ERROR_TYPE_PATTERN" '
+  FNR == 1 { intest = 0; testdepth = 0; pending = 0; collecting = 0 }
+
+  # A #[cfg(test)] module is fixture code. The attribute precedes the item, so
+  # arm on the attribute and start counting braces at the item that follows.
+  !collecting && /#\[cfg\(test\)\]/ { pending = 1; next }
+  pending {
+    if (index($0, "{") > 0) { pending = 0; intest = 1; testdepth = 0 }
+    else next
+  }
+  intest {
+    n = gsub(/\{/, "{"); m = gsub(/\}/, "}")
+    testdepth += n - m
+    if (testdepth <= 0) intest = 0
+    next
+  }
+
+  {
+    line = $0
+    # Strip a trailing line comment so a commented example is not a finding.
+    sub(/\/\/.*$/, "", line)
+
+    # A public error type outside any test module. Emitted per file; the shell
+    # resolves it to a crate and asks that crate for its alias once.
+    if (!collecting && line ~ errtype) printf "ERRTYPE:%s\n", FILENAME
+
+    if (!collecting) {
+      where = match(line, /map_err[[:space:]]*\([[:space:]]*\|[[:space:]]*[A-Za-z_][A-Za-z0-9_]*[[:space:]]*\|/)
+      if (where == 0) next
+      rest = substr(line, where)
+      # The closure binding: the identifier between the pipes.
+      bind = rest
+      sub(/^map_err[[:space:]]*\([[:space:]]*\|[[:space:]]*/, "", bind)
+      sub(/[[:space:]]*\|.*$/, "", bind)
+      if (bind == "_") next
+      collecting = 1; buffer = rest; startline = FNR; spanned = 1
+      depth = gsub(/\(/, "(", rest) - gsub(/\)/, ")", rest)
+    } else {
+      buffer = buffer " " line
+      spanned++
+      depth += gsub(/\(/, "(", line) - gsub(/\)/, ")", line)
+    }
+
+    if (depth > 0 && spanned < maxlines) next
+
+    # `bind.to_string()` — the cause converted to text on the way in.
+    stringified = 0
+    if (buffer ~ ("(^|[^A-Za-z0-9_])" bind "[[:space:]]*\\.[[:space:]]*to_string[[:space:]]*\\(")) stringified = 1
+    # `format!(... bind ...)` — the same loss wearing a formatter.
+    if (buffer ~ /format!/ && buffer ~ ("(^|[^A-Za-z0-9_])" bind "([^A-Za-z0-9_]|$)")) {
+      after = buffer; sub(/^.*format!/, "", after)
+      if (after ~ ("(^|[^A-Za-z0-9_])" bind "([^A-Za-z0-9_]|$)")) stringified = 1
+    }
+    if (stringified) printf "LOSSY:%s:%d\n", FILENAME, startline
+    collecting = 0
+  }
+' "${FILES[@]}" || true)"
+
+lossy_count=0
+error_type_files=()
+while IFS= read -r signal; do
+  case "$signal" in
+    LOSSY:*)
+      lossy_count=$((lossy_count + 1))
+      fail "${signal#LOSSY:}  $RULE: map_err stringifies its own cause — to_string()/format! on the closure binding destroys the source() chain. Carry the cause with #[from] or a source field; map_err only ADDS context."
+      ;;
+    ERRTYPE:*)
+      error_type_files+=("${signal#ERRTYPE:}")
+      ;;
+  esac
+done <<< "$signals"
+
+# ---------------------------------------------------------------------------
+# 2. An error type with no Result alias beside it.
+# ---------------------------------------------------------------------------
+# Crate-scoped: the alias may live in any file of the crate that declares the
+# error, so the question is asked of the crate, once, not of the file.
+crate_root_of() {
+  local dir; dir="$(dirname "$1")"
+  while [[ "$dir" != "." && "$dir" != "/" ]]; do
+    [[ -f "$dir/$CARGO_MANIFEST" ]] && { printf '%s' "$dir"; return 0; }
+    dir="$(dirname "$dir")"
+  done
+  [[ -f "$CARGO_MANIFEST" ]] && { printf '.'; return 0; }
+  return 1
+}
+
+alias_count=0
+checked_crates=""
+for path in ${error_type_files[@]+"${error_type_files[@]}"}; do
+  crate=""
+  crate_root_of "$path" > /dev/null 2>&1 && crate="$(crate_root_of "$path")"
+  # A .rs file outside any Cargo crate has no crate to carry the alias; the
+  # lossy-map_err half still judged it.
+  [[ -n "$crate" ]] || continue
+  case " $checked_crates " in *" $crate "*) continue ;; esac
+  checked_crates="$checked_crates $crate"
+  if ! git ls-files --cached --others --exclude-standard -- "$crate/*.rs" \
+       | xargs grep -lE "$RESULT_ALIAS_PATTERN" 2>/dev/null | grep -q .; then
+    alias_count=$((alias_count + 1))
+    fail "$path  $RULE: crate '$crate' declares a public Error type with no \`pub type Result<T, E = Error>\` beside it — a reader must not have to check WHICH error a signature returns."
+  fi
+done
+
+ok "$RULE: scanned ${#FILES[@]} runtime Rust file(s); lossy-map_err=$lossy_count missing-result-alias=$alias_count"
+if [[ $FAIL -ne 0 ]]; then
+  printf '\n🔴 %s: blocking violations. See %s (Error discipline).\n' "$RULE" "$FACADE" >&2
+  exit 1
+fi
+exit 0

package/core/operating-model.md

@@ -61,7 +61,7 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 - **Skip hooks/signing.** Never `--no-verify`/`--no-gpg-sign`/`-c commit.gpgsign=false`. Hook fails → fix cause.
 - **Plaintext secrets in entity tables.** Store vault `key_name` ref, resolve via `crypto_store.load()`.
 - **Static strings in SQL schema.** No `DEFAULT 'value'`/`CHECK (col IN ('a','b'))`. Enforce in app via named constants.
-- **Resolving/printing credentials.** `op read 'op://...'` at runtime — never paste/log.
+- **Resolving/printing credentials.** `op read 'op://...'` at runtime — never paste/log. Vault names come from the environment, never from a rules file.
 - **Force-push default branch** (`main`/`master`).
 - **Install-process launches in core paths.** Native SDKs. Exception: personal dev tools (`op`/`gh`/`glab`/`oracle`).
 
@@ -80,18 +80,18 @@ Auto-memory is **disabled** (`autoMemoryEnabled: false` + `CLAUDE_CODE_DISABLE_A
 ### Operational defaults
 
 - Workspace `~/Projects`. `gh`/`glab` not browsers. `trash` not `rm`. Conventional Commits. Process decisions → repo docs, not chat. "Make a note" → update `AGENTS.md`/repo docs.
-- **Symlinked edits land in the repository that owns the file.** A file whose `readlink` resolves outside this checkout — into a dotfiles or config repository — is an edit to *that* repository, not this one. Detect via `readlink` BEFORE editing. After: `cd` to the resolved repository, `git add <files> && git commit && git push` on its default branch. Never leave uncommitted. <!-- oracle-packs:persona.indy -->
+- **Symlinked edits land in the repository that owns the file.** A file whose `readlink` resolves outside this checkout — into a dotfiles or config repository — is an edit to *that* repository, not this one. Detect via `readlink` BEFORE editing. After: `cd` to the resolved repository, `git add <files> && git commit && git push` on its default branch. Never leave uncommitted.
 - **Docs-repo edits on own branch.** `~/Projects/docs/` is shared across milestones: check `git status` first; from `main` (checkout or worktree off `main`) commit on `chore/m{N}-{slug}-changelog`; recovery = stash, re-apply on a fresh branch.
-- Other dotfiles (`.zshrc`/`.gitconfig`/etc.): timestamped backup; minimal edits. <!-- oracle-packs:persona.indy -->
+- Other dotfiles (`.zshrc`/`.gitconfig`/etc.): timestamped backup; minimal edits.
+- **Check a sibling repository for an existing pattern in the same language before inventing one.** A shape shipping next door is prior art; a new one needs a reason.
+- **Read the reference implementation before designing.** Where the language's dispatch page names a canonical external source, that read is mandatory in review and its guideline identifiers are cited — applied or diverged from. "Broken for us" means the delta was missed: diff our call site against theirs before blaming the principle.
 - Before commit/push: `gitleaks` must pass.
 - No new `make` targets without a distinct caller (CI job, spec-mandated gate, or a workflow existing targets can't express) — check `make/*.mk` first; extend over near-duplicate wrappers.
 - `*.zig` → read `dispatch/write_zig.md`; ZIG GATE fires. <!-- oracle-packs:language.zig -->
 - Auth-flow (token-minting handlers, credential-typed spec dimensions, the repository's auth directories) → read the repository's `docs/AUTH.md` first, where it exists. <!-- oracle-packs:domain.auth -->
 - `conn.query()` requires `.drain()` in same fn before `deinit()`. Verify `make lint-governance`. Use `conn.exec()` for no-rows. <!-- oracle-packs:product.agentsfleet -->
 <!-- oracle-packs:start persona.indy -->
-- **Vault (1Password `op`).** Resolve secrets via the `op` CLI, never hand-paste/log. Vault names come from the environment, never from a rules file.
-- Check a sibling repository under `$HOME/Projects/` for an existing pattern in the same language before inventing one.
-- **Reference canon (read before designing):** TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop` + Microsoft's Rust guidelines (`oss/rust-guidelines/all.txt`, fetch if absent; mandatory in review). Missing checkout → ask, then clone into `~/Projects/oss/`. "Broken for us" → call-site diff first.
+- **Indy's reference checkouts** (the machine-local half of the rule above): TypeScript → `oss/supabase/apps/studio` + `oss/supabase/packages/{ui,ui-patterns}` + `oss/cli`; Zig → `oss/ghostty/src/`; Rust → `oss/bun/src/` + `oss/exonum` + `oss/core_api-develop`. Missing checkout → ask, then clone into `~/Projects/oss/`.
 <!-- oracle-packs:end -->
 
 **Forge detection:** `github.com` → `gh`; `gitlab.com` → `glab`. Check `git remote -v`.
@@ -186,7 +186,9 @@ Non-trivial (full lifecycle) if it: touches >1 file · new abstraction · data m
 
 **With spec:** `CHORE(open) → PLAN → EXECUTE → CONFORM → VERIFY → REVIEW → DOCUMENT → COMMIT → CHORE(close)`. **Without spec** (bug fix/config/refactor): `PLAN → EXECUTE → CONFORM → VERIFY → REVIEW → DOCUMENT → COMMIT`. CHORE bookends iff work creates/continues a spec under `docs/v*/{active,pending}/`. Stage runbooks (checklists, recipes, formats): `dispatch/lifecycle.md`.
 
-**Anchor invariant — `orly gate` proves the boundary.** No PR opens unless every `orly gate pr` criterion is green or carries an `Orly-Override` trailer the user recorded with a reason. `orly gate` runs `work → verify → pr`, stops at the first red group, and only reads; green unlocks CHORE(close) but never performs it. No spec → spec criteria skip, quality gates still run. Slow suites (`verify.integration`, `verify.memory`) run only when the branch carries code. A user-surface change without a docs change is red until docs land or an override says why not.
+**Anchor invariant — `orly gate` proves the boundary.** No PR opens unless every `orly gate pr` criterion is green or carries an `Orly-Override` trailer the user recorded with a reason.
+
+**One gate per cadence, each tier run once.** `work` = the declared `conform` command, no git state (a commit hook's tree is dirty by construction). `verify` = spec dimensions, docs language, the fast `verify.*` set. `pr` = branch shape, clean tree, pushed branch, every spec criterion, the slow suites. `orly gate pr` is the command CHORE(close) runs; `git.pushed` proves HEAD is exactly what the pre-push `orly gate verify` already graded. A bare `orly gate` chains all three, for a branch whose earlier gates never ran. Stage map: `dispatch/lifecycle.md`. Both stop at the first red group and only read; green unlocks CHORE(close) but never performs it. No spec → spec criteria skip, quality gates still run. Slow suites (`verify.integration`, `verify.memory`) run only when the branch carries code. A user-surface change without a docs change is red until docs land or an override says why not.
 
 **LAND (after merge, or when the user confirms it merged):** pull the default branch, prune the merged worktree + branch, `make down` where defined.
 
@@ -213,16 +215,16 @@ Edit only approved scope; no opportunistic refactors. Stay in active worktree. C
 
 ### CONFORM
 
-Runs after EXECUTE, before VERIFY. Invokes the `conform` commands the repository declares in `.oracle/orly.json` and aggregates every gate verdict. Any 🔴 returns to EXECUTE; the lifecycle does not advance.
+Runs after EXECUTE, before VERIFY. Invokes the `conform` commands the repository declares in `.oracle/orly.json` and aggregates every gate verdict. Any 🔴 returns to EXECUTE; the lifecycle does not advance. This is the `work` gate's tier and the pre-commit hook runs it at every commit: declare a `conform` costing seconds, not minutes.
 <!-- oracle-packs:start product.agentsfleet -->
 In `agentsfleet` this stage is `make harness-verify`; its output block and end-of-turn audit detail live in `docs/HARNESS_VERIFY_OUTPUT.md`. Required rows: FILE SHAPE, PUB GATE, LENGTH GATE, MILESTONE-ID GATE, ZIG GATE, UI GATE, DESIGN TOKEN GATE, UFS GATE, SCHEMA GUARD, GREPTILE GATE, Architecture consult, Coverage, and `/orly-write-unit-test`.
 <!-- oracle-packs:end -->
 
 ### VERIFY
 
-Run the repository's declared `verify.*` commands from `.oracle/orly.json`. A package-scoped command never replaces a listed one.
+**Two cadences, one boundary.** Inside a Section, run CONFORM plus the declared lane covering the surface the Section touched — enough to prove a Section, reported as a Section claim. The repository's full declared `verify.*` set runs ONCE, at the milestone boundary, before the PR. A package-scoped command never replaces a listed one at either cadence, and a Section lane never satisfies a "tests pass" claim about the repository.
 <!-- oracle-packs:start product.agentsfleet -->
-The `agentsfleet` output block and exact tiers live in `docs/VERIFY_TIERS.md`. **FIRST: `/orly-write-unit-test`** audits diff coverage. **LAST: the Test Delta row** compares against the CHORE(open) baseline; zero or negative unit growth on a code-adding diff needs justification or a return to EXECUTE. Paste memory-leak evidence into PR Session Notes or cite its Continuous Integration (CI) URL. After refactors, list newly dead code before removing it.
+The `agentsfleet` output block and both cadences live in `docs/VERIFY_TIERS.md`. **FIRST: `/orly-write-unit-test`** audits diff coverage. **LAST: the Test Delta row** compares against the CHORE(open) baseline; zero or negative unit growth on a code-adding diff needs justification or a return to EXECUTE. Paste memory-leak evidence into PR Session Notes or cite its Continuous Integration (CI) URL. After refactors, list newly dead code before removing it.
 <!-- oracle-packs:end -->
 
 ### REVIEW
@@ -250,7 +252,7 @@ Required when spec involved — after last COMMIT, before PR. Also runs when par
 
 | # | When | Skill |
 |---|---|---|
-| 1 | VERIFY | `/orly-write-unit-test`, then `/orly-write-integration-test` — both before the PR, never skipped, never deferred |
+| 1 | VERIFY | `/orly-write-unit-test` once per Section over that Section's diff, and again at the boundary — never skipped, never deferred. Then `/orly-write-integration-test` at the boundary **when the diff crosses a module boundary with real input/output**; otherwise record `N/A — <reason>` in Session Notes. |
 | 2 | REVIEW | gstack `/review` — every runtime, same route; address findings or record a user-acked deferral; reviewer unavailable → Session Notes: *"skipped — <reason> <ts>; rerun before merge"* |
 | 3 | After every push | `orly-babysit-prs` — CI check runs + greptile inline threads + PR-level summary; stops on two consecutive empty polls with CI green; never `gh pr checks --watch` for greptile |