@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/policy/gate-registry.schema.yaml

@@ -0,0 +1,176 @@
+# Gate profile row schema — the contract every row in this directory satisfies.
+#
+# The `_` prefix keeps this file out of `run.sh`'s row discovery
+# (`find "$ADL_PROFILES_DIR" -name '*.yaml' ! -name '_*.yaml'`), so it can sit
+# beside the rows without being read as rows.
+#
+# This file is DATA, not prose. `.workflows/scripts/tests/gates/meta/test-profile-schema.sh`
+# executes it: every constraint below is checked by a generic driver that owns no
+# rules of its own. A requirement that is not written here is not enforced, and a
+# requirement written here cannot be quietly skipped by the driver.
+#
+# The row carries identity and governance, and EVERY row-level attribute is
+# mandatory: a gate that cannot name its controls, its grants, or its timeout is
+# not fully declared. Everything about HOW the gate runs is nested under
+# `engine`, because that is where it happens, and only there is presence
+# conditional.
+#
+# Relationship to `.workflows/config/gates/_schema.yaml`: that file describes the
+# three-file layout with `kind:`, `paths:`, `glob:`, `evidence:` and `lane:`. This
+# one describes the single registry that replaces it. They are not both true.
+schema: adl.gate-profile-schema/v1
+
+# --- attribute tree -----------------------------------------------------------
+# presence: always      -- must be present at its level
+#           conditional -- presence is decided by a cross-field rule below
+#           optional    -- may be absent, constrained when present
+# An entry carrying `attributes` is an object, and its children are checked at
+# that path. Unknown keys are reported at every level described here.
+attributes:
+  # --- identity ---------------------------------------------------------------
+  # THREE FIELDS, ONE IDENTITY EACH. Before 2026-08-28 there was one `id`
+  # carrying two incompatible conventions at once: 123 rows spelled
+  # `layout.directory-ratchet` and 11 spelled `PATH-001`, and this attribute
+  # admitted both because converting either way was read as a rename of stable
+  # identifiers (K-05).
+  #
+  # That reading was right about renames and wrong about the cause. The two
+  # forms were not two spellings of one thing; they were two DIFFERENT things
+  # sharing a field. `PATH-001` is a code id. `layout.directory-ratchet` is a
+  # domain and a name. The 11 code-id rows had no domain and no name recorded
+  # anywhere, and the 123 dotted rows had no stable code id -- so neither group
+  # could be addressed the way the other was, and `PATH-001` was additionally
+  # the row id AND one of the two rule ids that row emits, which are not the
+  # same namespace either.
+  #
+  # Splitting the field gives every row all three, and each is now answerable in
+  # one place.
+  - name: id
+    presence: always
+    type: string
+    unique: true
+    pattern: '^[A-Z][A-Z0-9]*-[0-9]{3}$'
+    doc: >-
+      THE identifier, and the only one anything inside the package uses:
+      ADL_GATE_ID, the disposition data, grant lookups, --execute-profile, and
+      every report. Domain prefix plus a three-digit number, allocated once and
+      never reused -- a retired gate's number is retired with it. It is
+      deliberately not derived from the name: renaming a gate must not change
+      what the estate calls it, which is what made the previous scheme brittle.
+
+  - name: name
+    presence: always
+    type: string
+    pattern: '^[a-z0-9]+(-[a-z0-9]+)*$'
+    doc: >-
+      what the gate is called, lower-kebab, unique within its domain. This is
+      the USER-FACING half: the CLI accepts `<domain>.<name>` and resolves it to
+      the row's id once, at the edge. Nothing internal reads it. A gate may be
+      renamed here without any internal reference changing, which is the point
+      of keeping it separate from `id`.
+      `<domain>.<name>` must be unique across the registry, or the CLI cannot
+      resolve it to one row. That is a constraint over PAIRS of rows and `check`
+      filters one row at a time, so it is not expressible in `rules:` below: the
+      CLI enforces it by refusing an address that matches more than one row,
+      naming both. Stated here so the gap is visible rather than assumed shut.
+
+  - name: domain
+    presence: always
+    type: string
+    pattern: '^[a-z0-9]+(-[a-z0-9]+)*$'
+    doc: >-
+      the concern the gate belongs to -- layout, framework, rust, typescript,
+      docs, database, and so on. Pairs with `name` to form the CLI address, and
+      pairs with nothing else: it is not a path, not an owner, and not a phase.
+
+  - name: title
+    presence: always
+    type: string
+    max_length: 80
+    doc: one line, what the gate enforces.
+
+  - name: severity
+    presence: always
+    type: string
+    enum: [H, M, L]
+    doc: H, M or L.
+
+  - name: controls
+    presence: always
+    type: array
+    min_items: 1
+    doc: compliance control ids this gate evidences.
+
+  - name: engine
+    presence: always
+    type: object
+    doc: how the gate runs. Every row has one.
+    attributes:
+      - name: rule
+        presence: optional
+        type: string
+        unique: true
+        doc: >
+          one ast-grep rule id, or absent -- a row with no rule is dispatched
+          to a Python check by id instead. At most one gate per rule. Rule ids
+          are unique across every library under `compliance/`, so the id
+          alone resolves the file and no second attribute names the language.
+
+      - name: scope
+        presence: always
+        type: array
+        min_items: 1
+        doc: >
+          SCOPE. Ordered list, last match wins, '!' excludes. Not a grant:
+          it carries no signature and there is nothing to shrink.
+
+      - name: suppression
+        presence: optional
+        type: string
+        doc: >
+          the biome lint rule this ast-grep `rule` is equivalent to. When
+          present, an adjacent `// biome-ignore <rule>: <reason>` comment
+          naming this same rule with a non-empty reason is honoured and the
+          match is skipped; a bare marker with no reason is not. Absent means
+          no equivalence is declared, and the row honours no suppression.
+
+  # There is no `owner` attribute, deliberately. A team roster is consumer data,
+  # not package data: naming one here would make the package unusable anywhere
+  # else, which is the same reason no consumer path appears in this tree. The
+  # attribute existed on all 142 rows and had exactly one consumer — a check that
+  # validated the value against an enum declared in this same file. It proved
+  # nothing about the gate and travelled nowhere. Accountability for a gate is
+  # recorded where accountability is actually tracked: the grant catalogue, where
+  # every entry carries an owner and a reason and is a signed decision.
+
+  - name: grants
+    presence: always
+    type: integer|string
+    doc: >
+      GRANTS. remaining = actual - granted; >0 fails, <0 fails (shrink).
+      Two spellings, one meaning. `0` is the count itself, written inline:
+      a gate that grants nothing needs no file, and 118 rows carry it.
+      A path names a catalog whose entries each carry an owner and a reason,
+      and the granted count is the number of entries in it. The count is
+      always a number someone signed rather than an absence either way.
+
+  - name: timeout_ms
+    presence: always
+    type: number
+    doc: wall-clock ceiling; exit 124 on breach.
+
+# --- cross-field constraints --------------------------------------------------
+# `check` is a jq filter applied to one row. It SELECTS the row when the row is
+# in violation, so emitting nothing means the row is clean. The driver reports
+# `id` for every row a check selects.
+#
+# Ids are stable. ROW-02 through ROW-05 were retired when `language` merged into
+# `rule` and `controls` became mandatory; the numbers are not reused. ROW-01,
+# ROW-06, ROW-07 and ROW-08 were retired with `engine.script` and `test`
+# themselves (owner ruling 2026-09-15: the shell gates are deleted and never
+# coming back) — each constrained one of those two dead fields, and neither
+# field exists to constrain any more. The numbers are not reused.
+rules:
+  - id: ROW-09
+    message: scope pattern must not be an absolute path
+    check: 'select(any(.engine.scope[]?; startswith("/") or startswith("!/")))'