@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.4

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/policy/gate-registry.alt.yaml

@@ -0,0 +1,791 @@
+# Gate profile rows — the single registry.
+#
+# Every gate in the repository is one row here. There is no second profile
+# file: `run.sh` discovers rows with `find "$ADL_PROFILES_DIR" -name '*.yaml'`
+# and concatenates them into one index, so a split across files never had a
+# runtime meaning. Rows are ordered by `id`; the prefix is the domain.
+#
+# A gate is a gate. It has no kind. Every row has an `engine:`, and everything
+# about how the gate runs lives inside it. The row's own attributes are
+# identity and governance only.
+#
+# Row attributes:
+#   id                 domain.slug, lower.kebab. The row's identity everywhere.
+#   title              one line, what the gate enforces.
+#   severity           H | M | L. H requires `controls`.
+#   controls           compliance control ids this gate evidences. Required for H.
+#   engine             how the gate runs. See below.
+#   phases             which lifecycle stages admit this row.
+#   grants             GRANTS. Each entry carries an owner and a reason.
+#                      remaining = actual - granted; >0 fails, <0 fails (shrink).
+#   timeout_ms         wall-clock ceiling; exit 124 on breach.
+#
+# engine attributes:
+#   rule               one ast-grep rule id, or absent -- a row with no rule
+#                      is dispatched to a Python check by id instead. One
+#                      gate, at most one rule. Rule ids are
+#                      unique across every library under `compliance/`, so
+#                      the id alone resolves the file and no second attribute
+#                      names the language.
+#   scope              SCOPE. Ordered list, last match wins, '!' excludes.
+#                      Not a grant: no signature, nothing to shrink.
+schema: adl.gate-profile/v1
+rows:
+
+  # ---- coverage ----
+  - id: COV-001
+    name: backend-crate
+    domain: coverage
+    title: Run retained backend crate coverage gate
+    severity: M
+    controls:
+      - EC-A.8.29
+    engine:
+      scope:
+        - <rust>/**
+    grants: 0
+    timeout_ms: 60000
+  - id: COV-002
+    name: backend-ratchet
+    domain: coverage
+    title: Reject backend coverage decline below its ratchet
+    severity: H
+    controls:
+      - EC-A.8.28
+    engine:
+      scope:
+        - <rust>/**
+    grants: 0
+    timeout_ms: 60000
+  - id: COV-003
+    name: baseline
+    domain: coverage
+    title: Run retained coverage baseline gate
+    severity: M
+    controls:
+      - EC-A.8.29
+    engine:
+      scope:
+        - <rust>/**
+    grants: 0
+    timeout_ms: 60000
+  - id: COV-004
+    name: config-committed
+    domain: coverage
+    title: Require coverage ratchet data to be committed
+    severity: M
+    controls:
+      - EC-A.8.29
+    engine:
+      scope:
+        - <compliance>/policy/inputs/coverage-baseline.json
+    grants: 0
+    timeout_ms: 60000
+  - id: COV-005
+    name: full
+    domain: coverage
+    title: Run retained coverage gate
+    severity: M
+    controls:
+      - EC-A.8.29
+    engine:
+      scope:
+        - <rust>/**
+        - <compliance>/checks/coverage/full/coverage-modules.list
+    grants: 0
+    timeout_ms: 60000
+
+  # ---- docs ----
+  - id: DOC-001
+    name: adr-lifecycle
+    domain: docs
+    title: Run retained ADR lifecycle gate
+    severity: M
+    controls:
+      - EC-A.5.37
+    engine:
+      scope:
+        - <docs>/decisions/**
+    grants: 0
+    timeout_ms: 60000
+  - id: DOC-002
+    name: english-only
+    domain: docs
+    title: Run retained English-only gate
+    severity: M
+    controls:
+      - EC-A.5.37
+    engine:
+      scope:
+        - '**'
+        # This package's OWN test data is not prose it may grade. The
+        # english-only fixtures are deliberately Han text -- they exist to prove
+        # the check detects it -- so grading them made the gate permanently red
+        # against its own repository. Same spelling as the sixteen rows already
+        # normalised; do not invent a seventh.
+        - '!**/fixtures/**'
+        # Colocated test modules, same reason and the same shape as the existing
+        # `!**/{*_test.rs,*_tests.rs,...}` exclusion seven other rows carry: this
+        # package puts `test_check.py` BESIDE `check.py`, so a `fixtures/` glob
+        # cannot reach it. `docs/english_only/test_check.py` holds Han text
+        # inline to prove the detector fires.
+        # COVERAGE COST, stated not buried: 93 colocated `test_*.py` files stop
+        # being graded for english-only. Accepted because a test asserting a
+        # non-English string is indistinguishable, to this check, from prose
+        # written in the wrong language.
+        - '!**/test_*.py'
+        # Same reasoning, the TypeScript-shaped colocated test file: this scope
+        # excluded `test_*.py` but nothing that names a TypeScript test the way
+        # every managed repo's own convention does. Caught live against
+        # enact-vps-m5: `global-tools/test/install-embedding-model.test.ts`
+        # asserts that `selectVocabulary` DROPS non-Latin-script tokens, and
+        # embeds a CJK literal as the negative-test input -- exactly
+        # the "test asserting a non-English string" case above, just in `.ts`
+        # rather than `.py`. COVERAGE COST, stated not buried: 548 colocated
+        # `*.test.ts`/`*.test.tsx` files across the four managed repos
+        # (enact-m5 400, enact-vps-m5 134, enact-repo-controls-m5 14,
+        # enact-extensions 0) stop being graded for english-only.
+        - '!**/*.test.ts'
+        - '!**/*.test.tsx'
+        # The four exclusions removed here named
+        # `<typescript>/packages/desktop/...` and `<typescript>/tests/unit/...`
+        # -- one repository's files written into the shared package. Measured
+        # before removing: 0 of the 4 exist in ANY of the four managed
+        # repositories, so they excluded nothing anywhere. If a consumer ever
+        # has legitimately non-English source, it declares that itself.
+    grants: 0
+    timeout_ms: 60000
+  - id: DOC-004
+    name: index-updated
+    domain: docs
+    title: Run retained docs-index gate
+    severity: M
+    controls:
+      - EC-A.5.37
+    engine:
+      scope:
+        - <docs>/**
+    grants: 0
+    timeout_ms: 60000
+  - id: DOC-005
+    name: markdown-ast
+    domain: docs
+    title: Parse Markdown through the retained AST gate
+    severity: M
+    controls:
+      - EC-A.5.37
+    engine:
+      scope:
+        - '<docs>/**'
+        - '<plans>/**'
+    grants: 0
+    timeout_ms: 60000
+  - id: DOC-006
+    name: okf-profile
+    domain: docs
+    title: Require documents to satisfy their OKF profile
+    severity: M
+    controls:
+      - EC-A.5.37
+    engine:
+      # docs/ only. The plans tree is deliberately NOT here: its
+      # frontmatter answers to the board -- `status` is a work item state,
+      # `work_item` is a link, `type` is pbi or bug -- and forcing it through
+      # the OKF register meant bending `common_required` for every other
+      # document kind to suit it. LAY-009 owns plans/ frontmatter instead.
+      scope:
+        - <docs>/**
+        # A holding area for work that is not yet a Feature on the board. It has
+        # no OKF profile by design: grading it would force a plan to be filed as
+        # architecture, which is the misclassification this tree exists to avoid.
+        - '!<docs>/proposals/**'
+        # DISABLED 2026-09-15, pending a real compliance audit. The Compliance
+        # Assessment profile wants control_ids, owner, review_frequency and
+        # evidence_retention -- audit metadata a writer cannot infer from the
+        # document. The one page here is a running gap register, a chronological
+        # log of findings and their evidence, which is no more a compliance
+        # assessment than a knowledge index is a document about the system
+        # (5e257e0 excluded indexes for that reason). Re-enable with the audit.
+        - '!<docs>/compliance/**'
+        # Tree guides are not OKF documents. AGENTS.md and CLAUDE.md say what
+        # belongs in a directory; they are governed by layout.agents-layout,
+        # and no profile here describes them — so grading them only ever
+        # reports "no profile matches this path" for files that correctly have
+        # none.
+        - '!<docs>/**/AGENTS.md'
+        - '!<docs>/AGENTS.md'
+        - '!<docs>/**/CLAUDE.md'
+        - '!<docs>/CLAUDE.md'
+        # A knowledge index is a catalog of a tree, not a document about the
+        # system. docs.indexes (KNW-001) already declares what frontmatter and
+        # sections each index must carry and grades it against the inventory it
+        # catalogues; judging it a second time against the profile of the tree
+        # it indexes asks it to be an architecture page as well as the list of
+        # them.
+        - '!<docs>/**/index.md'
+    grants: 0
+    timeout_ms: 60000
+  - id: DOC-007
+    name: semantics
+    domain: docs
+    title: Run retained documentation semantics gate
+    severity: M
+    controls:
+      - EC-A.5.37
+    engine:
+      scope:
+        - <docs>/**
+    grants: 0
+    timeout_ms: 60000
+
+  # ---- frontend ----
+  - id: DOC-008
+    name: indexes
+    domain: docs
+    title: Run retained knowledge-index gate
+    severity: M
+    controls:
+      - EC-A.5.37
+    engine:
+      scope:
+        - '<docs>/*.md'
+        - '<plans>/*.md'
+        - '<docs>/**/*.md'
+        - '<plans>/**/*.md'
+    grants: 0
+    timeout_ms: 60000
+  - id: DOC-009
+    name: ledger
+    domain: docs
+    title: Run retained knowledge-ledger gate
+    severity: M
+    controls:
+      - EC-A.5.37
+    engine:
+      # INVERTED 2026-09-17: the artifact this gate validates is
+      # `<plans>/LEDGER.md`, not `<plans>/LEDGER.yaml`. The Markdown ledger is
+      # already selected by `<plans>/*.md` below, so it needs no entry of its
+      # own; the `LEDGER.yaml` entry STAYS so that touching a leftover YAML
+      # ledger still runs the gate that now reports it as superseded. A stale
+      # scope is a silent pass (K-17).
+      #
+      # Still not covered: the gate also checks that every ref names an
+      # existing path, and those point at arbitrary repository files, not
+      # only Markdown. Deleting a non-Markdown ref target does not trigger this
+      # row. Widening to `**` would run the gate on every change in the
+      # repository, which is a scheduling decision, not a scope correction.
+      scope:
+        - <plans>/LEDGER.yaml
+        - '<docs>/*.md'
+        - '<plans>/*.md'
+        - '<docs>/**/*.md'
+        - '<plans>/**/*.md'
+    grants: 0
+    timeout_ms: 60000
+  - id: DOC-010
+    name: closed-set
+    domain: docs
+    title: Require the declared docs/ folder shape
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      # `docs.semantics` (DOC-007) filters to a fixed collection list before it
+      # grades a single page, but a path outside that list is never selected —
+      # it does not reach a branch that could name it (plans/GAPS-AND-FINDINGS.md,
+      # "docs/ has no closed-set check"). This gate reads the docs-root listing
+      # directly and reports anything undeclared, the same shape LAY-012 uses
+      # for the repository root.
+      scope:
+        - '<docs>/*'
+        - '<docs>/**'
+    grants: 0
+    timeout_ms: 60000
+
+  # ---- layout ----
+  - id: LAY-001
+    name: agents-layout
+    domain: layout
+    title: Run retained AGENTS layout gate
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      # `**/…` needs a slash, so it cannot match the repository-root pair. That
+      # was invisible while the gate walked the index itself and filtered by
+      # basename; now that the row is the only scope, the root AGENTS.md has to
+      # be named or rule 2 stops checking the one guide every other one hangs
+      # off. Same shape as framework.recipe-references, which lists `AGENTS.md`
+      # and `**/AGENTS.md` for the same reason.
+      # Fixtures are excluded, last match winning over the `**/` include above.
+      # A fixture corpus under compliance/fixtures/ is a miniature repo tree,
+      # so it carries docs/AGENTS.md and friends as TEST INPUT -- with no
+      # sibling CLAUDE.md, correctly, because a fixture is not a guide. This
+      # row is now the gate's only scope, so the exclusion has to be stated
+      # here; while the gate walked the index itself and filtered by basename
+      # the omission was invisible. Same pattern, same reason, as
+      # layout.markdown-trees below.
+      scope:
+        - '{AGENTS,CLAUDE}.md'
+        - '**/{AGENTS,CLAUDE}.md'
+        - <compliance>/checks/layout/agents-layout/check.sh
+        - '!**/fixtures/**'
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-002
+    name: ci-paths
+    domain: layout
+    title: Run retained CI paths gate
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      scope:
+        - <workflows>/{scripts,pipelines,config}/**
+        # The gate reads a path-shaped STRING; it cannot tell one the script will
+        # open from one it merely contains. In a test harness that difference is
+        # the whole file: `*coverage/command.ts*) exit 0 ;;` is a stub's case
+        # pattern, and `printf 'path="infra/.local/foo"' >"$FIXTURE/good.sh"` is
+        # the script WRITING its own fixture. Both were reported as CI
+        # referencing an invisible path.
+        #
+        # Same shape as LAY-014's `!<workflows>/scripts/**/fixtures/**`, one
+        # level up. COVERAGE COST, stated rather than buried: this drops 19 of
+        # enact-m5's 44 `workflows/scripts/` files (43%) from the gate. The risk
+        # it trades away is small — a TEST that truly needs a gitignored file
+        # fails loudly in CI, whereas a production CI script referencing one can
+        # silently skip, and production scripts are all still graded.
+        - '!<workflows>/scripts/tests/**'
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-004
+    name: directory-ratchet
+    domain: layout
+    title: Prevent directory shape growth across every registered tree
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      scope:
+        - <typescript>/**
+        - <rust>/**
+        - <infra>/**
+        - <dev>/**
+        - <workflows>/**
+        # A single '*' cannot cross a '/': it is one path segment, not "the rest
+        # of the subtree". Confirmed live against this checkout, not just the
+        # ported test fixture — locales/de/common.json sits two segments below
+        # locales/, and real crate/build/terraform files sit at varying depths
+        # below their prefix (`rg`/`find` measured 2 and 4 segments for
+        # Cargo.toml, 4 for build.rs, 2 through 5 for main.tf) — every nested
+        # occurrence was silently unexcluded until these five became '**'.
+        - '!<typescript>/packages/desktop/src/renderer/services/i18n/locales/**'
+        - '!<rust>/crates/enact-app/assets/builtin-skills/**'
+        - '!<rust>/crates/enact-app/assets/builtin-harnesses/*'
+        - '!<dev>/seed/access/*'
+        - '!<dev>/seed/infra/*'
+        - '!<dev>/seed/tenancy/*'
+        - '!<dev>/scripts/*'
+        - '!<dev>/ops/*'
+        - '!**/Cargo.toml'
+        - '!**/build.rs'
+        - '!**/main.tf'
+        # No named-input entry for the ratchet register: it is package data now
+        # (src/adl_compliance/checks/layout/directory_ratchet/grants.yaml,
+        # read via `resources`, not a consumer path), so editing it does not
+        # select this gate -- the same known gap DOC-006's packaged profile
+        # register has (see INVARIANTS.md, "What is not true yet").
+    # Tree-scoped only. Every verdict is a directory's DIRECT FILE COUNT, which
+    # is only knowable by listing all of that directory's children: on a diff
+    # scope DIR-002 can never fire and DIR-001's single-file rule misfires on
+    # any directory with exactly one file in the change. The check previously
+    # sat on these incremental phases and covered for it by scanning the whole
+    # tree anyway and then filtering the report -- the hidden walk this sweep
+    # removes. `full` (`selects: all-rows`) picks this row up regardless.
+    # Not an exception catalogue: `structural_grant = True` on the check
+    # already forces the allowance to 0 regardless of this field. The ratchet
+    # register itself is package data, read via `resources` (see check.py).
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-006
+    name: markdown-trees
+    domain: layout
+    title: Require Markdown in approved documentation trees
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      # `.mdx` is here because the gate has always graded it -- its pathspecs
+      # named `'*.md' '*.mdx'` -- while the row named only `.md`. That gap cost
+      # nothing while the row's scope was inert; once the scope became the
+      # authority over the file set it would have silently stopped checking
+      # every .mdx page, which is the failure mode a narrower-than-the-gate row
+      # produces: no error, just less checked than the row appears to promise.
+      # `!**/fixtures/**` last, because last match wins: a corpus is a
+      # directory of files in the exact shapes a gate forbids, so a fixture for
+      # ANY rule looks like a violation of this one. The same exclusion is
+      # already carried by framework.no-silent-degrade for the same reason.
+      scope:
+        - '*.md'
+        - '**/*.md'
+        - '*.mdx'
+        - '**/*.mdx'
+        - '!**/fixtures/**'
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-008
+    name: placement
+    domain: layout
+    title: Run retained placement gate
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      scope:
+        - '*'
+        - '*.{log,tmp,bak,swp}'
+        - '**/*.{log,tmp,bak,swp}'
+        - <compliance>/checks/layout/placement/check.sh
+        # The corpora under placement-allowed/ and placement-stray/ are the
+        # gate's own test input: enumerated asset paths, a screenshot, a
+        # markdown file inside a crate src/ tree, and a file under retired
+        # apps/. Graded as production content they are exactly the findings
+        # the gate exists to raise.
+        - '!**/fixtures/**'
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-009
+    name: plans-layout
+    domain: layout
+    title: Run retained plans-layout gate
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      scope:
+        - <plans>/**
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-010
+    name: profile-data
+    domain: layout
+    title: Enforce data-backed layout profile predicates
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      # The two `*.md` globs are removed. They are residue from the multi-mode
+      # profile-data.sh this engine was split out of: its `layout.markdown-trees`
+      # branch read Markdown, and that branch now lives in its own gate
+      # (check-markdown-tree-location.sh) with its own row. This engine reads
+      # PostgreSQL migrations and nothing else, so the globs only made every
+      # documentation change schedule a gate with nothing to say. A stale scope
+      # is a silent pass in one direction and dead work in the other (K-17).
+      scope:
+        - <rust>/crates/**
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-011
+    name: references
+    domain: layout
+    title: Run retained references gate
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      # `.plans/c_done/**` is excluded here because the gate used to exclude it
+      # in its own code, and an exclusion belongs in the row rather than in a
+      # second surface inside the check. A completed plan is a historical
+      # record: it names paths that were real when it was written, and it is
+      # not rewritten when they move. Note the exclusion never took effect --
+      # it lived in a `git ls-files -z` branch whose reader dropped the whole
+      # stream (see the check's header) -- so this states the intent for the
+      # first time rather than preserving a measured behaviour.
+      scope:
+        - '<docs>/**'
+        - '<plans>/**'
+        - '!<plans>/c_done/**'
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-012
+    name: root-closed-set
+    domain: layout
+    title: Require the declared repository root shape
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      # The negations are gitignored local working state at the repository
+      # root. They are not new policy: the gate reached the same answer through
+      # `git ls-files`, whose index omits every ignored path, so the tolerance
+      # already existed — it just lived inside the mechanism where no reviewer
+      # could see it. The gate no longer asks git, so the row has to say it.
+      #
+      # The patterns carry `/**` because the gate reads FULL PATHS and recovers
+      # depth 1 from them, the way the `git ls-files` version did. An interim
+      # version listed depth-1 names directly with `find -maxdepth 1` and these
+      # were bare (`!.cache`); that traversal is gone, so a bare name would now
+      # match nothing and the exclusion would be silently inert (K-17).
+      #
+      # `.git` is here because set_scope_paths' no-set-given traversal is a
+      # plain `find` that would otherwise descend into it; git's index never
+      # did. `.code-review-graph` is deliberately NOT excluded: it is untracked
+      # but declared in the gate's ALLOWED_DIRS, so it must stay visible or the
+      # declared-but-missing arm would report it.
+      scope:
+        - '**'
+        - '!.git/**'
+        - '!.DS_Store'
+        - '!.cache/**'
+        - '!.enactrs/**'
+        - '!.pytest_cache/**'
+        - '!.ruff_cache/**'
+        - '!.scratch/**'
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-013
+    name: root-markdown-allowlist
+    domain: layout
+    title: Run retained root Markdown allowlist gate
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      # `!**/fixtures/**` for the same reason layout.markdown-trees and
+      # framework.recipe-references carry it: a gate's fixture corpus is by
+      # construction a directory of the exact shapes that gate forbids, so
+      # grading it reports every fixture as a violation of itself.
+      #
+      # This only became visible when the gate stopped calling `git ls-files`,
+      # which lists TRACKED files only — a newly added, still-untracked
+      # Markdown file was never graded until someone committed it. The runner's
+      # set is changed files, untracked ones included, so the exclusion has to
+      # be stated rather than fall out of the mechanism.
+      scope:
+        - '*.md'
+        - '**/README.md'
+        - '!**/fixtures/**'
+    grants: 0
+    timeout_ms: 60000
+  - id: LAY-014
+    name: scripts-size-depth
+    domain: layout
+    title: Bound workflow script directory size and depth
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      # The fixture exclusion is not new policy. The gate applied it in code,
+      # switched on by comparing its own resolved root against
+      # `git rev-parse --show-toplevel`; eleven of its twelve findings were
+      # meta-gate fixtures that mirror a .workflows/scripts tree inside
+      # themselves, so the gate measured the mirror instead of the real
+      # directory. The exclusion moves here, where it is reviewable, and it
+      # applies in every run rather than only when the gate decided it was
+      # looking at the real repository.
+      scope:
+        - <workflows>/scripts/**
+        - '!<workflows>/scripts/**/fixtures/**'
+    grants: 0
+    timeout_ms: 60000
+
+  - id: LAY-016
+    name: open-work-cap
+    domain: layout
+    title: No open plans or open gaps
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      scope:
+        - <plans>/**
+    grants: 0
+    timeout_ms: 60000
+
+  # ---- lfs ----
+  - id: LFS-001
+    name: integrity
+    domain: lfs
+    title: Every blob over 1 MiB enters Git through LFS
+    severity: M
+    controls:
+      - EC-A.8.9
+    engine:
+      scope:
+        - '**'
+        # The LFS fixtures are deliberately oversized binaries committed WITHOUT
+        # LFS -- that is precisely what they prove the check detects. Grading
+        # them means a package that fixture-tests "large blobs must use LFS"
+        # can never pass its own gate.
+        - '!**/fixtures/**'
+    grants: 0
+    timeout_ms: 60000
+
+  - id: PIP-004
+    name: phase-disjoint
+    domain: pipeline
+    title: Enforce phase mutual exclusion across every registry row
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      # Scope is SELECTION, not resolution. The check finds the registry
+      # structurally, from its own position in the package, and that is why it
+      # needs no path here to READ it -- but scope decides whether a changed
+      # file makes this row run at all, and an empty scope matches nothing. The
+      # gate that enforces phase disjointness across the registry was therefore
+      # never selected by a change to the registry: the one edit that can break
+      # it was the one edit that did not run it.
+      scope:
+        - <compliance>/policy/gate-registry.yaml
+    grants: 0
+    timeout_ms: 60000
+
+  # ---- repository ----
+  - id: REP-001
+    name: license-declared
+    domain: repository
+    title: Repository ships the licence it declares
+    severity: M
+    controls:
+      - EC-A.5.32
+    engine:
+      scope:
+        # Two files, because the gate asks two things: does LICENSE exist, and
+        # does it match what `[controls.compliance].license` declares. Both are
+        # structural — asserted BY PATH, since LICENSE-MISSING is about a file's
+        # ABSENCE and an absent file is in no file set. They are listed so the
+        # runner selects this row when either side of the pair changes.
+        #
+        # What used to be here — NOTICE, three manifests, five root documents,
+        # all of `docs/`, a donor-brand exclusion for `.donors/aionui/` — served
+        # rules that required the Apache License 2.0 text and scanned prose for
+        # another estate's brand names. Removed 2026-09-15 with those rules: the
+        # licence is the repository's declaration, not this package's answer.
+        - LICENSE
+        - adl-config.toml
+    grants: 0
+    timeout_ms: 60000
+  - id: REP-002
+    name: lockfile-integrity
+    domain: repository
+    title: Require present and Cargo-valid lockfiles
+    severity: H
+    controls:
+      - EC-A.5.21
+    engine:
+      scope:
+        - <rust>/Cargo.toml
+        - <rust>/Cargo.lock
+        - <typescript>/package.json
+        - <typescript>/bun.lock
+    grants: 0
+    timeout_ms: 60000
+  - id: REP-004
+    name: no-banned-commands
+    domain: repository
+    title: Forbid banned command invocations in shell scripts and justfiles
+    severity: M
+    controls:
+      - EC-A.5.36
+    engine:
+      scope:
+        # Both GIT-001 (no version-control invocation) and GRP-001 (no
+        # standalone grep, use rg) are restricted to the compliance package --
+        # a deliberate, explicit decision (both are compliance gates), not an
+        # inherited default. Neither rule is about the rest of the repository,
+        # so nothing here is expressed as an extension glob any more: the old
+        # repository-wide `*.{sh,bash,...}` list existed only because GRP-001
+        # used to run everywhere and needed to exclude non-shell files from a
+        # much larger candidate set. Restricted to compliance/**, that ceiling
+        # is gone -- check.sh's own shell/justfile filter is enough.
+        - <compliance>/**
+        # The scope contract itself. `discover_files` lists the tree through the
+        # version-control plumbing; every other file in this package reaches it
+        # through this one, which is why it is exempted here rather than at each
+        # caller. Out of scope, not granted: the rule does not apply to the
+        # implementation of the mechanism it exists to make optional everywhere
+        # else.
+        - '!<compliance>/lib/discovery.sh'
+        # The same exemption, on the test side. `_corpus-set.sh` is the one
+        # place a fixture enumerates its corpus, and it asks the corpus the
+        # same question the runner asks the repository, through the same
+        # plumbing -- deliberately, so the set a test hands over is the same
+        # KIND of set production hands over. Every converted gate test reaches
+        # it through this file, which is why it is exempted here rather than at
+        # each caller.
+        - '!<compliance>/checks/framework/_corpus-set.sh'
+        # EVERY gate's fixture corpus, not just this row's. A fixture is
+        # deliberate violation material -- both halves of this row's own corpus
+        # contain real invocations on purpose -- and graded as production
+        # content it fails the gate it exists to prove. Declared here rather
+        # than skipped inside the check: path exclusions carry no default in
+        # this tree.
+        - '!**/fixtures/**'
+    grants: 0
+    timeout_ms: 60000
+  - id: REP-005
+    name: ignored-paths
+    domain: repository
+    title: Never commit a path .gitignore excludes
+    severity: M
+    controls:
+      - EC-A.5.9
+    engine:
+      scope:
+        - '**'
+    grants: 0
+    timeout_ms: 60000
+  - id: REL-001
+    name: changeset-plan
+    domain: release
+    title: Run retained changeset-plan gate
+    severity: M
+    controls:
+      - EC-A.8.32
+    engine:
+      scope:
+        # The gate's own "release-relevant" case list, which is six paths, not
+        # one tree. `.changeset/**` alone understated it by five: while the gate
+        # resolved its own diff those five were still tested, so the row and the
+        # code disagreed and the code won. Now the row is the narrowing, so a
+        # missing entry here is a file the gate can no longer see.
+        - .changeset/**
+        - VERSION
+        - CHANGELOG.md
+        - <workflows>/package.json
+        - <workflows>/changesets/package.json
+        - <workflows>/changesets/bun.lock
+    grants: 0
+    timeout_ms: 60000
+  - id: REL-004
+    name: version-release
+    domain: release
+    title: Run retained version-release gate
+    severity: M
+    controls:
+      - EC-A.8.32
+    engine:
+      scope:
+        # The FOUR files check.sh actually reads: VERSION and CHANGELOG.md
+        # directly, plus the two entries in its `versioned_files` array. The
+        # prior brace-glob form, `{VERSION,CHANGELOG.md,backend/Cargo.toml,
+        # frontend/package.json,.changeset}/**`, appended `/**` after each
+        # FILE name -- `_glob_bash_pattern` in lib/glob.sh requires a literal
+        # "/" then more characters after the alternation, which a bare file
+        # never has, so the pattern matched none of VERSION, CHANGELOG.md,
+        # backend/Cargo.toml or frontend/package.json and only `.changeset/**`
+        # ever selected this row (K-13: a positive glob matching nothing
+        # excludes everything). backend/Cargo.toml (0.1.52) and
+        # frontend/package.json (2.1.41) carry their own independent
+        # versioning, not the release VERSION (0.0.11) -- check.sh does not
+        # read either, so they are not restored here; adding them would
+        # trigger this gate for two files it has no logic to grade.
+        - VERSION
+        - CHANGELOG.md
+        - <workflows>/package.json
+        - <workflows>/changesets/package.json
+    grants: 0
+    timeout_ms: 60000
+
+  # ---- rust ----