@ankhorage/doctor 0.11.7 → 0.11.9

package/src/analysis.ts

@@ -2,10 +2,12 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 
+import { ARCHITECTURE_POLICY } from '@ankhorage/policy/architecture';
 import { uniqueSortedStrings } from '@ankhorage/utility/array';
 
 import type { DoctorDiagnostic, DoctorPolicyProfile, DoctorRuleId } from './diagnostics.js';
 import type { DoctorReadiness } from './readiness.js';
+import { getArchitecturePolicyRule } from './utils/getArchitecturePolicyRule.js';
 
 export type DoctorTargetCheck = 'manifest' | 'package' | 'repo';
 export type DoctorTargetMode = 'fix' | 'package' | 'repo' | 'validate';
@@ -65,21 +67,7 @@ const REPO_MARKERS = [
   { label: 'yarn.lock', relativePath: 'yarn.lock' },
 ] as const;
 
-const REQUIRED_PUBLIC_PACKAGE_SCRIPTS = [
-  'build',
-  'typecheck',
-  'lint',
-  'lint:fix',
-  'format',
-  'format:check',
-  'test',
-  'test:standalone',
-  'knip:check',
-  'docs',
-  'changeset',
-  'changeset:status',
-  'version-packages',
-] as const;
+const PUBLIC_PACKAGE_POLICY = ARCHITECTURE_POLICY.publicPackage;
 
 const PROVIDER_SOURCE_CANDIDATES = [
   path.join('src', 'ankh.provider.ts'),
@@ -245,46 +233,16 @@ async function analyzeRepoPolicy(request: {
   const diagnostics: DoctorDiagnostic[] = [];
 
   if (request.profile === 'public-package') {
-    await maybeRequirePath(
-      diagnostics,
-      request.plannedChanges,
-      request.targetPath,
-      'README.md',
-      'repo.readme.required',
-      'create-file',
-    );
-    await maybeRequirePath(
-      diagnostics,
-      request.plannedChanges,
-      request.targetPath,
-      'CHANGELOG.md',
-      'repo.changelog.required',
-      'create-file',
-    );
-    await maybeRequirePath(
-      diagnostics,
-      request.plannedChanges,
-      request.targetPath,
-      'LICENSE',
-      'repo.license.required',
-      'create-file',
-    );
-    await maybeRequirePath(
-      diagnostics,
-      request.plannedChanges,
-      request.targetPath,
-      '.changeset',
-      'repo.changeset.required',
-      'create-directory',
-    );
-    await maybeRequirePath(
-      diagnostics,
-      request.plannedChanges,
-      request.targetPath,
-      path.join('.github', 'workflows'),
-      'repo.workflows.required',
-      'create-directory',
-    );
+    for (const artifact of PUBLIC_PACKAGE_POLICY.requiredRepoPaths) {
+      await maybeRequirePath(
+        diagnostics,
+        request.plannedChanges,
+        request.targetPath,
+        artifact.path,
+        artifact.ruleId,
+        artifact.kind === 'file' ? 'create-file' : 'create-directory',
+      );
+    }
   }
 
   if (request.profile === 'integration-monorepo') {
@@ -362,29 +320,11 @@ async function analyzePackagePolicy(request: {
   const { packageJson } = request;
 
   if (request.profile === 'public-package') {
-    requireNonEmptyStringField({
+    requirePublicPackageFields({
       diagnostics,
       packageJson,
       packageJsonPath: request.packageJsonPath,
       profile: request.profile,
-      ruleId: 'package.json.name.required',
-      fieldName: 'name',
-    });
-    requireNonEmptyStringField({
-      diagnostics,
-      packageJson,
-      packageJsonPath: request.packageJsonPath,
-      profile: request.profile,
-      ruleId: 'package.json.version.required',
-      fieldName: 'version',
-    });
-    requireNonEmptyStringField({
-      diagnostics,
-      packageJson,
-      packageJsonPath: request.packageJsonPath,
-      profile: request.profile,
-      ruleId: 'package.json.type.required',
-      fieldName: 'type',
     });
   }
 
@@ -401,79 +341,6 @@ async function analyzePackagePolicy(request: {
     );
   }
 
-  requireNonEmptyStringField({
-    diagnostics,
-    packageJson,
-    packageJsonPath: request.packageJsonPath,
-    profile: request.profile,
-    ruleId: 'package.json.description.required',
-    fieldName: 'description',
-  });
-  requireRecordField({
-    diagnostics,
-    packageJson,
-    packageJsonPath: request.packageJsonPath,
-    profile: request.profile,
-    ruleId: 'package.json.repository.required',
-    fieldName: 'repository',
-  });
-  requireNonEmptyStringField({
-    diagnostics,
-    packageJson,
-    packageJsonPath: request.packageJsonPath,
-    profile: request.profile,
-    ruleId: 'package.json.homepage.required',
-    fieldName: 'homepage',
-  });
-  requireRecordField({
-    diagnostics,
-    packageJson,
-    packageJsonPath: request.packageJsonPath,
-    profile: request.profile,
-    ruleId: 'package.json.bugs.required',
-    fieldName: 'bugs',
-  });
-  requireNonEmptyStringField({
-    diagnostics,
-    packageJson,
-    packageJsonPath: request.packageJsonPath,
-    profile: request.profile,
-    ruleId: 'package.json.license.required',
-    fieldName: 'license',
-  });
-  requireStringArrayField({
-    diagnostics,
-    packageJson,
-    packageJsonPath: request.packageJsonPath,
-    profile: request.profile,
-    ruleId: 'package.json.keywords.required',
-    fieldName: 'keywords',
-  });
-  requireStringArrayField({
-    diagnostics,
-    packageJson,
-    packageJsonPath: request.packageJsonPath,
-    profile: request.profile,
-    ruleId: 'package.json.files.required',
-    fieldName: 'files',
-  });
-  requireRecordField({
-    diagnostics,
-    packageJson,
-    packageJsonPath: request.packageJsonPath,
-    profile: request.profile,
-    ruleId: 'package.json.exports.required',
-    fieldName: 'exports',
-  });
-  requireRecordField({
-    diagnostics,
-    packageJson,
-    packageJsonPath: request.packageJsonPath,
-    profile: request.profile,
-    ruleId: 'package.json.publish-config.required',
-    fieldName: 'publishConfig',
-  });
-
   if (packageJson.private === true) {
     diagnostics.push(
       createDiagnostic({
@@ -481,35 +348,38 @@ async function analyzePackagePolicy(request: {
         message: 'Public package profiles must not set private: true.',
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.json.private.public-package-disallowed',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.privateDisallowedRuleId),
       }),
     );
   }
 
-  if (packageJson.type !== undefined && packageJson.type !== 'module') {
+  if (
+    packageJson.type !== undefined &&
+    packageJson.type !== PUBLIC_PACKAGE_POLICY.packageType.value
+  ) {
     diagnostics.push(
       createDiagnostic({
         code: 'field-invalid',
-        message: 'package.json "type" must be "module".',
+        message: `package.json "type" must be "${PUBLIC_PACKAGE_POLICY.packageType.value}".`,
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.json.type.module',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.packageType.ruleId),
       }),
     );
   }
 
   const { publishConfig } = packageJson;
-  if (isRecord(publishConfig) && publishConfig.access !== 'public') {
+  if (
+    isRecord(publishConfig) &&
+    publishConfig.access !== PUBLIC_PACKAGE_POLICY.publishAccess.value
+  ) {
     diagnostics.push(
       createDiagnostic({
         code: isNonEmptyString(publishConfig.access) ? 'field-invalid' : 'field-missing',
-        message: 'package.json publishConfig.access must exist and equal "public".',
+        message: `package.json publishConfig.access must exist and equal "${PUBLIC_PACKAGE_POLICY.publishAccess.value}".`,
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.json.publish-config.public',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.publishAccess.ruleId),
       }),
     );
   }
@@ -521,8 +391,7 @@ async function analyzePackagePolicy(request: {
         message: 'package.json must define a Bun-aligned packageManager field.',
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.json.package-manager.required',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.packageManager.requiredRuleId),
       }),
     );
     request.plannedChanges.push(
@@ -530,7 +399,7 @@ async function analyzePackagePolicy(request: {
         description: `Add packageManager: "bun@${Bun.version}" to package.json.`,
         filePath: request.packageJsonPath,
         kind: 'update-json',
-        ruleId: 'package.json.package-manager.required',
+        ruleId: PUBLIC_PACKAGE_POLICY.packageManager.requiredRuleId,
       }),
     );
   } else if (!packageJson.packageManager.startsWith('bun@')) {
@@ -540,23 +409,21 @@ async function analyzePackagePolicy(request: {
         message: 'package.json packageManager must be Bun-aligned, for example "bun@1.x".',
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.json.package-manager.bun',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.packageManager.bunRuleId),
       }),
     );
   }
 
   const scripts = isRecord(packageJson.scripts) ? packageJson.scripts : null;
-  for (const scriptName of REQUIRED_PUBLIC_PACKAGE_SCRIPTS) {
-    if (scripts === null || !isNonEmptyString(scripts[scriptName])) {
+  for (const requirement of PUBLIC_PACKAGE_POLICY.requiredScripts) {
+    if (scripts === null || !isNonEmptyString(scripts[requirement.name])) {
       diagnostics.push(
         createDiagnostic({
           code: 'missing-script',
-          message: `Missing required package script: ${scriptName}`,
+          message: `Missing required package script: ${requirement.name}`,
           path: request.packageJsonPath,
           profile: request.profile,
-          ruleId: mapScriptRule(scriptName),
-          severity: 'error',
+          ...architecturePolicyRuleFields(requirement.ruleId),
         }),
       );
     }
@@ -573,8 +440,7 @@ async function analyzePackagePolicy(request: {
         message: 'Public package repos must declare TypeScript in dependencies or devDependencies.',
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.dependencies.typescript.required',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.dependencyRules.typescript),
       }),
     );
   }
@@ -597,8 +463,7 @@ async function analyzePackagePolicy(request: {
         message: 'Public package repos must declare @types/bun in devDependencies.',
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.dependencies.types-bun.required',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.dependencyRules.bunTypes),
       }),
     );
   }
@@ -610,8 +475,7 @@ async function analyzePackagePolicy(request: {
         message: 'Public package repos must declare @types/node in devDependencies.',
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.dependencies.types-node.required',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.dependencyRules.nodeTypes),
       }),
     );
   }
@@ -624,8 +488,7 @@ async function analyzePackagePolicy(request: {
           'This package consumes shared Ankhorage lint/format/knip tooling and must declare @ankhorage/devtools.',
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.dependencies.devtools.required',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.dependencyRules.devtools),
       }),
     );
   }
@@ -641,8 +504,7 @@ async function analyzePackagePolicy(request: {
         message: 'This package owns Paradox docs generation and must declare @ankhorage/paradox.',
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.dependencies.paradox.required',
-        severity: 'error',
+        ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.dependencyRules.paradox),
       }),
     );
   }
@@ -684,8 +546,7 @@ function createChangesetsDependencyDiagnostic(request: {
       : 'Public package repos must not declare @changesets/cli directly; @ankhorage/devtools owns Changesets execution.',
     path: request.packageJsonPath,
     profile: request.profile,
-    ruleId: 'package.dependencies.changesets.required',
-    severity: 'error',
+    ...architecturePolicyRuleFields(PUBLIC_PACKAGE_POLICY.dependencyRules.changesets),
   });
 }
 
@@ -1027,6 +888,37 @@ async function isProviderPackage(targetPath: string): Promise<boolean> {
   return false;
 }
 
+/*** Validate every generic public-package metadata field from canonical Policy. */
+function requirePublicPackageFields(request: {
+  readonly diagnostics: DoctorDiagnostic[];
+  readonly packageJson: Record<string, unknown>;
+  readonly packageJsonPath: string;
+  readonly profile: DoctorPolicyProfile;
+}): void {
+  for (const requirement of PUBLIC_PACKAGE_POLICY.requiredFields) {
+    const input = {
+      diagnostics: request.diagnostics,
+      fieldName: requirement.name,
+      packageJson: request.packageJson,
+      packageJsonPath: request.packageJsonPath,
+      profile: request.profile,
+      ruleId: requirement.ruleId,
+    };
+
+    switch (requirement.kind) {
+      case 'non-empty-string':
+        requireNonEmptyStringField(input);
+        break;
+      case 'record':
+        requireRecordField(input);
+        break;
+      case 'string-array':
+        requireStringArrayField(input);
+        break;
+    }
+  }
+}
+
 async function maybeRequirePath(
   diagnostics: DoctorDiagnostic[],
   plannedChanges: DoctorPlannedChange[],
@@ -1051,8 +943,7 @@ async function maybeRequirePath(
       message: `Missing expected repo artifact: ${relativePath}`,
       path: absolutePath,
       profile: 'public-package',
-      ruleId,
-      severity: 'error',
+      ...architecturePolicyRuleFields(ruleId),
     }),
   );
   plannedChanges.push(
@@ -1083,8 +974,7 @@ function requireNonEmptyStringField(request: {
       message: `package.json must define a non-empty "${request.fieldName}" field.`,
       path: request.packageJsonPath,
       profile: request.profile,
-      ruleId: request.ruleId,
-      severity: 'error',
+      ...architecturePolicyRuleFields(request.ruleId),
     }),
   );
 }
@@ -1107,8 +997,7 @@ function requireRecordField(request: {
       message: `package.json must define an object "${request.fieldName}" field.`,
       path: request.packageJsonPath,
       profile: request.profile,
-      ruleId: request.ruleId,
-      severity: 'error',
+      ...architecturePolicyRuleFields(request.ruleId),
     }),
   );
 }
@@ -1131,8 +1020,7 @@ function requireStringArrayField(request: {
       message: `package.json must define a non-empty string array "${request.fieldName}" field.`,
       path: request.packageJsonPath,
       profile: request.profile,
-      ruleId: request.ruleId,
-      severity: 'error',
+      ...architecturePolicyRuleFields(request.ruleId),
     }),
   );
 }
@@ -1212,37 +1100,6 @@ function validateAnkhMetadataShape(value: unknown, providerPackage: boolean): st
   return null;
 }
 
-function mapScriptRule(scriptName: (typeof REQUIRED_PUBLIC_PACKAGE_SCRIPTS)[number]): DoctorRuleId {
-  switch (scriptName) {
-    case 'build':
-      return 'package.scripts.build.required';
-    case 'typecheck':
-      return 'package.scripts.typecheck.required';
-    case 'lint':
-      return 'package.scripts.lint.required';
-    case 'lint:fix':
-      return 'package.scripts.lint-fix.required';
-    case 'format':
-      return 'package.scripts.format.required';
-    case 'format:check':
-      return 'package.scripts.format-check.required';
-    case 'test':
-      return 'package.scripts.test.required';
-    case 'test:standalone':
-      return 'package.scripts.standalone.required';
-    case 'knip:check':
-      return 'package.scripts.knip.required';
-    case 'docs':
-      return 'package.scripts.docs.required';
-    case 'changeset':
-      return 'package.scripts.changeset.required';
-    case 'changeset:status':
-      return 'package.scripts.changeset-status.required';
-    case 'version-packages':
-      return 'package.scripts.version-packages.required';
-  }
-}
-
 function createEarlyResult(targetPath: string, diagnostic: DoctorDiagnostic): DoctorAnalysisResult {
   return {
     appliedChecks: [],
@@ -1256,6 +1113,14 @@ function createEarlyResult(targetPath: string, diagnostic: DoctorDiagnostic): Do
   };
 }
 
+/*** Return canonical rule id and severity for a Policy-owned generic package rule. */
+function architecturePolicyRuleFields(
+  ruleId: DoctorRuleId,
+): Pick<DoctorDiagnostic, 'ruleId' | 'severity'> {
+  const rule = getArchitecturePolicyRule(ruleId);
+  return { ruleId: rule.id, severity: rule.severity };
+}
+
 function createDiagnostic(diagnostic: DoctorDiagnostic): DoctorDiagnostic {
   return diagnostic;
 }

package/src/cliLayoutAnalysis.ts

@@ -1,6 +1,8 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 
+import { ARCHITECTURE_POLICY } from '@ankhorage/policy/architecture';
+
 import {
   analyzeDoctorTarget,
   type DoctorAnalysisRequest,
@@ -9,8 +11,10 @@ import {
 import type { DoctorDiagnostic, DoctorPolicyProfile } from './diagnostics.js';
 import { analyzeAppManifestTarget } from './manifestAnalysis.js';
 import { analyzeSourceArchitecture } from './sourceArchitectureAnalysis.js';
+import { getArchitecturePolicyRule } from './utils/getArchitecturePolicyRule.js';
 
-const LEGACY_ROOT_CLI_SOURCE = path.join('src', 'cli.ts');
+const CLI_POLICY = ARCHITECTURE_POLICY.cli;
+const DEPENDENCY_POLICY = ARCHITECTURE_POLICY.dependencies;
 const ACTIVE_SOURCE_ROOTS = ['src', 'app', 'apps', 'packages', 'scripts'] as const;
 const ACTIVE_SOURCE_EXTENSIONS = new Set([
   '.cjs',
@@ -38,7 +42,6 @@ const IGNORED_SOURCE_DIRECTORIES = new Set([
   'test',
   'tests',
 ]);
-const COMPATIBILITY_PACKAGE_PREFIX = '@ankh/';
 const STUDIO_PACKAGE_NAME = '@ankhorage/studio';
 const STUDIO_DND_PACKAGE_NAME = '@ankhorage/react-native-reanimated-dnd-web';
 const STUDIO_RUNTIME_PACKAGE_NAME = '@ankhorage/runtime';
@@ -105,9 +108,10 @@ async function analyzeTargetArchitecture(request: {
   readonly targetPath: string;
 }): Promise<DoctorDiagnostic[]> {
   const diagnostics: DoctorDiagnostic[] = [];
-  const legacyRootCliPath = path.join(request.targetPath, LEGACY_ROOT_CLI_SOURCE);
+  const legacyRootCliPath = path.join(request.targetPath, CLI_POLICY.legacyRootFile);
   const exportsField = isRecord(request.packageJson.exports) ? request.packageJson.exports : null;
-  const cliCapable = hasAnkhProvider(request.packageJson) || exportsField?.['./cli'] !== undefined;
+  const cliCapable =
+    hasAnkhProvider(request.packageJson) || exportsField?.[CLI_POLICY.packageExport] !== undefined;
 
   if (await pathExists(legacyRootCliPath)) {
     diagnostics.push({
@@ -115,20 +119,18 @@ async function analyzeTargetArchitecture(request: {
       message: 'Package CLI code must live under src/cli/; root src/cli.ts is not allowed.',
       path: legacyRootCliPath,
       profile: request.profile,
-      ruleId: 'package.cli.root-file.disallowed',
-      severity: 'error',
+      ...architectureRuleFields(CLI_POLICY.legacyRootRuleId),
     });
   }
 
-  if (cliCapable && exportsField?.['./cli'] === undefined) {
+  if (cliCapable && exportsField?.[CLI_POLICY.packageExport] === undefined) {
     diagnostics.push({
       code: 'field-missing',
       message:
         'CLI-capable packages must export "./cli" from package.json and point it at the metadata-declared provider build output.',
       path: request.packageJsonPath,
       profile: request.profile,
-      ruleId: 'package.cli.export.required',
-      severity: 'error',
+      ...architectureRuleFields(CLI_POLICY.exportRuleId),
     });
   }
 
@@ -178,42 +180,41 @@ function validateDependencyArchitecture(request: {
   const diagnostics: DoctorDiagnostic[] = [];
 
   for (const dependency of request.dependencyEntries) {
-    if (dependency.packageName.startsWith(COMPATIBILITY_PACKAGE_PREFIX)) {
+    if (dependency.packageName.startsWith(DEPENDENCY_POLICY.compatibilityPackagePrefix)) {
       diagnostics.push({
         code: 'field-invalid',
         message: `Dependency "${dependency.packageName}" in package.json.${dependency.fieldName} is an old ankhorage4 workspace alias. Depend on "${toOwningPackageSpecifier(dependency.packageName)}" directly.`,
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.dependencies.ankh-workspace-alias.disallowed',
-        severity: 'error',
+        ...architectureRuleFields(DEPENDENCY_POLICY.rules.compatibilityDependency),
       });
     }
 
     if (
       request.profile === 'public-package' &&
-      /^(?:file:|link:|workspace:|github:|git(?:\+[^:]+)?:)/u.test(dependency.version)
+      DEPENDENCY_POLICY.localProtocolPrefixes.some((prefix) =>
+        dependency.version.startsWith(prefix),
+      )
     ) {
       diagnostics.push({
         code: 'field-invalid',
         message: `Published dependency "${dependency.packageName}" must resolve from a registry version, not "${dependency.version}". Standalone packages cannot rely on local/workspace/Git package state.`,
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.dependencies.local-protocol.disallowed',
-        severity: 'error',
+        ...architectureRuleFields(DEPENDENCY_POLICY.rules.localProtocolDependency),
       });
     }
 
     if (
-      dependency.packageName.includes('ankhorage4') ||
-      dependency.version.includes('ankhorage4')
+      dependency.packageName.includes(DEPENDENCY_POLICY.legacySourceMarker) ||
+      dependency.version.includes(DEPENDENCY_POLICY.legacySourceMarker)
     ) {
       diagnostics.push({
         code: 'field-invalid',
         message: `Dependency "${dependency.packageName}" references ankhorage4 as active source. Depend on the extracted owning @ankhorage/* package instead.`,
         path: request.packageJsonPath,
         profile: request.profile,
-        ruleId: 'package.dependencies.ankhorage4-source.disallowed',
-        severity: 'error',
+        ...architectureRuleFields(DEPENDENCY_POLICY.rules.legacySourceDependency),
       });
     }
   }
@@ -228,25 +229,23 @@ function validateActiveSourceImports(request: {
   const diagnostics: DoctorDiagnostic[] = [];
 
   for (const sourceImport of request.activeSourceImports) {
-    if (sourceImport.specifier.startsWith(COMPATIBILITY_PACKAGE_PREFIX)) {
+    if (sourceImport.specifier.startsWith(DEPENDENCY_POLICY.compatibilityPackagePrefix)) {
       diagnostics.push({
         code: 'field-invalid',
         message: `Import "${sourceImport.specifier}" is an old ankhorage4 compatibility boundary. Import "${toOwningPackageSpecifier(sourceImport.specifier)}" directly from the owning package.`,
         path: sourceImport.filePath,
         profile: request.profile,
-        ruleId: 'package.imports.ankh-workspace-alias.disallowed',
-        severity: 'error',
+        ...architectureRuleFields(DEPENDENCY_POLICY.rules.compatibilityImport),
       });
     }
 
-    if (sourceImport.specifier.includes('ankhorage4')) {
+    if (sourceImport.specifier.includes(DEPENDENCY_POLICY.legacySourceMarker)) {
       diagnostics.push({
         code: 'field-invalid',
         message: `Import "${sourceImport.specifier}" references ankhorage4 as active source. Import the extracted owning @ankhorage/* package instead.`,
         path: sourceImport.filePath,
         profile: request.profile,
-        ruleId: 'package.imports.ankhorage4-source.disallowed',
-        severity: 'error',
+        ...architectureRuleFields(DEPENDENCY_POLICY.rules.legacySourceImport),
       });
     }
   }
@@ -429,8 +428,16 @@ function isPackageImport(specifier: string, packageName: string): boolean {
   return specifier === packageName || specifier.startsWith(`${packageName}/`);
 }
 
+/*** Resolve Policy-owned rule metadata for generic architecture diagnostics. */
+function architectureRuleFields(
+  ruleId: DoctorDiagnostic['ruleId'],
+): Pick<DoctorDiagnostic, 'ruleId' | 'severity'> {
+  const rule = getArchitecturePolicyRule(ruleId);
+  return { ruleId: rule.id, severity: rule.severity };
+}
+
 function toOwningPackageSpecifier(specifier: string): string {
-  return `@ankhorage/${specifier.slice(COMPATIBILITY_PACKAGE_PREFIX.length)}`;
+  return `@ankhorage/${specifier.slice(DEPENDENCY_POLICY.compatibilityPackagePrefix.length)}`;
 }
 
 async function readPackageJson(packageJsonPath: string): Promise<Record<string, unknown> | null> {