@azure-id/orc 1.5.0 → 1.7.0

package/bin/verify-package.js

@@ -33,6 +33,7 @@ const required = [
   "bin/webui/css/panels/overview.css",
   "bin/webui/css/panels/settings.css",
   "bin/webui/css/panels/lanes.css",
+  "bin/webui/css/panels/rules.css",
   "bin/webui/css/panels/runs.css",
   "bin/webui/css/panels/knowledge.css",
   // No knowledge.css: that panel is composed entirely from shared primitives
@@ -66,6 +67,7 @@ const required = [
   "bin/webui/js/panels/overview.js",
   "bin/webui/js/panels/settings.js",
   "bin/webui/js/panels/lanes.js",
+  "bin/webui/js/panels/rules.js",
   "bin/webui/js/panels/runs.js",
   "bin/webui/js/panels/knowledge.js",
   "bin/webui/js/panels/stats.js",
@@ -93,6 +95,8 @@ const required = [
   "bin/webui/fixtures/shell.js",
   "bin/webui/fixtures/settings.js",
   "bin/webui/fixtures/lanes.js",
+  "bin/webui/fixtures/rules.js",
+  "bin/webui/fixtures/wiki-one.js",
   "bin/webui/fixtures/knowledge.js",
   "bin/webui/fixtures/runs.js",
   "bin/webui/fixtures/stats.js",
@@ -122,6 +126,7 @@ const required = [
   "bin/webui/i18n/en/overview.json",
   "bin/webui/i18n/en/settings.json",
   "bin/webui/i18n/en/lanes.json",
+  "bin/webui/i18n/en/rules.json",
   "bin/webui/i18n/en/runs.json",
   "bin/webui/i18n/en/knowledge.json",
   "bin/webui/i18n/en/stats.json",
@@ -147,6 +152,7 @@ const required = [
   "bin/webui/i18n/id/overview.json",
   "bin/webui/i18n/id/settings.json",
   "bin/webui/i18n/id/lanes.json",
+  "bin/webui/i18n/id/rules.json",
   "bin/webui/i18n/id/runs.json",
   "bin/webui/i18n/id/knowledge.json",
   "bin/webui/i18n/id/stats.json",
@@ -480,6 +486,9 @@ const required = [
   // it. Wired even with the board off, because the measurement is handed over
   // either way.
   "templates/hooks/orc-subagent-line.js",
+  // v1.6.0 — the read gate. The one layer that can refuse an oversized read by
+  // the ORCHESTRATOR. Ships wired but OFF; `read_gate` arms it.
+  "templates/hooks/orc-read-gate.js",
   "templates/hooks/orc-trace.js",
 ];
 

package/bin/webui/api.js

@@ -363,6 +363,21 @@ const READS = {
   // nothing about a priority, an order, a wave shape or a number.
   "/api/doc/rules": () => ["doc", "rules"],
   "/api/doc/rules/one": (q) => ["doc", "rules", String(q.slug || "")],
+  // v1.7.0 — the anti-slop rule surface. Five READS. The panel decides nothing:
+  // not the precedence order, not a rule's tier, not the override count, and
+  // not which of the 65 rules the lint can actually prove.
+  //
+  // `lint` takes a path from the query string. It is user input like any other,
+  // so it is forwarded as ONE argv element and never through a shell — the same
+  // reason every other route here spawns an array rather than a string.
+  "/api/rules": () => ["rules"],
+  "/api/rules/user": () => ["rules", "user"],
+  "/api/rules/packs": () => ["rules", "packs"],
+  "/api/rules/credits": () => ["rules", "credits"],
+  "/api/rules/lint": (q) => ["rules", "lint", String(q.path || ".")],
+  // v1.7.0 — the wiki's one-doc-at-a-time probes. Both free, neither scans.
+  "/api/wiki/resolve": (q) => ["wiki", "resolve", String(q.topic || "")],
+  "/api/wiki/refs": () => ["wiki", "refs", "--check"],
   "/api/doc/forecast": (q) => ["doc", "forecast", String(q.slug || "")],
   "/api/doc/cost": (q) => ["doc", "cost", String(q.slug || "")],
   // v0.50.0 — `orc extra`. Every one is a READ, and every one is a subprocess of
@@ -592,6 +607,17 @@ const WRITES = {
   // house rule looks like, and the argv is a plain array, so a multi-line value
   // needs no escaping and no temp file.
   "/api/doc/rules/setAll": (b) => ["doc", "rules", "set-all", "--text", String(b.text || "")],
+  // v1.7.0 — the project's own anti-slop rules. ONE write route, for the same
+  // reason the doc ledger has one: it is a plain text config, so the panel
+  // writes the whole file from one textarea and the CLI is still the only
+  // writer and the only validator.
+  //
+  // There is deliberately NO route for the SHIPPED packs. They are read-only,
+  // `orc rules set --pack …` is refused by name, and a route that existed only
+  // to be refused would be a control that lies about what it can do.
+  // `--reset` also has no route: throwing away a project's standing rules is a
+  // CLI act.
+  "/api/rules/setAll": (b) => ["rules", "set-all", "--text", String(b.text || "")],
   "/api/doc/rules/sync": (b) => ["doc", "rules", String(b.slug), "--sync"],
   // v0.52.0 (D9) — per document, because a document's voice is the deliverable.
   // The CLI owns the resolution order and the shadowing announcement; the panel

package/bin/webui/app.html

@@ -25,6 +25,7 @@
 <link rel="stylesheet" href="css/05-tour.css">
 <link rel="stylesheet" href="css/panels/settings.css">
 <link rel="stylesheet" href="css/panels/lanes.css">
+<link rel="stylesheet" href="css/panels/rules.css">
 <link rel="stylesheet" href="css/panels/runs.css">
 <link rel="stylesheet" href="css/panels/knowledge.css">
 <link rel="stylesheet" href="css/panels/stats.css">
@@ -80,6 +81,14 @@
         which shared phases they run, in order, and which CLI calls they make.
       -->
       <li><a href="#/lanes"       data-panel="lanes"       data-idx="l" data-i18n="nav.lanes">Lanes</a></li>
+      <!--
+        v1.7.0. Rules sits directly under Lanes because it is the other half of
+        the same answer: Lanes says which phases a lane runs, this says which
+        rules ride in every slice it builds — and it is the one panel here where
+        a project can change what ORC writes, so it belongs with Settings and
+        Lanes rather than down among the reading panels.
+      -->
+      <li><a href="#/rules"       data-panel="rules"       data-idx="r" data-i18n="nav.rules">Rules</a></li>
       <li><a href="#/runs"        data-panel="runs"        data-idx="3" data-i18n="nav.runs">Runs</a></li>
       <li><a href="#/knowledge"   data-panel="knowledge"   data-idx="4" data-i18n="nav.knowledge">Knowledge</a></li>
       <li><a href="#/stats"       data-panel="stats"       data-idx="5" data-i18n="nav.stats">Stats</a></li>
@@ -197,6 +206,7 @@
 <script src="js/panels/overview.js"></script>
 <script src="js/panels/settings.js"></script>
 <script src="js/panels/lanes.js"></script>
+<script src="js/panels/rules.js"></script>
 <script src="js/panels/runs.js"></script>
 <script src="js/panels/knowledge.js"></script>
 <script src="js/panels/stats.js"></script>

package/bin/webui/css/panels/knowledge.css

@@ -84,3 +84,33 @@
 /* --- preview-then-apply --------------------------------------------------- */
 .kn-prune { margin-top: var(--sp-3); display: grid; gap: var(--sp-2); }
 .kn-prune-head { font-weight: 600; font-size: 13px; }
+
+/* ── one doc at a time (v1.7.0) ───────────────────────────────────────────── */
+/* The resolver and the derived-reference sweep. Both are probes, so the card is
+   read-shaped: a row of results, and a command where a lane would have to run. */
+.kn-one-topic { flex: 1 1 260px; min-width: 0; }
+.kn-one-out { margin-top: var(--sp-2); display: flex; flex-direction: column; gap: 4px; }
+.kn-one-cand {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--sp-1) var(--sp-2);
+  align-items: baseline;
+  padding-left: var(--sp-2);
+}
+.kn-one-sweep {
+  margin-top: var(--sp-3);
+  border-top: 1px solid var(--line-soft);
+  padding-top: var(--sp-2);
+}
+.kn-one-ref {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--sp-1) var(--sp-2);
+  align-items: baseline;
+  padding: 3px 0;
+}
+.kn-one-fix { padding-left: var(--sp-4); }
+
+@media (max-width: 720px) {
+  .kn-one-ref, .kn-one-cand { flex-direction: column; align-items: flex-start; gap: 2px; }
+}

package/bin/webui/css/panels/rules.css

@@ -0,0 +1,145 @@
+/* panels/rules.css — the anti-slop rule surface.
+   Classes are namespaced `orule-` rather than `rule-`: the Docs panel already
+   owns `.rule-editor` / `.rule-path` / `.rule-boundary` for its own house-rule
+   card, and two panels sharing a class name is a coupling nothing declares. */
+
+/* ── the precedence ladder ────────────────────────────────────────────────── */
+/* First card on the page, always open. Precedence is the one thing people get
+   wrong about this surface, so it is never behind a toggle. */
+.orule-ladder {
+  display: flex;
+  flex-direction: column;
+  gap: var(--sp-2);
+  margin: var(--sp-2) 0;
+}
+.orule-ladder-row {
+  display: flex;
+  gap: var(--sp-2);
+  align-items: flex-start;
+  padding: var(--sp-2);
+  border: 1px solid var(--line-soft);
+  border-radius: 6px;
+  background: var(--bg-soft, transparent);
+}
+.orule-rank {
+  flex: 0 0 auto;
+  width: 22px;
+  height: 22px;
+  display: grid;
+  place-items: center;
+  border-radius: 50%;
+  border: 1px solid var(--line);
+  font-size: 12px;
+  font-variant-numeric: tabular-nums;
+}
+.orule-ladder-body { flex: 1 1 auto; min-width: 0; }
+.orule-layer { font-weight: 600; }
+.orule-where { word-break: break-all; }
+.orule-house-note {
+  border-left: 2px solid var(--accent);
+  padding-left: var(--sp-2);
+  margin: var(--sp-2) 0;
+}
+.orule-overrides {
+  margin-top: var(--sp-3);
+  border-top: 1px solid var(--line-soft);
+  padding-top: var(--sp-2);
+}
+.orule-override-row {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--sp-1) var(--sp-2);
+  align-items: baseline;
+  padding: 3px 0;
+}
+.orule-boundary {
+  margin-top: var(--sp-3);
+  border-top: 1px solid var(--line-soft);
+  padding-top: var(--sp-2);
+}
+
+/* ── the project's own ledger ─────────────────────────────────────────────── */
+.orule-editor {
+  width: 100%;
+  box-sizing: border-box;
+  margin: var(--sp-2) 0 var(--sp-1);
+  padding: var(--sp-2);
+  font: 12px/1.6 var(--mono);
+  color: var(--fg);
+  background: var(--bg-code, var(--bg-soft));
+  border: 1px solid var(--line);
+  border-radius: 6px;
+  resize: vertical;
+  tab-size: 2;
+}
+.orule-editor::-webkit-scrollbar { width: 9px; }
+.orule-editor::-webkit-scrollbar-track { background: transparent; }
+.orule-editor::-webkit-scrollbar-thumb { background: var(--line); border-radius: 4px; }
+.orule-editor:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }
+.orule-path { word-break: break-all; font-family: var(--mono); }
+
+/* ── the shipped packs ────────────────────────────────────────────────────── */
+.orule-filters { margin: var(--sp-2) 0; gap: var(--sp-2); }
+.orule-search { flex: 1 1 220px; min-width: 0; }
+.orule-tier { flex: 0 0 auto; }
+.orule-list { display: flex; flex-direction: column; gap: var(--sp-3); }
+.orule-group { border-bottom: 1px solid var(--line-soft); }
+.orule-group:last-child { border-bottom: 0; }
+.orule-group-head {
+  display: flex;
+  gap: var(--sp-2);
+  align-items: baseline;
+  font-weight: 600;
+  padding: var(--sp-2) 0;
+  cursor: pointer;
+  list-style: none;
+}
+.orule-group-head::-webkit-details-marker { display: none; }
+/* The marker is drawn rather than inherited, so it points the same way in every
+   browser and stays legible at the small size the rail is set in. */
+.orule-group-head::before {
+  content: "\25B8";
+  display: inline-block;
+  width: 10px;
+  color: var(--fg-dim, var(--line));
+  transition: transform 120ms ease;
+}
+.orule-group[open] > .orule-group-head::before { transform: rotate(90deg); }
+.orule-group-head:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.orule-row {
+  padding: var(--sp-2) 0;
+  border-bottom: 1px solid var(--line-soft);
+}
+.orule-row:last-child { border-bottom: 0; }
+/* A rule the project replaced is SHOWN, dimmed and labelled. Hiding it would
+   make an override invisible in the one place it is explained. */
+.orule-row-off { opacity: 0.55; }
+.orule-row-off .orule-title { text-decoration: line-through; }
+.orule-title { font-weight: 600; }
+.orule-body { white-space: pre-wrap; margin-top: 4px; }
+
+/* ── credits ──────────────────────────────────────────────────────────────── */
+.orule-credit {
+  padding: var(--sp-2) 0;
+  border-bottom: 1px solid var(--line-soft);
+}
+.orule-credit:last-child { border-bottom: 0; }
+.orule-credit-who { font-weight: 600; }
+.orule-credit-link { display: block; word-break: break-all; }
+
+/* ── the lint ─────────────────────────────────────────────────────────────── */
+.orule-lint-path { flex: 1 1 240px; min-width: 0; }
+.orule-lint-out { margin-top: var(--sp-2); display: flex; flex-direction: column; gap: var(--sp-1); }
+.orule-lint-file { margin-top: var(--sp-2); font-weight: 600; word-break: break-all; }
+.orule-lint-row { padding-left: var(--sp-3); }
+/* The coverage line is the point of the card, not a footnote. */
+.orule-lint-coverage {
+  margin-top: var(--sp-3);
+  border-top: 1px solid var(--line-soft);
+  padding-top: var(--sp-2);
+}
+
+@media (max-width: 720px) {
+  .orule-ladder-row { flex-direction: column; }
+  .orule-filters { flex-direction: column; align-items: stretch; }
+}

package/bin/webui/fixtures/index.js

@@ -33,6 +33,8 @@ const { exportState, mocks } = require("./maintenance.js");
 const { chGoals, chDims, challengeRoles, challengeCouncil, challengeCycles, challengeList, challengeShow, challengeDiff, challengeDiffMissing, challengeLint } = require("./challenge.js");
 const { docList, docParts, docStatuses, docMapSections, docMap, docLint, docPlan, docShow, docSection, docShipped, docShippedDrifted, docNext, docAudit, docJournalRich, docJournalEmpty, docContext, docRules, docRulesFrozen, docForecast, docCost } = require("./docs.js");
 const { laneList, lanePhases, laneCalls } = require("./lanes.js");
+const { rules, rulesLint } = require("./rules.js");
+const { wikiResolveNew, wikiResolveMatch, wikiResolveAmbiguous, wikiRefs } = require("./wiki-one.js");
 const { diy } = require("./flow.js");
 const { crosslink } = require("./crosslink.js");
 const { mockDetail } = require("./mockrun.js");
@@ -60,6 +62,31 @@ module.exports.get = function get(route, q) {
       return testShows[(q && q.slug) || ""] || testShowToy;
     case "/api/test/ui":
       return testUiTools;
+    // v1.7.0 — the rule surface. One override and a lint with findings in BOTH
+    // prose and code: a clean ledger renders three of the five cards empty, and
+    // an empty card is a card nobody can design.
+    case "/api/rules":
+      return rules;
+    case "/api/rules/user":
+      return Object.assign({ ok: true, line: rules.line, boundary: rules.boundary, priorities: rules.priorities, overrides: rules.overrides }, rules.user);
+    case "/api/rules/packs":
+      return { ok: true, dir: rules.orc.dir, source: rules.orc.source, count: rules.orc.count, read_only: true, packs: rules.orc.packs, tiers: rules.tiers, line: rules.line };
+    case "/api/rules/credits":
+      return { ok: true, file: rules.orc.credits_file, sources: rules.orc.credits, text: null };
+    case "/api/rules/lint":
+      return rulesLint;
+    // v1.7.0 — the wiki's one-doc probes. The topic PICKS the verdict, so all
+    // three are reachable in the panel: type "remittance" for NEW, "invoice"
+    // for AMBIGUOUS, anything else for MATCH. A fixture that only ever returned
+    // one verdict would leave the other two cards designed blind.
+    case "/api/wiki/resolve": {
+      const topic = String((q && q.topic) || "").toLowerCase();
+      if (topic.includes("remittance") || topic.includes("payout")) return wikiResolveNew;
+      if (topic.includes("invoice") || topic.includes("billing")) return wikiResolveAmbiguous;
+      return wikiResolveMatch;
+    }
+    case "/api/wiki/refs":
+      return wikiRefs;
     case "/api/lanes":
       return laneList;
     case "/api/lane/phases":