@drkmttr/adhere 0.9.5 → 0.10.0

package/src/init.ts

@@ -1,4 +1,5 @@
-import { access, mkdir, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
 import { CONFIG_FILES } from "#config.ts";
 import { Effect } from "effect";
@@ -6,17 +7,45 @@ import { Effect } from "effect";
 export interface InitResult {
   readonly created: ReadonlyArray<string>;
   readonly skipped: ReadonlyArray<string>;
+  /** The package manager that added adhere, or why none did. */
+  readonly install: Install;
 }
 
+export type Install =
+  | { readonly status: "installed"; readonly packageManager: PackageManager }
+  | { readonly status: "listed" }
+  | { readonly status: "no-package-json" };
+
 export interface InitOptions {
   readonly force?: boolean;
 }
 
-const CONFIG = `import type { Config } from "@drkmttr/adhere";
+// adhere-ignore-file rules/import-written-files -- src/index.ts exports initProject, so a Bun text import here breaks loading the package on Node and in Vitest (checked 2026-09-26), and the compiled executable has no files beside it to read.
+const CONFIG = `import { defineConfig } from "@drkmttr/adhere";
 
-export default {
+export default defineConfig({
   threshold: 0.8,
-} satisfies Config;
+});
+`;
+
+/**
+ * A project for the config alone. A tsconfig's globs skip dot directories, so
+ * without it the editor opens `.adhere/config.ts` outside any project, where
+ * it cannot resolve `@drkmttr/adhere`, whose types only `bundler`, `node16`,
+ * and `nodenext` resolution reach.
+ */
+const TSCONFIG = `{
+  "compilerOptions": {
+    "target": "esnext",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "allowImportingTsExtensions": true
+  },
+  "include": ["config.ts"]
+}
 `;
 
 const SMALL_FILES = `---
@@ -24,16 +53,20 @@ description: A file should be small and focused, with one primary responsibility
 threshold: 0.8
 ---
 
-A guideline, so its description and its code say should and should not. A
+A guideline, so its description and its headings say should and should not. A
 rule that must hold says must and never instead, as name-domain-actions does.
 Use this rule as a template for repository-specific conventions.
 
-\`\`\`ts should
+## Should
+
+\`\`\`ts
 export const parsePort = (value: string) =>
   Port.make(Number.parseInt(value, 10));
 \`\`\`
 
-\`\`\`ts should not
+## Should not
+
+\`\`\`ts
 export const parsePort = (value: string) => Port.make(Number.parseInt(value, 10));
 export const sendWelcomeEmail = (to: Email) => Mailer.send(to, welcomeTemplate);
 export const renderInvoice = (invoice: Invoice) => Html.table(invoice.lines);
@@ -45,17 +78,21 @@ description: A function must be named after the domain action it performs, never
 threshold: 0.8
 ---
 
-\`\`\`ts must
+## Must
+
+\`\`\`ts
 export const loadCustomerProfile = (customerId: CustomerId) =>
   Effect.gen(function* () {
     return yield* CustomerStore.find(customerId);
   });
 \`\`\`
 
-A fence tagged \`never\` shows what a violation looks like. It is optional, and
-a rule can have one without the block above.
+## Never
 
-\`\`\`ts never
+The code under Never shows what a violation looks like. It is optional, and a
+rule can have it without the code under Must.
+
+\`\`\`ts
 export const handle = (id: string) =>
   Effect.gen(function* () {
     return yield* CustomerStore.find(id);
@@ -65,8 +102,12 @@ export const handle = (id: string) =>
 
 const CONFIG_PATH = CONFIG_FILES[0];
 
+/** The config's own project, which only a config at `.adhere/config.ts` needs. */
+const CONFIG_PROJECT = ".adhere/tsconfig.json";
+
 const files = [
   [CONFIG_PATH, CONFIG],
+  [CONFIG_PROJECT, TSCONFIG],
   [".adhere/style/prefer-small-files.md", SMALL_FILES],
   [".adhere/style/name-domain-actions.md", NAME_EFFECTS],
 ] as const;
@@ -102,6 +143,69 @@ const writeScaffoldFile = (root: string, path: string, contents: string, options
       ),
   });
 
+const PACKAGE = "@drkmttr/adhere";
+
+type PackageManager = "bun" | "pnpm" | "yarn" | "npm";
+
+/** The first lockfile at the root names the package manager; npm when there is none. */
+const lockfiles: ReadonlyArray<readonly [string, PackageManager]> = [
+  ["bun.lock", "bun"],
+  ["bun.lockb", "bun"],
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["package-lock.json", "npm"],
+];
+
+const packageManagerAt = async (root: string): Promise<PackageManager> => {
+  for (const [file, manager] of lockfiles) {
+    if (await exists(join(root, file))) return manager;
+  }
+  return "npm";
+};
+
+/**
+ * pnpm refuses to add to a workspace root without a flag. `-w` fails outside a
+ * workspace, so the first one, which works in both, stands in for it. pnpm 11
+ * also fails on msgpackr-extract's unapproved build script. It comes with
+ * effect, and adhere never calls msgpackr, so the second flag lets pnpm skip
+ * the build with a warning.
+ */
+const addFlags: Record<PackageManager, ReadonlyArray<string>> = {
+  bun: [],
+  pnpm: ["--ignore-workspace-root-check", "--config.strict-dep-builds=false"],
+  yarn: [],
+  npm: [],
+};
+
+/** Adds adhere to devDependencies, so the config's `import type` resolves. */
+const installAdhere = (root: string) =>
+  Effect.tryPromise({
+    try: async (): Promise<Install> => {
+      const manifest = await readFile(join(root, "package.json"), "utf8").catch(() => undefined);
+      if (manifest === undefined) return { status: "no-package-json" };
+      const { dependencies, devDependencies } = JSON.parse(manifest);
+      if (dependencies?.[PACKAGE] !== undefined || devDependencies?.[PACKAGE] !== undefined) {
+        return { status: "listed" };
+      }
+      const packageManager = await packageManagerAt(root);
+      await new Promise<void>((resolve, reject) => {
+        spawn(packageManager, ["add", "-D", PACKAGE, ...addFlags[packageManager]], {
+          cwd: root,
+          stdio: "inherit",
+        })
+          .on("error", reject)
+          .on("exit", (code) =>
+            code === 0 ? resolve() : reject(new Error(`${packageManager} exited with ${code}`)),
+          );
+      });
+      return { status: "installed", packageManager };
+    },
+    catch: (cause) =>
+      new Error(
+        `Could not add ${PACKAGE} to package.json: ${cause instanceof Error ? cause.message : String(cause)}`,
+      ),
+  });
+
 export const initProject = (
   root: string,
   options: InitOptions = {},
@@ -115,6 +219,8 @@ export const initProject = (
         skipped.push(existing);
         continue;
       }
+      // A config at another path is in the project's own tsconfig, or not ours to place.
+      if (path === CONFIG_PROJECT && existing !== undefined) continue;
       const status = yield* writeScaffoldFile(root, path, contents, options);
       if (status === "created") {
         created.push(relative(root, join(root, path)));
@@ -122,5 +228,6 @@ export const initProject = (
         skipped.push(relative(root, join(root, path)));
       }
     }
-    return { created, skipped };
+    const install = yield* installAdhere(root);
+    return { created, skipped, install };
   });

package/src/main.ts

@@ -49,7 +49,6 @@ const report = (cause: Cause.Cause<unknown>): Effect.Effect<void> => {
 
 Command.run(cli, { version }).pipe(
   Effect.tapCause(report),
-  // oxlint-disable-next-line effecttsgo/strict-effect-provide -- this executable entrypoint supplies Bun's process services and the logger.
   Effect.provide(Layer.merge(BunServices.layer, logger)),
   (program) => BunRuntime.runMain(program, { disableErrorReporting: true }),
 );

package/src/markdown.ts

@@ -10,27 +10,40 @@ import { Effect, Schema } from "effect";
  *     ---
  *     Any prose, rendered on GitHub and ignored by adhere.
  *
- *     ```ts must
+ *     ## Must
+ *
+ *     ```ts
  *     const written = "code that must be written this way"
  *     ```
  *
- *     ```ts never
+ *     ## Never
+ *
+ *     ```ts
  *     const avoided = "code that must never be written this way"
  *     ```
  *
- * A fence's info string names its code with RFC 2119's words: `must` and
- * `never` for a requirement, `should` and `should not` for a guideline. The
- * first fence under each word is that example, and a rule has either or both.
- * An untagged fence is the code to write, and without a fence the whole body
- * is. `avoid`, the word before 0.7, means `never`. `threshold` is optional.
+ * A heading names the code in its section with RFC 2119's words: `must` and
+ * `never` for a requirement, `should` and `should not` for a guideline. So
+ * does a fence's info string, as in `ts never`, which GitHub does not show; a
+ * fence's own word wins over its heading's. The first fence under each word is
+ * that example, and a rule has either or both. An untagged fence outside those
+ * sections is the code to write, and without a fence the whole body is.
+ * `avoid`, the word before 0.7, means `never`. `threshold` is optional, and
+ * so is `tests`: `only` for a rule about test files, which rules otherwise
+ * skip, and `include` for a rule that judges them too. So is `level`:
+ * `warning` reports the rule's findings as warnings, which do not fail a run.
  */
 const FrontMatter = Schema.Struct({
   description: Schema.String,
   threshold: Schema.optionalKey(Schema.FiniteFromString),
+  tests: Schema.optionalKey(Schema.Literals(["only", "include"])),
+  level: Schema.optionalKey(Schema.Literals(["error", "warning"])),
 });
 
 const FRONT_MATTER = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
 const FENCE = /^ {0,3}(`{3,}|~{3,})([^\n]*)\n([\s\S]*?)\n {0,3}\1[ \t]*$/gm;
+/** An ATX heading: its level as `#`s, then its text, without a closing run of `#`s. */
+const HEADING = /^ {0,3}(#{1,6})(?:[ \t]+(.*?))?(?:[ \t]+#+)?[ \t]*$/gm;
 
 const unquote = (value: string): string => {
   const trimmed = value.trim();
@@ -54,11 +67,17 @@ const parseFrontMatter = (block: string): Record<string, string> => {
 type Word = Example["word"];
 
 interface Fence {
-  /** The word the info string names the code with; none for an untagged fence. */
+  /** The word its info string, or else its heading, names the code with; none for untagged code. */
   readonly word: Word | undefined;
   readonly code: string;
 }
 
+interface Heading {
+  readonly level: number;
+  /** The word the heading names its section's code with; none for any other heading. */
+  readonly word: Word | undefined;
+}
+
 /** `must not`, like `never` and the older `avoid`, names code never to write. */
 const wordOf = (info: string): Word | undefined => {
   const words = info.trim().toLowerCase().split(/\s+/);
@@ -69,11 +88,55 @@ const wordOf = (info: string): Word | undefined => {
   return undefined;
 };
 
-const fencesOf = (body: string): ReadonlyArray<Fence> =>
-  Array.from(body.matchAll(FENCE), (match) => ({
-    word: wordOf(match[2] ?? ""),
-    code: (match[3] ?? "").trim(),
-  }));
+const HEADING_WORDS: ReadonlySet<string> = new Set([
+  "must",
+  "must not",
+  "never",
+  "avoid",
+  "should",
+  "should not",
+]);
+
+/**
+ * A heading names a word only when it is the word alone, in any case and with
+ * or without a colon: `## Never` does, `## Why never` does not.
+ */
+const headingWordOf = (text: string): Word | undefined => {
+  const phrase = text.trim().replace(/:$/, "").trim().toLowerCase().split(/\s+/).join(" ");
+  return HEADING_WORDS.has(phrase) ? wordOf(phrase) : undefined;
+};
+
+/**
+ * The headings open after `text`, outermost first, given those open before
+ * it. A heading closes the sections at its level and deeper, so a deeper
+ * heading stays inside the section above it.
+ */
+const openAfter = (open: ReadonlyArray<Heading>, text: string): ReadonlyArray<Heading> =>
+  Array.from(text.matchAll(HEADING)).reduce<ReadonlyArray<Heading>>((headings, match) => {
+    const level = (match[1] ?? "#").length;
+    return [
+      ...headings.filter((heading) => heading.level < level),
+      { level, word: headingWordOf(match[2] ?? "") },
+    ];
+  }, open);
+
+/**
+ * Each fence, under the word its info string names or, without one, the word
+ * of the innermost heading over it that names one.
+ */
+const fencesOf = (body: string): ReadonlyArray<Fence> => {
+  const fences: Array<Fence> = [];
+  let open: ReadonlyArray<Heading> = [];
+  let read = 0;
+  for (const match of body.matchAll(FENCE)) {
+    // Only headings between fences count: a `#` line inside one is code.
+    open = openAfter(open, body.slice(read, match.index));
+    read = match.index + match[0].length;
+    const section = open.findLast((heading) => heading.word !== undefined)?.word;
+    fences.push({ word: wordOf(match[2] ?? "") ?? section, code: (match[3] ?? "").trim() });
+  }
+  return fences;
+};
 
 /** An empty block counts as no block. */
 const nonEmpty = (code: string | undefined): string | undefined =>
@@ -134,7 +197,7 @@ export const parseRuleMarkdown = (
     }
     if (!requirement && !guideline) {
       return yield* ConfigUnavailable.make({
-        message: `${file}: the body needs code, in a fence tagged must, never, should, or should not, or untagged`,
+        message: `${file}: the body needs code, in a fence under a Must, Never, Should, or Should not heading, or untagged`,
       });
     }
     return { ...front, ...code };

package/src/models/Audit.ts

@@ -3,6 +3,8 @@ import { Schema } from "effect";
 export interface ScannedFile {
   readonly path: string;
   readonly lines: ReadonlyArray<string>;
+  /** A test file, which only the rules that say `tests` judge. */
+  readonly test?: boolean;
 }
 
 /** A source walker's refusal: the tree it was asked to read is not readable. */

package/src/presets.ts

@@ -4,10 +4,13 @@ import type { Preset } from "#config.ts";
  * `presets/` sits next to `src/` in a checkout. In a compiled executable
  * (`bun build --compile --asset ./presets`) Bun embeds it under the bundle's
  * own directory instead, hence the fork on `Bun.isStandaloneExecutable`, which
- * is the check Bun's docs give for this. Measured on Bun 1.4. The `typeof`
- * guard is for Vitest, which imports this module on Node.
+ * is the check Bun's docs give for this. Measured on Bun 1.4. It is read off
+ * `globalThis` for Vitest, which imports this module on Node, and for a
+ * project that type-checks this package's source without Bun's types.
  */
-const isStandaloneExecutable = typeof Bun !== "undefined" && Bun.isStandaloneExecutable;
+const isStandaloneExecutable =
+  (globalThis as { readonly Bun?: { readonly isStandaloneExecutable?: boolean } }).Bun
+    ?.isStandaloneExecutable === true;
 
 const presetsRoot = isStandaloneExecutable
   ? new URL("./presets/", import.meta.url)

package/src/rules.ts

@@ -1,5 +1,6 @@
 import {
   ConfigUnavailable,
+  type Override,
   type Rule,
   type RuleId,
   type RuleSource,
@@ -30,8 +31,10 @@ export interface RuleEntry {
  * mixes presets with the project's own rules says where each came from. The
  * project's own rules show their `.adhere/` ids as they are.
  */
-export const shownId = (entry: { readonly id: RuleId; readonly preset?: string }): string =>
-  entry.preset === undefined ? entry.id : `${entry.preset}/${entry.id}`;
+export const shownId = (entry: {
+  readonly id: RuleId;
+  readonly preset?: string | undefined;
+}): string => (entry.preset === undefined ? entry.id : `${entry.preset}/${entry.id}`);
 
 export type RuleSet = ReadonlyArray<RuleEntry>;
 
@@ -170,6 +173,36 @@ export const materializeRules = Effect.fn("materializeRules")(function* (
 export const globalRuleSet = (rules: Readonly<Record<RuleId, Rule>>, root: string) =>
   Object.entries(rules).map(([id, rule]): RuleEntry => ({ id, rule, scope: root }));
 
+/**
+ * The rules as a config's overrides leave them, each found by the id a report
+ * names it with: a rule set `off` gone, and any other with the level and
+ * threshold its override gives, over its own.
+ */
+export const withOverrides = (
+  entries: RuleSet,
+  overrides: Readonly<Record<string, Override>>,
+): RuleSet =>
+  entries.flatMap((entry) => {
+    const override = overrides[shownId(entry)];
+    if (override === undefined) return [entry];
+    const { level, threshold }: Exclude<Override, string> =
+      typeof override === "string" ? { level: override } : override;
+    if (level === "off") return [];
+    const rule: Rule = {
+      ...entry.rule,
+      ...(level === undefined ? {} : { level }),
+      ...(threshold === undefined ? {} : { threshold }),
+    };
+    return [{ ...entry, rule }];
+  });
+
+/**
+ * Whether a rule judges a file: a test file only when the rule says `tests`,
+ * and any other file unless it says `tests: only`.
+ */
+export const judgesFile = (rule: Rule, test: boolean): boolean =>
+  test ? rule.tests !== undefined : rule.tests !== "only";
+
 /**
  * The flat rule map for one source file. Root rules apply everywhere. When a
  * nested `.adhere/` defines the same id, the deepest matching scope wins.

package/src/services/AdhereConfig.ts

@@ -1,23 +1,25 @@
 import {
   ADHERE_DIRECTORY,
-  type AdhereConfig as Decoded,
+  AdhereConfig as AdhereConfigSchema,
   CONFIG_FILES,
   ConfigUnavailable,
   decodeConfig,
   type Loaded,
-  type Overrides,
+  type Flags,
   type Preset,
   presetsOf,
   type ResolvedConfig,
   resolveConfig,
 } from "#config.ts";
-import { type PresetName, presetOf, wholePresetOf } from "#presets.ts";
+import { type PresetName, presetOf, presets, wholePresetOf } from "#presets.ts";
 import {
   applicableRules,
   globalRuleSet,
   loadAdhereRuleSet,
   materializeRules,
   type RuleSet,
+  shownId,
+  withOverrides,
 } from "#rules.ts";
 import { Context, Effect, FileSystem, Layer, Path, Record } from "effect";
 
@@ -50,13 +52,23 @@ const loadPreset = Effect.fn("AdhereConfig.loadPreset")(function* (name: PresetN
   return [name, { ...preset, rules } satisfies Loaded<Preset>] as const;
 });
 
+/** Every rule of every built-in preset, by the id a report names it with. */
+const everyPresetRule = Effect.fn("AdhereConfig.everyPresetRule")(function* (base: string) {
+  const loaded = yield* Effect.forEach(Object.entries(presets), ([name, preset]) =>
+    Effect.map(materializeRules(preset.rules, base), (rules) =>
+      Object.keys(rules).map((id) => `${name}/${id}`),
+    ),
+  );
+  return new Set(loaded.flat());
+});
+
 /**
  * The config file in the working directory (one of `CONFIG_FILES`) with the
- * command-line overrides applied. The file is optional when `.adhere/` holds
+ * command-line flags applied. The file is optional when `.adhere/` holds
  * rules or a preset is named. Rule directories resolve against the working
  * directory.
  */
-export const AdhereConfigLive = (overrides: Overrides) =>
+export const AdhereConfigLive = (flags: Flags) =>
   Layer.effect(AdhereConfig)(
     Effect.gen(function* () {
       const path = yield* Path.Path;
@@ -73,8 +85,8 @@ export const AdhereConfigLive = (overrides: Overrides) =>
         });
       }
       const configFile = found[0];
-      const hasPreset = overrides.presets !== undefined && overrides.presets.length > 0;
-      const config: Decoded =
+      const hasPreset = flags.presets !== undefined && flags.presets.length > 0;
+      const config: typeof AdhereConfigSchema.Type =
         configFile === undefined
           ? yield* decodeConfig({})
           : yield* loadConfigFile(path.join(cwd, configFile));
@@ -90,10 +102,10 @@ export const AdhereConfigLive = (overrides: Overrides) =>
           ? discoveredEntries
           : globalRuleSet(yield* materializeRules(config.rules ?? {}, cwd), cwd);
       const rules = applicableRules(cwd, projectEntries);
-      const registry = yield* Effect.forEach(presetsOf(config, overrides), (name) =>
+      const registry = yield* Effect.forEach(presetsOf(config, flags), (name) =>
         loadPreset(name, cwd),
       ).pipe(Effect.map(Record.fromEntries));
-      const resolved = resolveConfig({ ...config, rules }, overrides, registry);
+      const resolved = resolveConfig({ ...config, rules }, flags, registry);
       const presetEntries = Object.entries(registry).flatMap(([name, preset]) =>
         globalRuleSet(preset.rules, cwd).map((entry) => ({
           ...entry,
@@ -103,9 +115,20 @@ export const AdhereConfigLive = (overrides: Overrides) =>
       yield* Effect.logDebug(
         `config: ${configFile ?? "no config file"}; presets ${Object.keys(registry).join(", ") || "none"}; ${presetEntries.length} preset and ${projectEntries.length} project rules; model ${resolved.model}, threshold ${resolved.threshold}${resolved.rpm === undefined ? "" : `, at most ${resolved.rpm} requests a minute`}`,
       );
-      return AdhereConfig.of({
-        ...resolved,
-        scopedRules: [...presetEntries, ...projectEntries],
-      });
+      const entries = [...presetEntries, ...projectEntries];
+      const overrides = config.overrides ?? {};
+      const loaded = new Set(entries.map(shownId));
+      const elsewhere = Object.keys(overrides).filter((id) => !loaded.has(id));
+      if (elsewhere.length > 0) {
+        // A rule of a preset this run leaves out may be overridden; one no rule has is a typo.
+        const every = yield* everyPresetRule(cwd);
+        const unknown = elsewhere.filter((id) => !every.has(id));
+        if (unknown.length > 0) {
+          return yield* ConfigUnavailable.make({
+            message: `overrides names ${unknown.join(", ")}, which is no preset or project rule. A preset's rule is named with its preset first, as in alchemy/providers/idempotent-delete.`,
+          });
+        }
+      }
+      return AdhereConfig.of({ ...resolved, scopedRules: withOverrides(entries, overrides) });
     }),
   );

package/src/services/SourceWalker.ts

@@ -1,9 +1,10 @@
 import { matchesGlob } from "node:path";
 import { Context, Effect, FileSystem, Layer, Path } from "effect";
-import { ADHERE_DIRECTORY, SKIPPED_DIRECTORIES } from "#config.ts";
+import { ADHERE_DIRECTORY, SKIPPED_DIRECTORIES, TEST_DIRECTORIES } from "#config.ts";
 import type { ScannedFile } from "#models/Audit.ts";
 import { WalkUnavailable } from "#models/Audit.ts";
 import { walkFiles } from "#walk.ts";
+import { AdhereConfig } from "#services/AdhereConfig.ts";
 import { clearingStatus, counted, countOf, Status } from "#services/Status.ts";
 
 /** Walks the repository's TypeScript source, skipping what is not ours to read. */
@@ -11,9 +12,9 @@ export class SourceWalker extends Context.Service<
   SourceWalker,
   {
     /**
-     * Every TypeScript file under the audit's roots, in directory order. A
-     * file that cannot be read refuses the walk: a silent gap would report
-     * a clean audit that was never complete.
+     * Every TypeScript file under the audit's roots, in directory order, test
+     * files marked. A file that cannot be read refuses the walk: a silent gap
+     * would report a clean audit that was never complete.
      */
     readonly files: Effect.Effect<ReadonlyArray<ScannedFile>, WalkUnavailable>;
   }
@@ -50,13 +51,26 @@ export const passesFilter = (relative: string, patterns: ReadonlyArray<string>):
   return (include.length === 0 || include.some(matches)) && !exclude.some(matches);
 };
 
+/**
+ * Whether a path, relative to the working directory, is a test: a `.test.ts`
+ * or `.spec.ts` file, or any file under a test directory such as `test/`.
+ */
+export const isTestFile = (relative: string): boolean => {
+  const segments = relative.split(/[\\/]/);
+  const name = segments.at(-1) ?? "";
+  return (
+    name.endsWith(".test.ts") ||
+    name.endsWith(".spec.ts") ||
+    segments.slice(0, -1).some((segment) => TEST_DIRECTORIES.has(segment))
+  );
+};
+
 const isInside = (file: string, root: string): boolean =>
   file === root || file.startsWith(`${root}/`);
 
 const isScannable = (file: string, self: string): boolean =>
   file.endsWith(".ts") &&
   !file.endsWith(".d.ts") &&
-  !file.endsWith(".test.ts") &&
   !file.endsWith("/adhere.config.ts") &&
   !file.endsWith("/.adhere.config.ts") &&
   // The audit's own detector patterns are data, not violations of themselves.
@@ -169,8 +183,10 @@ const scanDirs = Effect.fn("SourceWalker.scanDirs")(function* (
 
 /**
  * The real walker: the roots walked a directory at a time, skipped trees
- * left unread, each file read and split into lines. Tests substitute their
- * own tree.
+ * left unread, each file read and split into lines. The run's filter and the
+ * config's `exclude` leave out what they match. Test files are read, and
+ * marked, even when no rule judges them, so a prune keeps what other runs
+ * know of them. Tests substitute their own tree.
  * The scan root is the current working directory, so the audit reads the
  * repository it is run in.
  */
@@ -179,9 +195,11 @@ export const SourceWalkerLive = (filter: ReadonlyArray<string> = []) =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
+      const config = yield* AdhereConfig;
       // No segments: Path resolves against the working directory.
       const root = path.resolve();
       const self = yield* path.fromFileUrl(new URL("../../", import.meta.url)).pipe(Effect.orDie);
+      const patterns = [...filter, ...(config.exclude ?? []).map((glob) => `!${glob}`)];
       const walk = Effect.fn("SourceWalker.files")(function* () {
         const dirs = yield* scanDirs(fs, root).pipe(Effect.mapError(refused));
         const trees = yield* clearingStatus(
@@ -193,12 +211,16 @@ export const SourceWalkerLive = (filter: ReadonlyArray<string> = []) =>
               dir === "." ? "the working directory" : `${dir}/`,
               self,
               (relative) =>
-                // Filter patterns are relative to the working directory, not the tree read.
-                passesFilter(dir === "." ? relative : `${dir}/${relative}`, filter),
+                // Patterns are relative to the working directory, not the tree read.
+                passesFilter(dir === "." ? relative : `${dir}/${relative}`, patterns),
             ).pipe(Effect.mapError(refused)),
           ),
         );
-        return trees.flat();
+        return trees
+          .flat()
+          .map((file) =>
+            isTestFile(path.relative(root, file.path)) ? { ...file, test: true } : file,
+          );
       });
       return SourceWalker.of({ files: walk() });
     }),