@erclx/aitk 0.57.0 → 0.58.0

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "aitk",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/docs/agents/scripting.md

@@ -11,15 +11,15 @@ What a skill or script reads to discover names at runtime, and how each domain i
 
 Use these to discover what's available instead of hardcoding names.
 
-| Command                          | Returns                                       |
-| -------------------------------- | --------------------------------------------- |
-| `aitk tooling list --json`       | Stacks, extends chain, dep and script counts  |
-| `aitk snippets list --json`      | Presets and categories with their slugs       |
-| `aitk standards list --json`     | Standards docs and the paths each governs     |
-| `aitk gov list --json`           | Governance stacks and rule sets               |
-| `aitk claude seeds list --json`  | Seed doc sources with content                 |
-| `aitk claude skills list --json` | Plugin skills, descriptions, requirement flag |
-| `aitk docs list --json`          | Consumer docs plus per-domain context         |
+| Command                          | Returns                                              |
+| -------------------------------- | ---------------------------------------------------- |
+| `aitk tooling list --json`       | Stacks, extends chain, dep and script counts         |
+| `aitk snippets list --json`      | Presets and categories with their slugs              |
+| `aitk standards list --json`     | Standards docs and the paths each governs            |
+| `aitk gov list --json`           | Governance stacks, rule sets, and unreferenced rules |
+| `aitk claude seeds list --json`  | Seed doc sources with content                        |
+| `aitk claude skills list --json` | Plugin skills, descriptions, requirement flag        |
+| `aitk docs list --json`          | Consumer docs plus per-domain context                |
 
 ### Catalog fields
 
@@ -40,6 +40,18 @@ listing and the install cannot disagree. It now reports
 `.claude/context/index.md`, which `init` has always installed and the listing
 never named, and it emits the project-level `CLAUDE.md` last rather than first.
 
+`aitk gov list` reports each stack's rules already expanded. A stack entry names
+either a rule or a whole rule folder under `governance/rules/`, and the folder
+form reaches this listing as the rules it stands for rather than as the folder
+name. A consumer deduping `--add` extras against a stack therefore reads the same
+set the install writes, whichever form the stack file uses.
+
+It also carries `unreferenced`, the rules no stack reaches, on every invocation
+rather than behind a flag. These install only through `--add`, so the key answers
+what a stack leaves out without a caller resolving every stack itself. The key is
+present alongside `stacks` and `rules` and survives `--stacks` or `--rules`
+narrowing the other two.
+
 ### The skills catalog
 
 `aitk claude skills list` reads `claude/skills/*/SKILL.md` and reports the folder

package/governance/stacks/base.toml

@@ -1,2 +1,4 @@
 extends = ""
-rules = ["000-constitution", "010-testing", "020-concurrency", "030-error-handling", "040-performance", "050-logging", "060-naming", "070-planning", "080-config-comments", "090-code-comments", "500-prose", "501-markdown", "510-context", "520-wireframes", "530-requirements", "540-architecture", "550-design", "555-tasks", "556-groundwork", "557-intake", "560-diagrams", "570-skill", "580-readme", "590-rule-authoring", "591-standard-authoring"]
+# Both folders whole. Every rule authored under them ships to a base consumer,
+# so adding one is a single edit rather than a file and a name here.
+rules = ["core", "claude"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/aitk",
   "type": "module",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/scripts/core/verify.sh

@@ -18,6 +18,12 @@ CHANGED_FILES=""
 # unarmed and why.
 SANDBOX_UNDECLARED_CEILING=47
 
+# Rules no stack reaches, space separated and sorted the way `aitk gov list`
+# emits them. Both are opt-in libraries a project may not want, so they are
+# recorded here rather than in a config file: the list is what a reader compares
+# a new arrival against, and a config file would absorb the arrival silently.
+GOV_EXPECTED_UNREFERENCED="260-shadcn 320-tanstack-query"
+
 check_dependencies() {
   command -v bun >/dev/null 2>&1 || log_error "bun is not installed"
 }
@@ -208,6 +214,55 @@ main() {
   run_check "bash $PROJECT_ROOT/scripts/core/check-plugin-boundary.sh" "Plugin ships toolkit-internal content."
   log_info "Plugin boundary clean"
 
+  # A stack entry naming a rule folder takes every rule in it, which is what
+  # stops a new rule from needing a second edit to reach a target. The failure
+  # it leaves open is a rule authored into a folder no stack names, which
+  # installs for nobody and reports nothing on its own.
+  #
+  # This reports and never fails. Both standing findings are opt-in libraries
+  # this repository ships on purpose, so gating would fail every push over the
+  # deliberate case and teach a reader to route around the stage. Revisit when a
+  # third appears and the pattern is either a library set or an accident.
+  log_step "Unreferenced rules"
+  local gov_json gov_status=0 unreferenced
+  gov_json=$(cd "$PROJECT_ROOT" && bun src/cli.ts gov list --json 2>/dev/null) || gov_status=$?
+  if [ "$gov_status" -ne 0 ] || [ -z "$gov_json" ]; then
+    log_warn "Skipped, the governance catalog did not report"
+  else
+    # `bun --eval` rather than a grep, because the key holds an array of names
+    # and the numeric matches the stages above use reach a scalar alone.
+    #
+    # The `ok:` sentinel carries success rather than the exit code, because
+    # `bun --eval` reading piped stdin exits 0 even when the script throws.
+    # Measured on Bun 1.3.14: the same throw exits 1 with no pipe attached. A
+    # payload that parses as text but not as JSON would therefore print nothing
+    # and exit clean, and empty already means every rule is reached, so reading
+    # the exit code would report a broken catalog as a clean sweep. A missing
+    # or non-array key takes the same branch, since a stage that cannot measure
+    # should say so rather than claim the sweep found nothing.
+    local reported
+    reported=$(printf '%s' "$gov_json" | bun --eval '
+      try {
+        const data = JSON.parse(require("node:fs").readFileSync(0, "utf8"))
+        if (!Array.isArray(data.unreferenced)) throw new Error("no field")
+        console.log("ok:" + data.unreferenced.join(" "))
+      } catch {
+        console.log("unreadable:")
+      }
+    ')
+    unreferenced="${reported#ok:}"
+    if [ "${reported%%:*}" != "ok" ]; then
+      log_warn "Skipped, the governance catalog carried no readable unreferenced list"
+    elif [ -z "$unreferenced" ]; then
+      log_info "Every rule is reached by a stack"
+    elif [ "$unreferenced" = "$GOV_EXPECTED_UNREFERENCED" ]; then
+      log_info "Reached by no stack: $unreferenced (opt-in, install with --add)"
+    else
+      log_warn "Reached by no stack: $unreferenced"
+      log_warn "Expected: $GOV_EXPECTED_UNREFERENCED. Name the new rule in a stack, or update GOV_EXPECTED_UNREFERENCED in this script and say why it ships opt-in."
+    fi
+  fi
+
   # Only the citation half of the audit gates. Length, depth, table, and index
   # findings are judgment thresholds, and failing a push on one would make the
   # stage something to route around. `bun src/cli.ts` rather than `aitk`, since a

package/src/commands/gov.ts

@@ -2,11 +2,11 @@ import { existsSync } from 'node:fs'
 import { mkdir, writeFile } from 'node:fs/promises'
 import { basename, dirname, join, resolve } from 'node:path'
 import type { Command } from 'commander'
-import { registerPassThroughVerbs } from '@/commands/pass-through'
 import { PROJECT_ROOT } from '@/exec'
 import { createGovAdapter } from '@/gov/adapter'
 import { regenConsumedRules } from '@/gov/consumed'
 import { hasStandards, installRules, lookupRules } from '@/gov/install'
+import { buildGovCatalog, describeRule, describeStack } from '@/gov/list'
 import { buildRulesPayload, listRuleFiles } from '@/gov/payload'
 import {
   govStackExists,
@@ -34,8 +34,6 @@ const NC = '\x1b[0m'
 const PAYLOAD_REL = join('.claude', '.tmp', 'gov', 'rules.md')
 const RULES_REL = join('.claude', 'rules')
 
-const PASS_THROUGH_VERBS = ['list'] as const
-
 interface InstallOptions {
   readonly add?: string
 }
@@ -44,6 +42,12 @@ interface RegenOptions {
   readonly root?: string
 }
 
+interface ListOptions {
+  readonly stacks?: boolean
+  readonly rules?: boolean
+  readonly json?: boolean
+}
+
 export function register(program: Command): void {
   const gov = program
     .command('gov')
@@ -119,7 +123,78 @@ export function register(program: Command): void {
       process.exitCode = await runRegen(opts)
     })
 
-  registerPassThroughVerbs(gov, 'gov', PASS_THROUGH_VERBS)
+  gov
+    .command('list')
+    .description('Emit the catalog of stacks and rules')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--stacks', 'Only list stacks')
+    .option('--rules', 'Only list rules')
+    .option('--json', 'Emit machine-readable JSON')
+    .action((opts: ListOptions) => {
+      process.exitCode = runList(opts)
+    })
+}
+
+/**
+ * Both selectors absent means both sections, which is the bash default. Naming
+ * both is the same as naming neither rather than an error, since the two flags
+ * read as filters and a caller passing both is asking for everything.
+ */
+function selectedSections(opts: ListOptions): {
+  stacks: boolean
+  rules: boolean
+} {
+  const stacks = opts.stacks === true
+  const rules = opts.rules === true
+  if (stacks === rules) return { stacks: true, rules: true }
+  return { stacks, rules }
+}
+
+/**
+ * `JSON.stringify` replaces a `printf` that interpolated a description into a
+ * JSON string literal through a hand-rolled escaper, so a rule carrying a
+ * character that escaper missed emitted output a consuming skill could not
+ * parse.
+ *
+ * `unreferenced` rides the same payload rather than taking a flag of its own.
+ * The verify stage and a skill asking what a stack leaves out read one call,
+ * and the key is additive, so a consumer reading `stacks` or `rules` is
+ * untouched by it.
+ */
+function runList(opts: ListOptions): number {
+  const catalog = buildGovCatalog(PROJECT_ROOT)
+  const sections = selectedSections(opts)
+
+  if (opts.json) {
+    process.stdout.write(
+      `${JSON.stringify({
+        ...(sections.stacks ? { stacks: catalog.stacks } : {}),
+        ...(sections.rules ? { rules: catalog.rules } : {}),
+        unreferenced: catalog.unreferenced,
+      })}\n`,
+    )
+    return 0
+  }
+
+  intro('aitk gov list')
+
+  if (sections.stacks) {
+    logStep('Stacks')
+    for (const entry of catalog.stacks) logInfo(describeStack(entry))
+  }
+
+  if (sections.rules) {
+    logStep('Rules')
+    for (const entry of catalog.rules) logInfo(describeRule(entry))
+  }
+
+  if (catalog.unreferenced.length > 0) {
+    logStep('Reached by no stack')
+    for (const rule of catalog.unreferenced) logInfo(rule)
+  }
+
+  outro()
+  return 0
 }
 
 /**

package/src/gov/install.ts

@@ -31,6 +31,37 @@ export function ruleSubdir(src: string, rulesRoot: string): string {
   return subdir === '.' ? '' : subdir
 }
 
+/**
+ * Lists every rule source path under `governance/rules/`, relative to it and
+ * sorted, so a caller walking the tree and a caller resolving one name read the
+ * same order.
+ */
+export function listRuleSourcePaths(root: string): string[] {
+  const rulesRoot = rulesSourceDir(root)
+  if (!existsSync(rulesRoot)) return []
+
+  return [
+    ...new Bun.Glob('**/*.md').scanSync({ cwd: rulesRoot, onlyFiles: true }),
+  ].sort()
+}
+
+/**
+ * Maps each rule name to its source file. First path wins, so a name appearing
+ * in two subdirectories resolves deterministically rather than by whichever
+ * entry the filesystem yielded first.
+ */
+function indexRuleSources(root: string): Map<string, string> {
+  const rulesRoot = rulesSourceDir(root)
+  const byName = new Map<string, string>()
+
+  for (const rel of listRuleSourcePaths(root)) {
+    const name = rel.slice(rel.lastIndexOf('/') + 1, -'.md'.length)
+    if (!byName.has(name)) byName.set(name, join(rulesRoot, rel))
+  }
+
+  return byName
+}
+
 /**
  * Finds each rule's source file by name across the `governance/rules/`
  * subfolders. A rule with no source is reported rather than dropped, matching
@@ -41,21 +72,7 @@ export function lookupRules(
   rules: readonly string[],
 ): RuleLookup {
   const rulesRoot = rulesSourceDir(root)
-  const byName = new Map<string, string>()
-
-  const relPaths = existsSync(rulesRoot)
-    ? [
-        ...new Bun.Glob('**/*.md').scanSync({
-          cwd: rulesRoot,
-          onlyFiles: true,
-        }),
-      ].sort()
-    : []
-
-  for (const rel of relPaths) {
-    const name = rel.slice(rel.lastIndexOf('/') + 1, -'.md'.length)
-    if (!byName.has(name)) byName.set(name, join(rulesRoot, rel))
-  }
+  const byName = indexRuleSources(root)
 
   const found: RuleSource[] = []
   const missing: string[] = []

package/src/gov/list.ts

@@ -0,0 +1,106 @@
+import { readFileSync } from 'node:fs'
+import { basename, join } from 'node:path'
+import { listRuleSourcePaths, rulesSourceDir } from '@/gov/install'
+import {
+  expandStackEntry,
+  listGovStacks,
+  loadGovStack,
+  unreferencedRules,
+} from '@/gov/stacks'
+import { parseFrontmatter, readField } from '@/indexes/frontmatter'
+
+export interface StackEntry {
+  readonly name: string
+  readonly extends: string | null
+  readonly rules: string[]
+}
+
+export interface RuleEntry {
+  readonly name: string
+  readonly domain: string
+  readonly description: string
+  readonly paths: string[] | null
+}
+
+export interface GovCatalog {
+  readonly stacks: StackEntry[]
+  readonly rules: RuleEntry[]
+  readonly unreferenced: string[]
+}
+
+/**
+ * Reports each stack's own entries expanded, so a folder entry reaches a
+ * consumer as the rules it stands for. `setup-gov` dedupes `--add` extras
+ * against this list, and a stack answering `core` there would re-add every
+ * rule that folder already carries.
+ *
+ * The `extends` chain is deliberately not resolved, which is what the bash
+ * did. The list shows what each stack contributes beside the parent it
+ * inherits from, rather than repeating the ancestors under every descendant.
+ */
+export function buildStackEntries(root: string): StackEntry[] {
+  const entries: StackEntry[] = []
+
+  for (const name of listGovStacks(root)) {
+    const stack = loadGovStack(root, name)
+    if (!stack) continue
+
+    const seen = new Set<string>()
+    const rules: string[] = []
+
+    for (const entry of stack.rules) {
+      for (const rule of expandStackEntry(root, entry)) {
+        if (seen.has(rule)) continue
+        seen.add(rule)
+        rules.push(rule)
+      }
+    }
+
+    entries.push({ name, extends: stack.parent ?? null, rules })
+  }
+
+  return entries
+}
+
+/**
+ * Reads the catalog straight off the source tree. A rule's domain is the
+ * subdirectory it sits in, which is the band grouping install preserves.
+ */
+export function buildRuleEntries(root: string): RuleEntry[] {
+  const rulesRoot = rulesSourceDir(root)
+
+  return listRuleSourcePaths(root).map((rel) => {
+    const frontmatter = parseFrontmatter(
+      readFileSync(join(rulesRoot, rel), 'utf8'),
+    )
+    const paths = frontmatter?.fields.paths
+
+    return {
+      name: basename(rel, '.md'),
+      domain: rel.includes('/') ? rel.slice(0, rel.indexOf('/')) : '',
+      description: readField(frontmatter, 'description') ?? '',
+      paths: Array.isArray(paths)
+        ? paths.filter((entry): entry is string => typeof entry === 'string')
+        : null,
+    }
+  })
+}
+
+export function buildGovCatalog(root: string): GovCatalog {
+  return {
+    stacks: buildStackEntries(root),
+    rules: buildRuleEntries(root),
+    unreferenced: unreferencedRules(root),
+  }
+}
+
+export function describeStack(entry: StackEntry): string {
+  const count = `${entry.rules.length} rules`
+  return entry.extends === null
+    ? `${entry.name} (${count})`
+    : `${entry.name} (extends: ${entry.extends}, ${count})`
+}
+
+export function describeRule(entry: RuleEntry): string {
+  return `${entry.name} [${entry.domain}] ${entry.description}`
+}

package/src/gov/stacks.ts

@@ -1,5 +1,6 @@
-import { existsSync, readFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { existsSync, readFileSync, statSync } from 'node:fs'
+import { basename, join } from 'node:path'
+import { listRuleSourcePaths, rulesSourceDir } from '@/gov/install'
 
 export interface GovStack {
   readonly name: string
@@ -64,11 +65,33 @@ export function loadGovStack(
   }
 }
 
+/**
+ * Expands one stack entry. An entry naming a directory under
+ * `governance/rules/` resolves to every rule inside it, sorted, and any other
+ * entry resolves to itself, so a folder and a slug reach the caller as one
+ * shape rather than two the caller has to tell apart.
+ *
+ * The directory wins over a rule file of the same name. They cannot collide
+ * while `standards/rule.md` requires a numeric prefix on a rule slug, since a
+ * band folder carries none.
+ */
+export function expandStackEntry(root: string, entry: string): string[] {
+  const dir = join(rulesSourceDir(root), entry)
+  if (!existsSync(dir) || !statSync(dir).isDirectory()) return [entry]
+
+  return [...new Bun.Glob('**/*.md').scanSync({ cwd: dir, onlyFiles: true })]
+    .sort()
+    .map((rel) => basename(rel, '.md'))
+}
+
 /**
  * Walks `extends` ancestors first, then the stack's own rules, deduped by
  * first appearance. Tooling's `resolveChain` returns full manifests nearest
  * first and carries `skipStack` truncation, so the two walks stay separate
  * rather than fitting one shape to both.
+ *
+ * Dedupe runs on expanded names rather than on the entries, so a stack naming
+ * a folder and an ancestor naming a rule inside it yield that rule once.
  */
 export function resolveRules(root: string, stack: string): RuleResolution {
   const rules: string[] = []
@@ -87,10 +110,12 @@ export function resolveRules(root: string, stack: string): RuleResolution {
       if (missing !== undefined) return missing
     }
 
-    for (const rule of loaded.rules) {
-      if (seen.has(rule)) continue
-      seen.add(rule)
-      rules.push(rule)
+    for (const entry of loaded.rules) {
+      for (const rule of expandStackEntry(root, entry)) {
+        if (seen.has(rule)) continue
+        seen.add(rule)
+        rules.push(rule)
+      }
     }
 
     return undefined
@@ -102,6 +127,30 @@ export function resolveRules(root: string, stack: string): RuleResolution {
   return { ok: true, rules }
 }
 
+/**
+ * Names every rule no stack reaches, sorted. A rule outside every stack still
+ * installs through `--add`, so this reports an opt-in library and an oversight
+ * alike and leaves telling them apart to the reader.
+ *
+ * A stack whose `extends` does not resolve contributes nothing rather than
+ * aborting the sweep, or one broken stack would report the whole catalog as
+ * unreferenced.
+ */
+export function unreferencedRules(root: string): string[] {
+  const reached = new Set<string>()
+
+  for (const stack of listGovStacks(root)) {
+    const resolution = resolveRules(root, stack)
+    if (!resolution.ok) continue
+    for (const rule of resolution.rules) reached.add(rule)
+  }
+
+  return listRuleSourcePaths(root)
+    .map((rel) => basename(rel, '.md'))
+    .filter((rule) => !reached.has(rule))
+    .sort()
+}
+
 /**
  * Layers `--add` names on top of a resolved stack. The bash trimmed a single
  * leading and trailing space per entry; trimming fully is the same result for

package/standards/rule.md

@@ -33,6 +33,15 @@ Write both when both apply. A rule stating the directive and a skill stating how
 - Subdirectories group by domain: `core/`, `lang/`, `framework/`, `lib/`, `ui/`, `claude/`
 - `<n>` is a number in the subdirectory's band and `<slug>` is a one-to-three-word kebab topic
 - Scaffold a rule with a number that collides with neither the project's rules nor any installed shared rule set
+- Give every rule a numeric prefix. A bare-word filename reads as a folder name where a stack names its rules, so a rule without one is unreachable from a stack entry.
+
+## Two sources numbering into one folder
+
+A shared rule set and a project's own rules land in the same installed folder and draw from the same band, so the two need a division or they collide. Divide the band by source rather than by topic: one source takes the top of each band and the other takes the gaps between the tens. A rule set that ships to targets should take the tens, since it is the source a project cannot renumber.
+
+The collision this prevents is silent. Two rules that resolve to the same `<n>-<slug>` path leave one file in the installed folder, and neither the install nor the session that reads it reports which source lost. Nothing checks the division, so it holds only while both sources follow it.
+
+State the division where the rule sources are described, not in the rules themselves. A rule states its own topic, and a numbering convention spanning two sources belongs to whatever documents the pair.
 
 ## Frontmatter
 

package/scripts/gov/list.sh

@@ -1,234 +0,0 @@
-#!/usr/bin/env bash
-set -e
-set -o pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="${PROJECT_ROOT:-$(dirname "$(dirname "$SCRIPT_DIR")")}"
-
-source "$PROJECT_ROOT/scripts/lib/ui.sh"
-
-STACKS_DIR="$PROJECT_ROOT/governance/stacks"
-RULES_DIR="$PROJECT_ROOT/governance/rules"
-
-show_help() {
-  echo -e "${GREY}┌${NC}"
-  echo -e "${GREY}├${NC} ${WHITE}Usage:${NC} aitk gov list [options]"
-  echo -e "${GREY}│${NC}"
-  echo -e "${GREY}│${NC}  ${WHITE}Options:${NC}"
-  echo -e "${GREY}│${NC}    --stacks    ${GREY}# Only list stacks${NC}"
-  echo -e "${GREY}│${NC}    --rules     ${GREY}# Only list rules${NC}"
-  echo -e "${GREY}│${NC}    --json      ${GREY}# Emit machine-readable JSON${NC}"
-  echo -e "${GREY}│${NC}    -h, --help  ${GREY}# Show this help message${NC}"
-  echo -e "${GREY}└${NC}"
-  exit 0
-}
-
-read_frontmatter_field() {
-  local file="$1"
-  local field="$2"
-  awk -v f="$field" '
-    BEGIN { fm = 0 }
-    /^---$/ { fm++; if (fm > 1) exit; next }
-    fm == 1 {
-      if (match($0, "^" f ":")) {
-        val = substr($0, RLENGTH + 1)
-        sub(/^[[:space:]]+/, "", val)
-        sub(/^[\x27"]/, "", val)
-        sub(/[\x27"]$/, "", val)
-        print val
-        exit
-      }
-    }
-  ' "$file"
-}
-
-read_frontmatter_paths() {
-  local file="$1"
-  awk '
-    BEGIN { fm = 0; in_paths = 0 }
-    /^---$/ { fm++; if (fm > 1) exit; next }
-    fm == 1 {
-      if (in_paths) {
-        if (match($0, /^[[:space:]]*-[[:space:]]+/)) {
-          val = substr($0, RLENGTH + 1)
-          sub(/^[\x27"]/, "", val)
-          sub(/[\x27"]$/, "", val)
-          print val
-          next
-        }
-        in_paths = 0
-      }
-      if ($0 == "paths:") { in_paths = 1 }
-    }
-  ' "$file"
-}
-
-rule_domain() {
-  local file="$1"
-  local rel="${file#"$RULES_DIR"/}"
-  echo "${rel%%/*}"
-}
-
-stack_rules_array() {
-  local toml="$1"
-  grep -oE '"[0-9]{3}-[a-z0-9-]+"' "$toml" | sed 's/"//g'
-}
-
-json_escape() {
-  local s="$1"
-  s="${s//\\/\\\\}"
-  s="${s//\"/\\\"}"
-  printf '%s' "$s"
-}
-
-list_stacks_text() {
-  log_step "Stacks"
-  local toml
-  for toml in "$STACKS_DIR"/*.toml; do
-    local name
-    name=$(basename "$toml" .toml)
-    local extends
-    extends=$(grep '^extends' "$toml" | cut -d'"' -f2)
-    local rule_count
-    rule_count=$(stack_rules_array "$toml" | wc -l)
-    if [ -n "$extends" ]; then
-      log_info "$name (extends: $extends, $rule_count rules)"
-    else
-      log_info "$name ($rule_count rules)"
-    fi
-  done
-}
-
-list_rules_text() {
-  log_step "Rules"
-  local file
-  while IFS= read -r file; do
-    local name
-    name=$(basename "$file" .md)
-    local domain
-    domain=$(rule_domain "$file")
-    local desc
-    desc=$(read_frontmatter_field "$file" "description")
-    log_info "$name [$domain] $desc"
-  done < <(find "$RULES_DIR" -type f -name "*.md" | sort)
-}
-
-list_stacks_json() {
-  local first=1
-  local toml
-  printf '['
-  for toml in "$STACKS_DIR"/*.toml; do
-    local name
-    name=$(basename "$toml" .toml)
-    local extends
-    extends=$(grep '^extends' "$toml" | cut -d'"' -f2)
-    local rules_json="["
-    local first_rule=1
-    local rule
-    while IFS= read -r rule; do
-      [ -z "$rule" ] && continue
-      if [ "$first_rule" -eq 0 ]; then
-        rules_json+=","
-      fi
-      rules_json+="\"$rule\""
-      first_rule=0
-    done < <(stack_rules_array "$toml")
-    rules_json+="]"
-    if [ "$first" -eq 0 ]; then
-      printf ','
-    fi
-    if [ -n "$extends" ]; then
-      printf '{"name":"%s","extends":"%s","rules":%s}' "$name" "$extends" "$rules_json"
-    else
-      printf '{"name":"%s","extends":null,"rules":%s}' "$name" "$rules_json"
-    fi
-    first=0
-  done
-  printf ']'
-}
-
-list_rules_json() {
-  local first=1
-  local file
-  printf '['
-  while IFS= read -r file; do
-    local name
-    name=$(basename "$file" .md)
-    local domain
-    domain=$(rule_domain "$file")
-    local desc
-    desc=$(read_frontmatter_field "$file" "description")
-
-    local paths_json="null"
-    local paths_collected=()
-    while IFS= read -r p; do
-      [ -n "$p" ] && paths_collected+=("$p")
-    done < <(read_frontmatter_paths "$file")
-    if [ "${#paths_collected[@]}" -gt 0 ]; then
-      paths_json="["
-      local first_p=1
-      local p
-      for p in "${paths_collected[@]}"; do
-        [ "$first_p" -eq 0 ] && paths_json+=","
-        paths_json+="\"$(json_escape "$p")\""
-        first_p=0
-      done
-      paths_json+="]"
-    fi
-
-    if [ "$first" -eq 0 ]; then
-      printf ','
-    fi
-    printf '{"name":"%s","domain":"%s","description":"%s","paths":%s}' \
-      "$name" "$domain" "$(json_escape "$desc")" "$paths_json"
-    first=0
-  done < <(find "$RULES_DIR" -type f -name "*.md" | sort)
-  printf ']'
-}
-
-main() {
-  local show_stacks=1
-  local show_rules=1
-  local json=0
-
-  while [[ $# -gt 0 ]]; do
-    case "$1" in
-    -h | --help) show_help ;;
-    --stacks)
-      show_rules=0
-      shift
-      ;;
-    --rules)
-      show_stacks=0
-      shift
-      ;;
-    --json)
-      json=1
-      shift
-      ;;
-    *) log_error "Unknown option: $1" ;;
-    esac
-  done
-
-  trap close_timeline EXIT
-
-  if [ "$json" -eq 1 ]; then
-    printf '{'
-    if [ "$show_stacks" -eq 1 ]; then
-      printf '"stacks":'
-      list_stacks_json
-      [ "$show_rules" -eq 1 ] && printf ','
-    fi
-    if [ "$show_rules" -eq 1 ]; then
-      printf '"rules":'
-      list_rules_json
-    fi
-    printf '}\n'
-    exit 0
-  fi
-
-  [ "$show_stacks" -eq 1 ] && list_stacks_text
-  [ "$show_rules" -eq 1 ] && list_rules_text
-}
-
-main "$@"