@facilis.dev/ai 0.1.0 → 0.1.1

package/dist/index.d.ts

@@ -12,5 +12,5 @@
  */
 export { buildProjectContext } from "./context.js";
 export { checkPatchSyntax } from "./syntax-runner.js";
-export type { Analysis, BlockFacts, ColumnFact, ConfigFacts, Diagnostic, FileFacts, FilePatch, ImportAlias, ImportFact, LocaleCatalogs, PatchContext, ProjectContext, ProjectContextInput, RouteFact, SchemaSummary, SourceRef, SyntaxCheck, SyntaxChecker, SyntaxFinding, SyntaxIssue, TableFact, TranslationCallFact, ValidatePatchOptions, ValidationError, ValidationResult, } from "./types.js";
+export type { Analysis, BlockFacts, ColumnFact, ConfigFacts, Diagnostic, FileFacts, FilePatch, ImportAlias, ImportFact, LocaleCatalogs, PatchContext, ProjectContext, ProjectContextInput, RouteFact, SchemaSummary, SourceRef, SyntaxCheck, SyntaxChecker, SyntaxFinding, SyntaxIssue, TableFact, TranslationCallFact, ValidatePatchOptions, ValidationError, ValidationResult, WritePolicy, } from "./types.js";
 export { validatePatch } from "./validator.js";

package/dist/paths.d.ts

@@ -3,20 +3,39 @@
  *
  * Paths are always compared in their normalized, root-relative form ("src/App.tsx"), so
  * Windows separators or a leading "./" never change a rule's verdict.
+ *
+ * Rule 11's writable set follows the deployment profile (D-167). A `managed` build keeps
+ * the six source roots (D-084); an `open` build accepts the whole project minus the
+ * machine surfaces a patch must never touch: dependencies, install state, VCS/IDE state,
+ * build output and the project's own instruction file.
  */
+import type { WritePolicy } from "./types.js";
 /** The project files whose facts the validator treats specially. */
 export declare const CONFIG_PATH = "facilis.config.ts";
 export declare const SCHEMA_PATH = "db/schema.ts";
 export declare const LOCALES_PATH = "locales/en.json";
-/** Roots a patch may write to (SPEC §9.3 rule 11). */
+/** Roots a `managed` patch may write to (SPEC §9.3 rule 11, D-084). */
 export declare const ALLOWED_ROOTS: string[];
 /**
- * The one root file a patch may touch: rule 16 exists because a new permission/role is
- * declared in facilis.config.ts in the same patch, so a blanket root-file rejection would
- * make the 17-rule contract self-contradictory (D-084).
+ * The one root file a `managed` patch may touch: rule 16 exists because a new
+ * permission/role is declared in facilis.config.ts in the same patch, so a blanket
+ * root-file rejection would make the 17-rule contract self-contradictory (D-084).
  */
 export declare const ALLOWED_ROOT_FILES: Set<string>;
+/**
+ * Directory segments no `open` patch may write into (D-167). They are the same entries
+ * the PTC read policy hides (docs/PTC.md §6): dependencies, VCS and IDE state, and build
+ * output the Explorer does not review. A patch writing them could hide its own changes,
+ * poison a cache, or add code without an install.
+ */
+export declare const DENIED_SEGMENTS: Set<string>;
+/**
+ * File names no `open` patch may write (D-167). The install surface is the dependency
+ * manifest, the lockfiles and the npm config; AGENTS.md stays IDE-writer-only because it
+ * persists instructions into every later session (D-084).
+ */
+export declare const DENIED_FILES: Set<string>;
 export declare function normalizeProjectPath(path: string): string;
 export declare function isScriptPath(path: string): boolean;
-/** True when the normalized path is inside a root rule 11 allows. */
-export declare function isAllowedWritePath(path: string): boolean;
+/** True when the normalized path is writable under `policy` (rule 11). */
+export declare function isAllowedWritePath(path: string, policy?: WritePolicy): boolean;

package/dist/paths.js

@@ -3,20 +3,53 @@
  *
  * Paths are always compared in their normalized, root-relative form ("src/App.tsx"), so
  * Windows separators or a leading "./" never change a rule's verdict.
+ *
+ * Rule 11's writable set follows the deployment profile (D-167). A `managed` build keeps
+ * the six source roots (D-084); an `open` build accepts the whole project minus the
+ * machine surfaces a patch must never touch: dependencies, install state, VCS/IDE state,
+ * build output and the project's own instruction file.
  */
 const SCRIPT_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 /** The project files whose facts the validator treats specially. */
 export const CONFIG_PATH = "facilis.config.ts";
 export const SCHEMA_PATH = "db/schema.ts";
 export const LOCALES_PATH = "locales/en.json";
-/** Roots a patch may write to (SPEC §9.3 rule 11). */
+/** Roots a `managed` patch may write to (SPEC §9.3 rule 11, D-084). */
 export const ALLOWED_ROOTS = ["server/", "src/", "db/", "lib/", "components/", "locales/"];
 /**
- * The one root file a patch may touch: rule 16 exists because a new permission/role is
- * declared in facilis.config.ts in the same patch, so a blanket root-file rejection would
- * make the 17-rule contract self-contradictory (D-084).
+ * The one root file a `managed` patch may touch: rule 16 exists because a new
+ * permission/role is declared in facilis.config.ts in the same patch, so a blanket
+ * root-file rejection would make the 17-rule contract self-contradictory (D-084).
  */
 export const ALLOWED_ROOT_FILES = new Set(["facilis.config.ts"]);
+/**
+ * Directory segments no `open` patch may write into (D-167). They are the same entries
+ * the PTC read policy hides (docs/PTC.md §6): dependencies, VCS and IDE state, and build
+ * output the Explorer does not review. A patch writing them could hide its own changes,
+ * poison a cache, or add code without an install.
+ */
+export const DENIED_SEGMENTS = new Set([
+    "node_modules",
+    ".git",
+    ".facilis",
+    "dist",
+    ".turbo",
+    "coverage",
+]);
+/**
+ * File names no `open` patch may write (D-167). The install surface is the dependency
+ * manifest, the lockfiles and the npm config; AGENTS.md stays IDE-writer-only because it
+ * persists instructions into every later session (D-084).
+ */
+export const DENIED_FILES = new Set([
+    "package.json",
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    ".npmrc",
+    "AGENTS.md",
+]);
 export function normalizeProjectPath(path) {
     let normalized = path.trim();
     while (normalized.startsWith("./"))
@@ -26,7 +59,12 @@ export function normalizeProjectPath(path) {
 export function isScriptPath(path) {
     return SCRIPT_EXTENSIONS.some((extension) => path.endsWith(extension));
 }
-/** True when the normalized path is inside a root rule 11 allows. */
-export function isAllowedWritePath(path) {
-    return ALLOWED_ROOT_FILES.has(path) || ALLOWED_ROOTS.some((root) => path.startsWith(root));
+/** True when the normalized path is writable under `policy` (rule 11). */
+export function isAllowedWritePath(path, policy = "managed") {
+    if (policy === "managed") {
+        return ALLOWED_ROOT_FILES.has(path) || ALLOWED_ROOTS.some((root) => path.startsWith(root));
+    }
+    const segments = path.split("/");
+    const name = segments[segments.length - 1] ?? "";
+    return !DENIED_FILES.has(name) && !segments.some((segment) => DENIED_SEGMENTS.has(segment));
 }

package/dist/rules/database.d.ts

@@ -17,5 +17,8 @@ import type { FilePatch, ValidationError } from "../types.js";
 export declare function rlsErrors(state: EffectiveState): ValidationError[];
 /** Rule 14: a schema edit must ship a generated migration file (warning). */
 export declare function migrationWarnings(patches: readonly FilePatch[], state: EffectiveState): ValidationError[];
+/** The schema removals in a patch set (rule 15's predicate), for callers that need the
+ * fact without the finding (the IDE flags a write destructive, never blocks it). */
+export declare function destructiveChanges(state: EffectiveState): string[];
 /** Rule 15: dropping a table or column is destructive and must be confirmed. */
 export declare function destructiveErrors(state: EffectiveState, requiresConfirmation: boolean): ValidationError[];

package/dist/rules/database.js

@@ -79,17 +79,22 @@ function removedColumns(before, after) {
     }
     return removed;
 }
-/** Rule 15: dropping a table or column is destructive and must be confirmed. */
-export function destructiveErrors(state, requiresConfirmation) {
+/** The schema removals in a patch set (rule 15's predicate), for callers that need the
+ * fact without the finding (the IDE flags a write destructive, never blocks it). */
+export function destructiveChanges(state) {
     const afterNames = new Set(state.afterSchemaTables.map((table) => table.name));
     const droppedTables = state.beforeSchemaTables
         .map((table) => table.name)
         .filter((name) => !afterNames.has(name));
     const droppedColumns = removedColumns(state.beforeSchemaTables, state.afterSchemaTables);
-    const changes = [
+    return [
         ...droppedTables.map((name) => 'drops table "' + name + '"'),
         ...droppedColumns.map((name) => 'drops column "' + name + '"'),
     ];
+}
+/** Rule 15: dropping a table or column is destructive and must be confirmed. */
+export function destructiveErrors(state, requiresConfirmation) {
+    const changes = destructiveChanges(state);
     if (changes.length === 0 || requiresConfirmation)
         return [];
     const shown = changes.slice(0, 3).join(", ");

package/dist/rules/structural.d.ts

@@ -2,6 +2,15 @@
  * Rule 11 `file-path-allowed` plus the two structural checks the parser owns
  * (relative path, content present). These need no project context, so they also run
  * when the parser validates a raw answer before any context is assembled.
+ *
+ * The writable set follows the deployment profile (D-167): the finding keeps its rule id
+ * and severity, only the message and the fix hint change with the policy.
  */
-import type { FilePatch, ValidationError } from "../types.js";
-export declare function structuralErrors(patches: readonly FilePatch[], allowedRootFiles?: readonly string[]): ValidationError[];
+import type { FilePatch, ValidationError, WritePolicy } from "../types.js";
+export interface StructuralOptions {
+    /** Root files the caller's own writer may touch (never an AI patch). */
+    allowedRootFiles?: readonly string[];
+    /** Rule 11's writable set. Defaults to `managed` (fail-closed). */
+    writePolicy?: WritePolicy;
+}
+export declare function structuralErrors(patches: readonly FilePatch[], options?: StructuralOptions): ValidationError[];

package/dist/rules/structural.js

@@ -2,13 +2,22 @@
  * Rule 11 `file-path-allowed` plus the two structural checks the parser owns
  * (relative path, content present). These need no project context, so they also run
  * when the parser validates a raw answer before any context is assembled.
+ *
+ * The writable set follows the deployment profile (D-167): the finding keeps its rule id
+ * and severity, only the message and the fix hint change with the policy.
  */
 import { isAllowedWritePath, normalizeProjectPath } from "../paths.js";
 const UNSAFE_SEGMENTS = new Set(["..", "."]);
+const MANAGED_MESSAGE = " is outside the writable roots (server/, src/, db/, lib/, components/, locales/, facilis.config.ts).";
+const MANAGED_HINT = "Keep the patch under server/, src/, db/, lib/, components/ or locales/; the only allowed root file is facilis.config.ts.";
+const OPEN_MESSAGE = " is write-protected: a patch may not write dependencies, install state, VCS/IDE state or the project instruction file.";
+const OPEN_HINT = "Choose a project source or config file; node_modules/, package.json, lockfiles, .npmrc, .git/, .facilis/, dist/, .turbo/, coverage/ and AGENTS.md are never written by a patch.";
 function error(rule, file, message, fix_hint) {
     return { rule, severity: "error", file, message, fix_hint };
 }
-export function structuralErrors(patches, allowedRootFiles = []) {
+export function structuralErrors(patches, options = {}) {
+    const allowedRootFiles = options.allowedRootFiles ?? [];
+    const writePolicy = options.writePolicy ?? "managed";
     const errors = [];
     for (const patch of patches) {
         const path = normalizeProjectPath(patch.path);
@@ -20,10 +29,9 @@ export function structuralErrors(patches, allowedRootFiles = []) {
             errors.push(error("file-path-allowed", patch.path, "Patch paths must be relative to the project root.", "Use a project-relative path with no leading slash and no '..' segment."));
             continue;
         }
-        if (!isAllowedWritePath(path) && !allowedRootFiles.includes(path)) {
-            errors.push(error("file-path-allowed", patch.path, '"' +
-                path +
-                '" is outside the writable roots (server/, src/, db/, lib/, components/, locales/, facilis.config.ts).', "Keep the patch under server/, src/, db/, lib/, components/ or locales/; the only allowed root file is facilis.config.ts."));
+        if (!isAllowedWritePath(path, writePolicy) && !allowedRootFiles.includes(path)) {
+            const open = writePolicy === "open";
+            errors.push(error("file-path-allowed", patch.path, '"' + path + '"' + (open ? OPEN_MESSAGE : MANAGED_MESSAGE), open ? OPEN_HINT : MANAGED_HINT));
         }
         if (patch.action !== "delete" && (patch.content ?? "").length === 0) {
             errors.push(error("content-present", patch.path, "Create and update patches must include file content.", "Emit the complete new file content for every create and update patch."));

package/dist/testing/fixtures.d.ts

@@ -6,7 +6,7 @@
  * patch onto the pre-patch file map and analyze the result — so every rule runs against
  * AST facts instead of a tolerant text scan.
  */
-import { type FilePatch, type ImportAlias, type PatchContext, type SyntaxCheck, type ValidationResult } from "../index.js";
+import { type FilePatch, type ImportAlias, type PatchContext, type SyntaxCheck, type ValidatePatchOptions, type ValidationResult } from "../index.js";
 export declare const CONFIG = "import { defineConfig } from \"@facilis.dev/core\";\n\nexport default defineConfig({\n  release: { ref: \"origin/main\" },\n  db: { mode: \"pglite\", migrationsDir: \"db/migrations\" },\n  i18n: { defaultLocale: \"en\", locales: [\"en\"] },\n  auth: {\n    permissions: [\"todos:read\", \"todos:write\"],\n    roles: { admin: [\"*\"], user: [\"todos:read\", \"todos:write\"] },\n    defaultRole: \"user\",\n  },\n});\n";
 export declare const CONFIG_IT: string;
 export declare const SCHEMA = "import { boolean, pgTable, text, uuid } from \"drizzle-orm/pg-core\";\nimport { ownerIsolationPolicy, tenantColumn, tenantIsolationPolicy } from \"@facilis.dev/db\";\n\nexport const todos = pgTable(\n  \"todos\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    tenantId: tenantColumn(),\n    ownerId: uuid(\"owner_id\").notNull(),\n    title: text(\"title\").notNull(),\n    done: boolean(\"done\").notNull().default(false),\n  },\n  () => [tenantIsolationPolicy(), ownerIsolationPolicy()],\n).enableRLS();\n";
@@ -33,6 +33,7 @@ export declare function makeContext(patches?: readonly FilePatch[], options?: Co
 export interface ValidateOptions extends ContextOptions {
     requiresConfirmation?: boolean;
     allowedRootFiles?: readonly string[];
+    writePolicy?: ValidatePatchOptions["writePolicy"];
 }
 /** Build the context for the patch set, then validate it (the IDE's whole round). */
 export declare function validate(patches: readonly FilePatch[], options?: ValidateOptions): {

package/dist/testing/fixtures.js

@@ -134,6 +134,8 @@ export function validate(patches, options = {}) {
     }
     if (options.allowedRootFiles !== undefined)
         overrides.allowedRootFiles = options.allowedRootFiles;
+    if (options.writePolicy !== undefined)
+        overrides.writePolicy = options.writePolicy;
     const result = validatePatch(patches, { context, ...overrides });
     return { result, context };
 }

package/dist/types.d.ts

@@ -16,6 +16,12 @@ export type { ColumnFact, Diagnostic, FileFacts, ImportFact, JobFact, JobRelatio
 export type ConfigFacts = AnalyzerConfigFacts;
 export type RouteFact = AnalyzerRouteFact;
 export type TableFact = AnalyzerTableFact;
+/**
+ * Rule 11's writable set, selected by the deployment profile (D-167). `managed` keeps the
+ * six source roots (D-084); `open` accepts the whole project minus the install, VCS/IDE and
+ * instruction surfaces. The default is `managed`, so an external caller changes nothing.
+ */
+export type WritePolicy = "open" | "managed";
 /** One proposed file write (SPEC §9.2 response contract). */
 export interface FilePatch {
     path: string;
@@ -45,6 +51,12 @@ export interface ValidationResult {
     ok: boolean;
     errors: ValidationError[];
     warnings: ValidationError[];
+    /**
+     * The patch set drops a table or a column (rule 15's predicate). The IDE's incremental
+     * write path records it on the turn journal; confirmation stays rule 15's business, so
+     * this can be true on a result that is also `ok`.
+     */
+    destructive?: boolean;
 }
 /** One parse diagnostic from the injected TypeScript service (rule 1). */
 export interface SyntaxIssue {
@@ -129,4 +141,6 @@ export interface ValidatePatchOptions {
      * AGENTS.md scaffold); AI patches never do, so the model cannot persist instructions.
      */
     allowedRootFiles?: readonly string[];
+    /** Rule 11's writable set (D-167). Defaults to `managed`, the strict roots. */
+    writePolicy?: WritePolicy;
 }

package/dist/validator.js

@@ -12,7 +12,7 @@
 import { buildEffectiveState } from "./overlay.js";
 import { blockImportErrors } from "./rules/blocks.js";
 import { roleConfigSyncErrors } from "./rules/config-sync.js";
-import { destructiveErrors, migrationWarnings, rlsErrors } from "./rules/database.js";
+import { destructiveChanges, destructiveErrors, migrationWarnings, rlsErrors, } from "./rules/database.js";
 import { i18nWarnings } from "./rules/i18n.js";
 import { importResolveErrors, rawDbAccessErrors } from "./rules/imports.js";
 import { jobTableDeclaredFindings } from "./rules/job-relations.js";
@@ -23,11 +23,16 @@ import { routeDbTablesPresentErrors, routeInputErrors, routeSecurityErrors, } fr
 import { structuralErrors } from "./rules/structural.js";
 import { tsParseErrors } from "./rules/ts-parse.js";
 export function validatePatch(patches, options = {}) {
-    const errors = structuralErrors(patches, options.allowedRootFiles);
+    const errors = structuralErrors(patches, {
+        allowedRootFiles: options.allowedRootFiles ?? [],
+        writePolicy: options.writePolicy ?? "managed",
+    });
     const warnings = [];
+    let destructive = false;
     const context = options.context;
     if (context !== undefined) {
         const state = buildEffectiveState(context, patches);
+        destructive = destructiveChanges(state).length > 0;
         errors.push(...tsParseErrors(patches, context.syntax));
         errors.push(...routeSecurityErrors(state));
         errors.push(...routeDbTablesPresentErrors(state));
@@ -53,5 +58,5 @@ export function validatePatch(patches, options = {}) {
         errors.push(...jobTables.errors);
         warnings.push(...jobTables.warnings);
     }
-    return { ok: errors.length === 0, errors, warnings };
+    return { ok: errors.length === 0, errors, warnings, destructive };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@facilis.dev/ai",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "Facilis AI orchestration: prompt assembly, response parsing and patch validation.",
   "license": "MIT",
@@ -19,7 +19,7 @@
     "node": ">=22.15.0"
   },
   "dependencies": {
-    "@facilis.dev/analyze": "0.1.0"
+    "@facilis.dev/analyze": "0.1.1"
   },
   "publishConfig": {
     "access": "public"

package/src/index.ts

@@ -39,5 +39,6 @@ export type {
   ValidatePatchOptions,
   ValidationError,
   ValidationResult,
+  WritePolicy,
 } from "./types.ts";
 export { validatePatch } from "./validator.ts";

package/src/paths.ts

@@ -3,8 +3,15 @@
  *
  * Paths are always compared in their normalized, root-relative form ("src/App.tsx"), so
  * Windows separators or a leading "./" never change a rule's verdict.
+ *
+ * Rule 11's writable set follows the deployment profile (D-167). A `managed` build keeps
+ * the six source roots (D-084); an `open` build accepts the whole project minus the
+ * machine surfaces a patch must never touch: dependencies, install state, VCS/IDE state,
+ * build output and the project's own instruction file.
  */
 
+import type { WritePolicy } from "./types.ts";
+
 const SCRIPT_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 
 /** The project files whose facts the validator treats specially. */
@@ -12,16 +19,46 @@ export const CONFIG_PATH = "facilis.config.ts";
 export const SCHEMA_PATH = "db/schema.ts";
 export const LOCALES_PATH = "locales/en.json";
 
-/** Roots a patch may write to (SPEC §9.3 rule 11). */
+/** Roots a `managed` patch may write to (SPEC §9.3 rule 11, D-084). */
 export const ALLOWED_ROOTS = ["server/", "src/", "db/", "lib/", "components/", "locales/"];
 
 /**
- * The one root file a patch may touch: rule 16 exists because a new permission/role is
- * declared in facilis.config.ts in the same patch, so a blanket root-file rejection would
- * make the 17-rule contract self-contradictory (D-084).
+ * The one root file a `managed` patch may touch: rule 16 exists because a new
+ * permission/role is declared in facilis.config.ts in the same patch, so a blanket
+ * root-file rejection would make the 17-rule contract self-contradictory (D-084).
  */
 export const ALLOWED_ROOT_FILES = new Set(["facilis.config.ts"]);
 
+/**
+ * Directory segments no `open` patch may write into (D-167). They are the same entries
+ * the PTC read policy hides (docs/PTC.md §6): dependencies, VCS and IDE state, and build
+ * output the Explorer does not review. A patch writing them could hide its own changes,
+ * poison a cache, or add code without an install.
+ */
+export const DENIED_SEGMENTS = new Set([
+  "node_modules",
+  ".git",
+  ".facilis",
+  "dist",
+  ".turbo",
+  "coverage",
+]);
+
+/**
+ * File names no `open` patch may write (D-167). The install surface is the dependency
+ * manifest, the lockfiles and the npm config; AGENTS.md stays IDE-writer-only because it
+ * persists instructions into every later session (D-084).
+ */
+export const DENIED_FILES = new Set([
+  "package.json",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  ".npmrc",
+  "AGENTS.md",
+]);
+
 export function normalizeProjectPath(path: string): string {
   let normalized = path.trim();
   while (normalized.startsWith("./")) normalized = normalized.slice(2);
@@ -32,7 +69,12 @@ export function isScriptPath(path: string): boolean {
   return SCRIPT_EXTENSIONS.some((extension) => path.endsWith(extension));
 }
 
-/** True when the normalized path is inside a root rule 11 allows. */
-export function isAllowedWritePath(path: string): boolean {
-  return ALLOWED_ROOT_FILES.has(path) || ALLOWED_ROOTS.some((root) => path.startsWith(root));
+/** True when the normalized path is writable under `policy` (rule 11). */
+export function isAllowedWritePath(path: string, policy: WritePolicy = "managed"): boolean {
+  if (policy === "managed") {
+    return ALLOWED_ROOT_FILES.has(path) || ALLOWED_ROOTS.some((root) => path.startsWith(root));
+  }
+  const segments = path.split("/");
+  const name = segments[segments.length - 1] ?? "";
+  return !DENIED_FILES.has(name) && !segments.some((segment) => DENIED_SEGMENTS.has(segment));
 }

package/src/rules/database.ts

@@ -105,20 +105,26 @@ function removedColumns(before: readonly TableFact[], after: readonly TableFact[
   return removed;
 }
 
-/** Rule 15: dropping a table or column is destructive and must be confirmed. */
-export function destructiveErrors(
-  state: EffectiveState,
-  requiresConfirmation: boolean,
-): ValidationError[] {
+/** The schema removals in a patch set (rule 15's predicate), for callers that need the
+ * fact without the finding (the IDE flags a write destructive, never blocks it). */
+export function destructiveChanges(state: EffectiveState): string[] {
   const afterNames = new Set(state.afterSchemaTables.map((table) => table.name));
   const droppedTables = state.beforeSchemaTables
     .map((table) => table.name)
     .filter((name) => !afterNames.has(name));
   const droppedColumns = removedColumns(state.beforeSchemaTables, state.afterSchemaTables);
-  const changes = [
+  return [
     ...droppedTables.map((name) => 'drops table "' + name + '"'),
     ...droppedColumns.map((name) => 'drops column "' + name + '"'),
   ];
+}
+
+/** Rule 15: dropping a table or column is destructive and must be confirmed. */
+export function destructiveErrors(
+  state: EffectiveState,
+  requiresConfirmation: boolean,
+): ValidationError[] {
+  const changes = destructiveChanges(state);
   if (changes.length === 0 || requiresConfirmation) return [];
   const shown = changes.slice(0, 3).join(", ");
   const suffix = changes.length > 3 ? " (and " + (changes.length - 3) + " more)" : "";

package/src/rules/structural.ts

@@ -2,21 +2,42 @@
  * Rule 11 `file-path-allowed` plus the two structural checks the parser owns
  * (relative path, content present). These need no project context, so they also run
  * when the parser validates a raw answer before any context is assembled.
+ *
+ * The writable set follows the deployment profile (D-167): the finding keeps its rule id
+ * and severity, only the message and the fix hint change with the policy.
  */
 
 import { isAllowedWritePath, normalizeProjectPath } from "../paths.ts";
-import type { FilePatch, ValidationError } from "../types.ts";
+import type { FilePatch, ValidationError, WritePolicy } from "../types.ts";
 
 const UNSAFE_SEGMENTS = new Set(["..", "."]);
 
+const MANAGED_MESSAGE =
+  " is outside the writable roots (server/, src/, db/, lib/, components/, locales/, facilis.config.ts).";
+const MANAGED_HINT =
+  "Keep the patch under server/, src/, db/, lib/, components/ or locales/; the only allowed root file is facilis.config.ts.";
+const OPEN_MESSAGE =
+  " is write-protected: a patch may not write dependencies, install state, VCS/IDE state or the project instruction file.";
+const OPEN_HINT =
+  "Choose a project source or config file; node_modules/, package.json, lockfiles, .npmrc, .git/, .facilis/, dist/, .turbo/, coverage/ and AGENTS.md are never written by a patch.";
+
 function error(rule: string, file: string, message: string, fix_hint: string): ValidationError {
   return { rule, severity: "error", file, message, fix_hint };
 }
 
+export interface StructuralOptions {
+  /** Root files the caller's own writer may touch (never an AI patch). */
+  allowedRootFiles?: readonly string[];
+  /** Rule 11's writable set. Defaults to `managed` (fail-closed). */
+  writePolicy?: WritePolicy;
+}
+
 export function structuralErrors(
   patches: readonly FilePatch[],
-  allowedRootFiles: readonly string[] = [],
+  options: StructuralOptions = {},
 ): ValidationError[] {
+  const allowedRootFiles = options.allowedRootFiles ?? [];
+  const writePolicy = options.writePolicy ?? "managed";
   const errors: ValidationError[] = [];
   for (const patch of patches) {
     const path = normalizeProjectPath(patch.path);
@@ -36,15 +57,14 @@ export function structuralErrors(
       );
       continue;
     }
-    if (!isAllowedWritePath(path) && !allowedRootFiles.includes(path)) {
+    if (!isAllowedWritePath(path, writePolicy) && !allowedRootFiles.includes(path)) {
+      const open = writePolicy === "open";
       errors.push(
         error(
           "file-path-allowed",
           patch.path,
-          '"' +
-            path +
-            '" is outside the writable roots (server/, src/, db/, lib/, components/, locales/, facilis.config.ts).',
-          "Keep the patch under server/, src/, db/, lib/, components/ or locales/; the only allowed root file is facilis.config.ts.",
+          '"' + path + '"' + (open ? OPEN_MESSAGE : MANAGED_MESSAGE),
+          open ? OPEN_HINT : MANAGED_HINT,
         ),
       );
     }

package/src/testing/fixtures.ts

@@ -176,6 +176,7 @@ export function makeContext(
 export interface ValidateOptions extends ContextOptions {
   requiresConfirmation?: boolean;
   allowedRootFiles?: readonly string[];
+  writePolicy?: ValidatePatchOptions["writePolicy"];
 }
 
 /** Build the context for the patch set, then validate it (the IDE's whole round). */
@@ -184,11 +185,15 @@ export function validate(
   options: ValidateOptions = {},
 ): { result: ValidationResult; context: PatchContext } {
   const context = makeContext(patches, options);
-  const overrides: Pick<ValidatePatchOptions, "requiresConfirmation" | "allowedRootFiles"> = {};
+  const overrides: Pick<
+    ValidatePatchOptions,
+    "requiresConfirmation" | "allowedRootFiles" | "writePolicy"
+  > = {};
   if (options.requiresConfirmation !== undefined) {
     overrides.requiresConfirmation = options.requiresConfirmation;
   }
   if (options.allowedRootFiles !== undefined) overrides.allowedRootFiles = options.allowedRootFiles;
+  if (options.writePolicy !== undefined) overrides.writePolicy = options.writePolicy;
   const result = validatePatch(patches, { context, ...overrides });
   return { result, context };
 }

package/src/types.ts

@@ -39,6 +39,13 @@ export type ConfigFacts = AnalyzerConfigFacts;
 export type RouteFact = AnalyzerRouteFact;
 export type TableFact = AnalyzerTableFact;
 
+/**
+ * Rule 11's writable set, selected by the deployment profile (D-167). `managed` keeps the
+ * six source roots (D-084); `open` accepts the whole project minus the install, VCS/IDE and
+ * instruction surfaces. The default is `managed`, so an external caller changes nothing.
+ */
+export type WritePolicy = "open" | "managed";
+
 /** One proposed file write (SPEC §9.2 response contract). */
 export interface FilePatch {
   path: string;
@@ -70,6 +77,12 @@ export interface ValidationResult {
   ok: boolean;
   errors: ValidationError[];
   warnings: ValidationError[];
+  /**
+   * The patch set drops a table or a column (rule 15's predicate). The IDE's incremental
+   * write path records it on the turn journal; confirmation stays rule 15's business, so
+   * this can be true on a result that is also `ok`.
+   */
+  destructive?: boolean;
 }
 
 /** One parse diagnostic from the injected TypeScript service (rule 1). */
@@ -161,4 +174,6 @@ export interface ValidatePatchOptions {
    * AGENTS.md scaffold); AI patches never do, so the model cannot persist instructions.
    */
   allowedRootFiles?: readonly string[];
+  /** Rule 11's writable set (D-167). Defaults to `managed`, the strict roots. */
+  writePolicy?: WritePolicy;
 }

package/src/validator.ts

@@ -13,7 +13,12 @@
 import { buildEffectiveState } from "./overlay.ts";
 import { blockImportErrors } from "./rules/blocks.ts";
 import { roleConfigSyncErrors } from "./rules/config-sync.ts";
-import { destructiveErrors, migrationWarnings, rlsErrors } from "./rules/database.ts";
+import {
+  destructiveChanges,
+  destructiveErrors,
+  migrationWarnings,
+  rlsErrors,
+} from "./rules/database.ts";
 import { i18nWarnings } from "./rules/i18n.ts";
 import { importResolveErrors, rawDbAccessErrors } from "./rules/imports.ts";
 import { jobTableDeclaredFindings } from "./rules/job-relations.ts";
@@ -37,11 +42,16 @@ export function validatePatch(
   patches: readonly FilePatch[],
   options: ValidatePatchOptions = {},
 ): ValidationResult {
-  const errors = structuralErrors(patches, options.allowedRootFiles);
+  const errors = structuralErrors(patches, {
+    allowedRootFiles: options.allowedRootFiles ?? [],
+    writePolicy: options.writePolicy ?? "managed",
+  });
   const warnings: ValidationResult["warnings"] = [];
+  let destructive = false;
   const context = options.context;
   if (context !== undefined) {
     const state = buildEffectiveState(context, patches);
+    destructive = destructiveChanges(state).length > 0;
     errors.push(...tsParseErrors(patches, context.syntax));
     errors.push(...routeSecurityErrors(state));
     errors.push(...routeDbTablesPresentErrors(state));
@@ -67,5 +77,5 @@ export function validatePatch(
     errors.push(...jobTables.errors);
     warnings.push(...jobTables.warnings);
   }
-  return { ok: errors.length === 0, errors, warnings };
+  return { ok: errors.length === 0, errors, warnings, destructive };
 }