@geonosis/lint-parity 2.3.1 → 2.4.3

package/CHANGELOG.md

@@ -0,0 +1,408 @@
+# @geonosis/lint-parity
+
+## 2.4.3
+
+## 2.4.2
+
+## 2.4.1
+
+## 2.4.0
+
+## 2.3.1
+
+## 2.3.0
+
+### Minor Changes
+
+- 3dac9a7: **A rule a config turns off is out of the corpus's scope (#16).** `rulesNamedBy` took every key and
+  ignored severity, so three rules read as "fire nowhere" under a consumer's config where the doctor,
+  which reads severity, said one. A rule is in scope when some layer — base block or `overrides` entry
+  — leaves it running; a rule every layer sets to `"off"` (or `0`) is excluded, counted in the report
+  and named. `rulesTurnedOffBy` is the new door for the excluded list.
+- 3dac9a7: **One `--since`, and a report a machine can read (#97).** `--since` names a plan number, a day and
+  a git ref in three commands, and all three took any string: `plan check --since garbage` exempted
+  nothing and printed the verdict it would have printed with no flag, `stats --since notadate` put
+  every recorded day outside the window and printed `0 turns` as a pass rate. One reader now declares
+  which kind each means and refuses an unreadable value by name. `geonosis-ratchet`,
+  `geonosis-verify-arch` and `geonosis-lint-parity` take `--json`: the same report, on stdout,
+  whatever the verdict — `--json` with an explicit `--format` is refused rather than resolved.
+
+### Patch Changes
+
+- 3dac9a7: **A config oxlint would not parse is refused by name, never read as zero (#310).** Measured on
+  oxlint 1.80: a config naming a rule the loaded plugin does not export, or passing options to a rule
+  whose `schema` is `[]`, prints `Failed to parse oxlint configuration file`, exits 1 and lints
+  nothing — and zero findings against zero findings is a parity run that passes. The refusal is now
+  its own sentence, quoting what oxlint refused and naming the recipe: config A is the base commit's
+  corpus config against the base BUILD, never HEAD's config against an older one.
+- 3dac9a7: **One documented spelling (#90).** Every README of a package the metapackage fronts now names
+  `geonosis <tool>` — the door that pins the whole toolchain at one version — beside the bare bin, and
+  a `tooling/` test holds it. `#230`'s stamp test lands with it: every flag `docs/orchestration.md`'s
+  adoption loop names has to carry the version it first ships in, because the loop once told a
+  consumer to run a flag the published version did not have.
+
+## 2.2.0
+
+### Patch Changes
+
+- d15a654: **An envelope writer refuses a root it has been told is not its (#241).** A suite ran one over the
+  SHARED repo root mid-run: parallel suites made the comparison racy, and the file it left behind is
+  one the next run reads as real. Every one of the seven writer copies now refuses to write when
+  `GEONOSIS_ENVELOPES_FORBIDDEN_ROOT` names the root it was pointed at, saying so and pointing at a
+  scratch root instead. The kit's own vitest config sets it to the repo root, so a test that writes an
+  envelope there names itself — which is how the offender that filed this row was found again.
+
+## 2.1.0
+
+## 2.0.0
+
+## 1.4.0
+
+### Minor Changes
+
+- c712f3d: **A parity run now says which files both configs actually opened.** `filesLintedBy` asks oxlint itself, through `--debug=files`, and `fileCensus` splits the tree three ways; `geonosis-lint-parity` writes `.geonosis/envelopes/lint-parity.json` where `read` is the files BOTH configs read — the only population a findings diff means anything over — and a file one side ignores is `excused`, named with the side that ignored it. "B reported everything A did" over a tree B half-ignored has been the shape of an adoption proof that proved nothing. The census argv deliberately mirrors the lint argv, because oxlint's ignore resolution is sensitive to it: a config named through a symlinked prefix applies none of its own `ignorePatterns`.
+
+## 1.3.0
+
+### Patch Changes
+
+- 0a7673c: **`geonosis-lint-parity --print-config-shape` (#75).** It reads no configuration file: the two
+  `.oxlintrc.json` files it compares are named with `--a` and `--b`, and it reads them as oxlint does.
+- 228566f: **The doctor reads the options oxlint RESOLVES, not the base object beside them (#102).** A
+  config's `rules` block is only its first layer. An `overrides[]` entry naming a rule again replaces
+  its options for the files its globs claim — and dielime declares two of its three Medusa provider
+  registries exactly there, because that is where oxlint reads them. The rule resolved it correctly.
+  `drift` read `rules` alone and reported two working fulfillment carriers as directories the base
+  registry "never names": one config, two answers, from the tool whose whole subject is gates that
+  disagree with what they claim to measure.
+  
+  Every reader that consumes a rule's configuration now takes base + matching overrides, resolved the
+  way oxlint resolves them — **measured** against oxlint 1.80, not assumed: an override REPLACES the
+  base's options for its files rather than merging into them, and the last of several matching
+  overrides wins outright.
+  
+  - `drift`'s plugin-directory check asks each directory which layer governs it and checks it against
+    THAT layer's registry and manifests, so a repo with several registries gets a line per registry.
+  - `exercised` counts a rule an overrides entry enables — it read "no rule of this plugin is enabled
+    here" before, a SKIP from the check whose thesis is that an invisible check reads as a passing one
+    — and builds a probe from every configuration the repo gives a rule, not only the first.
+  - `@geonosis/lint-parity`'s `rulesNamedBy` reads overrides too: a rule configured only there fired
+    in the reach run and had no row in the report about which rules reach anything.
+  
+  A layer's options are only half of what it resolves; the other half is which FILES it governs. A
+  probe built from an override's options and written where the RULE looks is a probe for a
+  configuration that will not run on it — during.day scopes `no-raw-html-atoms` to its compound and
+  cell folders, and the probe lands nowhere near them. When no layer enabling a rule claims where its
+  probe lands, the question was not ASKED: UNJUDGED, naming the globs, never a FAIL against a repo
+  enforcing the rule on every file it means to.
+  
+  Measured read-only. dielime: `2 directory(ies) it never names` becomes five OK lines, one per
+  registry, and nothing else in the run moves. during.day: the rules it enables only in `overrides[]`
+  were invisible to this check and are now counted — two configs move from silence to UNJUDGED, which
+  is what "we could not tell" has always meant here, and neither passes.
+
+## 1.2.0
+
+## 1.1.0
+
+## 1.0.1
+
+### Patch Changes
+
+- 1c2ee0b: **Every package ships its declarations and says where they are.** `@geonosis/visual-diff` and
+  `@geonosis/verify` emitted no `.d.ts` at all (TS7016 in a consumer: the comparator every visual test
+  calls became `any` at the one seam that decides whether a screenshot regressed), and no package
+  declared `types` — the nineteen that worked did so through the sibling-file fallback, which ends the
+  day `exports` gains a condition. Every export now carries a `types` condition beside `default`, every
+  manifest a `types` field, and `tooling/types.test.ts` holds all twenty-one to it after the build.
+  
+  `geonosis-verify-arch` prints a check once when its label is its id ("direction, orphan", not
+  "direction direction").
+
+## 1.0.0
+
+### Major Changes
+
+- c575f44: Five counters, `tolerance`, and a baseline rewrite that only ever goes down.
+  
+  - `disabledCiJobs` — lines of `if: false` across the workflow files (`dir`). A job switched off to
+    get a release through is debt exactly like a lint error: invisible, because the pipeline goes
+    green. A condition that merely mentions `false` is not one, and a repo with no workflows
+    directory reads 0 rather than refusing; a workflow that is there and cannot be read refuses.
+  - `bundleBytes` — one integer out of whatever the repo's sizing command printed (`command`,
+    `match`), separators and all. With `match` it takes the group that pattern names and refuses when
+    it matches nothing, rather than falling back to any integer and reporting the wrong number as
+    confidently as the right one.
+  - `fastTierMs` — `finishedAt − startedAt` from the gate report `geonosis-verify` wrote (`report`,
+    `tier`). It refuses a report of another tier: the full tier takes minutes, and timing it against
+    the fast tier's baseline would report a regression of the wrong thing.
+  - `testsWithoutRunner` — workspaces holding tests with no `test` script. Unmeasured and passing are
+    indistinguishable from outside, so the count of unmeasured things has to be a number of its own.
+  - `packagesWithoutTypecheck` — workspaces with no `typecheck` script (`script`).
+  
+  `tolerance` is new on the verdict: the fraction of the baseline a number may drift UP before the
+  ratchet calls it growth. Bytes and milliseconds move on a dependency patch nobody chose, and a gate
+  that fails on +40 bytes is a gate that gets switched off. It forgives noise upward only — a shrink
+  of any size still lowers the baseline — and a `tolerance` that is not a non-negative number stops
+  the run naming the entry, because one that silently became `NaN` reads exactly like a counter that
+  can never grow.
+  
+  **Fix:** a baseline rewrite now lowers only the numbers that SHRANK. Writing every measured key back
+  was a harmless no-op while `held` implied `now === baseline`. Tolerance breaks that implication, and
+  the blanket rewrite would have laundered growth-within-tolerance into the new floor on the first
+  unrelated win — a baseline going up on a pass.
+  
+  `examples/dielime.ratchet.json` is dielime's Phase 3 config: 36 keys, one `testFailures` entry per
+  workspace. It keeps `--format=unix` and `expectFormat` on the two oxlint counters, which dielime's
+  own config drops — the summary cross-check can tell a misparse from a clean run only when the run
+  printed a summary, and a warnings-only run in an unreadable shape prints one that says nothing
+  about errors. Pinning the format is what closes that window.
+- c418f91: The `geonosis` Claude Code plugin — the method as enforcement rather than advice.
+  
+  `plugin/` ships five hooks, Node ≥ 22, zero dependencies, every tool resolved from the CONSUMER's
+  `node_modules/.bin` so a repo that has not adopted a tool is never blocked on a tool it lacks:
+  
+  - **SessionStart** runs `geonosis-doctor` if it is installed and prints a one-line digest of
+    `.oxlintrc.json` — which plugins are loaded, how many architecture rules are at `error`. It never
+    fails a session.
+  - **PreToolUse / Bash** refuses `prettier` (law 4) and `--no-verify` (law 7), and hands a
+    `git commit` to `geonosis-ledger` — the message its `-m` flags compose, and whether the staged
+    diff delivers anything but comments. The detectors are the ledger's, never reimplemented here; a
+    repo without it gets a note and no opinion.
+  - **PreToolUse / Edit|Write|MultiEdit** refuses a write that ADDS `eslint-disable`,
+    `oxlint-disable`, `@ts-ignore` or `@ts-expect-error` (law 3), any write to `gate-baseline.json` or
+    under `.geonosis/` (D-007 — the scored agent never writes the scoreboard), and a lint config that
+    sets a rule to `"warn"`, `"off"`, `0` or `1` (law 2). It reads what the call would ADD, never what
+    it removes, so the edit that DELETES a suppression is not refused by the guard against them.
+  - **PostToolUse / Edit|Write** runs oxfmt on the file just written. It never blocks.
+  - **Stop** runs `geonosis-verify fast` and will not let the turn end on a red one, capped at five
+    blocks per session — an agent retrying the same broken thing five times has a problem it will not
+    solve on the sixth, so the sixth prints the report and lets go.
+  
+  `.claude-plugin/marketplace.json` offers it from `./plugin`. `pnpm generate:skill` now writes the
+  plugin's copy of the mechanical skill, the engineer agent with the machine-specific path taken out,
+  and `plugin.json` carrying the kit's own version; staleness tests fail when any of the four drift.
+- 5f09ddc: Every hook is driven end to end, as Claude Code drives it.
+  
+  Each script is SPAWNED with real stdin JSON over a throwaway repo carrying a `geonosis.json`, a
+  `gate-baseline.json`, an `.oxlintrc.json` and a `node_modules/.bin` linked to the BUILT
+  `geonosis-verify` and `geonosis-ratchet`. A hook tested by calling its policy function proves the
+  policy; only a spawn proves the exit code, the JSON on stdout and the tool resolution — which is
+  the whole of what Claude Code actually reads.
+  
+  The Stop hook is exercised against a real fast tier that really goes red: a law file one line over
+  its baseline, so the ratchet grows and the hook blocks with exit 2, the failing step and its tail on
+  stderr. Then the sixth block prints the report and exits 0; a green run clears the session's count;
+  `stop_hook_active` short-circuits; and a repo with a BACKLOG that did not regress is not blocked at
+  all — which is the whole adoption argument, tested rather than asserted.
+  
+  The suite was falsified before it was trusted: making Stop exit 0 instead of 2, dropping the
+  delivery check, and raising the cap to 50 each turned exactly the tests that should have gone red,
+  red.
+- 89c6769: The ratchet's own layers are walled, and the walls have a door that is proved open.
+  
+  The three ratchet layers named FILE paths only, so `packages/ratchet/src/index.ts` — the published
+  entry — sat in no layer and could import anything, the CLI included, with lint green. It is
+  `ratchet-api` now, and the formatter it shares with the CLI has moved into a `ratchet-report` layer
+  of its own rather than being counted as part of the CLI it is not.
+  
+  The dogfood suite gains a second kind of plant. A wall that refused everything would be as useless
+  as one that refused nothing, so each layer's permitted import — `verify` reaching the lock through
+  `@geonosis/ratchet` — is planted and asserted to stay CLEAN. Without that, the next engineer widens
+  `mayImport` to get their work through and the wall goes with it.
+- b2d915f: **Fix:** a counter's command no longer loses what it wrote to stderr.
+  
+  `<command> 2>&1` binds the redirect to the LAST command of the string. `echo boom >&2; echo fine`
+  therefore merged nothing, and on a ZERO exit `execSync` hands back stdout alone — so a tool that
+  prints its findings to stderr and exits 0 read as a tool that found nothing. That is the exact shape
+  of a gate that has quietly stopped gating, and it is the one direction in which this kind of bug is
+  dangerous: the number comes back lower than the truth and the baseline banks it.
+  
+  On a NON-ZERO exit the line survived, because the failure path concatenates both captured buffers —
+  but concatenation put every stderr line after every stdout line, moving each diagnostic away from
+  the line it was about, which is what the evidence tail on a regression is for.
+  
+  The command now runs in a subshell, so the shell itself merges the streams in the order they were
+  written. Measured before and after: `echo boom >&2` on a zero exit read `""` and now reads `boom`;
+  `echo one; echo two >&2; echo three; exit 4` read `one three two` and now reads `one two three`.
+- 48bce0c: **Fix:** only a counter that measures a quantity accepts a `tolerance`.
+  
+  Any counter took one. `{"counter":"lawLineCount","tolerance":0.5}` over a two-line law with a
+  baseline of 2 printed `ratchet PASS` at three lines — a 50 % growth, waved through. The same edit is
+  `"tolerance": 100` on `oxlintErrors`: the gate switched off from the config file, with the run still
+  reporting green. That is law 2 — never downgrade a rule — wearing a friendlier name, and it was the
+  easiest edit in the repo to get past a reviewer.
+  
+  `Counter` gains `tolerates?: true`, declared only by `bundleBytes` and `fastTierMs`. Whether a
+  number is a measured quantity or a count of findings is the counter's to know, not the config's.
+  Anything else now stops the run, naming the entry:
+  
+  ```
+  geonosis-ratchet: "oxlintErrors" does not accept a tolerance — only a counter that measures a
+  quantity declares one
+  ```
+  
+  The plugin's write guard gains its first **ask**. A write to `geonosis.ratchet.json` that introduces
+  or raises a `"tolerance"` is neither refused nor allowed: it goes in front of the human as
+  `permissionDecision: "ask"`. Widening a band is legitimate and is not the agent's call — a band
+  somebody chose and a band somebody's agent chose are not the same thing. A tolerance carried through
+  an edit unchanged is not a change and says nothing.
+- 461233c: Docs for the two new things: `docs/plugin.md` and `packages/verify/README.md`.
+  
+  `docs/plugin.md` covers installing the plugin from a local path and from the remote once it is
+  pushed, what each of the five hooks does and the reason it does it that way, the five-block cap,
+  which files the runner owns and why the agent may not write them, what to put in `geonosis.json`,
+  and — the section every README skips — what the plugin CANNOT do. A `fast` tier of `["true"]` passes
+  for ever; only `geonosis-ratchet --prove` shows a counter can go red.
+  
+  `packages/verify/README.md` is the runner's own: `--prove` first, the config with no default tier,
+  the three exit codes and why a report that could not be written is exit 2, the report shape with the
+  `<tier>/<n>` id rule, and `--exclusive`.
+  
+  `docs/README.md` indexes both. The ratchet README gains rows for the five new counters, a section on
+  `tolerance` and the shrank-only rewrite it forces, and the landmine that cost an afternoon: a
+  loader or shim named RELATIVELY in a counter's command resolves to nothing under `--prove`, whose
+  probes run in a scratch directory. Write it `$PWD/…` and it works in both.
+- e48501b: `@geonosis/verify` — one gate runner, with a report a hook can read.
+  
+  `geonosis-verify <tier>` runs the shell steps a repo declared under `verify` in `geonosis.json`,
+  serially, stopping at the first red, and writes `.geonosis/gate-report.json`:
+  `{ tier, startedAt, finishedAt, ok, steps: [{ id, command, ok, exitCode, ms, tail, skipped? }] }`.
+  A step whose text is another tier's name is that tier, inlined in place; the inlined steps keep the
+  tier that declared them, so `fast/2` is the same command whether the operator ran `fast` or ran the
+  `full` tier that inlines it.
+  
+  There is no default tier and there never will be one: no config, no `verify` object, or an unknown
+  tier is refused by name with exit 2, and so is a green run whose report could not be written — a
+  gate that cannot record has not passed. A failed step is exit 1.
+  
+  `--exclusive` takes the ratchet's machine-wide lock through `@geonosis/ratchet`'s published entry
+  (`--exclusive-timeout <seconds>` bounds the wait), so a verify and a ratchet on one laptop serialise
+  against each other rather than each against itself. `--prove` plants a tier with one passing step
+  and one that exits 3, runs the real binary over it in a temp directory, and checks the failure
+  reached the report — a runner that reports green is worth nothing until it has been watched going
+  red on purpose.
+  
+  The kit walls the new package with its own `layer-walls` rule: `verify` may import `ratchet-api`
+  and nothing behind it, planted against in the dogfood suite like the other walls.
+
+## 0.6.0
+
+### Minor Changes
+
+- e446760: **New package `@geonosis/doctor` (bin `geonosis-doctor`).** Four questions a version bump is not
+  finished until something has asked. Each one is a way enforcement has reported green while measuring
+  nothing, in a real repo, for weeks.
+  
+  - **`loaded` — declared ≠ loaded.** oxlint resolves a `jsPlugins` specifier from the CONFIG FILE's
+    directory, so a nested `apps/<ws>/node_modules/@scope/plugin` left behind by a per-workspace
+    install runs while every manifest and the lockfile say a different version. One consumer measured
+    a whole bug report against 0.3.0 on a repo pinned to 0.4.0. For every config in the tree naming a
+    `@geonosis/*` plugin, this resolves it from that config's own directory, imports it, reads
+    `meta.version`, and compares it to the version the nearest manifest declares — then lists every
+    copy **resolution** reaches, one question per workspace. Never a `find`: on pnpm the store keeps
+    every version ever installed, so counting directories answers 7 on a correct tree. A declared
+    range it cannot read is a FAIL, not a pass.
+  - **`exercised` — enabled ≠ exercised.** Every rule a config enables, run against the corpus the
+    loaded plugin ships, under that config's own options — because the options are usually where the
+    reach went. Reuses `@geonosis/lint-parity`'s `corpusOf`; a plugin shipping no corpus is a SKIP.
+  - **`baseline` — a number that may only shrink, against another ref.** A ratchet lowers its own
+    baseline when a number shrinks, so nothing inside one checkout can see a branch raise one back up.
+    `--baseline-against [ref]` compares `gate-baseline.json` at HEAD with the same file at a ref. It
+    is OFF unless asked for by name: it is the only check that runs git, and this tool gets pointed at
+    repos other people are working in.
+  - **`runner` — an exit code is not a verdict.** Workspaces whose `test` script runs vitest or
+    `bun test` without asking for a JSON report, and which no `testFailures` counter in report mode
+    covers. `@cloudflare/vitest-pool-workers` exited 0 over suites it had just reported as failing.
+  
+  `--strict` promotes every WARN to a FAIL; `--json` prints the whole report for CI. Exits 1 on any
+  FAIL, 2 when the run could not be made at all.
+  
+  The package depends on `@geonosis/lint-parity` and on **nothing from the rule plugin** — it asks
+  which plugin a config loads, and a copy in its own dependency tree would be one more copy for the
+  question to be wrong about. A `layer-walls` layer named `doctor` in the kit's own config holds that
+  wall, planted against in `dogfood.test.ts`.
+  
+  **`@geonosis/lint-parity` exports `resolveOxlint(from)`** — the consumer's own oxlint, walking up
+  from a directory. It was already the answer the CLI needed; it is now the answer every tool that
+  spawns oxlint shares, rather than each keeping its own.
+  
+  **Measured, and worth knowing before writing anything that reads oxlint's output:** on oxlint 1.80 a
+  JS plugin rule that throws from `create()` is reported ONCE PER FILE, and `--format=unix` renders
+  each of those as `:0:0:  [Warning]` — no path, no rule id, no sentence. The reason survives only in
+  the default formatter. `geonosis-doctor` therefore asks a second time, over one trivial file, in the
+  format that answers. No rule changed in this release.
+
+## 0.5.0
+
+### Minor Changes
+
+- **New rule `cell-no-cross-feature-organelles` (preset `frontend`).** `organelle-dependency` is scoped
+  to `organelles/` and `no-cross-feature-stores` only judges stores, so a CELL importing another
+  feature's ORGANELLE passed both while both stayed green. Option `sharedFeatures`, default
+  `['shared']` — the same option and the same default as `organelle-dependency`'s, because the two
+  rules draw one boundary from two sides. Measured on a consumer: three findings in two files.
+  
+  **The corpus carries both spellings of every direction rule.** A direction rule judges where an
+  import lands, so `@/features/billing/x` and `../../billing/x` are one breach; the corpus previously
+  carried whichever spelling each rule's author happened to write. Fifteen fixtures added. No rule
+  changed.
+  
+  **`geonosis-lint-parity --corpus --expect-changed <rule,…>`.** A changelog line that names a rule is
+  a claim; this makes it data the corpus judges, and exits 1 on a claim the corpus is silent about or a
+  change nobody claimed. Mandatory for any release whose notes name a rule.
+  
+  **`testFailures` reads the runner's JSON report** with `report: "vitest-json"`, refusing when the
+  report is absent, unparsable, missing `numFailedTests`, or says `success: false` while naming none.
+  `Counter.probe` takes a list, so `--prove` proves each reading mode by name.
+  
+  **`geonosis-ratchet --prove` proves the lock**, by running two children of the CLI over a slow
+  `--hold` and requiring the second to start after the first finished.
+  
+  `@geonosis/ratchet`'s source is layered — `core/`, `counters/`, `report.ts`, `cli.ts` — with no
+  change to what `@geonosis/ratchet` exports or to a single line the CLI prints.
+
+## 0.4.0
+
+Version only — the three `@geonosis/*` packages move as one fixed group, and nothing in this package
+changed in 0.4.0. The release is the plugin's rule core and `@geonosis/ratchet`'s heavy lock.
+
+## 0.3.0
+
+## 0.2.1
+
+Version only — the three `@geonosis/*` packages move as one fixed group, and nothing in this
+package changed in 0.2.1. The release is `@geonosis/ratchet`'s: `--prove`, `--exclusive`, and
+`typecheckErrors` refusing on an unbuilt workspace.
+
+## 0.2.0
+
+### Minor Changes
+
+- Loose coupling, first slice — and a posture change that will break a config on purpose.
+  
+  **`@geonosis/lint-parity` is a new package.** Findings parity, rule reach, the corpus-manifest
+  contract and the `geonosis-lint-parity` bin now live on their own. The tool knows no rule name and
+  no plugin: two oxlint configs and a tree are the whole input, and a corpus arrives as a directory
+  whose own `manifest.json` says which rules it speaks for. A parity tool welded to one rule plugin
+  can only ever check that plugin.
+  
+  **BREAKING (plugin): the `geonosis-lint-parity` bin and the `./parity` export are gone.** Install
+  `@geonosis/lint-parity` and pass `--corpus node_modules/@geonosis/oxlint-plugin-biological-architecture/corpus`
+  — the plugin still ships the corpus, which is the part that is genuinely its own. `--corpus` now
+  requires its directory.
+  
+  **BREAKING (plugin): a rule enabled without the options it needs refuses the run.** `no-brand-names`,
+  `no-raw-html-atoms`, `documents-share-one-table`, `document-sagas-are-generic`,
+  `step-opens-its-own-cell` and `layer-walls` throw from `create()` naming the missing option, instead
+  of returning an empty visitor. A consumer that enabled one bare will fail lint until it configures
+  the rule or turns it off — which is the point: one consumer ran `no-raw-html-atoms` at "error" for
+  months with no element→atom map, over 136 raw elements, and the gate was green. An enabled rule that
+  cannot fire is indistinguishable from compliance. A rule nobody enabled still does nothing.
+  
+  **New rule `layer-walls`, new preset `tooling`.** A repo declares its own layers as data —
+  `{ name, paths, mayImport }` — and the rule enforces the direction between them: relative sources
+  resolved against the importing file first, `import()`, `require()` and both re-export forms visited,
+  externals not walls unless asked. The kit enables it on itself.
+  
+  The plugin also ships type declarations now, for all three entries.

package/bin/geonosis-lint-parity.mjs

@@ -17,11 +17,25 @@ const newest = (dir) =>
       }, 0)
     : 0
 const src = join(here, '..', 'src')
-if (existsSync(src) && newest(src) > newest(join(here, '..', 'dist'))) {
-  process.stderr.write(
-    'geonosis-lint-parity: dist is older than src — run pnpm build before trusting this bin.\n',
-  )
-  process.exit(2)
+const dist = join(here, '..', 'dist')
+// `newest` answers 0 for a directory that is NOT THERE and for one that is merely old, so the
+// two conditions were one comparison and one sentence — and the staleness sentence was printed
+// over trees that had never been built at all, blocking a turn in a fresh git worktree, which
+// has no dist because dist is not committed (#357). Only the second is evidence of a mistake.
+if (existsSync(src)) {
+  const built = newest(dist)
+  if (built === 0) {
+    process.stderr.write(
+      'geonosis-lint-parity: this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.\n',
+    )
+    process.exit(2)
+  }
+  if (newest(src) > built) {
+    process.stderr.write(
+      'geonosis-lint-parity: dist is older than src — run pnpm build before trusting this bin.\n',
+    )
+    process.exit(2)
+  }
 }
 
 await import('../dist/parity-cli.js')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/lint-parity",
-  "version": "2.3.1",
+  "version": "2.4.3",
   "types": "./dist/index.d.ts",
   "description": "Findings parity and rule reach over any two oxlint configs — the diff a fork is deleted on.",
   "keywords": [
@@ -31,6 +31,7 @@
     }
   },
   "files": [
+    "CHANGELOG.md",
     "bin",
     "dist"
   ],
@@ -44,7 +45,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@geonosis/ratchet": "2.3.1"
+    "@geonosis/ratchet": "2.4.3"
   },
   "scripts": {
     "build": "tsup",