@gspothq/cli 0.0.0-stage → 0.1.0

package/configurations/general/engineering/rules/agent/TALKING.md

@@ -0,0 +1,3 @@
+# Talking
+
+When you talk, use ASD-STE100.

package/configurations/general/engineering/rules/agent/TASKS.md

@@ -0,0 +1,19 @@
+# Task Runner
+
+Rules for `mise` tasks, `package.json` scripts, `Makefile` targets, or the project's runner.
+
+## Task behavior
+
+- Reuse the task names the project has. Add a task only when asked.
+- Do not add empty section markers or scripts that only echo a placeholder.
+- When a step fails, the task stops and exits with an error.
+
+## Task organization
+
+<!-- level: all -->
+
+- Use one declared task runner per project.
+- Name tasks in kebab-case with a colon namespace, such as `check:fix` or `deploy:staging`.
+- Use the runner's declarative commands and dependency ordering. Keep substantial parsing,
+  branching, and process control in the code that implements that behavior.
+- Give each task a concise description in the runner's task list.

package/configurations/general/engineering/rules/agent/WORKING.md

@@ -0,0 +1,83 @@
+# Working in a Repository
+
+## Running processes
+
+Check for a running instance before you start a dev server, a build watcher, an emulator, or a
+database. Look at the port, the process list and the runner's output. Reuse what runs. Start a
+second instance only for a test that needs isolation, or when the user asks in this
+conversation. A framework that moves to the next free port hides the duplicate: two servers then
+serve different code. Stop what you started when the task ends.
+
+## Thinking before coding
+
+Read the relevant code before touching it. Understand the public interfaces, data flow,
+and how the modules work together. Then think through your approach:
+
+- Which change solves the problem correctly with the fewest steps?
+- Which failures can occur? What happens with bad input, missing data, concurrent access, network failures?
+- Does this change affect other parts of the system? Trace the call chain.
+
+When you rename or move a file, update every reference: imports, documentation, configuration, and scripts.
+
+Before adding a new module, directory, or helper, identify the module that implements
+the behavior. When you add a file, tell the user why that module needs it.
+
+## Scope discipline
+
+- Complete the requested task. Do not expand scope.
+- If you discover something unrelated that needs fixing, mention it to the user. Do not silently fix it unless the fix takes one small edit in a file you already edit.
+- Do not add features, refactor surrounding code, or make unrequested improvements.
+
+## Verification and tests
+
+A check reports what it finds as a finding, and `gspot explain <check>` describes the check.
+
+Do not run verification broader than the change. Run no full test suite, build, scan, or Docker
+check unless the user asks for it or the checks of the repository include it.
+
+Write tests when the user asks or a check requires them. When your change breaks a test, fix the
+test. Language and framework instructions say how to write a test, not when.
+
+## No defensive logic
+
+Do not add guards, fallbacks, retries, defaults, or wrappers for states the public interface rules
+out. Handle known failure modes where failures can occur: user input, network calls, persistence,
+permissions, and external services. Trust an internal invariant once the public interface establishes it. When an invariant lacks a clear promise, trace the code and clarify the promised behavior instead of adding speculative protection.
+
+## Abstractions
+
+<!-- level: all -->
+
+Keep one implementation for each concept in the module that implements it. Extract shared behavior only
+when real callers need the same behavior and the extraction removes complexity. Do not add
+forwarding wrappers, one-caller helpers, or abstractions for hypothetical reuse. Prefer local
+duplication when callers have different responsibilities. Remove abstractions whose cost exceeds their benefit.
+
+- An abstraction that gains flags, modes, optional branches, or caller-specific conditions needs a different design. Do not box loosely related behavior into one function with a parameter that
+  picks the behavior.
+- Inline a wrong abstraction into each caller, delete the branches each caller does not need,
+  and extract only the common behavior that remains.
+- You can prepare the code to support the requested change: first keep the
+  behavior, then change it, in separate commits.
+- Replace positional booleans and ambiguous arguments with an options parameter using named fields.
+- Pass a function in only when it replaces several option flags across real callers.
+- Prefer plain functions, data structures, and explicit data flow to classes, factories,
+  strategies, and inheritance. Push state and I/O outward, and keep the core close to pure.
+
+## No backward compatibility
+
+<!-- level: all -->
+
+Never introduce compatibility layers, wrapper functions, re-exports for renamed symbols, deprecated-but-kept code, or any other form of backward-compatible scaffolding. A published API follows the deprecation policy its project declares instead.
+
+When you replace or rename something:
+
+- Delete the old implementation entirely.
+- Update every call site to use the new version.
+
+## Structure
+
+<!-- level: all -->
+
+Group constants, types, and schemas by the behavior they belong to. Do not mirror the source
+tree in tests.

package/configurations/general/engineering/rules/code/ACCESSIBILITY.md

@@ -0,0 +1,32 @@
+# Accessibility
+
+## Structure
+
+- Use semantic elements and roles: headings in order, landmarks, lists for lists, tables for data,
+  native controls such as `button`, `a`, `input`, `select` before custom ones.
+- Every page has one `h1` and a document language.
+- Reading order matches visual order.
+
+## Names and descriptions
+
+- Every interactive control has an accessible name. An icon-only control gets a label attribute; a
+  form field gets a visible label; an image gets `alt` that states its purpose, or empty `alt` when
+  decorative.
+- Link each error and hint to its field with `aria-describedby` on the web or `accessibilityHint` on iOS.
+  Announce an error when it appears.
+- Do not convey meaning by color, position, shape, or icon alone. State it in text.
+
+## Keyboard and focus
+
+- Let keyboard users reach everything a pointer can reach, in a sensible order.
+- Show focus. Do not remove the focus indicator without replacing it.
+- Move focus deliberately: into a dialog when it opens, back to the trigger when it closes, to the
+  first error on failed submission, to the new content on route change.
+- No keyboard traps. Escape closes a dialog, menu, or popover and returns focus to its trigger.
+
+## Motion, size, and contrast
+
+- Honor the reduced-motion setting. No information depends on an animation.
+- Text scales with the user's size preference through Dynamic Type or browser zoom without clipping.
+- Tap and click targets meet the platform minimum size.
+- Text and essential graphics meet the platform contrast minimum in every theme.

package/configurations/general/engineering/rules/code/CLI.md

@@ -0,0 +1,37 @@
+# Command-Line Programs
+
+These rules apply to command-line programs the project ships for people or automation. Internal build tasks follow the task runner's interface.
+
+## Streams and exit status
+
+- Data goes to stdout. Diagnostics, progress, prompts, and errors go to stderr.
+- Preserve established exit codes. New commands use `0` on success, `1` on failure, and `2`
+  on usage error unless their protocol defines other behavior. List each exit code in `--help`.
+- Keep machine-readable `--json` output complete, stable, and free of progress text.
+- Omit color and terminal control sequences unless stdout connects to a terminal and `NO_COLOR` has no value.
+
+## Interface
+
+- `--help` prints usage, every flag with its default, and one example. `--version` prints the
+  version and exits.
+- Every value a prompt asks for also has a flag. If the process has no terminal, fail. Name the missing flag.
+- A destructive command asks for confirmation on a terminal and requires `--yes` otherwise.
+
+## Behavior
+
+- Validate every argument before doing any work. Fail with an actionable message that names the
+  argument.
+- Idempotent where the operation allows it: running twice produces the same state.
+- Long operations report progress on stderr and honor interruption: catch the termination signal,
+  clean up, exit with the signal's status.
+- Resolve a relative path against the directory the user ran the command in, or against an
+  explicit argument. Never resolve it against the script's own folder.
+- Create temporary files with the platform's secure call such as `mktemp`, `tempfile.mkstemp`, and
+  delete them on exit.
+
+## Flag naming
+
+<!-- level: all -->
+
+Use `--kebab-case` for flags. Boolean switches take no value; use `--no-flag` for negation.
+Preserve names defined by an existing public interface.

package/configurations/general/engineering/rules/code/COMMENTS.md

@@ -0,0 +1,38 @@
+# Comments
+
+## What a comment says
+
+<!-- level: all -->
+
+A comment explains why, not what, and describes the code in its current form.
+
+Bad: `# Removed the old cache loader.`
+Good: `# Reads cached responses from the configured cache directory.`
+
+A doc comment says what a function does, what its parameters mean, and what it returns.
+
+## When to comment
+
+<!-- level: all -->
+
+Write the doc comment that the language check asks for. Add other comments only when a function:
+
+- handles a failure that its public interface does not explain
+- has concurrency, cancellation, or isolation requirements
+- makes a security or privacy decision
+- encodes a domain invariant such as `idempotent` or `retry-safe`
+- sits on a hot path
+- takes more than ten seconds to understand from its signature and body
+
+## Keep comments true
+
+When you change a function, update its doc comment: summary, parameters, return value, and errors.
+Rewrite or delete a comment that describes behavior the code lacks, or the reason for a decision
+you undo.
+
+## Deferred work
+
+<!-- level: all -->
+
+Track unfinished work in the issue tracker. Do not leave `TODO`, `FIXME`, `XXX`, or `HACK` in
+comments. An issue link may explain an existing constraint, never promise a later implementation.

package/configurations/general/engineering/rules/code/CONFIGURATION.md

@@ -0,0 +1,25 @@
+# Configuration
+
+## Validate external values
+
+- A missing or invalid value stops startup. The message names the variable and never prints its
+  value.
+- Parse booleans from an explicit accepted set, numbers with bounds, URLs through the URL parser,
+  and lists with a declared separator. Treat an empty required value as missing.
+
+## Reading configuration
+
+<!-- level: all -->
+
+- Each process reads the environment in one module and passes the values in.
+- Parse each value once at startup and expose a typed, immutable configuration object.
+- Do not add a hierarchy or a generic configuration module for one value.
+
+## Configuration structure
+
+<!-- level: all -->
+
+- A configuration file imports no application code.
+- Defaults live in the schema that validates the file, not scattered through readers.
+- State one precedence order in the configuration module: command-line flag, environment variable, project file,
+  default. That module resolves it; readers never merge sources themselves.

package/configurations/general/engineering/rules/code/ERRORS.md

@@ -0,0 +1,49 @@
+# Errors
+
+## Error taxonomy
+
+- Return a typed result or throw a typed error for an expected operational failure. Invalid input, missing resources, denied permission, and provider timeouts need results the caller can act on.
+- Throw a programmer error for a broken invariant or impossible state. Log its stack and show a generic failure. Never catch it to keep going.
+- A startup failure fails fast before the process accepts work.
+- On shutdown, set readiness to false, stop accepting work, drain in-flight work for a bounded
+  time, close resources, and exit.
+- A fatal runtime error stops new work, reports the failure, and exits. Last-resort handlers never
+  keep serving.
+
+## Raising and catching
+
+- Catch the narrowest type. Never a bare catch-all unless the block re-raises or deliberately isolates an operation and records the failure.
+- Keep the try block around the one operation that can fail.
+- Preserve the cause when wrapping: `new Error(message, { cause })`, `raise ... from error`, `Error` conformance with an underlying error.
+- Do not swallow failures. Handle, record, or re-raise each caught error.
+- Run required cleanup in `finally` or the language's equivalent.
+
+## Error messages
+
+A developer tool may name the file, line, and setting that the user must fix. Keep unrelated
+private data out of every output.
+
+**Keep out of public service responses:**
+
+- Schema names, table names, column names, or function names.
+- Internal identifiers such as row IDs, user IDs, or session tokens.
+- Stack traces or file paths.
+- Raw upstream, provider, or database errors.
+- Implementation details such as trigger names, policy names, or internal state like "deleted" flags.
+
+**Always:**
+
+- Make messages actionable: tell the user what went wrong, not how the system works.
+- Put the failing value in its own field, not in the message text.
+- Keep message text stable so readers can search for it.
+
+## User-facing messages
+
+- Convert technical errors to user-facing messages in the code that displays them.
+
+## Message style
+
+<!-- level: all -->
+
+Use sentence case for error messages. Keep their tone and casing consistent across the repository.
+Preserve diagnostic text from external tools when callers depend on its exact form.

package/configurations/general/engineering/rules/code/HTTP.md

@@ -0,0 +1,46 @@
+# HTTP
+
+Rules for any HTTP service, whatever framework serves it, on top of the security, error, and
+logging rules.
+
+## Requests
+
+- Validate input once where the request enters the service, with a schema. Handlers read the
+  validated value, never the raw request.
+- Reject unsupported content types on endpoints that take a body. Limit the body size per route,
+  and keep the proxy's body limit equal to the application parser's.
+- Handlers adapt transport to domain calls. They define no validation policy, database access,
+  provider mechanics, caching, or business decision.
+- Middleware validates, authenticates, rate-limits, and attaches context, and makes no feature
+  decision.
+
+## Responses
+
+- One handler formats error responses. Feature code throws and never builds an HTTP error body.
+- Give clients generic, stable messages. Detail stays in server diagnostics.
+- The service documents one success shape and one error shape and keeps both stable.
+- Use precise status codes: 201 for creation, 204 with no body, 4xx for caller errors, and 5xx
+  only for failures the caller cannot fix.
+- The endpoint or module maps provider and database shapes into response shapes. Response
+  use API field names rather than storage names, unless the public interface explicitly uses the provider's format.
+- Escape HTML for its rendering context, and never pre-escape JSON field values.
+
+## Sessions and transport
+
+- Terminate TLS at the proxy, and trust forwarding headers only from that proxy.
+- When the service issues tokens, a revocation reaches every instance.
+
+## Wire names
+
+<!-- level: all -->
+
+- Keep existing protocol header names, and a new header carries no `X-` prefix, as
+  [Request for Comments (RFC) 6648](https://www.rfc-editor.org/rfc/rfc6648) recommends.
+
+## Operations
+
+- Keep health and readiness endpoints cheap. Call no provider from them.
+- Broad rate limits sit at the edge, application limits in middleware, and route limits beside
+  the route.
+- Either the proxy or the application compresses responses, not both. Under heavy traffic, the
+  reverse proxy compresses responses.

package/configurations/general/engineering/rules/code/LOGGING.md

@@ -0,0 +1,55 @@
+# Logging
+
+## One logger
+
+<!-- level: all -->
+
+- One logging module per process, configured at the entrypoint: level, format, redaction, transports.
+- Feature code obtains a logger from that module. It never instantiates, configures, or adds transports.
+- A service logs to stdout. Configure other transports at the logger.
+
+## Levels
+
+<!-- level: all -->
+
+- `debug`: noisy diagnostic detail, off in production.
+- `info`: normal lifecycle events and status.
+- `warn`: degraded, retryable, or unexpected but survivable conditions.
+- `error`: an operation failed and no caller recovered.
+- `fatal`: the process cannot go on and stops.
+- Do not add custom levels.
+
+## Structure
+
+- Write a stable, human-readable message string that describes the event. Values go in structured fields, never interpolated into the message.
+- Preserve declared event names and field keys. Before you rename one, tell the user because
+  dashboards and alerts may read it.
+- Include the request trace when the request provides one.
+- Use stable names for request IDs, correlation IDs, provider request IDs, operation IDs, resource IDs, and safe user IDs. Propagate them to provider calls when supported.
+- Put an error object in the field the logger serializes errors from, so the logger keeps the stack and cause.
+- Summarize: counts, IDs, statuses, provider names, durations. No large, deeply nested, or expensive-to-compute fields.
+- Do not compute expensive log arguments when the logger disables the level.
+
+### Field naming
+
+<!-- level: all -->
+
+Use `lower_snake_case` for new event names and field keys unless an existing logging interface defines their spelling.
+
+## Sensitive values
+
+Follow the secrets rules for values that must never reach logs.
+
+- Personal data, raw user content, full request or response bodies, provider payloads, database rows.
+
+Redaction lives in the logging module. When a new sensitive key can reach logs, update the redaction list; do not filter at one call site.
+
+```ts
+// Bad.
+logger.info({ headers: req.headers }, 'Incoming request');
+
+// Good.
+logger.info({ path: req.path, method: req.method, requestId }, 'Incoming request');
+```
+
+A logging test asserts the fields and redaction, not that the logger ran.

package/configurations/general/engineering/rules/code/TESTING.md

@@ -0,0 +1,58 @@
+# Testing
+
+Tests exist to catch bugs. A useful test fails when the behavior it covers breaks.
+
+## Assertions
+
+- Use Arrange, Act, Assert. Test behavior, not private implementation details.
+- Assert exact values that the public interface defines, such as status codes, exit codes, and
+  messages. Do not pin incidental configuration or internal representation.
+- Cover relevant empty and null inputs, limits, expected errors, and unexpected internal errors.
+- Assert every changed outcome: responses, stored rows, outbound requests, side effects, and logs.
+- A test has meaningful assertions; it does not merely prove that the code called a collaborator or
+  that a mock returns the value supplied to it.
+- Use snapshots only for stable data, and review every change to them.
+- Do not add test-only authentication bypasses, magic headers, or bypass routes.
+
+## Mocks
+
+- Mock only what leaves the process: network, filesystem, subprocesses, clock, and database.
+  Never mock the code under test or provider SDK internals.
+- Mock the module that talks to the network or database. Use dependency injection when the
+  code declares the dependencies. Replace that whole module rather than hiding selected behavior.
+- Keep mocks that affect the outcome in the arrange step. Reset or redefine shared mocks before
+  each test; do not use surprising global auto-mocks.
+- Restore environment variables, globals, fake timers, and spies changed by a test.
+
+## Placement and names
+
+<!-- level: all -->
+
+- Follow the framework or runner's test layout and keep one layout in each repository.
+- Put builders, fakes, servers, and database support in the declared test support folder, never
+  in `mocks/`, `helpers/`, or `utils/`. Support files contain no assertions or test blocks.
+- A test name states the scenario and expected outcome. Never use `test1`, `works`, `edge cases`,
+  or `happy path`. Group tests by unit, then scenario.
+- Prefer role and label queries. Use a test ID last; name it in camelCase for its control, such
+  as `submitButton`. Never put visible text, user data, or record IDs in it.
+
+## Test data
+
+- Each test creates its records directly or through an explicit builder. It does not depend on
+  execution order, mystery seed state, or a globally empty database.
+- Use fixed, descriptive names, emails, IDs, and references. Add a per-run suffix only for rows
+  in a shared database.
+- Do not share mutable IDs between tests or count unrelated data. Add unrelated records when a
+  test must prove that the code leaves them unchanged.
+- Use unique queue names, event IDs, operation IDs, or correlation IDs for event-driven tests.
+  Never purge shared queues or tables as a substitute for isolated data.
+- Do not use fixed sleeps. Use bounded polling, fake timers, or a signal that proves completion.
+
+## Network and providers
+
+- Block unexpected external HTTP calls. Allow only the local service under test unless the
+  suite explicitly opts into a real provider through an environment variable absent by default.
+- Assert outbound URLs, methods, safe headers, timeouts, and bodies. Never assert on secrets or
+  full sensitive payloads.
+- Where the module recovers, test timeouts, 5xx, 429, malformed JSON, missing fields, and rejected
+  promises. Fake responses fail when a payload lacks required fields.

package/configurations/general/files/manifest.toml

@@ -0,0 +1,141 @@
+allowed_words = ["JSON", "TOML", "YAML"]
+[configuration]
+title = "JSON, YAML, TOML, and XML files"
+always_selected = true
+description = "Checks JSON, YAML, TOML, XML, and related formats. Its tool files configure the tools that read these files."
+
+[files]
+extensions = [".json", ".jsonc", ".json5", ".yaml", ".yml", ".toml", ".xml"]
+
+[[tool]]
+name = "taplo"
+version = "0.10.0"
+min_version = "0.9.0"
+mise = "taplo"
+brew = "taplo"
+cargo = "taplo-cli"
+# No npm pin: the npm build of Taplo checks no file on Windows, so every platform takes the native release.
+github = { name = "tamasfe/taplo", version = "0.10.0" }
+[[tool.replace]]
+file = "taplo.toml"
+shared = false
+
+[[tool.replace]]
+file = ".taplo.toml"
+shared = false
+
+[[tool]]
+name = "yamllint"
+version = "1.38.0"
+mise = "pipx:yamllint"
+pypi = "yamllint"
+brew = "yamllint"
+[[tool.replace]]
+file = ".yamllint"
+shared = false
+
+[[tool.replace]]
+file = ".yamllint.yml"
+shared = false
+
+[[tool.replace]]
+file = ".yamllint.yaml"
+shared = false
+
+[[tool]]
+name = "v8r"
+requires = ["ajv"]
+version = "6.1.0"
+mise = "npm:v8r"
+npm = "v8r"
+
+# v8r imports this optional peer when it loads ajv-draft-04. Tool projects must install it.
+
+[[tool]]
+name = "ajv"
+kind = "library"
+version = "8.20.0"
+npm = "ajv"
+
+[[tool]]
+name = "xmllint"
+system = true
+brew = "libxml2"
+apt = "libxml2-utils"
+
+[[tool_file]]
+target = ".gspot/config/taplo.toml"
+tool = "taplo"
+
+[[tool_file]]
+target = ".gspot/config/yamllint.yml"
+tool = "yamllint"
+per_scope = true
+rule_keys = ["rules"]
+
+[[tool_file]]
+target = ".gspot/config/v8r.yml"
+tool = "v8r"
+
+[[check]]
+name = "taplo"
+example = "The TOML line `enabled =` lacks a value and reports a parse error. Use `enabled = true` when the setting is a boolean."
+level = "recommended"
+stage = "commit"
+command = ["taplo", "check", "--config", "{tool_file:taplo}", "--colors", "never", "{files}"]
+files = { extensions = [".toml"] }
+output = { format = "regex", pattern = "^\\s*┌─ (?<file>(?:[A-Za-z]:)?[^:]+):(?<line>\\d+):(?<column>\\d+)$", message = "The file does not parse as TOML." }
+summary = "Parses every TOML file with taplo; the schema check runs at push through v8r."
+why = "A TOML file that does not parse stops the tool that reads it at the worst moment."
+help = "Fix the line taplo names."
+
+[[check]]
+name = "taplo-format"
+example = "The TOML assignment `enabled=true` differs from the configured formatter output. Run the formatter to obtain `enabled = true` and rerun."
+level = "recommended"
+stage = "commit"
+command = ["taplo", "fmt", "--config", "{tool_file:taplo}", "--colors", "never", "--check", "--diff", "{files}"]
+fix = ["taplo", "fmt", "--config", "{tool_file:taplo}", "--colors", "never", "{files}"]
+files = { extensions = [".toml"] }
+output = { format = "regex", pattern = "^(?:--- a/(?<file>.+)|ERROR taplo:format_files: the file is not properly formatted path=\"(?<file>[^\"]+)\")$", message = "The file is not formatted with the configured TOML settings." }
+summary = "Checks that every TOML file is formatted the way taplo formats it with the shared settings."
+why = "One formatter keeps a diff about the values, not the spacing."
+help = "Run gspot check --fix."
+
+[[check]]
+name = "yamllint"
+example = "Two `enabled` keys in the same YAML mapping report a duplicate-key finding. Keep the one intended value and remove the duplicate."
+level = "recommended"
+stage = "commit"
+command = ["yamllint", "-c", "{tool_file:yamllint}", "-f", "parsable", "-s", "{files}"]
+files = { extensions = [".yaml", ".yml"] }
+output = { format = "regex", pattern = "^(?<file>[^:]+):(?<line>\\d+):(?<column>\\d+): \\[(?:error|warning)\\] (?<message>.*?)(?: \\((?<rule>[a-z-]+)\\))?$" }
+summary = "Parses every YAML file and checks its indentation, keys, and values with yamllint."
+why = "A YAML file that parses to the wrong shape fails silently: a duplicated key wins, a stray tab changes the nesting."
+help = "Fix the line yamllint names, or set the rule's options with gspot set tools.yamllint.rules."
+
+[[check]]
+name = "v8r"
+example = "A governed JSON file with a string where its selected schema requires a boolean reports a schema mismatch. Replace the value with the intended boolean and rerun against the same schema."
+level = "recommended"
+stage = "push"
+needs = ["network"]
+command = ["v8r", "--output-format", "text", "{files}"]
+env = { V8R_CONFIG_FILE = "{tool_file:v8r}" }
+files = { extensions = [".json", ".jsonc", ".yaml", ".yml", ".toml"] }
+output = { format = "regex", pattern = "^(?<file>[^#\\s]+)#(?<message>.+)$" }
+summary = "Validates every tool file that has a known schema against it: package.json, tsconfig.json, mise, workflows and the rest of the SchemaStore catalog."
+why = "A key the schema refuses is a setting that never applies, and nobody finds out until the behavior it was meant to change does not change."
+help = "Fix the key v8r names, or map the file to its schema under tools.v8r.schema."
+
+[[check]]
+name = "xmllint"
+example = "The XML text `<settings><enabled>true</settings>` has mismatched tags. Close the child element as `<enabled>true</enabled>` before closing `settings`."
+level = "recommended"
+stage = "commit"
+command = ["xmllint", "--noout", "{files}"]
+files = { extensions = [".xml", ".storyboard", ".xib"] }
+output = { format = "regex", pattern = "^(?<file>[^:]+):(?<line>\\d+): (?<message>.*)$" }
+summary = "Parses every XML file with xmllint."
+why = "Malformed XML is refused by the reader at the worst moment."
+help = "Fix the line xmllint names."

package/configurations/general/files/rules/YAML.md

@@ -0,0 +1,19 @@
+# YAML
+
+Rules for every `.yml` and `.yaml` file.
+
+- Keep one document per file unless the consumer requires a stream.
+- Quote strings that YAML otherwise reinterprets: `yes`, `no`, `on`, `off`, `null`, `~`,
+  version numbers such as `1.10`, octal-looking values, and anything starting with `*`, `&`, `!`,
+  `%`, `@`, or a backtick.
+- Keep anchors and aliases inside one file. Name them for what they carry. No merge keys
+  across documents.
+- Long strings use a block scalar, `|` or `>`, rather than a quoted string with escapes.
+
+## Organization
+
+<!-- level: all -->
+
+- Order keys as the consumer documents, then alphabetically. Do not reorder keys in a file
+  you did not otherwise change.
+- Use `.yml` for GitHub workflows, `compose.yaml` for Compose, and `.yaml` elsewhere.