@ixo/domain.md 0.3.0

package/assets/rules.json

@@ -0,0 +1,275 @@
+{
+  "specVersion": "1.0.0-rc.3",
+  "rules": [
+    {
+      "code": "file-too-large",
+      "severity": "error",
+      "description": "Reject domain input that exceeds the configured byte limit before model construction."
+    },
+    {
+      "code": "encoding",
+      "severity": "error",
+      "description": "Require strict UTF-8 without a byte-order mark."
+    },
+    {
+      "code": "missing-frontmatter",
+      "severity": "error",
+      "description": "Require YAML frontmatter at the beginning of every domain.md."
+    },
+    {
+      "code": "frontmatter-fence",
+      "severity": "error",
+      "description": "Require exactly one valid frontmatter fence at the beginning of the document."
+    },
+    {
+      "code": "frontmatter-shape",
+      "severity": "error",
+      "description": "Require frontmatter to decode to a mapping."
+    },
+    {
+      "code": "unsafe-yaml",
+      "severity": "error",
+      "description": "Reject duplicate keys, aliases, anchors, custom tags, merge keys, and unsafe YAML limits."
+    },
+    {
+      "code": "schema",
+      "severity": "error",
+      "description": "Require frontmatter to satisfy the matching domain.md JSON Schema."
+    },
+    {
+      "code": "profile-mismatch",
+      "severity": "error",
+      "description": "Require an asserted profile to match the document profile."
+    },
+    {
+      "code": "template-placeholder",
+      "severity": "error",
+      "description": "Reject unresolved authoring or publication placeholders in conforming output."
+    },
+    {
+      "code": "secret-in-index",
+      "severity": "error",
+      "description": "Reject secret-bearing fields and private key material."
+    },
+    {
+      "code": "privacy-public-sensitive",
+      "severity": "error",
+      "description": "Reject public access for sensitive documents, resources, and services."
+    },
+    {
+      "code": "duplicate-entry-id",
+      "severity": "error",
+      "description": "Require controller, right, resource, flow, and transition identifiers to be unique."
+    },
+    {
+      "code": "duplicate-section",
+      "severity": "error",
+      "description": "Reject duplicate canonical Markdown sections."
+    },
+    {
+      "code": "missing-required-section",
+      "severity": "error",
+      "description": "Require every section declared by validation.required_sections."
+    },
+    {
+      "code": "section-order",
+      "severity": "warning",
+      "description": "Report canonical sections that appear out of order."
+    },
+    {
+      "code": "unknown-section",
+      "severity": "info",
+      "description": "Preserve and report unknown Markdown sections."
+    },
+    {
+      "code": "unknown-top-level-key",
+      "severity": "warning",
+      "description": "Report unknown non-extension frontmatter fields."
+    },
+    {
+      "code": "document-contract",
+      "severity": "error",
+      "description": "Enforce universal roles, manifest authority, disclosure, privacy, and profile identity rules."
+    },
+    {
+      "code": "constitution-required",
+      "severity": "error",
+      "description": "Require governed and agentic domains to declare a complete constitutional package."
+    },
+    {
+      "code": "constitutional-subject-profile-unresolved",
+      "severity": "error",
+      "description": "Require every domain to classify its subject and resolve each declared constitutional facet."
+    },
+    {
+      "code": "constitution-not-applicable-invalid",
+      "severity": "error",
+      "description": "Permit not_applicable only for passive domains without agent or executable governance."
+    },
+    {
+      "code": "constitutional-instrument-unresolved",
+      "severity": "error",
+      "description": "Require every constitutional instrument to resolve to a unique domain document entry."
+    },
+    {
+      "code": "constitutional-authority-unverified",
+      "severity": "error",
+      "description": "Require jurisdiction and authority evidence before legal effect may be marked verified."
+    },
+    {
+      "code": "constitutional-execution-incomplete",
+      "severity": "error",
+      "description": "Require executable governance implementations, tests, enforcement points, and fail-closed policy."
+    },
+    {
+      "code": "constitutional-ai-incomplete",
+      "severity": "error",
+      "description": "Require agentic domains to bind principles, procedures, agents, conflict policy, and an audit record."
+    },
+    {
+      "code": "constitution-conflicts-canonical",
+      "severity": "error",
+      "description": "Reject inconsistent effective periods or simultaneously canonical superseded instruments."
+    },
+    {
+      "code": "constitutional-amendment-unapproved",
+      "severity": "error",
+      "description": "Require amending instruments to resolve an amendment procedure and constitutional authority source."
+    },
+    {
+      "code": "broken-local-reference",
+      "severity": "error",
+      "description": "Require locally scoped controller, right, resource, claim, flow, and transition references to resolve."
+    },
+    {
+      "code": "source-authority",
+      "severity": "error",
+      "description": "Require fact-scoped authority sources to appear in the conflict-resolution order."
+    },
+    {
+      "code": "incomplete-claim-contract",
+      "severity": "error",
+      "description": "Require claim evidence, rubric, determination, review, and next-action contracts."
+    },
+    {
+      "code": "invalid-flow",
+      "severity": "error",
+      "description": "Require valid, reachable, right-gated flow transitions and review for consequential effects."
+    },
+    {
+      "code": "template-contract",
+      "severity": "error",
+      "description": "Require a pinned protocol, derived type, allowlisted path, parameter schema, and verified file identity."
+    },
+    {
+      "code": "integrity-mismatch",
+      "severity": "error",
+      "description": "Reject bytes that do not match their declared SHA-256 digest or CID."
+    },
+    {
+      "code": "network-policy",
+      "severity": "error",
+      "description": "Reject unsafe HTTPS or IPFS retrieval, redirects, credentials, and private network targets."
+    },
+    {
+      "code": "runtime-external-checks-required",
+      "severity": "info",
+      "description": "Identify checks that static validation cannot prove for anchored and runtime profiles."
+    },
+    {
+      "code": "capsule-file-too-large",
+      "severity": "error",
+      "description": "Reject an Oracle Capsule JSON document above the frozen byte budget."
+    },
+    {
+      "code": "capsule-encoding",
+      "severity": "error",
+      "description": "Require strict UTF-8 without a byte-order mark for capsule JSON."
+    },
+    {
+      "code": "capsule-json-syntax",
+      "severity": "error",
+      "description": "Require unambiguous JSON syntax before validation or hashing."
+    },
+    {
+      "code": "capsule-duplicate-key",
+      "severity": "error",
+      "description": "Reject duplicate JSON object names before model construction."
+    },
+    {
+      "code": "capsule-unicode",
+      "severity": "error",
+      "description": "Reject lone Unicode surrogate data that is not I-JSON compatible."
+    },
+    {
+      "code": "capsule-number",
+      "severity": "error",
+      "description": "Reject non-finite and non-interoperable unsafe integer values."
+    },
+    {
+      "code": "capsule-limit",
+      "severity": "error",
+      "description": "Enforce capsule depth, node, scalar, file-count and byte budgets."
+    },
+    {
+      "code": "capsule-schema",
+      "severity": "error",
+      "description": "Require the manifest and source lock to satisfy their frozen schemas."
+    },
+    {
+      "code": "capsule-cid",
+      "severity": "error",
+      "description": "Require CIDv1 raw sha2-256 content addresses."
+    },
+    {
+      "code": "capsule-integrity",
+      "severity": "error",
+      "description": "Reject disagreements among exact bytes, byte lengths, SHA-256 digests and CIDs."
+    },
+    {
+      "code": "capsule-uri-policy",
+      "severity": "error",
+      "description": "Reject invalid, credential-bearing, query-bearing or mutable artifact URI forms."
+    },
+    {
+      "code": "capsule-duplicate-id",
+      "severity": "error",
+      "description": "Require component, tool and capability request identifiers to be unique."
+    },
+    {
+      "code": "capsule-reference",
+      "severity": "error",
+      "description": "Require component dependencies and requested tool references to resolve locally."
+    },
+    {
+      "code": "capsule-dependency-cycle",
+      "severity": "error",
+      "description": "Reject cyclic component dependency graphs."
+    },
+    {
+      "code": "capsule-lock",
+      "severity": "error",
+      "description": "Require complete, exact and component-bound source locks."
+    },
+    {
+      "code": "capsule-duplicate-path",
+      "severity": "error",
+      "description": "Reject duplicate paths in source locks."
+    },
+    {
+      "code": "capsule-path-collision",
+      "severity": "error",
+      "description": "Reject locked paths that collide on case-insensitive portable hosts."
+    },
+    {
+      "code": "capsule-release-digest",
+      "severity": "error",
+      "description": "Require the declared release digest to match the RFC 8785 release projection."
+    },
+    {
+      "code": "capsule-canonicalization",
+      "severity": "error",
+      "description": "Reject values that cannot be serialized by the frozen RFC 8785 contract."
+    }
+  ]
+}