@joshuafolkken/kit 1.1514.0 → 1.1784.0

package/scripts/registry-migration/migrate.ts

@@ -1,292 +0,0 @@
-import { existsSync, rmSync, writeFileSync } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { file_reader } from '#scripts/lib/read-file'
-import { timed_fetch } from '#scripts/lib/timed-fetch'
-import { COMMAND_TIMEOUT_MS, INSTALL_TIMEOUT_MS } from '#scripts/lib/timeouts'
-import { execa } from 'execa'
-import { z } from 'zod'
-import { migrate_logic, type MigrationPlan } from './migrate-logic'
-import { user_npmrc } from './user-npmrc'
-
-const NPMRC = '.npmrc'
-const LOCKFILE = 'pnpm-lock.yaml'
-const WORKSPACE = 'pnpm-workspace.yaml'
-const PUBLIC_REGISTRY = 'https://registry.npmjs.org/'
-const SCOPE = '@joshuafolkken/'
-const manifest_schema = z.looseObject({
-	dependencies: z.record(z.string(), z.string()).optional(),
-	devDependencies: z.record(z.string(), z.string()).optional(),
-	optionalDependencies: z.record(z.string(), z.string()).optional(),
-	peerDependencies: z.record(z.string(), z.string()).optional(),
-})
-const version_schema = z.looseObject({
-	dist: z.looseObject({ integrity: z.string(), tarball: z.string() }),
-})
-
-function is_public_npm_url(value: string): boolean {
-	try {
-		const url = new URL(value)
-
-		return url.origin === 'https://registry.npmjs.org' && url.username === '' && url.password === ''
-	} catch {
-		return false
-	}
-}
-
-interface VersionCheck {
-	missing: ReadonlyArray<string>
-	integrities: ReadonlyMap<string, string>
-}
-
-async function probe_integrity(
-	name: string,
-	version: string,
-	probe_version: MigrationDependencies['fetch_version'],
-): Promise<string | undefined> {
-	if (!version) return undefined
-
-	return await probe_version(name, version)
-}
-
-interface MigrationDependencies {
-	fetch_version: (name: string, version: string) => Promise<string | undefined>
-	install: (cwd: string) => Promise<void>
-	effective_registry: (cwd: string) => Promise<string>
-	user_npmrc: string
-	environment: NodeJS.ProcessEnv
-}
-
-interface MigrationContext {
-	cwd: string
-	npmrc_path: string
-	lockfile_path: string
-	workspace_path: string
-	original_npmrc: string
-	original_lockfile: string
-	original_workspace: string
-	has_npmrc: boolean
-	has_lockfile: boolean
-	has_workspace: boolean
-	plan: MigrationPlan
-}
-
-function read_file(file_path: string): string {
-	return file_reader.read_file_or_empty(file_path)
-}
-
-function has_registry_override(environment: NodeJS.ProcessEnv): boolean {
-	return Object.keys(environment).some((key) =>
-		/^(?:npm|pnpm)_config_.*(?:joshuafolkken.*registry|userconfig)/iu.test(key),
-	)
-}
-
-function manifest_packages(content: string): ReadonlyArray<string> {
-	const manifest = manifest_schema.parse(JSON.parse(content))
-	const sections = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
-
-	return sections.flatMap((section) => {
-		const value: unknown = Reflect.get(manifest, section)
-		if (typeof value !== 'object' || value === null) return []
-
-		return Object.keys(value).filter((name) => name.startsWith(SCOPE))
-	})
-}
-
-function restore(context: MigrationContext): void {
-	if (context.has_npmrc) writeFileSync(context.npmrc_path, context.original_npmrc)
-	else rmSync(context.npmrc_path, { force: true })
-	writeFileSync(context.lockfile_path, context.original_lockfile)
-	if (context.has_workspace) writeFileSync(context.workspace_path, context.original_workspace)
-	else rmSync(context.workspace_path, { force: true })
-}
-
-async function verify_public_versions(
-	lockfile: string,
-	probe_version: MigrationDependencies['fetch_version'],
-): Promise<VersionCheck> {
-	const versions = migrate_logic.scoped_versions(lockfile)
-	// Each probe reads its own package, so they run together; the report keeps the lockfile's order.
-	const probed = await Promise.all(
-		versions.map(async ([name, version]) => await probe_integrity(name, version, probe_version)),
-	)
-	const missing: Array<string> = []
-	const integrities = new Map<string, string>()
-
-	for (const [index, [name, version]] of versions.entries()) {
-		const integrity = probed[index]
-		const id = `${name}@${version}`
-		if (integrity === undefined) missing.push(id)
-		else integrities.set(id, integrity)
-	}
-
-	return { missing, integrities }
-}
-
-function report_context(context: MigrationContext): void {
-	console.info(`Current registry and planned change: ${context.plan.change}`)
-	console.info(`Installed scoped packages: ${context.plan.packages.join(', ') || '(none)'}`)
-}
-
-function create_context(cwd: string, dependencies: MigrationDependencies): MigrationContext {
-	const npmrc_path = path.join(cwd, NPMRC)
-	const lockfile_path = path.join(cwd, LOCKFILE)
-	const workspace_path = path.join(cwd, WORKSPACE)
-	const original_npmrc = read_file(npmrc_path)
-	const original_lockfile = read_file(lockfile_path)
-	const original_workspace = read_file(workspace_path)
-	const plan = migrate_logic.plan(original_npmrc, dependencies.user_npmrc, original_lockfile)
-
-	return {
-		cwd,
-		npmrc_path,
-		lockfile_path,
-		workspace_path,
-		original_npmrc,
-		original_lockfile,
-		original_workspace,
-		plan,
-		has_npmrc: existsSync(npmrc_path),
-		has_lockfile: existsSync(lockfile_path),
-		has_workspace: existsSync(workspace_path),
-	}
-}
-
-function initial_block(
-	context: MigrationContext,
-	dependencies: MigrationDependencies,
-): string | undefined {
-	if (!context.has_lockfile) return 'No lockfile; run pnpm install before migrating.'
-	const manifest = manifest_packages(read_file(path.join(context.cwd, 'package.json')))
-	const missing_lock = manifest.filter((name) => !context.plan.packages.includes(name))
-	const blocked = [...context.plan.blocked, ...missing_lock]
-	if (!context.plan.packages.includes(`${SCOPE}kit`)) blocked.push('kit is absent from lockfile')
-	if (has_registry_override(dependencies.environment)) blocked.push('registry environment override')
-	if (blocked.length === 0) return undefined
-
-	return `Migration blocked: ${blocked.join(', ')}. Keep GitHub Packages until every package is available on npm.`
-}
-
-async function verify_resolution(
-	context: MigrationContext,
-	dependencies: MigrationDependencies,
-	integrities: ReadonlyMap<string, string>,
-): Promise<void> {
-	await dependencies.install(context.cwd)
-
-	if (read_file(context.workspace_path) !== context.original_workspace) {
-		throw new Error('pnpm changed pnpm-workspace.yaml outside the migration')
-	}
-
-	const actual = await dependencies.effective_registry(context.cwd)
-	if (!is_public_npm_url(actual)) throw new Error(`effective registry is ${actual}`)
-	const lockfile = read_file(context.lockfile_path)
-	const old_tarballs = migrate_logic.github_tarballs(lockfile)
-	if (old_tarballs.length > 0) throw new Error(`GitHub tarballs remain: ${old_tarballs.join(', ')}`)
-
-	if (migrate_logic.rewrite_scoped_lockfile(lockfile, integrities) !== lockfile) {
-		throw new Error('lockfile integrity does not match public npm')
-	}
-}
-
-async function apply(
-	context: MigrationContext,
-	dependencies: MigrationDependencies,
-	integrities: ReadonlyMap<string, string>,
-): Promise<string> {
-	try {
-		writeFileSync(context.npmrc_path, context.plan.content)
-		writeFileSync(
-			context.lockfile_path,
-			migrate_logic.rewrite_scoped_lockfile(context.original_lockfile, integrities),
-		)
-		await verify_resolution(context, dependencies, integrities)
-	} catch (error) {
-		restore(context)
-
-		return `Migration blocked; original settings restored: ${String(error)}`
-	}
-
-	return 'Migrated to public npm. The project registry and lockfile now resolve from npm.'
-}
-
-function is_already_migrated(
-	context: MigrationContext,
-	integrities: ReadonlyMap<string, string>,
-): boolean {
-	return (
-		context.plan.content === context.original_npmrc &&
-		migrate_logic.rewrite_scoped_lockfile(context.original_lockfile, integrities) ===
-			context.original_lockfile
-	)
-}
-
-async function migrate(cwd: string, dependencies: MigrationDependencies): Promise<string> {
-	const context = create_context(cwd, dependencies)
-
-	report_context(context)
-	const block = initial_block(context, dependencies)
-	if (block !== undefined) return block
-	const version_check = await verify_public_versions(
-		context.original_lockfile,
-		dependencies.fetch_version,
-	)
-
-	if (version_check.missing.length > 0) {
-		return `Migration blocked: unpublished on npm: ${version_check.missing.join(', ')}.`
-	}
-
-	if (is_already_migrated(context, version_check.integrities)) {
-		return 'Already using public npm; no changes made.'
-	}
-
-	return await apply(context, dependencies, version_check.integrities)
-}
-
-async function fetch_version(name: string, version: string): Promise<string | undefined> {
-	const encoded = encodeURIComponent(name)
-	const response = await timed_fetch(`${PUBLIC_REGISTRY}${encoded}/${encodeURIComponent(version)}`)
-
-	if (!response.ok) return undefined
-	const parsed = version_schema.safeParse(await response.json())
-	if (!parsed.success || !is_public_npm_url(parsed.data.dist.tarball)) return undefined
-
-	return parsed.data.dist.integrity
-}
-
-async function install(cwd: string): Promise<void> {
-	await execa('pnpm', ['install', '--lockfile-only', '--ignore-scripts', '--force'], {
-		cwd,
-		timeout: INSTALL_TIMEOUT_MS,
-	})
-}
-
-async function effective_registry(cwd: string): Promise<string> {
-	const result = await execa('pnpm', ['config', 'get', '@joshuafolkken:registry'], {
-		cwd,
-		timeout: COMMAND_TIMEOUT_MS,
-	})
-
-	return result.stdout.trim()
-}
-
-async function main(): Promise<void> {
-	const result = await migrate(process.cwd(), {
-		fetch_version,
-		install,
-		effective_registry,
-		user_npmrc: user_npmrc.read(),
-		environment: process.env,
-	})
-
-	console.info(result)
-
-	if (result.startsWith('Migration blocked') || result.startsWith('No lockfile')) process.exit(1)
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-const registry_migration = { migrate, install, effective_registry }
-
-export { registry_migration }
-export type { MigrationDependencies }

package/scripts/registry-migration/user-npmrc.ts

@@ -1,15 +0,0 @@
-import os from 'node:os'
-import path from 'node:path'
-import { file_reader } from '#scripts/lib/read-file'
-
-const NPMRC = '.npmrc'
-
-function read(home: string = os.homedir()): string {
-	const file = path.join(home, NPMRC)
-
-	return file_reader.read_file_or_empty(file)
-}
-
-const user_npmrc = { read }
-
-export { user_npmrc }

package/scripts/rules/rule-guard.ts

@@ -1,23 +0,0 @@
-#!/usr/bin/env tsx
-import { text } from 'node:stream/consumers'
-import { fileURLToPath } from 'node:url'
-import { hook_decision } from '#scripts/josh/hook-decision'
-import { delivered_rules } from './delivered-rules'
-
-// The hook entry point for trigger-delivered rules.
-//
-// **It is the same shape `batch-guard.ts` and `investigation-guard.ts` already have**, and
-// deliberately so: read the payload on stdin, ask the rule, write the one envelope Claude Code
-// understands. What differs is only that this one asks an *enumeration* rather than a single rule —
-// so the next rule that leaves residency costs one row in `delivered-rules.ts` and no new process,
-// no new settings entry and no new test file.
-
-const rule_delivery = delivered_rules.delivery
-const { is_enabled, SWITCH_ENV_KEY } = delivered_rules
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
-	if (process.stdin.isTTY) hook_decision.report_no_payload('rule:guard')
-	else hook_decision.write_decision(await text(process.stdin), rule_delivery)
-}
-
-export { is_enabled, rule_delivery, SWITCH_ENV_KEY }

package/scripts/rules/rule-registry-rows.ts

@@ -1,292 +0,0 @@
-// The `pnpm josh rule:guard` rows of the rule registry (`rule-registry.ts`), split out by size: the
-// human-readable side of each `delivered-rules.ts` row, keyed by the row's `id`.
-
-interface RegisteredRule {
-	id: string
-	title: string
-	// The single source of the rule's procedure.
-	topic: string
-	// The hook command that delivers it.
-	entry: string
-	fires: string
-	// The silent turn — it matches the state in which the rule is already kept.
-	quiet: string
-}
-
-const RULE_GUARD = 'pnpm josh rule:guard'
-const OPERATING_RULES = '`operating-rules.md`'
-const PRE_GATE_CUT = '`.claude/skills/workflow-commands/pre-gate-cut.md`'
-const SHELL_BODY = '`shell-body.md`'
-const BACKGROUND_COMMANDS = '`.claude/skills/workflow-commands/background-commands.md`'
-const BACKLOGRUN_LANES = '`.claude/skills/workflow-commands/backlogrun-lanes.md`'
-const GIT_RULES = '`CLAUDE.md` → Git Rules'
-
-const GUARD_ROWS: ReadonlyArray<RegisteredRule> = [
-	{
-		id: 'third-party-write',
-		title: 'Third-party write',
-		topic: '`upstream-interrupt.md`',
-		entry: RULE_GUARD,
-		fires:
-			'a `gh api` write (field flag or a write method) to a repository whose owner is not this session. Every occurrence',
-		quiet: 'a read, or a first-party owner (`pnpm josh repo:party`)',
-	},
-	{
-		id: 'direct-filing',
-		title: 'Direct filing',
-		topic: '`docs/josh-commands-backlog.md` → `josh issue:file`',
-		entry: RULE_GUARD,
-		fires:
-			'a `Bash` that creates an Issue outside `josh issue:file` (`gh issue create`, or a POST with `title` to `…/issues`); the refusal hands over the `pnpm josh issue:file` form. Every occurrence',
-		quiet:
-			'filing through `pnpm josh issue:file` — the duplicate scan, the body check and `epic:bundle` all run',
-	},
-	{
-		id: 'filing-cap',
-		title: 'The 10-Issue filing cap per run',
-		topic: '`.claude/skills/workflow-commands/prerequisite.md`, `observation-filing.md`',
-		entry: RULE_GUARD,
-		fires:
-			'the 11th `pnpm josh issue:file` in a run that already has 10 filings not refused; failed calls do not count. Every occurrence',
-		quiet: 'fewer than 10 filings not refused',
-	},
-	{
-		id: 'issue-comments',
-		title: 'Reading Issue comments',
-		topic: '`issue-comments.md`',
-		entry: RULE_GUARD,
-		fires:
-			'a `Bash` that reads only the Issue body (`gh issue view <N>`, or a GET ending in `…/issues/<N>`). Refused until it is re-read with the comments',
-		quiet:
-			'no Issue read, or a read with `--comments` / `--json comments` / `…/comments` from the start',
-	},
-	{
-		id: 'shell-body',
-		title: 'No body on the shell',
-		topic: SHELL_BODY,
-		entry: RULE_GUARD,
-		fires:
-			'a double-quoted body value (`-f body="…"` / `-f "body=…"` / `--body "…"` / `--notify-message "…"`) carrying a backtick or `$`',
-		quiet: 'the shell does not evaluate the body',
-	},
-	{
-		id: 'raw-field-body',
-		title: 'Posting `@path` literally',
-		topic: SHELL_BODY,
-		entry: RULE_GUARD,
-		fires: 'a raw field (`-f` / `--raw-field`) passing `body=@<path>`. Every occurrence',
-		quiet: '`-F` / `--field body=@`, a body without `@`, or `pnpm josh issue:comment`',
-	},
-	{
-		id: 'piped-verification',
-		title: 'Piped verification',
-		topic: '`output-bounds.md`',
-		entry: RULE_GUARD,
-		fires:
-			'a pass/fail josh check (`gate` / `check` / `lint*` / `cspell*` / `test*` / `eval` / `overrides` / `ranges`) in front of a pipe — rewritten under `set -o pipefail` when every filter is `tail` or a full-reading `grep`, refused otherwise',
-		quiet: 'the exit code reaches the caller — a failure reads as a failure',
-	},
-	{
-		id: 'early-heartbeat',
-		title: 'Early progress report',
-		topic:
-			'`.claude/skills/workflow-commands/progress-watcher.md` → "Progress while the run is quiet"',
-		entry: RULE_GUARD,
-		fires:
-			'a `Bash` whose only purpose is waiting (`sleep` alone, or `echo` / `:` / `date`) while a timer is live or before the interval. Every occurrence',
-		quiet: 'no hand-made wait timer — `run:progress` holds the one clock',
-	},
-	{
-		id: 'test-declared',
-		title: 'Test declaration',
-		topic: '`CLAUDE.md` → Code Change Rules',
-		entry: RULE_GUARD,
-		fires: '`pnpm josh git -y` (`josh g`) while `pnpm josh test:declared` answers `required`',
-		quiet: '`exempt` (non-runtime only) or `satisfied` (tests included)',
-	},
-	{
-		id: 'lane-background',
-		title: 'Lane child background push',
-		topic: BACKGROUND_COMMANDS,
-		entry: RULE_GUARD,
-		fires:
-			'a dispatched lane child backgrounding `josh gate` / `git` / `followup` / `ship`; it hands over `pnpm josh ship --detach`. Every occurrence',
-		quiet: 'not a lane child, or the foreground `ship --detach`',
-	},
-	{
-		id: 'run-tail',
-		title: 'Idle run tail',
-		topic: BACKGROUND_COMMANDS,
-		entry: RULE_GUARD,
-		fires:
-			'`pnpm josh git -y` (`josh g`, `--yes` alike) issued in the **foreground**. Every occurrence',
-		quiet: 'issued in the background — its completion resumes the run',
-	},
-	{
-		id: 'pre-gate-cut',
-		title: 'The cut before the gate',
-		topic: PRE_GATE_CUT,
-		entry: RULE_GUARD,
-		fires:
-			'`pnpm josh gate` (`josh ga`) in a lane work tree whose `JOSH_LANE_CHILD` names the Issue and has no cut record',
-		quiet: 'outside a lane, no marker (a person in the lane), or already cut',
-	},
-	{
-		id: 'lane-split-park',
-		title: 'A split is not a park',
-		topic: '`.claude/skills/workflow-commands/backlogrun-park.md` → "Splitting a child mid-run"',
-		entry: RULE_GUARD,
-		fires:
-			'a lane child that promoted its Issue to an epic this run parking it (`needs-decision`, `confirmation` notify). Every occurrence',
-		quiet: 'no promotion this run',
-	},
-	{
-		id: 'lane-park',
-		title: 'Lane child park',
-		topic: PRE_GATE_CUT,
-		entry: RULE_GUARD,
-		fires: 'a dispatched lane child issuing `pnpm josh notify --task-type confirmation`',
-		quiet: 'not a lane child, or not a stop notification',
-	},
-	{
-		id: 'lane-interactive-ask',
-		title: 'Lane child interactive ask',
-		topic: `${PRE_GATE_CUT} → "The interactive ask is refused one call earlier"`,
-		entry: RULE_GUARD,
-		fires:
-			"a dispatched lane child's `AskUserQuestion`; it hands over the park procedure. Every occurrence",
-		quiet: 'not a lane child, or not an interactive tool',
-	},
-	{
-		id: 'agent-model',
-		title: 'Subagent model named',
-		topic:
-			'`.claude/skills/workflow-commands/delegation.md` → "A `general-purpose` subagent names its model"',
-		entry: RULE_GUARD,
-		fires:
-			'an `Agent` / `Task` call of the `general-purpose` type with no `model`. Every occurrence',
-		quiet: 'a named agent type, or a `model` set',
-	},
-	{
-		id: 'lane-carry-conflict',
-		title: 'Lane child carry commands',
-		topic: BACKLOGRUN_LANES,
-		entry: RULE_GUARD,
-		fires: 'a dispatched lane child running `pnpm josh run:merge` / `run:carry`. Every occurrence',
-		quiet: 'not a lane child — the parent owns the run budget',
-	},
-	{
-		id: 'lane-switch-main',
-		title: 'Lane child on `git switch main`',
-		topic: BACKLOGRUN_LANES,
-		entry: RULE_GUARD,
-		fires:
-			'a dispatched lane child switching to the default branch or running `josh main:sync`. Every occurrence',
-		quiet: 'not a lane child — `pnpm josh main:merge` brings the default in at the gate',
-	},
-	{
-		id: 'josh-git-bare',
-		title: 'Bare `pnpm josh git`',
-		topic: GIT_RULES,
-		entry: RULE_GUARD,
-		fires:
-			'`pnpm josh git` without `-y`, whose staging prompt cancels with no TTY. Every occurrence',
-		quiet: '`pnpm josh git -y`',
-	},
-	{
-		id: 'git-force',
-		title: 'Force push / branch delete',
-		topic: OPERATING_RULES,
-		entry: RULE_GUARD,
-		fires:
-			'a `git push` / `git branch` read as force (`--force` / `-f` / `-uf` …) or delete (`--delete` / `-d` / `-D` / `:branch`) in any spelling. Every occurrence',
-		quiet: 'a plain `git push` / `git branch`',
-	},
-	{
-		id: 'worktree-mutation',
-		title: 'Unauthorized work-tree mutation',
-		topic: OPERATING_RULES,
-		entry: RULE_GUARD,
-		fires:
-			'`git checkout -- <path>` / `git restore <path>` / forced `git clean -f` / an unauthorized `git stash` (bare, push without a message, positional pop). Every occurrence',
-		quiet: '`git stash push -m`, `git stash list`, `pnpm josh git`, `pnpm josh stash:pop`',
-	},
-	{
-		id: 'file-body',
-		title: 'No file body on the shell',
-		topic: '`file-edits.md`',
-		entry: RULE_GUARD,
-		fires:
-			'a heredoc write to an existing file, a writing `node -e` / interpreter heredoc, or `perl -0pi -e`. Every occurrence',
-		quiet: 'a new file, a read-only heredoc, or a short `sed -i`',
-	},
-	{
-		id: 'index-mutation',
-		title: 'Index mutation',
-		topic: OPERATING_RULES,
-		entry: RULE_GUARD,
-		fires:
-			'`git add` / `commit` / `reset` / `rm` / `mv` / `restore --staged` in any spelling. Every occurrence',
-		quiet: '`pnpm josh git` — the approved commit flow',
-	},
-	{
-		id: 'destructive-command',
-		title: 'Destructive command',
-		topic: OPERATING_RULES,
-		entry: RULE_GUARD,
-		fires:
-			'`rm -rf` (any spelling), `gh repo delete` / `archive`, `gh pr close`, `gh api -X DELETE`. Every occurrence',
-		quiet: "`gh issue close` or removing an Issue label — the workflow's own steps",
-	},
-	{
-		id: 'protected-file',
-		title: 'Protected file',
-		topic: OPERATING_RULES,
-		entry: RULE_GUARD,
-		fires:
-			'a `Read` of `.env`, or an `Edit` / `Write` of `.claude/settings.json` outside kit. Every occurrence',
-		quiet: "kit itself, or the user's `~/.claude/settings.json`",
-	},
-	{
-		id: 'direct-pr-create',
-		title: 'Direct PR creation',
-		topic: GIT_RULES,
-		entry: RULE_GUARD,
-		fires:
-			'`gh pr create`, or a `gh api` write to `repos/<o>/<r>/pulls`; it points at `pnpm josh pr`. Every occurrence',
-		quiet: '`pnpm josh pr`, or reading a PR — the path that writes `closes #N`',
-	},
-	{
-		id: 'poll-loop',
-		title: 'Output poll loop',
-		topic: BACKGROUND_COMMANDS,
-		entry: RULE_GUARD,
-		fires:
-			"a hand-written `while` / `until` wait loop over a command's output, a marker file or a process. Every occurrence",
-		quiet: 'the command started with `run_in_background` — its exit ends the wait',
-	},
-	{
-		id: 'implementation-cut',
-		title: 'The implementation-phase cut',
-		topic: `${PRE_GATE_CUT} → "It is a guard, fired at the edit that crosses the threshold"`,
-		entry: RULE_GUARD,
-		fires:
-			'an `Edit` / `Write` by an uncut lane child whose recent context is over the `pnpm josh cost --cut` threshold; it hands over `pnpm josh run:cut --impl <N> --handoff <path>`. At each threshold crossing',
-		quiet: 'not a lane child, a non-editing tool, already cut, or under the threshold',
-	},
-	{
-		id: 'rule-body',
-		title: 'Question 0 and the ordering question before writing a rule into prose',
-		topic: '`residency.md`',
-		entry: RULE_GUARD,
-		fires:
-			'an `Edit` / `Write` to `CLAUDE.md` / `prompts/**/*.md` / `.claude/skills/**/*.md` appending at least the threshold. Refused until both `pnpm josh oracle:list` and `pnpm josh run:step` ran',
-		quiet:
-			'not a rule document, an append under the threshold (typo, link swap, deletion), or both commands ran',
-	},
-]
-
-const rule_registry_rows = { GUARD_ROWS, RULE_GUARD }
-
-export type { RegisteredRule }
-export { rule_registry_rows }