@mmerterden/multi-agent-pipeline 14.2.2 → 15.0.0

package/pipeline/skills/shared/external/ios-coding-standard/references/rules.yml

@@ -36,6 +36,31 @@ enforcement_kinds:
   judgement: requires a human or an audit run
 exception_marker: "// standard:exception(<RULE-ID>) <reason> <expiry:YYYY-MM-DD>"
 
+# ---------------------------------------------------------------------------
+# Roles  -  what the structure rules name instead of paths
+# ---------------------------------------------------------------------------
+# A structure rule never names a folder or a type; it names a role, and the module's overlay binds
+# that role to its own spelling. An UNBOUND role disables every rule that reads it, and the audit
+# reports that rather than guessing a shape. Substitutions available in a binding: {dir}, {stem}.
+roles:
+  screen.root: the directory that is one screen; everything else resolves relative to it
+  screen.entry: the file a coordinator or factory constructs to show the screen
+  screen.viewmodel: the type holding the screen's behaviour and service calls
+  screen.state: the type holding UI state, when the module separates it from the view model
+  screen.analytics: the screen's analytics surface
+  screen.factory: the seam another module calls to build the screen
+  screen.mapper: the wire-to-domain translation for the screen
+  service.dir: one directory per service operation, holding that operation's models
+  service.request: the request half of a service operation
+  service.response: the response half of a service operation
+  subview.view: an extracted view belonging to one screen
+  subview.configuration: the value type an extracted view renders
+  repository.live: the production implementation of a screen's data access
+  repository.mock: the scripted implementation previews and the debug menu use
+  shared.root: the module's cross-screen folder
+  source.root: the module's source tree, as the mirror rule's counterpart to the test tree
+  test.root: the module's test tree
+
 module_overlay_slots:
   description: >
     Some rules govern a CHOICE rather than a defect: two shapes are each internally coherent, the
@@ -48,6 +73,45 @@ module_overlay_slots:
     counter-example: a module with no copy surface has not chosen a different dialect, it is
     missing the surface, so that rule is not slotted.
   slots:
+    - id: ScreenLayerShape
+      governs: [STRUCT-02, STRUCT-03]
+      values:
+        layered: every screen carries the same layer folders, including the ones empty for it.
+        organic: a screen carries only the layers it actually has.
+      note: Decides whether "this screen has no data layer" is a finding or a fact.
+    - id: ServiceModelDir
+      governs: [STRUCT-09]
+      values:
+        under-data: the request/response pair sits in the data layer, beside the calling code.
+        under-mapper: the pair sits beside the mapper that translates it.
+    - id: ServiceModelPairing
+      governs: [STRUCT-09]
+      values:
+        both: every operation models a request and a response, even when the request is empty.
+        response-only: a request is modelled only when the call carries a body.
+    - id: ScreenAssemblyShape
+      governs: [STRUCT-10]
+      values:
+        per-screen-factory: each screen ships its own construction seam.
+        shared-factory: one factory per module builds every screen.
+    - id: UIStateHolder
+      governs: [STRUCT-11]
+      values:
+        separate-state-type: UI state lives in its own type beside the view model.
+        view-model-owned: the view model holds UI state directly.
+    - id: SubviewShape
+      governs: [READ-04b, STRUCT-12, STRUCT-13]
+      values:
+        folder-per-subview: each extracted view gets a folder holding it and its value type.
+        flat: extracted views sit loose in one folder, with no required companion.
+    - id: ScreenCompositionShape
+      governs: [STRUCT-07]
+      values:
+        extracted: a fragment of the screen becomes a named view beside it.
+        in-file: the entry file composes its own fragments.
+      note: >
+        Both keep the body readable, which is what STRUCT-07 protects. Counting view members on
+        entry files against extracted view files tells you which one the module chose.
     - id: ServiceNamingScheme
       governs: [SVC-07]
       values:
@@ -161,12 +225,16 @@ sensitive_data_classes:
       loggable: never
 
 rules:
-
   # ── READ  -  format & readability ───────────────────────────────────────────
   - id: READ-01
     title: MARK sections separate concerns  -  business rules, service calls, UI, one group each
     severity: important
-    enforcement: judgement
+    predicate: vocabulary
+    params:
+      vocabulary_key: SectionHeadings
+      declaration: '^\s*//\s*MARK:\s*-\s*(.+)$'
+      exempt_patterns: ['^[a-z][a-zA-Z0-9/{}.\- ]*$', '→', '↔']
+    enforcement: lint
     rationale: readability
     check: >
       A file mixing a service call, a business rule and a view fragment under one MARK (or none)
@@ -179,7 +247,7 @@ rules:
     title: Comments are clear statements; no AI or tool attribution anywhere
     severity: blocking
     enforcement: lint
-    mechanism: 'custom regex: (?i)(generated by|copilot|co-authored-by:.*(claude|anthropic|ai))'
+    mechanism: "custom regex: (?i)(generated by|copilot|co-authored-by:.*(claude|anthropic|ai))"
     rationale: readability
     check: >
       Trim a comment by deleting what the code already says, the design-frame archaeology and the
@@ -194,6 +262,9 @@ rules:
   - id: READ-03
     title: Size thresholds with carve-outs  -  screen 600 / file 400 / function 40 lines
     severity: important
+    predicate: file_size
+    params:
+      test_marker: /Tests/
     enforcement: lint
     mechanism: swiftlint file_length, function_body_length, type_body_length
     rationale: readability
@@ -228,7 +299,14 @@ rules:
   - id: READ-04b
     title: A view fragment that renders a thing is a component file with a preview
     severity: important
-    enforcement: judgement
+    predicate: sibling_required
+    params:
+      slot: SubviewShape
+      slot_value: folder-per-subview
+      subject_role: subview.view
+      strip_suffix_from_vocabulary: SubviewViewSuffix
+      append_suffix_from_vocabulary: SubviewConfigurationSuffix
+    enforcement: lint
     rationale: testability
     check: >
       A `private var x: some View` inside a scene is a component in disguise. If it renders a
@@ -316,6 +394,11 @@ rules:
   - id: READ-07
     title: Casing, boolean prefixes, guard-early / return-early
     severity: suggestion
+    predicate: naming_pattern
+    params:
+      glob: '**/*.swift'
+      declaration: '^\s+(?:@\w+\s+)?(?:private\(set\)\s+)?(?:public\s+)?var\s+([a-z]\w*)\s*:\s*Bool\b'
+      accept_from_vocabulary: BooleanPrefixes
     enforcement: lint
     mechanism: swiftlint identifier_name, type_name, cyclomatic_complexity
     rationale: readability
@@ -342,7 +425,12 @@ rules:
   - id: STRUCT-01
     title: One primary top-level type per file; nesting only for owned details
     severity: important
-    enforcement: judgement
+    predicate: naming_pattern
+    params:
+      glob: '**/*.swift'
+      declaration: '^(?:public\s+)?(?:final\s+)?(?:struct|class|enum|actor|protocol)\s+(\w+)'
+      match_file_stem: true
+    enforcement: lint
     rationale: readability
     check: >
       Forbidden nested: entity, domain model, request/response payload, list element. Allowed
@@ -358,7 +446,12 @@ rules:
   - id: STRUCT-02
     title: A screen is a known file manifest, not a pile
     severity: important
-    enforcement: judgement
+    predicate: dir_required_in_dir
+    params:
+      slot: ScreenLayerShape
+      slot_value: layered
+      vocabulary_key: LayerDirs
+    enforcement: lint
     rationale: readability
     check: >
       Scene, ViewModel, LocalizedText, CoordinatorEvent, AnalyticsTracking, UseCase, Repository
@@ -368,19 +461,30 @@ rules:
   - id: STRUCT-03
     title: Every screen sits at the same depth with the same internal grouping
     severity: important
-    enforcement: judgement
+    predicate: dir_required_in_dir
+    params:
+      vocabulary_key: PresentationDir
+    enforcement: lint
     rationale: readability
 
   - id: STRUCT-04
     title: Nothing lives outside the layout  -  no loose root type, no Utils/Helpers/Misc bucket
     severity: important
-    enforcement: judgement
+    predicate: naming_pattern
+    params:
+      glob: '**/*.swift'
+      declaration: '^(?:public\s+)?(?:final\s+)?(?:struct|class|enum|actor|protocol)\s+(\w+)'
+      reject_from_vocabulary: ForbiddenTypeSuffixes
+    enforcement: lint
     rationale: readability
 
   - id: STRUCT-05
     title: Type placement follows a consumer-count ladder
     severity: important
-    enforcement: judgement
+    predicate: prefix_collision
+    params:
+      subject_role: shared.root
+    enforcement: lint
     rationale: flexibility
     check: >
       2+ modules -> cross-module shared tier. 2+ screens -> module shared entities. One screen ->
@@ -499,7 +603,14 @@ rules:
   - id: STRUCT-07
     title: A scene is one type  -  no inner view struct wrapping it
     severity: important
-    enforcement: judgement
+    predicate: forbidden_member
+    params:
+      slot: ScreenCompositionShape
+      slot_value: extracted
+      subject_role: screen.entry
+      pattern: '^\s+(?:@ViewBuilder\s+)?(?:private\s+)?(?:var|func)\s+(\w+)[^\n]*?some View'
+      allow: [body]
+    enforcement: lint
     rationale: readability
     check: >
       `struct XScene: View { var body: some View { XView(viewModel: viewModel) } }` with the real
@@ -882,7 +993,7 @@ rules:
     title: Assets come from the app's own CDN
     severity: blocking
     enforcement: lint
-    mechanism: 'custom regex: https?:// host not on the app''s own domains, in a non-test source'
+    mechanism: "custom regex: https?:// host not on the app's own domains, in a non-test source"
     rationale: security
     check: >
       An image or asset URL pointing at a third-party host is a finding even when it renders
@@ -896,14 +1007,14 @@ rules:
     title: Escaping closures capture self weakly and unwrap immediately
     severity: important
     enforcement: lint
-    mechanism: 'custom regex: escaping closure body referencing self without a weak capture list'
+    mechanism: "custom regex: escaping closure body referencing self without a weak capture list"
     rationale: security
 
   - id: SAFE-02
     title: A calendar day sent to a service uses the shared calendar-day helper
     severity: blocking
     enforcement: lint
-    mechanism: 'custom regex: DateFormatter constructed in a mapper or repository path'
+    mechanism: "custom regex: DateFormatter constructed in a mapper or repository path"
     rationale: security
 
   # ── VIS  -  declaration & visibility ────────────────────────────────────────
@@ -938,7 +1049,19 @@ rules:
 
   # ── UI ────────────────────────────────────────────────────────────────────
   - id: UI-01
-    scope: { frameworks: [swiftui], paths: ["**/*View.swift", "**/*Screen.swift", "**/*Scene.swift", "**/*Cell.swift", "**/*Configuration.swift", "**/*+Modifiers.swift"] }
+    scope:
+      {
+        frameworks: [swiftui],
+        paths:
+          [
+            "**/*View.swift",
+            "**/*Screen.swift",
+            "**/*Scene.swift",
+            "**/*Cell.swift",
+            "**/*Configuration.swift",
+            "**/*+Modifiers.swift",
+          ],
+      }
     scope_reason: SwiftUI view composition  -  a UIKit view controller hierarchy expresses reuse differently
     title: A screen's composite view is never consumed by another screen
     severity: blocking
@@ -946,7 +1069,19 @@ rules:
     rationale: flexibility
 
   - id: UI-02
-    scope: { frameworks: [swiftui], paths: ["**/*View.swift", "**/*Screen.swift", "**/*Scene.swift", "**/*Cell.swift", "**/*Configuration.swift", "**/*+Modifiers.swift"] }
+    scope:
+      {
+        frameworks: [swiftui],
+        paths:
+          [
+            "**/*View.swift",
+            "**/*Screen.swift",
+            "**/*Scene.swift",
+            "**/*Cell.swift",
+            "**/*Configuration.swift",
+            "**/*+Modifiers.swift",
+          ],
+      }
     scope_reason: SwiftUI view construction
     title: No new component is added to a UI target the module marks as frozen
     severity: important
@@ -955,28 +1090,64 @@ rules:
     rationale: flexibility
 
   - id: UI-03
-    scope: { frameworks: [swiftui], paths: ["**/*View.swift", "**/*Screen.swift", "**/*Scene.swift", "**/*Cell.swift", "**/*Configuration.swift", "**/*+Modifiers.swift"] }
+    scope:
+      {
+        frameworks: [swiftui],
+        paths:
+          [
+            "**/*View.swift",
+            "**/*Screen.swift",
+            "**/*Scene.swift",
+            "**/*Cell.swift",
+            "**/*Configuration.swift",
+            "**/*+Modifiers.swift",
+          ],
+      }
     scope_reason: SwiftUI view construction
     title: Every screen with user actions has its analytics surface; no direct generated-event calls
     severity: important
-    enforcement: judgement
+    predicate: file_required_in_dir
+    params:
+      role: screen.analytics
+    enforcement: lint
     rationale: readability
 
   - id: UI-04
-    scope: { frameworks: [swiftui], paths: ["**/*View.swift", "**/*Screen.swift", "**/*Scene.swift", "**/*Cell.swift", "**/*Configuration.swift", "**/*+Modifiers.swift"] }
+    scope:
+      {
+        frameworks: [swiftui],
+        paths:
+          [
+            "**/*View.swift",
+            "**/*Screen.swift",
+            "**/*Scene.swift",
+            "**/*Cell.swift",
+            "**/*Configuration.swift",
+            "**/*+Modifiers.swift",
+          ],
+      }
     scope_reason: SwiftUI copy surface (LocalizedText); UIKit modules localise through a different seam
     title: All user copy goes through the screen's copy surface
     severity: important
-    enforcement: lint
-    mechanism: 'custom regex: raw localization key access inside Scene/ViewModel'
+    enforcement: judgement
+    mechanism: "custom regex: raw localization key access inside Scene/ViewModel"
     rationale: flexibility
 
   # ── MOD  -  modularity ──────────────────────────────────────────────────────
+    conflict: >
+      The module-structure pass that produced STRUCT-09..14 came from a folder-structure document
+      that says the opposite - copy is resolved AT THE RENDER SITE, and a per-screen copy type is
+      the finding. One module has already been refactored to that shape and now has zero copy
+      surfaces, which this rule reads as a violation on every screen. Two documents the same team
+      owns disagree; until one is retired, this rule is not mechanically enforced. Do not resolve
+      it by binding a slot: this registry's own slot doctrine names UI-04 as the counter-example -
+      a module with no copy surface has not chosen a dialect, it is missing the surface.
+
   - id: MOD-01
     title: A feature module never imports another feature module
     severity: blocking
     enforcement: lint
-    mechanism: 'custom regex per module: ^import (<sibling feature names>)'
+    mechanism: "custom regex per module: ^import (<sibling feature names>)"
     rationale: flexibility
     check: A feature that imports many siblings to compose them has promoted itself to a second composition root  -  highest severity in this section.
 
@@ -1050,7 +1221,7 @@ rules:
     title: One concurrency model  -  no GCD, semaphore or completion handler layered onto async
     severity: important
     enforcement: lint
-    mechanism: 'custom regex: DispatchQueue|DispatchSemaphore|DispatchGroup in async-adopted paths'
+    mechanism: "custom regex: DispatchQueue|DispatchSemaphore|DispatchGroup in async-adopted paths"
     rationale: readability
 
   - id: CONC-05
@@ -1115,6 +1286,10 @@ rules:
   - id: TEST-06
     title: Tests mirror the source tree across the module's declared layers
     severity: important
+    predicate: mirror_required
+    params:
+      test_role: test.root
+      source_role: source.root
     enforcement: scan
     rationale: testability
     metric: "screens with production logic and no mirrored test folder (target 0)"
@@ -1184,7 +1359,7 @@ rules:
     title: Feature flags are resolved at the boundary and carry a removal condition
     severity: important
     enforcement: lint
-    mechanism: 'custom regex: flag access inside a view body'
+    mechanism: "custom regex: flag access inside a view body"
     rationale: flexibility
 
   - id: FLEX-05
@@ -1353,7 +1528,7 @@ rules:
     title: Our own deprecations name a replacement and have a removal condition
     severity: important
     enforcement: lint
-    mechanism: 'custom regex: @available(*, deprecated) without a message:, and a deprecated declaration still referenced in-module'
+    mechanism: "custom regex: @available(*, deprecated) without a message:, and a deprecated declaration still referenced in-module"
     rationale: flexibility
     check: >
       A deprecation without a stated replacement is a complaint, not a migration. Every
@@ -1376,7 +1551,7 @@ rules:
     title: Availability gates below the deployment target are removed
     severity: suggestion
     enforcement: lint
-    mechanism: 'custom regex: @available / #available naming a version at or below the package deployment target'
+    mechanism: "custom regex: @available / #available naming a version at or below the package deployment target"
     rationale: readability
     check: >
       An `if #available(iOS 16)` in a module that already requires iOS 17 is dead branching a
@@ -1402,7 +1577,7 @@ rules:
     title: A TODO carries an owner or a ticket, and no FIXME survives a release
     severity: suggestion
     enforcement: lint
-    mechanism: 'custom regex: TODO or FIXME without a bracketed tag or ticket reference'
+    mechanism: "custom regex: TODO or FIXME without a bracketed tag or ticket reference"
     rationale: readability
     metric: "untagged TODO count (target 0), FIXME count (target 0)"
     check: >
@@ -1412,7 +1587,19 @@ rules:
 
   # ── A11Y ──────────────────────────────────────────────────────────────────
   - id: A11Y-01
-    scope: { frameworks: [swiftui], paths: ["**/*View.swift", "**/*Screen.swift", "**/*Scene.swift", "**/*Cell.swift", "**/*Configuration.swift", "**/*+Modifiers.swift"] }
+    scope:
+      {
+        frameworks: [swiftui],
+        paths:
+          [
+            "**/*View.swift",
+            "**/*Screen.swift",
+            "**/*Scene.swift",
+            "**/*Cell.swift",
+            "**/*Configuration.swift",
+            "**/*+Modifiers.swift",
+          ],
+      }
     scope_reason: SwiftUI accessibility modifiers
     title: An identifier from the shared source on every interactive element
     severity: important
@@ -1421,7 +1608,19 @@ rules:
     rationale: testability
 
   - id: A11Y-02
-    scope: { frameworks: [swiftui], paths: ["**/*View.swift", "**/*Screen.swift", "**/*Scene.swift", "**/*Cell.swift", "**/*Configuration.swift", "**/*+Modifiers.swift"] }
+    scope:
+      {
+        frameworks: [swiftui],
+        paths:
+          [
+            "**/*View.swift",
+            "**/*Screen.swift",
+            "**/*Scene.swift",
+            "**/*Cell.swift",
+            "**/*Configuration.swift",
+            "**/*+Modifiers.swift",
+          ],
+      }
     scope_reason: SwiftUI accessibility modifiers
     title: Localized VoiceOver label, plus a hint where the action is not obvious
     severity: important
@@ -1429,7 +1628,19 @@ rules:
     rationale: accessibility
 
   - id: A11Y-03
-    scope: { frameworks: [swiftui], paths: ["**/*View.swift", "**/*Screen.swift", "**/*Scene.swift", "**/*Cell.swift", "**/*Configuration.swift", "**/*+Modifiers.swift"] }
+    scope:
+      {
+        frameworks: [swiftui],
+        paths:
+          [
+            "**/*View.swift",
+            "**/*Screen.swift",
+            "**/*Scene.swift",
+            "**/*Cell.swift",
+            "**/*Configuration.swift",
+            "**/*+Modifiers.swift",
+          ],
+      }
     scope_reason: SwiftUI accessibility modifiers
     title: Minimum 44x44 tap target; grouped content exposes one meaningful element
     severity: important
@@ -1437,7 +1648,19 @@ rules:
     rationale: accessibility
 
   - id: A11Y-04
-    scope: { frameworks: [swiftui], paths: ["**/*View.swift", "**/*Screen.swift", "**/*Scene.swift", "**/*Cell.swift", "**/*Configuration.swift", "**/*+Modifiers.swift"] }
+    scope:
+      {
+        frameworks: [swiftui],
+        paths:
+          [
+            "**/*View.swift",
+            "**/*Screen.swift",
+            "**/*Scene.swift",
+            "**/*Cell.swift",
+            "**/*Configuration.swift",
+            "**/*+Modifiers.swift",
+          ],
+      }
     scope_reason: SwiftUI accessibility modifiers
     title: Dynamic Type does not break layout at the largest accessibility sizes
     severity: important
@@ -1446,7 +1669,19 @@ rules:
     check: No fixed-height container holding scalable text.
 
   - id: A11Y-05
-    scope: { frameworks: [swiftui], paths: ["**/*View.swift", "**/*Screen.swift", "**/*Scene.swift", "**/*Cell.swift", "**/*Configuration.swift", "**/*+Modifiers.swift"] }
+    scope:
+      {
+        frameworks: [swiftui],
+        paths:
+          [
+            "**/*View.swift",
+            "**/*Screen.swift",
+            "**/*Scene.swift",
+            "**/*Cell.swift",
+            "**/*Configuration.swift",
+            "**/*+Modifiers.swift",
+          ],
+      }
     scope_reason: SwiftUI accessibility modifiers
     title: RTL mirrors correctly; no leading/trailing hardcoded as left/right
     severity: important
@@ -1465,7 +1700,7 @@ rules:
     title: Lists and grids use lazy containers with stable identity
     severity: important
     enforcement: lint
-    mechanism: 'custom regex: ForEach over indices as identity; VStack over a large collection'
+    mechanism: "custom regex: ForEach over indices as identity; VStack over a large collection"
     rationale: performance
 
   - id: PERF-03
@@ -1478,5 +1713,105 @@ rules:
     title: No per-render construction of formatters, calendars or regexes
     severity: suggestion
     enforcement: lint
-    mechanism: 'custom regex: DateFormatter(|NumberFormatter(|Regex( inside a view body'
+    mechanism: "custom regex: DateFormatter(|NumberFormatter(|Regex( inside a view body"
     rationale: performance
+
+  # --- Tree, mechanically checked (added 0.2.0) ----------------------------
+  - id: STRUCT-09
+    title: A service operation's request and response live together, and neither travels alone
+    severity: important
+    enforcement: lint
+    predicate: pair_required_in_dir
+    params:
+      slot: ServiceModelDir
+      container_role: service.dir
+      left_role: service.request
+      right_role: service.response
+      pairing_slot: ServiceModelPairing
+      right_only_value: response-only
+    rationale: navigability
+    check: >
+      A directory holding one half of a service operation holds the other. A lone response means
+      the request is inlined somewhere a reader will not find it. Under `response-only` a lone
+      response is normal and only a lone request is the finding.
+
+  - id: STRUCT-10
+    title: A screen ships the construction seam its module's assembly shape declares
+    severity: important
+    enforcement: lint
+    predicate: file_required_in_dir
+    params:
+      slot: ScreenAssemblyShape
+      slot_value: per-screen-factory
+      role: screen.factory
+    applies_when: the module binds ScreenAssemblyShape to per-screen-factory. Otherwise DISABLED.
+    rationale: module boundaries
+    check: Under per-screen-factory each screen ships its own seam; under shared-factory the seam is one per module.
+
+  - id: STRUCT-11
+    title: UI state lives where the module decided it lives
+    severity: important
+    enforcement: lint
+    predicate: file_required_in_dir
+    params:
+      slot: UIStateHolder
+      slot_value: separate-state-type
+      role: screen.state
+      trigger_role: screen.viewmodel
+      trigger_pattern: '(FormField|\.Section\b|var\s+(is|selected|shows|expanded)\w*(Presented|Expanded|Sheet|Index|Visible|Selected|Shown)\b)'
+    rationale: testability
+    check: >
+      A screen with bound form objects or visual state, in a module that separated that state out,
+      carries the state type. A screen with neither is not missing anything.
+
+  - id: STRUCT-12
+    title: The value type an extracted view renders holds values, not behaviour
+    severity: blocking
+    enforcement: lint
+    predicate: forbidden_pattern
+    params:
+      slot: SubviewShape
+      slot_value: folder-per-subview
+      subject_role: subview.configuration
+      pattern: '^\s+(let|var)\s+\w+\s*:\s*(@escaping\s+)?\('
+    rationale: testability
+    check: >
+      A closure stored in the value type makes it non-comparable and drags the caller's lifetime
+      into it. Actions reach the view as its own parameters.
+
+  - id: STRUCT-13
+    title: An extracted view takes values, never the screen's view model
+    severity: blocking
+    enforcement: lint
+    predicate: forbidden_pattern
+    params:
+      slot: SubviewShape
+      subject_role: subview.view
+      pattern: '^\s+(let|var)\s+\w+\s*:\s*(any\s+)?\w*ViewModel\b'
+    rationale: testability
+    check: >
+      A view holding the view model can reach anything, so nothing about it can be asserted from
+      its inputs, and it cannot be previewed without constructing the whole screen.
+
+  - id: STRUCT-14
+    title: Fixture data lives with the fixtures, not inside the thing that serves it
+    severity: suggestion
+    enforcement: judgement
+    predicate: none
+    params: {}
+    rationale: readability
+    check: >
+      A scripted implementation that also carries its payload literals mixes which scenario to
+      answer with the content of the answer. The tool surfaces the size ratio; the split is a reading.
+
+  - id: NAME-07
+    title: A positional index carries the same label everywhere
+    severity: suggestion
+    enforcement: lint
+    predicate: naming_pattern
+    params:
+      glob: '**/*.swift'
+      declaration: '\((for|_)\s+(?:index|\w+Index)\s*:\s*Int'
+      accept_from_vocabulary: IndexLabel
+    rationale: readability
+    check: One spelling for "at this position" across the module; two make the call sites read as two concepts.

package/pipeline/skills/shared/external/ios-coding-standard/references/swiftlint.draft.yml

@@ -109,7 +109,6 @@ missing_docs:
   excludes_trivial_init: true
 
 custom_rules:
-
   # ── SEC ─────────────────────────────────────────────────────────────────
   sec_01_no_plaintext_persistence:
     name: "SEC-01 sensitive value in unprotected storage"
@@ -301,7 +300,7 @@ custom_rules:
   # ── READ / SAFE ─────────────────────────────────────────────────────────
   read_02_ai_attribution:
     name: "READ-02 AI or tool attribution"
-    regex: '(?i)(generated by (claude|copilot|ai)|🤖 generated|co-authored-by:.*(claude|anthropic|copilot))'
+    regex: "(?i)(generated by (claude|copilot|ai)|🤖 generated|co-authored-by:.*(claude|anthropic|copilot))"
     message: "No AI or tool attribution in source, commits or PRs."
     severity: error