@nurix/etna 0.19.66 → 0.19.68

package/data/harnesses/apollo/hooks/lib/ownership.mjs

@@ -1,242 +0,0 @@
-// harness/code/hooks/lib/ownership.mjs — frontmatter scan + owns:-glob resolution, shared by the
-// hook entrypoints (awareness, compliance) and the CI checks so gates and pipeline cannot disagree.
-// Everything here is read-only over docs/features/ and the source tree; no network, no deps.
-
-import fs from "node:fs";
-import path from "node:path";
-
-// Read all of stdin synchronously; returns "" if nothing is piped.
-export function readStdin() {
-  try {
-    return fs.readFileSync(0, "utf8");
-  } catch (e) {
-    return "";
-  }
-}
-
-// Resolve the project root: CLAUDE_PROJECT_DIR env, else payload cwd, else process cwd.
-export function resolveProjectDir(payload) {
-  return process.env.CLAUDE_PROJECT_DIR || (payload && payload.cwd) || process.cwd();
-}
-
-// Recursively collect every .md file under dir (returns [] if the dir is absent).
-export function listMarkdown(dir) {
-  const out = [];
-  let entries;
-  try {
-    entries = fs.readdirSync(dir, { withFileTypes: true });
-  } catch (e) {
-    return out;
-  }
-  for (const entry of entries) {
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) out.push(...listMarkdown(full));
-    else if (entry.isFile() && entry.name.endsWith(".md")) out.push(full);
-  }
-  return out;
-}
-
-// Pull the leading `--- … ---` frontmatter block; "" if the file has none.
-export function frontmatter(text) {
-  const m = /^?---\r?\n([\s\S]*?)\r?\n---/.exec(text);
-  return m ? m[1] : "";
-}
-
-// Trim surrounding whitespace, then strip one layer of matching quotes.
-export function unquote(s) {
-  return String(s).trim().replace(/^["']|["']$/g, "").trim();
-}
-
-// One YAML list/array item → clean value: a quoted item ends at its closing quote
-// (anything after — trailing comments — drops); an unquoted item ends at ` #`.
-export function cleanItem(s) {
-  const t = String(s).trim();
-  const q = t[0];
-  if (q === '"' || q === "'") {
-    const end = t.indexOf(q, 1);
-    if (end > 0) return t.slice(1, end).trim();
-  }
-  const hash = t.search(/\s#/);
-  return unquote(hash >= 0 ? t.slice(0, hash) : t);
-}
-
-// `[a, b] # comment` → items; content ends at the closing bracket, not the line end.
-function parseInlineArray(raw) {
-  const end = raw.indexOf("]");
-  const body = (end >= 0 ? raw.slice(0, end) : raw).replace(/^\[/, "");
-  return body.split(",").map((s) => cleanItem(s)).filter(Boolean);
-}
-
-// Read one frontmatter key: scalar (`k: v`), inline array (`k: [a, b]`), or a following `- item` block.
-// Returns a string for scalars, an array for lists, or undefined when the key is absent.
-export function field(block, key) {
-  const lines = block.split(/\r?\n/);
-  const head = new RegExp(`^${key}\\s*:\\s*(.*)$`);
-  for (let i = 0; i < lines.length; i++) {
-    const m = head.exec(lines[i]);
-    if (!m) continue;
-    const raw = m[1].trim();
-    if (raw === "") {
-      // A bare key may continue as an indented inline array on the next line, or a `- item` block.
-      // The array may span several lines, so join through the closing bracket before parsing —
-      // reading only the first line yields a bare "[", which parses to [] and makes the whole doc
-      // look like it owns nothing. `scanFeatureDocs` skips such docs, so the failure is invisible:
-      // the doc drops out of the ownership index and out of every dead-glob count.
-      const next = (lines[i + 1] || "").trim();
-      if (next.startsWith("[")) {
-        let joined = "";
-        for (let j = i + 1; j < lines.length; j++) {
-          joined += (joined ? " " : "") + lines[j].trim();
-          if (lines[j].includes("]")) break;
-        }
-        return parseInlineArray(joined);
-      }
-      const items = [];
-      for (let j = i + 1; j < lines.length; j++) {
-        const li = /^\s*-\s+(.*)$/.exec(lines[j]);
-        if (!li) break;
-        items.push(cleanItem(li[1]));
-      }
-      return items;
-    }
-    if (raw.startsWith("[")) {
-      return parseInlineArray(raw);
-    }
-    return unquote(raw);
-  }
-  return undefined;
-}
-
-// Coerce a field that may be scalar/array/undefined into a clean string array.
-export function asList(v) {
-  if (v == null) return [];
-  return (Array.isArray(v) ? v : [v]).map((s) => String(s).trim()).filter(Boolean);
-}
-
-// Scan docs/features/**/*.md and return one entry per feature doc that declares owns:.
-// Shape: { doc (repo-relative, /-separated), owns[], module, keywords[], status }.
-export function scanFeatureDocs(projectDir) {
-  const featuresDir = path.join(projectDir, "docs", "features");
-  const files = listMarkdown(featuresDir);
-  const docs = [];
-  for (const file of files) {
-    let text;
-    try {
-      text = fs.readFileSync(file, "utf8");
-    } catch (e) {
-      continue;
-    }
-    const block = frontmatter(text);
-    if (!block) continue;
-    const owns = asList(field(block, "owns"));
-    if (owns.length === 0) continue;
-    docs.push({
-      doc: path.relative(projectDir, file).split(path.sep).join("/"),
-      owns,
-      module: (field(block, "module") || "—").toString(),
-      keywords: asList(field(block, "keywords")),
-      status: (field(block, "status") || "active").toString().toLowerCase(),
-    });
-  }
-  return docs;
-}
-
-// Build the ownership index text from every feature doc's frontmatter.
-export function buildIndex(projectDir) {
-  // Total markdown under docs/features/, counted independently of scanFeatureDocs — which
-  // drops a doc carrying no owns:, making a parse failure and a doc that owns nothing look alike.
-  const total = listMarkdown(path.join(projectDir, "docs", "features")).length;
-  const docs = scanFeatureDocs(projectDir);
-  const lines = [];
-  let deprecated = 0;
-  for (const entry of docs) {
-    if (entry.status === "deprecated") {
-      deprecated += 1;
-      continue; // keep deprecated docs out of the routing lines
-    }
-    const kw = entry.keywords.length ? `[${entry.keywords.join(", ")}]` : "[]";
-    for (const glob of entry.owns) {
-      lines.push(`${glob} → ${entry.doc} · ${entry.module} · ${kw} · ${entry.status}`);
-    }
-  }
-  if (lines.length === 0) return "";
-  lines.sort();
-  const header =
-    "# Ownership index (generated) — code-path glob → owning feature doc · module · keywords · status\n" +
-    "# Match the file or topic you're about to touch, then read the owning doc before changing it.\n";
-  const indexed = docs.length - deprecated;
-  const skipped = total - docs.length;
-  const notes = [];
-  if (deprecated > 0) notes.push(`${deprecated} deprecated`);
-  if (skipped > 0) notes.push(`${skipped} with no owns:`);
-  const footer = notes.length
-    ? `\n# (${indexed}/${total} feature doc(s) indexed - ${notes.join(", ")})`
-    : "";
-  return header + lines.join("\n") + footer;
-}
-
-// Compile one owns:-style glob (`**` any depth, `*` within a segment) to a RegExp
-// over /-separated repo-relative paths. `a/**` also matches `a` itself.
-export function globToRegExp(glob) {
-  const g = glob.replace(/\\/g, "/").replace(/\/+$/, "");
-  const escaped = g.replace(/[\\^$.|?+()[\]{}]/g, "\\$&");
-  const re = escaped
-    .replace(/\/\*\*$/, "\0TAIL\0") // `x/**` → x plus optionally anything below it
-    .replace(/\*\*\//g, "\0LEAD\0") // `**/x` → any (possibly empty) directory prefix
-    .replace(/\*\*/g, "\0ANY\0")
-    .replace(/\*/g, "[^/]*")
-    .replace(/\0TAIL\0/g, "(?:/.*)?")
-    .replace(/\0LEAD\0/g, "(?:.*/)?")
-    .replace(/\0ANY\0/g, ".*");
-  return new RegExp(`^${re}$`);
-}
-
-// Feature docs owning the given repo-relative path (deprecated docs excluded).
-export function owningDocs(projectDir, relPath) {
-  const rel = relPath.split(path.sep).join("/");
-  const out = [];
-  for (const entry of scanFeatureDocs(projectDir)) {
-    if (entry.status === "deprecated") continue;
-    if (entry.owns.some((g) => globToRegExp(g).test(rel))) out.push(entry);
-  }
-  return out;
-}
-
-const SKIP_DIRS = new Set(["node_modules", ".git", "dist", "build", ".claude", ".codex"]);
-
-// Walk the repo once and return every tracked-ish file path (repo-relative, /-separated).
-// Used to detect dead globs; heavy dirs are skipped, depth is bounded by the tree itself.
-export function listRepoFiles(projectDir) {
-  const out = [];
-  function walk(dir) {
-    let entries;
-    try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
-    } catch (e) {
-      return;
-    }
-    for (const entry of entries) {
-      if (SKIP_DIRS.has(entry.name)) continue;
-      const full = path.join(dir, entry.name);
-      if (entry.isDirectory()) walk(full);
-      else if (entry.isFile()) out.push(path.relative(projectDir, full).split(path.sep).join("/"));
-    }
-  }
-  walk(projectDir);
-  return out;
-}
-
-// Globs across all feature docs that match zero files on disk.
-// Returns [{ glob, doc }]; pass a precomputed file list to amortize the walk.
-export function deadGlobs(projectDir, repoFiles) {
-  const files = repoFiles || listRepoFiles(projectDir);
-  const dead = [];
-  for (const entry of scanFeatureDocs(projectDir)) {
-    if (entry.status === "deprecated") continue;
-    for (const glob of entry.owns) {
-      const re = globToRegExp(glob);
-      if (!files.some((f) => re.test(f))) dead.push({ glob, doc: entry.doc });
-    }
-  }
-  return dead;
-}

package/data/harnesses/apollo/hooks/lib/state.mjs

@@ -1,170 +0,0 @@
-// harness/code/hooks/lib/state.mjs — the bookkeeping queue (docs/operations/bookkeeping.md) and the
-// machine-local state dir (.claude/state/). The row grammar is the contract between the awareness
-// detector (writer), the bookkeeper agent (drain), the compliance gates (walls), and CI (backstop):
-//   - auto: {YYYY-MM-DD} · {finding-kind} · {description} → {action} | sid={session_id}
-//   - note: {YYYY-MM-DD} · {area} · {context} → lands-in: {owning doc | backlog | memory} | sid=…
-//   - needs-session: {YYYY-MM-DD} · {what could not be grounded} → main session resolves | refs={ts}
-//   - waived: {YYYY-MM-DD} · {what is deferred} · reason: {why} → expires={YYYY-MM-DD}
-// Unresolved = auto + note + needs-session. waived: rows are resolved history until expires= passes.
-
-import fs from "node:fs";
-import path from "node:path";
-
-export const QUEUE_PATH = ["docs", "operations", "bookkeeping.md"];
-
-export const QUEUE_HEADER = `# Bookkeeping
-
-The shared work queue keeping documentation and code in sync — a queue, never an archive. Rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is either **resolved, which deletes it**, or converted to \`waived:\`. A drained row leaves no trace here; what it closed is recorded in the doc it corrected, and git history holds the row itself. Row grammar and lifecycle: the \`documentation\` skill's \`templates/bookkeeping.md\`. A \`waived:\` row carries \`expires=\` and is PR-reviewable history.
-`;
-
-export function queueFile(projectDir) {
-  return path.join(projectDir, ...QUEUE_PATH);
-}
-
-const ROW_RE = /^-\s+(auto|note|needs-session|waived):\s+(.*)$/;
-
-// Parse the queue text into rows: { kind, date, body, raw }. Non-row lines are ignored.
-export function parseQueue(text) {
-  const rows = [];
-  for (const line of String(text || "").split(/\r?\n/)) {
-    const m = ROW_RE.exec(line.trim());
-    if (!m) continue;
-    const body = m[2].trim();
-    const date = (/^(\d{4}-\d{2}-\d{2})/.exec(body) || [])[1] || "";
-    rows.push({ kind: m[1], date, body, raw: line });
-  }
-  return rows;
-}
-
-export function readQueue(projectDir) {
-  try {
-    return parseQueue(fs.readFileSync(queueFile(projectDir), "utf8"));
-  } catch (e) {
-    return [];
-  }
-}
-
-// Counts by kind; `unresolved` is the number the walls act on.
-export function countRows(rows) {
-  const c = { auto: 0, note: 0, needsSession: 0, waived: 0 };
-  for (const row of rows) {
-    if (row.kind === "auto") c.auto += 1;
-    else if (row.kind === "note") c.note += 1;
-    else if (row.kind === "needs-session") c.needsSession += 1;
-    else if (row.kind === "waived") c.waived += 1;
-  }
-  c.unresolved = c.auto + c.note + c.needsSession;
-  return c;
-}
-
-// Format one auto: row per the grammar; the sid tail is the only provenance kept —
-// a transcript path or timestamp is machine noise in a PR-reviewed queue.
-export function formatAutoRow({ date, kind, description, action, sessionId }) {
-  return `- auto: ${date} · ${kind} · ${description} → ${action} | sid=${sessionId || "-"}`;
-}
-
-// Format one needs-session: row — a finding detected mechanically that only a session can resolve.
-// It carries no `sid=`: unlike an auto: row it is never drained by the bookkeeper, so the session
-// that raised it is not the one that must answer it.
-export function formatNeedsSessionRow({ date, description, refs }) {
-  return `- needs-session: ${date} · ${description} → main session resolves | refs=${refs}`;
-}
-
-// Append rows to the queue, creating the file with its genre header when absent.
-// Dedupes on the row text before the `| sid=` tail, so a re-fired detector never stacks duplicates.
-export function appendRows(projectDir, rowLines) {
-  if (!rowLines || rowLines.length === 0) return 0;
-  const file = queueFile(projectDir);
-  let text = "";
-  try {
-    text = fs.readFileSync(file, "utf8");
-  } catch (e) {
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    text = QUEUE_HEADER + "\n";
-  }
-  const key = (line) => line.split("| sid=")[0].trim();
-  const existing = new Set(parseQueue(text).map((r) => key(r.raw)));
-  const fresh = rowLines.filter((line) => !existing.has(key(line)));
-  if (fresh.length === 0) return 0;
-  if (!text.endsWith("\n")) text += "\n";
-  fs.writeFileSync(file, text + fresh.join("\n") + "\n");
-  return fresh.length;
-}
-
-// Delete queue rows matching the predicate (used by the detector to auto-resolve
-// rows whose finding the session has since addressed). Returns the count removed.
-export function resolveRows(projectDir, predicate) {
-  const file = queueFile(projectDir);
-  let text;
-  try {
-    text = fs.readFileSync(file, "utf8");
-  } catch (e) {
-    return 0;
-  }
-  let removed = 0;
-  const kept = text.split(/\r?\n/).filter((line) => {
-    const m = ROW_RE.exec(line.trim());
-    if (!m) return true;
-    const row = { kind: m[1], body: m[2].trim(), raw: line };
-    if (predicate(row)) {
-      removed += 1;
-      return false;
-    }
-    return true;
-  });
-  if (removed > 0) fs.writeFileSync(file, kept.join("\n"));
-  return removed;
-}
-
-// Unexpired waived rows for a finding kind (the dead-glob allowlist CI honors).
-// A waived row covers a glob when its body names it verbatim.
-export function unexpiredWaivers(rows, kind, today) {
-  return rows.filter((row) => {
-    if (row.kind !== "waived") return false;
-    if (kind && !row.body.includes(kind)) return false;
-    const expires = (/expires=(\d{4}-\d{2}-\d{2})/.exec(row.body) || [])[1];
-    if (!expires) return false;
-    return expires >= today;
-  });
-}
-
-// Ensure .claude/state/ exists and is self-ignoring (a `*` .gitignore inside it),
-// so consumers never see machine-local state as untracked noise. Returns the dir.
-export function stateDir(projectDir) {
-  const dir = path.join(projectDir, ".claude", "state");
-  fs.mkdirSync(dir, { recursive: true });
-  const ignore = path.join(dir, ".gitignore");
-  if (!fs.existsSync(ignore)) fs.writeFileSync(ignore, "*\n");
-  return dir;
-}
-
-// Session-scoped ask memory: an `ask` gate fires once per (session, class); after the user has
-// answered it once, repeats in the same session pass silently (the runtime's own permission
-// prompts still apply). Records live in .claude/state/asked.tsv — machine-local, self-ignored.
-export function askedThisSession(projectDir, sessionId, key) {
-  if (!sessionId) return false;
-  try {
-    const text = fs.readFileSync(path.join(projectDir, ".claude", "state", "asked.tsv"), "utf8");
-    return text.split("\n").includes(`${sessionId}\t${key}`);
-  } catch (e) {
-    return false;
-  }
-}
-
-export function recordAsked(projectDir, sessionId, key) {
-  if (!sessionId) return;
-  fs.appendFileSync(path.join(stateDir(projectDir), "asked.tsv"), `${sessionId}\t${key}\n`);
-}
-
-// Append one tab-separated line to .claude/state/touched.tsv (file → owning doc map for the session).
-//
-// THE SESSION ID IS THE FOURTH COLUMN, and it is what lets a reader tell one session's edits from
-// another's. The file is shared by every session running in this checkout, so without it a gate that
-// asks "did I touch this?" can only answer "did anyone?" — and blocks one session for another's
-// work. Appended rather than inserted so rows written before this column existed still parse: the
-// path stays at index 1, and a missing id reads as `undefined`, which belongs to no session.
-export function recordTouched(projectDir, relPath, docs, sessionId) {
-  const dir = stateDir(projectDir);
-  const line = `${new Date().toISOString()}\t${relPath}\t${docs.join(",") || "-"}\t${sessionId || "-"}\n`;
-  fs.appendFileSync(path.join(dir, "touched.tsv"), line);
-}

package/data/harnesses/apollo/rules/changelog.md

@@ -1,27 +0,0 @@
-# Changelog
-
-Every unit of work leaves one record — `docs/history/changelog/YYYY-MM-DD-{three-words}.md` (the three words name the work, not the commit) — plus its row in `docs/history/CHANGELOG.md`, appended in the same pass so the index never trails the folder. Entry format, field rules, and the closed exemption list are the `documentation` skill's `templates/changelog-entry.md`; this rule owns when an entry is owed and how it lives. An entry is never a commit summary — it carries the refinement context only the working session holds, which no diff reconstructs.
-
-## When an entry is owed
-
-| Trigger | What to write |
-| --- | --- |
-| A plan reaches `Status: Complete` | A draft entry for that plan, linked to it — written now, while the session still holds the context |
-| The user asks for a changelog | The entry for the work in hand. No commit required |
-| A commit is made | Every non-exempt commit is covered by an entry — the `commit` skill writes or completes it (no `commit` skill in the runtime ⇒ write the entry from the `documentation` skill's `templates/changelog-entry.md` and stage it with the commit) |
-
-An entry is owed only by work that changes promised behavior or takes a design decision; mechanical and cosmetic commits — a typo, a copy tweak, a config value, a log line — take only their `docs/history/CHANGELOG.md` row, no entry file. The failure fields (`Ask:`, `Skills:`, `Pin:`) are required only when non-none.
-
-Route the lesson by who pays for losing it: product context — what changed and why — belongs in the entry; anything the **next session would re-pay** — a library's API drifted from what the model expects, a validator's quirk, a tooling workaround — goes to `docs/memory/main.md` as well, because a changelog is read by people tracing history and memory is read by every session before it repeats the mistake.
-
-## Lifecycle
-
-Draft (created before its commit exists) → complete (missing fields filled from the diff and the session) → frozen the moment it rides in a commit. **Immutability begins at commit, not at creation** — a draft is meant to be edited, which is what lets a completed plan record its context before anything is committed; a committed entry is history, and a correction is a new entry linking back, **never** an edit.
-
-## Granularity
-
-A commit is the smallest unit an entry may describe; above that the mapping is judgment — four commits may be four entries or one, whichever reads better as history. An entry spanning several commits rides in the **last** of them, naming the predecessors in `Commits:`. When work exceeds what a draft describes, write a second entry rather than stretching the draft — the first stays an honest account of the plan.
-
-## Migrations are a different genre
-
-**One-shot migrations are a different genre.** Work that runs **once** against a live system — a data backfill, a schema cutover, a dependency or harness upgrade rolled across repos — is a **migration runbook** at `docs/history/migrations/YYYY-MM-DD-{slug}.md` (template: the `documentation` skill's `templates/migration-runbook.md`), authored **before** execution and outcome-stamped after. A changelog entry says what changed in the repo; a runbook says what was executed against the world and how to verify or undo it. A repeatable procedure is neither — that is `docs/operations/`. When a runbook defers targets, it records **why** and the **trigger to re-evaluate them**, so the next run re-checks rather than inheriting the skip.

package/data/harnesses/apollo/rules/database.md

@@ -1,34 +0,0 @@
-# Database
-
-Naming and the fixed column vocabulary for relational schemas in **every** Nurix project — one concept, one name, everywhere. Written for SQLite / Cloudflare D1 + Drizzle; a Postgres project keeps the same column names and semantics with native types (`uuid`, `timestamptz`, `boolean`). **Design doctrine — what earns a table, state vs. logs, junctions, FK policy, uniqueness traps — is the `schema-design` skill; consult it before any schema change.**
-
-## Keys & the shared vocabulary
-
-Three column roles are fixed across every table and every project:
-
-- **`id`** — the primary key, **always a UUID** (`TEXT PRIMARY KEY` on D1, `uuid` on Postgres), never a synthetic or natural key (❌ `type_page_button`, `human:default`). Runtime rows mint a UUIDv7; seed rows derive a deterministic UUIDv5 of the natural key so re-seeds stay stable. **Never** mix synthetic and UUID ids in one table. The single exemption is a log whose **composite key is its ordering** (`PRIMARY KEY (<entity>_id, sequence)`), declared at the table that uses it — everything else, logs included, takes a UUIDv7.
-- **`slug`** — the **stable key rows in another scope reference**: `UNIQUE`, lowercase `snake_case`. A slug means the same thing in every scope, so a slug reference survives a copy with no remapping — copying between scopes is the `schema-design` skill. ❌ Never rename this role `handle`, `key`, `code`, or `name` in another project.
-- **`label`** — the **human display name** — ❌ never `name`, `title`, or `display_name`.
-
-Reference columns name what they point at: `<entity>_id` for a UUID-PK reference (`user_id`, `app_id`), `<entity>_slug` for a slug reference (`source_slug`).
-
-- **Enforced, same scope** (the referenced row must exist) → a real `FOREIGN KEY (<x>_id) REFERENCES <table>(id)`.
-- **Cross-scope** (the reference must survive being copied) → `<x>_slug` as a plain column, **no** FK — an FK would bind the row to one scope's copy of the target, which is the remapping the slug exists to avoid.
-- **Drift-tolerant** (a controlled-vocabulary value that may fall off-list) → a plain value column, **no** FK, paired with an `is_*` boolean recording whether the value is in the canonical set.
-
-**Every inbound FK to a hub table declares a deliberate `ON DELETE`.** A hub (`users`, `devices`, anything several modules point at) collects edges from teams that never meet, and a single `NO ACTION` among them turns deleting the parent into a constraint error naming neither table. Decide per edge: the child dies with the row (`CASCADE`) or survives it (`SET NULL`, which needs a nullable column) — `NO ACTION` on a hub is a deferred outage, not a default.
-
-## Naming
-
-- **Tables** — `snake_case`, plural noun for what they hold (`users`, `apps`, `devices`).
-- **Junction (M:N) tables** — `<entityA>_<entityB>_map`, **always**, even when the join carries its own columns; singular stems, owning/anchor entity first (`app_user_map`, `app_device_map`). ❌ Never a "nice" noun (`members`, `installs`, `memberships`, `enrolments`) — the name must read as a join, and a reviewer should know both sides from it. The `_map` suffix is reserved for genuine M:N — the cardinality test that decides junction vs. column is the `schema-design` skill.
-- **Columns** — `snake_case`; booleans `is_*` / `has_*`; timestamps `created_at` / `updated_at`; foreign keys `<entity>_id`.
-- **Indexes** — `<table>_<col(s)>_idx`; unique `<table>_<col(s)>_unique`; a junction's composite unique reads `<table>_<colA>_<colB>_unique` (`app_user_map_app_user_unique`).
-- **Drizzle mirror** — the exported object is the camelCase table name (`app_user_map` → `appUserMap`); column props are the camelCase of the column (`created_at` → `createdAt`). The `sqliteTable("…")` string and every index name must match the DDL (`init.sql`) exactly — the schema-parity boundary.
-
-## Column types (SQLite / D1)
-
-- **Timestamps** — `created_at` + `updated_at`, both `TEXT NOT NULL DEFAULT (datetime('now'))`, on **every** table — except append-only logs, which carry only `created_at`.
-- **Booleans** — `INTEGER` (Drizzle `integer(…, { mode: "boolean" })`); the `is_*` / `has_*` names are § Naming.
-- **JSON** — `TEXT` (Drizzle `text(…, { mode: "json" })`).
-

package/data/harnesses/apollo/rules/frontend.md

@@ -1,30 +0,0 @@
-# Frontend
-
-Tailwind v4 + shadcn-based UI conventions for **web** apps — styling, the `@nurix/components` library, the `design.md` token artifact, and design-skill routing — plus the TypeScript conventions every package compiles under.
-
-- **Build every UI through the `design` skill** — never hand-roll layouts; the page archetypes, the `design.md` identity system with its token artifact (`design.tokens.css`), and chrome wiring live in the skill.
-- **The brief's stated theme binds** — dark boots dark when the brief says so (recorded in the project's `design.md`); light is the default only when the brief is silent.
-- **`@nurix/components`** is the UI library — import by subpath (`@nurix/components/button`). **Never** `npx shadcn add`, no `components.json` scaffold — consume the prebuilt library (`.tsx`, not `.jsx`).
-- Vite: `@tailwindcss/vite` + `@vitejs/plugin-react-swc`. Pin `react` / `react-dom` / `react/jsx-runtime` / `react/jsx-dev-runtime` to the app's single copy via `resolve.alias` — `@nurix/*` ship nested react, and two copies means two hook dispatchers.
-- Tailwind v4 is CSS-only — no `tailwind.config.js`, no PostCSS.
-- CSS entry `globals.css`, imports in order: `@import "./fonts.css"` (`@fontsource` registrations) → the project's `design.tokens.css` (derived from the repo-base `design.md` by the design skill's validator — **never** hand-edited) → `@import "tailwindcss"` → the library's `styles.css` — then `@theme inline {…}` mapping vars to tokens.
-- Tokens: CSS vars in `:root, :root[data-theme="light"]` and `:root[data-theme="dark"]` (both specificity 0,2,0 — armor a later bare `:root` can't defeat), consumed as semantic Tailwind tokens (`bg-card`, `text-foreground`). `globals.css` carries the active `@custom-variant dark` line; the theme attribute is `data-theme`. The library bundles `class-variance-authority`, `clsx`, `tailwind-merge` — don't re-add them.
-- Spacing in 2/4/6/8; `object-cover`; `truncate`; color through tokens — **never** hardcoded hex in components.
-
-## TypeScript
-
-Every package compiles under `strict: true` and `noUncheckedIndexedAccess: true`.
-
-### Type Safety
-
-- **Never** `any` to silence the checker. Unknown value → type `unknown`, then narrow (type guard / `zod` parse).
-- **Never** weaken strictness: no `// @ts-nocheck`; `// @ts-expect-error` only with a same-line reason.
-- Infer locals and return types; annotate at boundaries (exports, props, contracts).
-
-### Generics
-
-Shared libraries (`@nurix/components`, etc.) are generic on purpose — that's what types `cell(row)`, checks `slug` against `keyof TData`, and ties `data`/`columns` together; **never** widen to `any` to dodge it. State the row type **once per file** and let inference carry it — repeating `fn<Type>(…)` / `<Comp<Type>>` per call site is cosmetic (same safety, same emitted JS):
-
-- **Bind a repeated factory once** (preferred): `const col = defineColumn<BriefRow>;` → `col({...})`. Canonical: `modules/briefs/BriefsListPage.tsx`.
-- **Infer JSX type args from props:** `<Table data={rows} columns={columns} />`, not `<Table<BriefRow> …>`.
-- **Anchor with a collection annotation** when nothing else can: `const columns: ColumnDefinition<BriefRow>[] = [...]`.

package/data/harnesses/apollo/rules/general.md

@@ -1,40 +0,0 @@
-# General Standards
-
-Runtime versions, package policy, the API response envelope, and GitHub Actions pins — the workspace baseline.
-
-## Runtime Versions
-
-- **Node.js:** the version pinned in `.nvmrc` / `package.json` `engines` — **never** a hardcoded number, **never** the runner's default. Workflows use `node-version-file: .nvmrc`.
-- **Package manager:** detect from the lockfile — **never** hardcode one.
-- **PostgreSQL:** 17 · **Redis:** 7.x (latest)
-
-## Packages
-
-**Only packages in the approved table** — `.claude/hooks/approved-packages.md`, enforced by the PreToolUse install gate, which names the file on a block. The table changes only by explicit user decision. Test packages install at `latest`; fake data comes from `@ngneat/falso` — **never** `@faker-js/faker` / `chance`.
-
-## API Response Envelope
-
-Success and error share **one** envelope — a cross-service contract clients branch on, so a per-service "improvement" (`success: true`, a boolean `status`, a bare payload) breaks every consumer:
-
-```json
-{
-  "status": 1,
-  "message": "Message sent successfully",
-  "data": { "delivered": [{ "user@example.com": 2 }] }
-}
-```
-
-Error: `{ "status": 0, "message": "Error description", "data": null }`
-
-HTTP codes, default list: `200`, `201` (created), `400`, `401` (not authenticated), `403` (not authorized), `404`, `500` — plus `204`/`304` (null-body responses), `409` (conflicting write), `429` (rate limit), `503` (unhealthy dependency) where the semantics call for them. Middleware- and protocol-emitted codes are exempt from the envelope.
-
-## GitHub Actions
-
-Pin the major, and check it against the action's releases — a major behind still runs, so a stale pin never fails, it only warns.
-
-| Action | Version | Use |
-| --- | --- | --- |
-| `actions/checkout` | v7 | Repo checkout |
-| `actions/setup-node` | v7 | Node toolchain + npm cache |
-
-Set `node-version` via `node-version-file: .nvmrc`, **never** a hardcoded number and **never** the runner's default.

package/data/harnesses/apollo/rules/nomenclature.md

@@ -1,30 +0,0 @@
-# Nomenclature
-
-Naming and casing for code — identifiers, files, folders. The rationale throughout is consistency: one concept, one name, one casing shape, in every repo that loads this rule.
-
-Names state intent in full words — clarity over brevity; no abbreviations unless universally understood (`id`, `url` ✅ · `cfg`, `btn`, `idx` ❌).
-
-## Casing
-
-| Casing | Used for | Example |
-| --- | --- | --- |
-| `camelCase` | variables, functions, methods, properties; a module file exporting no component | `calculateTotal`, `sessionClient.ts` |
-| `PascalCase` | classes, type definitions, components; the file exporting one | `PaymentProcessor`, `AppsListPage.tsx` |
-| `UPPER_SNAKE_CASE` | constants, environment variables | `MAX_RETRY_COUNT` |
-| `kebab-case` | URLs, CSS class names, HTML IDs, multi-word folders | `user-profile`, `workspace-provisioning/` |
-| `snake_case` | database tables, columns, indexes | `created_at` |
-
-**A file exporting one component carries that component's name exactly**, so an import names the file it came from; a single-word folder is plain lowercase (`lib`, `surfaces`). ❌ Never `snake_case` a file or folder — that casing belongs to the database.
-
-## Identifier shape
-
-| Identifier | Shape | Example |
-| --- | --- | --- |
-| Variable | noun phrase | `paymentStatus` |
-| Function / method | verb phrase naming the action | `validateInput` |
-| Boolean | `is` / `has` / `can` / `should` prefix — **never** a bare adjective | `hasPermission` |
-| Array / collection | plural noun | `errorMessages` |
-| Class / component | singular noun phrase | `RequestHandler` |
-| Event handler | `handle` or `on` prefix | `handleSubmit`, `onPageLoad` |
-| Interface | `I` prefix acceptable; type aliases stay plain | `IConfigOptions`, `AuthResponse` |
-| Async function | verb phrase; `Async` suffix acceptable | `loadConfigAsync` |

package/data/harnesses/apollo/rules/pnpm.md

@@ -1,57 +0,0 @@
-# pnpm — `@nurix/*` Workspaces: naming, boundaries, and consuming
-
-How a `@nurix/*` repo is **named**, **structured**, and how its packages are **consumed** — every repo takes the workspace shape, single-package frontends included. Publishing and CLI design live in the `nustack` skill, not here.
-
----
-
-## 1. Package naming
-
-Every workspace package is scoped **`@nurix/`**; the dot vs. hyphen after the scope is semantic, not cosmetic:
-
-| Form | Meaning | Examples |
-| --- | --- | --- |
-| `@nurix/workflows-sdk` (hyphen) | **Published, externally-destined** contract | `@nurix/workflows-sdk` |
-| `@nurix/workflows.<name>` (dot) | **Internal** to the product — `private: true`, refactor freely. The default for a new package | `@nurix/workflows.agent-core`, `.worker`, `.playground` |
-| `@nurix/<name>` (plain) | Cross-repo shared lib owned **elsewhere** — never renamed | `@nurix/contracts`, `@nurix/components` |
-
-- `<name>` is always **kebab-case**.
-- The dot is **not** a path separator — subpath exports resolve normally (`@nurix/workflows.agent-core/nodes`).
-- The dot tracks "internal product package," not the `private` flag: `@nurix/workflows.secrets` is `private: false` (extraction-bound) yet dotted. `-sdk` is the only clean published form.
-
----
-
-## 2. Monorepo & package boundaries
-
-- **One `tsconfig.base.json` at the repo root owns TS policy** — the strict set, `target`, and everything uniform across packages (here, `module`/`moduleResolution`). Each package's `tsconfig.json` `extends` the base and adds only its coordinates (`rootDir`/`outDir`/`include`) and genuine environment overrides (`lib`/`types`/`jsx`; `module`/`moduleResolution` only when the package's module system truly differs). **Never** re-declare or weaken a policy option locally. One exception: a framework that owns its own base (an Astro app on `astro/tsconfigs/strict`).
-- **Internal packages are source-first.** A `private: true` package exposes its API via `exports` pointing at source (`"types"`/`"default"` → `./src/index.ts`) — no build step, and no bare `main`/`module` on new packages. One typed subpath per public surface; consumers import the subpath, **never** a deep relative path into another package's `src/`. `types` comes **first** in every subpath block — resolvers take the first matching condition, so a `types` listed after `default` is never reached.
-- **Crossing the publish boundary is the `nustack` skill** — `private: false`, the published manifest, the pipeline.
-- **Single-source shared dep versions with pnpm `catalog:`** — `typescript`, `zod`, `vitest`, `react`, type packages — so every package resolves the same copy and its types stay mutually assignable.
-- **TS project references only when it hurts** — adopt `references` once the typecheck/build graph is slow enough to feel; until then, `pnpm -r typecheck`.
-
-### The catalog has no garbage collector
-
-- **Removing the last consumer of a cataloged package removes its catalog entry in the same change** — `pnpm remove` rewrites the manifest and lockfile but **never** `pnpm-workspace.yaml`, and nothing downstream flags the orphan: no install fails, no lint fires.
-- The check is mechanical: an entry no workspace manifest names under any dependency field is orphaned; one absent from `pnpm-lock.yaml` is an orphan with certainty.
-- **A cataloged package is `catalog:` in every manifest** — a literal range (`"zod": "^4.2.1"`) resolves identically today and silently stops tracking the catalog the moment it moves.
-
-### The workspace root is a hard boundary
-
-- **A dependency spec never points outside the folder holding `pnpm-workspace.yaml`** — `devDependencies` included. Inside the root, `workspace:*` between `packages/*` is the normal, correct thing; outside it, nothing — no `file:../…`, no `link:`, no absolute `file:`. A sibling checkout is another repo, and the registry is the only supported way to consume one — a cross-root spec bakes machine-local paths into the lockfile and the published tarball, so `install --frozen-lockfile` fails on any other machine.
-- **A package unreachable from the registry is an auth or publishing bug — fix it there, never with a local path.** Diagnosis order: the scope's registry (§3) → the token → whether it was actually published.
-
----
-
-## 3. Consuming `@nurix/*` packages
-
-`@nurix/*` packages publish to npm with **`restricted`** access — installing needs read rights to the `nurix` org.
-
-- **Registry** — point the scope at npmjs, where the packages are published. A restricted read answers `404`, not `401`, so a mispaired registry is indistinguishable from "never published" — on an `@nurix/*` 404, check the registry pairing **first**, before auth and before assuming the package is missing.
-- **Auth** — `npm login` once (the npm user must be a `nurix` member), or a read token in `.npmrc` (the only CI option):
-  ```ini
-  @nurix:registry=https://registry.npmjs.org/
-  //registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}
-  ```
-  The token needs only `Read` on the `nurix` scope. A `403` on install means auth failed — check `npm whoami` (local) or the `NPM_READ_TOKEN` secret (CI). Attempt the install directly — the token authenticates ambiently; don't pre-empt or second-guess it. If it fails, flag it to the user — **never** reach for alternatives, a substitute package, or `npm login` swaps.
-- **Import by subpath, never the barrel** — subpaths tree-shake reliably; the available subpaths are the package's `exports` keys. `import { Button } from "@nurix/components/button";`
-- **Styles** — import a CSS-shipping package's stylesheet **once** at the app entry: `import "@nurix/components/styles.css";`. Unstyled components are almost always a missing styles import. The shipped stylesheet is precompiled — no Tailwind `@source` directive unless consuming source via a workspace link.
-- **CLIs** ship a `bin` — run directly: `npx @nurix/etna@latest` (or `npm install -g`).