@polydeukes/core 0.3.0 → 0.4.0

package/dist/config.d.ts

@@ -156,7 +156,8 @@ export declare class ConfigValidationError extends Error {
  * Throws {@link ConfigValidationError} (naming the offending field path) when the top level
  * is not a plain object, any object level carries an unknown key, `languages` is
  * missing/empty, any language's `productionGlob` is missing/empty, any `testCmd` is not a
- * non-empty string template, `telemetry.logPath` is not a string, `protectedPaths` carries a
- * non-string element, or `adapters` is not a map of plain-object namespaces.
+ * non-empty string template, `telemetry.logPath` is not a non-empty string after trimming,
+ * `protectedPaths` carries a non-string or empty element, or `adapters` is not a map of
+ * plain-object namespaces.
  */
 export declare function defineConfig(config: unknown): ResolvedConfig;

package/dist/config.js

@@ -170,6 +170,11 @@ function validateDisciplines(disciplines) {
         if (predicate === 'forbid') {
             const forbid = entry.forbid;
             if (typeof forbid === 'string') {
+                // An empty pattern matches at every position, so the entry would break every
+                // in-scope change — rejected like every sibling pattern field.
+                if (forbid.length === 0) {
+                    throw new ConfigValidationError(`${location} forbid must be a non-empty string pattern`);
+                }
                 rejectUncompilableRegex(forbid, `${location} forbid`);
             }
             else if (isPlainObject(forbid)) {
@@ -178,6 +183,9 @@ function validateDisciplines(disciplines) {
                 if (keys.length !== 1 || keys[0] !== 'added' || typeof forbid.added !== 'string') {
                     throw new ConfigValidationError(`${location} forbid object must have exactly one key 'added' with a string pattern`);
                 }
+                if (forbid.added.length === 0) {
+                    throw new ConfigValidationError(`${location} forbid.added must be a non-empty string pattern`);
+                }
                 rejectUncompilableRegex(forbid.added, `${location} forbid.added`);
             }
             else {
@@ -193,6 +201,11 @@ function validateDisciplines(disciplines) {
             if (typeof entry.forbidCommand !== 'string') {
                 throw new ConfigValidationError(`${location} forbidCommand must be a string pattern`);
             }
+            if (entry.forbidCommand.length === 0) {
+                // An empty pattern matches every command line — one typo would block every
+                // shell call the entry sees.
+                throw new ConfigValidationError(`${location} forbidCommand must be a non-empty string pattern`);
+            }
             rejectUncompilableRegex(entry.forbidCommand, `${location} forbidCommand`);
         }
         else {
@@ -213,27 +226,9 @@ function validateDisciplines(disciplines) {
     return disciplines;
 }
 /**
- * Validate parsed unknown data as a {@link PolydeukesConfig} and return a
- * {@link ResolvedConfig} with defaults filled and templates compiled (PRD §4.3).
- * Pure — no file I/O.
- *
- * Throws {@link ConfigValidationError} (naming the offending field path) when the top level
- * is not a plain object, any object level carries an unknown key, `languages` is
- * missing/empty, any language's `productionGlob` is missing/empty, any `testCmd` is not a
- * non-empty string template, `telemetry.logPath` is not a string, `protectedPaths` carries a
- * non-string element, or `adapters` is not a map of plain-object namespaces.
+ * Validate the `languages` map and compile each profile's `{scope}` template (PRD §4.1).
  */
-export function defineConfig(config) {
-    if (!isPlainObject(config)) {
-        throw new ConfigValidationError('config must be a plain object');
-    }
-    rejectUnknownKeys(config, TOP_LEVEL_KEYS, 'config');
-    // `$schema` is an IDE schema reference (CONFIG-03): accepted, type-checked, and
-    // ignored — it never appears in the resolution output.
-    if (config.$schema !== undefined && typeof config.$schema !== 'string') {
-        throw new ConfigValidationError('$schema must be a string');
-    }
-    const languages = config.languages;
+function validateLanguages(languages) {
     if (!isPlainObject(languages) || Object.keys(languages).length === 0) {
         throw new ConfigValidationError('languages must be a non-empty object');
     }
@@ -258,56 +253,101 @@ export function defineConfig(config) {
             testCmd: compileTestCmd(profile.testCmd),
         };
     }
-    if (config.protectedPaths !== undefined && !isStringArray(config.protectedPaths)) {
+    return resolvedLanguages;
+}
+/** Validate `protectedPaths` — an array of non-empty strings; the data passes through verbatim. */
+function validateProtectedPaths(protectedPaths) {
+    if (!isStringArray(protectedPaths)) {
         throw new ConfigValidationError('protectedPaths must be an array of strings');
     }
-    let adapters;
-    if (config.adapters !== undefined) {
-        // Array first: the removed directory-list form deserves a migration hint, not a
-        // generic type error — and an EMPTY array must land here too, never pass as a map.
-        if (Array.isArray(config.adapters) || !isPlainObject(config.adapters)) {
-            throw new ConfigValidationError('adapters must be an object map of adapter namespaces — the directory-list form ' +
-                'was removed; move directories to protectedPaths');
-        }
-        for (const [name, namespace] of Object.entries(config.adapters)) {
-            if (!isPlainObject(namespace)) {
-                throw new ConfigValidationError(`adapters.${name} must be an object`);
-            }
-        }
-        adapters = config.adapters;
+    // An empty element carries no path meaning and would ride along unnoticed next to
+    // valid siblings.
+    if (protectedPaths.some((path) => path.length === 0)) {
+        throw new ConfigValidationError('protectedPaths must not contain an empty string');
     }
-    const disciplines = config.disciplines !== undefined ? validateDisciplines(config.disciplines) : undefined;
-    let logPath;
-    if (config.telemetry !== undefined) {
-        if (!isPlainObject(config.telemetry)) {
-            throw new ConfigValidationError('telemetry must be an object');
-        }
-        rejectUnknownKeys(config.telemetry, TELEMETRY_KEYS, 'telemetry');
-        if (config.telemetry.logPath !== undefined) {
-            if (typeof config.telemetry.logPath !== 'string') {
-                throw new ConfigValidationError('telemetry.logPath must be a string');
-            }
-            logPath = config.telemetry.logPath;
-        }
+    return protectedPaths;
+}
+/**
+ * Validate the `adapters` map (CONFIG-07 layering) — each namespace is a plain object whose
+ * contents belong to that adapter's own validator, so they pass through verbatim.
+ */
+function validateAdapters(adapters) {
+    // Array first: the removed directory-list form deserves a migration hint, not a
+    // generic type error — and an EMPTY array must land here too, never pass as a map.
+    if (Array.isArray(adapters) || !isPlainObject(adapters)) {
+        throw new ConfigValidationError('adapters must be an object map of adapter namespaces — the directory-list form ' +
+            'was removed; move directories to protectedPaths');
     }
-    let witness;
-    if (config.witness !== undefined) {
-        if (!isPlainObject(config.witness)) {
-            throw new ConfigValidationError('witness must be an object');
-        }
-        rejectUnknownKeys(config.witness, WITNESS_KEYS, 'witness');
-        const { token, ttlMinutes } = config.witness;
-        if (typeof token !== 'string' || token.trim().length === 0) {
-            throw new ConfigValidationError('witness.token must be a non-empty string after trimming');
+    for (const [name, namespace] of Object.entries(adapters)) {
+        if (!isPlainObject(namespace)) {
+            throw new ConfigValidationError(`adapters.${name} must be an object`);
         }
-        if (typeof ttlMinutes !== 'number' || !(Number.isFinite(ttlMinutes) && ttlMinutes > 0)) {
-            throw new ConfigValidationError('witness.ttlMinutes must be a finite number greater than 0');
-        }
-        witness = { token, ttlMinutes };
     }
+    return adapters;
+}
+/** Validate the `telemetry` section and return its `logPath` (absent stays undefined). */
+function validateTelemetry(telemetry) {
+    if (!isPlainObject(telemetry)) {
+        throw new ConfigValidationError('telemetry must be an object');
+    }
+    rejectUnknownKeys(telemetry, TELEMETRY_KEYS, 'telemetry');
+    if (telemetry.logPath === undefined) {
+        return undefined;
+    }
+    if (typeof telemetry.logPath !== 'string') {
+        throw new ConfigValidationError('telemetry.logPath must be a string');
+    }
+    if (telemetry.logPath.trim().length === 0) {
+        throw new ConfigValidationError('telemetry.logPath must be a non-empty string after trimming');
+    }
+    return telemetry.logPath;
+}
+/** Validate the `witness` section (CONFIG-05) — both values are consumed at assembly time. */
+function validateWitness(witness) {
+    if (!isPlainObject(witness)) {
+        throw new ConfigValidationError('witness must be an object');
+    }
+    rejectUnknownKeys(witness, WITNESS_KEYS, 'witness');
+    const { token, ttlMinutes } = witness;
+    if (typeof token !== 'string' || token.trim().length === 0) {
+        throw new ConfigValidationError('witness.token must be a non-empty string after trimming');
+    }
+    if (typeof ttlMinutes !== 'number' || !(Number.isFinite(ttlMinutes) && ttlMinutes > 0)) {
+        throw new ConfigValidationError('witness.ttlMinutes must be a finite number greater than 0');
+    }
+    return { token, ttlMinutes };
+}
+/**
+ * Validate parsed unknown data as a {@link PolydeukesConfig} and return a
+ * {@link ResolvedConfig} with defaults filled and templates compiled (PRD §4.3).
+ * Pure — no file I/O.
+ *
+ * Throws {@link ConfigValidationError} (naming the offending field path) when the top level
+ * is not a plain object, any object level carries an unknown key, `languages` is
+ * missing/empty, any language's `productionGlob` is missing/empty, any `testCmd` is not a
+ * non-empty string template, `telemetry.logPath` is not a non-empty string after trimming,
+ * `protectedPaths` carries a non-string or empty element, or `adapters` is not a map of
+ * plain-object namespaces.
+ */
+export function defineConfig(config) {
+    if (!isPlainObject(config)) {
+        throw new ConfigValidationError('config must be a plain object');
+    }
+    rejectUnknownKeys(config, TOP_LEVEL_KEYS, 'config');
+    // `$schema` is an IDE schema reference (CONFIG-03): accepted, type-checked, and
+    // ignored — it never appears in the resolution output.
+    if (config.$schema !== undefined && typeof config.$schema !== 'string') {
+        throw new ConfigValidationError('$schema must be a string');
+    }
+    const resolvedLanguages = validateLanguages(config.languages);
+    const protectedPaths = config.protectedPaths !== undefined ? validateProtectedPaths(config.protectedPaths) : undefined;
+    const adapters = config.adapters !== undefined ? validateAdapters(config.adapters) : undefined;
+    const disciplines = config.disciplines !== undefined ? validateDisciplines(config.disciplines) : undefined;
+    const logPath = config.telemetry !== undefined ? validateTelemetry(config.telemetry) : undefined;
+    const witness = config.witness !== undefined ? validateWitness(config.witness) : undefined;
     return {
         languages: resolvedLanguages,
-        ...(config.protectedPaths !== undefined && { protectedPaths: config.protectedPaths }),
+        ...(protectedPaths !== undefined && { protectedPaths }),
         ...(adapters !== undefined && { adapters }),
         telemetry: {
             logPath: logPath ?? DEFAULT_TELEMETRY_LOG_PATH,

package/dist/exit-codes.d.ts

@@ -0,0 +1,20 @@
+/**
+ * exit-codes — the covenant protocol's exit-code vocabulary (CORE-01 PRD §4.1).
+ *
+ * The three codes are distinct and ordered by severity. The covenant *body* only
+ * ever emits `0` (uphold) or `1` (break, non-blocking); translating a break into the
+ * blocking `2` is the wrapper's job (COVENANT-01), never the core's. The sole place
+ * the core itself reaches for `2` is the fail-closed parse path in the barrel.
+ *
+ * These live in their own module rather than the barrel because `fail-policy.ts` needs
+ * them: importing them from the barrel, which re-exports fail-policy, is an
+ * initialization cycle — the constants read as `undefined` depending on which module
+ * the runtime evaluates first (CLEANUP-01 F1). The barrel re-exports them, so every
+ * consumer outside core still reaches them at the same path.
+ */
+/** Promise upheld — no violation, the edit/push passes. */
+export declare const EXIT_UPHOLD = 0;
+/** Violation reported as a non-blocking signal. The covenant body's break code. */
+export declare const EXIT_BREAK_NON_BLOCKING = 1;
+/** Violation blocked — the edit/push is refused. Reserved for the wrapper / fail-closed. */
+export declare const EXIT_BREAK_BLOCKING = 2;

package/dist/exit-codes.js

@@ -0,0 +1,20 @@
+/**
+ * exit-codes — the covenant protocol's exit-code vocabulary (CORE-01 PRD §4.1).
+ *
+ * The three codes are distinct and ordered by severity. The covenant *body* only
+ * ever emits `0` (uphold) or `1` (break, non-blocking); translating a break into the
+ * blocking `2` is the wrapper's job (COVENANT-01), never the core's. The sole place
+ * the core itself reaches for `2` is the fail-closed parse path in the barrel.
+ *
+ * These live in their own module rather than the barrel because `fail-policy.ts` needs
+ * them: importing them from the barrel, which re-exports fail-policy, is an
+ * initialization cycle — the constants read as `undefined` depending on which module
+ * the runtime evaluates first (CLEANUP-01 F1). The barrel re-exports them, so every
+ * consumer outside core still reaches them at the same path.
+ */
+/** Promise upheld — no violation, the edit/push passes. */
+export const EXIT_UPHOLD = 0;
+/** Violation reported as a non-blocking signal. The covenant body's break code. */
+export const EXIT_BREAK_NON_BLOCKING = 1;
+/** Violation blocked — the edit/push is refused. Reserved for the wrapper / fail-closed. */
+export const EXIT_BREAK_BLOCKING = 2;

package/dist/fail-policy.js

@@ -5,7 +5,7 @@
  * performs I/O and never throws. The single source of truth for "which failures
  * block and which pass through" lives here, not scattered across call sites.
  */
-import { EXIT_BREAK_BLOCKING, EXIT_UPHOLD } from './index.js';
+import { EXIT_BREAK_BLOCKING, EXIT_UPHOLD } from './exit-codes.js';
 /**
  * Policy table (PRD §4.1). Null-prototype so lookups can never reach
  * Object.prototype members ('__proto__', 'toString', …) — those must resolve

package/dist/index.d.ts

@@ -8,25 +8,12 @@
  * See https://github.com/huskyhoochu/polydeukes
  */
 export { ConfigValidationError, DEFAULT_TELEMETRY_LOG_PATH, type DisciplineEntry, type DisciplineForbid, defineConfig, type LanguageProfile, type PolydeukesConfig, type ResolvedConfig, type ResolvedLanguageProfile, } from './config.js';
+export { EXIT_BREAK_BLOCKING, EXIT_BREAK_NON_BLOCKING, EXIT_UPHOLD, } from './exit-codes.js';
 export { type FailMode, type FailureKind, failModeToExitCode, resolveFailMode, } from './fail-policy.js';
 export { isPlainObject } from './is-plain-object.js';
 export { normalizeProtectedPaths } from './protected-paths.js';
 export { aggregateGain, appendRecord, appendRecordFailOpen, formatRecordLine, type GainSummary, parseRecordLine, readRecords, runGain, type TelemetryEvent, type TelemetryRecord, } from './telemetry.js';
 export { type CanonicalTranscript, noopTranscript, type SubagentInvocation, type TranscriptToolCall, type TranscriptUserMessage, transcriptFromInput, } from './transcript.js';
-/**
- * exit-code semantics of the covenant protocol (PRD §4.1).
- *
- * The three codes are distinct and ordered by severity. The covenant *body* only
- * ever emits `0` (uphold) or `1` (break, non-blocking); translating a break into the
- * blocking `2` is the wrapper's job (COVENANT-01), never the core's. The sole place
- * the core itself reaches for `2` is the fail-closed parse path below.
- */
-/** Promise upheld — no violation, the edit/push passes. */
-export declare const EXIT_UPHOLD = 0;
-/** Violation reported as a non-blocking signal. The covenant body's break code. */
-export declare const EXIT_BREAK_NON_BLOCKING = 1;
-/** Violation blocked — the edit/push is refused. Reserved for the wrapper / fail-closed. */
-export declare const EXIT_BREAK_BLOCKING = 2;
 /**
  * `FileChange` — one file's mutation evidence around the judged call (CORE-06 §4.1).
  *

package/dist/index.js

@@ -7,27 +7,15 @@
  * appendRecordFailOpen — the fail-open wrapper promoted by CORE-05).
  * See https://github.com/huskyhoochu/polydeukes
  */
+import { EXIT_BREAK_BLOCKING, EXIT_BREAK_NON_BLOCKING, EXIT_UPHOLD } from './exit-codes.js';
 import { isPlainObject } from './is-plain-object.js';
 export { ConfigValidationError, DEFAULT_TELEMETRY_LOG_PATH, defineConfig, } from './config.js';
+export { EXIT_BREAK_BLOCKING, EXIT_BREAK_NON_BLOCKING, EXIT_UPHOLD, } from './exit-codes.js';
 export { failModeToExitCode, resolveFailMode, } from './fail-policy.js';
 export { isPlainObject } from './is-plain-object.js';
 export { normalizeProtectedPaths } from './protected-paths.js';
 export { aggregateGain, appendRecord, appendRecordFailOpen, formatRecordLine, parseRecordLine, readRecords, runGain, } from './telemetry.js';
 export { noopTranscript, transcriptFromInput, } from './transcript.js';
-/**
- * exit-code semantics of the covenant protocol (PRD §4.1).
- *
- * The three codes are distinct and ordered by severity. The covenant *body* only
- * ever emits `0` (uphold) or `1` (break, non-blocking); translating a break into the
- * blocking `2` is the wrapper's job (COVENANT-01), never the core's. The sole place
- * the core itself reaches for `2` is the fail-closed parse path below.
- */
-/** Promise upheld — no violation, the edit/push passes. */
-export const EXIT_UPHOLD = 0;
-/** Violation reported as a non-blocking signal. The covenant body's break code. */
-export const EXIT_BREAK_NON_BLOCKING = 1;
-/** Violation blocked — the edit/push is refused. Reserved for the wrapper / fail-closed. */
-export const EXIT_BREAK_BLOCKING = 2;
 /**
  * Deserialize stdin-JSON into a {@link CovenantInput} (the protocol's reverse direction).
  *

package/dist/telemetry.d.ts

@@ -8,13 +8,18 @@
  * than building its own logger.
  */
 /**
- * The five telemetry events. `witnessed` is a first-class event, not a flag on `passed`:
+ * The six telemetry events. `witnessed` is a first-class event, not a flag on `passed`:
  * a break a human stood behind by supplying the pass condition themselves. `advised` is a
  * violation verdict an advise-level observer recorded but let through; `skipped` is a
  * discipline a surface could not judge at all (no evidence channel) — a no-op that shows
  * up in the data instead of vanishing.
+ *
+ * `unattributed` is the one observation event among them: a protected entry whose state
+ * changed with no judgment row explaining it. It sits on a different axis from the five
+ * verdicts — `skipped` is an inability known up front, `unattributed` an attribution
+ * failure found after the fact — and it never blocks or passes a call.
  */
-export type TelemetryEvent = 'passed' | 'blocked' | 'witnessed' | 'advised' | 'skipped';
+export type TelemetryEvent = 'passed' | 'blocked' | 'witnessed' | 'advised' | 'skipped' | 'unattributed';
 /**
  * `TelemetryRecord` — one measured covenant outcome (PRD §4.1).
  *
@@ -43,7 +48,7 @@ export declare function formatRecordLine(record: TelemetryRecord): string;
  * Parse one TSV line back into a {@link TelemetryRecord}, or `null` if malformed (pure).
  *
  * Tolerates a trailing newline (so it round-trips {@link formatRecordLine}). Returns
- * `null` for the wrong field count, an event outside the five valid events, or an
+ * `null` for the wrong field count, an event outside the six valid events, or an
  * empty line — a malformed line is rejected, never coerced into a bogus record. The one
  * exception is {@link LEGACY_WITNESSED_EVENT}, which reads back as `witnessed`.
  */
@@ -87,7 +92,7 @@ export declare function readRecords(path: string): {
 /**
  * Aggregate records into per-label event counts (PRD §4.4, pure).
  *
- * Each label gets its own counter across all five events, so a corrupt or missing
+ * Each label gets its own counter across all six events, so a corrupt or missing
  * event never bleeds counts between labels.
  */
 export declare function aggregateGain(records: TelemetryRecord[]): GainSummary;

package/dist/telemetry.js

@@ -16,6 +16,7 @@ const VALID_EVENTS = [
     'witnessed',
     'advised',
     'skipped',
+    'unattributed',
 ];
 /**
  * The event name `witnessed` was written under before the rename — a read-only migration
@@ -51,7 +52,7 @@ export function formatRecordLine(record) {
  * Parse one TSV line back into a {@link TelemetryRecord}, or `null` if malformed (pure).
  *
  * Tolerates a trailing newline (so it round-trips {@link formatRecordLine}). Returns
- * `null` for the wrong field count, an event outside the five valid events, or an
+ * `null` for the wrong field count, an event outside the six valid events, or an
  * empty line — a malformed line is rejected, never coerced into a bogus record. The one
  * exception is {@link LEGACY_WITNESSED_EVENT}, which reads back as `witnessed`.
  */
@@ -144,14 +145,21 @@ export function readRecords(path) {
 /**
  * Aggregate records into per-label event counts (PRD §4.4, pure).
  *
- * Each label gets its own counter across all five events, so a corrupt or missing
+ * Each label gets its own counter across all six events, so a corrupt or missing
  * event never bleeds counts between labels.
  */
 export function aggregateGain(records) {
     const counts = {};
     for (const record of records) {
         if (!(record.label in counts)) {
-            counts[record.label] = { passed: 0, blocked: 0, witnessed: 0, advised: 0, skipped: 0 };
+            counts[record.label] = {
+                passed: 0,
+                blocked: 0,
+                witnessed: 0,
+                advised: 0,
+                skipped: 0,
+                unattributed: 0,
+            };
         }
         counts[record.label][record.event] += 1;
     }
@@ -160,9 +168,10 @@ export function aggregateGain(records) {
 /**
  * Render a {@link GainSummary} into human-readable lines (pure).
  *
- * Each label is mentioned with its passed/blocked/witnessed/advised/skipped counts; each
- * is a distinct column, never folded into another (PRD §4.4). A non-zero corrupt-line
- * count is reported rather than hidden — silent skipping would mask log corruption.
+ * Each label is mentioned with its passed/blocked/witnessed/advised/skipped/unattributed
+ * counts; each is a distinct column, never folded into another (PRD §4.4). A non-zero
+ * corrupt-line count is reported rather than hidden — silent skipping would mask log
+ * corruption.
  *
  * Two different meanings share the word `skipped`: the per-label EVENT column above,
  * and the unparseable-line count below. They are rendered on separate lines and never
@@ -174,7 +183,7 @@ function renderGain(summary, skipped) {
     }
     const lines = [`total ${summary.total}`];
     for (const [label, counts] of Object.entries(summary.counts)) {
-        lines.push(`${label}: passed=${counts.passed} blocked=${counts.blocked} witnessed=${counts.witnessed} advised=${counts.advised} skipped=${counts.skipped}`);
+        lines.push(`${label}: passed=${counts.passed} blocked=${counts.blocked} witnessed=${counts.witnessed} advised=${counts.advised} skipped=${counts.skipped} unattributed=${counts.unattributed}`);
     }
     if (skipped > 0) {
         lines.push(`corrupt lines skipped=${skipped}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polydeukes/core",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Polydeukes core — covenant protocol, config loader, and transcript interface. Domain- and agent-agnostic. Alpha.",
   "license": "MIT",
   "repository": {

package/schema/polydeukes.schema.json

@@ -19,7 +19,7 @@
     "protectedPaths": {
       "description": "Raw protected path patterns — normalization happens at resolve time.",
       "type": "array",
-      "items": { "type": "string" }
+      "items": { "type": "string", "minLength": 1 }
     },
     "adapters": {
       "description": "Adapter namespaces — keys are adapter names, values are each adapter's own settings object (contents not validated by the core schema).",
@@ -64,8 +64,10 @@
       "additionalProperties": false,
       "properties": {
         "logPath": {
-          "description": "Telemetry log path. Defaults to .polydeukes/roi.log when omitted.",
-          "type": "string"
+          "description": "Telemetry log path. Defaults to .polydeukes/roi.log when omitted. Must be non-empty after trimming.",
+          "type": "string",
+          "minLength": 1,
+          "pattern": "\\S"
         }
       }
     },
@@ -136,13 +138,13 @@
             "forbid": {
               "description": "Delta family — string shorthand is equivalent to { added }.",
               "anyOf": [
-                { "type": "string", "format": "regex" },
+                { "type": "string", "minLength": 1, "format": "regex" },
                 {
                   "type": "object",
                   "additionalProperties": false,
                   "required": ["added"],
                   "properties": {
-                    "added": { "type": "string", "format": "regex" }
+                    "added": { "type": "string", "minLength": 1, "format": "regex" }
                   }
                 }
               ]
@@ -172,6 +174,7 @@
             "forbidCommand": {
               "description": "Command family — regex over shell command strings.",
               "type": "string",
+              "minLength": 1,
               "format": "regex"
             }
           }