@tencent-rtc/trtc-agent-skills 0.1.0

package/skills/trtc/room-builder/tools/render_ai_instructions.py

@@ -0,0 +1,226 @@
+#!/usr/bin/env python3
+"""render_ai_instructions.py — Render ai-instructions/*.md to tool-specific entry files.
+
+Sources: ai-instructions/*.md  (single source of truth, human-edited)
+Targets:
+  - AGENTS.md                    (for Codex / Aider / Cline / CodeBuddy)
+  - CLAUDE.md                    (between AI-INSTRUCTIONS markers)
+  - .cursor/rules/{name}.mdc     (one per source file; with Cursor frontmatter)
+
+Grown TDD-style; see tests/unit/test_render_ai_instructions.py.
+"""
+import argparse
+import sys
+from pathlib import Path
+
+
+def _sources(project_root, *, include_base=True):
+    """Return sorted list of .md source files under ai-instructions/.
+
+    base.md is the fixed preamble for AGENTS.md (tells Codex to read CLAUDE.md).
+    When include_base=False it is excluded — used by CLAUDE.md and Cursor renders
+    which don't need a self-referential pointer.
+    """
+    src_dir = project_root / "ai-instructions"
+    if not src_dir.exists():
+        return []
+    files = sorted(src_dir.glob("*.md"))
+    if not include_base:
+        files = [f for f in files if f.name != "base.md"]
+    return files
+
+
+# Single source-of-truth banner. Reused across all derived targets so the
+# message stays identical and contributors can grep for "DO NOT EDIT" to
+# find every generated file.
+_BANNER = (
+    "<!-- DO NOT EDIT — generated from ai-instructions/ by "
+    "skills/trtc/room-builder/tools/render_ai_instructions.py. "
+    "Edit the source markdown and re-run the renderer instead. -->"
+)
+
+
+def _render_agents_md(project_root):
+    """Regenerate AGENTS.md by concatenating all sources.
+
+    base.md is rendered first as a plain preamble (no H1 header) so Codex
+    sees the "read CLAUDE.md" instruction at the top. Remaining sources get
+    an H1 section header per file.
+    """
+    base_path = project_root / "ai-instructions" / "base.md"
+    sources = _sources(project_root, include_base=False)
+    parts = [_BANNER + "\n"]
+    # Preamble from base.md (rendered without a # header — it has its own).
+    if base_path.exists():
+        parts.append(base_path.read_text().rstrip() + "\n")
+    for src in sources:
+        parts.append(f"# {src.stem}\n\n{src.read_text().rstrip()}\n")
+    (project_root / "AGENTS.md").write_text("\n".join(parts) if (base_path.exists() or sources) else _BANNER + "\n")
+
+
+BEGIN_MARKER = "<!-- AI-INSTRUCTIONS:BEGIN -->"
+END_MARKER = "<!-- AI-INSTRUCTIONS:END -->"
+
+
+def _demote_headings(body):
+    """Add one '#' to every ATX heading line.
+
+    `## Foo` → `### Foo`, `### Foo` → `#### Foo`, etc. Lines that aren't
+    headings are returned unchanged. Used in CLAUDE.md so body sections
+    nest under the renderer-prepended `## {name}` parent.
+    """
+    out = []
+    for line in body.splitlines():
+        # Match an ATX heading: 1-6 '#' followed by a space.
+        stripped = line.lstrip()
+        if stripped.startswith("#"):
+            hashes = len(stripped) - len(stripped.lstrip("#"))
+            if 1 <= hashes <= 5 and stripped[hashes:hashes + 1] == " ":
+                # Preserve leading whitespace (rare in markdown but safe).
+                lead = line[:len(line) - len(stripped)]
+                out.append(f"{lead}#{stripped}")
+                continue
+        out.append(line)
+    return "\n".join(out)
+
+
+def _rendered_block(project_root):
+    """The string content placed between markers in CLAUDE.md.
+
+    Section headers are H2 (`## {name}`). Body headings are demoted by one
+    level so they nest as children of the section header instead of
+    appearing as adjacent siblings. Banner placed first so a casual reader
+    sees the warning before any rendered content.
+
+    base.md is excluded — CLAUDE.md doesn't need a pointer to itself.
+    """
+    sources = _sources(project_root, include_base=False)
+    parts = [_BANNER + "\n"]
+    for src in sources:
+        body = _demote_headings(src.read_text().rstrip())
+        parts.append(f"## {src.stem}\n\n{body}\n")
+    return "\n".join(parts)
+
+
+def _render_claude_md(project_root):
+    """Update CLAUDE.md in place between AI-INSTRUCTIONS markers.
+
+    If markers exist: replace content strictly between them.
+    If markers don't exist: append markers + rendered block at EOF.
+    Content outside the markers is never touched.
+    """
+    claude_path = project_root / "CLAUDE.md"
+    existing = claude_path.read_text() if claude_path.exists() else ""
+    block = _rendered_block(project_root)
+    marker_block = f"{BEGIN_MARKER}\n{block}\n{END_MARKER}\n"
+
+    if BEGIN_MARKER in existing and END_MARKER in existing:
+        begin = existing.index(BEGIN_MARKER)
+        end = existing.index(END_MARKER) + len(END_MARKER)
+        # Preserve trailing newline behavior from the original end-marker position.
+        trailing_nl = "\n" if end < len(existing) and existing[end] == "\n" else ""
+        new = existing[:begin] + marker_block.rstrip("\n") + trailing_nl + existing[end + len(trailing_nl):]
+        claude_path.write_text(new)
+    else:
+        # Append block at EOF (with a blank line separator).
+        sep = "" if existing.endswith("\n\n") or not existing else ("\n" if existing.endswith("\n") else "\n\n")
+        claude_path.write_text(existing + sep + marker_block)
+
+
+def _render_cursor_rules(project_root):
+    """One .cursor/rules/{name}.mdc per source file, with Cursor frontmatter.
+
+    Banner placed AFTER the frontmatter so Cursor's YAML parser still works.
+    base.md is excluded — Cursor reads its own rules, no redirect needed.
+    """
+    rules_dir = project_root / ".cursor" / "rules"
+    rules_dir.mkdir(parents=True, exist_ok=True)
+    for src in _sources(project_root, include_base=False):
+        target = rules_dir / f"{src.stem}.mdc"
+        body = src.read_text().rstrip()
+        target.write_text(
+            "---\n"
+            "alwaysApply: true\n"
+            "---\n"
+            "\n"
+            f"{_BANNER}\n"
+            "\n"
+            f"{body}\n"
+        )
+
+
+def _check_targets_up_to_date(project_root):
+    """Compare current target contents to what would be rendered.
+
+    Returns a list of stale target paths (relative to project_root). Empty
+    list = everything in sync.
+
+    Implementation: render to a temporary in-memory representation and diff
+    against current file contents. The cleanest way is to capture what
+    each render function would write before it writes; rather than
+    refactoring all three to return strings, we copy the current targets
+    out, run the renderers, diff, then restore on mismatch (so --check
+    has no side effect on the working tree).
+    """
+    targets = ["AGENTS.md", "CLAUDE.md"]
+    rules_dir = project_root / ".cursor" / "rules"
+    for src in _sources(project_root):
+        targets.append(f".cursor/rules/{src.stem}.mdc")
+
+    # Snapshot current contents.
+    snapshot = {}
+    for rel in targets:
+        p = project_root / rel
+        snapshot[rel] = p.read_bytes() if p.exists() else None
+
+    # Run render to compute new contents.
+    _render_agents_md(project_root)
+    _render_claude_md(project_root)
+    _render_cursor_rules(project_root)
+
+    stale = []
+    for rel in targets:
+        p = project_root / rel
+        new = p.read_bytes() if p.exists() else None
+        if new != snapshot[rel]:
+            stale.append(rel)
+
+    # Restore original contents so --check has no side effect.
+    for rel, original in snapshot.items():
+        p = project_root / rel
+        if original is None:
+            if p.exists():
+                p.unlink()
+        else:
+            p.write_bytes(original)
+    return stale
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Render ai-instructions/*.md to tool files.")
+    parser.add_argument("--project-root", default=".",
+                        help="Repo root (defaults to CWD)")
+    parser.add_argument("--check", action="store_true",
+                        help="Exit 2 if any target is stale (CI mode); no writes.")
+    args = parser.parse_args()
+    root = Path(args.project_root).resolve()
+
+    if args.check:
+        stale = _check_targets_up_to_date(root)
+        if stale:
+            print("render_ai_instructions: stale targets:", file=sys.stderr)
+            for s in stale:
+                print(f"  {s}", file=sys.stderr)
+            print("Re-run `python3 skills/trtc/room-builder/tools/render_ai_instructions.py` and commit the diff.",
+                  file=sys.stderr)
+            return 2
+        return 0
+
+    _render_agents_md(root)
+    _render_claude_md(root)
+    _render_cursor_rules(root)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/trtc-apply/SKILL.md

@@ -0,0 +1,97 @@
+---
+name: trtc-apply
+description: >
+  INTERNAL structural gate for TRTC code generated by the topic / onboarding
+  skills. Not a user-facing skill, and NOT a correctness verifier. It does one
+  job: stop the AI from declaring a slice "done" and ending the turn before a
+  deterministic check has run. The check itself is lightweight — code exists +
+  the slice's entry symbol is wired up (with comment/string anti-cheat) — it
+  does NOT verify types, compilation, or runtime behavior. Triggered only by
+  other skills in this repo (topic step gates, onboarding A2). Do NOT route to
+  this skill when a user asks "review my code" or "check this implementation".
+---
+
+# TRTC apply — Structural Gate
+
+apply 是 topic / onboarding 代码交付流程里的一道**结构门**,不是正确性校验器。
+
+```
+它保证「流程没被跳过」,不保证「代码是对的」。
+```
+
+正确性由两处负责,不在 apply 范围内:
+- **生成阶段**:slice 的 MUST / MUST NOT 约束指导代码怎么写。
+- **客户侧**:在真实项目里编译 / 运行确认。apply 跑在客户五花八门的已有项目里,无法假设一个统一可靠的 build,因此**刻意不做编译**——编译失败往往与生成代码无关(历史报错、缺依赖、私有 registry、monorepo 配置),把它当门禁只会产生噪声并拖慢每个 slice。
+
+本 skill 只有一种触发场景:topic / onboarding 生成代码后**内部调用**。它不是面向外部用户的"贴代码帮我检查"服务;若用户贴代码求排障,走 onboarding Path B。
+
+---
+
+## 它实际做的两件事
+
+### 1. 强制门(防止"自我宣布完成就停")
+
+apply 接在状态机上。每个 slice 的状态流转:
+
+```
+slice_read → code_written → apply_passed → user_confirmed
+```
+
+- 写完代码后必须运行 `apply.py`,把状态从 `code_written` 推到 `apply_passed`,否则
+- `guardrails/stop_require_apply_evidence.py`(Stop hook)会**拦住结束**:`code_written` 或 `apply_failed` 状态下不允许 AI 结束本轮。
+
+这是 apply 真正的价值:LLM 不能写一段"看起来对"的代码就自我盖章完成。
+
+### 2. 代码非空 + 入口符号检查(轻量,不等于正确)
+
+`apply.py` 扫 `<project_root>/src/**/*.{vue,ts}`,做两件事:
+
+- **代码非空**:`src/` 不存在或没有源码 → `static-only` → fail(没有可检查的内容,不放行)。
+- **入口符号**:每个 slice 有一个「入口符号」(它的 composable / 组件,如 device-control 的 `useDeviceState`)。该入口符号作为**真实代码标识符**出现在某个源文件里即通过;没有出现则 fail;**该 slice 没有登记入口符号 → 跳过**(无法机械检查,绝不误判)。
+
+入口符号映射是单一来源:`apply_lib/rule_parser.py` 的 `COMPOSABLE_TO_SLICE`(配 `entry_symbols_for_slice()`)。
+
+- 匹配前先用 `_strip_comments_and_strings` 剥掉注释与字符串字面量——防止把入口塞进 `// 注释` 或 `"字符串"` 骗过检查(来自 demo-test-2 真实 bug)。**入口符号是代码标识符,从不出现在字符串里,所以这步剥离不会冤枉正确代码**(这正是它取代旧「MUST 符号 grep」的原因:旧检查会把写在字符串里的符号——如错误码常量——剥掉而产生假阴性)。
+- 失败信息会点名该 slice 的入口 composable(那是它公开文档里的 import,不是隐藏的 API pattern,点名安全且有助修复)。
+
+> 明确边界:这一步**不验证**参数 / 类型 / 调用顺序 / 是否被执行 / 能否编译 / 运行时行为,也**不再**逐条核对 slice 的 MUST 符号。它只回答"代码非空,且这个 slice 的能力入口被接上了"。正确性由 slice 的 MUST / MUST NOT 约束(生成阶段)和客户侧编译运行负责。
+
+### 3. 重复声明检查(窄范围,真实编译错误)
+
+`apply.py` 还有一个**高精度、窄范围**的编译安全检查:只针对"从 `use*()` 调用解构出来的名字"——同名被解构 ≥2 次,或被解构且又以 `const/function/class` 声明,则判为 `duplicate-declaration` 并 fail。两个真实案例:
+
+- `const { getCameraList } = useDeviceState()` 之后又写 `function getCameraList()`;
+- `subscribeEvent` 同时从 `useRoomParticipantState()` 和 `useRoomState()` 解构。
+
+它**不是**通用重复声明 linter(两个不同作用域的同名局部 `const` 不会被误报)。修法是给其中一个解构起别名:`const { subscribeEvent: subscribeParticipantEvent } = useRoomParticipantState()`。
+
+---
+
+## 调用方式
+
+```bash
+python3 skills/trtc-topic/scripts/apply.py --slice <slice_id>
+# 或按交付单元
+python3 skills/trtc-topic/scripts/apply.py --unit <unit_id>
+```
+
+- session 路径解析:`$TRTC_SESSION_PATH` → `$CLAUDE_PROJECT_DIR/.trtc-session.yaml` → `./.trtc-session.yaml`。
+- 退出码:`0` 通过(状态 → `apply_passed`) / `1` 失败(状态 → `apply_failed`) / `2` 用法错误。
+- 证据写入 `<session_dir>/.trtc-apply-evidence/<slug>.json`(状态、入口检查数 `entries_checked`、每个 slice 的 `entry_result`、未过项的语义文本)。
+- `src/` 不存在或无源码 → 记为 `static-only`,结论为 `fail`(无可检查内容,不放行)。
+
+`auto_advance_policy` 为 `pause_on_failure` / `pause_at_end` 时,通过后自动推进到 `user_confirmed`;否则(默认 `pause_each`)保留每步向用户确认的暂停。
+
+---
+
+## 范围与非目标
+
+| 在范围内 | 不在范围内 |
+|---------|-----------|
+| web / vue 生成代码 | iOS / Android / Flutter / Electron |
+| 代码非空 + 单 slice 入口符号检查 | 类型 / 编译 / 运行时正确性 |
+| 注释/字符串防作弊 | 逐条核对 slice 的 MUST 符号 / 参数 / 调用顺序 |
+| 重复声明(编译安全)检查 | 跨 slice 前置状态、生命周期、清理对称性 |
+| 状态机强制门 + Stop hook | 集成安全(diff 范围、SDK 初始化冲突、回归测试) |
+
+入口符号检查只在「共用入口」(如 `conference` 对象同时承载 login-auth 与 room-lifecycle)上区分度较弱:导入一次即可让同入口的多个 slice 都过。这是「删掉逐符号 grep、改用入口门」时已接受的取舍——门的核心价值是状态机强制(不许自我盖章结束),而非判据的精度。跨 slice / 场景级的更强校验目前未实现,且不应硬编码进本门;正确性应由 slice 的 MUST / MUST NOT 约束与客户侧编译运行承接。

package/skills/trtc-apply/guardrails/apply_lib/rule_parser.py

@@ -0,0 +1,268 @@
+"""rule_parser.py — Slice rule extraction + entry-symbol map.
+
+Two responsibilities:
+
+  * ``extract_rules_from_slice`` / ``rules_for_file`` — parse the
+    "代码生成约束 / 生成规则" sections of slice .md files into structured
+    MUST/MUST NOT rules (still used for documentation/inspection).
+  * ``COMPOSABLE_TO_SLICE`` / ``entry_symbols_for_slice`` — the slice ↔ entry
+    symbol map. The structural gate (``skills/trtc-topic/scripts/apply.py``)
+    uses this to check that a slice's entry composable/component is wired up
+    in the generated code. (The gate no longer greps each rule's backtick
+    patterns — that produced false negatives on symbols living inside string
+    literals; see apply.py's module docstring.)
+
+Each rule has:
+  - type: "MUST" or "MUST NOT"
+  - text: The full rule description
+  - patterns: List of grep-able code patterns extracted from backtick segments
+  - verify_hint: The "Verify:" instruction if present
+  - source_file: Path to the slice .md file
+  - slice_id: e.g. "conference/login-auth"
+"""
+import re
+from pathlib import Path
+from typing import Optional
+
+
+# Match numbered MUST/MUST NOT rules in slice files.
+# Format: "N. **text** — explanation\n   **Verify**: check"
+_RULE_BLOCK_RE = re.compile(
+    r'^\d+\.\s+\*\*(.*?)\*\*\s*[—–-]\s*(.*?)$',
+    re.MULTILINE
+)
+
+# Match the section headers for MUST / MUST NOT
+_MUST_SECTION_RE = re.compile(
+    r'^#{2,4}\s+MUST(?:\s+NOT)?\s*[（(].*?[）)]',
+    re.MULTILINE
+)
+
+# Extract code patterns from backtick-quoted segments
+_BACKTICK_RE = re.compile(r'`([^`]+)`')
+
+# Match "**Verify**:" lines
+_VERIFY_RE = re.compile(r'\*\*Verify\*\*:\s*(.+?)$', re.MULTILINE)
+
+
+# Entry composable / component / value → slice_id.
+#
+# This is the single source for "what is this slice's entry symbol". It is
+# consumed in two places:
+#   * rules_for_file() — to decide which slice's rules apply to a file.
+#   * the apply gate (apply.py) — to check that a slice's entry symbol
+#     actually appears in the generated code.
+#
+# Entry symbols are stable code identifiers (composables / components / exported
+# values), never string literals — which is what makes the entry-presence check
+# immune to the comment/string-literal stripping false-negative that the old
+# MUST-symbol grep suffered from.
+COMPOSABLE_TO_SLICE = {
+    'useLoginState': 'conference/login-auth',
+    'useRoomState': 'conference/room-lifecycle',
+    'useDeviceState': 'conference/device-control',
+    'useRoomParticipantState': 'conference/participant-list',
+    'RoomView': 'conference/video-layout',
+    'RoomLayoutTemplate': 'conference/video-layout',
+    'networkInfo': 'conference/network-quality',
+    'NetworkQuality': 'conference/network-quality',
+    'useConversationListState': 'conference/room-chat',
+    'useMessageListState': 'conference/room-chat',
+    'useMessageInputState': 'conference/room-chat',
+    'setActiveConversation': 'conference/room-chat',
+    'startScreenShare': 'conference/screen-share',
+    'stopScreenShare': 'conference/screen-share',
+}
+
+
+def entry_symbols_for_slice(slice_id: str) -> list:
+    """Return the known entry symbols for a slice (inverse of COMPOSABLE_TO_SLICE).
+
+    Empty list means the slice has no registered entry symbol; callers should
+    treat that as "cannot check mechanically" rather than a failure.
+    """
+    return [sym for sym, sid in COMPOSABLE_TO_SLICE.items() if sid == slice_id]
+
+
+def extract_rules_from_slice(md_path: Path) -> list:
+    """Parse a slice markdown file for MUST/MUST NOT rules.
+
+    Looks for the "代码生成约束" / "生成规则" section and extracts
+    structured rules from the MUST/MUST NOT subsections.
+
+    Returns list of rule dicts.
+    """
+    if not md_path.exists():
+        return []
+
+    content = md_path.read_text(encoding='utf-8')
+
+    # Find the code generation constraints section
+    constraint_start = _find_constraint_section(content)
+    if constraint_start is None:
+        return []
+
+    constraint_text = content[constraint_start:]
+    rules = []
+
+    # Split into MUST and MUST NOT sections
+    must_section = _extract_section(constraint_text, 'MUST（生成时必须包含）')
+    must_not_section = _extract_section(constraint_text, 'MUST NOT（生成时绝不能出现）')
+
+    if must_section:
+        rules.extend(_parse_rules_in_section(must_section, 'MUST', md_path))
+    if must_not_section:
+        rules.extend(_parse_rules_in_section(must_not_section, 'MUST NOT', md_path))
+
+    return rules
+
+
+def _find_constraint_section(content: str) -> Optional[int]:
+    """Find the start of the code generation constraints section."""
+    markers = [
+        '## 代码生成约束',
+        '### 生成规则',
+        '#### MUST（生成时必须包含）',
+        '#### MUST（',
+    ]
+    for marker in markers:
+        idx = content.find(marker)
+        if idx != -1:
+            return idx
+    return None
+
+
+def _extract_section(text: str, header_fragment: str) -> Optional[str]:
+    """Extract text from a section header to the next same-or-higher-level header."""
+    idx = text.find(header_fragment)
+    if idx == -1:
+        return None
+
+    # Find the end: next #### or ### or ## header
+    section_start = text.find('\n', idx) + 1
+    remaining = text[section_start:]
+
+    # End at next heading of same or higher level
+    end_match = re.search(r'^#{2,4}\s+', remaining, re.MULTILINE)
+    if end_match:
+        return remaining[:end_match.start()]
+    return remaining
+
+
+def _parse_rules_in_section(section_text: str, rule_type: str, source_file: Path) -> list:
+    """Parse numbered rules from a MUST or MUST NOT section."""
+    rules = []
+
+    # Split by numbered items (1. ... 2. ... 3. ...)
+    items = re.split(r'\n(?=\d+\.\s+)', section_text)
+
+    for item in items:
+        item = item.strip()
+        if not item or not re.match(r'^\d+\.', item):
+            continue
+
+        # Extract the rule title (bold text after number)
+        title_match = re.match(r'^\d+\.\s+\*\*(.*?)\*\*', item)
+        if not title_match:
+            # Try without bold
+            title_match = re.match(r'^\d+\.\s+(.+?)(?:\s*[—–-]|$)', item)
+
+        title = title_match.group(1) if title_match else item[:80]
+
+        # Extract code patterns from backticks
+        patterns = _BACKTICK_RE.findall(item)
+
+        # Extract verify hint
+        verify_match = _VERIFY_RE.search(item)
+        verify_hint = verify_match.group(1) if verify_match else None
+
+        # Derive slice_id from file path
+        slice_id = _derive_slice_id(source_file)
+
+        rules.append({
+            'type': rule_type,
+            'text': title.strip(),
+            'patterns': patterns,
+            'verify_hint': verify_hint,
+            'source_file': str(source_file),
+            'slice_id': slice_id,
+        })
+
+    return rules
+
+
+def _derive_slice_id(md_path: Path) -> str:
+    """Derive slice_id from file path.
+
+    e.g. .../slices/conference/web/login-auth.md → conference/login-auth
+    """
+    parts = md_path.parts
+    try:
+        slices_idx = parts.index('slices')
+        # Pattern: slices/{product}/{platform}/{ability}.md
+        # or: slices/{product}/{ability}.md
+        remaining = parts[slices_idx + 1:]
+        if len(remaining) >= 3:
+            # slices/conference/web/login-auth.md
+            product = remaining[0]
+            ability = remaining[-1].replace('.md', '')
+            return f"{product}/{ability}"
+        elif len(remaining) == 2:
+            # slices/conference/login-auth.md
+            product = remaining[0]
+            ability = remaining[1].replace('.md', '')
+            return f"{product}/{ability}"
+    except (ValueError, IndexError):
+        pass
+    return str(md_path.stem)
+
+
+def load_rules_for_product_platform(
+    kb_root: Path,
+    product: str,
+    platform: str,
+) -> list:
+    """Load all rules for a given product and platform.
+
+    Loads both product-level and platform-specific slice files.
+    """
+    slices_dir = kb_root / 'knowledge-base' / 'slices' / product
+    all_rules = []
+
+    # Product-level slices
+    for md_file in slices_dir.glob('*.md'):
+        all_rules.extend(extract_rules_from_slice(md_file))
+
+    # Platform-specific slices
+    platform_dir = slices_dir / platform
+    if platform_dir.exists():
+        for md_file in platform_dir.glob('*.md'):
+            all_rules.extend(extract_rules_from_slice(md_file))
+
+    return all_rules
+
+
+def rules_for_file(all_rules: list, file_content: str) -> list:
+    """Filter rules relevant to a specific file based on what it imports.
+
+    A rule is relevant if the file contains any composable/import that
+    the rule's slice defines.
+    """
+    # Build a map: slice_id → rules
+    by_slice = {}
+    for rule in all_rules:
+        sid = rule.get('slice_id', '')
+        by_slice.setdefault(sid, []).append(rule)
+
+    # Determine which slices this file touches
+    active_slices = set()
+    for composable, slice_id in COMPOSABLE_TO_SLICE.items():
+        if composable in file_content:
+            active_slices.add(slice_id)
+
+    # Return rules from active slices only
+    relevant = []
+    for sid in active_slices:
+        relevant.extend(by_slice.get(sid, []))
+
+    return relevant