@terpjs/spec 0.14.0 → 0.15.0

package/catalog/backend/no_adhoc_logging_config.json

@@ -1,22 +1,22 @@
-{
-  "id": "backend/no_adhoc_logging_config",
-  "surface": "backend",
-  "title": "App code never configures logging globally; redaction is centralized",
-  "intent": "Structured logging plus secret/PII redaction is installed once, centrally, at composition. A module that re-points the global logging configuration itself can silently bypass the central redaction filter.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_adhoc_logging_config"
-    }
-  ],
-  "reference": "configure_logging (called by create_app) installs the redacting handlers; logging.basicConfig / dictConfig / fileConfig calls in app modules are refused.",
-  "opt_out": "# arch-allow-no-adhoc-logging-config: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "Global logging mutation is ambient interpreter state with no framework chokepoint to refuse it. The paired protection is constructive rather than preventive: the framework installs redaction on every handler it configures, but cannot intercept a module calling logging.basicConfig at import time."
-  },
-  "guide_topic": "capability",
-  "corpus": true
-}
+{
+  "id": "backend/no_adhoc_logging_config",
+  "surface": "backend",
+  "title": "App code never configures logging globally; redaction is centralized",
+  "intent": "Structured logging plus secret/PII redaction is installed once, centrally, at composition. A module that re-points the global logging configuration itself can silently bypass the central redaction filter.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_adhoc_logging_config"
+    }
+  ],
+  "reference": "configure_logging (called by create_app) installs the redacting handlers; logging.basicConfig / dictConfig / fileConfig calls in app modules are refused.",
+  "opt_out": "# arch-allow-no-adhoc-logging-config: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "Global logging mutation is ambient interpreter state with no framework chokepoint to refuse it. The paired protection is constructive rather than preventive: the framework installs redaction on every handler it configures, but cannot intercept a module calling logging.basicConfig at import time."
+  },
+  "guide_topic": "capability",
+  "corpus": true
+}

package/catalog/backend/no_adhoc_middleware.json

@@ -1,27 +1,27 @@
-{
-  "id": "backend/no_adhoc_middleware",
-  "surface": "backend",
-  "title": "App code never wires HTTP middleware itself; security is centralized",
-  "intent": "Cross-cutting HTTP security (headers, CORS, rate-limit, body-size, request-id) is declared once as central security configuration and installed at composition. A module that registers middleware itself — by call, decorator, or subclassing — is assembling a security posture outside that single control plane.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_adhoc_middleware"
-    },
-    {
-      "kind": "runtime",
-      "tool": "terp.core",
-      "ref": "_freeze_app_middleware_registration"
-    }
-  ],
-  "reference": "SecurityConfig declared once and installed by create_app; add_middleware(...), the @app.middleware(\"http\") decorator, and BaseHTTPMiddleware subclasses are refused in app modules. On the composed app both registration spellings raise BootError at runtime; create_app's middleware parameter is the one sanctioned composition seam.",
-  "opt_out": "# arch-allow-no-adhoc-middleware: <reason>",
-  "runtime": {
-    "applicability": "required",
-    "rationale": "The composition freeze covers the middleware seam: on the composed app, add_middleware(...) and the @app.middleware(...) decorator are replaced by refusers that raise a BootError naming this rule and the sanctioned alternative (create_app's middleware parameter) -- so middleware registered between composition and serving is refused fail-closed, not just flagged at build time."
-  },
-  "guide_topic": "capability",
-  "corpus": true
-}
+{
+  "id": "backend/no_adhoc_middleware",
+  "surface": "backend",
+  "title": "App code never wires HTTP middleware itself; security is centralized",
+  "intent": "Cross-cutting HTTP security (headers, CORS, rate-limit, body-size, request-id) is declared once as central security configuration and installed at composition. A module that registers middleware itself — by call, decorator, or subclassing — is assembling a security posture outside that single control plane.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_adhoc_middleware"
+    },
+    {
+      "kind": "runtime",
+      "tool": "terp.core",
+      "ref": "_freeze_app_middleware_registration"
+    }
+  ],
+  "reference": "SecurityConfig declared once and installed by create_app; add_middleware(...), the @app.middleware(\"http\") decorator, and BaseHTTPMiddleware subclasses are refused in app modules. On the composed app both registration spellings raise BootError at runtime; create_app's middleware parameter is the one sanctioned composition seam.",
+  "opt_out": "# arch-allow-no-adhoc-middleware: <reason>",
+  "runtime": {
+    "applicability": "required",
+    "rationale": "The composition freeze covers the middleware seam: on the composed app, add_middleware(...) and the @app.middleware(...) decorator are replaced by refusers that raise a BootError naming this rule and the sanctioned alternative (create_app's middleware parameter) -- so middleware registered between composition and serving is refused fail-closed, not just flagged at build time."
+  },
+  "guide_topic": "capability",
+  "corpus": true
+}

package/catalog/backend/no_adhoc_permission_literals.json

@@ -1,27 +1,27 @@
-{
-  "id": "backend/no_adhoc_permission_literals",
-  "surface": "backend",
-  "title": "Modules reference typed authority objects, never bare permission strings",
-  "intent": "An authority named as a bare string is invisible to the control plane: it cannot be resolved against the app's declared registry, so a typo or a stale name silently grants nothing (or the wrong thing) instead of failing the build. Citing typed authority objects keeps every permission reference greppable and verifiable against the registry, and lets the runtime normalization chokepoint refuse anything unregistered.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_adhoc_permission_literals"
-    },
-    {
-      "kind": "runtime",
-      "tool": "terp.core",
-      "ref": "requirement_from"
-    }
-  ],
-  "reference": "Role / Permission objects from the control-plane registry; requirement_from raises TypeError on a bare string.",
-  "opt_out": "# arch-allow-no-adhoc-permission-literals: <reason>",
-  "runtime": {
-    "applicability": "required",
-    "rationale": "The typed normalization chokepoint refuses a bare string outright (requirement_from raises TypeError for anything but Role / Permission / the legacy enum), and boot refuses a Policy citing an authority the control plane does not declare."
-  },
-  "guide_topic": "policy",
-  "corpus": true
-}
+{
+  "id": "backend/no_adhoc_permission_literals",
+  "surface": "backend",
+  "title": "Modules reference typed authority objects, never bare permission strings",
+  "intent": "An authority named as a bare string is invisible to the control plane: it cannot be resolved against the app's declared registry, so a typo or a stale name silently grants nothing (or the wrong thing) instead of failing the build. Citing typed authority objects keeps every permission reference greppable and verifiable against the registry, and lets the runtime normalization chokepoint refuse anything unregistered.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_adhoc_permission_literals"
+    },
+    {
+      "kind": "runtime",
+      "tool": "terp.core",
+      "ref": "requirement_from"
+    }
+  ],
+  "reference": "Role / Permission objects from the control-plane registry; requirement_from raises TypeError on a bare string.",
+  "opt_out": "# arch-allow-no-adhoc-permission-literals: <reason>",
+  "runtime": {
+    "applicability": "required",
+    "rationale": "The typed normalization chokepoint refuses a bare string outright (requirement_from raises TypeError for anything but Role / Permission / the legacy enum), and boot refuses a Policy citing an authority the control plane does not declare."
+  },
+  "guide_topic": "policy",
+  "corpus": true
+}

package/catalog/backend/no_app_instantiation.json

@@ -1,22 +1,22 @@
-{
-  "id": "backend/no_app_instantiation",
-  "surface": "backend",
-  "title": "App code never constructs the web application object directly",
-  "intent": "The framework's composer owns app composition (deny-by-default guards, the control plane, the error envelope). A hand-built application object is an application assembled outside the framework — it acquires none of those controls.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_app_instantiation"
-    }
-  ],
-  "reference": "terp.core.create_app composes the app; a bare FastAPI() constructor call is refused.",
-  "opt_out": "# arch-allow-no-app-instantiation: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "A raw FastAPI() is an ordinary object the framework never sees: it acquires no guard, middleware, or error envelope -- and offers no seam through which terp.core could refuse its construction. Only composition through create_app passes framework-owned surface; the rule keeps authorship inside it."
-  },
-  "guide_topic": "capability",
-  "corpus": true
-}
+{
+  "id": "backend/no_app_instantiation",
+  "surface": "backend",
+  "title": "App code never constructs the web application object directly",
+  "intent": "The framework's composer owns app composition (deny-by-default guards, the control plane, the error envelope). A hand-built application object is an application assembled outside the framework — it acquires none of those controls.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_app_instantiation"
+    }
+  ],
+  "reference": "terp.core.create_app composes the app; a bare FastAPI() constructor call is refused.",
+  "opt_out": "# arch-allow-no-app-instantiation: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "A raw FastAPI() is an ordinary object the framework never sees: it acquires no guard, middleware, or error envelope -- and offers no seam through which terp.core could refuse its construction. Only composition through create_app passes framework-owned surface; the rule keeps authorship inside it."
+  },
+  "guide_topic": "capability",
+  "corpus": true
+}

package/catalog/backend/no_blocking_sleep.json

@@ -1,22 +1,22 @@
-{
-  "id": "backend/no_blocking_sleep",
-  "surface": "backend",
-  "title": "Never block the thread with a synchronous sleep",
-  "intent": "A synchronous sleep parks the thread that is serving the request or running the job, so the whole worker sits idle and the pool starves under load. Waiting must yield the thread — poll with an awaitable, schedule a delayed job, or let the runtime back off — never freeze it.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_blocking_sleep"
-    }
-  ],
-  "reference": "A call to the standard library's time.sleep() is refused; use a non-blocking wait or a scheduled job.",
-  "opt_out": "# arch-allow-no-blocking-sleep: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "The invariant is a property of the authored call. At execution time a blocking sleep is a normal function call on the stack, and by the time it runs the thread is already parked — no seam upstream can turn a blocking wait into a yielding one, so the only faithful check refuses the construct in source."
-  },
-  "guide_topic": "jobs",
-  "corpus": true
-}
+{
+  "id": "backend/no_blocking_sleep",
+  "surface": "backend",
+  "title": "Never block the thread with a synchronous sleep",
+  "intent": "A synchronous sleep parks the thread that is serving the request or running the job, so the whole worker sits idle and the pool starves under load. Waiting must yield the thread — poll with an awaitable, schedule a delayed job, or let the runtime back off — never freeze it.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_blocking_sleep"
+    }
+  ],
+  "reference": "A call to the standard library's time.sleep() is refused; use a non-blocking wait or a scheduled job.",
+  "opt_out": "# arch-allow-no-blocking-sleep: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The invariant is a property of the authored call. At execution time a blocking sleep is a normal function call on the stack, and by the time it runs the thread is already parked — no seam upstream can turn a blocking wait into a yielding one, so the only faithful check refuses the construct in source."
+  },
+  "guide_topic": "jobs",
+  "corpus": true
+}

package/catalog/backend/no_cross_module_imports.json

@@ -1,21 +1,21 @@
-{
-  "id": "backend/no_cross_module_imports",
-  "surface": "backend",
-  "title": "A module never imports a sibling module (leaf domains stay independent)",
-  "intent": "Modules couple only through the platform surface and their own files — a sibling import creates hidden coupling that breaks module isolation and independent evolution. Both absolute and relative sibling imports are caught: a relative import is resolved to its absolute module first, so renaming the import style does not re-couple two leaf modules.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_cross_module_imports"
-    }
-  ],
-  "opt_out": "# arch-allow-no-cross-module-imports: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "Module independence is an import-graph property of the source tree. At runtime the composed app legitimately holds every module in one process, so a cross-module reference is indistinguishable from composition itself."
-  },
-  "guide_topic": "module",
-  "corpus": true
-}
+{
+  "id": "backend/no_cross_module_imports",
+  "surface": "backend",
+  "title": "A module never imports a sibling module (leaf domains stay independent)",
+  "intent": "Modules couple only through the platform surface and their own files — a sibling import creates hidden coupling that breaks module isolation and independent evolution. Both absolute and relative sibling imports are caught: a relative import is resolved to its absolute module first, so renaming the import style does not re-couple two leaf modules.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_cross_module_imports"
+    }
+  ],
+  "opt_out": "# arch-allow-no-cross-module-imports: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "Module independence is an import-graph property of the source tree. At runtime the composed app legitimately holds every module in one process, so a cross-module reference is indistinguishable from composition itself."
+  },
+  "guide_topic": "module",
+  "corpus": true
+}

package/catalog/backend/no_dependency_overrides.json

@@ -1,27 +1,27 @@
-{
-  "id": "backend/no_dependency_overrides",
-  "surface": "backend",
-  "title": "App code never rebinds the composed app's dependency injections",
-  "intent": "Composition binds the authentication and session seams once. Rebinding the app's dependency-override map in app code (e.g. replacing the principal provider) silently disables authentication or swaps the database session outside every guard. Overrides are a TEST-ONLY seam; application code has no legitimate use.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_dependency_overrides"
-    },
-    {
-      "kind": "runtime",
-      "tool": "terp.core",
-      "ref": "_freeze_dependency_overrides"
-    }
-  ],
-  "reference": "app.dependency_overrides on the create_app-composed app is the refused surface; composition binds the seams (create_app(principal_provider=...)) before the freeze.",
-  "opt_out": "# arch-allow-no-dependency-overrides: <reason>",
-  "runtime": {
-    "applicability": "required",
-    "rationale": "Outside the local environment the composed app's dependency-override map is replaced by a refusing mapping: every mutating spelling raises a BootError naming this rule while per-request override reads keep working. The local environment deliberately keeps the map writable -- overrides are the sanctioned test-only seam (a local test suite rebinding the session against a scratch engine), which is exactly the legitimate use the rule's intent carves out; a deployed app can never rebind its auth or session seams post-composition."
-  },
-  "guide_topic": "capability",
-  "corpus": true
-}
+{
+  "id": "backend/no_dependency_overrides",
+  "surface": "backend",
+  "title": "App code never rebinds the composed app's dependency injections",
+  "intent": "Composition binds the authentication and session seams once. Rebinding the app's dependency-override map in app code (e.g. replacing the principal provider) silently disables authentication or swaps the database session outside every guard. Overrides are a TEST-ONLY seam; application code has no legitimate use.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_dependency_overrides"
+    },
+    {
+      "kind": "runtime",
+      "tool": "terp.core",
+      "ref": "_freeze_dependency_overrides"
+    }
+  ],
+  "reference": "app.dependency_overrides on the create_app-composed app is the refused surface; composition binds the seams (create_app(principal_provider=...)) before the freeze.",
+  "opt_out": "# arch-allow-no-dependency-overrides: <reason>",
+  "runtime": {
+    "applicability": "required",
+    "rationale": "Outside the local environment the composed app's dependency-override map is replaced by a refusing mapping: every mutating spelling raises a BootError naming this rule while per-request override reads keep working. The local environment deliberately keeps the map writable -- overrides are the sanctioned test-only seam (a local test suite rebinding the session against a scratch engine), which is exactly the legitimate use the rule's intent carves out; a deployed app can never rebind its auth or session seams post-composition."
+  },
+  "guide_topic": "capability",
+  "corpus": true
+}

package/catalog/backend/no_destructive_migrations.json

@@ -1,22 +1,22 @@
-{
-  "id": "backend/no_destructive_migrations",
-  "surface": "backend",
-  "title": "Destructive migration operations require a reason-bearing marker",
-  "intent": "Dropping a table or column, changing a column's type, and executing raw destructive statements in an upgrade can destroy data or make rollback unsafe — whether spelled directly, on a batch block, through an alias, or smuggled into a raw statement. Each destructive operation is a violation; a reviewed one is justified through the standard governed escape hatch — a justified marker on (or immediately above) the operation, counted against the app's budget ratchet — so every accepted risk is explicit, reviewable, greppable, and ratcheted like any other opt-out.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_destructive_migrations"
-    }
-  ],
-  "reference": "drop_table / drop_column / type-changing alter_column and execute(...) of DROP TABLE / DROP COLUMN / TRUNCATE / DELETE FROM / ALTER TABLE ... DROP in upgrade() are flagged per operation; the standard # arch-allow-no-destructive-migrations marker (budgeted) justifies a reviewed one. The pre-0.6.0 file-level terp-allow-destructive-migration waiver is retired.",
-  "opt_out": "# arch-allow-no-destructive-migrations: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "The invariant is reviewability of the authored revision: a reason-bearing marker is a comment, invisible to Alembic when the DDL executes. What could be checked at apply time is a different (op-classification) control; the justified-marker contract itself only exists in source."
-  },
-  "guide_topic": "migrations",
-  "corpus": true
-}
+{
+  "id": "backend/no_destructive_migrations",
+  "surface": "backend",
+  "title": "Destructive migration operations require a reason-bearing marker",
+  "intent": "Dropping a table or column, changing a column's type, and executing raw destructive statements in an upgrade can destroy data or make rollback unsafe — whether spelled directly, on a batch block, through an alias, or smuggled into a raw statement. Each destructive operation is a violation; a reviewed one is justified through the standard governed escape hatch — a justified marker on (or immediately above) the operation, counted against the app's budget ratchet — so every accepted risk is explicit, reviewable, greppable, and ratcheted like any other opt-out.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_destructive_migrations"
+    }
+  ],
+  "reference": "drop_table / drop_column / type-changing alter_column and execute(...) of DROP TABLE / DROP COLUMN / TRUNCATE / DELETE FROM / ALTER TABLE ... DROP in upgrade() are flagged per operation; the standard # arch-allow-no-destructive-migrations marker (budgeted) justifies a reviewed one. The pre-0.6.0 file-level terp-allow-destructive-migration waiver is retired.",
+  "opt_out": "# arch-allow-no-destructive-migrations: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The invariant is reviewability of the authored revision: a reason-bearing marker is a comment, invisible to Alembic when the DDL executes. What could be checked at apply time is a different (op-classification) control; the justified-marker contract itself only exists in source."
+  },
+  "guide_topic": "migrations",
+  "corpus": true
+}

package/catalog/backend/no_dynamic_sql.json

@@ -1,22 +1,22 @@
-{
-  "id": "backend/no_dynamic_sql",
-  "surface": "backend",
-  "title": "Raw SQL text in app modules must be a static literal, never dynamically built",
-  "intent": "A raw-SQL construct built dynamically — through interpolation, concatenation, format calls, or a variable — is not statically reviewable and is easy to turn into SQL injection. Keep SQL as a literal and pass data through bound parameters / the query builder's typed expressions instead. As a security rule this also scans test and migration files inside a module — they are importable code, so they are application surface too.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_dynamic_sql"
-    }
-  ],
-  "reference": "text(...) / sqlalchemy.text(...) with an f-string, concatenation, .format, % formatting, or a variable is refused; SQLAlchemy bound parameters / ORM expressions are the compliant path.",
-  "opt_out": "# arch-allow-no-dynamic-sql: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "The invariant is a property of the authored source: whether SQL text was written as a static, reviewable literal. At execution time every statement is just a string \u2014 how it was built is erased, so no runtime seam can distinguish a vetted literal from concatenated input. The adjacent runtime protections are different controls: the write guard refuses smuggled DML (mutations_emit_audit) and parameter binding is the compliant data path."
-  },
-  "guide_topic": "service",
-  "corpus": true
-}
+{
+  "id": "backend/no_dynamic_sql",
+  "surface": "backend",
+  "title": "Raw SQL text in app modules must be a static literal, never dynamically built",
+  "intent": "A raw-SQL construct built dynamically — through interpolation, concatenation, format calls, or a variable — is not statically reviewable and is easy to turn into SQL injection. Keep SQL as a literal and pass data through bound parameters / the query builder's typed expressions instead. As a security rule this also scans test and migration files inside a module — they are importable code, so they are application surface too.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_dynamic_sql"
+    }
+  ],
+  "reference": "text(...) / sqlalchemy.text(...) with an f-string, concatenation, .format, % formatting, or a variable is refused; SQLAlchemy bound parameters / ORM expressions are the compliant path.",
+  "opt_out": "# arch-allow-no-dynamic-sql: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The invariant is a property of the authored source: whether SQL text was written as a static, reviewable literal. At execution time every statement is just a string \u2014 how it was built is erased, so no runtime seam can distinguish a vetted literal from concatenated input. The adjacent runtime protections are different controls: the write guard refuses smuggled DML (mutations_emit_audit) and parameter binding is the compliant data path."
+  },
+  "guide_topic": "service",
+  "corpus": true
+}

package/catalog/backend/no_empty_tests.json

@@ -1,22 +1,22 @@
-{
-  "id": "backend/no_empty_tests",
-  "surface": "backend",
-  "title": "Every test must assert a real outcome",
-  "intent": "A test whose body is empty, is only a docstring or a bare pass, or asserts a constant that can never fail, passes unconditionally — it exercises nothing yet reports green, giving false confidence that the behaviour it names is covered. A test must drive real behaviour and assert a real result.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_empty_tests"
-    }
-  ],
-  "reference": "A test_* function with an empty body, a lone pass, or a single assertion of a constant truthy value is refused. The scan covers every test_*.py file — the test tree the other source rules deliberately skip.",
-  "opt_out": "# arch-allow-no-empty-tests: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "The invariant is a property of the authored test source, evaluated at build time in the test suite itself; there is no production runtime seam that observes whether a test asserts anything. Only a source-form check can see the empty body."
-  },
-  "guide_topic": "rules",
-  "corpus": true
-}
+{
+  "id": "backend/no_empty_tests",
+  "surface": "backend",
+  "title": "Every test must assert a real outcome",
+  "intent": "A test whose body is empty, is only a docstring or a bare pass, or asserts a constant that can never fail, passes unconditionally — it exercises nothing yet reports green, giving false confidence that the behaviour it names is covered. A test must drive real behaviour and assert a real result.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_empty_tests"
+    }
+  ],
+  "reference": "A test_* function with an empty body, a lone pass, or a single assertion of a constant truthy value is refused. The scan covers every test_*.py file — the test tree the other source rules deliberately skip.",
+  "opt_out": "# arch-allow-no-empty-tests: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The invariant is a property of the authored test source, evaluated at build time in the test suite itself; there is no production runtime seam that observes whether a test asserts anything. Only a source-form check can see the empty body."
+  },
+  "guide_topic": "rules",
+  "corpus": true
+}

package/catalog/backend/no_eval_or_exec.json

@@ -1,22 +1,22 @@
-{
-  "id": "backend/no_eval_or_exec",
-  "surface": "backend",
-  "title": "Never execute a string as code",
-  "intent": "Turning a runtime string into executed code is a code-injection hole: any value an attacker can influence on its way into the evaluator becomes arbitrary code the process runs. There is no safe in-app use — parse the data into a structure, dispatch on a lookup table, or import a real module instead of evaluating text.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_eval_or_exec"
-    }
-  ],
-  "reference": "Calls to the eval() and exec() builtins are refused. The scan covers the whole importable tree — including tests and migrations — because any Python that runs is in scope.",
-  "opt_out": "# arch-allow-no-eval-or-exec: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "The invariant is a property of the authored source: whether a dynamic-execution builtin was written. By the time the process runs, an evaluated string is indistinguishable from ordinary control flow, and no runtime seam upstream can tell a vetted call from an injected one — the only faithful check is refusing the construct in source."
-  },
-  "guide_topic": "capability",
-  "corpus": true
-}
+{
+  "id": "backend/no_eval_or_exec",
+  "surface": "backend",
+  "title": "Never execute a string as code",
+  "intent": "Turning a runtime string into executed code is a code-injection hole: any value an attacker can influence on its way into the evaluator becomes arbitrary code the process runs. There is no safe in-app use — parse the data into a structure, dispatch on a lookup table, or import a real module instead of evaluating text.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_eval_or_exec"
+    }
+  ],
+  "reference": "Calls to the eval() and exec() builtins are refused. The scan covers the whole importable tree — including tests and migrations — because any Python that runs is in scope.",
+  "opt_out": "# arch-allow-no-eval-or-exec: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The invariant is a property of the authored source: whether a dynamic-execution builtin was written. By the time the process runs, an evaluated string is indistinguishable from ordinary control flow, and no runtime seam upstream can tell a vetted call from an injected one — the only faithful check is refusing the construct in source."
+  },
+  "guide_topic": "capability",
+  "corpus": true
+}

package/catalog/backend/no_hardcoded_credentials.json

@@ -1,21 +1,21 @@
-{
-  "id": "backend/no_hardcoded_credentials",
-  "surface": "backend",
-  "title": "App modules do not hard-code credentials or recognizable secret tokens",
-  "intent": "A credential-shaped assignment to a non-empty string literal is almost always a secret that should come from sealed config / environment wiring, not source. The rule also rejects common high-confidence secret literal formats anywhere in a module so leaked keys are caught even when assigned to a bland variable name. As a security rule this also scans test and migration files inside a module — a real secret is a leak wherever it is committed.",
-  "layer": "static-portable",
-  "enforcement": [
-    {
-      "kind": "build-time",
-      "tool": "terp.arch",
-      "ref": "check_no_hardcoded_credentials"
-    }
-  ],
-  "opt_out": "# arch-allow-no-hardcoded-credentials: <reason>",
-  "runtime": {
-    "applicability": "not-applicable",
-    "rationale": "At runtime a credential is a string wherever it came from: a source literal and an injected environment value are indistinguishable once loaded. 'It was committed to the repository' is a source-tree fact only a source scan can state."
-  },
-  "guide_topic": "capability",
-  "corpus": true
-}
+{
+  "id": "backend/no_hardcoded_credentials",
+  "surface": "backend",
+  "title": "App modules do not hard-code credentials or recognizable secret tokens",
+  "intent": "A credential-shaped assignment to a non-empty string literal is almost always a secret that should come from sealed config / environment wiring, not source. The rule also rejects common high-confidence secret literal formats anywhere in a module so leaked keys are caught even when assigned to a bland variable name. As a security rule this also scans test and migration files inside a module — a real secret is a leak wherever it is committed.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "terp.arch",
+      "ref": "check_no_hardcoded_credentials"
+    }
+  ],
+  "opt_out": "# arch-allow-no-hardcoded-credentials: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "At runtime a credential is a string wherever it came from: a source literal and an injected environment value are indistinguishable once loaded. 'It was committed to the repository' is a source-tree fact only a source scan can state."
+  },
+  "guide_topic": "capability",
+  "corpus": true
+}