@terpjs/spec 0.14.0

package/catalog/frontend/no-cross-module-imports.json

@@ -0,0 +1,21 @@
+{
+  "id": "frontend/no-cross-module-imports",
+  "surface": "frontend",
+  "title": "An app module never imports a sibling module",
+  "intent": "Modules couple only through the platform packages and their own files. A sibling import — static, dynamic import(), relative or via the app alias — creates hidden coupling that breaks module isolation and independent evolution.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-cross-module-imports",
+      "reported_as": "terp/no-cross-module-imports"
+    }
+  ],
+  "opt_out": "// terp-allow-no-cross-module-imports: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "Module independence is an import-graph property of the source tree; the bundler merges every module into one dependency graph, after which a cross-module edge is indistinguishable from composition."
+  },
+  "corpus": true
+}

package/catalog/frontend/no-deep-imports.json

@@ -0,0 +1,25 @@
+{
+  "id": "frontend/no-deep-imports",
+  "surface": "frontend",
+  "title": "App modules import platform packages from the root only",
+  "intent": "A deep import into a platform package's internals couples the app to files that are free to move; the package root is the published, stable surface. The refused path segments are declared in restricted-surface.json (deepImportPathSegments).",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.internalImportPatterns",
+      "reported_as": "no-restricted-imports"
+    }
+  ],
+  "reference": "@terp/*/src/* and @terp/*/dist/* imports are refused; import from the @terp/* package root.",
+  "opt_out": "// terp-allow-no-deep-imports: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "Package-boundary form: the bundler resolves and inlines whatever was imported, and the built artifact retains no distinction between a root import and a deep one."
+  },
+  "restricted_surface": [
+    "deepImportPathSegments"
+  ],
+  "corpus": true
+}

package/catalog/frontend/no-dom-html-injection.json

@@ -0,0 +1,22 @@
+{
+  "id": "frontend/no-dom-html-injection",
+  "surface": "frontend",
+  "title": "DOM HTML-injection sinks are refused in app modules",
+  "intent": "dangerouslySetInnerHTML, innerHTML/outerHTML assignment, insertAdjacentHTML and document.write inject markup that bypasses the framework's output escaping — the canonical XSS sink. Rich text renders through the stack's sanctioned rich-text component instead.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-dom-html-injection",
+      "reported_as": "terp/no-dom-html-injection"
+    }
+  ],
+  "reference": "The Markdown component from @terp/react-core for rich text.",
+  "opt_out": "// terp-allow-no-dom-html-injection: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The sinks are platform primitives on every element; React's default output escaping is the ambient constructive protection and the sanctioned Markdown component sanitises rich text. A runtime hook over every element's HTML mutation is not a seam react-core owns or could make sound -- vendored code legitimately uses the same primitives."
+  },
+  "corpus": true
+}

package/catalog/frontend/no-eval.json

@@ -0,0 +1,21 @@
+{
+  "id": "frontend/no-eval",
+  "surface": "frontend",
+  "title": "eval() and new Function() are refused in app modules",
+  "intent": "Runtime code evaluation defeats every static guarantee the boundary provides and is a classic injection primitive. There is no sanctioned dynamic-code path in an app module.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-eval",
+      "reported_as": "terp/no-eval"
+    }
+  ],
+  "opt_out": "// terp-allow-no-eval: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The prohibition is on authoring dynamic-code primitives in app modules \u2014 a source-form fact. In the running bundle the primitive itself is a platform global the framework cannot remove, and legitimately vendored code may reference it, so a runtime hook cannot attribute authorship to an app module. Deployment-level CSP can harden the served app, but it is deployment configuration, not a control this framework owns per rule."
+  },
+  "corpus": true
+}

package/catalog/frontend/no-inline-styling.json

@@ -0,0 +1,25 @@
+{
+  "id": "frontend/no-inline-styling",
+  "surface": "frontend",
+  "title": "style and className attributes are refused in app modules",
+  "intent": "A style or className attribute is a side channel into hand-authored CSS that drifts per screen; styling flows from the app's design tokens and sanctioned layout primitives only. The refused attributes are declared in restricted-surface.json (restrictedAttributes).",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.restrictedAttributes",
+      "reported_as": "no-restricted-syntax"
+    }
+  ],
+  "reference": "Layout via Stack, DetailList and the page archetypes from @terp/react-core; theming via the app's token source.",
+  "opt_out": "// terp-allow-no-inline-styling: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "style/className are authoring-surface attributes: the token pipeline itself emits inline styles and class names into the built DOM, so their presence at runtime is legitimate and unattributable to app authorship."
+  },
+  "restricted_surface": [
+    "restrictedAttributes"
+  ],
+  "corpus": true
+}

package/catalog/frontend/no-style-imports.json

@@ -0,0 +1,24 @@
+{
+  "id": "frontend/no-style-imports",
+  "surface": "frontend",
+  "title": "Module-authored stylesheets are refused",
+  "intent": "Importing a stylesheet from an app module reintroduces per-screen CSS; theming flows from the app's token source only. The refused stylesheet extensions are declared in restricted-surface.json (styleImportExtensions).",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.styleImportPatterns",
+      "reported_as": "no-restricted-imports"
+    }
+  ],
+  "opt_out": "// terp-allow-no-style-imports: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "A stylesheet import is a build-graph edge; the bundler compiles it into the emitted CSS, after which module authorship does not exist."
+  },
+  "restricted_surface": [
+    "styleImportExtensions"
+  ],
+  "corpus": true
+}

package/catalog/frontend/no-unsafe-href.json

@@ -0,0 +1,21 @@
+{
+  "id": "frontend/no-unsafe-href",
+  "surface": "frontend",
+  "title": "javascript: URLs are refused in app modules",
+  "intent": "A javascript: href executes script on click \u2014 an XSS vector that survives the framework's attribute escaping. Links carry http(s), mailto, tel or in-app router paths only.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-unsafe-href",
+      "reported_as": "terp/no-unsafe-href"
+    }
+  ],
+  "opt_out": "// terp-allow-no-unsafe-href: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The refusal is of authoring javascript: URLs in source. Data-driven links are the sanctioned components' own concern (the Markdown component strips unsafe protocols at render -- its control, not this rule's), and raw anchors are refused wholesale in app modules anyway."
+  },
+  "corpus": true
+}

package/catalog/frontend/no-unsafe-target-blank.json

@@ -0,0 +1,21 @@
+{
+  "id": "frontend/no-unsafe-target-blank",
+  "surface": "frontend",
+  "title": "A static target=\"_blank\" link declares rel=\"noopener\"",
+  "intent": "Without rel=noopener the opened page holds a window.opener reference to the app \u2014 the reverse-tabnabbing primitive. The rule enforces the safe default on every statically-authored external link.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "terp/no-unsafe-target-blank",
+      "reported_as": "terp/no-unsafe-target-blank"
+    }
+  ],
+  "opt_out": "// terp-allow-no-unsafe-target-blank: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "An authored static target=_blank without rel is a source form; the residual risk it addresses is legacy-engine reverse-tabnabbing, fixable only where the anchor is written. Modern engines default to noopener behaviour, and raw anchors are refused wholesale in app modules regardless."
+  },
+  "corpus": true
+}

package/catalog/frontend/router-links.json

@@ -0,0 +1,22 @@
+{
+  "id": "frontend/router-links",
+  "surface": "frontend",
+  "title": "In-app links go through the router, never a raw anchor",
+  "intent": "A raw <a href=\"/...\"> forces a full reload and skips the role-aware route guard; in-app navigation uses the stack's router-integrated link. External https:// anchors stay allowed.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.restrictInAppAnchors",
+      "reported_as": "no-restricted-syntax"
+    }
+  ],
+  "reference": "Link from @terp/react-core (router-integrated, role-aware).",
+  "opt_out": "// terp-allow-router-links: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "In the rendered DOM the router's own Link IS an anchor -- raw-anchor authorship is only visible in source, so no DOM check can distinguish a sanctioned link from a hand-written one."
+  },
+  "corpus": true
+}

package/catalog/frontend/token-styled-elements.json

@@ -0,0 +1,25 @@
+{
+  "id": "frontend/token-styled-elements",
+  "surface": "frontend",
+  "title": "Raw interactive/structural HTML elements are refused in app modules",
+  "intent": "A raw <button>/<input>/<select>/<textarea>/<table>/<dialog>/<form> bypasses the app's sanctioned, token-styled primitive surface (accessible and theme-consistent by construction). The refused elements are declared in restricted-surface.json (restrictedElements); each has a sanctioned replacement in the stack's component surface, and the violation message names it.",
+  "layer": "static-portable",
+  "enforcement": [
+    {
+      "kind": "build-time",
+      "tool": "@terp/eslint-boundaries",
+      "ref": "BOUNDARY_SPEC.restrictedElements",
+      "reported_as": "no-restricted-syntax"
+    }
+  ],
+  "reference": "Button, Input, Select, Textarea, DataView, ConfirmDialog and Stack as=\"form\" from @terp/react-core (BOUNDARY_SPEC.restrictedElements maps each element to its replacement).",
+  "opt_out": "// terp-allow-token-styled-elements: <reason>",
+  "runtime": {
+    "applicability": "not-applicable",
+    "rationale": "The sanctioned components themselves render the raw elements into the built DOM -- every button on screen is legitimate output of Button. Compilation erases which JSX authored a node, and third-party components legitimately render the same primitives, so a DOM scan cannot soundly attribute a raw element to app authorship (unlike the layout contract's slot check, which verifies the identity of sanctioned components at one owned seam)."
+  },
+  "restricted_surface": [
+    "restrictedElements"
+  ],
+  "corpus": true
+}

package/catalog/schema.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://terp.dev/spec/catalog/schema.json",
+  "title": "Terp Standard catalog entry",
+  "description": "One enforced Terp rule as data (ADR 0080). The file lives at catalog/<surface>/<rule>.json and its id must equal '<surface>/<rule>'. The spec version an entry belongs to is the checked-in spec/VERSION.",
+  "type": "object",
+  "required": ["id", "surface", "title", "intent", "layer", "enforcement", "runtime", "corpus"],
+  "additionalProperties": false,
+  "properties": {
+    "id": {
+      "type": "string",
+      "description": "Stack-neutral rule id: backend/<snake_case> or frontend/<kebab-case>. Findings are attributed to this id (see ../findings.schema.json).",
+      "pattern": "^(backend/[a-z0-9_]+|frontend/[a-z0-9-]+)$"
+    },
+    "surface": { "enum": ["backend", "frontend"] },
+    "title": { "type": "string", "minLength": 1 },
+    "intent": { "type": "string", "minLength": 1 },
+    "layer": {
+      "description": "Cheapest faithful verification for a NEW stack: black-box (probe a running app), static-portable (generic source patterns), static-bespoke (needs deep framework knowledge).",
+      "enum": ["black-box", "static-portable", "static-bespoke"]
+    },
+    "enforcement": {
+      "description": "How the reference implementation enforces the rule today. At least one build-time entry; a 'runtime' entry records the fail-closed runtime half of the two-layer discipline, and a 'black-box' entry names the conformance-suite probe.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["kind", "tool", "ref"],
+        "additionalProperties": false,
+        "properties": {
+          "kind": { "enum": ["build-time", "runtime", "black-box"] },
+          "tool": { "type": "string", "minLength": 1 },
+          "ref": { "type": "string", "minLength": 1 },
+          "reported_as": {
+            "type": "string",
+            "description": "Frontend build-time only: the ESLint rule id violations surface as. Several catalog rules share a core rule id, so conformance findings are attributed via the adapter's catalogRuleId mapping, never this field."
+          }
+        }
+      }
+    },
+    "runtime": {
+      "description": "The rule's runtime-applicability classification: whether the two-layer discipline pairs this build-time rule with a fail-closed runtime control. 'required' means the reference implementation owns such a control and the entry declares it (a kind 'runtime' enforcement entry whose ref must resolve — the parity test fails otherwise). 'not-applicable' means the invariant is a property of the authored artifact (source form, imports, markers, checked-in files) that is erased or already materialised by the time the app runs, so no runtime seam can enforce it — the rationale states why. 'deferred' means a runtime control would add independent fidelity on a seam the framework owns but has not shipped yet — an explicit, reviewed gap, never a silent one. Coherence is held by the spec suite: 'required' iff a kind 'runtime' enforcement entry exists; an exemption always carries a rationale.",
+      "type": "object",
+      "required": ["applicability"],
+      "additionalProperties": false,
+      "properties": {
+        "applicability": { "enum": ["required", "not-applicable", "deferred"] },
+        "rationale": {
+          "type": "string",
+          "description": "Why the rule is exempt from the runtime half (mandatory for 'not-applicable' and 'deferred'; optional for 'required', e.g. to record which vector the control covers).",
+          "minLength": 1
+        },
+        "tracking": {
+          "type": "string",
+          "description": "Where the deferral is tracked (mandatory for 'deferred', held by the spec suite): an issue URL, or the reference implementation's tracker document plus the named seam — so a deferred runtime control has a lifecycle instead of being an open-ended gap.",
+          "minLength": 1
+        }
+      }
+    },
+    "restricted_surface": {
+      "type": "array",
+      "description": "The restricted-surface.json keys this rule realises (frontend prohibition rules only). The structural half of the citation: the spec suite resolves each key against the refused surface and requires every key to be claimed by some rule, so the linkage never depends on parsing prose.",
+      "minItems": 1,
+      "items": {
+        "enum": [
+          "restrictedElements",
+          "restrictedAttributes",
+          "restrictedGlobals",
+          "restrictedMemberCalls",
+          "styleImportExtensions",
+          "deepImportPathSegments"
+        ]
+      }
+    },
+    "reference": {
+      "type": "string",
+      "description": "Reference-implementation metadata: the compliant realisation the reference stack offers (component / helper names). Not normative — the title and intent state the stack-neutral invariant; another stack ships its own realisation.",
+      "minLength": 1
+    },
+    "opt_out": {
+      "type": "string",
+      "description": "The reference realisation of the abstract escape-hatch contract: a justified inline marker naming the CATALOG RULE NAME (the <rule> half of the id — never a tool-internal rule id, mirroring findings attribution), counted against the app's checked-in budget ratchet. Another stack implements the same contract with its own comment syntax; only the semantics are normative. Omitted exactly by the escape-hatch governance rules themselves (the budget ratchet, the ungoverned-marker condition) — governance cannot be waived by the mechanism it governs. The spec suite holds both the derivation and the omissions.",
+      "minLength": 1
+    },
+    "guide_topic": {
+      "type": "string",
+      "description": "Reference-implementation metadata (backend only): the `terp guide` topic teaching the compliant pattern. Not normative for other stacks.",
+      "minLength": 1
+    },
+    "corpus": {
+      "type": "boolean",
+      "description": "Whether corpus/<id>/ cases exist (held to the directory truth by the parity test; a covered rule needs at least one violation-* AND one compliant-* case)."
+    }
+  }
+}

package/corpus/PENDING.json

@@ -0,0 +1,4 @@
+{
+  "_comment": "The corpus-coverage ratchet: every catalog rule still WITHOUT corpus cases, exactly. Seeding a rule's corpus removes it here (the list only shrinks); a new rule without corpus must be added here explicitly, so uncovered rules stay visible and reviewed. Held to the catalog truth by tests/architecture/test_spec_catalog.py.",
+  "pending": []
+}

package/corpus/RESIDUALS.json

@@ -0,0 +1,21 @@
+{
+  "_comment": "The detector-residual ratchet: the statically-erased or renamed forms DELIBERATELY outside the corpus contract, per rule — known limits of precise, low-false-positive detection, recorded as data so a second implementation neither over-fits nor under-claims. Governed like corpus/PENDING.json: the list only shrinks — closing a residual means seeding the corpus case that contracts it and deleting the entry here, never silently. Every key must be a catalog rule id; held to the catalog by tests/test_standard.py.",
+  "residuals": {
+    "backend/no_dynamic_sql": [
+      "an alias-renamed symbol import (`from sqlalchemy import text as sql_text`) is not required to be resolved to `text`"
+    ],
+    "backend/no_raw_outbound_http": [
+      "dynamic import (`importlib.import_module(\"httpx\")`) is not required to be seen as an import"
+    ],
+    "frontend/generated-client-only": [
+      "egress through receivers other than `window`/`globalThis` (`self.fetch`) is not required"
+    ],
+    "frontend/no-dom-html-injection": [
+      "a computed sink (`el[\"innerHTML\"] = ...`) is not required to be recognised"
+    ],
+    "frontend/no-eval": [
+      "`Function(\"...\")` called without `new` is not required",
+      "a computed global (`window[\"eval\"]`) is not required to be recognised"
+    ]
+  }
+}

package/corpus/backend/alembic_downgrades_not_empty/compliant-01/modules/notes/migrations/versions/0001_change.py

@@ -0,0 +1,6 @@
+def upgrade():
+    op.add_column("notes", column)
+
+
+def downgrade():
+    op.drop_column("notes", "title")

package/corpus/backend/alembic_downgrades_not_empty/violation-01/modules/notes/migrations/versions/0001_change.py

@@ -0,0 +1,6 @@
+def upgrade():
+    op.add_column("notes", column)
+
+
+def downgrade():
+    pass

package/corpus/backend/base_query_not_overridden/compliant-01/modules/notes/service.py

@@ -0,0 +1,8 @@
+from terp.core import BaseService
+
+
+class NoteService(BaseService):
+    model = Note
+
+    def business_filters(self):
+        return [Note.archived == False]

package/corpus/backend/base_query_not_overridden/compliant-02/modules/notes/service.py

@@ -0,0 +1,8 @@
+from terp.core import BaseService
+
+
+class NoteService(BaseService):
+    model = Note
+
+    def business_filters(self):
+        return [Note.archived == False]

package/corpus/backend/base_query_not_overridden/violation-01/modules/notes/service.py

@@ -0,0 +1,8 @@
+from terp.core import BaseService
+
+
+class NoteService(BaseService):
+    model = Note
+
+    def base_query(self):
+        return super().base_query().where(Note.archived == False)

package/corpus/backend/base_query_not_overridden/violation-02/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/base_query_not_overridden",
+    "path": "modules/notes/service.py",
+    "line": 7
+  }
+]

package/corpus/backend/base_query_not_overridden/violation-02/modules/notes/service.py

@@ -0,0 +1,8 @@
+from terp.core import BaseService
+
+
+class NoteService(BaseService):
+    model = Note
+
+    async def base_query(self):
+        return (await super().base_query()).where(Note.archived == False)

package/corpus/backend/canonical_module_shape/compliant-01/modules/notes/models.py

@@ -0,0 +1,6 @@
+from sqlmodel import Field
+from terp.core import BaseTable
+
+
+class Note(BaseTable, table=True):
+    title: str = Field(max_length=200)

package/corpus/backend/canonical_module_shape/compliant-01/modules/notes/module.py

@@ -0,0 +1,7 @@
+from terp.core import ModuleSpec, Policy, Roles
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(read=Roles.VIEWER, write=Roles.EDITOR),
+)

package/corpus/backend/canonical_module_shape/compliant-01/modules/notes/router.py

@@ -0,0 +1,3 @@
+@router.get('/', response_model=Page[NoteRead])
+def list_notes() -> Page[NoteRead]:
+    return Page()

package/corpus/backend/canonical_module_shape/compliant-01/modules/notes/schemas.py

@@ -0,0 +1,10 @@
+from sqlmodel import Field
+from terp.core import BaseSchema
+
+
+class NoteCreate(BaseSchema):
+    title: str = Field(max_length=200)
+
+
+class NoteRead(BaseSchema):
+    title: str

package/corpus/backend/canonical_module_shape/compliant-01/modules/notes/service.py

@@ -0,0 +1,5 @@
+from terp.core import BaseService
+
+
+class NoteService(BaseService):
+    model = Note

package/corpus/backend/canonical_module_shape/violation-01/modules/notes/router.py

@@ -0,0 +1,3 @@
+@router.get('/', response_model=Page[NoteRead])
+def list_notes() -> Page[NoteRead]:
+    return Page()

package/corpus/backend/datetime_columns_are_timezone_aware/compliant-01/modules/notes/models.py

@@ -0,0 +1,12 @@
+from datetime import datetime
+
+from sqlalchemy import DateTime
+from sqlmodel import Field
+
+from terp.core import BaseTable
+
+
+class Note(BaseTable, table=True):
+    title: str = Field(max_length=200)
+    # The column type pins the zone, so the stored moment stays unambiguous.
+    due_at: datetime | None = Field(default=None, sa_type=DateTime(timezone=True))

package/corpus/backend/datetime_columns_are_timezone_aware/violation-01/modules/notes/models.py

@@ -0,0 +1,12 @@
+from datetime import datetime
+
+from sqlmodel import Field
+
+from terp.core import BaseTable
+
+
+class Note(BaseTable, table=True):
+    title: str = Field(max_length=200)
+    # No column type is named, so this maps to naive storage: the database
+    # drops the zone of whatever aware value the service hands it.
+    due_at: datetime | None = Field(default=None, index=True)

package/corpus/backend/datetime_columns_are_timezone_aware/violation-02/modules/notes/models.py

@@ -0,0 +1,13 @@
+from datetime import datetime
+
+from sqlalchemy import DateTime
+from sqlmodel import Field
+
+from terp.core import BaseTable
+
+
+class Note(BaseTable, table=True):
+    title: str = Field(max_length=200)
+    # An explicit column type that is declared without a timezone is naive
+    # storage just as thoroughly as naming no type at all.
+    due_at: datetime = Field(sa_type=DateTime(timezone=False))

package/corpus/backend/datetime_columns_are_timezone_aware/violation-03/modules/notes/models.py

@@ -0,0 +1,15 @@
+from datetime import datetime
+
+from sqlmodel import Field
+
+from terp.core import BaseTable
+
+
+class ArchivedMixin:
+    # Declaring the column one class up does not change where it lands: the
+    # table still gets a naive timestamp column.
+    archived_at: datetime | None = Field(default=None)
+
+
+class Note(ArchivedMixin, BaseTable, table=True):
+    title: str = Field(max_length=200)

package/corpus/backend/escape_hatch_budget/compliant-01/escape-hatch-budget.json

@@ -0,0 +1,3 @@
+{
+  "arch-allow-no-dynamic-sql": 1
+}

package/corpus/backend/escape_hatch_budget/compliant-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def legacy_report(session, sql):
+    return session.execute(text(sql))  # arch-allow-no-dynamic-sql: legacy reporting query, parameterised upstream

package/corpus/backend/escape_hatch_budget/compliant-02/escape-hatch-budget.json

@@ -0,0 +1 @@
+{}

package/corpus/backend/escape_hatch_budget/compliant-02/modules/notes/service.py

@@ -0,0 +1,4 @@
+def render_help():
+    # Marker-shaped text inside a string is not counted by the budget ratchet:
+    # with an empty budget this app is exactly in balance.
+    return "suppress with '# arch-allow-no-dynamic-sql: <reason>' after review"

package/corpus/backend/escape_hatch_budget/violation-01/escape-hatch-budget.json

@@ -0,0 +1 @@
+{}

package/corpus/backend/escape_hatch_budget/violation-01/modules/notes/service.py

@@ -0,0 +1,2 @@
+def legacy_report(session, sql):
+    return session.execute(text(sql))  # arch-allow-no-dynamic-sql: legacy reporting query, parameterised upstream

package/corpus/backend/escape_hatch_budget/violation-02/escape-hatch-budget.json

@@ -0,0 +1,3 @@
+{
+  "arch-allow-made-up-rule": 1
+}

package/corpus/backend/escape_hatch_budget/violation-02/modules/notes/service.py

@@ -0,0 +1,4 @@
+def legacy_report():
+    # A marker (or budget key) that names no rule with a governed opt-out is
+    # refused outright - it can never be budgeted into legitimacy.
+    return None  # arch-allow-made-up-rule: stale name

package/corpus/backend/events_reference_catalog/compliant-01/modules/notes/module.py

@@ -0,0 +1,9 @@
+from control_plane.events import NOTE_CREATED
+from terp.core import ModuleSpec, Policy, Roles
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(read=Roles.VIEWER, write=Roles.EDITOR),
+    emits=[NOTE_CREATED],
+)

package/corpus/backend/events_reference_catalog/violation-01/modules/notes/module.py

@@ -0,0 +1,8 @@
+from terp.core import ModuleSpec, Policy, Roles
+
+spec = ModuleSpec(
+    name="notes",
+    router=router,
+    policy=Policy(read=Roles.VIEWER, write=Roles.EDITOR),
+    emits=["notes.created"],
+)

package/corpus/backend/input_schemas_exclude_managed_columns/compliant-01/modules/notes/schemas.py

@@ -0,0 +1,6 @@
+from sqlmodel import Field
+from terp.core import BaseSchema
+
+
+class NoteCreate(BaseSchema):
+    title: str = Field(max_length=200)

package/corpus/backend/input_schemas_exclude_managed_columns/violation-01/expected-findings.json

@@ -0,0 +1,7 @@
+[
+  {
+    "rule": "backend/input_schemas_exclude_managed_columns",
+    "path": "modules/notes/schemas.py",
+    "line": 8
+  }
+]

package/corpus/backend/input_schemas_exclude_managed_columns/violation-01/modules/notes/schemas.py

@@ -0,0 +1,9 @@
+import uuid
+
+from sqlmodel import Field
+from terp.core import BaseSchema
+
+
+class NoteCreate(BaseSchema):
+    id: uuid.UUID
+    title: str = Field(max_length=200)