@vantageos/backend-doctor 0.2.0 → 0.4.0

package/fixtures/rule-classes-bacc54a.json

@@ -0,0 +1,244 @@
+{
+	"standard_sha": "bacc54a53d5f6f9f20e5254908e2b46807902faa",
+	"standard_file": "fixtures/backend-standard-bacc54a.md",
+	"about": "Per-rule gate class for the deploy gate's mechanical_violations count. mechanical = a detector decides it by deterministic code over the source or the oracle; judgement = it needs a human reading or a written justification the detector cannot verify. DATA, never TS logic: src/rule-class.ts loads this file and cross-checks every R- entry against the pinned standard's own build kind (section 15 table, which at bacc54a lists all 56 rules; the '*kind:*' Detector-spec token is the fallback for a rule the table omits) through standard_kind_to_class. A sidecar class that disagrees with the standard, or a rule with no entry, is could-not-judge: the CLI names it and the evidence file carries mechanical_violations = null, never a defaulted count.",
+	"standard_kind_to_class": {
+		"mechanical": "mechanical",
+		"judgement": "judgement",
+		"process": "judgement"
+	},
+	"rules": {
+		"R-1": {
+			"class": "mechanical",
+			"basis": "oracle `surface` cell is one of three closed values"
+		},
+		"R-2": {
+			"class": "mechanical",
+			"basis": "oracle verb is in the closed set and never `rpc`"
+		},
+		"R-3": {
+			"class": "mechanical",
+			"basis": "oracle cursor/default/max cells are present and numeric"
+		},
+		"R-4": {
+			"class": "mechanical",
+			"basis": "oracle retrieval mechanism is in the indexed set"
+		},
+		"R-5": {
+			"class": "mechanical",
+			"basis": "oracle reader tier is one of five"
+		},
+		"R-6": {
+			"class": "mechanical",
+			"basis": "standard s15 (ElPi-Corp #225): argument-derived boundary traced through the handler; flagged row with no JUSTIFIED token is non-conforming"
+		},
+		"R-7": {
+			"class": "mechanical",
+			"basis": "INCOHERENT flag without a written JUSTIFIED token is decided by a token match (s23)"
+		},
+		"R-8": {
+			"class": "mechanical",
+			"basis": "AUCUN scope on a data op without a STATELESS/JUSTIFIED token is decided by a token match (s23)"
+		},
+		"R-9": {
+			"class": "mechanical",
+			"basis": "oracle token-cost cell is a number, not a placeholder"
+		},
+		"R-10": {
+			"class": "mechanical",
+			"basis": "writer tier present, distinct, one of five in the side-car"
+		},
+		"R-11": {
+			"class": "mechanical",
+			"basis": "standard s15 (ElPi-Corp #225): in-handler post-query scope filter with no withIndex on the key, decided by a token match"
+		},
+		"R-12": {
+			"class": "mechanical",
+			"basis": "indexed-vector row declares a namespace and a numeric topK"
+		},
+		"R-13": {
+			"class": "mechanical",
+			"basis": "purpose non-empty and disposition in a closed set"
+		},
+		"R-14": {
+			"class": "mechanical",
+			"basis": "inventory header compared field by field against the s2 contract"
+		},
+		"R-15": {
+			"class": "judgement",
+			"basis": "standard s15 process rule: reconciliation of a new term is a delivery-gate reading"
+		},
+		"R-16": {
+			"class": "judgement",
+			"basis": "standard s15: error shape is mechanical, whether the remedy is followable is human"
+		},
+		"R-17": {
+			"class": "judgement",
+			"basis": "standard s15: additivity is a heuristic, reversibility soundness is human"
+		},
+		"R-18": {
+			"class": "judgement",
+			"basis": "standard s15: key presence is mechanical, key correctness is human"
+		},
+		"R-19": {
+			"class": "judgement",
+			"basis": "standard s15: retention/delete path is mechanical, cascade completeness is human"
+		},
+		"R-20": {
+			"class": "judgement",
+			"basis": "standard s15: bounds are mechanical, idempotency soundness is human"
+		},
+		"R-21": {
+			"class": "mechanical",
+			"basis": "webhook path is read for signature verification and a delivery-id key"
+		},
+		"R-22": {
+			"class": "mechanical",
+			"basis": "secret-shaped literal scan over source, responses and logs"
+		},
+		"R-23": {
+			"class": "mechanical",
+			"basis": "rate and runtime bounds are numeric or a written exception exists"
+		},
+		"R-24": {
+			"class": "mechanical",
+			"basis": "bulk-write default dry-run and confirm flag read from source"
+		},
+		"R-25": {
+			"class": "judgement",
+			"basis": "standard s15: org-binding/expiry are mechanical, the both-ends check is human"
+		},
+		"R-26": {
+			"class": "judgement",
+			"basis": "standard s15: seam declaration is mechanical, library trust is a human justification"
+		},
+		"R-27": {
+			"class": "mechanical",
+			"basis": "named survivor resolves to a tool in the current inventory"
+		},
+		"R-28": {
+			"class": "mechanical",
+			"basis": "non-conforming tool carries a CORRIGER/REVOIR remediation, not a placeholder"
+		},
+		"R-29": {
+			"class": "mechanical",
+			"basis": "standard s15 (ElPi-Corp #225): action-orchestrated writes found from source; a flagged row with no JUSTIFIED token is non-conforming"
+		},
+		"R-30": {
+			"class": "mechanical",
+			"basis": "declared max present and below the platform limit, read from source"
+		},
+		"R-31": {
+			"class": "mechanical",
+			"basis": "bulk op batches reads and writes with take/paginate + self-schedule, read from source"
+		},
+		"R-32": {
+			"class": "judgement",
+			"basis": "standard s15 process rule: a real-deployment proof is checked at the delivery gate"
+		},
+		"R-33": {
+			"class": "mechanical",
+			"basis": "standard s15 (ElPi-Corp #225): caller-influenced outbound call-site inventory; a flagged row with no JUSTIFIED token is non-conforming"
+		},
+		"R-34": {
+			"class": "mechanical",
+			"basis": "standard s15 (ElPi-Corp #225): forwarded caller-token / missing audience-assert grep; a flagged row with no JUSTIFIED token is non-conforming"
+		},
+		"R-35": {
+			"class": "mechanical",
+			"basis": "standard s15 (ElPi-Corp #225): third-party content spliced into an instruction position; a flagged row with no JUSTIFIED token is non-conforming"
+		},
+		"R-36": {
+			"class": "mechanical",
+			"basis": "lockfile pins every dependency and publish carries provenance"
+		},
+		"R-37": {
+			"class": "mechanical",
+			"basis": "pairwise filled-neighbour compare plus a justification-token match (s23)"
+		},
+		"R-38": {
+			"class": "mechanical",
+			"basis": "thirteen s2 fields present per table within their vocabulary"
+		},
+		"R-39": {
+			"class": "judgement",
+			"basis": "standard s15: the mechanism is named mechanically, its current guarantee is a delivery-gate reading"
+		},
+		"R-40": {
+			"class": "mechanical",
+			"basis": "two backends' shared fields compared with a justification-token match (s23)"
+		},
+		"R-41": {
+			"class": "mechanical",
+			"basis": "every cited S-/C- identifier resolves in the vendored sibling document"
+		},
+		"R-42": {
+			"class": "judgement",
+			"basis": "standard s15 process rule: un-routed subjects are a delivery-gate reading"
+		},
+		"R-43": {
+			"class": "judgement",
+			"basis": "standard s15: whether a missing delete is an accepted choice is human"
+		},
+		"R-44": {
+			"class": "judgement",
+			"basis": "standard s15: whether the backfill reaches every pre-write row is human"
+		},
+		"R-45": {
+			"class": "judgement",
+			"basis": "standard s15: whether the fixture truly reaches the pre-migration state is human"
+		},
+		"R-46": {
+			"class": "mechanical",
+			"basis": "returns-validator field set compared to the schema's writable fields"
+		},
+		"R-47": {
+			"class": "judgement",
+			"basis": "standard s15: which remedy (refusal, index, bound) is right is human"
+		},
+		"R-48": {
+			"class": "judgement",
+			"basis": "standard s15: whether an unreachable row is a deliberate lock is human"
+		},
+		"R-50": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-50 mechanical: org throw vs fail-closed resolver read from source"
+		},
+		"R-51": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-51 mechanical: the two readable absences are read from source"
+		},
+		"R-52": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-52: tenant-column test, caller-choosable selector trace and a server-stamped tenant guard read from source; no token exit"
+		},
+		"R-53": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-53: principal source, ID-vs-name admission predicate, unresolved branch and local identity layer read from source; no token exit"
+		},
+		"R-54": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-54: a door that resolves its caller through the scope resolver is read for a claim argument and a refusal of the claimless service-account call; exits listed; no other token exit"
+		},
+		"R-55": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-55: a caller-dependent predicate or an aggregate applied after the bound of a read is read from source; no token exit"
+		},
+		"R-56": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-56: credential storage, refresh-token consumption, bearer mint revocation and verification-token matching read from source; no token exit"
+		},
+		"R-57": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-57: a function defining an identity primitive of any of five kinds, ceiling zero; measured and reported under the doctor-owned key CR-2 (src/not-checkable.ts names why), so it is never counted twice"
+		},
+		"CR-1": {
+			"class": "mechanical",
+			"basis": "doctor-owned: a FAIL-OPEN or unjustified NO-IDENTITY registration is classified from source; not in the standard, so no cross-check"
+		},
+		"CR-2": {
+			"class": "mechanical",
+			"basis": "doctor-owned: a function outside @vantageos/cloud-identity that resolves a caller to a tenant, asserts membership, filters by caller scope, validates a credential or identifies an agent by name is classified from source (AST); ceiling 0; the standard at bacc54a numbers this rule R-57, the key stays CR-2 for the deploy-gate baseline; non-R id, so no cross-check"
+		}
+	}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/backend-doctor",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "A conformance instrument that measures the VantagePeers backend against the pinned backend standard. The THIRD doctor built ON the @vantageos/mcp-doctor engine — never a third engine. It consumes runDoctor/renderTable and adds only detectors.",
   "type": "module",
   "main": "./dist/cli.js",