@vantageos/backend-doctor 0.3.0 → 0.4.2

package/fixtures/{rule-classes-2825122.json → rule-classes-bacc54a.json}

@@ -1,7 +1,7 @@
 {
-	"standard_sha": "2825122a3ab1e4ddb4b955cfb136b7e8ab04f8f3",
-	"standard_file": "fixtures/backend-standard-2825122.md",
-	"about": "Per-rule gate class for the deploy gate's mechanical_violations count. mechanical = a detector decides it by deterministic code over the source or the oracle; judgement = it needs a human reading or a written justification the detector cannot verify. DATA, never TS logic: src/rule-class.ts loads this file and cross-checks every R- entry against the pinned standard's own build kind (section 15 table, which at 2825122 lists all 52 rules; the '*kind:*' Detector-spec token is the fallback for a rule the table omits) through standard_kind_to_class. A sidecar class that disagrees with the standard, or a rule with no entry, is could-not-judge: the CLI names it and the evidence file carries mechanical_violations = null, never a defaulted count.",
+	"standard_sha": "bacc54a53d5f6f9f20e5254908e2b46807902faa",
+	"standard_file": "fixtures/backend-standard-bacc54a.md",
+	"about": "Per-rule gate class for the deploy gate's mechanical_violations count. mechanical = a detector decides it by deterministic code over the source or the oracle; judgement = it needs a human reading or a written justification the detector cannot verify. DATA, never TS logic: src/rule-class.ts loads this file and cross-checks every R- entry against the pinned standard's own build kind (section 15 table, which at bacc54a lists all 56 rules; the '*kind:*' Detector-spec token is the fallback for a rule the table omits) through standard_kind_to_class. A sidecar class that disagrees with the standard, or a rule with no entry, is could-not-judge: the CLI names it and the evidence file carries mechanical_violations = null, never a defaulted count.",
 	"standard_kind_to_class": {
 		"mechanical": "mechanical",
 		"judgement": "judgement",
@@ -216,13 +216,29 @@
 			"class": "mechanical",
 			"basis": "standard s15 row R-53: principal source, ID-vs-name admission predicate, unresolved branch and local identity layer read from source; no token exit"
 		},
+		"R-54": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-54: a door that resolves its caller through the scope resolver is read for a claim argument and a refusal of the claimless service-account call; exits listed; no other token exit"
+		},
+		"R-55": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-55: a caller-dependent predicate or an aggregate applied after the bound of a read is read from source; no token exit"
+		},
+		"R-56": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-56: credential storage, refresh-token consumption, bearer mint revocation and verification-token matching read from source; no token exit"
+		},
+		"R-57": {
+			"class": "mechanical",
+			"basis": "standard s15 row R-57: a function defining an identity primitive of any of five kinds, ceiling zero; measured and reported under the doctor-owned key CR-2 (src/not-checkable.ts names why), so it is never counted twice"
+		},
 		"CR-1": {
 			"class": "mechanical",
 			"basis": "doctor-owned: a FAIL-OPEN or unjustified NO-IDENTITY registration is classified from source; not in the standard, so no cross-check"
 		},
 		"CR-2": {
 			"class": "mechanical",
-			"basis": "doctor-owned: a function outside @vantageos/cloud-identity that resolves a caller to a tenant, asserts membership, filters by caller scope, validates a credential or identifies an agent by name is classified from source (AST); ceiling 0; not in the standard, so no cross-check"
+			"basis": "doctor-owned: a function outside @vantageos/cloud-identity that resolves a caller to a tenant, asserts membership, filters by caller scope, validates a credential or identifies an agent by name is classified from source (AST); ceiling 0; the standard at bacc54a numbers this rule R-57, the key stays CR-2 for the deploy-gate baseline; non-R id, so no cross-check"
 		}
 	}
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/backend-doctor",
-  "version": "0.3.0",
+  "version": "0.4.2",
   "description": "A conformance instrument that measures the VantagePeers backend against the pinned backend standard. The THIRD doctor built ON the @vantageos/mcp-doctor engine — never a third engine. It consumes runDoctor/renderTable and adds only detectors.",
   "type": "module",
   "main": "./dist/cli.js",