@webpieces/rules-config 0.4.630 → 0.4.632

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/rules-config",
-  "version": "0.4.630",
+  "version": "0.4.632",
   "description": "Shared webpieces.config.json loader. Single source of truth for validation rule configuration consumed by @webpieces/ai-hook-rules, @webpieces/code-rules, and @webpieces/nx-webpieces-rules.",
   "type": "commonjs",
   "main": "./src/index.js",

package/templates/webpieces.guard-matrix.md

@@ -10,15 +10,21 @@ reading this, one of the faults below fired and named this file.
 
 ## The faults
 
-| code | fault | detected by | enforced in |
-|---|---|---|---|
-| `D` | version drift — root package.json pin != installed version | sh, before the bin runs | sh |
-| `X` | guard bin missing (fresh clone / new worktree / package removed) | sh, before the bin runs | sh |
-| `U` | guard bin missing AND @webpieces/ai-hook-rules is not declared in package.json | sh, before the bin runs | sh |
-| `K` | guard bin present but CRASHED (exit code not 0 or 2 — corrupt node_modules) | sh, before the bin runs | sh |
-| `S` | a webpieces-managed hook file, the .claude/settings.json registration or its managed env entry does not match this release | the guard bin | JS |
-| `C` | webpieces.config.json missing | the guard bin | JS |
-| `Y` | a loaded rule has no webpieces.config.json key | the guard bin | JS |
+THE JOIN KEYS ARE `guard`, `fault=` and `row=`. Every L0 deny opens
+`[<guard>] (layer=L0 fault=<code> row=3, …)`, and every audit line — from BOTH halves of L0, the
+`sh` shim and the guard bin — carries `layer=L0 row=<n> fault=<code>`. So one grep lands you in
+the deny, the log line and the row below. The guard names come from `L0_FAULT_NAMES` and the row
+numbers from `L0_ROW_*`, both spelled in exactly one place (`core/l0-fault-codes.ts`).
+
+| code | guard | fault | detected by | enforced in |
+|---|---|---|---|---|
+| `D` | `version-drift` | version drift — root package.json pin != installed version | sh, before the bin runs | sh |
+| `X` | `guard-bin-missing` | guard bin missing (fresh clone / new worktree / package removed) | sh, before the bin runs | sh |
+| `U` | `guard-pkg-undeclared` | guard bin missing AND @webpieces/ai-hook-rules is not declared in package.json | sh, before the bin runs | sh |
+| `K` | `guard-bin-crashed` | guard bin present but CRASHED (exit code not 0 or 2 — corrupt node_modules) | sh, before the bin runs | sh |
+| `S` | `managed-hook-surface` | a webpieces-managed hook file, the .claude/settings.json registration or its managed env entry does not match this release | the guard bin | JS |
+| `C` | `config-missing` | webpieces.config.json missing | the guard bin | JS |
+| `Y` | `config-out-of-sync` | a loaded rule has no webpieces.config.json key | the guard bin | JS |
 
 First match wins. `D`/`X`/`U`/`K` are decided in POSIX `sh` inside the committed shim, BEFORE the
 guard bin runs — a stale, missing or broken validator cannot be trusted to validate itself.
@@ -32,7 +38,7 @@ the option you pick EXACTLY as written and run nothing else on that line.
 ### `D` — version drift — root package.json pin != installed version
 
 - **Option 1 (preferred)**: `pnpm install`  ← pick this when node_modules is OLDER than the pin, OR you are on a feature branch and want YOUR branch pin (usually the case) — it always clears the drift
-- **Option 2**: `git pull`  ← pick this when node_modules is NEWER than the pin AND you are on main — the PIN is the stale side, so pull first and install second; a bare install would downgrade you
+- **Option 2**: `git checkout main && git pull origin main`  ← pick this when node_modules is NEWER than the pin AND you are on main — the PIN is the stale side, so sync first and install second; a bare install would downgrade you
 
 ### `X` — guard bin missing (fresh clone / new worktree / package removed)
 
@@ -70,13 +76,17 @@ L0 has NO genuine second dimension. Every branch reduces to one question:
 | 2 | any | yes | PASS or ALLOW (see the entry) |
 | 3 | any | no | BLOCK — **only the message varies by fault** |
 
+Row 3 is the only row that blocks, so every L0 deny cites it — `row=3` in the
+deny header, `row=3` on the audit line, and this row here. Same numbers as L1 uses for
+its own rows (see `L1_ROWS`), and for the same reason: a row number is IDENTITY, so it is never reused.
+
 The tool is not a dimension either: "any Read" is an allowlist ENTRY, not a tool check.
 
 ## The allowlist
 
 ONE list, consulted identically by every fault. A cure that cannot help a given fault also
 cannot hurt it, and gating each entry on a fault is what produced four real defects (a stale
-shim that denied `pnpm install` and `git pull`; faults that denied every Read; a config fault
+shim that denied `pnpm install` and every git sync; faults that denied every Read; a config fault
 that denied `rm -rf node_modules && pnpm install` while allowing a bare `pnpm install`).
 
 | # | allowed | outcome |
@@ -85,13 +95,14 @@ that denied `rm -rf node_modules && pnpm install` while allowing a bare `pnpm in
 | 2 | a Write/Edit whose target is webpieces.config.json | PASS |
 | 3 | pnpm|npm install | ALLOW |
 | 4 | rm -rf node_modules && pnpm install - the cure for a CORRUPT node_modules | ALLOW |
-| 5 | git pull / git fetch - merge is NOT on the list | ALLOW |
-| 6 | pnpm exec wp-upgrade-shim | ALLOW |
-| 7 | cp node_modules/@webpieces/ai-hook-rules/templates/ai-hook.sh .claude/webpieces/ai-hook.sh | ALLOW |
-| 8 | pnpm wp-prune-unknown-config | ALLOW |
-| 9 | pnpm exec wp-install-ai-hooks (flags allowed, e.g. --target=project) | ALLOW |
-| 10 | pnpm add -D @webpieces/ai-hook-rules (an @version and extra flags allowed) | ALLOW |
-| 11 | read-only orientation: pwd, git status/log/diff/show/branch/rev-parse, git worktree list | ALLOW |
+| 5 | git fetch - a bare git pull and git merge are NOT on the list | ALLOW |
+| 6 | git checkout main && git pull origin main | ALLOW |
+| 7 | pnpm exec wp-upgrade-shim | ALLOW |
+| 8 | cp node_modules/@webpieces/ai-hook-rules/templates/ai-hook.sh .claude/webpieces/ai-hook.sh | ALLOW |
+| 9 | pnpm wp-prune-unknown-config | ALLOW |
+| 10 | pnpm exec wp-install-ai-hooks (flags allowed, e.g. --target=project) | ALLOW |
+| 11 | pnpm add -D @webpieces/ai-hook-rules (an @version and extra flags allowed) | ALLOW |
+| 12 | read-only orientation: pwd, git status/log/diff/show/branch/rev-parse, git worktree list | ALLOW |
 
 - **PASS** — L0 has no objection; the call falls THROUGH so the downstream guards still judge it.
 - **ALLOW** — terminal; bypasses everything, because a cure must stay reachable even when a