code-auditor-mcp 3.5.0 → 3.7.0

package/dist/analyzers/ruleRegistry.js

@@ -11,7 +11,6 @@ export const RULE_REGISTRY = {
         analyzer: 'solid',
         field: 'rule',
         input: ['files'],
-        gating: true,
         resolvable: true,
         message: 'Class "{name}" has {methods} methods, exceeding the maximum of {max}. Consider splitting responsibilities.',
         docs: 'solid/class-size',
@@ -32,7 +31,6 @@ export const RULE_REGISTRY = {
         analyzer: 'solid',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Method "{name}" has cyclomatic complexity {complexity}, exceeding the maximum of {max}.',
         docs: 'solid/method-complexity',
@@ -50,7 +48,6 @@ export const RULE_REGISTRY = {
         analyzer: 'solid',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Class "{name}" violates the Open/Closed Principle.',
         docs: 'solid/open-closed',
@@ -68,11 +65,12 @@ export const RULE_REGISTRY = {
         analyzer: 'solid',
         field: 'rule',
         input: ['files'],
-        gating: true,
         resolvable: true,
-        message: 'Function "{name}" has {count} {metric}, exceeding the maximum of {max}. Break it down.',
+        message: 'Function "{name}" mixes unrelated responsibilities. Split it into one function per concern.',
         docs: 'solid/single-responsibility',
-        thresholds: ['maxParametersPerMethod', 'maxLinesPerMethod'],
+        // #131: the mixed-concern check has no tunable threshold. The size proxies
+        // (line count, parameter count) moved to function-length / parameter-count.
+        thresholds: [],
         samples: {
             valid: [
                 { code: 'function parse(input) {\n  return input.trim().split(",");\n}', nearMiss: true },
@@ -85,11 +83,50 @@ export const RULE_REGISTRY = {
             ],
         },
     },
+    'function-length': {
+        analyzer: 'solid',
+        field: 'rule',
+        input: ['files'],
+        resolvable: true,
+        message: 'Function "{name}" has {lines} lines, exceeding the maximum of {max}. Consider breaking it down.',
+        docs: 'function-length',
+        thresholds: ['maxLinesPerMethod'],
+        samples: {
+            valid: [
+                { code: 'function short(x) {\n  const a = transform(x);\n  const b = validate(a);\n  return b;\n}', nearMiss: true },
+            ],
+            invalid: [
+                {
+                    code: 'function long(input) {\n  let a = step1(input);\n  let b = step2(a);\n  let c = step3(b);\n  let d = step4(c);\n  let e = step5(d);\n  let f = step6(e);\n  let g = step7(f);\n  let h = step8(g);\n  let i = step9(h);\n  let j = step10(i);\n  let k = step11(j);\n  let l = step12(k);\n  let m = step13(l);\n  let n = step14(m);\n  let o = step15(n);\n  let p = step16(o);\n  let q = step17(p);\n  let r = step18(q);\n  let s = step19(r);\n  let t = step20(s);\n  let u = step21(t);\n  let v = step22(u);\n  let w = step23(v);\n  let x = step24(w);\n  let y = step25(x);\n  let z = step26(y);\n  let aa = step27(z);\n  let ab = step28(aa);\n  let ac = step29(ab);\n  let ad = step30(ac);\n  let ae = step31(ad);\n  let af = step32(ae);\n  let ag = step33(af);\n  let ah = step34(ag);\n  let ai = step35(ah);\n  let aj = step36(ai);\n  let ak = step37(aj);\n  let al = step38(ak);\n  let am = step39(al);\n  let an = step40(am);\n  let ao = step41(an);\n  let ap = step42(ao);\n  let aq = step43(ap);\n  let ar = step44(aq);\n  let as = step45(ar);\n  let at = step46(as);\n  let au = step47(at);\n  let av = step48(au);\n  let aw = step49(av);\n  let ax = step50(aw);\n  let ay = step51(ax);\n  return ay;\n}',
+                    resolution: { action: 'break-down-function', summary: 'Break "long" into smaller functions, extracting named helper blocks for each pipeline stage.', symbols: ['long'] },
+                },
+            ],
+        },
+    },
+    'parameter-count': {
+        analyzer: 'solid',
+        field: 'rule',
+        input: ['files'],
+        resolvable: true,
+        message: 'Function "{name}" has {params} parameters, exceeding the maximum of {max}. Consider using an options object.',
+        docs: 'parameter-count',
+        thresholds: ['maxParametersPerMethod'],
+        samples: {
+            valid: [
+                { code: 'function combine(a, b, c, d) {\n  return a + b + c + d;\n}', nearMiss: true },
+            ],
+            invalid: [
+                {
+                    code: 'function combine(a, b, c, d, e) {\n  return a + b + c + d + e;\n}',
+                    resolution: { action: 'bundle-params', summary: 'Bundle the 5 parameters of "combine" into an options object.', symbols: ['a', 'b', 'c', 'd', 'e'] },
+                },
+            ],
+        },
+    },
     'solid/interface-segregation': {
         analyzer: 'solid',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Interface "{name}" has many members.',
         docs: 'solid/interface-segregation',
@@ -107,7 +144,6 @@ export const RULE_REGISTRY = {
         analyzer: 'solid',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Method "{name}" overrides a parent method and throws where the parent does not.',
         docs: 'solid/liskov-substitution',
@@ -125,7 +161,6 @@ export const RULE_REGISTRY = {
         analyzer: 'solid',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Module "{name}" violates the Dependency Inversion Principle.',
         docs: 'solid/dependency-inversion',
@@ -144,7 +179,6 @@ export const RULE_REGISTRY = {
         analyzer: 'dry',
         field: 'rule',
         input: ['files'],
-        gating: true,
         resolvable: true,
         message: 'Duplicate code block detected ({lines} lines). First occurrence at {file}:{line}.',
         docs: 'dry/duplicate',
@@ -166,7 +200,6 @@ export const RULE_REGISTRY = {
         field: 'rule',
         configGate: 'checkStructuralSimilarity',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Structurally similar code block detected ({similarity}% similar to {file}:{line}).',
         docs: 'dry/structural-similarity',
@@ -180,12 +213,47 @@ export const RULE_REGISTRY = {
             ],
         },
     },
+    'dry/similar-expression': {
+        analyzer: 'dry',
+        field: 'rule',
+        configGate: 'checkExpressionSimilarity',
+        input: ['files'],
+        resolvable: true,
+        message: 'Near-identical expression detected ({shared} shared {unit}: {names}). First occurrence at {file}:{line}.',
+        docs: 'dry/similar-expression',
+        // #133: on by default. The floor (minShapeNames) counts the field/method
+        // names two fragments must share. Fluent library/builder chains (query and
+        // schema builders, Zod validators, commander, promises, DOM and stdlib
+        // method chains) are excluded and object literals must target the same
+        // identifier, so default-on stays quiet on idiomatic API surface and schema
+        // literals while still firing on the `resultSummary` object built twice.
+        thresholds: ['minShapeNames'],
+        samples: {
+            valid: [
+                {
+                    // Same target assigned twice, but the field lists share nothing — a
+                    // "built twice" shape that is not actually near-identical.
+                    code: 'const state = {};\nstate.summary = { a: 1, b: 2, c: 3, d: 4 };\nstate.summary = { e: 5, f: 6, g: 7, h: 8 };',
+                    nearMiss: true,
+                },
+            ],
+            invalid: [
+                {
+                    code: 'const info = {};\ninfo.resultSummary = { completedAt: now, tables: t, tableCounts: tc, stagingCounts: sc, steps: st };\ninfo.resultSummary = { completedAt: now, tables: t, tableCounts: tc, stagingCounts: sc, steps: st, durationMs: d };',
+                    resolution: {
+                        action: 'extract-shared-expression',
+                        summary: 'Extract the shared field list (completedAt, tables, tableCounts, stagingCounts, steps) into a shared builder or constant both sites use.',
+                        symbols: ['info.resultSummary'],
+                    },
+                },
+            ],
+        },
+    },
     'duplicate-string-literal': {
         analyzer: 'dry',
         field: 'rule',
         configGate: 'checkStrings',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'String literal "{text}" is duplicated {count} times.',
         docs: 'duplicate-string-literal',
@@ -204,7 +272,6 @@ export const RULE_REGISTRY = {
         field: 'rule',
         configGate: 'checkImports',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Duplicate import of "{module}".',
         docs: 'duplicate-import',
@@ -223,7 +290,6 @@ export const RULE_REGISTRY = {
         analyzer: 'data-access',
         field: 'rule',
         input: ['files'],
-        gating: true,
         resolvable: true,
         message: 'Potential SQL injection risk in {method}. Use parameterized queries.',
         docs: 'sql-injection-risk',
@@ -244,7 +310,6 @@ export const RULE_REGISTRY = {
         analyzer: 'data-access',
         field: 'rule',
         input: ['schema'],
-        gating: false,
         resolvable: false,
         message: 'Query on {tables} is missing an organization/tenant filter.',
         docs: 'missing-org-filter',
@@ -262,7 +327,6 @@ export const RULE_REGISTRY = {
         analyzer: 'data-access',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Query references {tables} tables.',
         docs: 'complex-query',
@@ -280,7 +344,6 @@ export const RULE_REGISTRY = {
         analyzer: 'data-access',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Query on {tables} has no filter.',
         docs: 'unfiltered-query',
@@ -298,7 +361,6 @@ export const RULE_REGISTRY = {
         analyzer: 'data-access',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Hardcoded database connection string detected.',
         docs: 'hardcoded-connection',
@@ -316,7 +378,6 @@ export const RULE_REGISTRY = {
         analyzer: 'data-access',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Database query inside a loop detected in {method}.',
         docs: 'loop-query',
@@ -330,12 +391,47 @@ export const RULE_REGISTRY = {
             ],
         },
     },
+    // ── secrets (UniversalSecretsAnalyzer) ──────────────────────────────────
+    'hardcoded-secret': {
+        analyzer: 'secrets',
+        field: 'rule',
+        configGate: 'checkHardcodedSecrets',
+        input: ['files'],
+        resolvable: true,
+        message: 'Hardcoded secret detected: a credential value is embedded in source. Move it to an environment variable or secret store.',
+        docs: 'hardcoded-secret',
+        thresholds: [],
+        samples: {
+            valid: [
+                // Placeholder value — named like a secret, but the value is a known placeholder.
+                { code: "const apiKey = 'your-api-key';", nearMiss: true },
+                // Env var reference — not a string literal, so never a candidate.
+                { code: 'const apiKey = process.env.API_KEY;', nearMiss: true },
+            ],
+            invalid: [
+                {
+                    code: "const password = 'hunter2Secret9';",
+                    resolution: {
+                        action: 'remove-hardcoded-secret',
+                        summary: 'Replace the hardcoded "password" credential with a reference to an environment variable or secret store (e.g. process.env.PASSWORD).',
+                        symbols: ['password'],
+                    },
+                },
+                {
+                    code: "await page.type('#password', 'vyy8AUVvish34Fq');",
+                    resolution: {
+                        action: 'remove-hardcoded-secret',
+                        summary: 'Replace the hardcoded credential with a reference to an environment variable or secret store (e.g. process.env.SECRET).',
+                    },
+                },
+            ],
+        },
+    },
     // ── documentation (UniversalDocumentationAnalyzer) ─────────────────────
     'file-documentation': {
         analyzer: 'documentation',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'File is missing a leading documentation comment.',
         docs: 'file-documentation',
@@ -353,7 +449,6 @@ export const RULE_REGISTRY = {
         analyzer: 'documentation',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Function "{name}" is missing a doc comment.',
         docs: 'function-documentation',
@@ -371,7 +466,6 @@ export const RULE_REGISTRY = {
         analyzer: 'documentation',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Parameter "{name}" in function "{func}" is missing a @param tag.',
         docs: 'parameter-documentation',
@@ -389,7 +483,6 @@ export const RULE_REGISTRY = {
         analyzer: 'documentation',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Function "{name}" is missing a @returns tag.',
         docs: 'return-documentation',
@@ -407,7 +500,6 @@ export const RULE_REGISTRY = {
         analyzer: 'documentation',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Class "{name}" is missing a doc comment.',
         docs: 'class-documentation',
@@ -425,7 +517,6 @@ export const RULE_REGISTRY = {
         analyzer: 'documentation',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Method "{name}" is missing a doc comment.',
         docs: 'method-documentation',
@@ -445,7 +536,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Invalid JSON: {error}.',
         docs: 'invalid-json',
@@ -463,7 +553,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Missing JSON schema declaration.',
         docs: 'missing-schema-declaration',
@@ -481,7 +570,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Undefined required field "{field}".',
         docs: 'undefined-required-field',
@@ -499,7 +587,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Invalid type for field "{field}".',
         docs: 'invalid-type',
@@ -517,7 +604,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Invalid range for field "{field}".',
         docs: 'invalid-range',
@@ -535,7 +621,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Error processing schema file: {error}.',
         docs: 'file-error',
@@ -553,7 +638,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Type mismatch for field "{field}".',
         docs: 'type-mismatch',
@@ -571,7 +655,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'String value too short for field "{field}".',
         docs: 'string-too-short',
@@ -589,7 +672,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'String value too long for field "{field}".',
         docs: 'string-too-long',
@@ -607,7 +689,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Value does not match pattern for field "{field}".',
         docs: 'pattern-mismatch',
@@ -625,7 +706,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Invalid format for field "{field}".',
         docs: 'invalid-format',
@@ -643,7 +723,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Value below minimum for field "{field}".',
         docs: 'below-minimum',
@@ -661,7 +740,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Value above maximum for field "{field}".',
         docs: 'above-maximum',
@@ -679,7 +757,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Too few items for field "{field}".',
         docs: 'too-few-items',
@@ -697,7 +774,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Too many items for field "{field}".',
         docs: 'too-many-items',
@@ -715,7 +791,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Missing required field "{field}".',
         docs: 'missing-required-field',
@@ -733,7 +808,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Unexpected property "{property}".',
         docs: 'unexpected-property',
@@ -751,7 +825,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-json'],
-        gating: false,
         resolvable: false,
         message: 'Value does not match any enum value for field "{field}".',
         docs: 'enum-mismatch',
@@ -770,7 +843,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-code'],
-        gating: false,
         resolvable: false,
         message: 'Potential SQL injection via string interpolation in {method}.',
         docs: 'sql-injection',
@@ -791,7 +863,6 @@ export const RULE_REGISTRY = {
         field: 'rule',
         configGate: 'checkNamingConventions',
         input: ['schema-code'],
-        gating: false,
         resolvable: false,
         message: 'Table name "{table}" should use snake_case convention.',
         docs: 'table-naming-convention',
@@ -810,7 +881,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema',
         field: 'rule',
         input: ['schema-code'],
-        gating: true,
         resolvable: true,
         message: 'Reference to unknown table "{table}" ({type}). Did you mean: {suggestions}?',
         docs: 'unknown-table',
@@ -832,7 +902,6 @@ export const RULE_REGISTRY = {
         analyzer: 'react',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'React hook "{name}" does not follow the "use*" naming convention.',
         docs: 'hooks-naming',
@@ -850,7 +919,6 @@ export const RULE_REGISTRY = {
         analyzer: 'react',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'React component "{name}" has complexity {complexity}, exceeding the maximum.',
         docs: 'complexity',
@@ -869,7 +937,6 @@ export const RULE_REGISTRY = {
         field: 'rule',
         configGate: 'requirePropTypes',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'React component "{name}" is missing prop-types.',
         docs: 'missing-props',
@@ -887,7 +954,6 @@ export const RULE_REGISTRY = {
         analyzer: 'react',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'React component tree is missing an error boundary.',
         docs: 'no-error-boundary',
@@ -906,7 +972,6 @@ export const RULE_REGISTRY = {
         field: 'rule',
         configGate: 'requireMemoization',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'React component "{name}" is missing memoization.',
         docs: 'performance',
@@ -924,7 +989,6 @@ export const RULE_REGISTRY = {
         analyzer: 'react',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Accessibility issue in component "{name}": {issue}.',
         docs: 'accessibility',
@@ -942,7 +1006,6 @@ export const RULE_REGISTRY = {
         analyzer: 'react',
         field: 'rule',
         input: ['files'],
-        gating: true,
         resolvable: true,
         message: 'raw `<{element}>` — this project uses `<{wrapper}>` ({file}).',
         docs: 'raw-element',
@@ -965,7 +1028,6 @@ export const RULE_REGISTRY = {
         analyzer: 'invariants',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Invalid invariant config: {error}.',
         docs: 'config-error',
@@ -983,7 +1045,6 @@ export const RULE_REGISTRY = {
         analyzer: 'invariants',
         field: 'rule',
         input: ['files'],
-        gating: false,
         resolvable: false,
         message: 'Invariant rule engine error: {error}.',
         docs: 'engine-error',
@@ -1002,7 +1063,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema-validator',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Field mismatch: {detail}.',
         docs: 'field-mismatch',
@@ -1020,7 +1080,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema-validator',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Schema field type-name strings differ: {detail}.',
         docs: 'schema-field-mismatch',
@@ -1038,7 +1097,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema-validator',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Missing field: {field}.',
         docs: 'missing-field',
@@ -1056,7 +1114,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema-validator',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Extra field: {field}.',
         docs: 'extra-field',
@@ -1074,7 +1131,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema-validator',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Constraint mismatch: {detail}.',
         docs: 'constraint-mismatch',
@@ -1092,7 +1148,6 @@ export const RULE_REGISTRY = {
         analyzer: 'schema-validator',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Version mismatch: {detail}.',
         docs: 'version-mismatch',
@@ -1111,7 +1166,6 @@ export const RULE_REGISTRY = {
         analyzer: 'api-contract',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'API type mismatch: {detail}.',
         docs: 'api-type-mismatch',
@@ -1129,7 +1183,6 @@ export const RULE_REGISTRY = {
         analyzer: 'api-contract',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Missing API endpoint: {endpoint}.',
         docs: 'missing-endpoint',
@@ -1147,7 +1200,6 @@ export const RULE_REGISTRY = {
         analyzer: 'api-contract',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Extra field in API response: {field}.',
         docs: 'api-extra-field',
@@ -1165,7 +1217,6 @@ export const RULE_REGISTRY = {
         analyzer: 'api-contract',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Missing field in API response: {field}.',
         docs: 'api-missing-field',
@@ -1183,7 +1234,6 @@ export const RULE_REGISTRY = {
         analyzer: 'api-contract',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'HTTP method mismatch: {detail}.',
         docs: 'method-mismatch',
@@ -1201,7 +1251,6 @@ export const RULE_REGISTRY = {
         analyzer: 'api-contract',
         field: 'rule',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Authentication mismatch: {detail}.',
         docs: 'auth-mismatch',
@@ -1220,7 +1269,6 @@ export const RULE_REGISTRY = {
         analyzer: 'dependency-graph',
         field: 'type',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Circular dependency detected: {cycle}.',
         docs: 'circular-dependency',
@@ -1238,7 +1286,6 @@ export const RULE_REGISTRY = {
         analyzer: 'dependency-graph',
         field: 'type',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Break dependency cycle: {cycle}.',
         docs: 'break-cycles',
@@ -1256,7 +1303,6 @@ export const RULE_REGISTRY = {
         analyzer: 'dependency-graph',
         field: 'type',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Tight coupling detected between {a} and {b}.',
         docs: 'tight-coupling',
@@ -1274,7 +1320,6 @@ export const RULE_REGISTRY = {
         analyzer: 'dependency-graph',
         field: 'type',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Reduce coupling between {a} and {b}.',
         docs: 'reduce-coupling',
@@ -1292,7 +1337,6 @@ export const RULE_REGISTRY = {
         analyzer: 'dependency-graph',
         field: 'type',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Hub node "{node}" has {count} dependencies.',
         docs: 'hub-nodes',
@@ -1310,7 +1354,6 @@ export const RULE_REGISTRY = {
         analyzer: 'dependency-graph',
         field: 'type',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Split responsibilities of node "{node}".',
         docs: 'split-responsibilities',
@@ -1328,7 +1371,6 @@ export const RULE_REGISTRY = {
         analyzer: 'dependency-graph',
         field: 'type',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Orphaned node "{node}" has no connections.',
         docs: 'orphaned-nodes',
@@ -1346,7 +1388,6 @@ export const RULE_REGISTRY = {
         analyzer: 'dependency-graph',
         field: 'type',
         input: ['cross-language-entities'],
-        gating: false,
         resolvable: false,
         message: 'Review orphaned nodes: {nodes}.',
         docs: 'review-orphans',
@@ -1360,12 +1401,28 @@ export const RULE_REGISTRY = {
             ],
         },
     },
+    'unreferenced-module': {
+        analyzer: 'dependency-graph',
+        field: 'type',
+        input: ['cross-language-entities'],
+        resolvable: false,
+        message: 'Module is not imported by any other file and is not a framework entry point — dead code candidate.',
+        docs: 'unreferenced-module',
+        thresholds: [],
+        samples: {
+            valid: [
+                { code: 'export function used() {}', nearMiss: true },
+            ],
+            invalid: [
+                { code: '// file exports symbols but nothing imports it' },
+            ],
+        },
+    },
     // ── styles (UniversalStylesAnalyzer) ─────────────────────────────────────
     'styles/value-drift': {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: false,
         resolvable: false,
         message: 'Color value "{value}" drifts from the dominant token.',
         docs: 'styles/value-drift',
@@ -1383,7 +1440,6 @@ export const RULE_REGISTRY = {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: false,
         resolvable: false,
         message: 'Value "{value}" is off the project\'s design scale.',
         docs: 'styles/off-scale',
@@ -1401,7 +1457,6 @@ export const RULE_REGISTRY = {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: true,
         resolvable: true,
         message: 'Undefined CSS class: "{class}" has no matching definition.',
         docs: 'styles/undefined-class',
@@ -1422,7 +1477,6 @@ export const RULE_REGISTRY = {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: false,
         resolvable: false,
         message: 'Undefined-class detection skipped: {reason}.',
         docs: 'styles/undefined-class-disabled',
@@ -1440,7 +1494,6 @@ export const RULE_REGISTRY = {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: false,
         resolvable: false,
         message: 'Token bypass: raw value "{value}" used instead of a design token.',
         docs: 'styles/token-bypass',
@@ -1458,7 +1511,6 @@ export const RULE_REGISTRY = {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: false,
         resolvable: false,
         message: 'Styling mechanism fragmented across {count} mechanisms.',
         docs: 'styles/mechanism-fragmentation',
@@ -1476,7 +1528,6 @@ export const RULE_REGISTRY = {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: false,
         resolvable: false,
         message: 'Mixing styling mechanisms in one file.',
         docs: 'styles/mechanism-mixing',
@@ -1494,7 +1545,6 @@ export const RULE_REGISTRY = {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: false,
         resolvable: false,
         message: 'Declaration set similar to another block ({similarity}%).',
         docs: 'styles/declaration-set-similarity',
@@ -1512,7 +1562,6 @@ export const RULE_REGISTRY = {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: false,
         resolvable: false,
         message: 'Z-index sprawl: {count} distinct z-index values.',
         docs: 'styles/z-index-sprawl',
@@ -1530,7 +1579,6 @@ export const RULE_REGISTRY = {
         analyzer: 'styles',
         field: 'rule',
         input: ['styles-css'],
-        gating: false,
         resolvable: false,
         message: 'Z-index value "{value}" appears only once.',
         docs: 'styles/z-index-singleton',
@@ -1549,7 +1597,6 @@ export const RULE_REGISTRY = {
         analyzer: 'conventions',
         field: 'rule',
         input: ['function-index'],
-        gating: true,
         resolvable: true,
         message: '{pct}% of `{antecedent}` callers also call `{consequent}`.',
         docs: 'conventions/usage-pair',
@@ -1570,7 +1617,6 @@ export const RULE_REGISTRY = {
         analyzer: 'conventions',
         field: 'rule',
         input: ['function-index'],
-        gating: false,
         resolvable: false,
         message: 'Import form mismatch: use {form} for "{source}".',
         docs: 'conventions/import-form',
@@ -1588,7 +1634,6 @@ export const RULE_REGISTRY = {
         analyzer: 'conventions',
         field: 'rule',
         input: ['function-index'],
-        gating: false,
         resolvable: false,
         message: 'Error-handling convention mismatch: {detail}.',
         docs: 'conventions/error-handling',
@@ -1606,7 +1651,6 @@ export const RULE_REGISTRY = {
         analyzer: 'conventions',
         field: 'rule',
         input: ['function-index'],
-        gating: false,
         resolvable: false,
         message: 'Export shape mismatch: {detail}.',
         docs: 'conventions/export-shape',
@@ -1624,7 +1668,6 @@ export const RULE_REGISTRY = {
         analyzer: 'conventions',
         field: 'rule',
         input: ['function-index'],
-        gating: false,
         resolvable: false,
         message: 'Naming convention mismatch: {detail}.',
         docs: 'conventions/naming',
@@ -1643,7 +1686,6 @@ export const RULE_REGISTRY = {
         analyzer: 'cross-domain',
         field: 'rule',
         input: ['schema_usage', 'functions'],
-        gating: false,
         resolvable: false,
         message: 'Table "{table}" is written but never read.',
         docs: 'cross-domain/written-never-read',
@@ -1661,7 +1703,6 @@ export const RULE_REGISTRY = {
         analyzer: 'cross-domain',
         field: 'rule',
         input: ['schema_usage', 'functions'],
-        gating: false,
         resolvable: false,
         message: 'Table "{table}" is read but never written.',
         docs: 'cross-domain/read-never-written',
@@ -1679,7 +1720,6 @@ export const RULE_REGISTRY = {
         analyzer: 'cross-domain',
         field: 'rule',
         input: ['schema_usage', 'functions'],
-        gating: false,
         resolvable: false,
         message: 'Transaction boundary spans {count} tables.',
         docs: 'cross-domain/transaction-boundary',
@@ -1697,7 +1737,6 @@ export const RULE_REGISTRY = {
         analyzer: 'cross-domain',
         field: 'rule',
         input: ['schema_usage', 'functions'],
-        gating: false,
         resolvable: false,
         message: 'Validation bypass: {detail}.',
         docs: 'cross-domain/validation-bypass',
@@ -1715,7 +1754,6 @@ export const RULE_REGISTRY = {
         analyzer: 'cross-domain',
         field: 'rule',
         input: ['schema_usage', 'functions'],
-        gating: false,
         resolvable: false,
         message: 'Uncovered risk: {detail}.',
         docs: 'cross-domain/uncovered-risk',
@@ -1765,11 +1803,13 @@ export const MCP_DEFAULT_ANALYZERS = [
  * The registry records which field on the Violation carries the rule ID
  * (`field` — `rule` for almost every analyzer, `type` for dependency-graph).
  * This helper reads that field off the violation and matches it against the
- * registry key, so gate decisions (Spec 36 R4/R6) never hard-code a field.
+ * registry key, so the gate's resolution-gap detection (Spec 45 R1) never
+ * hard-codes a field.
  *
  * Invariant violations (user-defined rule IDs) have no registry entry and
- * return `undefined` — they are always "new" and never gating (their gate
- * decision is made by the invariant rule engine, not this map).
+ * return `undefined`. They still gate (Spec 45 R1) — the gate blocks on every
+ * finding at a blocking severity; the registry only determines whether a
+ * missing resolution is a recorded gap.
  */
 export function getViolationRuleEntry(v) {
     if (!v.analyzer)