code-auditor-mcp 4.1.1 → 5.0.2

package/dist/analyzers/ruleRegistry.js

@@ -9,8 +9,6 @@
 export const RULE_REGISTRY = {
     // ── solid (UniversalSOLIDAnalyzer) ──────────────────────────────────────
     'solid/class-size': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'Class "{name}" has {methods} methods, exceeding the maximum of {max}. Consider splitting into smaller classes.',
@@ -30,8 +28,6 @@ export const RULE_REGISTRY = {
         },
     },
     'solid/method-complexity': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Method "{name}" has cyclomatic complexity {complexity}, exceeding the maximum of {max}.',
@@ -48,8 +44,6 @@ export const RULE_REGISTRY = {
         },
     },
     'solid/open-closed': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Class "{name}" uses instanceof against a user-defined type.',
@@ -65,8 +59,6 @@ export const RULE_REGISTRY = {
         },
     },
     'solid/single-responsibility': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'Function "{name}" mixes unrelated responsibilities. Split it into one function per concern.',
@@ -87,8 +79,6 @@ export const RULE_REGISTRY = {
         },
     },
     'function-length': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'Function "{name}" has {lines} lines, exceeding the maximum of {max}. Consider breaking it down.',
@@ -108,8 +98,6 @@ export const RULE_REGISTRY = {
         },
     },
     'parameter-count': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'Function "{name}" has {params} parameters, exceeding the maximum of {max}. Consider using an options object.',
@@ -129,8 +117,6 @@ export const RULE_REGISTRY = {
         },
     },
     'interface-size': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Interface "{name}" has many members.',
@@ -153,8 +139,6 @@ export const RULE_REGISTRY = {
     // panic()) rule. They were missing from the registry, so Go findings were
     // invisible to coverage and `describeRuleId` reported them `unknown`.
     'switch-size': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Switch or type switch has many case clauses.',
@@ -174,8 +158,6 @@ export const RULE_REGISTRY = {
         },
     },
     'function-size': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Function has many parameters, multiple returns, and high complexity.',
@@ -195,8 +177,6 @@ export const RULE_REGISTRY = {
         },
     },
     'struct-size': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Struct has many fields.',
@@ -216,8 +196,6 @@ export const RULE_REGISTRY = {
         },
     },
     'liskov-substitution': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Method calls panic().',
@@ -236,14 +214,12 @@ export const RULE_REGISTRY = {
         },
     },
     // ── Go non-SOLID rules (Spec-54 severity) ──────────────────────────────
-    // The Go subprocess emits these under a single `go` analyzer namespace: the
-    // subprocess's internal `imports`/`errors`/`goroutines`/`channels` dispatch is
+    // The Go phase rules emit these under a single `go` analyzer namespace: the
+    // rules' internal `imports`/`errors`/`goroutines`/`channels` provenance is
     // collapsed to `go` at emit time so its structure does not surface as four
     // analyzer names a user has to learn. Registered here so coverage and
     // describeRuleId see them, and so their severities carry a registry entry.
     'channel-deadlock': {
-        analyzer: 'go',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Guaranteed deadlock: an unbuffered channel is both sent to and received from in the same goroutine.',
@@ -263,8 +239,6 @@ export const RULE_REGISTRY = {
         },
     },
     'error-handling': {
-        analyzer: 'go',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Function assigns an error that is never checked, returned, or propagated.',
@@ -284,8 +258,6 @@ export const RULE_REGISTRY = {
         },
     },
     'concurrency': {
-        analyzer: 'go',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Function launches a goroutine without synchronization.',
@@ -305,8 +277,6 @@ export const RULE_REGISTRY = {
         },
     },
     'import-organization': {
-        analyzer: 'go',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Import block mixes standard library and third-party imports without grouping.',
@@ -326,8 +296,6 @@ export const RULE_REGISTRY = {
         },
     },
     'import-style': {
-        analyzer: 'go',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Dot import detected — can lead to namespace pollution.',
@@ -347,8 +315,6 @@ export const RULE_REGISTRY = {
         },
     },
     'solid/liskov-substitution': {
-        analyzer: 'solid',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Method "{name}" overrides a parent method and throws where the parent does not.',
@@ -363,27 +329,8 @@ export const RULE_REGISTRY = {
             ],
         },
     },
-    'solid/dependency-inversion': {
-        analyzer: 'solid',
-        field: 'rule',
-        input: ['files'],
-        resolvable: false,
-        message: 'Module "{name}" violates the Dependency Inversion Principle.',
-        docs: 'solid/dependency-inversion',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'class Service {\n  constructor(repo) { this.repo = repo; }\n}', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'class Service {\n  constructor() { this.repo = new PostgresRepo(); }\n}' },
-            ],
-        },
-    },
     // ── dry (UniversalDRYAnalyzer) ──────────────────────────────────────────
     'dry/duplicate': {
-        analyzer: 'dry',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'Duplicate code block detected ({lines} lines). First occurrence at {file}:{line}.',
@@ -407,9 +354,6 @@ export const RULE_REGISTRY = {
         },
     },
     'dry/structural-similarity': {
-        analyzer: 'dry',
-        field: 'rule',
-        configGate: 'checkStructuralSimilarity',
         input: ['files'],
         resolvable: false,
         message: 'Structurally similar code block detected ({similarity}% similar to {file}:{line}).',
@@ -432,9 +376,6 @@ export const RULE_REGISTRY = {
         },
     },
     'dry/similar-expression': {
-        analyzer: 'dry',
-        field: 'rule',
-        configGate: 'checkExpressionSimilarity',
         input: ['files'],
         resolvable: true,
         message: 'Near-identical expression detected ({shared} shared {unit}: {names}). First occurrence at {file}:{line}.',
@@ -471,8 +412,6 @@ export const RULE_REGISTRY = {
     // across consecutive runs (copy-paste then edit one side). Cross-run: emitted
     // by the divergence-tracking pass in auditRunner, not the per-file DRY visitor.
     'dry/diverging-clone': {
-        analyzer: 'dry',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Clone pair has diverged: similarity dropped {drop} (from {previous} to {current}) across {runs} consecutive runs. Review {file1}:{line1} and {file2}:{line2} for diverged logic.',
@@ -491,9 +430,6 @@ export const RULE_REGISTRY = {
         },
     },
     'duplicate-string-literal': {
-        analyzer: 'dry',
-        field: 'rule',
-        configGate: 'checkStrings',
         input: ['files'],
         resolvable: false,
         message: 'String literal "{text}" is duplicated {count} times.',
@@ -509,9 +445,6 @@ export const RULE_REGISTRY = {
         },
     },
     'duplicate-import': {
-        analyzer: 'dry',
-        field: 'rule',
-        configGate: 'checkImports',
         input: ['files'],
         resolvable: false,
         message: 'Duplicate import of "{module}".',
@@ -528,8 +461,6 @@ export const RULE_REGISTRY = {
     },
     // ── data-access (UniversalDataAccessAnalyzer) ───────────────────────────
     'sql-injection-risk': {
-        analyzer: 'data-access',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'Potential SQL injection risk in {method}. Use parameterized queries.',
@@ -537,19 +468,17 @@ export const RULE_REGISTRY = {
         thresholds: [],
         samples: {
             valid: [
-                { code: 'db.query("SELECT * FROM users WHERE id = ?", [userId])', nearMiss: true },
+                { code: 'const db: D1Database = getDb();\ndb.query("SELECT * FROM users WHERE id = ?", [userId])', nearMiss: true },
             ],
             invalid: [
                 {
-                    code: 'db.query("SELECT * FROM users WHERE id = " + userId)',
+                    code: 'import { Pool } from "pg";\nconst db = new Pool();\ndb.query("SELECT * FROM users WHERE id = " + userId)',
                     resolution: { action: 'parameterize', summary: 'Replace the string-concatenated SQL with a parameterized query using the driver\'s placeholder form.', symbols: ['query'] },
                 },
             ],
         },
     },
     'missing-org-filter': {
-        analyzer: 'data-access-org-filter',
-        field: 'rule',
         input: ['data-access', 'schema'],
         resolvable: true,
         // The claim is "no organization/tenant *predicate*", NOT "no filter". A
@@ -577,8 +506,6 @@ export const RULE_REGISTRY = {
         },
     },
     'complex-query': {
-        analyzer: 'data-access',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Query references many tables (join-heavy).',
@@ -586,17 +513,15 @@ export const RULE_REGISTRY = {
         thresholds: ['performanceThresholds.joinedTableCount'],
         samples: {
             valid: [
-                { code: 'db.query("SELECT COUNT(*) FROM users")', nearMiss: true },
-                { code: 'db.query("SELECT * FROM users WHERE id IN (SELECT user_id FROM orders)")', nearMiss: true },
+                { code: 'const db: D1Database = getDb();\ndb.query("SELECT COUNT(*) FROM users")', nearMiss: true },
+                { code: 'const db: D1Database = getDb();\ndb.query("SELECT * FROM users WHERE id IN (SELECT user_id FROM orders)")', nearMiss: true },
             ],
             invalid: [
-                { code: 'db.query("SELECT * FROM a JOIN b JOIN c JOIN d JOIN e JOIN f JOIN g JOIN h JOIN i")' },
+                { code: 'const db: D1Database = getDb();\ndb.query("SELECT * FROM a JOIN b JOIN c JOIN d JOIN e JOIN f JOIN g JOIN h JOIN i")' },
             ],
         },
     },
     'unfiltered-query': {
-        analyzer: 'data-access',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Unfiltered write or tenant-scoped read on {tables} has no WHERE/HAVING/LIMIT.',
@@ -604,17 +529,15 @@ export const RULE_REGISTRY = {
         thresholds: [],
         samples: {
             valid: [
-                { code: 'db.query("SELECT * FROM users")', nearMiss: true },
-                { code: 'db.query("DELETE FROM users WHERE id = ?", [id])', nearMiss: true },
+                { code: 'const db: D1Database = getDb();\ndb.query("SELECT * FROM users")', nearMiss: true },
+                { code: 'const db: D1Database = getDb();\ndb.query("UPDATE users SET active = 0 WHERE id = ?")', nearMiss: true },
             ],
             invalid: [
-                { code: 'db.query("DELETE FROM users")' },
+                { code: 'const db: D1Database = getDb();\ndb.query("UPDATE users SET active = 0")' },
             ],
         },
     },
     'hardcoded-connection': {
-        analyzer: 'data-access',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Hardcoded database connection string detected.',
@@ -630,8 +553,6 @@ export const RULE_REGISTRY = {
         },
     },
     'loop-query': {
-        analyzer: 'data-access',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Database query inside a loop detected in {method}.',
@@ -642,15 +563,12 @@ export const RULE_REGISTRY = {
                 { code: 'for (const id of ids) {\n  cache.set(id, lookup(id));\n}', nearMiss: true },
             ],
             invalid: [
-                { code: 'for (const id of ids) {\n  db.query("SELECT * FROM users WHERE id = ?", [id]);\n}' },
+                { code: 'const db: D1Database = getDb();\nfor (const id of ids) {\n  db.query("SELECT * FROM users WHERE id = ?", [id]);\n}' },
             ],
         },
     },
     // ── secrets (UniversalSecretsAnalyzer) ──────────────────────────────────
     'hardcoded-secret': {
-        analyzer: 'secrets',
-        field: 'rule',
-        configGate: 'checkHardcodedSecrets',
         input: ['files'],
         resolvable: true,
         message: 'Hardcoded secret detected: a credential value is embedded in source. Move it to an environment variable or secret store.',
@@ -684,8 +602,6 @@ export const RULE_REGISTRY = {
     },
     // ── documentation (UniversalDocumentationAnalyzer) ─────────────────────
     'file-documentation': {
-        analyzer: 'documentation',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'File is missing a leading documentation comment.',
@@ -701,8 +617,6 @@ export const RULE_REGISTRY = {
         },
     },
     'function-documentation': {
-        analyzer: 'documentation',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Function "{name}" is missing a doc comment.',
@@ -718,8 +632,6 @@ export const RULE_REGISTRY = {
         },
     },
     'parameter-documentation': {
-        analyzer: 'documentation',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Parameter "{name}" in function "{func}" is missing a @param tag.',
@@ -735,8 +647,6 @@ export const RULE_REGISTRY = {
         },
     },
     'return-documentation': {
-        analyzer: 'documentation',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Function "{name}" is missing a @returns tag.',
@@ -763,8 +673,6 @@ export const RULE_REGISTRY = {
         },
     },
     'class-documentation': {
-        analyzer: 'documentation',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Class "{name}" is missing a doc comment.',
@@ -780,8 +688,6 @@ export const RULE_REGISTRY = {
         },
     },
     'method-documentation': {
-        analyzer: 'documentation',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Method "{name}" is missing a doc comment.',
@@ -799,8 +705,6 @@ export const RULE_REGISTRY = {
     // ── schema (UniversalSchemaAnalyzer) ────────────────────────────────────
     // JSON validation rules → emitted by the schema-json visitor path.
     'invalid-json': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Invalid JSON: {error}.',
@@ -816,8 +720,6 @@ export const RULE_REGISTRY = {
         },
     },
     'missing-schema-declaration': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Missing JSON schema declaration.',
@@ -833,8 +735,6 @@ export const RULE_REGISTRY = {
         },
     },
     'undefined-required-field': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Undefined required field "{field}".',
@@ -850,8 +750,6 @@ export const RULE_REGISTRY = {
         },
     },
     'invalid-type': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Invalid type for field "{field}".',
@@ -867,8 +765,6 @@ export const RULE_REGISTRY = {
         },
     },
     'invalid-range': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Invalid range for field "{field}".',
@@ -884,8 +780,6 @@ export const RULE_REGISTRY = {
         },
     },
     'type-mismatch': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Type mismatch for field "{field}".',
@@ -901,8 +795,6 @@ export const RULE_REGISTRY = {
         },
     },
     'string-too-short': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'String value too short for field "{field}".',
@@ -918,8 +810,6 @@ export const RULE_REGISTRY = {
         },
     },
     'string-too-long': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'String value too long for field "{field}".',
@@ -935,8 +825,6 @@ export const RULE_REGISTRY = {
         },
     },
     'pattern-mismatch': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Value does not match pattern for field "{field}".',
@@ -952,8 +840,6 @@ export const RULE_REGISTRY = {
         },
     },
     'invalid-format': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Invalid format for field "{field}".',
@@ -969,8 +855,6 @@ export const RULE_REGISTRY = {
         },
     },
     'below-minimum': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Value below minimum for field "{field}".',
@@ -986,8 +870,6 @@ export const RULE_REGISTRY = {
         },
     },
     'above-maximum': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Value above maximum for field "{field}".',
@@ -1003,8 +885,6 @@ export const RULE_REGISTRY = {
         },
     },
     'too-few-items': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Too few items for field "{field}".',
@@ -1020,8 +900,6 @@ export const RULE_REGISTRY = {
         },
     },
     'too-many-items': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Too many items for field "{field}".',
@@ -1037,8 +915,6 @@ export const RULE_REGISTRY = {
         },
     },
     'missing-required-field': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Missing required field "{field}".',
@@ -1054,8 +930,6 @@ export const RULE_REGISTRY = {
         },
     },
     'unexpected-property': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Unexpected property "{property}".',
@@ -1071,8 +945,6 @@ export const RULE_REGISTRY = {
         },
     },
     'enum-mismatch': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-json'],
         resolvable: false,
         message: 'Value does not match any enum value for field "{field}".',
@@ -1089,8 +961,6 @@ export const RULE_REGISTRY = {
     },
     // SQL-injection → emitted by the schema-code visitor over TS/JS source.
     'dynamic-sql-construction': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-code'],
         resolvable: false,
         message: 'SQL query built via string interpolation or concatenation in {method}; use parameterized queries.',
@@ -1098,19 +968,16 @@ export const RULE_REGISTRY = {
         thresholds: [],
         samples: {
             valid: [
-                { code: 'db.query("SELECT * FROM t WHERE id = ?", [id])', nearMiss: true },
+                { code: 'const db: D1Database = getDb();\ndb.query("SELECT * FROM t WHERE id = ?", [id])', nearMiss: true },
             ],
             invalid: [
-                { code: 'db.query("SELECT * FROM t WHERE id = " + id)' },
+                { code: 'const db: D1Database = getDb();\ndb.query("SELECT * FROM t WHERE id = " + id)' },
             ],
         },
     },
     // Table naming-convention check → emitted by the schema-code visitor.
     // Spec 38 R5: renamed from `naming-convention` (see src/ruleAliases.ts).
     'table-naming-convention': {
-        analyzer: 'schema',
-        field: 'rule',
-        configGate: 'checkNamingConventions',
         input: ['schema-code'],
         resolvable: false,
         message: 'Table name "{table}" should use snake_case convention.',
@@ -1127,8 +994,6 @@ export const RULE_REGISTRY = {
     },
     // Cross-file unknown-table detection → emitted by the schema Stage 3 reducer.
     'unknown-table': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-code'],
         resolvable: true,
         message: 'Reference to unknown table "{table}" ({type}). Did you mean: {suggestions}?',
@@ -1136,11 +1001,11 @@ export const RULE_REGISTRY = {
         thresholds: [],
         samples: {
             valid: [
-                { code: 'db.query("SELECT * FROM users")', nearMiss: true },
+                { code: 'const db: D1Database = getDb();\ndb.query("SELECT * FROM users")', nearMiss: true },
             ],
             invalid: [
                 {
-                    code: 'db.query("SELECT * FROM user")',
+                    code: 'const db: D1Database = getDb();\ndb.query("SELECT * FROM user")',
                     resolution: { action: 'use-known-table', summary: 'Rename the table reference "user" to the nearest known table "users".', symbols: ['users'] },
                 },
             ],
@@ -1152,8 +1017,6 @@ export const RULE_REGISTRY = {
     // reference, not a typo, so the message names the dropping migration and the
     // tables it created in its place.
     'stale-table-reference': {
-        analyzer: 'schema',
-        field: 'rule',
         input: ['schema-code'],
         resolvable: true,
         message: 'Reference to dropped table "{table}" — dropped in {migration}.',
@@ -1161,7 +1024,7 @@ export const RULE_REGISTRY = {
         thresholds: [],
         samples: {
             valid: [
-                { code: 'db.query("SELECT * FROM users")', nearMiss: true },
+                { code: 'const db: D1Database = getDb();\ndb.query("SELECT * FROM users")', nearMiss: true },
             ],
             invalid: [
                 {
@@ -1176,9 +1039,6 @@ export const RULE_REGISTRY = {
     // (like the other schema rules) has no config shape in the threshold-validation
     // test, so the knob is documented here rather than declared in `thresholds`.
     'too-many-queries': {
-        analyzer: 'schema',
-        field: 'rule',
-        configGate: 'validateQueryPatterns',
         input: ['schema-code'],
         resolvable: false,
         message: 'Function "{name}" has {count} queries, exceeding the maximum of {max}.',
@@ -1186,10 +1046,10 @@ export const RULE_REGISTRY = {
         thresholds: [],
         samples: {
             valid: [
-                { code: 'function getUser(id) {\n  return db.query("SELECT * FROM users WHERE id = ?", [id]);\n}', nearMiss: true },
+                { code: 'const db: D1Database = getDb();\nfunction getUser(id) {\n  return db.query("SELECT * FROM users WHERE id = ?", [id]);\n}', nearMiss: true },
             ],
             invalid: [
-                { code: 'function loadDashboard() {\n  db.query("SELECT * FROM users");\n  db.query("SELECT * FROM orders");\n  db.query("SELECT * FROM products");\n  db.query("SELECT * FROM reviews");\n  db.query("SELECT * FROM events");\n  db.query("SELECT * FROM alerts");\n}' },
+                { code: 'const db: D1Database = getDb();\nfunction loadDashboard() {\n  db.query("SELECT * FROM users");\n  db.query("SELECT * FROM orders");\n  db.query("SELECT * FROM products");\n  db.query("SELECT * FROM reviews");\n  db.query("SELECT * FROM events");\n  db.query("SELECT * FROM alerts");\n}' },
             ],
         },
     },
@@ -1197,13 +1057,11 @@ export const RULE_REGISTRY = {
     // constant, computed/concatenated expression, call result) is no longer a
     // violation rule. It moved to the coverage-diagnostics channel
     // (`CoverageDiagnostic`, kind `unresolved-query`) — surfaced in the report
-    // with file+line, never blocking. The registry entry is removed so
-    // `buildCoverageReport` doesn't classify it `clean` (which would assert the
-    // tool checked something it no longer checks as a finding).
+    // with file+line, never blocking. The registry entry is removed so derived
+    // coverage doesn't classify it `clean` (which would assert the tool checked
+    // something it no longer checks as a finding).
     // ── react (reactAnalyzer) ───────────────────────────────────────────────
     'hooks-naming': {
-        analyzer: 'react',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'React hook "{name}" does not follow the "use*" naming convention.',
@@ -1219,8 +1077,6 @@ export const RULE_REGISTRY = {
         },
     },
     'complexity': {
-        analyzer: 'react',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'React component "{name}" has complexity {complexity}, exceeding the maximum.',
@@ -1243,9 +1099,6 @@ export const RULE_REGISTRY = {
         },
     },
     'missing-props': {
-        analyzer: 'react',
-        field: 'rule',
-        configGate: 'requirePropTypes',
         input: ['files'],
         resolvable: false,
         message: 'React component "{name}" is missing prop-types.',
@@ -1261,8 +1114,6 @@ export const RULE_REGISTRY = {
         },
     },
     'no-error-boundary': {
-        analyzer: 'react',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'React component tree is missing an error boundary.',
@@ -1278,9 +1129,6 @@ export const RULE_REGISTRY = {
         },
     },
     'performance': {
-        analyzer: 'react',
-        field: 'rule',
-        configGate: 'requireMemoization',
         input: ['files'],
         resolvable: false,
         message: 'React component "{name}" is missing memoization.',
@@ -1296,8 +1144,6 @@ export const RULE_REGISTRY = {
         },
     },
     'accessibility': {
-        analyzer: 'react',
-        field: 'rule',
         input: ['files'],
         resolvable: false,
         message: 'Accessibility issue in component "{name}": {issue}.',
@@ -1313,8 +1159,6 @@ export const RULE_REGISTRY = {
         },
     },
     'raw-element': {
-        analyzer: 'react',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'raw `<{element}>` — this project uses `<{wrapper}>` ({file}).',
@@ -1338,13 +1182,11 @@ export const RULE_REGISTRY = {
     // the coverage-diagnostics channel (`CoverageDiagnostic`, kinds `config-error`
     // / `engine-error`). A bad `.codeauditor.json` or a rule-engine failure is a
     // tool-side "couldn't do its job", not a defect in the audited code. The
-    // registry entries are removed so `buildCoverageReport` doesn't classify them
+    // registry entries are removed so derived coverage doesn't classify them
     // `clean` (which would assert the tool checked something it no longer checks
     // as a finding).
     // ── schema-validator (SchemaValidator) ──────────────────────────────────
     'schema-field-mismatch': {
-        analyzer: 'schema-validator',
-        field: 'rule',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Schema field type-name strings differ: {detail}.',
@@ -1360,8 +1202,6 @@ export const RULE_REGISTRY = {
         },
     },
     'missing-field': {
-        analyzer: 'schema-validator',
-        field: 'rule',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Missing field: {field}.',
@@ -1377,8 +1217,6 @@ export const RULE_REGISTRY = {
         },
     },
     'extra-field': {
-        analyzer: 'schema-validator',
-        field: 'rule',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Extra field: {field}.',
@@ -1395,8 +1233,6 @@ export const RULE_REGISTRY = {
     },
     // ── dependency-graph (DependencyGraphBuilder) ───────────────────────────
     'circular-dependency': {
-        analyzer: 'dependency-graph',
-        field: 'type',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Circular dependency detected: {cycle}.',
@@ -1412,8 +1248,6 @@ export const RULE_REGISTRY = {
         },
     },
     'break-cycles': {
-        analyzer: 'dependency-graph',
-        field: 'type',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Break dependency cycle: {cycle}.',
@@ -1429,14 +1263,12 @@ export const RULE_REGISTRY = {
         },
     },
     'tight-coupling': {
-        analyzer: 'dependency-graph',
-        field: 'type',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Tight coupling detected between {a} and {b}.',
         docs: 'tight-coupling',
         thresholds: [],
-        thresholdRationale: 'Cohesion (internal edges / incident edges) > 0.7 — 70% of a cluster\'s edges staying internal is genuinely tight. A density ratio, not a "size" number; fires once per corpus. Kept at 0.7.',
+        thresholdRationale: 'Pairwise coupling (cross-cluster edges / (cross + internal edges)) > 0.7 with ≥ 3 cross edges — two packages are tightly coupled when their mutual edges dominate the edges that stay inside either package. The prior metric measured single-cluster cohesion (internal / incident edges), which inverted the concept and flagged well-factored packages; this measures actual coupling between distinct clusters.',
         samples: {
             valid: [
                 { code: 'import { one } from "./m";', nearMiss: true },
@@ -1447,8 +1279,6 @@ export const RULE_REGISTRY = {
         },
     },
     'reduce-coupling': {
-        analyzer: 'dependency-graph',
-        field: 'type',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Reduce coupling between {a} and {b}.',
@@ -1463,43 +1293,7 @@ export const RULE_REGISTRY = {
             ],
         },
     },
-    'hub-nodes': {
-        analyzer: 'dependency-graph',
-        field: 'type',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'Hub node "{node}" has {count} dependencies.',
-        docs: 'hub-nodes',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'export function small() {}', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'export function hub() {\n  a(); b(); c(); d(); e(); f(); g(); h(); i(); j();\n}' },
-            ],
-        },
-    },
-    'split-responsibilities': {
-        analyzer: 'dependency-graph',
-        field: 'type',
-        input: ['cross-language-entities'],
-        resolvable: false,
-        message: 'Split responsibilities of node "{node}".',
-        docs: 'split-responsibilities',
-        thresholds: [],
-        samples: {
-            valid: [
-                { code: 'export function focused() { return a(); }', nearMiss: true },
-            ],
-            invalid: [
-                { code: 'export function multi() {\n  readDb(); writeLog(); renderUi(); sendMail();\n}' },
-            ],
-        },
-    },
     'orphaned-nodes': {
-        analyzer: 'dependency-graph',
-        field: 'type',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Orphaned node "{node}" has no connections.',
@@ -1515,8 +1309,6 @@ export const RULE_REGISTRY = {
         },
     },
     'review-orphans': {
-        analyzer: 'dependency-graph',
-        field: 'type',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Review orphaned nodes: {nodes}.',
@@ -1532,8 +1324,6 @@ export const RULE_REGISTRY = {
         },
     },
     'unreferenced-module': {
-        analyzer: 'dependency-graph',
-        field: 'type',
         input: ['cross-language-entities'],
         resolvable: false,
         message: 'Module is not imported by any other file and is not a framework entry point — dead code candidate.',
@@ -1552,16 +1342,14 @@ export const RULE_REGISTRY = {
     // specifier is no longer a violation rule. It moved to the coverage-
     // diagnostics channel (`CoverageDiagnostic`, kind `unresolved-dynamic-import`)
     // — surfaced with file+line, never blocking. Removed from the registry so
-    // `buildCoverageReport` doesn't flip it to a false `clean`.
+    // derived coverage doesn't flip it to a false `clean`.
     // ── styles (UniversalStylesAnalyzer) ─────────────────────────────────────
     'styles/value-drift': {
-        analyzer: 'styles',
-        field: 'rule',
         input: ['styles-css'],
         resolvable: false,
-        message: 'Color value "{value}" drifts from the dominant token.',
+        message: 'Color drift in "{property}": "{value}" is near-identical to "{canonical}" (ΔE = {d}). Consider using "{canonical}".',
         docs: 'styles/value-drift',
-        thresholds: ['colorDeltaE', 'outlierMaxShare'],
+        thresholds: ['colorDeltaE'],
         samples: {
             valid: [
                 { code: '.btn { color: var(--brand); }', nearMiss: true },
@@ -1572,13 +1360,11 @@ export const RULE_REGISTRY = {
         },
     },
     'styles/off-scale': {
-        analyzer: 'styles',
-        field: 'rule',
         input: ['styles-css'],
         resolvable: false,
         message: 'Value "{value}" is off the Tailwind spacing scale.',
         docs: 'styles/off-scale',
-        thresholds: ['minCorpus'],
+        thresholds: ['offScaleMinDeclarations'],
         samples: {
             valid: [
                 { code: '.x { padding: 8px; }', nearMiss: true },
@@ -1589,8 +1375,6 @@ export const RULE_REGISTRY = {
         },
     },
     'styles/undefined-class': {
-        analyzer: 'styles',
-        field: 'rule',
         input: ['styles-css'],
         resolvable: true,
         message: 'Class "{class}" was not found in any read stylesheet or utility set.',
@@ -1615,8 +1399,6 @@ export const RULE_REGISTRY = {
     // do its job", not a defect. The registry entry is removed so coverage never
     // asserts the tool checked something it no longer checks as a finding.
     'styles/token-bypass': {
-        analyzer: 'styles',
-        field: 'rule',
         input: ['styles-css'],
         resolvable: false,
         message: 'Token bypass: raw value "{value}" used instead of a design token.',
@@ -1632,8 +1414,6 @@ export const RULE_REGISTRY = {
         },
     },
     'styles/mechanism-fragmentation': {
-        analyzer: 'styles',
-        field: 'rule',
         input: ['styles-css'],
         resolvable: false,
         message: 'Styling mechanism fragmented across {count} mechanisms.',
@@ -1649,8 +1429,6 @@ export const RULE_REGISTRY = {
         },
     },
     'styles/mechanism-mixing': {
-        analyzer: 'styles',
-        field: 'rule',
         input: ['styles-css'],
         resolvable: false,
         message: 'Mixing styling mechanisms in one file.',
@@ -1666,8 +1444,6 @@ export const RULE_REGISTRY = {
         },
     },
     'styles/declaration-set-similarity': {
-        analyzer: 'styles',
-        field: 'rule',
         input: ['styles-css'],
         resolvable: false,
         message: 'Declaration set similar to another block ({similarity}%).',
@@ -1683,8 +1459,6 @@ export const RULE_REGISTRY = {
         },
     },
     'styles/z-index-sprawl': {
-        analyzer: 'styles',
-        field: 'rule',
         input: ['styles-css'],
         resolvable: false,
         message: 'Z-index sprawl: {count} distinct z-index values.',
@@ -1700,8 +1474,6 @@ export const RULE_REGISTRY = {
         },
     },
     'styles/z-index-singleton': {
-        analyzer: 'styles',
-        field: 'rule',
         input: ['styles-css'],
         resolvable: false,
         message: 'Z-index value "{value}" appears only once.',
@@ -1718,8 +1490,6 @@ export const RULE_REGISTRY = {
     },
     // ── conventions (UniversalConventionsAnalyzer) ───────────────────────────
     'conventions/usage-pair': {
-        analyzer: 'conventions',
-        field: 'rule',
         input: ['function-index'],
         resolvable: true,
         message: '{pct}% of `{antecedent}` callers also call `{consequent}`.',
@@ -1738,8 +1508,6 @@ export const RULE_REGISTRY = {
         },
     },
     'conventions/import-form': {
-        analyzer: 'conventions',
-        field: 'rule',
         input: ['function-index'],
         resolvable: false,
         message: 'Import form mismatch: use {form} for "{source}".',
@@ -1755,8 +1523,6 @@ export const RULE_REGISTRY = {
         },
     },
     'conventions/error-handling': {
-        analyzer: 'conventions',
-        field: 'rule',
         input: ['function-index'],
         resolvable: false,
         message: 'Error-handling convention mismatch: {detail}.',
@@ -1772,8 +1538,6 @@ export const RULE_REGISTRY = {
         },
     },
     'conventions/export-shape': {
-        analyzer: 'conventions',
-        field: 'rule',
         input: ['function-index'],
         resolvable: false,
         message: 'Export shape mismatch: {detail}.',
@@ -1789,8 +1553,6 @@ export const RULE_REGISTRY = {
         },
     },
     'conventions/naming': {
-        analyzer: 'conventions',
-        field: 'rule',
         input: ['function-index'],
         resolvable: false,
         message: 'Naming convention mismatch: {detail}.',
@@ -1807,8 +1569,6 @@ export const RULE_REGISTRY = {
     },
     // ── cross-domain (CrossDomainAnalyzer) ────────────────────────────────────
     'cross-domain/written-never-read': {
-        analyzer: 'cross-domain',
-        field: 'rule',
         input: ['schema_usage', 'functions'],
         resolvable: false,
         message: 'Table "{table}" is written but never read.',
@@ -1824,8 +1584,6 @@ export const RULE_REGISTRY = {
         },
     },
     'cross-domain/read-never-written': {
-        analyzer: 'cross-domain',
-        field: 'rule',
         input: ['schema_usage', 'functions'],
         resolvable: false,
         message: 'Table "{table}" is read but never written.',
@@ -1841,8 +1599,6 @@ export const RULE_REGISTRY = {
         },
     },
     'cross-domain/multi-table-write': {
-        analyzer: 'cross-domain',
-        field: 'rule',
         input: ['schema_usage', 'functions'],
         resolvable: false,
         message: 'Function writes to {count} distinct tables.',
@@ -1858,8 +1614,6 @@ export const RULE_REGISTRY = {
         },
     },
     'cross-domain/no-validator-reachable': {
-        analyzer: 'cross-domain',
-        field: 'rule',
         input: ['schema_usage', 'functions'],
         resolvable: false,
         message: 'No validator reachable within BFS depth: {detail}.',
@@ -1875,8 +1629,6 @@ export const RULE_REGISTRY = {
         },
     },
     'cross-domain/uncovered-risk': {
-        analyzer: 'cross-domain',
-        field: 'rule',
         input: ['schema_usage', 'functions'],
         resolvable: false,
         message: 'Uncovered risk: {detail}.',
@@ -1893,8 +1645,6 @@ export const RULE_REGISTRY = {
     },
     // ── security (UniversalSecurityAnalyzer) — Spec 61 R6 ─────────────────────
     'command-injection-risk': {
-        analyzer: 'security',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'Unsafe process invocation: {method} is passed a command built by interpolation/concatenation.',
@@ -1910,8 +1660,6 @@ export const RULE_REGISTRY = {
         },
     },
     'dynamic-require-of-project-path': {
-        analyzer: 'security',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'Dynamic require/import of a project config path: {path}.',
@@ -1928,8 +1676,6 @@ export const RULE_REGISTRY = {
         },
     },
     'unescaped-html-interpolation': {
-        analyzer: 'security',
-        field: 'rule',
         input: ['files'],
         resolvable: true,
         message: 'Unescaped HTML interpolation: {field} is inserted into an HTML template without an escaping call.',
@@ -1958,61 +1704,12 @@ export const RULE_REGISTRY = {
         },
     },
 };
-/**
- * Canonical set of every analyzer ID that emits at least one rule in
- * {@link RULE_REGISTRY}, derived from the registry itself. An analyzer "exists"
- * iff it emits a rule, so this is the single source of truth for analyzer
- * identity.
- *
- * Every other analyzer list — the audit-runner registry, config validation,
- * default-enabled analyzers, the detached runner, and the MCP default set —
- * must derive from this rather than re-type names. Adding an analyzer is then a
- * registry edit plus an enable decision, never a hunt across hand-maintained
- * arrays that drift out of sync (the historical failure: four lists at 13, 10,
- * 10, and 7).
- */
-export const ALL_ANALYZERS = [
-    ...new Set(Object.values(RULE_REGISTRY).map((e) => e.analyzer)),
-].sort();
-/**
- * The reduced analyzer set the MCP `audit.run` surface enables by default —
- * a deliberate subset of {@link ALL_ANALYZERS} (the MCP path favors a lighter,
- * latency-sensitive audit). The full CLI `audit` default is {@link ALL_ANALYZERS}.
- * Referenced here so mcp.ts and mcp-tools-shared.ts don't each re-type the list.
- */
-export const MCP_DEFAULT_ANALYZERS = [
-    'solid',
-    'dry',
-    'documentation',
-    'react',
-    'data-access',
-    'data-access-org-filter',
-];
-/**
- * Analyzers the pipeline can run that emit *no* registry rule. Their rules come
- * from a runtime source other than {@link RULE_REGISTRY}: `invariants` reads its
- * rules from the `.codeauditor.json` `rules` array (the seven invariant rule
- * kinds), not from registry rows, so it is absent from {@link ALL_ANALYZERS}.
- */
-export const PIPELINE_ONLY_ANALYZERS = ['invariants'];
-/**
- * Every analyzer `enabledAnalyzers` may legitimately name — {@link ALL_ANALYZERS}
- * (registry rule emitters) plus {@link PIPELINE_ONLY_ANALYZERS}. This is the
- * single source of truth for "can this analyzer actually run?" — used by config
- * validation, which must not reject `invariants` (a valid pipeline analyzer that
- * happens to carry no registry rule).
- */
-export const RUNNABLE_ANALYZERS = [
-    ...new Set([...ALL_ANALYZERS, ...PIPELINE_ONLY_ANALYZERS]),
-].sort();
 /**
  * Resolve a violation to its canonical {@link RuleRegistryEntry}, if any.
  *
- * The registry records which field on the Violation carries the rule ID
- * (`field` — `rule` for almost every analyzer, `type` for dependency-graph).
- * This helper reads that field off the violation and matches it against the
- * registry key, so the gate's resolution-gap detection (Spec 45 R1) never
- * hard-codes a field.
+ * Every migrated rule is re-emitted into the result with `rule` set to its
+ * canonical registry id (the both-paths split, Spec 68 §11.1), so the registry
+ * is a direct lookup by that id — no analyzer/field indirection remains.
  *
  * Invariant violations (user-defined rule IDs) have no registry entry and
  * return `undefined`. They still gate (Spec 45 R1) — the gate blocks on every
@@ -2020,15 +1717,8 @@ export const RUNNABLE_ANALYZERS = [
  * missing resolution is a recorded gap.
  */
 export function getViolationRuleEntry(v) {
-    if (!v.analyzer)
+    if (!v.rule)
         return undefined;
-    for (const [ruleId, entry] of Object.entries(RULE_REGISTRY)) {
-        if (entry.analyzer !== v.analyzer)
-            continue;
-        const value = v[entry.field];
-        if (value === ruleId)
-            return entry;
-    }
-    return undefined;
+    return RULE_REGISTRY[v.rule];
 }
 //# sourceMappingURL=ruleRegistry.js.map