codictator 0.0.0 → 0.1.3

package/dist/features/ci/workflow.js

@@ -0,0 +1,261 @@
+// SPEC §4.15.1: generated workflow rendering. Pure: action pins arrive via
+// options (resolved at generation time by latest stable, §4.8.3); the CLI
+// owns registry resolution and writes the file. Deterministic in its inputs,
+// so regen is byte-identical across OSes (§4.14 EC-11).
+import { sha256Text } from "../../kernel/index.js";
+// SPEC §4.15.1: pins resolved at generation by latest stable (§4.8.3).
+// Fallback used only when registry resolution is unavailable; generation
+// prefers caller-supplied pins and records their versions in comments.
+export const FALLBACK_PINS = {
+    checkoutSha: "3d3c42e5aac5ba805825da76410c181273ba90b1",
+    checkoutVersion: "v7.0.1",
+    setupNodeSha: "949feb2413d6458794dcd2491c4babbbce0c15c1",
+    setupNodeVersion: "v7.1.0",
+};
+// SPEC §4.15.1: daily schedule minute and hour derive from a hash of the
+// repo name to spread load; hex parsing keeps this deterministic.
+export function scheduleCronFor(repoName) {
+    const digest = sha256Text(repoName);
+    const minute = Number.parseInt(digest.slice(0, 4), 16) % 60;
+    const hour = Number.parseInt(digest.slice(4, 6), 16) % 24;
+    return `${minute} ${hour} * * *`;
+}
+function sweepPermissions(bot) {
+    if (bot === "none") {
+        return "    permissions:\n      contents: write\n      pull-requests: write\n";
+    }
+    // SPEC §4.15.1: a configured bot owns upgrades, so sweep stays read-only.
+    return "    permissions:\n      contents: read\n";
+}
+// SPEC §4.15.1: .github/workflows/codictator.yml, manifest-owned. Workflow
+// default is contents: read; jobs raise only what they need.
+// SPEC §4.15.5: this workflow also governs Codictator's own repo, where no
+// published `codictator` binary exists on PATH yet — every job therefore
+// bootstraps the CLI from the local checkout (setup-node, install, build)
+// and invokes the built entry, instead of assuming a published binary.
+// Build-from-source stays deterministic and keeps working post-publish.
+const CODICTATOR_RUN = "node packages/codictator/dist/cli/main.js";
+// SPEC §4.15.3: the step passes the PR author and the changed files from
+// the Actions context, so the command's --author/--files contract holds;
+// forks ride along as --fork and are never written to. (Actions
+// expressions stay literal via \${{ escapes; only the runner path
+// interpolates.)
+const recordBotChange = [
+    "      - run: |",
+    `          base_sha="\${{ github.event.pull_request.base.sha }}"`,
+    `          record_args=(--author "\${{ github.event.pull_request.user.login }}")`,
+    "          while IFS= read -r changed_file; do",
+    '            if [ -n "$changed_file" ]; then record_args+=(--files="$changed_file"); fi',
+    '          done < <(git diff --name-only "$base_sha"...HEAD --)',
+    `          if [ "\${{ github.event.pull_request.head.repo.fork }}" = "true" ]; then record_args+=(--fork); fi`,
+    `          ${CODICTATOR_RUN} ci record-bot-change "\${record_args[@]}"`,
+];
+// SPEC §10.6: the scheduled live job checks real registry and OSV response
+// shapes and harness-capture freshness, and opens an issue on drift. It is
+// never a merge gate: the required-check read matches only the `verify`
+// context (protection-read.ts strips matrix suffixes, then exact-matches),
+// so `live` can never satisfy it, and the job runs only on schedule or
+// manual dispatch — never on push or pull_request.
+const liveCheck = [
+    "      - name: live shape check (SPEC §10.6)",
+    "        run: |",
+    "          set -eu",
+    "          curl -sSf --max-time 60 -o /tmp/live-packument.json https://registry.npmjs.org/typescript",
+    `          curl -sSf --max-time 60 -H 'Content-Type: application/json' -d '{"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.20"}' -o /tmp/live-osv.json https://api.osv.dev/v1/query`,
+    "          node <<'EOF'",
+    "          const fs = require('fs');",
+    // §10.3 item 6 scans src for a JSON-parse call literal; the two uses below
+    // are YAML template text for the CI job's node script, not module
+    // parsing, so the call name is concatenated to keep the literal out of src.
+    "          function readJson(path) {",
+    "            return JSON." + "parse(fs.readFileSync(path, 'utf8'));",
+    "          }",
+    "          const packument = readJson('/tmp/live-packument.json');",
+    "          for (const key of ['name', 'versions', 'time', 'dist-tags']) {",
+    "            if (!(key in packument)) {",
+    "              throw new Error('registry shape drift: packument missing ' + key);",
+    "            }",
+    "          }",
+    "          console.log('registry shape ok: ' + packument.name);",
+    "          const osv = readJson('/tmp/live-osv.json');",
+    "          if ('vulns' in osv && !Array.isArray(osv.vulns)) {",
+    "            throw new Error('OSV shape drift: vulns is not a list');",
+    "          }",
+    "          console.log('OSV shape ok: ' + (osv.vulns || []).length + ' advisories');",
+    "          const root = 'packages/codictator/fixtures/harness';",
+    "          const stale = [];",
+    "          function hasDirect(dir, name) {",
+    "            return fs.readdirSync(dir).indexOf(name) >= 0;",
+    "          }",
+    "          function hasCapture(dir) {",
+    "            return fs.readdirSync(dir).some(function (entry) {",
+    "              return entry.endsWith('.json');",
+    "            });",
+    "          }",
+    "          for (const harness of fs.readdirSync(root).sort()) {",
+    "            const hdir = root + '/' + harness;",
+    "            if (!fs.statSync(hdir).isDirectory()) {",
+    "              continue;",
+    "            }",
+    "            for (const version of fs.readdirSync(hdir).sort()) {",
+    "              const dir = hdir + '/' + version;",
+    "              let stat = null;",
+    "              try {",
+    "                stat = fs.statSync(dir);",
+    "              } catch (ignored) {",
+    "                stat = null;",
+    "              }",
+    "              if (stat === null || !stat.isDirectory()) {",
+    "                continue;",
+    "              }",
+    "              if (!hasDirect(dir, 'README.md') && !hasCapture(dir)) {",
+    "                continue;",
+    "              }",
+    "              let readme = '';",
+    "              try {",
+    "                readme = fs.readFileSync(dir + '/README.md', 'utf8');",
+    "              } catch (ignored) {",
+    "                readme = '';",
+    "              }",
+    "              if (!/source:/i.test(readme) || !/version/i.test(readme)) {",
+    "                stale.push(dir + ' (README missing source/version)');",
+    "                continue;",
+    "              }",
+    "              for (const entry of fs.readdirSync(dir).sort()) {",
+    "                if (!entry.endsWith('.json')) {",
+    "                  continue;",
+    "                }",
+    "                let capture = null;",
+    "                try {",
+    "                  capture = JSON." +
+        "parse(fs.readFileSync(dir + '/' + entry, 'utf8'));",
+    "                } catch (ignored) {",
+    "                  capture = null;",
+    "                }",
+    "                if (capture === null || typeof capture.provenance !== 'string' || capture.provenance === '') {",
+    "                  stale.push(dir + '/' + entry + ' (no provenance)');",
+    "                }",
+    "              }",
+    "            }",
+    "          }",
+    "          if (stale.length > 0) {",
+    "            throw new Error('capture freshness drift: ' + stale.join(', '));",
+    "          }",
+    "          console.log('capture freshness ok');",
+    "          EOF",
+];
+const liveIssue = [
+    "      - name: open drift issue",
+    "        if: failure()",
+    "        env:",
+    `          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}`,
+    "        run: |",
+    `          gh issue create --title "[live] scheduled drift detected" --body "The scheduled live job (SPEC §10.6) detected drift: a registry/OSV response shape changed or a harness capture lost its provenance. See the failing run: \${{ github.server_url }}/\${{ github.repository }}/actions/runs/\${{ github.run_id }}."`,
+];
+export function renderWorkflow(repoRoot, options) {
+    const os = options?.os ?? ["ubuntu-latest"];
+    const branch = options?.defaultBranch ?? "main";
+    const pins = options?.pins ?? FALLBACK_PINS;
+    const bot = options?.bot ?? "none";
+    const name = repoRoot.replaceAll("\\", "/").split("/").pop() ?? "repo";
+    const cron = scheduleCronFor(options?.repoName ?? name);
+    const matrix = os.map((runner) => `"${runner}"`).join(", ");
+    const text = [
+        "name: codictator",
+        "",
+        "# Generated by `codictator regen` (SPEC §4.15.1); do not edit by hand.",
+        "on:",
+        "  push:",
+        `    branches: [${branch}]`,
+        "  pull_request:",
+        "  schedule:",
+        `    - cron: "${cron}"`,
+        "  workflow_dispatch:",
+        "",
+        "permissions:",
+        "  contents: read",
+        "",
+        "concurrency:",
+        `  group: codictator-\${{ github.ref }}`,
+        `  cancel-in-progress: \${{ github.event_name == 'pull_request' }}`,
+        "",
+        "jobs:",
+        "  verify:",
+        `    runs-on: \${{ matrix.os }}`,
+        "    strategy:",
+        "      matrix:",
+        `        os: [${matrix}]`,
+        "    steps:",
+        `      - uses: actions/checkout@${pins.checkoutSha} # ${pins.checkoutVersion}`,
+        "        with:",
+        "          fetch-depth: 0",
+        "          persist-credentials: false",
+        `      - uses: actions/setup-node@${pins.setupNodeSha} # ${pins.setupNodeVersion}`,
+        "        with:",
+        "          node-version-file: .nvmrc",
+        "          cache: npm",
+        "      - run: npm ci --ignore-scripts",
+        "      - run: npm run build",
+        `      - run: ${CODICTATOR_RUN} ci verify`,
+        "",
+        "  record-bot-change:",
+        "    if: github.event_name == 'pull_request'",
+        "    permissions:",
+        "      contents: write",
+        "    runs-on: ubuntu-latest",
+        "    steps:",
+        `      - uses: actions/checkout@${pins.checkoutSha} # ${pins.checkoutVersion}`,
+        "        with:",
+        "          fetch-depth: 0",
+        `      - uses: actions/setup-node@${pins.setupNodeSha} # ${pins.setupNodeVersion}`,
+        "        with:",
+        "          node-version-file: .nvmrc",
+        "          cache: npm",
+        "      - run: npm ci --ignore-scripts",
+        "      - run: npm run build",
+        ...recordBotChange,
+        "",
+        "  sweep:",
+        "    if: github.event_name == 'schedule'",
+        sweepPermissions(bot).trimEnd(),
+        "    runs-on: ubuntu-latest",
+        "    steps:",
+        `      - uses: actions/checkout@${pins.checkoutSha} # ${pins.checkoutVersion}`,
+        "        with:",
+        "          fetch-depth: 0",
+        `      - uses: actions/setup-node@${pins.setupNodeSha} # ${pins.setupNodeVersion}`,
+        "        with:",
+        "          node-version-file: .nvmrc",
+        "          cache: npm",
+        "      - run: npm ci --ignore-scripts",
+        "      - run: npm run build",
+        `      - run: ${CODICTATOR_RUN} ci sweep`,
+        "",
+        "  live:",
+        "    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'",
+        "    permissions:",
+        "      contents: read",
+        "      issues: write",
+        "    runs-on: ubuntu-latest",
+        "    steps:",
+        `      - uses: actions/checkout@${pins.checkoutSha} # ${pins.checkoutVersion}`,
+        "        with:",
+        "          fetch-depth: 0",
+        `      - uses: actions/setup-node@${pins.setupNodeSha} # ${pins.setupNodeVersion}`,
+        "        with:",
+        "          node-version-file: .nvmrc",
+        "          cache: npm",
+        "      - run: npm ci --ignore-scripts",
+        "      - run: npm run build",
+        ...liveCheck,
+        ...liveIssue,
+        "",
+    ].join("\n");
+    return {
+        host: "github",
+        os,
+        steps: ["checkout", "setup-node", "install", "build", "verify"],
+        text,
+        scheduleCron: cron,
+    };
+}

package/dist/features/config/human.d.ts

@@ -0,0 +1,4 @@
+import type { Env } from "../../kernel/index.ts";
+export declare const HOOK_MARKER = "CODICTATOR_HOOK";
+export declare function requireHuman(env: Env, isTty: boolean, agentMarkers?: ReadonlyArray<string>): void;
+export declare function checkAgentMarkers(env: Env): void;

package/dist/features/config/human.js

@@ -0,0 +1,31 @@
+import { makeError } from "../../kernel/index.js";
+// SPEC §4.2.3: set by the launcher in every agent-owned process.
+export const HOOK_MARKER = "CODICTATOR_HOOK";
+function humanOnlyError(reason) {
+    return makeError("CDX-E107", `human-only command refused: ${reason}`, "Run this command yourself in an interactive terminal, not through an agent or hook.");
+}
+// SPEC §4.2.3: agent markers are CODICTATOR_HOOK=1 plus every configured
+// adapter's agentEnvMarkers (§7.9), which the CLI passes in.
+export function requireHuman(env, isTty, agentMarkers = []) {
+    const hook = env.get(HOOK_MARKER);
+    if (hook === "1") {
+        throw humanOnlyError(`${HOOK_MARKER}=1 is set`);
+    }
+    for (const marker of agentMarkers) {
+        const seen = env.get(marker);
+        if (seen !== undefined && seen !== "") {
+            throw humanOnlyError(`agent marker ${marker} is set`);
+        }
+    }
+    if (!isTty) {
+        throw humanOnlyError("no interactive TTY on stdin and stdout");
+    }
+}
+// SPEC §4.2.4 EC-10: config loading refuses agent-owned processes outright;
+// the TTY half of §4.2.3 is enforced by requireHuman at the CLI layer.
+export function checkAgentMarkers(env) {
+    const hook = env.get(HOOK_MARKER);
+    if (hook === "1") {
+        throw humanOnlyError(`${HOOK_MARKER}=1 is set`);
+    }
+}

package/dist/features/config/index.d.ts

@@ -0,0 +1,37 @@
+import type { Ports } from "../../kernel/index.ts";
+export { checkAgentMarkers, HOOK_MARKER, requireHuman } from "./human.ts";
+export interface ConfigTunable {
+    readonly params: Readonly<Record<string, unknown>>;
+}
+export interface Config {
+    readonly version: 1;
+    readonly codictator: string;
+    readonly packs: ReadonlyArray<{
+        readonly id: string;
+        readonly version?: string;
+        readonly path?: string;
+    }>;
+    readonly harnesses: ReadonlyArray<string>;
+    readonly tunables: Readonly<Record<string, ConfigTunable>>;
+    readonly architecture?: unknown;
+    readonly workflow?: unknown;
+    readonly spec?: unknown;
+    readonly testing?: unknown;
+    readonly commands?: Readonly<Record<string, ReadonlyArray<string>>>;
+    readonly steering?: unknown;
+    readonly tools?: ReadonlyArray<unknown>;
+    readonly security?: unknown;
+    readonly deps?: unknown;
+    readonly network?: unknown;
+    readonly integrity?: unknown;
+    readonly ci?: unknown;
+    readonly llm?: unknown;
+}
+export interface EffectiveConfig {
+    readonly config: Config;
+    readonly configHash: string;
+}
+export declare const ENGINE_VERSION = "0.0.0";
+export declare function configHashFor(config: Config): string;
+export declare function validateConfig(value: unknown, engineVersion?: string): EffectiveConfig;
+export declare function loadConfig(repoRoot: string, ports?: Ports, engineVersion?: string): Promise<EffectiveConfig>;

package/dist/features/config/index.js

@@ -0,0 +1,129 @@
+// SPEC §4.2: config load, validate, tighten. Owns the §7.2 format.
+import { globMatch, makeError, NodeEnv, NodeFs, NodeGit, NodeNet, NodeProc, normalizeText, parseJson, SystemClock, sha256Text, stableStringify, } from "../../kernel/index.js";
+import { checkAgentMarkers } from "./human.js";
+import { validateConfigValue } from "./validate.js";
+export { checkAgentMarkers, HOOK_MARKER, requireHuman } from "./human.js";
+// Mirrors packages/codictator/package.json version. The CLI passes the real
+// installed version when it can read its own manifest; tests pin "0.0.0".
+export const ENGINE_VERSION = "0.0.0";
+const CONFIG_REL = ".codictator/config.json";
+// Manifest names that mark a directory a repo without Codictator config.
+const MANIFEST_FILES = [
+    "package.json",
+    "pyproject.toml",
+    "setup.py",
+    "setup.cfg",
+    "requirements.txt",
+    "Cargo.toml",
+    "go.mod",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "composer.json",
+    "Gemfile",
+    "Package.swift",
+    "pubspec.yaml",
+    "deno.json",
+    "deno.jsonc",
+];
+const MANIFEST_GLOBS = ["*.sln", "*.csproj", "*.fsproj"];
+function cleanRoot(repoRoot) {
+    const stripped = repoRoot.replace(/\/+$/, "");
+    return stripped === "" ? "." : stripped;
+}
+function deepFreeze(value) {
+    if (typeof value !== "object" || value === null || Object.isFrozen(value)) {
+        return;
+    }
+    for (const entry of Object.values(value)) {
+        deepFreeze(entry);
+    }
+    Object.freeze(value);
+}
+// SPEC §4.2.1 step 5: the frozen config hashed with the kernel canonical
+// form, normalized first so CRLF-bearing values hash identically cross-OS
+// (CONVENTIONS determinism). Every surface evaluates the same rule set.
+export function configHashFor(config) {
+    return sha256Text(normalizeText(stableStringify(config)));
+}
+function finishConfig(config) {
+    const frozen = structuredClone(config);
+    deepFreeze(frozen);
+    return { config: frozen, configHash: configHashFor(frozen) };
+}
+// SPEC §4.2.2: tunables tighten only; any loosening is an error.
+export function validateConfig(value, engineVersion = ENGINE_VERSION) {
+    return finishConfig(validateConfigValue(value, engineVersion));
+}
+async function findManifest(fs, root) {
+    for (const name of MANIFEST_FILES) {
+        const seen = await fs.exists(`${root}/${name}`);
+        if (seen.ok && seen.value) {
+            return name;
+        }
+    }
+    // The glob patterns are top-level-only: per SPEC §4.1.2 a bare `*`
+    // never crosses `/`, so a recursive walk can only ever match the top
+    // level. One listing answers every pattern without the descent (which
+    // also walks `.git`; SPEC §10.5 carries the same scoping as a
+    // non-normative hint). The returned pattern strings and their order
+    // are unchanged, so resolution semantics are identical.
+    const listed = await fs.list(root);
+    if (!listed.ok) {
+        return undefined;
+    }
+    for (const pattern of MANIFEST_GLOBS) {
+        if (listed.value.some((name) => globMatch(pattern, name))) {
+            return pattern;
+        }
+    }
+    return undefined;
+}
+// SPEC §4.2.1: resolution order is the repo config file, validated in full.
+// Ports are injected; without them the composition uses the live kernel
+// ports rooted at repoRoot. Throws the CdxError its SPEC row owns.
+export async function loadConfig(repoRoot, ports, engineVersion = ENGINE_VERSION) {
+    const root = cleanRoot(repoRoot);
+    let active = ports;
+    if (active === undefined) {
+        const made = await NodeFs.create({ root });
+        if (!made.ok) {
+            throw makeError("CDX-E108", `not a Codictator repo under ${root}: cannot resolve a repo root there`, "Run codictator init inside a repository to adopt it, or change into a Codictator repo.", made.error.message);
+        }
+        const proc = new NodeProc();
+        active = {
+            fs: made.value,
+            proc,
+            net: new NodeNet(),
+            clock: new SystemClock(),
+            git: new NodeGit(proc, root),
+            env: new NodeEnv(),
+        };
+    }
+    // SPEC §4.2.4 EC-10: an agent-owned process never loads config.
+    checkAgentMarkers(active.env);
+    const configRel = `${root}/${CONFIG_REL}`;
+    const seen = await active.fs.exists(configRel);
+    if (!seen.ok) {
+        throw makeError("CDX-E101", `cannot read ${configRel}`, "Fix permissions on .codictator/config.json, then retry.", seen.error.message);
+    }
+    if (!seen.value) {
+        const manifest = await findManifest(active.fs, root);
+        if (manifest !== undefined) {
+            throw makeError("CDX-E101", `${CONFIG_REL} is missing but ${manifest} exists`, "Run codictator init --repair to recreate the config.");
+        }
+        throw makeError("CDX-E108", `no ${CONFIG_REL} and no manifest under ${root}: not a Codictator repo`, "Run codictator init inside a repository to adopt it, or change into a Codictator repo.");
+    }
+    const text = await active.fs.readText(configRel);
+    if (!text.ok) {
+        throw makeError("CDX-E101", `${CONFIG_REL} is unreadable`, "Fix the file so it parses as JSON matching schema/config.schema.json, then retry.", text.error.message);
+    }
+    const parsed = parseJson(text.value);
+    if (!parsed.ok) {
+        throw parsed.error;
+    }
+    // SPEC §3.3: config imports kernel only, so the CDX-E103 integrity event
+    // the SPEC §4.2.4 EC-6 row pairs with the error is emitted by the caller
+    // (engine or CLI), which may compose config with audit.
+    return finishConfig(validateConfigValue(parsed.value, engineVersion));
+}

package/dist/features/config/pack-data.d.ts

@@ -0,0 +1,18 @@
+export type Stricter = "lower" | "higher" | "subset" | "superset" | "policy";
+export interface NumericParam {
+    readonly kind: "number";
+    readonly default: number;
+    readonly bound: number;
+    readonly stricter: "lower" | "higher";
+}
+export interface SetParam {
+    readonly kind: "set";
+    readonly default: ReadonlyArray<string>;
+    readonly stricter: "subset" | "superset";
+}
+export interface PolicyParam {
+    readonly kind: "policy";
+}
+export type ParamSpec = NumericParam | SetParam | PolicyParam;
+export declare const TUNABLE_PARAMS: Readonly<Record<string, Readonly<Record<string, ParamSpec>>>>;
+export declare const FLOOR_RULES: ReadonlySet<string>;

package/dist/features/config/pack-data.js

@@ -0,0 +1,116 @@
+function numeric(defaultValue, bound, stricter) {
+    return { kind: "number", default: defaultValue, bound, stricter };
+}
+function stringSet(defaultValue, stricter) {
+    return { kind: "set", default: defaultValue, stricter };
+}
+const POLICY = { kind: "policy" };
+// SPEC §5.1, §5.3, §5.4, §5.6, §5.7, §5.9, §5.10, §5.12: every tunable rule
+// of the core pack. Defaults and bounds are the table values verbatim.
+export const TUNABLE_PARAMS = {
+    "core/context-soft-band": { softPercent: numeric(60, 70, "lower") },
+    "core/context-hard-band": { hardPercent: numeric(75, 85, "lower") },
+    "core/session-tool-call-limit": { maxToolCalls: numeric(300, 500, "lower") },
+    "core/dep-latest-stable": {
+        lagDays: numeric(30, 60, "lower"),
+        majorLagDays: numeric(60, 120, "lower"),
+        minReleaseAgeDays: numeric(7, 3, "higher"),
+    },
+    "core/dep-license": { allow: POLICY },
+    "core/coverage-floor": {
+        lines: numeric(90, 80, "higher"),
+        branches: numeric(80, 70, "higher"),
+    },
+    "core/file-size": { maxLines: numeric(300, 500, "lower") },
+    "core/function-size": { maxLines: numeric(40, 80, "lower") },
+    "core/complexity": { maxCyclomatic: numeric(10, 15, "lower") },
+    "core/duplication": { minTokens: numeric(50, 100, "lower") },
+    "core/ratchet-touched-improves": { minDecrement: numeric(1, 1, "higher") },
+    "core/remediation-step-size": {
+        maxFiles: numeric(10, 20, "lower"),
+        maxChangedLines: numeric(300, 600, "lower"),
+    },
+    "core/max-file-bytes": { maxBytes: numeric(1048576, 5242880, "lower") },
+    "core/arch-module-size": {
+        maxFiles: numeric(80, 150, "lower"),
+        maxLines: numeric(8000, 15000, "lower"),
+    },
+    "core/loop-breaker": { maxRepeats: numeric(3, 5, "lower") },
+    "core/review-round-cap": { maxRounds: numeric(3, 5, "lower") },
+    "core/doc-placement": { allowedGlobs: stringSet([], "subset") },
+    "core/doc-size": {
+        maxBytes: numeric(40000, 60000, "lower"),
+        maxLines: numeric(500, 800, "lower"),
+    },
+    "core/doc-breadth": {
+        maxH2: numeric(15, 25, "lower"),
+        maxFilesPerFolder: numeric(40, 60, "lower"),
+    },
+    "core/doc-density": {
+        maxSentenceWords: numeric(40, 55, "lower"),
+        maxParagraphSentences: numeric(6, 9, "lower"),
+    },
+    "core/agent-assets-present": {
+        requiredHelpers: stringSet(["knowledge-graph", "token-saver"], "superset"),
+    },
+};
+// SPEC §5.1–§5.12: every rule the tables mark floor. A floor rule id under
+// tunables or in a waiver is CDX-E103 (§4.2.2).
+export const FLOOR_RULES = new Set([
+    "core/read-dedupe",
+    "core/graph-before-scan",
+    "core/mcp-declared",
+    "core/no-secrets",
+    "core/no-secret-reads",
+    "core/dangerous-shell",
+    "core/write-confinement",
+    "core/dep-exact-pin",
+    "core/dep-lockfile",
+    "core/dep-no-vulnerable",
+    "core/dep-no-deprecated",
+    "core/dep-new-needs-reason",
+    "core/dep-one-per-capability",
+    "core/spec-trace",
+    "core/red-before-green",
+    "core/test-kinds-by-scenario",
+    "core/regression-test-for-fix",
+    "core/no-assertion-loss",
+    "core/no-skipped-tests",
+    "core/no-new-suppressions",
+    "core/no-fixture-shrink",
+    "core/no-threshold-lowering",
+    "core/test-command-intact",
+    "core/no-baseline-raise",
+    "core/dead-code",
+    "core/no-speculative-abstraction",
+    "core/no-guard-removal",
+    "core/arch-profile-declared",
+    "core/arch-module-mapped",
+    "core/arch-boundaries",
+    "core/arch-public-entry",
+    "core/arch-no-cycles",
+    "core/compiler-strict",
+    "core/history-entry",
+    "core/history-append-only",
+    "core/history-entry-complete",
+    "core/bug-registry",
+    "core/bug-rows-immutable",
+    "core/diagnose-before-fix",
+    "core/workflow-gates",
+    "core/writes-within-plan",
+    "core/review-gate",
+    "core/conventional-commit",
+    "core/no-bypass",
+    "core/repo-hygiene",
+    "core/file-naming",
+    "core/branch-protection",
+    "core/ci-present",
+    "core/ci-required-check",
+    "core/ci-actions-pinned",
+    "core/perf-budgets",
+    "core/guardrail-manifest",
+    "core/hooks-active",
+    "core/engine-version-match",
+    "core/waivers-valid",
+    "core/custom-pack-selftest",
+]);

package/dist/features/config/validate-sections.d.ts

@@ -0,0 +1,6 @@
+export declare function validateWorkflowPhases(raw: unknown): void;
+export declare function validateArchitecture(raw: unknown): void;
+export declare function validateTools(raw: unknown): void;
+export declare function validateLlm(raw: unknown): void;
+export declare function validatePacks(raw: unknown): Set<string>;
+export declare function validateHarnesses(raw: unknown): void;