fallow 3.1.0 → 3.3.0

package/capabilities.json

@@ -1,6 +1,6 @@
 {
   "name": "fallow",
-  "version": "3.1.0",
+  "version": "3.3.0",
   "manifest_version": "1",
   "description": "Codebase analyzer for TypeScript/JavaScript: unused code, circular dependencies, code duplication, complexity hotspots, and architecture boundary violations",
   "global_flags": [
@@ -985,6 +985,11 @@
       "description": "Print the JSON Schema for external plugin files",
       "flags": []
     },
+    {
+      "name": "plugin-check",
+      "description": "Dry-run external plugins: report what each activated and seeded",
+      "flags": []
+    },
     {
       "name": "rule-pack-schema",
       "description": "Print the JSON Schema for rule pack files",
@@ -1023,6 +1028,11 @@
         }
       ]
     },
+    {
+      "name": "recommend",
+      "description": "Recommend a project-tailored config for an agent to author",
+      "flags": []
+    },
     {
       "name": "list",
       "description": "List discovered entry points, files, plugins, boundaries, and workspaces",
@@ -1909,6 +1919,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file unused-file",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -1943,6 +1956,9 @@
       "fixable": true,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-export",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -1974,6 +1990,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-type",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2008,6 +2027,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line private-type-leak",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Opt-in API hygiene check; the rule defaults to off",
       "license": "free",
       "license_note": null,
@@ -2042,6 +2064,9 @@
       "fixable": true,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "--unused-deps controls unused-dependency, unused-dev-dependency, unused-optional-dependency, type-only-dependency, and test-only-dependency",
       "license": "free",
       "license_note": null,
@@ -2079,6 +2104,9 @@
       "fixable": true,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "--unused-deps controls unused-dependency, unused-dev-dependency, unused-optional-dependency, type-only-dependency, and test-only-dependency",
       "license": "free",
       "license_note": null,
@@ -2116,6 +2144,9 @@
       "fixable": true,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "--unused-deps controls unused-dependency, unused-dev-dependency, unused-optional-dependency, type-only-dependency, and test-only-dependency",
       "license": "free",
       "license_note": null,
@@ -2150,6 +2181,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Only reported in --production mode; --unused-deps scopes it together with the other dependency kinds",
       "license": "free",
       "license_note": null,
@@ -2184,6 +2218,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Not reported in --production mode (test files are excluded there); --unused-deps scopes it together with the other dependency kinds",
       "license": "free",
       "license_note": null,
@@ -2218,6 +2255,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2252,6 +2292,9 @@
       "fixable": true,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-enum-member",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2286,6 +2329,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-class-member",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2322,6 +2368,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-store-member",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2356,6 +2405,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unresolved-import",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2390,6 +2442,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2424,6 +2479,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file duplicate-export",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "fallow fix can add an ignoreExports rule to the fallow config instead of editing source",
       "license": "free",
       "license_note": null,
@@ -2460,6 +2518,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line circular-dependency",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2498,6 +2559,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file re-export-cycle",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2532,6 +2596,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line boundary-violation",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires configured boundary zones (boundaries config)",
       "license": "free",
       "license_note": null,
@@ -2565,6 +2632,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file boundary-violation",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires boundaries.coverage.requireAllFiles",
       "license": "free",
       "license_note": null,
@@ -2599,6 +2669,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line boundary-call-violation",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires boundaries.calls.forbidden patterns",
       "license": "free",
       "license_note": null,
@@ -2632,6 +2705,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line policy-violation",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires a configured rule pack (rulePacks config)",
       "license": "free",
       "license_note": null,
@@ -2665,6 +2741,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Fix by removing the stale suppression marker itself",
       "license": "free",
       "license_note": null,
@@ -2694,6 +2773,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2731,6 +2813,9 @@
       "fixable": true,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2768,6 +2853,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2805,6 +2893,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2843,6 +2934,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2881,6 +2975,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -2914,6 +3011,11 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line invalid-client-export",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [
+        "next"
+      ],
       "note": "Requires the project to declare next",
       "license": "free",
       "license_note": null,
@@ -2947,6 +3049,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line mixed-client-server-barrel",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires the project to declare next",
       "license": "free",
       "license_note": null,
@@ -2980,6 +3085,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line misplaced-directive",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": "Requires the project to declare next",
       "license": "free",
       "license_note": null,
@@ -3013,6 +3121,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unprovided-inject",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3046,6 +3157,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unrendered-component",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3079,6 +3193,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-component-prop",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3112,6 +3229,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-component-emit",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3145,6 +3265,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-component-input",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3178,6 +3301,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-component-output",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3211,6 +3337,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-svelte-event",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3244,6 +3373,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-server-action",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3277,6 +3409,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line unused-load-data-key",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3306,6 +3441,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line prop-drilling",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Opt-in: set rules.prop-drilling to warn or error to enable. Defaults to off.",
       "license": "free",
       "license_note": null,
@@ -3337,6 +3475,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line thin-wrapper",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Opt-in: set rules.thin-wrapper to warn or error to enable. Defaults to off.",
       "license": "free",
       "license_note": null,
@@ -3368,6 +3509,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line duplicate-prop-shape",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Opt-in: set rules.duplicate-prop-shape to warn or error to enable. Defaults to off.",
       "license": "free",
       "license_note": null,
@@ -3401,6 +3545,11 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file route-collision",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [
+        "next"
+      ],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3434,6 +3583,11 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file dynamic-segment-name-conflict",
+      "default_severity": "error",
+      "opt_in": false,
+      "frameworks": [
+        "next"
+      ],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3461,6 +3615,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3488,6 +3645,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3515,6 +3675,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3542,6 +3705,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line complexity",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3569,6 +3735,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3596,6 +3765,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-token-drift",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3623,6 +3795,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-duplicate-block",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3650,6 +3825,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-selector-complexity",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3677,6 +3855,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-dead-surface",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3704,6 +3885,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line css-broken-reference",
+      "default_severity": "warn",
+      "opt_in": false,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3731,6 +3915,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file coverage-gaps",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3758,6 +3945,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file coverage-gaps",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -3785,6 +3975,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3812,6 +4005,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3839,6 +4035,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3866,6 +4065,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3893,6 +4095,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Requires --runtime-coverage input (V8 directory, V8 JSON, or Istanbul map)",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3920,6 +4125,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Produced by fallow coverage analyze",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3947,6 +4155,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Produced by fallow coverage analyze",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -3974,6 +4185,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Produced by fallow coverage analyze",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -4001,6 +4215,9 @@
       "fixable": false,
       "suppressible": false,
       "suppress_comment": null,
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Produced by fallow coverage analyze",
       "license": "freemium",
       "license_note": "A single local runtime-coverage capture is free; continuous or multi-capture runtime monitoring requires an active license (fallow license activate).",
@@ -4028,6 +4245,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line code-duplication",
+      "default_severity": null,
+      "opt_in": null,
+      "frameworks": [],
       "note": "Reported by fallow dupes (and bare fallow / fallow audit)",
       "license": "free",
       "license_note": null,
@@ -4055,6 +4275,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line feature-flag",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Reported by fallow flags",
       "license": "free",
       "license_note": null,
@@ -4082,6 +4305,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -4109,6 +4335,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-file security-client-server-leak",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": null,
       "license": "free",
       "license_note": null,
@@ -4136,6 +4365,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Include-required category: enable via security.categories.include",
       "license": "free",
       "license_note": null,
@@ -4163,6 +4395,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4190,6 +4425,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4217,6 +4455,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4244,6 +4485,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4271,6 +4515,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4298,6 +4545,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4325,6 +4575,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4352,6 +4605,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4379,6 +4635,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4406,6 +4665,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4433,6 +4695,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4460,6 +4725,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4487,6 +4755,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4514,6 +4785,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4541,6 +4815,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4568,6 +4845,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4595,6 +4875,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4622,6 +4905,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4649,6 +4935,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4676,6 +4965,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4703,6 +4995,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4730,6 +5025,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4757,6 +5055,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4784,6 +5085,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4811,6 +5115,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4838,6 +5145,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4865,6 +5175,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4892,6 +5205,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4919,6 +5235,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4946,6 +5265,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -4973,6 +5295,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5000,6 +5325,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5027,6 +5355,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5054,6 +5385,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5081,6 +5415,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5108,6 +5445,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5135,6 +5475,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5162,6 +5505,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5189,6 +5535,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5216,6 +5565,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5243,6 +5595,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5270,6 +5625,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5297,6 +5655,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5324,6 +5685,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5351,6 +5715,9 @@
       "fixable": false,
       "suppressible": true,
       "suppress_comment": "// fallow-ignore-next-line security-sink",
+      "default_severity": "off",
+      "opt_in": true,
+      "frameworks": [],
       "note": "Tainted-sink catalogue category; the security-sink suppression token covers every category",
       "license": "free",
       "license_note": null,
@@ -5434,14 +5801,481 @@
     "warn",
     "off"
   ],
+  "field_notes": {
+    "default_severity": "The rule's severity under zero config (error/warn/off). null means the finding is not gated by a rules.* severity (a metric or command-driven finding, or a security-catalogue row).",
+    "opt_in": "true when the rule defaults to off and reports nothing until enabled. Enabling an opt_in rule blindly is the most common way to flood a repo with findings, so treat true as a deliberate decision.",
+    "frameworks": "Non-empty ONLY when the rule's DETECTOR self-gates on that framework (it does nothing unless the framework is declared). An EMPTY array does NOT mean the rule is framework-agnostic: many rules are framework-relevant (see the description) yet fire on any matching syntax, so never disable a rule solely because frameworks is empty.",
+    "config_key": "The canonical key under `rules` in the config file, i.e. rules.<config_key>. The `id` is an accepted alias. null for findings that are not configured via a rules.* severity."
+  },
+  "related_schemas": {
+    "note": "This manifest lists RULES, capabilities, presets, and the taste catalog. To author a config FILE you also need its shape, which is a separate schema.",
+    "config_schema_command": "fallow config-schema",
+    "config_schema_note": "Full JSON Schema of the config file: every top-level key (rules, entry, ignorePatterns, workspaces, boundaries, duplicates, health, security, rulePacks, production, cache, ...) and its shape. entry and ignorePatterns are how you declare entry points and exclusions; fallow also auto-honors package.json exports/main/module for library public APIs.",
+    "rule_pack_schema_command": "fallow rule-pack-schema",
+    "rule_pack_schema_note": "JSON Schema for a declarative rule pack referenced from rulePacks.",
+    "plugin_schema_command": "fallow plugin-schema",
+    "plugin_schema_note": "JSON Schema for a user-authored external plugin (fallow-plugin-*.jsonc). Teach fallow about an unsupported framework declaratively: detection, entryPoints, alwaysUsed, usedExports, usedClassMembers, and manifestEntries (derive entry points from per-package manifest files).",
+    "plugin_check_command": "fallow plugin-check",
+    "plugin_check_note": "Read-only dry-run of your external plugins: reports which activated, which manifests each manifestEntries rule matched, what it seeded (with path-exists), and typed warnings (manifests-matched-none, when-excluded-all, field-path-unresolved, entries-empty, manifest-parse-failed, entry-outside-root, seeded-paths-missing). Run it after authoring a fallow-plugin-*.jsonc to verify it before a full analysis.",
+    "config_files": [
+      ".fallowrc.json",
+      ".fallowrc.jsonc",
+      "fallow.toml",
+      ".fallow.toml"
+    ]
+  },
+  "boundary_presets": [
+    {
+      "name": "layered",
+      "description": "Classic layers: presentation depends on application depends on domain; infrastructure depends on domain and application.",
+      "config": "boundaries.preset: \"layered\""
+    },
+    {
+      "name": "hexagonal",
+      "description": "Ports and adapters: adapters depend on ports, ports depend on the domain; the domain depends on nothing outward.",
+      "config": "boundaries.preset: \"hexagonal\""
+    },
+    {
+      "name": "feature-sliced",
+      "description": "Feature-Sliced Design: app, pages, widgets, features, entities, shared; each layer may only import from the layers below it.",
+      "config": "boundaries.preset: \"feature-sliced\""
+    },
+    {
+      "name": "bulletproof",
+      "description": "Bulletproof React: app and features depend on shared and server; features stay isolated from each other.",
+      "config": "boundaries.preset: \"bulletproof\""
+    }
+  ],
+  "taste_choices": [
+    {
+      "id": "ci-strictness",
+      "header": "CI gate",
+      "prompt": "Should the cleanup rules that default to warn (unused dev/optional dependencies, component-level dead code, styling drift) fail CI, or stay advisory?",
+      "tier": "taste",
+      "first_run": true,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.unused-dev-dependencies",
+        "rules.unused-optional-dependencies",
+        "rules.stale-suppressions"
+      ],
+      "default_summary": "These rules default to warn: reported, never failing CI. The structural rules (unused files/exports/deps, circular deps, unresolved imports, boundary violations) already default to error.",
+      "options": [
+        {
+          "label": "Advisory",
+          "effect": "Keep the warn-default rules at warn.",
+          "tradeoff": "Cleanup drift is visible but never blocks a merge; the team addresses it on its own cadence."
+        },
+        {
+          "label": "Strict",
+          "effect": "Promote the warn-default cleanup rules to error.",
+          "tradeoff": "A PR that adds unused dev deps or dead component surface fails CI; noisier on legacy code, tighter on new code."
+        }
+      ]
+    },
+    {
+      "id": "private-type-leak",
+      "header": "API hygiene",
+      "prompt": "Enable the opt-in private-type-leak check, which flags exported signatures that reference a same-file private type (a break for consumers)?",
+      "tier": "taste",
+      "first_run": true,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.private-type-leaks"
+      ],
+      "default_summary": "Off by default: it is a lower-confidence API-hygiene check, so fallow does not enable it unless you opt in.",
+      "options": [
+        {
+          "label": "Keep off",
+          "effect": "Leave private-type-leak disabled.",
+          "tradeoff": "No API-hygiene findings; a leaked private type in a public signature goes unflagged."
+        },
+        {
+          "label": "Enable (warn)",
+          "effect": "Set rules.private-type-leaks to warn.",
+          "tradeoff": "Catches public signatures that reference private types; can be noisy on libraries with intentional internal-type re-use."
+        }
+      ]
+    },
+    {
+      "id": "dupes-sensitivity",
+      "header": "Dupes",
+      "prompt": "Code-duplication sensitivity (how large and how repeated a clone must be before it is reported).",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "duplicates.mode",
+        "duplicates.minTokens",
+        "duplicates.minOccurrences"
+      ],
+      "default_summary": "mild mode, minTokens 50, minOccurrences 2: reports moderately sized clones that appear at least twice. Raise minOccurrences to 3 to focus on widespread duplication only. Note: `fallow init`'s starter config seeds minOccurrences at 3 to hide pair-only noise on a first run, so its output is intentionally stricter than this zero-config default of 2.",
+      "options": []
+    },
+    {
+      "id": "complexity-ceilings",
+      "header": "Complexity",
+      "prompt": "Function complexity ceilings used by fallow health.",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "health.maxCyclomaticComplexity",
+        "health.maxCognitiveComplexity",
+        "health.maxCrapThreshold",
+        "health.maxUnitSize"
+      ],
+      "default_summary": "cyclomatic 20, cognitive 15, CRAP 30, unit size 60 lines. These are SIG-aligned; raise them for an established codebase that would otherwise report a large existing backlog.",
+      "options": []
+    },
+    {
+      "id": "styling-drift",
+      "header": "Styling",
+      "prompt": "Design-system styling-drift strictness (hardcoded values where a token exists, duplicate blocks, selector complexity).",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.css-token-drift",
+        "rules.css-duplicate-block",
+        "rules.css-selector-complexity"
+      ],
+      "default_summary": "All css-* rules default to warn (advisory, verdict-neutral). Promote to error only once the design system is stable enough that drift should block a merge.",
+      "options": []
+    },
+    {
+      "id": "react-health-signals",
+      "header": "React heur",
+      "prompt": "React/Preact structural health signals (prop-drilling, thin-wrapper, duplicate-prop-shape).",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": true,
+      "config_paths": [
+        "rules.prop-drilling",
+        "rules.thin-wrapper",
+        "rules.duplicate-prop-shape"
+      ],
+      "default_summary": "Off by default: opinion-heavy heuristics that are noisy on established component trees. Enable per-rule (warn) only if the team wants refactor pressure on component structure.",
+      "options": []
+    },
+    {
+      "id": "coverage-gaps",
+      "header": "Cov gaps",
+      "prompt": "Coverage-gap detection (runtime files/exports with no test dependency path).",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.coverage-gaps"
+      ],
+      "default_summary": "Off by default and most useful once runtime coverage data is available. Not surfaced on a first run because a cold project rarely has the inputs it needs.",
+      "options": []
+    },
+    {
+      "id": "security",
+      "header": "Security",
+      "prompt": "Opt-in security candidate detection (client/server secret leaks, tainted sinks). Surfaced by the separate fallow security command.",
+      "tier": "default",
+      "first_run": false,
+      "framework_gated": false,
+      "config_paths": [
+        "rules.security-client-server-leak",
+        "rules.security-sink"
+      ],
+      "default_summary": "Off by default: candidates are unverified and high-noise, so enabling security is a deliberate decision, not a first-run default. Run fallow security to explore candidates without changing config.",
+      "options": []
+    }
+  ],
+  "security_categories": {
+    "note": "Valid ids for security.categories.include / exclude. include-required categories (hardcoded-secret, secret-to-network) run only when explicitly listed in categories.include; all others are admitted by default unless an include list restricts to a whitelist.",
+    "categories": [
+      {
+        "id": "angular-trusted-html",
+        "title": "Angular bypassSecurityTrust sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "cleartext-transport",
+        "title": "Cleartext transport URL",
+        "cwe": 319,
+        "include_required": false
+      },
+      {
+        "id": "code-injection",
+        "title": "Code injection sink",
+        "cwe": 94,
+        "include_required": false
+      },
+      {
+        "id": "command-injection",
+        "title": "OS command injection sink",
+        "cwe": 78,
+        "include_required": false
+      },
+      {
+        "id": "dangerous-html",
+        "title": "Dangerous HTML sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "deprecated-cipher",
+        "title": "Deprecated cipher constructor",
+        "cwe": 327,
+        "include_required": false
+      },
+      {
+        "id": "dom-document-write",
+        "title": "DOM document.write sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "dynamic-module-load",
+        "title": "Dynamic module load sink",
+        "cwe": 95,
+        "include_required": false
+      },
+      {
+        "id": "dynamic-regex",
+        "title": "Dynamic regular expression sink",
+        "cwe": 1333,
+        "include_required": false
+      },
+      {
+        "id": "electron-unsafe-webpreferences",
+        "title": "Unsafe Electron BrowserWindow preferences",
+        "cwe": 1188,
+        "include_required": false
+      },
+      {
+        "id": "hardcoded-secret",
+        "title": "Hardcoded secret candidate",
+        "cwe": null,
+        "include_required": true
+      },
+      {
+        "id": "header-injection",
+        "title": "HTTP response header injection sink",
+        "cwe": 113,
+        "include_required": false
+      },
+      {
+        "id": "insecure-cookie",
+        "title": "Insecure cookie options",
+        "cwe": 614,
+        "include_required": false
+      },
+      {
+        "id": "insecure-randomness",
+        "title": "Insecure randomness sink",
+        "cwe": 338,
+        "include_required": false
+      },
+      {
+        "id": "insecure-temp-file",
+        "title": "Predictable temporary file path",
+        "cwe": 377,
+        "include_required": false
+      },
+      {
+        "id": "jquery-html",
+        "title": "jQuery .html() sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "jwt-alg-none",
+        "title": "JWT alg none",
+        "cwe": 347,
+        "include_required": false
+      },
+      {
+        "id": "jwt-verify-missing-algorithms",
+        "title": "JWT verify missing algorithms allowlist",
+        "cwe": 347,
+        "include_required": false
+      },
+      {
+        "id": "llm-call-injection",
+        "title": "Untrusted input reaches an LLM call",
+        "cwe": 1427,
+        "include_required": false
+      },
+      {
+        "id": "mass-assignment",
+        "title": "Mass assignment sink",
+        "cwe": 915,
+        "include_required": false
+      },
+      {
+        "id": "mysql-multiple-statements",
+        "title": "MySQL multiple statements enabled",
+        "cwe": 89,
+        "include_required": false
+      },
+      {
+        "id": "nextjs-open-redirect",
+        "title": "Next.js open redirect sink",
+        "cwe": 601,
+        "include_required": false
+      },
+      {
+        "id": "nosql-injection",
+        "title": "NoSQL injection sink",
+        "cwe": 943,
+        "include_required": false
+      },
+      {
+        "id": "open-redirect",
+        "title": "Open redirect sink",
+        "cwe": 601,
+        "include_required": false
+      },
+      {
+        "id": "path-traversal",
+        "title": "Path traversal sink",
+        "cwe": 22,
+        "include_required": false
+      },
+      {
+        "id": "permissive-cors",
+        "title": "Permissive CORS policy",
+        "cwe": 942,
+        "include_required": false
+      },
+      {
+        "id": "postmessage-wildcard-origin",
+        "title": "Wildcard postMessage target origin",
+        "cwe": 346,
+        "include_required": false
+      },
+      {
+        "id": "prototype-pollution",
+        "title": "Prototype pollution sink",
+        "cwe": 1321,
+        "include_required": false
+      },
+      {
+        "id": "redos-regex",
+        "title": "ReDoS regex sink",
+        "cwe": 1333,
+        "include_required": false
+      },
+      {
+        "id": "resource-amplification",
+        "title": "Resource amplification sink",
+        "cwe": 400,
+        "include_required": false
+      },
+      {
+        "id": "route-send-file",
+        "title": "Route file-send path traversal sink",
+        "cwe": 22,
+        "include_required": false
+      },
+      {
+        "id": "secret-pii-log",
+        "title": "Secret or PII logged",
+        "cwe": 532,
+        "include_required": false
+      },
+      {
+        "id": "secret-to-network",
+        "title": "Secret reaches a network request",
+        "cwe": 201,
+        "include_required": true
+      },
+      {
+        "id": "sql-injection",
+        "title": "SQL injection sink",
+        "cwe": 89,
+        "include_required": false
+      },
+      {
+        "id": "ssrf",
+        "title": "Server-side request forgery sink",
+        "cwe": 918,
+        "include_required": false
+      },
+      {
+        "id": "ssti",
+        "title": "Server-side template injection sink",
+        "cwe": 1336,
+        "include_required": false
+      },
+      {
+        "id": "template-escape-bypass",
+        "title": "Template escape bypass sink",
+        "cwe": 79,
+        "include_required": false
+      },
+      {
+        "id": "tls-validation-disabled",
+        "title": "TLS validation disabled",
+        "cwe": 295,
+        "include_required": false
+      },
+      {
+        "id": "unsafe-buffer-alloc",
+        "title": "Unsafe Buffer allocation sink",
+        "cwe": 1188,
+        "include_required": false
+      },
+      {
+        "id": "unsafe-deserialization",
+        "title": "Unsafe deserialization sink",
+        "cwe": 502,
+        "include_required": false
+      },
+      {
+        "id": "weak-crypto",
+        "title": "Runtime-selectable crypto algorithm",
+        "cwe": 327,
+        "include_required": false
+      },
+      {
+        "id": "webview-injection",
+        "title": "WebView injected-script sink",
+        "cwe": 94,
+        "include_required": false
+      },
+      {
+        "id": "world-writable-permission",
+        "title": "World-writable chmod mode",
+        "cwe": 732,
+        "include_required": false
+      },
+      {
+        "id": "xpath-injection",
+        "title": "XPath injection sink",
+        "cwe": 643,
+        "include_required": false
+      },
+      {
+        "id": "xxe",
+        "title": "XML external entity (XXE) sink",
+        "cwe": 611,
+        "include_required": false
+      },
+      {
+        "id": "zip-slip",
+        "title": "Archive path-traversal (zip-slip) sink",
+        "cwe": 22,
+        "include_required": false
+      }
+    ]
+  },
   "mcp_tools": {
     "server": "fallow-mcp",
-    "note": "key_params is a curated subset; the live MCP input schemas (list_tools) are authoritative for the full parameter list",
+    "note": "key_params is a curated subset; the live MCP input schemas (list_tools) are authoritative for the full parameter list. cli_command is the nearest CLI fallback, not a full MCP input-schema projection",
     "tools": [
       {
         "name": "code_execute",
         "kind": "composition",
         "description": "Run a bounded read-only JavaScript snippet that composes fallow's analysis tools inside a sandbox (Code Mode meta-tool, not a plain analysis call)",
+        "cli_command": null,
         "key_params": [
           "code",
           "timeout_ms",
@@ -5455,6 +6289,7 @@
         "name": "analyze",
         "kind": "analysis",
         "description": "Full dead-code analysis: unused files, exports, types, dependencies, circular dependencies, and boundary violations",
+        "cli_command": "fallow dead-code --format json --quiet",
         "key_params": [
           "issue_types",
           "production",
@@ -5471,6 +6306,7 @@
         "name": "check_changed",
         "kind": "analysis",
         "description": "Incremental dead-code analysis scoped to files changed since a git ref (ideal for PR review)",
+        "cli_command": "fallow dead-code --changed-since <ref> --format json --quiet",
         "key_params": [
           "since",
           "baseline",
@@ -5484,6 +6320,7 @@
         "name": "security_candidates",
         "kind": "analysis",
         "description": "Unverified local security candidates (tainted sinks) for downstream agent verification",
+        "cli_command": "fallow security --format json --quiet",
         "key_params": [
           "gate",
           "surface",
@@ -5498,6 +6335,7 @@
         "name": "inspect_target",
         "kind": "analysis",
         "description": "One evidence bundle for a file or exported symbol: trace, dead-code actions, duplication, complexity, and security candidates",
+        "cli_command": "fallow inspect --format json --quiet",
         "key_params": [
           "target",
           "production"
@@ -5510,6 +6348,7 @@
         "name": "guard",
         "kind": "introspection",
         "description": "Report the architecture rules that apply to given files before editing them: boundary zone, allowed import zones, forbidden calls, and rule-pack policies",
+        "cli_command": "fallow guard <file> --format json --quiet",
         "key_params": [
           "files"
         ],
@@ -5521,6 +6360,7 @@
         "name": "find_dupes",
         "kind": "analysis",
         "description": "Code duplication detection with clone groups and refactoring suggestions",
+        "cli_command": "fallow dupes --format json --quiet",
         "key_params": [
           "mode",
           "min_tokens",
@@ -5536,6 +6376,7 @@
         "name": "check_health",
         "kind": "analysis",
         "description": "Complexity, styling health, hotspots, ownership, refactoring targets, coverage gaps, and CSS/CSS-in-JS candidates",
+        "cli_command": "fallow health --format json --quiet",
         "key_params": [
           "score",
           "css",
@@ -5555,6 +6396,7 @@
         "name": "check_runtime_coverage",
         "kind": "runtime-coverage",
         "description": "Merge V8 or Istanbul runtime coverage into the health report (hot paths, cold paths, verdicts)",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "min_invocations_hot",
@@ -5570,6 +6412,7 @@
         "name": "get_hot_paths",
         "kind": "runtime-coverage",
         "description": "Production hot paths from runtime coverage, sorted by invocation volume",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "top",
@@ -5583,6 +6426,7 @@
         "name": "get_blast_radius",
         "kind": "runtime-coverage",
         "description": "Blast-radius context (caller counts, risk bands) from runtime coverage; augments review only, never gates safe_to_delete (three-state tracking issues that verdict)",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "group_by"
@@ -5595,6 +6439,7 @@
         "name": "get_importance",
         "kind": "runtime-coverage",
         "description": "Production-importance scores (0-100) combining invocations, complexity, and ownership; augments review only, never gates safe_to_delete (three-state tracking issues that verdict)",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "group_by"
@@ -5607,6 +6452,7 @@
         "name": "get_cleanup_candidates",
         "kind": "runtime-coverage",
         "description": "Cleanup candidates with safe_to_delete, review_required, and low_traffic verdicts from runtime coverage",
+        "cli_command": "fallow health --runtime-coverage <path> --format json --quiet",
         "key_params": [
           "coverage",
           "group_by"
@@ -5619,6 +6465,7 @@
         "name": "get_token_blast_radius",
         "kind": "analysis",
         "description": "Design-token blast radius for Tailwind v4 @theme tokens AND CSS-in-JS defineVars/createTheme-family token definitions: per token, a consumer_count (static lower bound) and a capped located consumers[] sample tagged theme-var/css-var/utility/apply (Tailwind) or js-member (CSS-in-JS cross-module member access); descriptive context for sizing a token change, never a deletion gate",
+        "cli_command": "fallow health --css --format json --quiet",
         "key_params": [],
         "license": "free",
         "license_note": null,
@@ -5628,6 +6475,7 @@
         "name": "audit",
         "kind": "analysis",
         "description": "Combined dead-code, complexity, duplication, and styling audit for changed files with a pass/warn/fail verdict",
+        "cli_command": "fallow audit --format json --quiet",
         "key_params": [
           "gate",
           "base",
@@ -5644,6 +6492,7 @@
         "name": "decision_surface",
         "kind": "analysis",
         "description": "Surface the few consequential structural decisions a change embeds (coupling, public API, dependency), each as a judgment question with the routed expert; ranked, capped, and signal_id-anchored",
+        "cli_command": "fallow decision-surface --format json --quiet",
         "key_params": [
           "base",
           "max_decisions",
@@ -5657,6 +6506,7 @@
         "name": "fallow_explain",
         "kind": "introspection",
         "description": "Explain one issue type (rationale, examples, fix guidance) without running an analysis",
+        "cli_command": "fallow explain <issue-type> --format json --quiet",
         "key_params": [
           "issue_type"
         ],
@@ -5668,6 +6518,7 @@
         "name": "fix_preview",
         "kind": "fix",
         "description": "Dry-run auto-fix preview; shows what would change without modifying files",
+        "cli_command": "fallow fix --dry-run --format json --quiet",
         "key_params": [
           "no_create_config"
         ],
@@ -5679,6 +6530,7 @@
         "name": "fix_apply",
         "kind": "fix",
         "description": "Apply auto-fixes: removes unused exports, dependencies, and enum members (mutates files)",
+        "cli_command": "fallow fix --yes --format json --quiet",
         "key_params": [
           "no_create_config"
         ],
@@ -5690,6 +6542,7 @@
         "name": "project_info",
         "kind": "introspection",
         "description": "Project metadata: active framework plugins, discovered files, entry points, and boundary zones",
+        "cli_command": "fallow list --files --entry-points --plugins --format json --quiet",
         "key_params": [
           "entry_points",
           "files",
@@ -5700,10 +6553,23 @@
         "license_note": null,
         "read_only": true
       },
+      {
+        "name": "recommend",
+        "kind": "introspection",
+        "description": "Recommend a project-tailored config from framework/workspace/tooling detection: a loader-validated proposed_config and three-valued auto/default/taste decisions for cold-start onboarding",
+        "cli_command": "fallow recommend --format json --quiet",
+        "key_params": [
+          "root"
+        ],
+        "license": "free",
+        "license_note": null,
+        "read_only": true
+      },
       {
         "name": "list_boundaries",
         "kind": "introspection",
         "description": "List architecture boundary zones and access rules",
+        "cli_command": "fallow list --boundaries --format json --quiet",
         "key_params": [],
         "license": "free",
         "license_note": null,
@@ -5713,6 +6579,7 @@
         "name": "feature_flags",
         "kind": "analysis",
         "description": "Detect feature flag patterns (environment variables, SDK calls, config objects)",
+        "cli_command": "fallow flags --format json --quiet",
         "key_params": [
           "workspace",
           "production"
@@ -5725,6 +6592,7 @@
         "name": "impact",
         "kind": "introspection",
         "description": "Read the local Fallow Impact value-tracking report (per-project history in the user config dir, never in the repo; local-dev only)",
+        "cli_command": "fallow impact --format json --quiet",
         "key_params": [
           "root"
         ],
@@ -5736,6 +6604,7 @@
         "name": "impact_all",
         "kind": "introspection",
         "description": "Roll every tracked fallow project on this machine into one cross-repo value report (hashed keys plus basename labels, never paths; local-dev only)",
+        "cli_command": "fallow impact --all --format json --quiet",
         "key_params": [
           "sort",
           "limit"
@@ -5748,6 +6617,7 @@
         "name": "trace_export",
         "kind": "trace",
         "description": "Trace why an export is used or unused, including re-export chains and entry-point status",
+        "cli_command": "fallow dead-code --trace <file:export> --format json --quiet",
         "key_params": [
           "file",
           "export_name"
@@ -5760,6 +6630,7 @@
         "name": "trace_file",
         "kind": "trace",
         "description": "Trace all module-graph edges for a file (imports, exports, importers, re-exports)",
+        "cli_command": "fallow dead-code --trace-file <file> --format json --quiet",
         "key_params": [
           "file"
         ],
@@ -5767,10 +6638,23 @@
         "license_note": null,
         "read_only": true
       },
+      {
+        "name": "impact_closure",
+        "kind": "trace",
+        "description": "Trace the transitive affected-but-not-in-diff set and coordination gaps for one file",
+        "cli_command": "fallow dead-code --impact-closure <path> --format json --quiet",
+        "key_params": [
+          "path"
+        ],
+        "license": "free",
+        "license_note": null,
+        "read_only": true
+      },
       {
         "name": "trace_dependency",
         "kind": "trace",
         "description": "Trace where a dependency is imported and whether scripts or CI use it",
+        "cli_command": "fallow dead-code --trace-dependency <package> --format json --quiet",
         "key_params": [
           "package_name"
         ],
@@ -5782,6 +6666,7 @@
         "name": "trace_clone",
         "kind": "trace",
         "description": "Deep-dive a duplicate-code clone group by location or fingerprint",
+        "cli_command": "fallow dupes --trace <file:line> --format json --quiet",
         "key_params": [
           "file",
           "line",