gcf-aif-ext 0.2.0

package/node_modules/cnlp-kit/cnlp-format.md

@@ -0,0 +1,470 @@
+# CNL-P format — the standard
+
+A way to write any document an agent has to read precisely. This file is the source of
+truth for it. Extend it when the format grows; do not re-derive the rules from an existing
+file.
+
+**Every rule here holds for every document.** What differs between one kind of document and
+another — its blocks, their order, whether it has headings — is declared in a *profile*
+(§7), never branched inside a rule. The profiles that ship live in `profiles/`; a new kind of
+document is added by writing a new profile, with no change to this file.
+
+**What is enforced:** the checker reads the profile for the values and checks the mechanical
+rules against it. Each profile's `enforcement:` block names the command or test that runs it;
+`npx cnlp check` is the one that ships here. No checker can judge whether a bullet says
+something useful — only whether the document is shaped and worded as declared.
+
+## 1. What it is
+
+A document written as structured `key:` blocks instead of prose. One idea per line, one
+term per concept, no narrative connective tissue.
+
+Prose leaves the reader to work out which sentence is intent, which is policy, which is
+sequence and which is the shape of the answer — by inference, every time the document is
+read. A `key:` block states which is which. That helps a document that is executed and a
+document that is consulted for the same reason: neither reader should have to reconstruct
+the structure before using the content. A human reviewer gets the same benefit — the file is
+auditable in one pass.
+
+## 2. Shape
+
+```
+---
+name: …          <- YAML frontmatter, untouched
+description: …
+---
+
+first_key:
+- one idea
+- one idea
+
+second_key:
+1. first step
+2. second step
+```
+
+- **Frontmatter is never rewritten.** It is the machine contract of the document kind; the
+  profile lists its fields in `frontmatter_fields:`.
+- Sections are top-level `key:` lines in `lower_snake_case`.
+- A section ends where the next **unindented** `key:` begins, or where the next `##`
+  heading begins. Anything indented belongs to the section above it.
+- **Headings come from the profile.** A profile that declares `headings:` has an H1 title
+  and those `##` headings partitioning the body, and each block names the heading it sits
+  under. A profile that declares none has a flat body and the title lives in the
+  frontmatter.
+
+## 3. Section forms
+
+Every section is one of five forms. **The profile declares the form of each block**; mixing
+forms inside one section is not allowed.
+
+**scalar** — one value on the key line.
+
+```
+mode: release_check
+decision: use a shared external session store for all authenticated sessions
+```
+
+**bullet-list** — the default. Unindented `- ` items.
+
+```
+purpose:
+- state what the document is loaded for, and when a reader reaches for it
+- state which neighbouring document owns the topics this one does not
+```
+
+**numbered-list** — unindented `N. ` items, ordered, for a sequence.
+
+```
+workflow:
+1. run `npx cnlp check`
+2. fix the issues it reports
+```
+
+**record-list** — repeated records. Each record opens with `- key: value` and continues
+with **two-space-indented** keys. Every record in one section carries the keys the profile
+lists in `record_keys:`, and may carry those in `optional_record_keys:`. A key the profile
+does not declare is not added to a record: it is prose looking for a home.
+
+```
+steps:
+- id: freeze
+  description: stop merges to the release branch
+  owner: release manager
+
+- id: tag
+  description: tag the commit the build came from
+  owner: release manager
+```
+
+**A blank line between records separates them for a reader and carries no meaning.** A checker
+skips it, so the two spellings parse the same; it belongs between records that run to two lines or
+more, where the only other boundary is a `- ` at the start of a line and a reader has to scan for
+it. A list of one-line records is left tight, because the double spacing buys nothing there.
+
+**keyed-block** — a fixed set of named sub-values, or one verbatim fenced block. Sub-keys
+are **two-space-indented**; a fenced block sits directly under the key.
+
+```
+run_footer:
+  format: "✔ <check-name> · <files> files · <issues> issues"
+  source: `npx cnlp check`
+
+report_format:
+```text
+| # | Suggestion | Verdict | Justification |
+```
+```
+
+**Nesting is one level deep**, and only inside a record-list or a keyed-block. A bullet
+never carries sub-bullets to hold a second thought — that is two bullets.
+
+**A fenced block is opaque.** Its contents are verbatim data, not structure: the `id:` and
+`type:` lines inside a `template_frontmatter:` fence are frontmatter fields of another
+document, not CNL-P sections. Anything reading this format skips fenced regions before
+looking for section keys.
+
+**An empty block.** A required block with nothing in it carries `- none` and the reason:
+`- none: no alternative was viable at this scale`. That single line is the whole content and
+replaces the form the block would otherwise take, so a record-list or a keyed-block says it
+the same way a bullet-list does. It is the *whole* content: `- none` next to a real item says
+the block is both empty and not, and the checker rejects it. An optional block with nothing in
+it is deleted rather than marked, so `- none` in one is also rejected. A key with no items at
+all is neither, and the checker rejects that too.
+
+A **scalar** has no empty form: it holds the one value the block exists for, so a scalar with
+nothing to say means the document is unfinished, and the checker says so.
+
+A block whose content is a fenced region is not empty — the fence is opaque, not absent.
+
+## 4. Line rules
+
+- One idea per bullet. A bullet carrying two obligations is two bullets.
+- **Length: 150 characters is the target, 250 is the hard limit.** It applies to every line
+  outside a fence — a bullet, a step, a scalar value, a record sub-key — because each of them
+  holds one idea. The median across the
+  migrated corpus is 72. Past 150, check whether the line holds a condition, a reason and an action at once;
+  if so, split it. A line that is long only because one idea enumerates its parts is fine
+  and is not split — that is the `give per approach: a, b, c` case below. Past 250 the
+  line is compound whatever it claims, and the checker rejects it.
+- Plain lowercase prose in the bullet. No `MUST` / `MUST NOT` ceremony, no line ids.
+- A rule and its reason go on one line, separated by a colon:
+  `do not move files by hand: the command owns the atomic move`.
+- An enumeration inside one idea is fine and is not two ideas:
+  `give per approach: consequences over 6–12 months, effect on coupling, hidden risks`.
+- **Markdown code fences and tables stay** wherever content is verbatim or tabular: shell
+  commands, frontmatter examples, text inserted into another file, diagrams, report
+  templates. A format that cannot hold a shell command is useless here.
+
+## 5. Lexicon
+
+- Use plain, common words over rare or literary ones.
+- One term per concept, and do not vary the word once it is chosen.
+- One part of speech per term: a word used as both a verb and a noun is 2 terms wearing 1 name.
+- No idioms, no slang, no figurative language.
+- No word with several unrelated senses unless this file fixes the sense.
+- A short concrete verb over an abstract one.
+- Define a specialized term once, then reuse it verbatim.
+
+**`check the corpus` and `run the check` are 2 terms.** One term per concept fixes which word names a
+thing; one part of speech fixes which job that word does — here the action, and the program that
+performs the action. Keep the part of speech the term already carries and rename the other use:
+`check` the verb, `the checker` the program. The checker cannot enforce this — telling a verb from a
+noun needs a parser, and it is regular expressions over lines — so it is what a review looks for first
+in a converted document, where a word doing 2 jobs survives every mechanical rule above.
+
+**Quoted text is data.** Anything inside quotes or backticks is a value the document carries
+— a command, a name, a claim being reported — not a claim the document makes, so no rule
+below applies to it. That is what lets a document name a bad argument in order to reject it:
+`do not accept "faster to write" as justification`.
+
+**Prohibition is always `do not`.** `never` is not used as a bullet opener — one concept,
+one term. `never` inside a sentence, qualifying a clause, is fine
+(`the operator decides, do not silently downgrade`).
+
+**A threshold is a digit.** `exactly 1 primary decision`, `at least 2 viable approaches`,
+`more than 1 non-archived plan` — the reader has to check the value against something, so
+it is written as a value. A digit also stands out against lowercase prose, and reads as a
+parameter rather than as a word that must first be mapped to a number.
+
+A number that is not a threshold stays a word: inside an idiom (`two ways of doing one
+thing is a real cost`), inside a hyphenated adjective (`one-line`, `two-space-indented`),
+or as an ordinal (`first review`). Digits there read as a typo.
+
+**A limit is written as a comparison.** The canonical form is
+`<subject> <operator> <value> <unit>`: `open connections per client <= 2`,
+`p95 latency <= 200 ms`. The phrase form leaves the reader to work out whether the bound is
+inclusive; the operator makes the author decide once, at the time the decision is made.
+
+- operators are `<`, `<=`, `>`, `>=`, `=`, `!=`, and a closed range written `2..5`.
+- the subject and the unit stay attached: `open connections per client <= 2`, not a bare `<= 2`.
+- do not invent a threshold nobody agreed: an unagreed "fast startup" stays prose and marks
+  the document unfinished; the rule formalizes a limit, it does not fabricate one.
+- a number that is a determiner inside a sentence keeps the word-plus-digit form:
+  `present at least 2 viable approaches` is an instruction, not a limit to check a value against.
+
+The checker rejects only the phrases whose bound is genuinely open — `no more than`,
+`at most`, `up to`, `not exceeding`, `no fewer than`, `not less than`. `at least`,
+`exactly`, `more than`, `fewer than` and `only` state their bound, so they are left to
+review, the same split §4 makes between the 150-character target and the 250-character
+hard limit.
+
+**An unquantified comparative is not a decision.** A comparative claims a value the reader
+cannot check, so it is replaced by the property and its bound, or dropped.
+
+| Instead of | Write |
+|---|---|
+| better, faster, cleaner | the property and its bound: `p95 latency <= 200 ms` |
+| significantly, substantially | the measured delta |
+| flexible, scalable, extensible | the axis it varies on, with its bound |
+| where possible, if needed, as appropriate | the condition that triggers it |
+| should probably, we may want to | the decision, or move the line to the block that owns doubt |
+
+**A nominalization is the verb it hides.** `make a decision` is `decide` carrying 2 extra words and
+no verb of its own. The checker rejects the light-verb construction — `make`, `do`, `perform`,
+`provide`, `carry out` or `give`, then an article, then an abstract noun — because that is the shape
+prose keeps when a migration converts it a line at a time. It is the specific case the bullet
+`a short concrete verb over an abstract one` states in general.
+
+| Instead of | Write |
+|---|---|
+| make a decision | `decide` |
+| do a check of, perform a check on | `check` |
+| provide a description of | `describe` |
+| carry out an inspection of | `inspect` |
+| give a report on | `report` |
+
+The noun alone is not the construction: `the decision` in the block that records one is the thing
+itself, not a verb in hiding. Neither is a light verb carrying a real object — the noun has to close
+the phrase or take a preposition, so `make a check pass` is a causative and stays. And the verb alone
+is not the construction either: `make` stays canonical while `make a decision` is rejected, because
+the construction is the defect, not the verb.
+
+**Canonical verbs**, for a profile whose `mood:` is `imperative`: `run`, `read`, `inspect`,
+`identify`, `name`, `cite`, `compare`, `present`, `ask`, `update`, `transition`, `report`,
+`record`, `state`, `stop`, `verify`, `validate`, `copy`, `list`, `map`, `fill`, `pick`, `make`,
+`rewrite`, `tick`, `measure`, `repeat`, `write`. The set binds the word that opens a step; what follows the
+opener is the step's own prose, held by the rest of this section. A profile whose mood is
+`declarative` states what is true instead of what to do, in the present tense, and the set does not
+bind it.
+
+**The set is closed, and it grows on the record.** A step needing an opener the set does not carry
+adds that verb here, in the same change as the step: it does not borrow a synonym, and it does not
+pass silently. The 11 verbs from `copy` on arrived that way, harvested from step openers already
+written against a set authored for 1 other kind of document — which is what an unrecorded
+addition costs, a set no reader can trust. Nothing enforces the set yet: the opening word of a
+step is an intra-block line grammar, which is the `item_pattern:` item in `docs/BACKLOG.md`.
+
+**An imperative document names the actor.** A body written to a profile whose `mood:` is
+`imperative` is addressed to whoever executes it, so an agentless passive drops the one word the
+reader needs: `the profile is edited first` does not say who edits it, and `edit the profile first`
+does. The checker reads a form of `be` followed by an `-ed` participle, and only in an imperative
+document.
+
+- a `declarative` document is left alone: it states what is true, and the actor of `a reference file
+  is loaded by path` is genuinely nobody.
+- a participle naming a state rather than an action is exempt: `is required`, `is allowed`,
+  `is needed`, `is based on`, `is limited to`, `is intended`, `is expected`, and any `un-` participle
+  such as `is unchanged`.
+- an irregular participle — `is written`, `is taken`, `is known` — is left to review, because `often`
+  and `open` end in the same 2 letters and are not participles at all. That is the same split this
+  section makes between the enforced and the reviewed half of a limit.
+
+This is the 1 rule `mood:` gates; §7 states which of a profile's values the checker reads.
+
+Deny-list, each with its replacement:
+
+| Instead of | Write |
+|---|---|
+| surface | `state` or `report` |
+| sharpen | `improve` |
+| weigh | `compare` |
+| leverage | `use` |
+| ensure | `verify` |
+| handle | name the action |
+| robust | name the property |
+| sanity-check | `check` |
+
+Established domain terms are not on the deny-list even when they read as figures of
+speech: `blast radius` is precise here and stays.
+
+The checker enforces every row of this table except `handle`: the noun is an established
+domain term — an entity handle, a file handle — that a word-level pattern cannot tell from the
+verb, so the verb is left to review. That is the same enforced-versus-reviewed split the
+passive rule states for irregular participles.
+
+## 6. No section restates another
+
+Each fact appears once, in the block that owns it.
+
+- **The frontmatter is a block like any other.** A body line repeating a frontmatter field —
+  a code path, an id, a status, a link to another document — is a second copy that goes
+  stale. Naming another document inside a sentence is fine; carrying the relation there is
+  not.
+- A rule already stated in one block is not repeated in another, and the step that checks it
+  names the command, not the rule again.
+- A block is dropped when another block already states its content.
+- Two blocks that state *different* facts about one thing are not a repetition: when
+  something is emitted and what shape it has are two facts. Stating it a third time is the
+  repetition, and that one goes.
+
+A profile adds the pairs its own blocks confuse, as `note:` on the sections concerned — for
+example, a cost that is certain against a risk that may not happen.
+
+This is the rule most often broken by a first draft. When a file grows during migration,
+look here first.
+
+## 7. The profile contract
+
+A profile is itself a CNL-P document, in `profiles/<name>.md`. It declares values, never
+rules — a rule in a profile is a rule that escaped this file.
+
+**`format:` closes the loop.** This file states the rules and a profile states the values, so
+the two are read together and neither is complete alone. A reader arriving at a profile —
+sent there by a skill, or by the document kind it describes — follows `format:` to the rules
+first, then reads the profile for the blocks they apply to.
+
+**The path in `format:` names a document, not a location on the reader's disk.** The standard
+and the profiles that ship with it live inside the package, which is not the root of the
+project whose documents obey them. From a project, `npx cnlp print` writes the standard to
+stdout, `npx cnlp print <profile>` writes a profile, and `--path` gives the resolved location
+to open directly. A project that keeps its own profiles names them in `cnlp.config.json` and
+they resolve before the packaged ones.
+
+| Block | Form | Holds |
+|---|---|---|
+| `format` | scalar | the standard this profile's documents obey, by path |
+| `mood` | scalar | `imperative` or `declarative` (§5) |
+| `headings` | bullet-list | the `##` headings in order, or `- none` for a flat body |
+| `frontmatter_fields` | bullet-list | the fields §6 forbids the body to restate |
+| `lexicon_exempt` | bullet-list | frontmatter fields the lexicon does not police, with the reason |
+| `sections` | record-list | the blocks, in order |
+| `custom_sections` | bullet-list | names a document of this kind may add, or `- none` |
+| `enforcement` | bullet-list | the command or test that checks this profile, and its severity |
+
+A `sections:` record carries `key`, `form` (one of the five in §3) and `required`
+(`yes`/`no`), plus `heading`, `record_keys`, `optional_record_keys`, `record_values` and `note`
+where they apply. The order of the records is the order the blocks appear in, so a record's `heading:`
+never names a heading earlier than the heading of the record before it. `required: yes` means the
+document is not conformant without the block; a block that is needed only under some
+condition is `required: no` with the condition in its `note:`, because that judgment is not
+mechanical.
+
+A `custom_sections:` name is a block the checker accepts but does not shape: reference
+material, a vocabulary the document refers to, or behaviour owned by something else. Reuse a
+name `custom_sections:` already carries before inventing one — a new name is a new place for prose to hide.
+This is where a project's own vocabulary lives, and it is the block a project edits after
+adopting a packaged profile.
+
+**`record_values:` closes a record key to a vocabulary.** A profile writes
+`record_values: status = covered, source, avoid`, and a second key follows a `;`. The checker holds
+every record of that block to it, in a record-list and in a keyed-block alike; a key the profile
+leaves out of `record_values:` stays open and nothing polices its value.
+
+A vocabulary stated only in a `note:` is a vocabulary nothing reads, and the cost of that is not
+even: it depends on what the absent value makes the reader do. A docset `catalog:` record whose
+`status` is outside `covered`, `source` and `avoid` used to read as `covered`, sending a reader to
+a `page:` that is not there — the value failed open, and the reader could not tell. Close a key
+whose wrong value would be read as a right one; leave open a key whose values are a free list.
+
+This is one half of the intra-block grammar a profile cannot otherwise declare. The other half — the
+*shape* of a line rather than the value of a key — is not here: a profile still cannot state the form
+of a step's opening word or of a bare list item, and those rules ship as review-only.
+
+**Where a custom block sits** is decided by what it is, in every profile, and the test is
+whether the reader needs it in hand or is sent to it:
+
+- a **term** the steps use without introducing it goes *before* the block that uses it, so it
+  is read first: `glossary`, `severity_scale`, `confidence_scale`.
+- a **case table** a step names at the point of use goes *after*: `severity_mapping`,
+  `block_choice`, `file_map`. The step that says "apply the one matching case in `file_map`"
+  resolves the reference itself, and moving the table above the steps buries them.
+- **behaviour owned by something else**, or anything describing what happens after the run,
+  goes *after*: `report_format`, `test_runners`, `follow_up`.
+
+A custom block is allowed only when its content is neither a rule, a step, nor an output —
+those have declared blocks already. Placement is judgment: nothing enforces it.
+
+**What the checker reads.** `headings`, `frontmatter_fields`, `sections` — `record_values:`
+included — `custom_sections` and `mood` shape what the checker enforces. `format`, `lexicon_exempt`, `enforcement` and
+every `note:` are for whoever writes the document: `lexicon_exempt` names frontmatter fields, which
+the checker never reads. A profile states both kinds, and this table says which is which so neither is
+mistaken for the other.
+
+`mood` sits on both sides. It is the register a body is written in, which the checker cannot judge, and it
+is what gates the 1 lexicon rule that depends on the register: only an imperative document has an
+actor to name, so only an imperative document is held to the active voice (§5).
+
+`profiles/profile.md` is the profile of a profile, so the same checker covers the profile
+files themselves — including that one, which is checked against itself. Nothing checks that
+last step; the recursion stops there on purpose.
+
+## 8. Migration procedure
+
+1. **List the source's rules before rewriting.** Every normative statement, including the
+   ones buried in a subordinate clause.
+2. Rewrite into the profile's blocks.
+3. **Tick each listed rule against the result.** Anything deliberately dropped is stated
+   out loud, with the reason.
+4. **Check the reverse direction.** Any rule in the result that has no origin in the
+   source is an addition — say so; do not let it arrive silently.
+5. **Measure the size and state the cause of any growth.** Growth is not automatically a
+   defect: splitting one prose sentence into the three obligations it was hiding
+   legitimately adds lines, and so does fixing a defect found during the rewrite. Growth
+   with no such cause means §6 was broken or prose survived.
+6. Run the command the profile's `enforcement:` names.
+
+Formalizing prose finds defects in the prose — contradictory rules, branches that turn out
+not to be mutually exclusive, instructions the tooling rejects. Report them; do not resolve
+them silently inside a format migration.
+
+## 9. Page references
+
+Everything above holds for one document alone. A **document set** is a directory of documents
+written to be read a page at a time, where one page sends the reader to another instead of
+restating it — which is §6 applied across files rather than inside one.
+
+A reference is a **`page:` or a `by:` value**, and a `docset:` value names a whole set. They are
+the only forms a reference takes: a name inside prose is a mention, not a reference, and nothing
+resolves it. That is what lets a document set be checked at all.
+
+**A page id is `<set>:<name>`.** `<name>` is the path under the set's directory without the `.md`
+suffix, so `docsets/toolkit/api/query.md` in a `docsets` root of `docsets` is
+`toolkit:api/query`. **A bare name is local**, resolved against the set the referring document
+sits in; a name carrying a prefix crosses into another set. A bare name is the common case, and
+the prefix is what makes a crossing visible at the point it happens.
+
+The rules a checker holds:
+
+- every `page:` and `by:` value resolves to a document that exists.
+- every `docset:` value names a set that exists.
+- a `by:` value is local, so it carries no prefix: `by:` names the replacement inside the set that
+  declares it, and a prefix there is a copy of the set's own name.
+- every document except a set's `index` is the target of at least 1 reference. A page nothing
+  reaches is a page nobody reads, and it goes stale unobserved.
+
+**The checker reads this only when a project says where its sets live**, with a `docsets` key in
+`cnlp.config.json` naming the directory whose immediate subdirectories are one set each. A project
+with no such key has no document set, and none of this applies to it.
+
+The rules a review holds. They are the same kind of rule as the four above and no checker reaches
+them, the way §5 splits the enforced half of a limit from the reviewed half:
+
+- **A fact stated on one page of a set is not restated on another.** §6 holds inside a document and
+  stops at its edge; a set is many documents written to send the reader onward instead of repeating,
+  so the same rule holds across it. Two pages stating one fact go stale apart, and the reader who
+  found the stale copy has no way to know the other exists.
+- **A set has one running example.** Whatever a page's own `example:` shows, it uses the names the
+  set's entry document introduced, so a reader assembling several pages gets one program rather than
+  fragments to reconcile. Fragments that do not compose put the reconciling on the reader, which is
+  the work a set exists to remove.
+- **A name the entry document routes on reaches exactly one page.** A name listed against two pages
+  is two answers with nothing to choose between them, and the reader picks by opening both — which
+  is the guessing an entry document exists to end.
+
+All three were found by reading a set, not by running one: a fact duplicated across two pages, one
+set whose pages carried seven unrelated sets of names, and one name routed to three pages at once.
+
+A profile decides which of its blocks carry references and what each reference means — an
+`overrides:` record whose `page:` names a foreign page is a value that profile declares, not a rule
+this file states.

package/node_modules/cnlp-kit/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "cnlp-kit",
+  "version": "3.4.1",
+  "description": "CNL-P — a format for documents an agent has to read precisely. The standard, its profiles, and the checker that holds them.",
+  "type": "module",
+  "license": "MIT",
+  "author": "VirtualMaestro",
+  "keywords": [
+    "cnlp",
+    "controlled-natural-language",
+    "agent",
+    "skill",
+    "adr",
+    "documentation",
+    "linter"
+  ],
+  "bin": {
+    "cnlp": "bin/cnlp.js"
+  },
+  "exports": {
+    ".": "./src/cnlp.js",
+    "./config": "./src/config.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "profiles",
+    "skills",
+    "cnlp-format.md",
+    "quality-rules.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "test": "node --test",
+    "prepublishOnly": "node --test"
+  },
+  "engines": {
+    "node": ">=22.14"
+  }
+}

package/node_modules/cnlp-kit/profiles/adr.md

@@ -0,0 +1,129 @@
+---
+name: adr
+description: The CNL-P profile of an architecture decision record — the blocks an ADR body uses, in order.
+---
+
+format: cnlp-format.md
+
+mood: declarative
+
+headings:
+- ## Context
+- ## Decision
+- ## Alternatives considered
+- ## Consequences
+
+frontmatter_fields:
+- id
+- type
+- status
+- owners
+- depends_on
+- affects
+- supersedes
+- code
+- issue
+- plan
+- evidence
+- replaced_by
+
+lexicon_exempt:
+- none: every field of an ADR body is read by a person deciding whether the rule applies
+
+sections:
+- key: problem
+  form: bullet-list
+  required: yes
+  heading: "## Context"
+  note: what breaks today, one observable statement per line
+
+- key: constraints
+  form: bullet-list
+  required: yes
+  heading: "## Context"
+  note: what the decision cannot violate; what chooses between options is decision_drivers
+
+- key: decision_drivers
+  form: bullet-list
+  required: yes
+  heading: "## Context"
+  note: the criteria that decide the choice
+
+- key: decision
+  form: scalar
+  required: yes
+  heading: "## Decision"
+  note: the choice alone; its boundary is scope and its reason is decision_drivers
+
+- key: scope
+  form: bullet-list
+  required: yes
+  heading: "## Decision"
+  note: what the decision covers, and one line opening "excludes:" for what it does not
+
+- key: rules
+  form: numbered-list
+  required: yes
+  heading: "## Decision"
+  note: the obligations the decision puts on the codebase
+
+- key: out_of_scope
+  form: record-list
+  required: no
+  heading: "## Decision"
+  record_keys: item, trigger
+  note: a deferred item and the event that would reopen it
+
+- key: increment_order
+  form: numbered-list
+  required: no
+  heading: "## Decision"
+  note: for a decision that ships in stages
+
+- key: alternatives
+  form: record-list
+  required: yes
+  heading: "## Alternatives considered"
+  record_keys: id, description, rejected_because
+  optional_record_keys: kept_as
+  note: rejected_because is the cost of the road not taken, so it is not restated in negative
+
+- key: positive
+  form: bullet-list
+  required: yes
+  heading: "## Consequences"
+  note: what improves
+
+- key: negative
+  form: bullet-list
+  required: yes
+  heading: "## Consequences"
+  note: a cost the decision is known to incur; something that may not happen is a risk
+
+- key: risks
+  form: bullet-list
+  required: yes
+  heading: "## Consequences"
+  note: risk -> mitigation, or "not eliminated"
+
+- key: unproven_hypothesis
+  form: keyed-block
+  required: no
+  heading: "## Consequences"
+  record_keys: claim, acceptance_test, metric
+  note: a claim the decision rests on and how it would be measured
+
+- key: blast_radius
+  form: bullet-list
+  required: no
+  heading: "## Consequences"
+  note: required when the decision changes code; what the change touches
+
+custom_sections:
+- none: an ADR block that is not listed above is prose looking for a home
+
+enforcement:
+- `npx cnlp check`, over the files a `cnlp.config.json` corpus entry maps to this profile
+- a warning while the ADR is `proposed`, `draft` or `superseded`, an error once it is `accepted` or `active`
+- the gate is where the document becomes a rule other work is measured against
+- no status reaches the checker, so a project gating on lifecycle status applies that severity policy in its own validator