oh-my-agent-commandcode 0.0.0-stage → 20.38.4

package/skills/oma-tf-infra/resources/policy-testing-examples.md

@@ -0,0 +1,332 @@
+# Policy and Testing Examples
+
+OPA policies, Sentinel rules, and infrastructure testing patterns.
+
+## OPA (Open Policy Agent)
+
+### Required Tags Policy
+```rego
+# policies/required_tags.rego — OPA >= 1.0
+package terraform.tags
+
+# Map-shaped tags only; ASG uses repeated tag blocks and needs a separate rule.
+# Extend this allowlist only after validating the exact provider plan schema.
+taggable := {"aws_instance", "aws_s3_bucket"}
+
+deny contains msg if {
+    resource := input.resource_changes[_]
+    resource.mode == "managed"
+    resource.type in taggable
+    resource.change.after != null # ignore pure deletions
+    tags := object.get(resource.change.after, "tags", {})
+    required := {"Environment", "Project", "Owner", "CostCenter"}
+    missing := required - object.keys(tags)
+    count(missing) > 0
+    msg := sprintf("Resource %s missing tags: %v", [resource.address, missing])
+}
+```
+
+### Encryption Policy
+```rego
+# policies/encryption_required.rego
+package terraform.encryption
+
+# Require the project's configured SSE-KMS algorithm on explicit encryption
+# resources. Bucket creation and existing remote configuration need separate
+# coverage; a change-only plan cannot prove the full estate is encrypted.
+deny contains msg if {
+    resource := input.resource_changes[_]
+    resource.type == "aws_s3_bucket_server_side_encryption_configuration"
+    resource.change.after != null
+    rule := resource.change.after.rule[_]
+    encryption := rule.apply_server_side_encryption_by_default[_]
+    encryption.sse_algorithm != "aws:kms"
+    msg := sprintf("%s must use aws:kms", [resource.address])
+}
+```
+
+Also verify every bucket created by the module has a corresponding encryption
+resource (use module tests or the complete planned values/configuration). Unknown
+planned values need explicit handling; field presence in the deprecated inline
+bucket attribute is not proof of the required algorithm/key.
+
+### Cost Control Policy
+```rego
+# policies/cost_control.rego
+package terraform.cost
+
+deny contains msg if {
+    resource := input.resource_changes[_]
+    resource.type == "aws_instance"
+    resource.change.after != null
+    resource.change.after.tags.Environment == "dev"
+    instance_type := resource.change.after.instance_type
+    not startswith(instance_type, "t3.")
+    msg := sprintf("Dev EC2 %s uses disallowed type %s", [resource.address, instance_type])
+}
+```
+
+### Combined Plan Decision
+```rego
+# policies/guardrails.rego
+package terraform.guardrails
+
+deny contains msg if { msg := data.terraform.tags.deny[_] }
+deny contains msg if { msg := data.terraform.encryption.deny[_] }
+deny contains msg if { msg := data.terraform.cost.deny[_] }
+```
+
+Run policy unit tests, then evaluate the actual plan. Evaluating a deny set without
+an exit-code flag does not gate CI. Query individual members with `--fail-defined`
+so an empty set passes and any violation fails.
+
+## Sentinel (Terraform Cloud)
+
+### Require Encryption
+
+Use the current `tfplan/v2` or `tfconfig/v2` import and match
+`aws_s3_bucket_server_side_encryption_configuration` to the project's bucket
+resources. Check the required algorithm/key and deletion/unknown-value cases.
+Do not copy an inline `aws_s3_bucket.server_side_encryption_configuration`
+existence check as an encryption guarantee; validate this rule against fixtures
+from the exact provider/plan version before enabling a Sentinel gate.
+
+### Restrict Instance Types
+```hcl
+# restrict_instance_types.sentinel
+import "tfplan"
+
+allowed_types = ["t3.micro", "t3.small", "t3.medium"]
+
+main = rule {
+  all tfplan.resources.aws_instance as _, instances {
+    all instances as _, instance {
+      instance.applied.instance_type in allowed_types
+    }
+  }
+}
+```
+
+## Native `terraform test` (Terraform >= 1.6)
+
+Prefer the built-in HCL test framework for module tests before reaching for Terratest.
+
+```hcl
+# tests/vpc.tftest.hcl
+variables {
+  name       = "test-vpc"
+  cidr_block = "10.0.0.0/16"
+}
+
+run "creates_vpc_with_expected_cidr" {
+  command = plan
+
+  assert {
+    condition     = google_compute_network.main.name == "test-vpc"
+    error_message = "VPC name does not match input"
+  }
+}
+
+run "apply_and_verify_outputs" {
+  command = apply
+
+  assert {
+    condition     = length(output.private_subnet_ids) == 2
+    error_message = "Expected 2 private subnets"
+  }
+}
+```
+
+Run with `terraform test`. `command = plan` runs assertion-only checks without creating resources; `command = apply` provisions real (or mocked, via `mock_provider`) resources and destroys them afterward.
+
+## Terratest (Go)
+
+### VPC Module Test
+```go
+// vpc_test.go
+package test
+
+import (
+  "testing"
+  "github.com/gruntwork-io/terratest/modules/terraform"
+  "github.com/stretchr/testify/assert"
+)
+
+func TestVpcModule(t *testing.T) {
+  terraformOptions := &terraform.Options{
+    TerraformDir: "../modules/vpc",
+    Vars: map[string]interface{}{
+      "name":               "test-vpc",
+      "cidr_block":          "10.0.0.0/16",
+      "availability_zones":  []string{"us-east-1a", "us-east-1b"},
+    },
+  }
+
+  defer terraform.Destroy(t, terraformOptions)
+  terraform.InitAndApply(t, terraformOptions)
+
+  vpcId := terraform.Output(t, terraformOptions, "vpc_id")
+  assert.NotEmpty(t, vpcId)
+
+  privateSubnets := terraform.OutputList(t, terraformOptions, "private_subnet_ids")
+  assert.Equal(t, 2, len(privateSubnets))
+}
+```
+
+### Database Module Test
+```go
+// database_test.go
+package test
+
+import (
+  "testing"
+  "github.com/gruntwork-io/terratest/modules/terraform"
+  "github.com/stretchr/testify/assert"
+)
+
+func TestDatabaseModule(t *testing.T) {
+  terraformOptions := &terraform.Options{
+    TerraformDir: "../modules/database",
+    Vars: map[string]interface{}{
+      "identifier":     "test-db",
+      "engine":         "postgres",
+      "instance_class": "db.t3.micro",
+    },
+  }
+
+  defer terraform.Destroy(t, terraformOptions)
+  terraform.InitAndApply(t, terraformOptions)
+
+  endpoint := terraform.Output(t, terraformOptions, "endpoint")
+  assert.Contains(t, endpoint, "rds.amazonaws.com")
+}
+```
+
+## Kitchen-Terraform (Ruby)
+
+### VPC Controls
+```ruby
+# controls/vpc.rb
+control 'vpc-exists' do
+  describe aws_vpc('vpc-12345678') do
+    it { should exist }
+    its('cidr_block') { should eq '10.0.0.0/16' }
+  end
+end
+
+control 'subnets-exist' do
+  describe aws_subnets do
+    its('subnet_ids.count') { should be >= 2 }
+  end
+end
+```
+
+### Security Group Controls
+```ruby
+# controls/security_group.rb
+control 'no-ssh-from-internet' do
+  aws_security_groups.group_ids.each do |sg_id|
+    describe aws_security_group(sg_id) do
+      it { should_not allow_in(port: 22, ipv4_range: '0.0.0.0/0') }
+    end
+  end
+end
+```
+
+## CI/CD Integration
+
+### GitHub Actions Workflow
+```yaml
+# .github/workflows/terraform.yml
+name: Terraform
+
+on: [push, pull_request]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        
+      - name: Terraform Format
+        run: terraform fmt -check -recursive
+        
+      - name: Terraform Validate
+        run: |
+          terraform init -backend=false
+          terraform validate
+          
+      - name: Run TFLint
+        uses: terraform-linters/setup-tflint@v4
+        with:
+          tflint_version: latest
+      - run: tflint --init && tflint
+        
+      - name: Run Checkov
+        uses: bridgecrewio/checkov-action@master
+        with:
+          directory: .
+          framework: terraform
+          
+      - name: Setup OPA
+        uses: open-policy-agent/setup-opa@v2
+        with:
+          version: v1.0.1
+
+      # Configure project-specific workload identity and backend credentials
+      # before this planning step. Never put secrets in the plan artifact.
+      - name: Run OPA Tests
+        run: |
+          terraform init -reconfigure
+          terraform plan -out=tfplan
+          terraform show -json tfplan > tfplan.json
+          opa test policies/ --verbose
+          opa eval --fail-defined --data policies/ --input tfplan.json "data.terraform.guardrails.deny[_]"
+```
+
+### Validation Script
+```bash
+#!/bin/bash
+# validate.sh
+
+set -e
+
+echo "Running Terraform validation..."
+
+# Format check
+echo "  → Checking format..."
+terraform fmt -check -recursive
+
+# Initialize
+echo "  → Initializing..."
+terraform init -backend=false
+
+# Validate
+echo "  → Validating..."
+terraform validate
+
+# Security scan with Checkov
+echo "  → Running Checkov..."
+checkov -d . --framework terraform --quiet
+
+# Lint with TFLint
+echo "  → Running TFLint..."
+tflint --init
+tflint
+
+# Plan and OPA check (if policies exist)
+if [ -d "policies" ]; then
+  echo "  → Running OPA policy checks..."
+  # Requires explicitly configured backend/auth for this project.
+  terraform init -reconfigure
+  terraform plan -out=tfplan
+  terraform show -json tfplan > tfplan.json
+  opa test policies/
+  opa eval --fail-defined --data policies/ --input tfplan.json "data.terraform.guardrails.deny[_]"
+fi
+
+echo "All validation passed!"
+```

package/skills/oma-translation/SKILL.md

@@ -0,0 +1,229 @@
+---
+name: oma-translation
+description: Translate or revise localized UI strings and prose while preserving
+  meaning, terminology, placeholders, and structure.
+---
+
+# Translation - Context-Aware Localization
+
+## Scheduling
+
+### Goal
+Translate, review, or adapt multilingual content faithfully and naturally while preserving the
+parts that must remain exact: placeholders, code, links, formatting, terminology, and file
+structure.
+
+### Intent signature
+- Translate, localize, review a translation, adapt copy, or create a glossary/style guide.
+- Update target-language files after the source changed.
+
+### When to use
+- UI strings, error messages, locale files, documentation, reports, marketing copy, and prose.
+- Review of existing translations for accuracy, register, terminology, or naturalness.
+
+### When NOT to use
+- i18n infrastructure, locale registration, or key extraction -> use the relevant development skill.
+- Date/pluralization APIs or other code-level localization -> use the owning code-domain skill.
+
+### Expected inputs
+- Source text, target language or locale, content type, and requested output mode.
+- Existing locale files, glossary, surrounding context, and optional author sample.
+- Placeholder and formatting constraints when the source is structured.
+
+### Expected outputs
+- Natural target-language text or evidence-backed review findings.
+- Exact preservation of placeholders, code spans, links, headings, list structure, and locale keys.
+- Translator notes only for meaningful ambiguity or necessary cultural explanation.
+
+### Dependencies
+- Target profile: `resources/lang/{code}.md`, if one exists.
+- `resources/translation-rubric.md` for substantive content or review.
+- Selected external prose-style skills for English and Korean; loading and execution
+  are defined in `resources/style-skills.md`.
+- Shared prose diagnostics and translation exceptions for other target languages.
+- Existing siblings and glossary when translating into a project.
+
+### Control-flow features
+- Branches by UI batch versus prose, profile availability, locale variant, ambiguity, and review mode.
+- Loads only the target profile and references required for the content type.
+- Edits files only when the user asked for file changes.
+
+## Structural Flow
+
+### Entry
+1. Identify source, target locale, content type, and whether this is translate, review, or diff-sync.
+2. Preserve exact tokens first: placeholders, code, URLs, keys, and structural markers.
+3. Load the target profile if available; read sibling translations when the target is in a project.
+
+### Scenes
+1. **PREPARE**: Resolve locale, output mode, target audience, and protected syntax.
+2. **ACQUIRE**: Read the target profile, relevant siblings, glossary, and source context. Select the substantive prose-style route in the canonical workflow; keep short independent UI strings on the lightweight path.
+3. **REASON**: Determine meaning, register, terminology, cultural references, and any ambiguity. Decide whether an idiom should be interpreted, substituted, or retained.
+4. **ACT**: Write natural target-language text. Match established project patterns without adding meaning, opinion, or personality.
+5. **VERIFY**: Check protected syntax and structure. For substantive text, check meaning, terminology, register, and target-language naturalness against the rubric.
+6. **FINALIZE**: Return the requested text, patch, or review with only supported findings.
+
+### Transitions
+- A profile exists -> load it; its target-language rules take precedence over shared guidance.
+- A locale variant is required -> resolve it before drafting.
+- No profile exists -> use shared guidance and note that limit once; do not borrow another language's rules.
+- A short independent UI string with established siblings -> use protected-syntax and sibling checks; the full prose review is optional.
+- Long prose, documentation, marketing copy, mixed tables/code, or review mode -> use the rubric.
+- Ambiguous meaning that changes the result -> ask one targeted question or flag the choice.
+- Diff-sync -> modify only source-touched equivalents, located by headings and surrounding context, not line number.
+
+### Failure and recovery
+| Failure | Recovery |
+|---|---|
+| Missing target context | Use the source register and state the assumption, unless the ambiguity changes meaning |
+| Conflicting literal wording and project convention | Follow the established target convention and explain a material difference |
+| Placeholder or structure mismatch | Revise before emitting or applying a patch |
+| Missing profile | Use shared guidance and identify the coverage limit once |
+| Unclear cultural reference | Add a concise note only when the target audience needs it |
+| Selected external style skill unavailable | Complete supported translation checks and report the unavailable style pass; do not substitute another language's style skill or claim it ran |
+
+### Exit
+- Success: the text is faithful, natural, structurally safe, and checked in proportion to content risk.
+- Partial: unresolved ambiguity, missing context, or an unavailable selected style pass
+  is stated without inventing an answer or claiming that pass ran.
+
+### Language profile loading
+
+Resolve the BCP 47 primary subtag and load one matching profile when present:
+
+| Target | Profile |
+|---|---|
+| Korean | `resources/lang/ko.md` |
+| Japanese | `resources/lang/ja.md` |
+| Chinese | `resources/lang/zh.md`; resolve the declared variant |
+| English | `resources/lang/en.md` |
+| Other | no profile; use shared guidance |
+
+Profiles define typography, register, and target-language checks. Shared guidance explains common
+risks. A profile wins if they conflict. Add a new profile from `resources/lang/_template.md` only
+when the task is to extend this skill.
+
+### Translation method
+
+1. Read for meaning, intended effect, domain terms, and protected syntax. Identify figurative
+   wording as **interpret**, **substitute**, or **retain**. Do not add a new metaphor or remove an
+   intentional one without a reason.
+2. Choose register from the source, target audience, and sibling translations. Apply
+   `translation_voice` from `.agents/oma-config.yaml` only as a rhythm/formality preference:
+   `formal`, `balanced` (default), or `interpreter`. It never overrides meaning or target norms.
+3. Reconstruct in the target language. Change word order, split or merge sentences, and omit
+   implied subjects only when the target language calls for it.
+4. Preserve author style only where it belongs: prose, dialogue, adaptation, or explicitly
+   user-authored documentation. Match observable rhythm and diction, never add facts, stance,
+   jokes, first person, or stronger emotion.
+
+### Verification
+
+Always check:
+
+- Every placeholder, code span, identifier, URL, and locale key is unchanged.
+- Headings, links, table rows, list nesting, and code blocks retain their structure.
+- The target follows its profile's typography and register rules.
+- Existing siblings are matched when they establish terminology or UI style.
+
+For substantive content and review mode, also check the rubric: meaning, naturalness,
+terminology, register, cultural fit, and emotional force. Apply the selected target-language
+style route while preserving intentional source style and content.
+
+### Review mode
+
+Review from evidence, not from an expectation that every draft is machine-translated. Record zero
+findings when no material defect is confirmed. Separate:
+
+- **Accuracy or safety defects**: changed meaning, broken placeholder, incorrect term, or wrong register.
+- **Supported style findings**: a concrete target-language issue with a reason and proposed fix.
+- **Preferences**: optional alternatives that do not make the existing translation wrong.
+
+Do not rewrite a sound translation merely to produce findings.
+
+### Batch and diff-sync work
+
+For batches, read the complete set first, translate values only, and maintain one terminology and
+register decision. Verify placeholders and key structure across the set.
+
+For diff-sync, map each source hunk by heading and surrounding context. Touch only the affected
+target section; leave unrelated text byte-identical. State updated sections, skipped cosmetic
+hunks, and material terminology decisions.
+
+### Output formats
+
+For a single text, present the translation and brief notes for ambiguities or adaptations. For
+files, preserve the input format and modify only requested values. For review, show the original,
+the suggested revision only when warranted, and the evidence for each finding.
+
+## Logical Operations
+
+### Actions
+| Action | SSL primitive | Evidence |
+|---|---|---|
+| Resolve locale and mode | `SELECT` | User request and file context |
+| Read profile and siblings conditionally | `READ` | Target profile, glossary, nearby translations |
+| Protect syntax and structure | `VALIDATE` | Source tokens and structural markers |
+| Infer meaning and register | `INFER` | Source, audience, project convention |
+| Translate or revise | `WRITE` | Target text or requested file patch |
+| Review substantive content | `VALIDATE` | Rubric and concrete findings |
+| Report result and limits | `NOTIFY` | Translation, patch, or review |
+
+### Tools and instruments
+- Native search/read for local source and sibling translations.
+- Configured `code_intelligence` capability when available for code-context navigation; native
+  search/read when it is unavailable or times out.
+- Target profile, rubric, selected prose-style implementation, and language-template
+  resources as selected by the canonical workflow.
+
+### Canonical workflow path
+1. Resolve target locale and protect exact syntax.
+2. Load the one applicable language profile and relevant siblings; load the rubric for substantive
+   content or review. For substantive prose, select by the **target** BCP 47 primary subtag:
+   - `en` (including regional variants): load `resources/style-skills.md` and resolve `humanizer`.
+   - `ko` (including regional variants): load that resource and resolve `humanize-korean`.
+   - Other languages: load `../_shared/core/anti-ai-prose.md` with
+     `resources/anti-ai-patterns.md` and the target profile.
+   Short independent UI strings with established siblings need protected-syntax and
+   sibling checks; they do not require an external prose-style pass.
+3. Infer meaning, register, terminology, and figurative-language handling.
+4. Draft in natural target order and project style.
+5. Apply the selected style implementation to the draft, preserving review-only mode
+   and translation fidelity. Then verify exact syntax, terminology, source claims,
+   structure and diff-sync scope, and check substantive content against the rubric.
+6. Emit the requested translation, patch, or evidence-backed review. State a missing-profile or
+   context limitation when material.
+
+### Resource scope
+| Scope | Resource target |
+|---|---|
+| `LOCAL_FS` | Source/target files, glossaries, language profiles |
+| `CODEBASE` | Sibling translations and code context |
+| `PROCESS` | Syntax checks and selected external-skill acquisition or local gates |
+| `NETWORK` | Upstream style-skill retrieval when not already available |
+| `MEMORY` | Locale, terminology, register, protected syntax, unresolved ambiguity |
+
+### Effects and side effects
+- Produces translated text or review findings.
+- Changes locale/docs files only when explicitly requested.
+- Retains source structure, identifiers, and placeholders.
+- May retrieve a missing selected style-skill bundle; reuses installed or cached
+  instructions. Upstream intermediate files stay in a writable scratch workspace.
+
+### Guardrails
+1. Preserve meaning, protected syntax, and file structure before stylistic preference.
+2. Do not invent facts, opinions, emotional emphasis, examples, citations, or personality.
+3. Do not use a different language's profile as a substitute.
+4. Do not change untouched sections during diff-sync.
+5. Do not claim completion of a check that the available source cannot support.
+
+## References
+
+- Translation rubric: `resources/translation-rubric.md` (load for substantive content or review)
+- Selected style skills: `resources/style-skills.md` (English or Korean substantive prose)
+- Common prose diagnostics: `../_shared/core/anti-ai-prose.md` (other target languages, with translation exceptions when prose style needs review)
+- Translation exceptions and grammar diagnostics: `resources/anti-ai-patterns.md` (other target languages, with common diagnostics when prose style needs review)
+- Target profiles: `resources/lang/{ko,ja,zh,en}.md` (load one matching profile)
+- Profile template: `resources/lang/_template.md` (only when adding a profile)
+- Shared context loading: `../_shared/core/context-loading.md`
+- Shared quality principles: `../_shared/core/quality-principles.md`

package/skills/oma-translation/resources/anti-ai-patterns.md

@@ -0,0 +1,104 @@
+# Translation prose diagnostics
+
+Load this file with `../../_shared/core/anti-ai-prose.md` and the target
+`lang/{code}.md` when reviewing prose in a language without a selected external
+style skill. English and Korean use `style-skills.md` instead. Common pattern
+definitions live in the shared resource; this file owns fidelity exceptions and
+translation-specific rules for the remaining language routes.
+
+A target profile takes precedence for target-language usage; do not borrow a
+different language's rules.
+
+## Fidelity exceptions
+
+- Preserve meaning, claims, named sources, qualifiers, emotional force, terminology,
+  placeholders, code, links, locale keys, and required document structure.
+- Do not add praise, authority, certainty, opinions, jokes, first person, examples,
+  numbers, or citations. A portability finding is not permission to invent specifics.
+- Do not remove source content merely because a shared diagnostic flags it. In strict
+  translation, preserve the claim and intended emphasis in natural target wording;
+  flag a source problem separately when material. Deletion or reorganization belongs
+  to authorized adaptation or revision, not automatic translation cleanup.
+- Classify source figurative language as interpret, substitute,
+  or retain. Do not add mannered metaphors, and do not flatten intentional source voice.
+- Retain an intentional ending, uncertainty, research
+  question, or rhetorical effect when fidelity requires it. Do not intensify it.
+- Preserve headings, lists, tables, formatting, and quoted chatbot
+  language when they are source content. Do not introduce decorative structure.
+- Use the target profile's vocabulary examples. Five or more flagged
+  terms in one paragraph prompt contextual review, not automatic substitutions.
+- Follow the target profile's dash conventions with at most one per
+  paragraph. Reconstruct the clause instead of swapping punctuation;
+  compare sibling wording before deciding the target syntax.
+- Preserve source cadence where natural. Do not import academic
+  sentence-length targets, first-person bans, or paragraph templates.
+
+## Europeanized / Translation-ese Patterns
+
+Patterns where the target text mimics source-language (typically English) grammar
+instead of following native structure.
+
+The categories below are shared. **Every example and every fix is
+language-specific**, so the working version of each rule lives in
+`lang/{code}.md` under "Localizations of shared rules". A profile may also
+declare that a category does not apply to its language.
+
+### Unnecessary Connectives
+
+AI over-inserts logical connectives (*therefore, however, additionally,
+furthermore, moreover*) where context already implies the relationship. If the
+previous sentence already carries the logic, drop the connective and let the
+clause boundary do the work.
+
+### Passive Voice Abuse
+
+English uses the passive far more than most target languages. Restructure to
+active with an explicit agent unless the target genuinely prefers the passive in
+that position, or the agent is unknown or deliberately suppressed.
+
+### Noun Pile-up (Long Modifier Chains)
+
+English stacks modifiers before nouns. Most languages read better when the chain
+is broken into shorter clauses.
+
+Rule: 3 or more stacked modifiers before a noun → break into clauses. Some
+languages need a tighter threshold; see the profile.
+
+### Over-nominalization
+
+English uses abstract nouns plus a light verb ("conduct an analysis") where most
+languages prefer a single verb ("analyze"). Watch for light-verb constructions in
+the target and collapse them.
+
+### Awkward Pronoun Insertion
+
+English requires explicit subjects. Pro-drop languages prefer omission when the
+subject is clear from context, so calqued pronouns read as stammering.
+
+Rule: if the subject has not changed and is clear from context, omit it. For
+targets that are **not** pro-drop, the inverse applies: supply the subject the
+source omitted rather than leaving a dangling clause.
+
+### Cleft Sentence Calques
+
+English "It is X that ..." and "What matters is X" structures should not be
+calqued. Most languages express the same emphasis with word order or a focus
+particle.
+
+### Target-Language Typography and Fragments
+
+Sentence-completion requirements, fragment tolerance by position, quotation
+marks, dash glyphs, spacing between scripts, counters, and date and number
+formats are entirely language-specific.
+
+There is no shared rule here. See the typography and sentence-completion sections
+of `lang/{code}.md`.
+
+---
+
+## Translation checks
+
+Check protected syntax and document structure first. Then use the shared diagnostics
+with the fidelity exceptions above, the translation rubric for substantive text,
+and the target profile's grammar and typography checks. Report only supported accuracy or
+style defects, separate optional preferences, and accept zero findings.