npm - pyric-tools - Versions diffs - 0.1.0-alpha.7 - Mend

pyric-tools 0.1.0-alpha.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1052) hide show

package/dist/serve/docs-ui/docs/pyric-rules-explanation-agent-failure-modes/index.html ADDED Viewed

@@ -0,0 +1,50 @@
+<!DOCTYPE html><html lang="en"> <head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Agent failure modes the linter catches · Pyric Studio</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet"><link rel="stylesheet" href="/__pyric/ui/_astro/_slug_.BsN3bPok.css"></head> <body>  <header class="studio__bar"> <div class="studio__bar-inner"> <a class="studio__brand" href="/__pyric/ui/" aria-label="Pyric Studio">Pyric</a> <nav class="studio__nav" aria-label="Studio tabs"> <a class="studio__nav-tab" href="/__pyric/ui/"> Home </a><a class="studio__nav-tab" href="/__pyric/ui/firestore"> Firestore </a><a class="studio__nav-tab" href="/__pyric/ui/auth"> Auth </a><a class="studio__nav-tab" href="/__pyric/ui/rtdb"> RTDB </a><a class="studio__nav-tab" href="/__pyric/ui/storage"> Storage </a><a class="studio__nav-tab" href="/__pyric/ui/traffic"> Traffic </a><a class="studio__nav-tab" href="/__pyric/ui/prototype"> Prototype </a><a class="studio__nav-tab" href="/__pyric/ui/settings"> Settings </a><a class="studio__nav-tab" href="/__pyric/ui/docs" aria-current="page"> Docs </a> </nav> </div> </header> <div class="docs-shell">  <details class="docs-nav-drawer"> <summary>Navigate</summary> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div> <script type="module">let i=null;function d(t){return i||(i=fetch(t).then(e=>e.json())),i}function l(t,e){return t.title.toLowerCase().includes(e)||t.excerpt.toLowerCase().includes(e)?!0:t.headings.some(r=>r.text.toLowerCase().includes(e))}function u(t,e,r){if(e.innerHTML="",t.length===0){e.hidden=!1;{const n=document.createElement("li");n.className="docs-search-empty",n.textContent="No matches",e.appendChild(n)}return}e.hidden=!1;for(const n of t.slice(0,8)){const s=document.createElement("li"),c=document.createElement("a");c.href=n.path;const o=document.createElement("span");o.className="docs-search-result-title",o.textContent=n.title;const a=document.createElement("span");a.className="docs-search-result-meta",a.textContent=[n.group,n.section].filter(Boolean).join(" / "),c.append(o,a),s.appendChild(c),e.appendChild(s)}}document.querySelectorAll(".docs-search").forEach(t=>{const e=t.dataset.indexUrl,r=t.querySelector(".docs-search-input"),n=t.querySelector(".docs-search-results");r.addEventListener("input",async()=>{const s=r.value.trim().toLowerCase();if(!s){n.hidden=!0,n.innerHTML="";return}const{pages:c}=await d(e);r.value.trim().toLowerCase()===s&&u(c.filter(o=>l(o,s)),n)}),r.addEventListener("focus",()=>{d(e),n.childElementCount>0&&(n.hidden=!1)}),r.addEventListener("keydown",s=>{s.key==="Escape"&&(r.value="",n.hidden=!0,n.innerHTML="",r.blur())}),r.addEventListener("blur",()=>{window.setTimeout(()=>{n.hidden=!0},150)})});document.addEventListener("keydown",t=>{if(!(t.metaKey||t.ctrlKey)||t.key.toLowerCase()!=="k")return;const e=[...document.querySelectorAll(".docs-search-input")].find(r=>r.offsetParent!==null);e&&(t.preventDefault(),e.focus(),e.select())});</script> <details class="docs-nav-group"> <summary>pyric-tools</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-tools/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-getting-started/"> Getting started </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-server-adoption/"> Server adoption </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-wire-claude-code/"> Wire Claude Code </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-how-to-build-a-standalone-binary/"> Build a standalone binary </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-configure-auth-providers-and-domains/"> Configure auth providers </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-discover-a-schema-from-firestore/"> Infer a schema </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-promote-sandbox-state-to-a-fixture/"> Promote sandbox state </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-serve-persistence-and-multi-tab/"> Persistence &amp; multi-tab </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-use-the-vite-plugin/"> Use the Vite plugin </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-verify-against-a-captured-session/"> Verify rules against prod </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-reference-cli/"> pyric CLI reference </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-reference-verify/"> Verify API </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Bridge </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-bridge/"> pyric-tools/bridge </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric-tools / deploy</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-tutorials-01-deploy-a-cloud-function/"> Deploy a Cloud Function </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-firebase-auth/"> Scope from Firebase Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-service-account/"> Scope from service account </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-bundle-and-deploy-a-function/"> Bundle &amp; deploy a function </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-indexes/"> Deploy Firestore indexes </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-rules/"> Deploy Firestore rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-hosting-rewrites/"> Deploy Hosting rewrites </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-realtime-database-rules/"> Deploy RTDB rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-to-a-preview-channel/"> Deploy to a preview channel </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-handle-errors-and-outcomes/"> Handle errors and outcomes </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-provision-a-firestore-database/"> Provision a database </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-register-tools-with-an-agent/"> Register deploy tools </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-cli-agent-io/"> pyric deploy agent I/O </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-error-codes/"> Error codes by operation </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-firestore-namespace/"> firestore namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-functions-namespace/"> functions namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-config/"> firebase.json hosting config </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-namespace/"> hosting namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-rtdb-namespace/"> rtdb namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-scope-and-outcome/"> Scope and Outcome </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-tool-factories/"> Tool factories </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-primitives-vs-orchestrators/"> Primitives vs. orchestrators </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-token-caching/"> Token caching and memoizeTtl </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-why-no-firebase-cli/"> Why no Firebase CLI </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / firestore</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-tutorials-01-write-a-sandbox-demo/"> Sandbox-backed demo </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-tutorials-02-swap-to-prod-backend/"> Swap to prod backend </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-build-queries/"> Build queries </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-migrate-from-firebase-firestore/"> Migrate from Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-pick-a-backend/"> Pick a backend </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-run-a-transaction/"> Run a transaction </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-use-onsnapshot/"> Use onSnapshot </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-use-sandbox-ops/"> Use sandbox-only ops </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-feature-matrix/"> Feature matrix </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-getfirestore/"> getFirestore overloads </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-query-constraints/"> Query constraints </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-sandbox-ops/"> Sandbox-only operations </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-tool-factories/"> Tool factories </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-rules-tooling-is-separate/"> Rules tooling is separate </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-target-symbol-opacity/"> TARGET_SYMBOL opacity </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-two-backends-one-surface/"> Two backends, one surface </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" open> <summary>pyric / rules</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-rules/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-tutorials-01-lint-your-first-rules-file/"> Lint your first rules file </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-tutorials-02-write-a-test-suite-for-your-rules/"> Write a rules test suite </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-how-to-compare-rulesets-for-weakening/"> Compare rulesets </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-inspect-rules-via-the-ast/"> Inspect rules via the AST </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-lint-rules-source/"> Lint a rules source </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-pin-request-time/"> Pin request.time </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-register-tools-with-an-agent/"> Register rules tools </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-resolve-module-imports/"> Resolve 2+modules imports </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-simulate-rules-locally/"> Simulate rules locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-test-rules-against-firebase/"> Test rules against Firebase </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-ast/"> AST </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-errors/"> Errors </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-lint-rules/"> Lint rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-simulator-context/"> Simulator context </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-stdlib-modules/"> Standard library modules </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-test-case-schema/"> TestCase schema </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-validator-findings/"> Validator findings </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-value-wrappers/"> Value wrappers </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-explanation-agent-failure-modes/" aria-current="page"> Agent failure modes </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-lint-vs-validate-vs-simulate-vs-test/"> Lint vs validate vs test </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-runtime-budget-and-shared-gates/"> Runtime budget and gates </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-sentinel-expression-engine/"> Sentinel expression engine </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-simulator-vs-rules-test-api/"> Simulator vs Rules Test API </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-the-2-plus-modules-extension/"> The 2+modules extension </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-value-wrappers-design/"> Value wrapper design </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / sandbox</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-01-your-first-sandbox-session/"> Your first sandbox session </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-02-use-the-sandbox-in-a-test-harness/"> Sandbox in a test harness </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-03-build-a-traffic-monitor/"> Traffic monitor </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-multiple-isolated-sandboxes/"> Run isolated sandboxes </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-observe-events/"> Observe sandbox events </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-pick-an-adapter/"> Pick an adapter </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-replay-events/"> Replay events </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-reset-between-tests/"> Reset between tests </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-seed-data-and-rules/"> Seed data and rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-switch-users/"> Switch users </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-use-admin-reads/"> Use admin reads </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-divergences/"> Divergence </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-error-codes/"> SandboxError codes </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-internal-protocol/"> The /internal protocol </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-sandbox-and-context/"> Sandbox and context </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-sandbox-event/"> SandboxEvent </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-snapshot-and-admin/"> Snapshot and admin reads </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-every-op-is-a-request/"> Every operation is a request </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-identity-is-a-context/"> Identity is a context </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-internal-adapter-protocol/"> The /internal protocol </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-listener-re-evaluation/"> Listener re-evaluation </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-local-backend-vs-firestore-offline/"> Local backend vs. offline </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-why-adapters-are-siblings/"> Why adapters are siblings </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / storage</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-storage/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-tutorials-01-upload-and-download/"> Upload and download </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-how-to-enforce-rules/"> Enforce Storage rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-list-and-delete/"> List and delete objects </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-round-trip-metadata/"> Round-trip metadata </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-switch-backends/"> Switch backends </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-test-rule-expressions/"> Test rule expressions </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-error-codes/"> Error codes </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-rules-subset/"> Storage rules subset </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-storage-options/"> StorageOptions </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-explanation-implementation-scope/"> Implementation scope </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-explanation-session-archive-use-case/"> The session-archive driver </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-explanation-why-indexeddb/"> Why IndexedDB </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / auth</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-auth/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-auth-reference-api/"> API reference </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-feature-matrix/"> Feature matrix </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-sandbox-test-driver/"> Sandbox test driver </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric / database</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-database/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-tutorials-01-author-rtdb-rules-with-constraints/"> Author RTDB rules </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-reference-rules-tooling/"> RTDB rules tooling </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-explanation-rules-authoring-and-deploy-are-separate/"> Authoring vs. deploy </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>pyric-admin / firestore</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-tutorials-01-first-admin-session/"> First admin session </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-run-a-transaction/"> Run a transaction </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-seed-and-set-rules/"> Seed and set rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-translate-denials/"> Translate denials </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-use-onsnapshot/"> Use onSnapshot </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-write-a-batch/"> Write a batch </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-onsnapshot/"> onSnapshot overloads </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-re-exported-types/"> Re-exported types </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-sandbox-firestore/"> SandboxFirestore surface </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-error-translation/"> Error translation </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-per-call-delegate/"> Per-call delegate </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-why-mirror-admin-shape/"> Why mirror the admin SDK </a> </li> </ul> </div> </div> </details><details class="docs-nav-group"> <summary>@pyric/ui</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ui/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Primitives </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-primitives-badge/"> &lt;Badge&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-confirmdialog/"> &lt;ConfirmDialog&gt; + useConfirm </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-copybutton/"> &lt;CopyButton&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-jsonview/"> &lt;JsonView&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-segmentedcontrol/"> &lt;SegmentedControl&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-toast/"> &lt;ToastProvider&gt; + useToast </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-virtuallist/"> &lt;VirtualList&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Firestore </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-firestore-collectionlist/"> &lt;CollectionList&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-deletewithconfirm/"> &lt;DeleteWithConfirm&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documenteditor/"> &lt;DocumentEditor&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documentlist/"> &lt;DocumentList&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documentpreview/"> &lt;DocumentPreview&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-querybuilder/"> &lt;QueryBuilder&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-referencepicker/"> &lt;ReferencePicker&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Storage </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-storage-deleteselectionwithconfirm/"> &lt;DeleteSelectionWithConfirm&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-objectbrowser/"> &lt;ObjectBrowser&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-objectinspector/"> &lt;ObjectInspector&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-pathbreadcrumb/"> &lt;PathBreadcrumb&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage/"> @pyric/ui/storage </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-uploaddropzone/"> &lt;UploadDropzone&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-rules-aware-affordances/"> Rules-aware affordances </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-usestoragerulesgate/"> useStorageRulesGate </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Traffic </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-traffic/"> @pyric/ui/traffic </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-ruleheatmap/"> &lt;RuleHeatmap&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficdetail/"> &lt;TrafficDetail&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficlog/"> TrafficLog components </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficstats/"> &lt;TrafficStats&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading"> Auth </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-auth-authsigninhelper/"> AuthSignInHelper </a> </li><li> <a href="/__pyric/ui/docs/ui-auth-authusers/"> Auth users admin </a> </li> </ul> </div> </div> </details> </nav> </details> <nav class="docs-nav" aria-label="Documentation"> <div class="docs-search" data-index-url="/__pyric/ui/docs/index.json"> <div class="docs-search-field"> <svg class="docs-search-icon" viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"> <path d="M11.5 11.5 15 15M13 7A6 6 0 1 1 1 7a6 6 0 0 1 12 0Z" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round"></path> </svg> <input type="text" class="docs-search-input" placeholder="Search docs" aria-label="Search docs" autocomplete="off" spellcheck="false"> <kbd class="docs-search-kbd">⌘K</kbd> </div> <ul class="docs-search-results" hidden></ul> </div>  <details class="docs-nav-group" id="nav-group-pyric-tools"> <summary>pyric-tools</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-tools/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-getting-started/"> Getting started </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-server-adoption/"> Server adoption </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-tutorials-wire-claude-code/"> Wire Claude Code </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-how-to-build-a-standalone-binary/"> Build a standalone binary </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-configure-auth-providers-and-domains/"> Configure auth providers </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-discover-a-schema-from-firestore/"> Infer a schema </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-promote-sandbox-state-to-a-fixture/"> Promote sandbox state </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-serve-persistence-and-multi-tab/"> Persistence &amp; multi-tab </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-use-the-vite-plugin/"> Use the Vite plugin </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-how-to-verify-against-a-captured-session/"> Verify rules against prod </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-reference-cli/"> pyric CLI reference </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-reference-verify/"> Verify API </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-bridge"> Bridge </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-bridge/"> pyric-tools/bridge </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-tools-deploy"> <summary>pyric-tools / deploy</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-deploy-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-tutorials-01-deploy-a-cloud-function/"> Deploy a Cloud Function </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-deploy-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-firebase-auth/"> Scope from Firebase Auth </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-build-projectscope-from-service-account/"> Scope from service account </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-bundle-and-deploy-a-function/"> Bundle &amp; deploy a function </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-indexes/"> Deploy Firestore indexes </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-firestore-rules/"> Deploy Firestore rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-hosting-rewrites/"> Deploy Hosting rewrites </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-realtime-database-rules/"> Deploy RTDB rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-deploy-to-a-preview-channel/"> Deploy to a preview channel </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-handle-errors-and-outcomes/"> Handle errors and outcomes </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-provision-a-firestore-database/"> Provision a database </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-how-to-register-tools-with-an-agent/"> Register deploy tools </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-deploy-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-cli-agent-io/"> pyric deploy agent I/O </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-error-codes/"> Error codes by operation </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-firestore-namespace/"> firestore namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-functions-namespace/"> functions namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-config/"> firebase.json hosting config </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-hosting-namespace/"> hosting namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-rtdb-namespace/"> rtdb namespace </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-scope-and-outcome/"> Scope and Outcome </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-reference-tool-factories/"> Tool factories </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-tools-deploy-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-primitives-vs-orchestrators/"> Primitives vs. orchestrators </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-token-caching/"> Token caching and memoizeTtl </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-why-no-firebase-cli/"> Why no Firebase CLI </a> </li><li> <a href="/__pyric/ui/docs/pyric-tools-deploy-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-firestore"> <summary>pyric / firestore</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-tutorials-01-write-a-sandbox-demo/"> Sandbox-backed demo </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-tutorials-02-swap-to-prod-backend/"> Swap to prod backend </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-build-queries/"> Build queries </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-migrate-from-firebase-firestore/"> Migrate from Firestore </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-pick-a-backend/"> Pick a backend </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-run-a-transaction/"> Run a transaction </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-use-onsnapshot/"> Use onSnapshot </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-how-to-use-sandbox-ops/"> Use sandbox-only ops </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-feature-matrix/"> Feature matrix </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-getfirestore/"> getFirestore overloads </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-query-constraints/"> Query constraints </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-sandbox-ops/"> Sandbox-only operations </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-reference-tool-factories/"> Tool factories </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-rules-tooling-is-separate/"> Rules tooling is separate </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-target-symbol-opacity/"> TARGET_SYMBOL opacity </a> </li><li> <a href="/__pyric/ui/docs/pyric-firestore-explanation-two-backends-one-surface/"> Two backends, one surface </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-firestore-compat"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-firestore-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-rules" open> <summary>pyric / rules</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-rules/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-rules-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-tutorials-01-lint-your-first-rules-file/"> Lint your first rules file </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-tutorials-02-write-a-test-suite-for-your-rules/"> Write a rules test suite </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-rules-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-how-to-compare-rulesets-for-weakening/"> Compare rulesets </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-inspect-rules-via-the-ast/"> Inspect rules via the AST </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-lint-rules-source/"> Lint a rules source </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-pin-request-time/"> Pin request.time </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-register-tools-with-an-agent/"> Register rules tools </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-resolve-module-imports/"> Resolve 2+modules imports </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-simulate-rules-locally/"> Simulate rules locally </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-how-to-test-rules-against-firebase/"> Test rules against Firebase </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-rules-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-ast/"> AST </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-errors/"> Errors </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-lint-rules/"> Lint rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-simulator-context/"> Simulator context </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-stdlib-modules/"> Standard library modules </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-test-case-schema/"> TestCase schema </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-validator-findings/"> Validator findings </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-reference-value-wrappers/"> Value wrappers </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-rules-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-rules-explanation-agent-failure-modes/" aria-current="page"> Agent failure modes </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-lint-vs-validate-vs-simulate-vs-test/"> Lint vs validate vs test </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-runtime-budget-and-shared-gates/"> Runtime budget and gates </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-sentinel-expression-engine/"> Sentinel expression engine </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-simulator-vs-rules-test-api/"> Simulator vs Rules Test API </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-the-2-plus-modules-extension/"> The 2+modules extension </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-value-wrappers-design/"> Value wrapper design </a> </li><li> <a href="/__pyric/ui/docs/pyric-rules-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-sandbox"> <summary>pyric / sandbox</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-sandbox-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-01-your-first-sandbox-session/"> Your first sandbox session </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-02-use-the-sandbox-in-a-test-harness/"> Sandbox in a test harness </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-tutorials-03-build-a-traffic-monitor/"> Traffic monitor </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-sandbox-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-multiple-isolated-sandboxes/"> Run isolated sandboxes </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-observe-events/"> Observe sandbox events </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-pick-an-adapter/"> Pick an adapter </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-replay-events/"> Replay events </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-reset-between-tests/"> Reset between tests </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-seed-data-and-rules/"> Seed data and rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-switch-users/"> Switch users </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-how-to-use-admin-reads/"> Use admin reads </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-sandbox-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-divergences/"> Divergence </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-error-codes/"> SandboxError codes </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-internal-protocol/"> The /internal protocol </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-sandbox-and-context/"> Sandbox and context </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-sandbox-event/"> SandboxEvent </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-reference-snapshot-and-admin/"> Snapshot and admin reads </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-sandbox-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-every-op-is-a-request/"> Every operation is a request </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-identity-is-a-context/"> Identity is a context </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-internal-adapter-protocol/"> The /internal protocol </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-listener-re-evaluation/"> Listener re-evaluation </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-local-backend-vs-firestore-offline/"> Local backend vs. offline </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-why-adapters-are-siblings/"> Why adapters are siblings </a> </li><li> <a href="/__pyric/ui/docs/pyric-sandbox-explanation-why-this-package-exists/"> Why this package exists </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-storage"> <summary>pyric / storage</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-storage/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-tutorials-01-upload-and-download/"> Upload and download </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-how-to-enforce-rules/"> Enforce Storage rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-list-and-delete/"> List and delete objects </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-round-trip-metadata/"> Round-trip metadata </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-switch-backends/"> Switch backends </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-how-to-test-rule-expressions/"> Test rule expressions </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-error-codes/"> Error codes </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-rules-subset/"> Storage rules subset </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-reference-storage-options/"> StorageOptions </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-explanation-implementation-scope/"> Implementation scope </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-explanation-session-archive-use-case/"> The session-archive driver </a> </li><li> <a href="/__pyric/ui/docs/pyric-storage-explanation-why-indexeddb/"> Why IndexedDB </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-storage-compat"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-storage-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-auth"> <summary>pyric / auth</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-auth/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-auth-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-auth-reference-api/"> API reference </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-feature-matrix/"> Feature matrix </a> </li><li> <a href="/__pyric/ui/docs/pyric-auth-reference-sandbox-test-driver/"> Sandbox test driver </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-auth-compat"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-auth-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-database"> <summary>pyric / database</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-database/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-database-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-tutorials-01-author-rtdb-rules-with-constraints/"> Author RTDB rules </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-database-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-reference-rules-tooling/"> RTDB rules tooling </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-database-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-explanation-rules-authoring-and-deploy-are-separate/"> Authoring vs. deploy </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-database-compat"> Compat </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-database-compat/"> Compatibility matrix </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-admin-firestore"> <summary>pyric-admin / firestore</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-admin-firestore-tutorials"> Tutorials </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-tutorials-01-first-admin-session/"> First admin session </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-admin-firestore-how-to"> How-to </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-run-a-transaction/"> Run a transaction </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-seed-and-set-rules/"> Seed and set rules </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-translate-denials/"> Translate denials </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-use-onsnapshot/"> Use onSnapshot </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-how-to-write-a-batch/"> Write a batch </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-admin-firestore-reference"> Reference </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-api/"> Public API </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-onsnapshot/"> onSnapshot overloads </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-re-exported-types/"> Re-exported types </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-reference-sandbox-firestore/"> SandboxFirestore surface </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-admin-firestore-explanation"> Explanation </h2> <ul> <li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-error-translation/"> Error translation </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-per-call-delegate/"> Per-call delegate </a> </li><li> <a href="/__pyric/ui/docs/pyric-admin-firestore-explanation-why-mirror-admin-shape/"> Why mirror the admin SDK </a> </li> </ul> </div> </div> </details><details class="docs-nav-group" id="nav-group-pyric-ui"> <summary>@pyric/ui</summary> <div class="docs-nav-group-body"> <div class="docs-nav-section">  <ul> <li> <a href="/__pyric/ui/docs/ui/"> Overview </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-primitives"> Primitives </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-primitives-badge/"> &lt;Badge&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-confirmdialog/"> &lt;ConfirmDialog&gt; + useConfirm </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-copybutton/"> &lt;CopyButton&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-jsonview/"> &lt;JsonView&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-segmentedcontrol/"> &lt;SegmentedControl&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-toast/"> &lt;ToastProvider&gt; + useToast </a> </li><li> <a href="/__pyric/ui/docs/ui-primitives-virtuallist/"> &lt;VirtualList&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-firestore"> Firestore </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-firestore-collectionlist/"> &lt;CollectionList&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-deletewithconfirm/"> &lt;DeleteWithConfirm&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documenteditor/"> &lt;DocumentEditor&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documentlist/"> &lt;DocumentList&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-documentpreview/"> &lt;DocumentPreview&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-querybuilder/"> &lt;QueryBuilder&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-firestore-referencepicker/"> &lt;ReferencePicker&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-storage"> Storage </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-storage-deleteselectionwithconfirm/"> &lt;DeleteSelectionWithConfirm&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-objectbrowser/"> &lt;ObjectBrowser&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-objectinspector/"> &lt;ObjectInspector&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-pathbreadcrumb/"> &lt;PathBreadcrumb&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage/"> @pyric/ui/storage </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-uploaddropzone/"> &lt;UploadDropzone&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-rules-aware-affordances/"> Rules-aware affordances </a> </li><li> <a href="/__pyric/ui/docs/ui-storage-usestoragerulesgate/"> useStorageRulesGate </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-traffic"> Traffic </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-traffic/"> @pyric/ui/traffic </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-ruleheatmap/"> &lt;RuleHeatmap&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficdetail/"> &lt;TrafficDetail&gt; </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficlog/"> TrafficLog components </a> </li><li> <a href="/__pyric/ui/docs/ui-traffic-trafficstats/"> &lt;TrafficStats&gt; </a> </li> </ul> </div><div class="docs-nav-section"> <h2 class="docs-nav-heading" id="nav-section-pyric-ui-auth"> Auth </h2> <ul> <li> <a href="/__pyric/ui/docs/ui-auth-authsigninhelper/"> AuthSignInHelper </a> </li><li> <a href="/__pyric/ui/docs/ui-auth-authusers/"> Auth users admin </a> </li> </ul> </div> </div> </details> </nav> <main class="doc-main"> <nav class="docs-breadcrumbs" aria-label="Breadcrumb"> <ol> <li>  <a href="/__pyric/ui/docs/pyric-rules/">pyric / rules</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <a href="#nav-section-pyric-rules-explanation">Explanation</a> </li><li> <span class="docs-breadcrumbs-sep" aria-hidden="true">/</span> <span aria-current="page">Agent failure modes</span> </li> </ol> </nav> <article class="prose">  <h1 id="agent-failure-modes-the-linter-catches">Agent failure modes the linter catches</h1>
+<p>Most of the linter’s compilation and budget rules came from production: we hit the limit, learned the number, encoded it. A separate set of rules came from somewhere different — watching LLM-driven agents try to write rules and fail in characteristic ways.</p>
+<p>These rules are advisory in nature but defensive in posture. Each one exists because an agent shipped the same broken pattern more than once in our playground sessions. This page tells the stories.</p>
+<h2 id="escaping-a-denial-with-if-true">Escaping a denial with <code>if true</code></h2>
+<p>The most common failure mode. The agent writes a rule with a careful predicate. A test case denies when the agent expected it to allow. The agent doesn’t understand why, can’t reproduce the rule’s mental model, and replaces the predicate with <code>if true</code> to make the test pass.</p>
+<p>The deploy ships. The collection is now publicly writable.</p>
+<p>The linter catches this with two rules:</p>
+<ul>
+<li><strong><code>PERMISSIVE_RULE</code></strong> — any write rule whose predicate folds to constant <code>true</code>. The fold handles boolean literals, <code>&#x26;&#x26;</code> / <code>||</code> of booleans, <code>!</code> of a boolean. It does not try to prove <code>1 == 1</code> or follow function calls; a few false negatives are acceptable, a single false positive would block a legitimate deploy.</li>
+<li><strong><code>RECURSIVE_WILDCARD_OPEN</code></strong> — a match path with <code>{document=**}</code> combined with an always-true predicate. The recursive wildcard makes the open-rule especially dangerous because it overrides every specific rule beneath it. Separate from <code>PERMISSIVE_RULE</code> so the diagnostic names the specific anti-pattern.</li>
+</ul>
+<p>Both are <code>severity: 'error'</code>. The deploy path refuses to swap a ruleset that contains either.</p>
+<p>The fix isn’t to relax the linter — it’s to give the agent a real diagnostic for the original denial. The simulator’s <code>debugMessages</code> array shows exactly which rule decided. If the agent learns to read that trace, the escape doesn’t happen.</p>
+<h2 id="silently-removing-predicates">Silently removing predicates</h2>
+<p>A subtler variant. The agent writes:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>allow update: if request.auth.uid == resource.data.ownerId</span></span>
+<span class="line"><span>              &#x26;&#x26; status == 'open';</span></span></code></pre>
+<p>A test case fails because the test set <code>status</code> to <code>'closed'</code>. The agent doesn’t update the test data — it removes the <code>status == 'open'</code> conjunct from the rule. The test passes. The deploy ships. Updates against closed records are no longer gated.</p>
+<p><code>RULES_WEAKENED</code> exists for this. When you pass the previously-deployed source to the linter:</p>
+<pre class="astro-code one-dark-pro" style="background-color:#282c34;color:#abb2bf; overflow-x: auto;" tabindex="0" data-language="ts"><code><span class="line"><span style="color:#61AFEF">lintFirestoreRules</span><span style="color:#ABB2BF">(</span><span style="color:#E06C75">newSource</span><span style="color:#ABB2BF">, { </span><span style="color:#E06C75">previousSource</span><span style="color:#ABB2BF">: </span><span style="color:#E06C75">oldSource</span><span style="color:#ABB2BF"> });</span></span></code></pre>
+<p>…the linter normalises every match path, finds the corresponding allow rule by op-set, extracts the top-level conjuncts of each predicate (split only on <code>&#x26;&#x26;</code>, never <code>||</code>), and reports every conjunct that existed before and is missing now.</p>
+<p><code>RULES_WEAKENED</code> is <code>warning</code>, not <code>error</code>. There are real reasons to delete a predicate — a refactor, a dedupe, an intentional broadening. The signal is “review this”, not “refuse the deploy”. A human (or a more careful agent) decides whether the removal is intentional.</p>
+<h2 id="javascript-hallucinations">JavaScript hallucinations</h2>
+<p>LLMs trained primarily on JavaScript will write <code>.filter()</code>, <code>.map()</code>, <code>.toLowerCase()</code>, <code>===</code>, <code>?.</code>, <code>??</code> in rules sources. None of these exist in the Firestore rules DSL. They either fail to parse (with an unhelpful “expected <code>)</code>” message) or parse and then fail at runtime (silently denying every request).</p>
+<p>The pre-parse syntax-hint pass fires on the raw source, before the parser runs, so the diagnostic is precise even when the file is unparseable:</p>
+<ul>
+<li><strong><code>INVALID_OPERATOR</code></strong> — <code>===</code>, <code>!==</code>, <code>?.</code>, <code>??</code>, backtick template literals. Each gets a specific message naming the JS operator and the Firestore-equivalent (or absence of one).</li>
+</ul>
+<p>The post-parse hallucination pass walks the AST for syntactically-valid-but-semantically-wrong calls:</p>
+<ul>
+<li><strong><code>HALLUCINATED_METHOD</code></strong> — method calls that don’t exist in the rules surface.</li>
+<li><strong><code>HALLUCINATED_GLOBAL</code></strong> — references to globals the engine doesn’t expose (<code>Math</code>, <code>JSON</code>, <code>Date</code>).</li>
+<li><strong><code>WRONG_CONTEXT_PATH</code></strong> — <code>get(...)</code> calls whose path doesn’t begin with <code>/databases/$(database)/documents/</code>.</li>
+<li><strong><code>LENGTH_PROPERTY</code></strong> — <code>.length</code> access on a string or list (the rules surface uses <code>.size()</code>).</li>
+<li><strong><code>INVALID_PATH_INTERPOLATION</code></strong> — match-style <code>{ident}</code> used inside a path literal where Firestore requires <code>$(ident)</code>.</li>
+<li><strong><code>METHOD_MISSING_PARENS</code></strong> — an identifier in expression position that looks like a method name without parens.</li>
+</ul>
+<p>Each rule produces a fix string when possible. The agent gets “you wrote <code>.length</code>, Firestore wants <code>.size()</code>” instead of a generic syntax error.</p>
+<h2 id="time-dependent-flakiness">Time-dependent flakiness</h2>
+<p>A rule reads <code>request.time</code> (a date-gated discount window, a trial-period check, an audit-log retention rule). The agent’s test case doesn’t pin <code>requestTime</code>, so the simulator falls back to wallclock. The test passes today, fails three months later when the rule’s date threshold has rolled past wallclock. CI starts going red intermittently.</p>
+<p><code>REQUEST_TIME_NOT_PINNED</code> activates when <code>options.testCases</code> is passed to the linter. For each rule that transitively reads <code>request.time</code>, the linter emits one warning per test case that targets the rule and doesn’t set <code>requestTime</code>. The fix is mechanical: add the ISO-8601 string. The diagnostic is precise: it names the rule, the test case, the path.</p>
+<p>This is the only lint rule that depends on a test suite, and the dependency is opt-in (<code>options.testCases</code> defaults to undefined). Source-only <code>lintFirestoreRules(source)</code> calls behave as they always did.</p>
+<h2 id="the-shape-of-these-rules">The shape of these rules</h2>
+<p>Every rule on this page shares three properties:</p>
+<ul>
+<li><strong>It came from observation, not specification.</strong> No one sat down to design <code>RULES_WEAKENED</code>; we watched it ship a regression and added the check the next day.</li>
+<li><strong>It targets the agent, not the language.</strong> A careful human reading the source would catch most of these on review. The point is to surface them automatically.</li>
+<li><strong>It carries a precise fix.</strong> “Your rule is wrong” is a useless diagnostic for an agent looping on the linter’s output. “Replace <code>if true</code> with <code>request.auth.uid == resource.data.ownerId</code>” is something the agent can act on directly.</li>
+</ul>
+<p>The list is not closed. As we watch new failure modes emerge — typically when a model architecture changes or a new playground scenario surfaces a recurring mistake — new rules join it.</p>  </article> </main> <aside class="doc-toc" aria-label="On this page"> <h2 class="doc-toc-heading">On this page</h2> <ul> <li data-depth="2"> <a href="#escaping-a-denial-with-if-true">Escaping a denial with if true</a> </li><li data-depth="2"> <a href="#silently-removing-predicates">Silently removing predicates</a> </li><li data-depth="2"> <a href="#javascript-hallucinations">JavaScript hallucinations</a> </li><li data-depth="2"> <a href="#time-dependent-flakiness">Time-dependent flakiness</a> </li><li data-depth="2"> <a href="#the-shape-of-these-rules">The shape of these rules</a> </li> </ul> </aside> </div> <script type="module">const s=new Map;document.querySelectorAll('.doc-toc a[href^="#"]').forEach(t=>s.set(decodeURIComponent(t.hash.slice(1)),t));if(s.size>0){const t=new Set,n=()=>{let o=null;for(const e of s.keys())if(t.has(e)){o=e;break}s.forEach((e,c)=>e.classList.toggle("active",c===o))},r=new IntersectionObserver(o=>{for(const e of o)e.isIntersecting?t.add(e.target.id):t.delete(e.target.id);n()},{rootMargin:"-72px 0px -60% 0px"});s.forEach((o,e)=>{const c=document.getElementById(e);c&&r.observe(c)})}</script> </body> </html>

package/dist/serve/docs-ui/docs/pyric-rules-explanation-agent-failure-modes.md ADDED Viewed

@@ -0,0 +1,74 @@
+# Agent failure modes the linter catches
+Most of the linter's compilation and budget rules came from production: we hit the limit, learned the number, encoded it. A separate set of rules came from somewhere different — watching LLM-driven agents try to write rules and fail in characteristic ways.
+These rules are advisory in nature but defensive in posture. Each one exists because an agent shipped the same broken pattern more than once in our playground sessions. This page tells the stories.
+## Escaping a denial with `if true`
+The most common failure mode. The agent writes a rule with a careful predicate. A test case denies when the agent expected it to allow. The agent doesn't understand why, can't reproduce the rule's mental model, and replaces the predicate with `if true` to make the test pass.
+The deploy ships. The collection is now publicly writable.
+The linter catches this with two rules:
+- **`PERMISSIVE_RULE`** — any write rule whose predicate folds to constant `true`. The fold handles boolean literals, `&&` / `||` of booleans, `!` of a boolean. It does not try to prove `1 == 1` or follow function calls; a few false negatives are acceptable, a single false positive would block a legitimate deploy.
+- **`RECURSIVE_WILDCARD_OPEN`** — a match path with `{document=**}` combined with an always-true predicate. The recursive wildcard makes the open-rule especially dangerous because it overrides every specific rule beneath it. Separate from `PERMISSIVE_RULE` so the diagnostic names the specific anti-pattern.
+Both are `severity: 'error'`. The deploy path refuses to swap a ruleset that contains either.
+The fix isn't to relax the linter — it's to give the agent a real diagnostic for the original denial. The simulator's `debugMessages` array shows exactly which rule decided. If the agent learns to read that trace, the escape doesn't happen.
+## Silently removing predicates
+A subtler variant. The agent writes:
+```
+allow update: if request.auth.uid == resource.data.ownerId
+              && status == 'open';
+```
+A test case fails because the test set `status` to `'closed'`. The agent doesn't update the test data — it removes the `status == 'open'` conjunct from the rule. The test passes. The deploy ships. Updates against closed records are no longer gated.
+`RULES_WEAKENED` exists for this. When you pass the previously-deployed source to the linter:
+```ts
+lintFirestoreRules(newSource, { previousSource: oldSource });
+```
+…the linter normalises every match path, finds the corresponding allow rule by op-set, extracts the top-level conjuncts of each predicate (split only on `&&`, never `||`), and reports every conjunct that existed before and is missing now.
+`RULES_WEAKENED` is `warning`, not `error`. There are real reasons to delete a predicate — a refactor, a dedupe, an intentional broadening. The signal is "review this", not "refuse the deploy". A human (or a more careful agent) decides whether the removal is intentional.
+## JavaScript hallucinations
+LLMs trained primarily on JavaScript will write `.filter()`, `.map()`, `.toLowerCase()`, `===`, `?.`, `??` in rules sources. None of these exist in the Firestore rules DSL. They either fail to parse (with an unhelpful "expected `)`" message) or parse and then fail at runtime (silently denying every request).
+The pre-parse syntax-hint pass fires on the raw source, before the parser runs, so the diagnostic is precise even when the file is unparseable:
+- **`INVALID_OPERATOR`** — `===`, `!==`, `?.`, `??`, backtick template literals. Each gets a specific message naming the JS operator and the Firestore-equivalent (or absence of one).
+The post-parse hallucination pass walks the AST for syntactically-valid-but-semantically-wrong calls:
+- **`HALLUCINATED_METHOD`** — method calls that don't exist in the rules surface.
+- **`HALLUCINATED_GLOBAL`** — references to globals the engine doesn't expose (`Math`, `JSON`, `Date`).
+- **`WRONG_CONTEXT_PATH`** — `get(...)` calls whose path doesn't begin with `/databases/$(database)/documents/`.
+- **`LENGTH_PROPERTY`** — `.length` access on a string or list (the rules surface uses `.size()`).
+- **`INVALID_PATH_INTERPOLATION`** — match-style `{ident}` used inside a path literal where Firestore requires `$(ident)`.
+- **`METHOD_MISSING_PARENS`** — an identifier in expression position that looks like a method name without parens.
+Each rule produces a fix string when possible. The agent gets "you wrote `.length`, Firestore wants `.size()`" instead of a generic syntax error.
+## Time-dependent flakiness
+A rule reads `request.time` (a date-gated discount window, a trial-period check, an audit-log retention rule). The agent's test case doesn't pin `requestTime`, so the simulator falls back to wallclock. The test passes today, fails three months later when the rule's date threshold has rolled past wallclock. CI starts going red intermittently.
+`REQUEST_TIME_NOT_PINNED` activates when `options.testCases` is passed to the linter. For each rule that transitively reads `request.time`, the linter emits one warning per test case that targets the rule and doesn't set `requestTime`. The fix is mechanical: add the ISO-8601 string. The diagnostic is precise: it names the rule, the test case, the path.
+This is the only lint rule that depends on a test suite, and the dependency is opt-in (`options.testCases` defaults to undefined). Source-only `lintFirestoreRules(source)` calls behave as they always did.
+## The shape of these rules
+Every rule on this page shares three properties:
+- **It came from observation, not specification.** No one sat down to design `RULES_WEAKENED`; we watched it ship a regression and added the check the next day.
+- **It targets the agent, not the language.** A careful human reading the source would catch most of these on review. The point is to surface them automatically.
+- **It carries a precise fix.** "Your rule is wrong" is a useless diagnostic for an agent looping on the linter's output. "Replace `if true` with `request.auth.uid == resource.data.ownerId`" is something the agent can act on directly.
+The list is not closed. As we watch new failure modes emerge — typically when a model architecture changes or a new playground scenario surfaces a recurring mistake — new rules join it.