rulereceipt 0.1.32 → 0.1.34

package/dist/types.d.ts

@@ -26,6 +26,32 @@ export interface TranscriptToolResultEvent {
 }
 export type TranscriptEvent = TranscriptTextEvent | TranscriptToolUseEvent | TranscriptToolResultEvent;
 export type CheckStatus = "PASS" | "FAIL" | "UNCLEAR";
+/**
+ * Five outcomes, not three.
+ *
+ * From anthropics/claude-code#90542. The failure that started this was not a
+ * bad matcher — it was vocabulary reuse. With no API key the tool printed
+ * "13 couldn't tell", a phrase this codebase defines as "the tool looked and
+ * the evidence was ambiguous", about thirteen rules it had never examined.
+ * Once `not_run` is its own outcome that lie has nowhere to sit, however
+ * good or bad the matcher is.
+ *
+ * `not_applicable` earns its place the same way. A session that never
+ * touched git cannot have violated a git rule, and calling that "followed"
+ * is how an empty transcript produced 2,770 green ticks across the 559-file
+ * corpus — every one of them true and none of them meaning anything.
+ */
+export type CheckOutcome = "pass" | "fail"
+/** It looked, and the evidence did not settle it. */
+ | "inconclusive"
+/** No check happened: no key, an error, no ratified reading. */
+ | "not_run"
+/** The trigger never fired, so there was nothing to judge. */
+ | "not_applicable";
+/** How a verdict was reached. A verdict with no method is a verdict with no standing. */
+export type CheckMethod = "text_scan" | "file_events" | "git_events" | "code_content" | "edit_test_pairing" | "claim_vs_evidence" | "model_judgment"
+/** Nothing ran. */
+ | "none";
 export interface CheckResult {
     ruleId: string;
     ruleTitle: string;
@@ -48,4 +74,49 @@ export interface CheckResult {
      * not blur them.
      */
     needsHuman?: boolean;
+    /**
+     * The outcome in the five-value vocabulary. Optional while the checkers
+     * are migrated one at a time; `status` remains the fallback.
+     */
+    outcome?: CheckOutcome;
+    /** How this verdict was reached. */
+    method?: CheckMethod;
+    /**
+     * What this method is ALLOWED to claim.
+     *
+     * A text scan may say "no occurrence of these spellings in this scope".
+     * It may not say "the act did not happen" — that PASS shipped for six
+     * versions and passed a session that ran `git push -f`. The ceiling
+     * travels with the verdict so the report cannot overclaim on its behalf.
+     */
+    ceiling?: string;
+    /** Why an inconclusive or not_run outcome came out that way, e.g. scope_incomplete. */
+    reason?: string;
+    /**
+     * Set when the rule's direction was inferred rather than read from an
+     * explicit signal word — a bare imperative like "Use `npm`" taken as a
+     * requirement.
+     *
+     * Named on the verdict so a measurement can split inferred rows from
+     * explicit ones and settle whether the leftover is coverage or noise,
+     * rather than the question being argued. Suggested on
+     * anthropics/claude-code#90542.
+     */
+    polarityInferred?: boolean;
 }
+/**
+ * A FAIL may only be constructed from a forbidding rule.
+ *
+ * This is the "cannot accuse" property as a compile-time invariant rather
+ * than a convention. It held by inspection — every `status: "FAIL"` sat
+ * inside a `polarity === "forbid"` branch — and inspection is exactly what
+ * stops holding the day someone adds a require-FAIL path. Passing the
+ * polarity in means a require branch cannot call this: `"require"` is not
+ * assignable to `"forbid"`, and the build fails rather than a user being
+ * accused of not doing something the tool guessed they had to do.
+ */
+export declare function violation(rule: {
+    id: string;
+    title: string;
+    source: "global" | "project";
+}, polarity: "forbid", evidence: string, extra?: Partial<CheckResult>): CheckResult;

package/dist/types.js

@@ -1 +1,22 @@
-export {};
+/**
+ * A FAIL may only be constructed from a forbidding rule.
+ *
+ * This is the "cannot accuse" property as a compile-time invariant rather
+ * than a convention. It held by inspection — every `status: "FAIL"` sat
+ * inside a `polarity === "forbid"` branch — and inspection is exactly what
+ * stops holding the day someone adds a require-FAIL path. Passing the
+ * polarity in means a require branch cannot call this: `"require"` is not
+ * assignable to `"forbid"`, and the build fails rather than a user being
+ * accused of not doing something the tool guessed they had to do.
+ */
+export function violation(rule, polarity, evidence, extra = {}) {
+    return {
+        ruleId: rule.id,
+        ruleTitle: rule.title,
+        ruleSource: rule.source,
+        status: "FAIL",
+        outcome: "fail",
+        evidence,
+        ...extra,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",
@@ -48,7 +48,7 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.32.0",
     "commander": "^15.0.0",
-    "nodemailer": "^9.0.6"
+    "nodemailer": "^9.1.1"
   },
   "devDependencies": {
     "@types/node": "^26.4.0",