runward 0.6.0 → 0.7.0

package/README.md

@@ -1,6 +1,6 @@
 # Runward
 
-[![License: MIT](https://img.shields.io/badge/License-MIT-0a0a0a?style=for-the-badge)](LICENSE) [![Doctrine: CC BY-ND 4.0](https://img.shields.io/badge/Doctrine-CC%20BY--ND%204.0-C9A45C?style=for-the-badge)](https://github.com/stranxik/designing-and-running-agentic-systems) [![Support via Ko-fi](https://img.shields.io/badge/%E2%98%95%20Support%20via%20Ko--fi-orange?style=for-the-badge)](https://ko-fi.com/stranxik)
+[![npm](https://img.shields.io/npm/v/runward?style=for-the-badge&color=0a0a0a&label=npm)](https://www.npmjs.com/package/runward) [![License: MIT](https://img.shields.io/badge/License-MIT-0a0a0a?style=for-the-badge)](LICENSE) [![Doctrine: CC BY-ND 4.0](https://img.shields.io/badge/Doctrine-CC%20BY--ND%204.0-C9A45C?style=for-the-badge)](https://github.com/stranxik/designing-and-running-agentic-systems) [![Support via Ko-fi](https://img.shields.io/badge/%E2%98%95%20Support%20via%20Ko--fi-orange?style=for-the-badge)](https://ko-fi.com/stranxik)
 
 **From business need to a system that holds in production.**
 

package/dist/cli.js

@@ -57,6 +57,7 @@ program
     .command("check")
     .description("can I cross the gate — gate audit, exit 1 on gaps (CI-friendly)")
     .option("-p, --path <path>", "project directory")
+    .option("--strict", "also verify the floor rule-conformance manifest (deterministic)")
     .action(checkCommand);
 program
     .command("status")

package/dist/commands/check.js

@@ -1,10 +1,15 @@
 import { join } from "node:path";
 import { analyze, findMissionRoot } from "../lib/mission.js";
+import { conformance } from "../lib/conformance.js";
 import { c, createHeader, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
 /**
  * Gate audit — the gap analysis: which deliverable, expected at which
  * phase, is present, started, or still a raw template.
+ * With --strict, also verifies the floor rule-conformance manifest (see
+ * docs/adr/ADR-0001): every CRITICAL/HIGH rule mapped to the floor phase must be
+ * accounted for. It checks the presence of a traced decision, never the quality
+ * of the implementation — that stays the operator's judgment at the gate.
  * Exit codes: 0 = current gate clean, 1 = gaps, 2 = no mission found.
  */
 export async function checkCommand(opts) {
@@ -37,14 +42,45 @@ export async function checkCommand(opts) {
                 gaps++;
         }
     }
+    let strictGaps = 0;
+    if (opts.strict) {
+        const CONFORMANCE = [
+            { phase: "architect", deliverable: "architecture.md", label: "Architect" },
+            { phase: "floor", deliverable: "floor.md", label: "Floor" },
+            { phase: "govern", deliverable: "governance/threat-model.md", label: "Govern" },
+        ];
+        console.log(section("Rule conformance (--strict)"));
+        let checked = 0;
+        for (const { phase, deliverable, label } of CONFORMANCE) {
+            const { expected, violations } = conformance(mission, phase, deliverable);
+            if (expected.length === 0)
+                continue;
+            checked++;
+            if (violations.length === 0) {
+                console.log(`  ${status.success(`${label}: ${expected.length} rule(s) accounted for`)}`);
+            }
+            else {
+                for (const v of violations)
+                    console.log(`  ${c.error("✗")} ${c.darkGray(label + " · ")}${c.white(v.rule)}${c.darkGray(" — " + v.problem)}`);
+                strictGaps += violations.length;
+            }
+        }
+        if (checked === 0)
+            console.log("  " + c.darkGray("no CRITICAL/HIGH rules mapped to a build phase"));
+    }
     console.log(section("Summary"));
     console.log(`  ${c.primaryBold("Current gate")}  ${c.white(report.currentPhase)}`);
     console.log(`  ${c.primaryBold("ADRs")}          ${c.white(String(report.adrCount))}${report.adrCount === 0 ? c.warning("  — no structural decision locked yet") : ""}`);
-    if (gaps === 0) {
+    if (gaps === 0 && strictGaps === 0) {
         console.log("\n" + status.success("All expected deliverables are filled. Cross gates on evidence, not on paperwork."));
     }
     else {
-        console.log("\n" + status.warning(`${gaps} deliverable(s) not filled. The gate rule: no phase closes without its artifact.`));
+        const parts = [];
+        if (gaps)
+            parts.push(`${gaps} deliverable(s) not filled`);
+        if (strictGaps)
+            parts.push(`${strictGaps} floor rule-conformance gap(s)`);
+        console.log("\n" + status.warning(`${parts.join(" · ")}. No phase closes without its artifact — and, under --strict, without its CRITICAL/HIGH rules accounted for.`));
         process.exitCode = 1;
     }
 }

package/dist/lib/conformance.js

@@ -0,0 +1,88 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { TEMPLATES } from "./paths.js";
+const FRONTMATTER = /^---\n([\s\S]*?)\n---/;
+const VALID_STATUS = new Set(["applied", "deviated", "n/a"]);
+function parseRuleMeta(content) {
+    const fm = content.match(FRONTMATTER)?.[1] ?? "";
+    const impact = (fm.match(/^impact:\s*(.+)$/m)?.[1] ?? "").trim();
+    const phasesRaw = fm.match(/^phases:\s*\[(.*)\]/m)?.[1] ?? "";
+    const phases = phasesRaw.split(",").map((s) => s.trim()).filter(Boolean);
+    return { impact, phases };
+}
+/** CRITICAL/HIGH rules mapped to a phase — the set that must be accounted for.
+ *  The mapping is a property of the rule definitions: read the mission's own
+ *  `runward/rules/` when present, else fall back to the package rules (the
+ *  authoritative source — covers missions predating rules-in-mission). */
+export function expectedRules(missionDir, phaseId) {
+    const missionRules = join(missionDir, "rules");
+    const dir = existsSync(missionRules) ? missionRules : join(TEMPLATES, "rules");
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .filter((f) => f.endsWith(".md"))
+        .filter((f) => {
+        const { impact, phases } = parseRuleMeta(readFileSync(join(dir, f), "utf8"));
+        return (impact === "CRITICAL" || impact === "HIGH") && phases.includes(phaseId);
+    })
+        .map((f) => f.replace(/\.md$/, ""))
+        .sort();
+}
+/** Parse the "## Rule conformance" markdown table from a deliverable. */
+export function parseManifest(content) {
+    const lines = content.split("\n");
+    const start = lines.findIndex((l) => /^##\s+Rule conformance/i.test(l));
+    if (start === -1)
+        return [];
+    const rows = [];
+    for (let i = start + 1; i < lines.length; i++) {
+        const line = lines[i];
+        if (/^##\s/.test(line))
+            break; // next section
+        if (!line.trim().startsWith("|"))
+            continue;
+        const cols = line.split("|").slice(1, -1).map((c) => c.replace(/`/g, "").trim());
+        if (cols.length < 3)
+            continue;
+        const [rule, status, evidence] = cols;
+        if (/^rule$/i.test(rule) || /^:?-+:?$/.test(rule))
+            continue; // header / separator
+        rows.push({ rule, status: status.toLowerCase(), evidence });
+    }
+    return rows;
+}
+function adrExists(missionDir, evidence) {
+    const id = evidence.match(/ADR-\d+/i)?.[0].toUpperCase();
+    if (!id)
+        return false;
+    const dir = join(missionDir, "adr");
+    return existsSync(dir) && readdirSync(dir).some((f) => f.toUpperCase().startsWith(id));
+}
+/** Verify a build phase's conformance manifest against its expected rule set. */
+export function conformance(missionDir, phaseId, deliverable) {
+    const expected = expectedRules(missionDir, phaseId);
+    const violations = [];
+    const path = join(missionDir, deliverable);
+    if (!existsSync(path)) {
+        return { expected, violations: expected.map((rule) => ({ rule, problem: `${deliverable} missing` })) };
+    }
+    const byRule = new Map(parseManifest(readFileSync(path, "utf8")).map((r) => [r.rule, r]));
+    for (const rule of expected) {
+        const row = byRule.get(rule);
+        if (!row) {
+            violations.push({ rule, problem: "not accounted for in the Rule conformance manifest" });
+            continue;
+        }
+        if (!VALID_STATUS.has(row.status)) {
+            violations.push({ rule, problem: `invalid status "${row.status}" (use applied | deviated | n/a)` });
+            continue;
+        }
+        if (row.status === "applied" && !row.evidence)
+            violations.push({ rule, problem: "applied without an evidence pointer" });
+        if (row.status === "deviated" && !adrExists(missionDir, row.evidence))
+            violations.push({ rule, problem: "deviated but no matching ADR in runward/adr/" });
+        if (row.status === "n/a" && !row.evidence)
+            violations.push({ rule, problem: "n/a without a reason" });
+    }
+    return { expected, violations };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runward",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "After the spec: ship and run. A delivery framework for agentic systems — floor first, evolution on evidence, governance from day zero, handover with proof.",
   "keywords": ["agentic", "ai-agents", "spec-driven", "delivery", "governance", "llm", "architecture"],
   "author": "Thibault Souris",

package/templates/mission/architecture.md

@@ -37,6 +37,14 @@
 | Tool registry + middleware chain | [single transversal surface, thin channel] | [—] |
 | One core language, thin model SDK | [no heavy chain framework] | [mature library or proven performance need → sidecar] |
 
+## Rule conformance
+
+> Account for every CRITICAL/HIGH craft rule mapped to the architect phase (`runward/rules/`, frontmatter `phases: [architect]`). `applied` needs a pointer; `deviated` needs an ADR; `n/a` needs a reason. `runward check --strict` verifies this table is complete — it checks a traced decision, not the quality of your architecture.
+
+| Rule | Status | Evidence |
+|---|---|---|
+| [rule-slug] | applied \| deviated \| n/a | [pointer, ADR-id, or reason] |
+
 ## 5. What stays open
 
 [Explicitly undecided: language(s), framework, model provider, hosting. Each is an adapter decision, taken later behind the contracts above, justified by a local technical reason.]

package/templates/mission/floor.md

@@ -17,6 +17,14 @@
 | Deterministic guardrails | [shipped] | [classification, validation, mutation access control] |
 | Baseline observability + cost ceiling | [shipped] | [request ID propagated; per-run ceiling: [value]] |
 
+## Rule conformance
+
+> Account for every CRITICAL/HIGH craft rule mapped to the floor phase (`runward/rules/`, frontmatter `phases: [floor]`). Status: `applied` needs an evidence pointer (a `file:line` or a test); `deviated` needs an ADR reference; `n/a` needs a one-line reason. `runward check --strict` verifies this table is complete and well-formed — it does not judge your implementation; you do, at the gate.
+
+| Rule | Status | Evidence |
+|---|---|---|
+| [rule-slug] | applied \| deviated \| n/a | [file:line, a test, ADR-id, or a reason] |
+
 ## 2. Proof against the success criterion
 
 [The measurement, on real traffic or a representative sample — never on cases picked to impress.]

package/templates/mission/threat-model.md

@@ -48,6 +48,14 @@
 
 **Reminder**: the approval summary is itself an attack surface. It must be deterministic and faithful to the real arguments, or an injected action slips through in the batch. Group low-urgency requests into a prioritized queue with summaries, so approvers are not trained to rubber-stamp.
 
+## Rule conformance
+
+> Account for every CRITICAL/HIGH craft rule mapped to the govern phase (`runward/rules/`, frontmatter `phases: [govern]`). `applied` needs a pointer; `deviated` needs an ADR; `n/a` needs a reason. `runward check --strict` verifies this table is complete — it checks a traced decision, not the quality of your governance.
+
+| Rule | Status | Evidence |
+|---|---|---|
+| [rule-slug] | applied \| deviated \| n/a | [pointer, ADR-id, or reason] |
+
 ## References
 
 - [Related hardening ADR, observability schema, evaluation rubric.]

package/templates/rules/async-job-guardrails.md

@@ -1,6 +1,7 @@
 ---
 title: Background Job Guardrails (Retry, Idempotency, Bounded Concurrency, Job Observability)
 impact: HIGH
+phases: [govern]
 impactDescription: The four non-negotiables of any background job — bounded retry per step, idempotency under concurrency, capped and partitioned concurrency, and queue lag plus failure rate as first-class metrics
 tags: [async, jobs, idempotency, concurrency, retry, observability]
 ---

package/templates/rules/config-secrets-boundary.md

@@ -1,6 +1,7 @@
 ---
 title: Secrets at the Network Boundary, Never in the Model
 impact: CRITICAL
+phases: [floor, govern]
 impactDescription: Makes secret disclosure structurally impossible by keeping the real key out of the model and the domain
 tags: [security, secrets, configuration, boundary]
 ---

package/templates/rules/contracts-governance.md

@@ -1,6 +1,7 @@
 ---
 title: Contract Governance (Versioned, Additive, Expand-then-Contract)
 impact: CRITICAL
+phases: [architect]
 impactDescription: Lets the system evolve without breaking consumers, by governing the contract at the boundary rather than the implementation behind it
 tags: [architecture, contracts, ports, versioning, compatibility]
 ---

package/templates/rules/eval-loop.md

@@ -1,6 +1,7 @@
 ---
 title: Evaluation Loop (Test + Evaluate, Hold-out, Anchored Judge)
 impact: CRITICAL
+phases: [govern]
 impactDescription: Gives a non-deterministic system a trustworthy way to detect behavioural regressions without letting it optimise its own grader
 tags: [evaluation, testing, llm, quality, governance]
 ---

package/templates/rules/frontier-deterministic-boundary.md

@@ -1,6 +1,7 @@
 ---
 title: Deterministic Boundary of the Model
 impact: CRITICAL
+phases: [floor]
 impactDescription: Keeps every fact, figure and decision that can be checked out of the model, so the system is verifiable and cannot hallucinate load-bearing values
 tags: [architecture, llm, frontier, grounding, safety, determinism]
 ---

package/templates/rules/hexa-adapter-pattern.md

@@ -1,6 +1,7 @@
 ---
 title: New Feature = New Adapter
 impact: HIGH
+phases: [architect, floor]
 impactDescription: Keeps core business logic clean and external integrations isolated
 tags: [architecture, hexagonal, adapters, integration]
 ---

package/templates/rules/hexa-architecture.md

@@ -1,6 +1,7 @@
 ---
 title: Hexagonal Architecture Structure
 impact: HIGH
+phases: [architect, floor]
 impactDescription: Enables testability, maintainability, and clean dependency management
 tags: [architecture, hexagonal, structure, testing]
 ---

package/templates/rules/hexa-move-deterministic-out.md

@@ -1,6 +1,7 @@
 ---
 title: Move the Deterministic out of the Model
 impact: CRITICAL
+phases: [floor]
 impactDescription: Reduces LLM costs and latency by moving deterministic logic out of LLM calls
 tags: [architecture, llm, cost-optimization, performance]
 ---

package/templates/rules/hexa-typescript-native.md

@@ -1,6 +1,7 @@
 ---
 title: A Thin Model Abstraction You Own (Not a Heavy Chain Framework)
 impact: HIGH
+phases: [architect]
 impactDescription: Reduces token overhead, improves debuggability, removes volatile dependencies by keeping a light abstraction you control instead of a heavy framework
 tags: [architecture, typescript, llm, frameworks]
 ---

package/templates/rules/process-adr-and-journal.md

@@ -1,6 +1,7 @@
 ---
 title: ADR Discipline and Working Journal
 impact: HIGH
+phases: [architect]
 impactDescription: Makes structural decisions traceable and reversible-by-record, so the system can be picked up by anyone without re-litigating settled choices
 tags: [process, adr, journal, traceability, governance]
 ---

package/templates/rules/provider-llm-auto-detection.md

@@ -1,6 +1,7 @@
 ---
 title: Model Provider as an Adapter (Detected, Never Hardcoded)
 impact: CRITICAL
+phases: [floor]
 impactDescription: Keeps the model behind a port so the provider can change by configuration without touching the core
 tags: [provider, llm, embeddings, ports, configuration, portability]
 ---

package/templates/rules/provider-no-crash-missing-env.md

@@ -1,6 +1,7 @@
 ---
 title: Graceful Degradation of Optional Services
 impact: HIGH
+phases: [floor]
 impactDescription: Lets the app start and run wherever it is deployed, enabling features by available config rather than crashing on a missing variable
 tags: [provider, configuration, resilience, deployment]
 ---

package/templates/rules/resilience-fail-open.md

@@ -1,6 +1,7 @@
 ---
 title: Fail-Open for the Non-Critical, Fail-Closed for the Sensitive
 impact: CRITICAL
+phases: [govern]
 impactDescription: Degrades gracefully where safe and denies safely where it matters, instead of applying one failure policy everywhere
 tags: [resilience, error-handling, availability, safety]
 ---

package/templates/rules/resilience-multi-provider-fallback.md

@@ -1,6 +1,7 @@
 ---
 title: Multi-Provider Fallback
 impact: HIGH
+phases: [govern]
 impactDescription: Ensures LLM availability by falling back to alternative providers
 tags: [resilience, llm, providers, availability]
 ---

package/templates/rules/resilience-retry-backoff.md

@@ -1,6 +1,7 @@
 ---
 title: LLM Retry with Exponential Backoff
 impact: HIGH
+phases: [govern]
 impactDescription: Handles transient LLM failures gracefully without overwhelming the API
 tags: [resilience, llm, retry, error-handling]
 ---

package/templates/rules/security-prompt-injection.md

@@ -1,6 +1,7 @@
 ---
 title: Untrusted Input, Prompt Injection and the Lethal Trifecta
 impact: CRITICAL
+phases: [floor, govern]
 impactDescription: Treats prompt injection as a first-rank, structural threat constrained by architecture rather than detected by heuristics
 tags: [security, llm, injection, trifecta, untrusted-input]
 ---

package/templates/rules/state-event-sourcing.md

@@ -1,6 +1,7 @@
 ---
 title: State as an Immutable Journal (Event Sourcing, Replay, Provenance)
 impact: HIGH
+phases: [floor]
 impactDescription: Makes the agent a stateless reducer over an external, replayable journal, so truth, audit and recovery are structural rather than bolted on
 tags: [state, event-sourcing, replay, provenance, memory]
 ---

package/templates/rules/tools-scope-atomicity.md

@@ -1,6 +1,7 @@
 ---
 title: Tool Scope and Atomicity
 impact: HIGH
+phases: [floor]
 impactDescription: Reduces token usage and improves LLM tool selection accuracy
 tags: [tools, llm, architecture, cost-optimization]
 ---

package/templates/targets/AGENTS.md

@@ -12,7 +12,7 @@ This project is delivered with the Runward method: floor first, evolution on evi
 
 ## How to work
 
-- Apply the craft rules in `runward/rules/` while building: they cover memory scoring, tiered retrieval, event sourcing, request-id propagation, resilience, cost routing, secrets and prompt-injection defenses. When a rule and a habit conflict, the rule wins; deviating from a rule requires an ADR.
+- Apply the craft rules in `runward/rules/` while building — and confront them at the point of action, not from memory. Each rule declares where it applies (`phases:`); a build phase surfaces its CRITICAL/HIGH rules to open and account for in the deliverable's `Rule conformance` manifest: `applied` with a `file:line` or test, `deviated` with an ADR, `n/a` with a reason. When a rule and a habit conflict, the rule wins; deviating requires an ADR. `runward check --strict` verifies the manifest is complete — it checks that a decision was traced, never the quality of the code; you judge that at the gate.
 - Consult `runward/decision-matrix.md` before adding any capability: 22 arbitrations, each with a sober default and an explicit trigger. No trigger, no change.
 - Before any structural decision, run `runward/workflows/decision-loop.md`: verify in the real code, check the sourced state of the art, challenge the source, take a durable position, lock it in an ADR — only then edit.
 - One ADR per structural decision, in `runward/adr/`, with a dated re-evaluation trigger. Use the template `runward/adr/ADR-0000-template.md`.

package/templates/workflows/architect.md

@@ -30,6 +30,8 @@ Use this workflow once framing is decided and structure must follow: "how do we
 
 **Lock structuring choices in ADRs.** Starting topology, core language, legacy integration strategy, bounded-context boundaries: each goes through `decision-loop` — reality-check against reference implementations, sourced state of the art, challenge, durable position, written lock. A decision that is not locked does not enter the architecture note.
 
+**Confront the architect craft rules at the point of deciding.** Open the CRITICAL/HIGH rules mapped to the architect phase (`runward/rules/`, `phases: [architect]`): contract governance, the hexagonal architecture and adapter pattern, the single core language, the ADR-and-journal discipline. Do not work from their names — read them. Account for each in the `Rule conformance` manifest of the architecture note: `applied` with a pointer, `deviated` with an ADR, or `n/a` with a reason. `runward check --strict` verifies that manifest.
+
 **Write the architecture note.** Short, readable, decided: the ports, the default topology and its triggers, what stays open (language, provider), and the target named without being built. A few pages, not a detailed design dossier.
 
 ## Definition of Done
@@ -37,6 +39,7 @@ Use this workflow once framing is decided and structure must follow: "how do we
 - Architecture note produced, boundaries first, stack open.
 - Every port named with contract and initial version; integration protocol stated.
 - One ADR per structuring choice, locked before the note mentions it.
+- Every architect CRITICAL/HIGH rule accounted for in the conformance manifest (`runward check --strict`).
 - Note reviewed via `review` before circulation.
 - Deliverable form matched: the presented architecture note carries an expected delivery form (a readable PDF or HTML); ADRs and contract specs stay as repository markdown.
 

package/templates/workflows/floor.md

@@ -21,6 +21,8 @@ Use this workflow once the architecture is fixed and building must start: "what
 
 **Start from the reference floor, not a blank page.** The starting point is the reference floor (`floor-ts/` in the Runward repository): a clonable hexagonal scaffold that already carries the pure domain, the ports, the adapters, and the middleware chain, with a principle-to-code table mapping each principle to where it lives in the code. Clone it, implement the project's concrete adapters behind the ports fixed in `architect`, and leave intact the structure that keeps the domain testable without the model. Do not reinvent the skeleton; populate it.
 
+**Confront the floor's craft rules at the point of building.** Before writing each piece, open the CRITICAL/HIGH rules mapped to the floor phase — `runward/rules/`, frontmatter `phases: [floor]`: the deterministic frontier guard, the model port and its keyless fallback, provider auto-detection, secrets boundary, prompt-injection defense, the hexagonal architecture and adapter pattern, the event-sourced journal, tool-scope atomicity. Do not work from their names — read them. Account for each in the `Rule conformance` manifest of the floor note: `applied` with a `file:line` or test, `deviated` with an ADR, or `n/a` with a reason. `runward check --strict` verifies that manifest is complete and well-formed (it checks that a decision was traced, never the quality of the code — you judge that at the gate).
+
 **Build exactly these six pieces, and nothing more.**
 
 1. **An entry point matched to actual use.** A minimal interface when a human operates the system (submit, review, approve, decide); an API or tool protocol when another system drives it. It is a primary adapter — plain, replaceable, never touching the domain, and never a demo showcase.
@@ -48,6 +50,7 @@ Lock any structuring decision met during the build through `decision-loop`. Writ
 - Value measured against the observable success criterion.
 - A complete trajectory replays from a single request ID.
 - Every deferral named with its trigger.
+- Every floor CRITICAL/HIGH rule accounted for in the conformance manifest (`runward check --strict` clean).
 - Floor note produced and reviewed.
 
 ## Anti-patterns

package/templates/workflows/govern.md

@@ -35,9 +35,12 @@ The chain carries transversal concerns only — no orchestration, no business lo
 
 **Test and evaluate — both.** Build the test pyramid: unit tests without network (pure domain, mocked model adapter); consumer-driven contract tests that catch drift between schema and real data; integration through the injection container with mock adapters; behavioral evaluations at the top. Then run the continuous evaluation loop: sample the trace stream off the hot path; score hybrid — deterministic checks wherever a guarantee exists, an anchored judge model (pinned version or replayed anchor set) only for the irreducibly behavioral, abstention first. The loop is valid only under a **hold-out the optimizer never sees**; self-tuning stays inside a pre-approved, audited envelope or goes through human validation — never autonomous self-rewriting. The hard floor — safety, security, authorization, audit — stays deterministic; never assemble it from soft judgments. Promote a new model via shadow deployment: same port, real traffic, silent; measure divergence with the same evaluation; roll out in stages with instant rollback.
 
+**Confront the govern craft rules.** Open the CRITICAL/HIGH rules mapped to the govern phase (`runward/rules/`, `phases: [govern]`): the evaluation loop, prompt-injection defense, the secrets boundary, fail-open/fail-closed resilience, provider fallback, retry-with-backoff, background-job guardrails. Account for each in the `Rule conformance` manifest of the threat model: `applied` with a pointer, `deviated` with an ADR, or `n/a` with a reason. `runward check --strict` verifies that manifest.
+
 ## Definition of Done
 
 - All transversal concerns pass through the single middleware chain; a trajectory replays from one request ID.
+- Every govern CRITICAL/HIGH rule accounted for in the conformance manifest (`runward check --strict`).
 - Cost ceilings enforced with stop-and-synthesize behavior.
 - Threat model written; two-of-three trifecta rule enforced while untrusted content is in the context window.
 - Test pyramid in place; evaluation loop running with anchored judge and hold-out.