vigiles 14.1.0 → 14.2.0

package/dist/cli.js

@@ -1535,7 +1535,7 @@ function computeRuleInventory(root, instructionFile) {
  * instruction files PLUS nested subdirectory-memory (`src/CLAUDE.md`,
  * `research/CLAUDE.md`, …), skipping fixture/demo/build/test dirs (`isFixturePath`)
  * so a repo's real memory is read without the test-fixture noise. `.claude/` rule
- * sources remain a future source. research/rule-compiler-multilang-design.md §0. */
+ * sources remain a future source. research/rule-enforcer-multilang-design.md §0. */
 function gatherInstructionFiles(root, instructionFile) {
     const raw = [];
     const collect = (rel) => {
@@ -1696,10 +1696,12 @@ function formatRuleMapSummary(routing) {
         counts.meta;
     if (confident === 0 && possible.length === 0 && skipped.length === 0)
         return "";
+    // Lane counts, rendered from the single-source LANE_META (glyph + label).
+    const lane = (c) => `${rule_routing_js_1.LANE_META[c].glyph} ${String(counts[c])} ${rule_routing_js_1.LANE_META[c].label}`;
     const lines = [
-        "Rule map — how your prose rules could be enforced (heuristic, precision-first):",
-        `  ✓ ${String(counts.reuse)} enforceable · ⛓ ${String(counts.hook)} hook · ⚙ ${String(counts.unrouted)} custom · ✎ ${String(counts.semantic)} judgment` +
-            (counts.meta > 0 ? ` · ☰ ${String(counts.meta)} agent-note` : ""),
+        "Rule map [experimental] — how your prose rules could be enforced (heuristic, precision-first; misses some rules):",
+        `  ${lane("reuse")} · ${lane("hook")} · ${lane("unrouted")} · ${lane("semantic")}` +
+            (counts.meta > 0 ? ` · ${lane("meta")}` : ""),
     ];
     if (possible.length > 0)
         lines.push(`  ? ${String(possible.length)} possible — rule-ish, but below the confidence bar (review these)`);

package/dist/core/rule-catalog.d.ts

@@ -8,7 +8,7 @@
  * / boundaries), of which ~140 are enabled — vs the old static map's ~23. That
  * makes an architecture norm enforceable too (`boundaries/dependencies` is in the
  * catalog), which a static map never captured. See
- * `research/rule-compiler-multilang-design.md` §0 (the spike this productizes).
+ * `research/rule-enforcer-multilang-design.md` §0 (the spike this productizes).
  *
  * SAFETY — this EXECUTES the linter. Loading ESLint resolves the repo's real
  * config (which can run plugin/config code), so `enumerateEslintCatalog` is an

package/dist/core/rule-catalog.js

@@ -9,7 +9,7 @@
  * / boundaries), of which ~140 are enabled — vs the old static map's ~23. That
  * makes an architecture norm enforceable too (`boundaries/dependencies` is in the
  * catalog), which a static map never captured. See
- * `research/rule-compiler-multilang-design.md` §0 (the spike this productizes).
+ * `research/rule-enforcer-multilang-design.md` §0 (the spike this productizes).
  *
  * SAFETY — this EXECUTES the linter. Loading ESLint resolves the repo's real
  * config (which can run plugin/config code), so `enumerateEslintCatalog` is an

package/dist/instruction-sources.d.ts

@@ -7,7 +7,7 @@
  * NOISE that would flood the preview. `isFixturePath` is the precision-first
  * discriminator (over-skip a legit `sample-service` before flooding with fixture
  * rules). Pure + unit-tested; the fs discovery/glue lives in cli.ts
- * (`gatherInstructionFiles`). See research/rule-compiler-multilang-design.md §0.
+ * (`gatherInstructionFiles`). See research/rule-enforcer-multilang-design.md §0.
  */
 /** One instruction file gathered from disk, with its canonical (symlink-resolved)
  * path so a mirror can be detected. */

package/dist/instruction-sources.js

@@ -8,7 +8,7 @@
  * NOISE that would flood the preview. `isFixturePath` is the precision-first
  * discriminator (over-skip a legit `sample-service` before flooding with fixture
  * rules). Pure + unit-tested; the fs discovery/glue lives in cli.ts
- * (`gatherInstructionFiles`). See research/rule-compiler-multilang-design.md §0.
+ * (`gatherInstructionFiles`). See research/rule-enforcer-multilang-design.md §0.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dedupeInstructionFiles = dedupeInstructionFiles;

package/dist/rule-inventory.js

@@ -42,7 +42,7 @@ exports.buildRuleInventory = buildRuleInventory;
 // the DYNAMIC available-rule catalog — enumerate the rules the repo's linter
 // ACTUALLY has (spike: 702 for this repo vs ~23 here) and match prose against
 // THAT, own-repo/consented since it executes the linter. Do NOT keep growing this
-// by hand. See research/rule-compiler-multilang-design.md §0.
+// by hand. See research/rule-enforcer-multilang-design.md §0.
 exports.INTENT_MAP = [
     {
         intent: "no console.log / use the logger",
@@ -235,12 +235,93 @@ exports.INTENT_MAP = [
         rule: "no-only-tests/no-only-tests",
         configFix: '"no-only-tests/no-only-tests": "error"',
     },
+    // --- Ruff (Python) — the modern default (allow-list, like ESLint). These are
+    // the NET-NEW intents Pylint does NOT already cover (imports-inside-functions,
+    // annotations, logger.exception, print, import-sorting). The SHARED Python
+    // intents (bare-except, broad-except, mutable-default, wildcard, global,
+    // too-many-*, line-length, unused, f-strings, docstrings) stay with the Pylint
+    // entries below — one intent, one linter, so keyword disjointness holds (the
+    // `rule-routing-dogfood` invariant test) and prose never double-routes. Whether
+    // shared Python NL prose should later PREFER Ruff over Pylint is an open
+    // ownership decision, deferred. ROUTE-ONLY like Pylint: config-state
+    // (buildRuleInventory) stays gated to eslint — Ruff's select/ignore config shape
+    // differs from the eslint rules-map, so the eslint-shaped check would MISLABEL;
+    // accurate Ruff enabled-state is the catalog/ConfigProbe follow-up
+    // (rule-enforcer-multilang-design.md §3). Every CODE was verified to exist
+    // against ruff 0.15.8 (`ruff rule <CODE>`); keywords are Python-diagnostic (no
+    // cross-language phrase that would mis-attribute the linter in a JS/TS doc).
+    {
+        intent: "no imports inside functions (Python)",
+        linter: "ruff",
+        keywords: [
+            "PLC0415",
+            "inline import",
+            "inline imports",
+            "imports inside functions",
+            "import inside a function",
+            "import inside functions",
+        ],
+        rule: "PLC0415",
+        configFix: 'add "PLC0415" (import-outside-top-level) to [tool.ruff.lint] select',
+    },
+    {
+        // E402 flags module-level code BEFORE the imports; the "no imports inside
+        // functions" reading is PLC0415 above. Code-only keyword ON PURPOSE: the
+        // phrase "imports at the top" is ambiguous between the two AND collides with
+        // ESLint `import/first` in a JS doc, so it is NOT a keyword here (a missing
+        // route is recoverable; a wrong "enforceable" claim is not).
+        intent: "no module code before imports (Python)",
+        linter: "ruff",
+        keywords: ["E402"],
+        rule: "E402",
+        configFix: 'add "E402" (module-import-not-at-top-of-file) to [tool.ruff.lint] select',
+    },
+    {
+        intent: "require argument type annotations (Python)",
+        linter: "ruff",
+        keywords: [
+            "ANN001",
+            "type hints required",
+            "type hints are required",
+            "require type hints",
+        ],
+        rule: "ANN001",
+        configFix: 'add "ANN001" (missing-type-function-argument) to [tool.ruff.lint] select',
+    },
+    {
+        intent: "require return type annotations (Python)",
+        linter: "ruff",
+        keywords: ["ANN201"],
+        rule: "ANN201",
+        configFix: 'add "ANN201" (missing-return-type-undocumented-public-function) to [tool.ruff.lint] select',
+    },
+    {
+        intent: "use logger.exception in handlers (Python)",
+        linter: "ruff",
+        keywords: ["TRY400", "logger.exception", "logging.exception"],
+        rule: "TRY400",
+        configFix: 'add "TRY400" (error-instead-of-exception) to [tool.ruff.lint] select',
+    },
+    {
+        intent: "no print statements — use logging (Python)",
+        linter: "ruff",
+        keywords: ["T201", "print statement", "print statements"],
+        rule: "T201",
+        configFix: 'add "T201" (print) to [tool.ruff.lint] select',
+    },
+    {
+        intent: "keep imports sorted (Python)",
+        linter: "ruff",
+        keywords: ["I001", "sorted imports", "isort"],
+        rule: "I001",
+        configFix: 'add "I001" (unsorted-imports) to [tool.ruff.lint] select',
+    },
     // --- Pylint (Python) — routing basics. These feed classify() (routing → reuse);
     // buildRuleInventory is gated to eslint (see below) because pylint is
     // ON-BY-DEFAULT (deny-list), so the eslint-shaped config-state check would
     // MISLABEL it (a symbol in `disable=` reads as "in-config", an absent one as
     // "enable it"). Accurate pylint enabled-state needs the inverted-polarity
-    // ConfigProbe (research/rule-compiler-multilang-design.md §3), deferred —
+    // ConfigProbe (research/rule-enforcer-multilang-design.md §3), deferred —
     // classify() needs NO enabled-state, so pylint prose still routes honestly.
     // Keywords are code-shaped symbols + Python-UNAMBIGUOUS compounds (singular AND
     // plural, since matchesWholeToken is boundary-exact); bare ambiguous words
@@ -351,6 +432,74 @@ exports.INTENT_MAP = [
         rule: "unused-import",
         configFix: "pylint enables unused-import (W0611) by default; keep it out of the disable list",
     },
+    // --- Clippy (Rust) — routing basics (backlog #3: the 0%→ win for Rust
+    // rulebooks; codex/ghostty routed 0% purely because clippy was unmapped, yet
+    // codex literally says "avoid patterns that require `panic!`, `unreachable!`,
+    // or `.unwrap()`" and "make `match` exhaustive … avoid wildcard arms"). Every
+    // lint is a real clippy restriction lint. Route-only, like ruff/pylint —
+    // config-state stays eslint-gated (L639) because clippy's lint levels live in
+    // Cargo.toml `[lints.clippy]` / crate attrs, a different shape (accurate
+    // enabled-state is the ConfigProbe follow-up, rule-enforcer-multilang-design
+    // §3). Keywords are Rust-UNAMBIGUOUS — macro `!` forms, `.method` call forms,
+    // `clippy::` symbols, and Rust-only compounds ("wildcard arm(s)", NOT bare
+    // "wildcard" which collides with pylint `wildcard-import`) — so a Python/JS
+    // doc never mis-attributes clippy (the cross-language-FP test guards this).
+    {
+        intent: "no .unwrap() (Rust)",
+        linter: "clippy",
+        keywords: ["clippy::unwrap_used", "unwrap_used", ".unwrap"],
+        rule: "clippy::unwrap_used",
+        configFix: 'set unwrap_used = "warn" in [lints.clippy] (Cargo.toml), or #![warn(clippy::unwrap_used)]',
+    },
+    {
+        intent: "no .expect() (Rust)",
+        linter: "clippy",
+        keywords: ["clippy::expect_used", "expect_used", ".expect"],
+        rule: "clippy::expect_used",
+        configFix: 'set expect_used = "warn" in [lints.clippy] (Cargo.toml), or #![warn(clippy::expect_used)]',
+    },
+    {
+        intent: "no panic! (Rust)",
+        linter: "clippy",
+        keywords: ["clippy::panic", "panic!"],
+        rule: "clippy::panic",
+        configFix: 'set panic = "warn" in [lints.clippy] (Cargo.toml), or #![warn(clippy::panic)]',
+    },
+    {
+        intent: "no unreachable! (Rust)",
+        linter: "clippy",
+        keywords: ["clippy::unreachable", "unreachable!"],
+        rule: "clippy::unreachable",
+        configFix: 'set unreachable = "warn" in [lints.clippy] (Cargo.toml), or #![warn(clippy::unreachable)]',
+    },
+    {
+        intent: "no todo! (Rust)",
+        linter: "clippy",
+        keywords: ["clippy::todo", "todo!"],
+        rule: "clippy::todo",
+        configFix: 'set todo = "warn" in [lints.clippy] (Cargo.toml), or #![warn(clippy::todo)]',
+    },
+    {
+        intent: "no dbg! (Rust)",
+        linter: "clippy",
+        keywords: ["clippy::dbg_macro", "dbg!"],
+        rule: "clippy::dbg_macro",
+        configFix: 'set dbg_macro = "warn" in [lints.clippy] (Cargo.toml), or #![warn(clippy::dbg_macro)]',
+    },
+    {
+        intent: "exhaustive match — no wildcard enum arm (Rust)",
+        linter: "clippy",
+        keywords: [
+            "clippy::wildcard_enum_match_arm",
+            "wildcard_enum_match_arm",
+            "wildcard match arm",
+            "wildcard match arms",
+            "wildcard arm",
+            "wildcard arms",
+        ],
+        rule: "clippy::wildcard_enum_match_arm",
+        configFix: 'set wildcard_enum_match_arm = "warn" in [lints.clippy] (Cargo.toml), or #![warn(clippy::wildcard_enum_match_arm)]',
+    },
 ];
 /** Escape a keyword for use inside a RegExp. */
 function escapeRe(s) {

package/dist/rule-routing.d.ts

@@ -41,6 +41,21 @@ import type { RuleCatalog } from "./core/rule-catalog.js";
 /** How a routed rule would be enforced (a MECHANISM ladder, not a 1-10 score). */
 export type RuleCategory = "reuse" | "hook" | "meta" | "semantic" | "unrouted";
 export type RuleMechanism = "config-line" | "hook" | "prose" | "synthesize";
+/**
+ * The user-facing presentation of each routing category — its glyph + lane
+ * label. The SINGLE SOURCE the terminal summary reads (and the HTML report
+ * mirrors), so the category-name → lane-label mapping lives in one place.
+ *
+ * NB the type name `unrouted` is a WIRE value (it appears in the versioned
+ * `AuditReport` JSON), which is why it isn't renamed to its lane label `custom`;
+ * this table is where the human-facing name is resolved. The category meanings
+ * are documented in the file header; the mapping is tabled in
+ * `research/rule-enforcer-design.md` §4.
+ */
+export declare const LANE_META: Record<RuleCategory, {
+    readonly glyph: string;
+    readonly label: string;
+}>;
 /** One segmented, deterministically-routed rule with provenance. */
 export interface RoutedRule {
     /** Normalized atomic rule text (from the segmenter). */
@@ -75,7 +90,7 @@ export interface RuleRouting {
     /** The POSSIBLE tier — rule-ish bullets (medium confidence) that did NOT clear
      * the bar, still classified so a human can review + promote them. Detection is
      * precision-first, so this is where a declarative rule ("Every X must Y") that
-     * the confident tier misses shows up. See `research/rule-compiler-design.md` §2. */
+     * the confident tier misses shows up. See `research/rule-enforcer-design.md` §2. */
     readonly possible: readonly RoutedRule[];
     /** Bullets the segmenter decided were NOT rules, each with a reason — so the
      * report is honest about what it set aside (§3). */