vigiles 2.0.0 → 2.1.1

package/dist/generate-types.js

@@ -73,7 +73,7 @@ function discoverEslintRules(basePath) {
         const rules = JSON.parse(output.trim() || "[]");
         if (rules.length === 0)
             return null;
-        return { linter: "eslint", rules, via: "flat config" };
+        return { linter: "eslint", rules, via: "flat config (v9+/v10)" };
     }
     catch {
         return null;
@@ -199,6 +199,41 @@ function discoverRubocopRules(basePath) {
         return null;
     }
 }
+function discoverCedarPolicies(basePath) {
+    const ID_RE = /@id\("([^"]+)"\)/g;
+    const STATEMENT_RE = /\b(?:permit|forbid)\s*\(/;
+    const policies = new Set();
+    for (const dir of [".cedar", "cedar"]) {
+        const fullDir = (0, node_path_1.resolve)(basePath, dir);
+        if (!(0, node_fs_1.existsSync)(fullDir))
+            continue;
+        const files = (0, glob_1.globSync)("**/*.cedar", { cwd: fullDir, nodir: true });
+        for (const file of files) {
+            let content;
+            try {
+                content = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(fullDir, file), "utf-8");
+            }
+            catch {
+                continue;
+            }
+            const annotated = [...content.matchAll(ID_RE)].map((m) => m[1]);
+            if (annotated.length > 0) {
+                for (const id of annotated)
+                    policies.add(id);
+            }
+            else if (STATEMENT_RE.test(content)) {
+                policies.add(file.replace(/\.cedar$/, "").replace(/\\/g, "/"));
+            }
+        }
+    }
+    if (policies.size === 0)
+        return null;
+    return {
+        linter: "cedar",
+        rules: [...policies].sort(),
+        via: ".cedar files",
+    };
+}
 function discoverClippyRules(basePath) {
     try {
         const cargoPath = (0, node_path_1.resolve)(basePath, "Cargo.toml");
@@ -300,6 +335,9 @@ function generateTypes(options = {}) {
     const clippy = discoverClippyRules(basePath);
     if (clippy)
         linters.push(clippy);
+    const cedar = discoverCedarPolicies(basePath);
+    if (cedar)
+        linters.push(cedar);
     const scripts = discoverNpmScripts(basePath);
     const files = discoverProjectFiles(basePath, fileGlobs);
     // Generate .d.ts

package/dist/hash.d.ts

@@ -0,0 +1,8 @@
+declare const __brand: unique symbol;
+export type SHA256Hash = string & {
+    readonly [__brand]: "SHA256Hash";
+};
+export declare function sha256short(data: string | Buffer): SHA256Hash;
+export declare function assertNever(x: never): never;
+export {};
+//# sourceMappingURL=hash.d.ts.map

package/dist/hash.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sha256short = sha256short;
+exports.assertNever = assertNever;
+const node_crypto_1 = require("node:crypto");
+const HASH_LENGTH = 16;
+function sha256short(data) {
+    return (0, node_crypto_1.createHash)("sha256")
+        .update(data)
+        .digest("hex")
+        .slice(0, HASH_LENGTH);
+}
+function assertNever(x) {
+    throw new Error(`Unexpected value: ${String(x)}`);
+}
+//# sourceMappingURL=hash.js.map

package/dist/integrity.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Integrity check: verify a compiled markdown file hasn't been hand-edited.
+ *
+ * Every compiled file has a SHA-256 hash in its first line:
+ *   <!-- vigiles:sha256:<hash> compiled from CLAUDE.md.spec.ts -->
+ *
+ * If the body content's hash no longer matches what's recorded, someone
+ * edited the compiled output directly. The check is one-pass and ~free.
+ *
+ * This is the entire freshness story now: no input fingerprinting, no
+ * recompile diffing. Those responsibilities belong elsewhere:
+ *
+ * - Hand-edit detection → this module
+ * - "Did the spec change?" → guard() rules emitting compile hooks
+ * - "Are referenced linter rules / files / scripts still valid?"
+ *   → enforce() / file() / cmd() catch this at compile time
+ * - "Are committed compiled files actually fresh?"
+ *   → CI runs `vigiles compile` then `git diff --exit-code`
+ */
+export interface IntegrityResult {
+    intact: boolean;
+    reason?: string;
+}
+/**
+ * Check whether the compiled markdown's SHA-256 hash matches its body.
+ * Files without a hash header are treated as hand-written (intact).
+ */
+export declare function checkIntegrity(content: string): IntegrityResult;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/integrity.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * Integrity check: verify a compiled markdown file hasn't been hand-edited.
+ *
+ * Every compiled file has a SHA-256 hash in its first line:
+ *   <!-- vigiles:sha256:<hash> compiled from CLAUDE.md.spec.ts -->
+ *
+ * If the body content's hash no longer matches what's recorded, someone
+ * edited the compiled output directly. The check is one-pass and ~free.
+ *
+ * This is the entire freshness story now: no input fingerprinting, no
+ * recompile diffing. Those responsibilities belong elsewhere:
+ *
+ * - Hand-edit detection → this module
+ * - "Did the spec change?" → guard() rules emitting compile hooks
+ * - "Are referenced linter rules / files / scripts still valid?"
+ *   → enforce() / file() / cmd() catch this at compile time
+ * - "Are committed compiled files actually fresh?"
+ *   → CI runs `vigiles compile` then `git diff --exit-code`
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkIntegrity = checkIntegrity;
+const hash_js_1 = require("./hash.js");
+const HASH_LINE_RE = /^<!-- vigiles:sha256:([a-f0-9]+) compiled from (.+) -->\r?\n\r?\n?/;
+/**
+ * Check whether the compiled markdown's SHA-256 hash matches its body.
+ * Files without a hash header are treated as hand-written (intact).
+ */
+function checkIntegrity(content) {
+    const match = content.match(HASH_LINE_RE);
+    if (!match) {
+        return { intact: true, reason: "No hash header (hand-written file)" };
+    }
+    const expectedHash = match[1];
+    const body = content.replace(HASH_LINE_RE, "");
+    if ((0, hash_js_1.sha256short)(body) !== expectedHash) {
+        return {
+            intact: false,
+            reason: "Compiled file was modified directly — edit the .spec.ts source and recompile",
+        };
+    }
+    return { intact: true };
+}
+//# sourceMappingURL=integrity.js.map

package/dist/linters.d.ts

@@ -3,10 +3,11 @@
  *
  * Verifies that linter rule references (e.g., "eslint/no-console") point to
  * real rules that exist and are enabled in project config. Supports:
- *   ESLint, Stylelint (Node API), Ruff, Clippy, Pylint, RuboCop (CLI).
+ *   ESLint, Stylelint (Node API), Ruff, Clippy, Pylint, RuboCop (CLI),
+ *   Cedar (filesystem policies for AWS Bedrock AgentCore / Vectimus).
  *
- * This is the core moat — no other tool resolves rules against 6 linter APIs
- * and checks config-enabled status.
+ * This is the core moat — no other tool resolves rules across 7 catalog APIs
+ * (6 linters + Cedar policy language) and checks config-enabled status.
  */
 export type ConfigEnabledStatus = "enabled" | "disabled" | "unknown";
 export interface LinterCheckResult {
@@ -23,6 +24,7 @@ export interface DetectedLinter {
 }
 /** @internal */ export declare function extractLinterName(enforcedBy: string): string;
 /** @internal */ export declare function extractRuleName(enforcedBy: string): string | null;
+/** @internal */ export declare function clearCedarCache(): void;
 /**
  * Check a single linter rule reference (e.g., "eslint/no-console").
  *

package/dist/linters.js

@@ -4,14 +4,16 @@
  *
  * Verifies that linter rule references (e.g., "eslint/no-console") point to
  * real rules that exist and are enabled in project config. Supports:
- *   ESLint, Stylelint (Node API), Ruff, Clippy, Pylint, RuboCop (CLI).
+ *   ESLint, Stylelint (Node API), Ruff, Clippy, Pylint, RuboCop (CLI),
+ *   Cedar (filesystem policies for AWS Bedrock AgentCore / Vectimus).
  *
- * This is the core moat — no other tool resolves rules against 6 linter APIs
- * and checks config-enabled status.
+ * This is the core moat — no other tool resolves rules across 7 catalog APIs
+ * (6 linters + Cedar policy language) and checks config-enabled status.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractLinterName = extractLinterName;
 exports.extractRuleName = extractRuleName;
+exports.clearCedarCache = clearCedarCache;
 exports.checkLinterRule = checkLinterRule;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
@@ -524,6 +526,114 @@ function getCliRuleSet(linterName, basePath) {
         return makeResult(ctx, false, "unknown", `Rule "${ctx.ruleName}" not found in ${ctx.linterName}.${hint}`);
     }
 }
+// ---------------------------------------------------------------------------
+// Vigiles-internal assertion catalog
+//
+// The `vigiles/<id>` namespace lets specs declare mechanical checks that
+// vigiles itself runs (orphan docs, integrity, etc.) without delegating to
+// an external linter. Existence is verified at compile time against this
+// fixed catalog; the actual check runs at audit time.
+// ---------------------------------------------------------------------------
+const VIGILES_INTERNAL_RULES = new Set(["orphan-docs"]);
+/** @internal */ function tryVigilesInternal(ctx) {
+    if (ctx.linterName !== "vigiles")
+        return null;
+    if (!VIGILES_INTERNAL_RULES.has(ctx.ruleName)) {
+        const suggestions = closestRuleNames(ctx.ruleName, VIGILES_INTERNAL_RULES);
+        const hint = suggestions.length > 0
+            ? ` Did you mean: ${suggestions.map((s) => `"vigiles/${s}"`).join(", ")}?`
+            : "";
+        return makeResult(ctx, false, "unknown", `Vigiles-internal rule "${ctx.ruleName}" not in known catalog (${[...VIGILES_INTERNAL_RULES].join(", ")}).${hint}`);
+    }
+    return makeResult(ctx, true, "enabled");
+}
+// ---------------------------------------------------------------------------
+// Cedar policy resolution (filesystem-based — no Node API, no CLI required)
+//
+// Cedar policies live in .cedar files. A policy is identified by its
+// `@id("name")` annotation when present; otherwise by filename. Presence
+// of a policy in the project counts as "enabled" — Cedar has no separate
+// config layer the way ESLint does, the policy bundle IS the config.
+//
+// Default search dirs: .cedar/ and cedar/ (project root). Override via
+// `options.linters.cedar.rulesDir`.
+// ---------------------------------------------------------------------------
+const CEDAR_DEFAULT_DIRS = [".cedar", "cedar"];
+const CEDAR_ID_RE = /@id\("([^"]+)"\)/g;
+const CEDAR_STATEMENT_RE = /\b(?:permit|forbid)\s*\(/;
+const CEDAR_POLICY_CACHE = new Map();
+function cedarCacheKey(basePath, customDirs) {
+    const dirs = customDirs
+        ? Array.isArray(customDirs)
+            ? customDirs.join("|")
+            : customDirs
+        : "";
+    return `${basePath}::${dirs}`;
+}
+function loadCedarPolicies(basePath, customDirs) {
+    const policies = new Set();
+    const dirs = customDirs
+        ? Array.isArray(customDirs)
+            ? customDirs
+            : [customDirs]
+        : CEDAR_DEFAULT_DIRS;
+    for (const dir of dirs) {
+        const fullDir = (0, node_path_1.resolve)(basePath, dir);
+        if (!(0, node_fs_1.existsSync)(fullDir))
+            continue;
+        const files = (0, glob_1.globSync)("**/*.cedar", { cwd: fullDir, nodir: true });
+        for (const file of files) {
+            let content;
+            try {
+                content = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(fullDir, file), "utf-8");
+            }
+            catch {
+                continue;
+            }
+            const annotated = [...content.matchAll(CEDAR_ID_RE)].map((m) => m[1]);
+            if (annotated.length > 0) {
+                for (const id of annotated)
+                    policies.add(id);
+            }
+            else if (CEDAR_STATEMENT_RE.test(content)) {
+                const name = file.replace(/\.cedar$/, "").replace(/\\/g, "/");
+                policies.add(name);
+            }
+        }
+    }
+    return policies;
+}
+function getCedarPolicies(basePath, customDirs) {
+    const key = cedarCacheKey(basePath, customDirs);
+    const cached = CEDAR_POLICY_CACHE.get(key);
+    if (cached)
+        return cached;
+    const policies = loadCedarPolicies(basePath, customDirs);
+    CEDAR_POLICY_CACHE.set(key, policies);
+    return policies;
+}
+/** @internal */ function clearCedarCache() {
+    CEDAR_POLICY_CACHE.clear();
+}
+/** @internal */ function tryCedarPolicy(ctx) {
+    if (ctx.linterName !== "cedar")
+        return null;
+    const customDirs = ctx.linters?.cedar?.rulesDir;
+    const policies = getCedarPolicies(ctx.basePath, customDirs);
+    if (policies.size === 0) {
+        return makeResult(ctx, false, "unknown", customDirs
+            ? `No Cedar policies found in configured rulesDir.`
+            : `No Cedar policies found. Add .cedar files under .cedar/ or cedar/, or set linters.cedar.rulesDir.`);
+    }
+    if (!policies.has(ctx.ruleName)) {
+        const suggestions = closestRuleNames(ctx.ruleName, policies);
+        const hint = suggestions.length > 0
+            ? ` Did you mean: ${suggestions.map((s) => `"cedar/${s}"`).join(", ")}?`
+            : "";
+        return makeResult(ctx, false, "unknown", `Cedar policy "${ctx.ruleName}" not found.${hint}`);
+    }
+    return makeResult(ctx, true, "enabled");
+}
 /** @internal */ function tryCustomRulesDir(ctx) {
     const linterCfg = ctx.linters?.[ctx.linterName];
     if (!linterCfg?.rulesDir)
@@ -566,9 +676,11 @@ function checkLinterRule(enforcedBy, basePath, options) {
         catalogOnly: options?.catalogOnly,
         linters: options?.linters,
     };
-    return (tryNodeResolver(ctx) ??
+    return (tryVigilesInternal(ctx) ??
+        tryNodeResolver(ctx) ??
         tryScopedPlugin(ctx) ??
         tryCliCheck(ctx) ??
+        tryCedarPolicy(ctx) ??
         tryCustomRulesDir(ctx) ??
         makeResult(ctx, false, "unknown", `Unknown linter: "${linterName}"`));
 }

package/dist/orphans.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Orphan-docs detection: the inverse of stale-reference validation.
+ *
+ * Stale-ref detection catches specs that point at files which no longer
+ * exist. Orphan detection catches files which exist but no spec or README
+ * points at — docs that quietly rot in `docs/` and `research/` because
+ * nothing tells the agent they're still load-bearing.
+ *
+ * The detector operates purely on the filesystem: it enumerates markdown
+ * files under configured doc roots and scans every `.md` in the repo for
+ * references (markdown links and backtick paths). Works against source
+ * README plus compiled CLAUDE.md — no spec loading required.
+ */
+export interface OrphanReport {
+    /** Include globs that were scanned. */
+    readonly include: readonly string[];
+    /** Total docs discovered under those globs. */
+    readonly totalDocs: number;
+    /** Docs referenced from at least one other `.md` file. */
+    readonly referencedDocs: readonly string[];
+    /** Docs that exist but no other `.md` references them. */
+    readonly orphans: readonly string[];
+}
+export interface FindOrphansOptions {
+    /** Repository root. Defaults to `process.cwd()`. */
+    readonly basePath?: string;
+    /**
+     * Glob patterns of `.md` files to scan. Defaults to
+     * `["docs/**\/*.md", "research/**\/*.md"]` — vigiles-repo convention.
+     * Set to `[]` to disable scanning entirely. Set to your project's
+     * doc directory globs (e.g. `["wiki/**\/*.md"]`) to override.
+     */
+    readonly include?: readonly string[];
+    /** Glob patterns to exclude within the include scope. */
+    readonly exclude?: readonly string[];
+}
+/**
+ * Find docs under `include` globs that no other markdown file references.
+ *
+ * A doc is considered referenced when some OTHER `.md` file in the repo
+ * links to it via `[text](path.md)` or mentions it in a backtick span like
+ * `` `docs/foo.md` ``. Self-references don't count — an orphan that only
+ * links to itself is still an orphan.
+ *
+ * `include` and `exclude` are tsconfig-style glob arrays. Default include
+ * is the vigiles-repo convention `["docs/**\/*.md", "research/**\/*.md"]`;
+ * override per-project via `.vigilesrc.json` → `orphans.include`.
+ */
+export declare function findOrphanDocs(options?: FindOrphansOptions): OrphanReport;
+/** Format an orphan report as human-readable text. */
+export declare function formatOrphanReport(report: OrphanReport): string;
+//# sourceMappingURL=orphans.d.ts.map

package/dist/orphans.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Orphan-docs detection: the inverse of stale-reference validation.
+ *
+ * Stale-ref detection catches specs that point at files which no longer
+ * exist. Orphan detection catches files which exist but no spec or README
+ * points at — docs that quietly rot in `docs/` and `research/` because
+ * nothing tells the agent they're still load-bearing.
+ *
+ * The detector operates purely on the filesystem: it enumerates markdown
+ * files under configured doc roots and scans every `.md` in the repo for
+ * references (markdown links and backtick paths). Works against source
+ * README plus compiled CLAUDE.md — no spec loading required.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findOrphanDocs = findOrphanDocs;
+exports.formatOrphanReport = formatOrphanReport;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const glob_1 = require("glob");
+// ---------------------------------------------------------------------------
+// Internals
+// ---------------------------------------------------------------------------
+const DEFAULT_INCLUDE = ["docs/**/*.md", "research/**/*.md"];
+const DEFAULT_IGNORE = [
+    "node_modules/**",
+    "dist/**",
+    ".vigiles/**",
+    ".git/**",
+];
+// Match markdown links ](path.md) or ](path.md#anchor)
+const LINK_RE = /\]\(([^)\s]+\.md)(?:#[^)]*)?\)/g;
+// Match backtick code spans wrapping a path ending in .md
+const BACKTICK_RE = /`([^`\s]+\.md)`/g;
+function normalizePath(p) {
+    return p.replace(/^\.\//, "").replace(/\\/g, "/");
+}
+function extractRefs(content) {
+    const refs = [];
+    for (const m of content.matchAll(LINK_RE))
+        refs.push(normalizePath(m[1]));
+    for (const m of content.matchAll(BACKTICK_RE))
+        refs.push(normalizePath(m[1]));
+    return refs;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Find docs under `include` globs that no other markdown file references.
+ *
+ * A doc is considered referenced when some OTHER `.md` file in the repo
+ * links to it via `[text](path.md)` or mentions it in a backtick span like
+ * `` `docs/foo.md` ``. Self-references don't count — an orphan that only
+ * links to itself is still an orphan.
+ *
+ * `include` and `exclude` are tsconfig-style glob arrays. Default include
+ * is the vigiles-repo convention `["docs/**\/*.md", "research/**\/*.md"]`;
+ * override per-project via `.vigilesrc.json` → `orphans.include`.
+ */
+function findOrphanDocs(options = {}) {
+    const basePath = options.basePath ?? process.cwd();
+    const include = options.include ?? DEFAULT_INCLUDE;
+    const userExclude = options.exclude ?? [];
+    const ignore = [...DEFAULT_IGNORE, ...userExclude];
+    const allDocs = new Set();
+    for (const pattern of include) {
+        const found = (0, glob_1.globSync)(pattern, { cwd: basePath, ignore });
+        for (const p of found)
+            allDocs.add(normalizePath(p));
+    }
+    const allMarkdown = (0, glob_1.globSync)("**/*.md", {
+        cwd: basePath,
+        ignore: [...DEFAULT_IGNORE],
+    });
+    const referencedBy = new Map();
+    for (const mdPath of allMarkdown) {
+        const source = normalizePath(mdPath);
+        let content;
+        try {
+            content = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(basePath, mdPath), "utf-8");
+        }
+        catch {
+            continue;
+        }
+        for (const target of extractRefs(content)) {
+            if (target === source)
+                continue;
+            let sources = referencedBy.get(target);
+            if (!sources) {
+                sources = new Set();
+                referencedBy.set(target, sources);
+            }
+            sources.add(source);
+        }
+    }
+    const orphans = [];
+    const referencedDocs = [];
+    for (const doc of [...allDocs].sort()) {
+        if (referencedBy.has(doc))
+            referencedDocs.push(doc);
+        else
+            orphans.push(doc);
+    }
+    return {
+        include: [...include],
+        totalDocs: allDocs.size,
+        referencedDocs,
+        orphans,
+    };
+}
+/** Format an orphan report as human-readable text. */
+function formatOrphanReport(report) {
+    if (report.orphans.length === 0) {
+        return `✓ no orphan docs (${String(report.totalDocs)} scanned across ${report.include.join(", ") || "no include patterns"})`;
+    }
+    const lines = [
+        `✗ ${String(report.orphans.length)} orphan doc(s) — referenced by no other .md:`,
+    ];
+    for (const o of report.orphans)
+        lines.push(`    ${o}`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=orphans.js.map

package/dist/proofs.js

@@ -23,20 +23,22 @@ exports.ruleToBloomFilter = ruleToBloomFilter;
 exports.fixedPoint = fixedPoint;
 exports.propertyTest = propertyTest;
 exports.fitness = fitness;
-const node_crypto_1 = require("node:crypto");
 const node_zlib_1 = require("node:zlib");
+const hash_js_1 = require("./hash.js");
 // ---------------------------------------------------------------------------
 // 1. Monotonicity Lattice — partial order on rule strength
 // ---------------------------------------------------------------------------
 /**
  * Ordinal strength of each rule kind.
  *
- *   guidance (0) < enforce (1)
+ *   guidance (0) < guard (1) = enforce (1)
  *
- * The lattice ensures specs only get stricter over time.
+ * Guard and enforce are both mechanically enforced (different mechanisms,
+ * same strength). The lattice ensures specs only get stricter over time.
  */
 const STRENGTH = {
     guidance: 0,
+    guard: 1,
     enforce: 1,
 };
 /**
@@ -194,11 +196,14 @@ function ruleToText(rule) {
             return `${rule.linterRule} ${rule.why}`;
         case "guidance":
             return rule.text;
-        default: {
-            const unknown = rule._kind;
-            throw new Error(`Unknown rule kind "${String(unknown)}" — expected "enforce" or "guidance". ` +
-                `Runtime data is out of sync with the Rule type (legacy spec, JS caller, or cast bypass).`);
+        case "guard": {
+            const patterns = Array.isArray(rule.watch)
+                ? rule.watch.join(" ")
+                : rule.watch;
+            return `${patterns} ${rule.run} ${rule.description}`;
         }
+        default:
+            return (0, hash_js_1.assertNever)(rule);
     }
 }
 // ---------------------------------------------------------------------------
@@ -343,10 +348,10 @@ function fixedPoint(compileFn, initialContent, maxIterations = 10) {
     const hashes = [];
     let current = initialContent;
     for (let i = 0; i < maxIterations; i++) {
-        const hash = sha256short(current);
+        const hash = (0, hash_js_1.sha256short)(current);
         hashes.push(hash);
         const next = compileFn(current);
-        const nextHash = sha256short(next);
+        const nextHash = (0, hash_js_1.sha256short)(next);
         // Fixed point: output === input
         if (nextHash === hash) {
             return { converged: true, iterations: i + 1, hashes, cycleLength: 0 };
@@ -370,10 +375,7 @@ function fixedPoint(compileFn, initialContent, maxIterations = 10) {
         cycleLength: 0,
     };
 }
-/** Compute a short SHA-256 hash (16 hex chars). */
-function sha256short(data) {
-    return (0, node_crypto_1.createHash)("sha256").update(data).digest("hex").slice(0, 16);
-}
+// sha256short imported from ./hash.js
 /** Compute the hash of a HistoryNode (excluding the hash field itself). */
 function computeNodeHash(node) {
     const payload = JSON.stringify({
@@ -383,7 +385,7 @@ function computeNodeHash(node) {
         proofs: node.proofs,
         timestamp: node.timestamp,
     });
-    return sha256short(payload);
+    return (0, hash_js_1.sha256short)(payload);
 }
 class MerkleHistory {
     nodes = [];
@@ -604,8 +606,12 @@ function fitness(spec, options = {}) {
     if (total === 0) {
         return { score: 0, coverage: 0, redundancy: 0, budgetPressure: 0 };
     }
-    // Coverage: fraction with teeth (enforce vs guidance)
-    const enforced = rules.filter((r) => r._kind === "enforce").length;
+    // Coverage: fraction with teeth (mechanically enforced — STRENGTH ≥ 1).
+    // Counts both enforce() (linter-verified) and guard() (file-watch reactive).
+    // Without guard here, mutations that introduce/keep guard rules look like
+    // they reduce coverage and get rejected by runProofSuite even though
+    // enforcement strength didn't drop (see proofs.ts STRENGTH lattice).
+    const enforced = rules.filter((r) => STRENGTH[r._kind] >= 1).length;
     const coverage = enforced / total;
     // Redundancy: fraction of pairs that are near-duplicates
     const similarPairs = findSimilarRules(spec.rules, ncdThreshold);