vigiles 2.0.0 → 2.2.0

package/dist/linters.js

@@ -4,20 +4,50 @@
  *
  * Verifies that linter rule references (e.g., "eslint/no-console") point to
  * real rules that exist and are enabled in project config. Supports:
- *   ESLint, Stylelint (Node API), Ruff, Clippy, Pylint, RuboCop (CLI).
+ *   ESLint, Stylelint (Node API), Ruff, Clippy, Pylint, RuboCop (CLI),
+ *   Cedar (filesystem policies for AWS Bedrock AgentCore / Vectimus).
  *
- * This is the core moat — no other tool resolves rules against 6 linter APIs
- * and checks config-enabled status.
+ * This is the core moat — no other tool resolves rules across 7 catalog APIs
+ * (6 linters + Cedar policy language) and checks config-enabled status.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractLinterName = extractLinterName;
 exports.extractRuleName = extractRuleName;
+exports.clearCedarCache = clearCedarCache;
 exports.checkLinterRule = checkLinterRule;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const node_child_process_1 = require("node:child_process");
 const node_module_1 = require("node:module");
 const glob_1 = require("glob");
+/**
+ * Prepend version-manager shim directories (rbenv / asdf / rvm) to PATH so
+ * gem/pip-installed linters are found in non-login shells and CI, where the
+ * shims dir is often missing from PATH even though the tool is installed.
+ * Runs once; only adds directories that exist and aren't already present.
+ */
+function augmentToolPath() {
+    const home = process.env.HOME ?? "";
+    // rbenv/asdf shims don't resolve without a selected version, so add the
+    // concrete per-version `bin` dirs (where the gem executables actually live).
+    const candidates = [
+        ...(0, glob_1.globSync)("/opt/rbenv/versions/*/bin", { nodir: false }),
+        ...(home
+            ? (0, glob_1.globSync)(`${home}/.rbenv/versions/*/bin`, { nodir: false })
+            : []),
+        ...(home
+            ? (0, glob_1.globSync)(`${home}/.asdf/installs/*/*/bin`, { nodir: false })
+            : []),
+        `${home}/.rvm/bin`,
+        `${home}/.local/bin`,
+    ];
+    const current = (process.env.PATH ?? "").split(":");
+    const additions = candidates.filter((d) => d && (0, node_fs_1.existsSync)(d) && !current.includes(d));
+    if (additions.length > 0) {
+        process.env.PATH = [...current, ...additions].join(":");
+    }
+}
+augmentToolPath();
 // ---------------------------------------------------------------------------
 // Parsing enforcement references
 // ---------------------------------------------------------------------------
@@ -524,6 +554,114 @@ function getCliRuleSet(linterName, basePath) {
         return makeResult(ctx, false, "unknown", `Rule "${ctx.ruleName}" not found in ${ctx.linterName}.${hint}`);
     }
 }
+// ---------------------------------------------------------------------------
+// Vigiles-internal assertion catalog
+//
+// The `vigiles/<id>` namespace lets specs declare mechanical checks that
+// vigiles itself runs (orphan docs, integrity, etc.) without delegating to
+// an external linter. Existence is verified at compile time against this
+// fixed catalog; the actual check runs at audit time.
+// ---------------------------------------------------------------------------
+const VIGILES_INTERNAL_RULES = new Set(["orphan-docs"]);
+/** @internal */ function tryVigilesInternal(ctx) {
+    if (ctx.linterName !== "vigiles")
+        return null;
+    if (!VIGILES_INTERNAL_RULES.has(ctx.ruleName)) {
+        const suggestions = closestRuleNames(ctx.ruleName, VIGILES_INTERNAL_RULES);
+        const hint = suggestions.length > 0
+            ? ` Did you mean: ${suggestions.map((s) => `"vigiles/${s}"`).join(", ")}?`
+            : "";
+        return makeResult(ctx, false, "unknown", `Vigiles-internal rule "${ctx.ruleName}" not in known catalog (${[...VIGILES_INTERNAL_RULES].join(", ")}).${hint}`);
+    }
+    return makeResult(ctx, true, "enabled");
+}
+// ---------------------------------------------------------------------------
+// Cedar policy resolution (filesystem-based — no Node API, no CLI required)
+//
+// Cedar policies live in .cedar files. A policy is identified by its
+// `@id("name")` annotation when present; otherwise by filename. Presence
+// of a policy in the project counts as "enabled" — Cedar has no separate
+// config layer the way ESLint does, the policy bundle IS the config.
+//
+// Default search dirs: .cedar/ and cedar/ (project root). Override via
+// `options.linters.cedar.rulesDir`.
+// ---------------------------------------------------------------------------
+const CEDAR_DEFAULT_DIRS = [".cedar", "cedar"];
+const CEDAR_ID_RE = /@id\("([^"]+)"\)/g;
+const CEDAR_STATEMENT_RE = /\b(?:permit|forbid)\s*\(/;
+const CEDAR_POLICY_CACHE = new Map();
+function cedarCacheKey(basePath, customDirs) {
+    const dirs = customDirs
+        ? Array.isArray(customDirs)
+            ? customDirs.join("|")
+            : customDirs
+        : "";
+    return `${basePath}::${dirs}`;
+}
+function loadCedarPolicies(basePath, customDirs) {
+    const policies = new Set();
+    const dirs = customDirs
+        ? Array.isArray(customDirs)
+            ? customDirs
+            : [customDirs]
+        : CEDAR_DEFAULT_DIRS;
+    for (const dir of dirs) {
+        const fullDir = (0, node_path_1.resolve)(basePath, dir);
+        if (!(0, node_fs_1.existsSync)(fullDir))
+            continue;
+        const files = (0, glob_1.globSync)("**/*.cedar", { cwd: fullDir, nodir: true });
+        for (const file of files) {
+            let content;
+            try {
+                content = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(fullDir, file), "utf-8");
+            }
+            catch {
+                continue;
+            }
+            const annotated = [...content.matchAll(CEDAR_ID_RE)].map((m) => m[1]);
+            if (annotated.length > 0) {
+                for (const id of annotated)
+                    policies.add(id);
+            }
+            else if (CEDAR_STATEMENT_RE.test(content)) {
+                const name = file.replace(/\.cedar$/, "").replace(/\\/g, "/");
+                policies.add(name);
+            }
+        }
+    }
+    return policies;
+}
+function getCedarPolicies(basePath, customDirs) {
+    const key = cedarCacheKey(basePath, customDirs);
+    const cached = CEDAR_POLICY_CACHE.get(key);
+    if (cached)
+        return cached;
+    const policies = loadCedarPolicies(basePath, customDirs);
+    CEDAR_POLICY_CACHE.set(key, policies);
+    return policies;
+}
+/** @internal */ function clearCedarCache() {
+    CEDAR_POLICY_CACHE.clear();
+}
+/** @internal */ function tryCedarPolicy(ctx) {
+    if (ctx.linterName !== "cedar")
+        return null;
+    const customDirs = ctx.linters?.cedar?.rulesDir;
+    const policies = getCedarPolicies(ctx.basePath, customDirs);
+    if (policies.size === 0) {
+        return makeResult(ctx, false, "unknown", customDirs
+            ? `No Cedar policies found in configured rulesDir.`
+            : `No Cedar policies found. Add .cedar files under .cedar/ or cedar/, or set linters.cedar.rulesDir.`);
+    }
+    if (!policies.has(ctx.ruleName)) {
+        const suggestions = closestRuleNames(ctx.ruleName, policies);
+        const hint = suggestions.length > 0
+            ? ` Did you mean: ${suggestions.map((s) => `"cedar/${s}"`).join(", ")}?`
+            : "";
+        return makeResult(ctx, false, "unknown", `Cedar policy "${ctx.ruleName}" not found.${hint}`);
+    }
+    return makeResult(ctx, true, "enabled");
+}
 /** @internal */ function tryCustomRulesDir(ctx) {
     const linterCfg = ctx.linters?.[ctx.linterName];
     if (!linterCfg?.rulesDir)
@@ -566,9 +704,11 @@ function checkLinterRule(enforcedBy, basePath, options) {
         catalogOnly: options?.catalogOnly,
         linters: options?.linters,
     };
-    return (tryNodeResolver(ctx) ??
+    return (tryVigilesInternal(ctx) ??
+        tryNodeResolver(ctx) ??
         tryScopedPlugin(ctx) ??
         tryCliCheck(ctx) ??
+        tryCedarPolicy(ctx) ??
         tryCustomRulesDir(ctx) ??
         makeResult(ctx, false, "unknown", `Unknown linter: "${linterName}"`));
 }

package/dist/mock-model.d.ts

@@ -0,0 +1,31 @@
+/** One scripted assistant turn: a final text answer, or a tool call. */
+export interface ModelTurn {
+    /** Final text answer (stops the turn). */
+    readonly text?: string;
+    /** A tool to invoke, e.g. "Bash" | "Write" | "Edit". */
+    readonly tool?: string;
+    /** The tool input, e.g. `{ file_path, content }` or `{ command }`. */
+    readonly input?: Record<string, unknown>;
+}
+/** Build a scripted model from an ordered list of turns. */
+export declare function scriptModel(turns: readonly ModelTurn[]): ModelTurn[];
+export interface TurnInfo {
+    readonly n: number;
+    readonly stream: boolean;
+    readonly hasToolResult: boolean;
+}
+export interface MockHandle {
+    readonly url: string;
+    close(): void;
+    /** Number of model turns served so far. */
+    readonly count: number;
+}
+/**
+ * Start the scripted mock on a free port. Each `/v1/messages` POST consumes the
+ * next turn (the last turn repeats if the client asks for more). Resolves to a
+ * handle with the base `url` and a `close()`.
+ */
+export declare function startMock(script: readonly ModelTurn[], opts?: {
+    onTurn?: (info: TurnInfo) => void;
+}): Promise<MockHandle>;
+//# sourceMappingURL=mock-model.d.ts.map

package/dist/mock-model.js

@@ -0,0 +1,189 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scriptModel = scriptModel;
+exports.startMock = startMock;
+/**
+ * vigiles — a scripted, deterministic Anthropic Messages API mock.
+ *
+ * Point a Claude Code client at it with `ANTHROPIC_BASE_URL` (and any dummy
+ * `ANTHROPIC_API_KEY`) and it serves a fixed *script* of model turns in order —
+ * each `POST /v1/messages` returns the next. This is the seam that makes harness
+ * testing deterministic: the real `claude` CLI runs your real hooks/settings,
+ * but the model's turns are scripted, so the outcome is reproducible and free.
+ *
+ *   scriptModel([
+ *     { tool: "Write", input: { file_path: "SKILL.md", content: "..." } },
+ *     { text: "done" },
+ *   ])
+ *
+ * Implements the parts a real client needs: SSE streaming (flushed per event),
+ * `/v1/messages/count_tokens` (else Claude Code hangs), HEAD/health tolerance,
+ * and echoing the requested model.
+ */
+const node_http_1 = __importDefault(require("node:http"));
+/** Build a scripted model from an ordered list of turns. */
+function scriptModel(turns) {
+    return [...turns];
+}
+function writeEvent(res, event, data) {
+    res.write(`event: ${event}\n`);
+    res.write(`data: ${JSON.stringify(data)}\n\n`);
+}
+const rid = (p) => `${p}${Math.random().toString(36).slice(2, 10)}`;
+function streamTurn(res, turn, model) {
+    res.writeHead(200, {
+        "content-type": "text/event-stream",
+        "cache-control": "no-cache",
+        connection: "keep-alive",
+    });
+    writeEvent(res, "message_start", {
+        type: "message_start",
+        message: {
+            id: rid("msg_"),
+            type: "message",
+            role: "assistant",
+            model,
+            content: [],
+            stop_reason: null,
+            usage: { input_tokens: 10, output_tokens: 1 },
+        },
+    });
+    if (turn.tool) {
+        writeEvent(res, "content_block_start", {
+            type: "content_block_start",
+            index: 0,
+            content_block: {
+                type: "tool_use",
+                id: rid("toolu_"),
+                name: turn.tool,
+                input: {},
+            },
+        });
+        writeEvent(res, "content_block_delta", {
+            type: "content_block_delta",
+            index: 0,
+            delta: {
+                type: "input_json_delta",
+                partial_json: JSON.stringify(turn.input ?? {}),
+            },
+        });
+        writeEvent(res, "content_block_stop", {
+            type: "content_block_stop",
+            index: 0,
+        });
+        writeEvent(res, "message_delta", {
+            type: "message_delta",
+            delta: { stop_reason: "tool_use", stop_sequence: null },
+            usage: { output_tokens: 5 },
+        });
+    }
+    else {
+        writeEvent(res, "content_block_start", {
+            type: "content_block_start",
+            index: 0,
+            content_block: { type: "text", text: "" },
+        });
+        writeEvent(res, "content_block_delta", {
+            type: "content_block_delta",
+            index: 0,
+            delta: { type: "text_delta", text: turn.text ?? "" },
+        });
+        writeEvent(res, "content_block_stop", {
+            type: "content_block_stop",
+            index: 0,
+        });
+        writeEvent(res, "message_delta", {
+            type: "message_delta",
+            delta: { stop_reason: "end_turn", stop_sequence: null },
+            usage: { output_tokens: 5 },
+        });
+    }
+    writeEvent(res, "message_stop", { type: "message_stop" });
+    res.end();
+}
+function jsonTurn(res, turn, model) {
+    const content = turn.tool
+        ? [
+            {
+                type: "tool_use",
+                id: rid("toolu_"),
+                name: turn.tool,
+                input: turn.input ?? {},
+            },
+        ]
+        : [{ type: "text", text: turn.text ?? "" }];
+    res.writeHead(200, { "content-type": "application/json" });
+    res.end(JSON.stringify({
+        id: rid("msg_"),
+        type: "message",
+        role: "assistant",
+        model,
+        stop_reason: turn.tool ? "tool_use" : "end_turn",
+        stop_sequence: null,
+        content,
+        usage: { input_tokens: 10, output_tokens: 5 },
+    }));
+}
+/**
+ * Start the scripted mock on a free port. Each `/v1/messages` POST consumes the
+ * next turn (the last turn repeats if the client asks for more). Resolves to a
+ * handle with the base `url` and a `close()`.
+ */
+function startMock(script, opts = {}) {
+    let i = 0;
+    const server = node_http_1.default.createServer((req, res) => {
+        let body = "";
+        req.on("data", (c) => (body += c));
+        req.on("end", () => {
+            const url = req.url ?? "";
+            const isCount = url.includes("count_tokens");
+            const isMessages = url.includes("/v1/messages") && !isCount;
+            let reqBody = {};
+            try {
+                reqBody = JSON.parse(body);
+            }
+            catch {
+                /* HEAD / health checks have no JSON body */
+            }
+            if (req.method === "HEAD" || (!isMessages && !isCount)) {
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end("{}");
+                return;
+            }
+            if (isCount) {
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify({ input_tokens: 10 }));
+                return;
+            }
+            const last = JSON.stringify(reqBody.messages?.at(-1)?.content ?? "");
+            opts.onTurn?.({
+                n: i,
+                stream: reqBody.stream === true,
+                hasToolResult: last.includes('"tool_result"'),
+            });
+            const turn = script[Math.min(i, script.length - 1)] ?? { text: "" };
+            i++;
+            const model = reqBody.model ?? "claude-mock";
+            if (reqBody.stream === true)
+                streamTurn(res, turn, model);
+            else
+                jsonTurn(res, turn, model);
+        });
+    });
+    return new Promise((resolve) => {
+        server.listen(0, "127.0.0.1", () => {
+            const { port } = server.address();
+            resolve({
+                url: `http://127.0.0.1:${String(port)}`,
+                close: () => server.close(),
+                get count() {
+                    return i;
+                },
+            });
+        });
+    });
+}
+//# sourceMappingURL=mock-model.js.map

package/dist/orphans.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Orphan-docs detection: the inverse of stale-reference validation.
+ *
+ * Stale-ref detection catches specs that point at files which no longer
+ * exist. Orphan detection catches files which exist but no spec or README
+ * points at — docs that quietly rot in `docs/` and `research/` because
+ * nothing tells the agent they're still load-bearing.
+ *
+ * The detector operates purely on the filesystem: it enumerates markdown
+ * files under configured doc roots and scans every `.md` in the repo for
+ * references (markdown links and backtick paths). Works against source
+ * README plus compiled CLAUDE.md — no spec loading required.
+ */
+export interface OrphanReport {
+    /** Include globs that were scanned. */
+    readonly include: readonly string[];
+    /** Total docs discovered under those globs. */
+    readonly totalDocs: number;
+    /** Docs referenced from at least one other `.md` file. */
+    readonly referencedDocs: readonly string[];
+    /** Docs that exist but no other `.md` references them. */
+    readonly orphans: readonly string[];
+}
+export interface FindOrphansOptions {
+    /** Repository root. Defaults to `process.cwd()`. */
+    readonly basePath?: string;
+    /**
+     * Glob patterns of `.md` files to scan. Defaults to
+     * `["docs/**\/*.md", "research/**\/*.md"]` — vigiles-repo convention.
+     * Set to `[]` to disable scanning entirely. Set to your project's
+     * doc directory globs (e.g. `["wiki/**\/*.md"]`) to override.
+     */
+    readonly include?: readonly string[];
+    /** Glob patterns to exclude within the include scope. */
+    readonly exclude?: readonly string[];
+}
+/**
+ * Find docs under `include` globs that no other markdown file references.
+ *
+ * A doc is considered referenced when some OTHER `.md` file in the repo
+ * links to it via `[text](path.md)` or mentions it in a backtick span like
+ * `` `docs/foo.md` ``. Self-references don't count — an orphan that only
+ * links to itself is still an orphan.
+ *
+ * `include` and `exclude` are tsconfig-style glob arrays. Default include
+ * is the vigiles-repo convention `["docs/**\/*.md", "research/**\/*.md"]`;
+ * override per-project via `.vigilesrc.json` → `orphans.include`.
+ */
+export declare function findOrphanDocs(options?: FindOrphansOptions): OrphanReport;
+/** Format an orphan report as human-readable text. */
+export declare function formatOrphanReport(report: OrphanReport): string;
+//# sourceMappingURL=orphans.d.ts.map

package/dist/orphans.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Orphan-docs detection: the inverse of stale-reference validation.
+ *
+ * Stale-ref detection catches specs that point at files which no longer
+ * exist. Orphan detection catches files which exist but no spec or README
+ * points at — docs that quietly rot in `docs/` and `research/` because
+ * nothing tells the agent they're still load-bearing.
+ *
+ * The detector operates purely on the filesystem: it enumerates markdown
+ * files under configured doc roots and scans every `.md` in the repo for
+ * references (markdown links and backtick paths). Works against source
+ * README plus compiled CLAUDE.md — no spec loading required.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findOrphanDocs = findOrphanDocs;
+exports.formatOrphanReport = formatOrphanReport;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const glob_1 = require("glob");
+// ---------------------------------------------------------------------------
+// Internals
+// ---------------------------------------------------------------------------
+const DEFAULT_INCLUDE = ["docs/**/*.md", "research/**/*.md"];
+const DEFAULT_IGNORE = [
+    "node_modules/**",
+    "dist/**",
+    ".vigiles/**",
+    ".git/**",
+];
+// Match markdown links ](path.md) or ](path.md#anchor)
+const LINK_RE = /\]\(([^)\s]+\.md)(?:#[^)]*)?\)/g;
+// Match backtick code spans wrapping a path ending in .md
+const BACKTICK_RE = /`([^`\s]+\.md)`/g;
+function normalizePath(p) {
+    return p.replace(/^\.\//, "").replace(/\\/g, "/");
+}
+function extractRefs(content) {
+    const refs = [];
+    for (const m of content.matchAll(LINK_RE))
+        refs.push(normalizePath(m[1]));
+    for (const m of content.matchAll(BACKTICK_RE))
+        refs.push(normalizePath(m[1]));
+    return refs;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Find docs under `include` globs that no other markdown file references.
+ *
+ * A doc is considered referenced when some OTHER `.md` file in the repo
+ * links to it via `[text](path.md)` or mentions it in a backtick span like
+ * `` `docs/foo.md` ``. Self-references don't count — an orphan that only
+ * links to itself is still an orphan.
+ *
+ * `include` and `exclude` are tsconfig-style glob arrays. Default include
+ * is the vigiles-repo convention `["docs/**\/*.md", "research/**\/*.md"]`;
+ * override per-project via `.vigilesrc.json` → `orphans.include`.
+ */
+function findOrphanDocs(options = {}) {
+    const basePath = options.basePath ?? process.cwd();
+    const include = options.include ?? DEFAULT_INCLUDE;
+    const userExclude = options.exclude ?? [];
+    const ignore = [...DEFAULT_IGNORE, ...userExclude];
+    const allDocs = new Set();
+    for (const pattern of include) {
+        const found = (0, glob_1.globSync)(pattern, { cwd: basePath, ignore });
+        for (const p of found)
+            allDocs.add(normalizePath(p));
+    }
+    const allMarkdown = (0, glob_1.globSync)("**/*.md", {
+        cwd: basePath,
+        ignore: [...DEFAULT_IGNORE],
+    });
+    const referencedBy = new Map();
+    for (const mdPath of allMarkdown) {
+        const source = normalizePath(mdPath);
+        let content;
+        try {
+            content = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(basePath, mdPath), "utf-8");
+        }
+        catch {
+            continue;
+        }
+        for (const target of extractRefs(content)) {
+            if (target === source)
+                continue;
+            let sources = referencedBy.get(target);
+            if (!sources) {
+                sources = new Set();
+                referencedBy.set(target, sources);
+            }
+            sources.add(source);
+        }
+    }
+    const orphans = [];
+    const referencedDocs = [];
+    for (const doc of [...allDocs].sort()) {
+        if (referencedBy.has(doc))
+            referencedDocs.push(doc);
+        else
+            orphans.push(doc);
+    }
+    return {
+        include: [...include],
+        totalDocs: allDocs.size,
+        referencedDocs,
+        orphans,
+    };
+}
+/** Format an orphan report as human-readable text. */
+function formatOrphanReport(report) {
+    if (report.orphans.length === 0) {
+        return `✓ no orphan docs (${String(report.totalDocs)} scanned across ${report.include.join(", ") || "no include patterns"})`;
+    }
+    const lines = [
+        `✗ ${String(report.orphans.length)} orphan doc(s) — referenced by no other .md:`,
+    ];
+    for (const o of report.orphans)
+        lines.push(`    ${o}`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=orphans.js.map

package/dist/proofs.js

@@ -23,20 +23,22 @@ exports.ruleToBloomFilter = ruleToBloomFilter;
 exports.fixedPoint = fixedPoint;
 exports.propertyTest = propertyTest;
 exports.fitness = fitness;
-const node_crypto_1 = require("node:crypto");
 const node_zlib_1 = require("node:zlib");
+const hash_js_1 = require("./hash.js");
 // ---------------------------------------------------------------------------
 // 1. Monotonicity Lattice — partial order on rule strength
 // ---------------------------------------------------------------------------
 /**
  * Ordinal strength of each rule kind.
  *
- *   guidance (0) < enforce (1)
+ *   guidance (0) < guard (1) = enforce (1)
  *
- * The lattice ensures specs only get stricter over time.
+ * Guard and enforce are both mechanically enforced (different mechanisms,
+ * same strength). The lattice ensures specs only get stricter over time.
  */
 const STRENGTH = {
     guidance: 0,
+    guard: 1,
     enforce: 1,
 };
 /**
@@ -194,11 +196,14 @@ function ruleToText(rule) {
             return `${rule.linterRule} ${rule.why}`;
         case "guidance":
             return rule.text;
-        default: {
-            const unknown = rule._kind;
-            throw new Error(`Unknown rule kind "${String(unknown)}" — expected "enforce" or "guidance". ` +
-                `Runtime data is out of sync with the Rule type (legacy spec, JS caller, or cast bypass).`);
+        case "guard": {
+            const patterns = Array.isArray(rule.watch)
+                ? rule.watch.join(" ")
+                : rule.watch;
+            return `${patterns} ${rule.run} ${rule.description}`;
         }
+        default:
+            return (0, hash_js_1.assertNever)(rule);
     }
 }
 // ---------------------------------------------------------------------------
@@ -343,10 +348,10 @@ function fixedPoint(compileFn, initialContent, maxIterations = 10) {
     const hashes = [];
     let current = initialContent;
     for (let i = 0; i < maxIterations; i++) {
-        const hash = sha256short(current);
+        const hash = (0, hash_js_1.sha256short)(current);
         hashes.push(hash);
         const next = compileFn(current);
-        const nextHash = sha256short(next);
+        const nextHash = (0, hash_js_1.sha256short)(next);
         // Fixed point: output === input
         if (nextHash === hash) {
             return { converged: true, iterations: i + 1, hashes, cycleLength: 0 };
@@ -370,10 +375,7 @@ function fixedPoint(compileFn, initialContent, maxIterations = 10) {
         cycleLength: 0,
     };
 }
-/** Compute a short SHA-256 hash (16 hex chars). */
-function sha256short(data) {
-    return (0, node_crypto_1.createHash)("sha256").update(data).digest("hex").slice(0, 16);
-}
+// sha256short imported from ./hash.js
 /** Compute the hash of a HistoryNode (excluding the hash field itself). */
 function computeNodeHash(node) {
     const payload = JSON.stringify({
@@ -383,7 +385,7 @@ function computeNodeHash(node) {
         proofs: node.proofs,
         timestamp: node.timestamp,
     });
-    return sha256short(payload);
+    return (0, hash_js_1.sha256short)(payload);
 }
 class MerkleHistory {
     nodes = [];
@@ -604,8 +606,12 @@ function fitness(spec, options = {}) {
     if (total === 0) {
         return { score: 0, coverage: 0, redundancy: 0, budgetPressure: 0 };
     }
-    // Coverage: fraction with teeth (enforce vs guidance)
-    const enforced = rules.filter((r) => r._kind === "enforce").length;
+    // Coverage: fraction with teeth (mechanically enforced — STRENGTH ≥ 1).
+    // Counts both enforce() (linter-verified) and guard() (file-watch reactive).
+    // Without guard here, mutations that introduce/keep guard rules look like
+    // they reduce coverage and get rejected by runProofSuite even though
+    // enforcement strength didn't drop (see proofs.ts STRENGTH lattice).
+    const enforced = rules.filter((r) => STRENGTH[r._kind] >= 1).length;
     const coverage = enforced / total;
     // Redundancy: fraction of pairs that are near-duplicates
     const similarPairs = findSimilarRules(spec.rules, ncdThreshold);