xdrs-core 0.41.1 → 0.43.0

package/lib/lint.js

@@ -149,9 +149,13 @@ function lintWorkspace(targetPath, options = {}) {
   const scopeEntries = rootEntries.filter((entry) => entry.isDirectory() && !entry.name.startsWith('.'));
 
   // Pass 1: collect known scope-type names from NNN-{scope-type}-scope-type.md files in any scope
-  const knownScopeTypes = new Map(); // scopeTypeName -> filePath
+  const knownScopeTypes = new Map(); // scopeTypeName -> filePath (first primary found, for downstream validation)
+  const scopeTypePrimaryKeys = new Set(); // "scopeName|typeName|scopeTypeName" for companion co-location checks
+  const scopeTypePrimaryByScope = new Map(); // "scopeName|scopeTypeName" -> [typeName, ...] for duplicate detection
+  const scopeTypeCompanions = []; // [{scopeTypeName, scopeName, typeName, filePath}]
   for (const scopeEntry of scopeEntries) {
-    const scopePath = path.join(xdrsRoot, scopeEntry.name);
+    const scopeName = scopeEntry.name;
+    const scopePath = path.join(xdrsRoot, scopeName);
     for (const typeName of Object.keys(TYPE_TO_ID)) {
       const principlesDir = path.join(scopePath, typeName, 'principles');
       if (!existsDirectory(principlesDir)) continue;
@@ -162,17 +166,54 @@ function lintWorkspace(targetPath, options = {}) {
         const m = entry.name.match(NUMBERED_FILE_RE);
         if (!m) continue;
         const shortTitle = m[2];
-        if (!shortTitle.endsWith('-scope-type')) continue;
-        const rawTypeName = shortTitle.slice(0, -'-scope-type'.length);
-        // Special-case: 'local' maps to '_local' (underscore not allowed in NUMBERED_FILE_RE)
-        const scopeTypeName = rawTypeName === 'local' ? '_local' : rawTypeName;
-        if (!knownScopeTypes.has(scopeTypeName)) {
-          knownScopeTypes.set(scopeTypeName, path.join(principlesDir, entry.name));
+        const filePath = path.join(principlesDir, entry.name);
+        if (shortTitle.endsWith('-scope-type')) {
+          // Primary scope-type definition file
+          const rawScopeTypeName = shortTitle.slice(0, -'-scope-type'.length);
+          // Special-case: 'local' maps to '_local' (underscore not allowed in NUMBERED_FILE_RE)
+          const scopeTypeName = rawScopeTypeName === 'local' ? '_local' : rawScopeTypeName;
+          if (!knownScopeTypes.has(scopeTypeName)) {
+            knownScopeTypes.set(scopeTypeName, filePath);
+          }
+          scopeTypePrimaryKeys.add(`${scopeName}|${typeName}|${scopeTypeName}`);
+          const scopeKey = `${scopeName}|${scopeTypeName}`;
+          if (!scopeTypePrimaryByScope.has(scopeKey)) {
+            scopeTypePrimaryByScope.set(scopeKey, []);
+          }
+          scopeTypePrimaryByScope.get(scopeKey).push(typeName);
+          validateStructuredFormat(filePath, errors, '_core-adr-policy-010.08b-def-scope-type-must-be-structured');
+        } else {
+          // Check if it's a companion file: title contains '-scope-type-' followed by a qualifier
+          const stIdx = shortTitle.indexOf('-scope-type-');
+          if (stIdx > 0) {
+            const rawScopeTypeName = shortTitle.slice(0, stIdx);
+            // Special-case: 'local' maps to '_local'
+            const scopeTypeName = rawScopeTypeName === 'local' ? '_local' : rawScopeTypeName;
+            scopeTypeCompanions.push({ scopeTypeName, scopeName, typeName, filePath });
+            validateStructuredFormat(filePath, errors, '_core-adr-policy-010.08b-def-scope-type-must-be-structured');
+          }
         }
       }
     }
   }
 
+  // Validate: no duplicate primaries across type folders in the same scope
+  for (const [scopeKey, typeNames] of scopeTypePrimaryByScope) {
+    if (typeNames.length > 1) {
+      const pipeIdx = scopeKey.indexOf('|');
+      const sName = scopeKey.slice(0, pipeIdx);
+      const stName = scopeKey.slice(pipeIdx + 1);
+      errors.push(`Scope type "${stName}" has primary definitions in multiple type folders [${typeNames.join(', ')}] in scope "${sName}": only one primary is allowed per scope [_core-adr-policy-010.02-def-naming]`);
+    }
+  }
+
+  // Validate: each companion must have a corresponding primary in the same scope and type folder
+  for (const { scopeTypeName, scopeName, typeName, filePath } of scopeTypeCompanions) {
+    if (!scopeTypePrimaryKeys.has(`${scopeName}|${typeName}|${scopeTypeName}`)) {
+      errors.push(`Companion scope-type file has no corresponding primary "${scopeTypeName}-scope-type" policy in the same scope "${scopeName}" and type folder "${typeName}": ${toDisplayPath(filePath)} [_core-adr-policy-010.02b-companion-requires-primary]`);
+    }
+  }
+
   for (const entry of rootEntries) {
     if (entry.isFile() && entry.name !== 'index.md') {
       errors.push(`Unexpected file at .xdrs root: ${entry.name} [_core-adr-policy-001]`);
@@ -292,29 +333,64 @@ function lintScopeIndexFrontmatter(scopeIndexPath, scopeName, errors, xdrsRoot,
   }
 
   const scopeTypeMatch = block.match(/^scope-type:\s*(.+)$/m);
-  const scopeType = scopeTypeMatch ? scopeTypeMatch[1].trim() : null;
-  if (!scopeType) {
+  const scopeTypeRaw = scopeTypeMatch ? scopeTypeMatch[1].trim() : null;
+  if (!scopeTypeRaw) {
     errors.push(`Scope index frontmatter must include a scope-type field: ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-010.08-def-valid-iff-policy-exists]`);
     return;
   }
-  if (scopeType.startsWith('_') && scopeType !== '_local') {
-    errors.push(`Scope type "${scopeType}" uses a reserved "_" prefix; only "_local" is a valid underscore-prefixed scope type: ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-010.06-def-no-underscore-prefix]`);
-    return;
+
+  // Parse scope-type: supports single string or comma-separated list (e.g. "compiled, internal-docs")
+  const commaSeparatedScopeTypePattern = /^[a-zA-Z_][a-zA-Z0-9_-]*(?:\s*,\s*[a-zA-Z_][a-zA-Z0-9_-]*)+$/;
+  let scopeTypes;
+  if (commaSeparatedScopeTypePattern.test(scopeTypeRaw)) {
+    scopeTypes = scopeTypeRaw.split(',').map((s) => s.trim());
+  } else {
+    scopeTypes = [scopeTypeRaw];
   }
-  if (!knownScopeTypes.has(scopeType) && scopeType !== '_local') {
-    errors.push(`Scope index scope-type "${scopeType}" has no corresponding ${scopeType}-scope-type policy in the principles of any scope: ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-010.08-def-valid-iff-policy-exists]`);
-    return;
+
+  // Validate each element: no duplicates, valid chars, no reserved prefix
+  const seenTypes = new Set();
+  let hasElementError = false;
+  const SCOPE_TYPE_ELEMENT_RE = /^[a-zA-Z_][a-zA-Z0-9_-]*$/;
+  for (const scopeType of scopeTypes) {
+    if (!SCOPE_TYPE_ELEMENT_RE.test(scopeType)) {
+      errors.push(`Scope type element "${scopeType}" contains invalid characters (must match [a-zA-Z_][a-zA-Z0-9_-]*): ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-010.06-def-no-underscore-prefix]`);
+      hasElementError = true;
+      continue;
+    }
+    if (scopeType.startsWith('_') && scopeType !== '_local') {
+      errors.push(`Scope type "${scopeType}" uses a reserved "_" prefix; only "_local" is a valid underscore-prefixed scope type: ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-010.06-def-no-underscore-prefix]`);
+      hasElementError = true;
+      continue;
+    }
+    if (seenTypes.has(scopeType)) {
+      errors.push(`Scope type list contains duplicate value "${scopeType}": ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-010.05b-def-multi-type-validation]`);
+      hasElementError = true;
+      continue;
+    }
+    seenTypes.add(scopeType);
   }
-  // Validate inheritance chain: ensure all ancestors exist in knownScopeTypes
-  if (scopeType !== '_local') {
-    const visited = new Set([scopeType]);
-    let currentType = scopeType;
+  if (hasElementError) return;
+
+  // Use first element for single-value checks that only apply to the primary type
+  const scopeType = scopeTypes[0];
+
+  // Validate each type exists in knownScopeTypes and check parent chains with global cycle detection
+  const globalVisited = new Set(scopeTypes);
+  for (const st of scopeTypes) {
+    if (st === '_local') continue;
+    if (!knownScopeTypes.has(st)) {
+      errors.push(`Scope index scope-type "${st}" has no corresponding ${st}-scope-type policy in the principles of any scope: ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-010.08-def-valid-iff-policy-exists]`);
+      continue;
+    }
+    // Validate parent chain
+    let currentType = st;
     while (currentType) {
       const policyPath = knownScopeTypes.get(currentType);
       if (!policyPath) break;
       const parentType = extractParentScopeType(policyPath);
       if (!parentType) break;
-      if (visited.has(parentType)) {
+      if (globalVisited.has(parentType)) {
         errors.push(`Scope type "${currentType}" declares parent "${parentType}" which creates a cycle in the scope-type inheritance chain: ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-010.07-def-parent-scope-type]`);
         break;
       }
@@ -322,7 +398,7 @@ function lintScopeIndexFrontmatter(scopeIndexPath, scopeName, errors, xdrsRoot,
         errors.push(`Scope type "${currentType}" declares parent "${parentType}" but no ${parentType}-scope-type policy exists in any scope: ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-010.07-def-parent-scope-type]`);
         break;
       }
-      visited.add(parentType);
+      globalVisited.add(parentType);
       currentType = parentType;
     }
   }
@@ -332,16 +408,16 @@ function lintScopeIndexFrontmatter(scopeIndexPath, scopeName, errors, xdrsRoot,
   if (scopeName === '_local' && scopeType !== '_local') {
     errors.push(`Scope "_local" must have scope-type "_local": ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-015.01-scope-type-name]`);
   }
-  if (scopeType === 'core' && !scopeName.includes('core')) {
+  if (scopeTypes.includes('core') && !scopeName.includes('core')) {
     errors.push(`Scope with type "core" must have "core" in its name: ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-011.03-naming-convention]`);
   }
-  if (scopeType === '_local' && scopeName !== '_local') {
+  if (scopeTypes.includes('_local') && scopeName !== '_local') {
     errors.push(`Scope type "_local" is reserved for the "_local" scope: ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-015.03-exclusive-reservation]`);
   }
-  if (scopeType === 'reference' && !scopeName.includes('-ref-')) {
+  if (scopeTypes.includes('reference') && !scopeName.includes('-ref-')) {
     errors.push(`Scope with type "reference" must follow the naming pattern {domain}-ref-{name} (e.g. "security-ref-baseline"): ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-012.03-naming-convention]`);
   }
-  if (scopeType === 'platform' && !scopeName.includes('-plat-')) {
+  if (scopeTypes.includes('platform') && !scopeName.includes('-plat-')) {
     errors.push(`Scope with type "platform" must follow the naming pattern {domain}-plat-{name} (e.g. "cloud-plat-aws"): ${toDisplayPath(scopeIndexPath)} [_core-adr-policy-013.03-naming-convention]`);
   }
 
@@ -528,6 +604,26 @@ function lintScopeDirectory(xdrsRoot, scopeName, errors, warnings, actualTypeInd
     errors.push(`Invalid scope name: ${toDisplayPath(scopePath)} [_core-adr-policy-001]`);
   }
 
+  // Determine if this scope is a core-type scope (but not _core which is exempt)
+  // Used to enforce structured format on all policies in core-type scopes
+  let isCoreTypeNonExempt = false;
+  if (scopeName !== '_core') {
+    const scopeIndexPath = path.join(scopePath, 'index.md');
+    if (existsFile(scopeIndexPath)) {
+      try {
+        const idxContent = fs.readFileSync(scopeIndexPath, 'utf8');
+        const stMatch = idxContent.match(/^scope-type:\s*(.+)$/m);
+        if (stMatch) {
+          const stRaw = stMatch[1].trim();
+          const stList = stRaw.startsWith('[') && stRaw.endsWith(']')
+            ? stRaw.slice(1, -1).split(',').map((s) => s.trim())
+            : [stRaw];
+          isCoreTypeNonExempt = stList.includes('core');
+        }
+      } catch { /* ignore read errors; will be caught later */ }
+    }
+  }
+
   const typeIndexesInScope = [];
   const entries = safeReadDir(scopePath, errors, `read scope directory ${scopeName}`);
   for (const entry of entries) {
@@ -537,7 +633,7 @@ function lintScopeDirectory(xdrsRoot, scopeName, errors, warnings, actualTypeInd
         errors.push(`Unexpected directory under scope ${scopeName}: ${toDisplayPath(entryPath)} [_core-adr-policy-001]`);
         continue;
       }
-      lintTypeDirectory(xdrsRoot, scopeName, entry.name, errors, warnings, actualTypeIndexes, externalScopes);
+      lintTypeDirectory(xdrsRoot, scopeName, entry.name, errors, warnings, actualTypeIndexes, externalScopes, isCoreTypeNonExempt);
       const typeIndexPath = path.join(entryPath, 'index.md');
       if (existsFile(typeIndexPath)) {
         typeIndexesInScope.push(typeIndexPath);
@@ -559,37 +655,62 @@ function lintScopeDirectory(xdrsRoot, scopeName, errors, warnings, actualTypeInd
     lintScopeIndex(scopeIndexPath, xdrsRoot, scopeName, typeIndexesInScope, errors, externalScopes);
     lintScopeIndexFrontmatter(scopeIndexPath, scopeName, errors, xdrsRoot, knownScopeTypes, readOnlyScopes);
   }
-  lintScopeLocalStandards(xdrsRoot, scopeName, errors);
+  lintLocalMetaPolicies(xdrsRoot, scopeName, errors);
 }
 
-function lintScopeLocalStandards(xdrsRoot, scopeName, errors) {
+function lintLocalMetaPolicies(xdrsRoot, scopeName, errors) {
   const scopePath = path.join(xdrsRoot, scopeName);
-  const corePolicySuffix = `${scopeName}-core`;
-  const foundPolicies = [];
+  // Track qualifiers across all type folders: qualifier ('' for primary) -> filePath
+  const seenQualifiers = new Map();
   for (const typeName of Object.keys(TYPE_TO_ID)) {
     const principlesDir = path.join(scopePath, typeName, 'principles');
     if (!existsDirectory(principlesDir)) continue;
     let principlesEntries;
     try { principlesEntries = fs.readdirSync(principlesDir, { withFileTypes: true }); } catch { continue; }
+    // Collect primary and companions per type folder
+    let primaryInFolder = null;
+    const companionsInFolder = [];
     for (const entry of principlesEntries) {
       if (!entry.isFile()) continue;
-      if (!NUMBERED_FILE_RE.test(entry.name)) continue;
+      const m = entry.name.match(NUMBERED_FILE_RE);
+      if (!m) continue;
+      const title = m[2];
+      // Exclude scope-type definition files
+      if (title.endsWith('-scope-type')) continue;
+      const titleParts = title.split('-');
+      if (titleParts[0] !== 'core') continue;
+      // Determine qualifier ('') for primary, qualifier string for companions
+      const qualifier = titleParts.length === 1 ? '' : titleParts.slice(1).join('-');
       const filePath = path.join(principlesDir, entry.name);
-      let content;
-      try { content = fs.readFileSync(filePath, 'utf8'); } catch { continue; }
-      const fm = extractFrontmatter(content);
-      if (fm.name && (fm.name === corePolicySuffix || fm.name.endsWith(`-${corePolicySuffix}`))) {
-        foundPolicies.push(filePath);
+      if (qualifier === '') {
+        primaryInFolder = { filePath, qualifier };
+      } else {
+        companionsInFolder.push({ filePath, qualifier });
       }
     }
-  }
-  if (foundPolicies.length > 1) {
-    const paths = foundPolicies.map((p) => toDisplayPath(p)).join(', ');
-    errors.push(`Scope "${scopeName}" has more than one scope-local standards policy (name ending with "${corePolicySuffix}"): ${paths} [_core-adr-policy-010.10-local-placement]`);
+    // Error: companion exists without primary in same type folder
+    for (const companion of companionsInFolder) {
+      if (!primaryInFolder) {
+        errors.push(`Local meta-policy companion "${path.basename(companion.filePath)}" requires a primary "NNN-core.md" in the same type folder "${typeName}": ${toDisplayPath(companion.filePath)} [_core-adr-policy-010.10b-local-primary-required]`);
+      }
+    }
+    // Check qualifier uniqueness across all type folders
+    const allInFolder = primaryInFolder ? [primaryInFolder, ...companionsInFolder] : companionsInFolder;
+    for (const { filePath, qualifier } of allInFolder) {
+      const existing = seenQualifiers.get(qualifier);
+      if (existing) {
+        const label = qualifier === '' ? 'primary (no qualifier)' : `qualifier "${qualifier}"`;
+        errors.push(`Local meta-policy ${label} appears in multiple type folders in scope "${scopeName}": ${toDisplayPath(existing)} and ${toDisplayPath(filePath)} [_core-adr-policy-010.10c-local-unique-qualifier]`);
+      } else {
+        seenQualifiers.set(qualifier, filePath);
+      }
+      // Validate structured format for all local meta-policy files
+      validateStructuredFormat(filePath, errors, '_core-adr-policy-010.12b-local-must-be-structured');
+    }
   }
 }
 
-function lintTypeDirectory(xdrsRoot, scopeName, typeName, errors, warnings, actualTypeIndexes, externalScopes = new Set()) {
+function lintTypeDirectory(xdrsRoot, scopeName, typeName, errors, warnings, actualTypeIndexes, externalScopes = new Set(), enforceStructured = false) {
   const typePath = path.join(xdrsRoot, scopeName, typeName);
   const indexPath = path.join(typePath, 'index.md');
   const xdrsNumbers = new Map();
@@ -620,7 +741,7 @@ function lintTypeDirectory(xdrsRoot, scopeName, typeName, errors, warnings, actu
       warnings.push(`Invalid subject folder for ${typeName}: ${toDisplayPath(entryPath)} [_core-adr-policy-001] [exempt: freeze-reference]`);
     }
 
-    artifacts.push(...lintSubjectDirectory(xdrsRoot, scopeName, typeName, entry.name, xdrsNumbers, errors, warnings, externalScopes));
+    artifacts.push(...lintSubjectDirectory(xdrsRoot, scopeName, typeName, entry.name, xdrsNumbers, errors, warnings, externalScopes, enforceStructured));
   }
 
   if (existsFile(indexPath)) {
@@ -628,7 +749,7 @@ function lintTypeDirectory(xdrsRoot, scopeName, typeName, errors, warnings, actu
   }
 }
 
-function lintSubjectDirectory(xdrsRoot, scopeName, typeName, subjectName, xdrsNumbers, errors, warnings, externalScopes = new Set()) {
+function lintSubjectDirectory(xdrsRoot, scopeName, typeName, subjectName, xdrsNumbers, errors, warnings, externalScopes = new Set(), enforceStructured = false) {
   const subjectPath = path.join(xdrsRoot, scopeName, typeName, subjectName);
   const artifacts = [];
   const entries = safeReadDir(subjectPath, errors, `read subject directory ${scopeName}/${typeName}/${subjectName}`);
@@ -667,7 +788,7 @@ function lintSubjectDirectory(xdrsRoot, scopeName, typeName, subjectName, xdrsNu
     }
 
     artifacts.push(entryPath);
-    lintXdrsElementFile(xdrsRoot, scopeName, typeName, subjectName, entryPath, xdrsNumbers, errors, warnings, externalScopes);
+    lintXdrsElementFile(xdrsRoot, scopeName, typeName, subjectName, entryPath, xdrsNumbers, errors, warnings, externalScopes, enforceStructured);
   }
 
   const subjectAssetsDir = path.join(subjectPath, RESOURCE_DIR_NAME);
@@ -677,7 +798,7 @@ function lintSubjectDirectory(xdrsRoot, scopeName, typeName, subjectName, xdrsNu
   return artifacts;
 }
 
-function lintXdrsElementFile(xdrsRoot, scopeName, typeName, subjectName, filePath, xdrsNumbers, errors, warnings, externalScopes = new Set()) {
+function lintXdrsElementFile(xdrsRoot, scopeName, typeName, subjectName, filePath, xdrsNumbers, errors, warnings, externalScopes = new Set(), enforceStructured = false) {
   const baseName = path.basename(filePath);
   const match = baseName.match(NUMBERED_FILE_RE);
   if (!match) {
@@ -707,10 +828,21 @@ function lintXdrsElementFile(xdrsRoot, scopeName, typeName, subjectName, filePat
     warnings.push(`Policy title must start with "${expectedHeader}": ${toDisplayPath(filePath)} [_core-adr-policy-002] [exempt: freeze-reference]`);
   }
 
+  // Enforce 'core' word reservation: only allowed as first word of filename title in principles/
+  const titleParts = match[2].split('-');
+  if (titleParts.includes('core') && !(subjectName === 'principles' && titleParts[0] === 'core')) {
+    const msg = `Policy filename must not use "core" as a name word unless it is a local meta-policy in "principles/" starting with "core" (e.g., "NNN-core.md" or "NNN-core-{qualifier}.md"): ${toDisplayPath(filePath)} [_core-adr-policy-010.09-local-naming]`;
+    if (freezeReference) { warnings.push(`${msg} [exempt: freeze-reference]`); } else { errors.push(msg); }
+  }
+
   const expectedName = extractExpectedXdrsNameFromHeading(firstLine)
     || `${scopeName}-${TYPE_TO_ID[typeName]}-${number}-${match[2]}`;
   lintXdrsElementFrontmatter(content, expectedName, filePath, errors, warnings, freezeReference);
-  lintStructuredRuleBlocks(content, filePath, errors);
+  if (enforceStructured) {
+    validateStructuredFormatContent(content, filePath, errors, '_core-adr-policy-010.08c-def-core-scope-policies-must-be-structured');
+  } else {
+    lintStructuredRuleBlocks(content, filePath, errors);
+  }
   lintRequiredSections(content, filePath, XDRS_REQUIRED_SECTIONS, 'Policy', errors);
   lintNoEmojis(content, filePath, 'Policy', errors);
   lintWordCount(content, filePath, 'Policy', POLICY_MAX_WORDS, errors);
@@ -801,6 +933,11 @@ function lintSkillsDirectory(xdrsRoot, scopeName, typeName, subjectName, skillsP
       continue;
     }
 
+    // .assets is allowed as a shared resources directory within skills/
+    if (entry.name === RESOURCE_DIR_NAME) {
+      continue;
+    }
+
     const match = entry.name.match(NUMBERED_DIR_RE);
     if (!match) {
       errors.push(`Invalid skill package name: ${toDisplayPath(entryPath)} [_core-adr-policy-003]`);
@@ -1485,6 +1622,29 @@ function stripFrontmatter(content) {
   return match ? content.slice(match[0].length) : content;
 }
 
+/**
+ * Validate that a policy file follows the structured format defined in policy-008:
+ * must have a "### Details" section and at least one "#### NN-rulename" rule block.
+ */
+function validateStructuredFormat(filePath, errors, errorCode) {
+  let content;
+  try { content = fs.readFileSync(filePath, 'utf8'); } catch { return; }
+  validateStructuredFormatContent(content, filePath, errors, errorCode);
+}
+
+function validateStructuredFormatContent(content, filePath, errors, errorCode) {
+  const body = stripFrontmatter(content);
+  if (!/^### Details\s*$/m.test(body)) {
+    errors.push(`Policy must have a "### Details" section: ${toDisplayPath(filePath)} [${errorCode}]`);
+    return;
+  }
+  if (!/^#### \d{2}-[a-z][a-z0-9-]*$/m.test(body)) {
+    errors.push(`Policy must have at least one structured rule block (#### NN-rulename) in ### Details: ${toDisplayPath(filePath)} [${errorCode}]`);
+    return;
+  }
+  lintStructuredRuleBlocks(content, filePath, errors);
+}
+
 function findIgnoredMarkdownLines(lines) {
   const ignored = [];
   let inCodeFence = false;