import { z } from 'zod'; /** * Schema mirroring `@ast-grep/napi`'s `NapiConfig` interface for compound * structural rules. The `rule` key is required at the Zod layer so the * parse-time failure is loud and readable; the inner tree shape is handed * off to `@ast-grep/napi` at the engine boundary for the authoritative * validity check (see `validateAstGrepPattern`). `passthrough()` lets * future napi fields (e.g. `constraints`, `transform`) survive a parse * without a schema bump. * * The rule body is a recursive structural tree (combinators like `all`, * `any`, `not`, `inside`, `has`, `precedes`, `follows`). Rather than * modelling the full recursive schema with `z.lazy()`, we accept any * object shape here and lean on napi to reject malformed trees. That * keeps the Zod layer cheap and the authoritative check centralized. */ export declare const NapiConfigSchema: z.ZodObject<{ rule: z.ZodRecord; }, "passthrough", z.ZodTypeAny, z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">, z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">>; export type NapiConfig = z.infer; /** * Named alias of `NapiConfigSchema` for grep-ability. The field on * `CompiledRule` is named `astGrepYamlRule` (see ADR-087); the alias * lets a reader search for `AstGrepYamlRuleSchema` and land on the * right definition without first knowing it's a napi config. */ export declare const AstGrepYamlRuleSchema: z.ZodObject<{ rule: z.ZodRecord; }, "passthrough", z.ZodTypeAny, z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">, z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">>; export type AstGrepYamlRule = NapiConfig; /** * A full sha256 digest in lowercase hex — the codomain of every content hash on * this seam (Prop 310 § Design 10's CR-blind example-pair hash, the record file's * own content hash). Canonical form only, for the same reason `COMMIT_SHA_RE` * refuses uppercase: admitting a non-canonical digest is a silent data-quality * hole, and normalising it on parse would move the hash basis. */ export declare const SHA256_HEX_RE: RegExp; export declare const AUTHORED_RULE_ID_HEX_LEN = 16; export declare const AUTHORED_RULE_ID_RE: RegExp; /** * True iff `s` is a well-formed ISO-8601 date/timestamp AND a REAL calendar date. * `Date.parse` alone is insufficient: it NORMALIZES day-overflow (`2026-02-31` → Mar 3, * `2026-02-29` non-leap → Mar 1) instead of rejecting it (#2259 CR re-review). The * `Date.UTC` round-trip validates the date HEAD's calendar independently of any timezone * in the time component — a negative offset can legitimately shift the UTC day, so the * head, not the parsed instant, is what must round-trip. */ export declare function isIso8601CalendarDate(s: string): boolean; /** * mmnto-ai/totem#2183 — the §3.1 provenance leg of the ADR-110 Gate-1 * legitimacy bar: the identity of the merged-PR history a regenerated rule was * mined from. Structured and **mechanically validated** (NOT a bare string) so * a placeholder cannot masquerade as provenance. Promotion state is NOT carried * here — it lives on the owning rule's top-level `unverified` flag (ADR-089 * zero-trust), the single source of truth `deriveRuleClass` reads. Control * *evidence* (which PRs/fixtures proved each control) rides the wind-tunnel * manifest (ADR-110 §6), not the per-rule marker. * * **ADR-112 — this is the MINED variant of the `ProvenanceRecord` union.** The * wire shape is otherwise UNCHANGED: `kind` is OPTIONAL and absent on every * pre-ADR-112 record, so a legacy mined provenance parses + reserializes * BYTE-IDENTICAL (no added key — `canonicalStringify` omits the undefined * discriminator exactly as it omits an absent `unverified`), preserving the * non-mutating-refine manifest-hash discipline. Absence ⇒ `'mined'` via * `provenanceKind()`; the miner path types its provenance as * `MinedProvenanceRecord` (the documented mining-only boundary), so its readers * of `mergedPr` / `commitSha` stay type-safe without narrowing. */ export declare const MinedProvenanceWireSchema: z.ZodObject<{ /** * ADR-112 discriminator. OPTIONAL on the mined wire so legacy records (which * have no `kind`) round-trip byte-identical; absence is read as `'mined'` by * `provenanceKind()`. A new mined artifact MAY carry `kind: 'mined'` only * where the resulting hash churn is intentional. */ kind: z.ZodOptional>; /** Merged PR the rule was mined from (positive integer PR number). */ mergedPr: z.ZodNumber; /** * Reference to the review thread that adjudicated the rule. Rejects empty and * whitespace-only via a NON-MUTATING refinement (greptile/CR #2186): a * `.trim()` transform would silently normalize a padded value on parse, so a * stamped rule's on-disk JSON could differ from its parsed form and churn the * manifest hash on the next `verify-manifest`. `.refine` validates without * mutating, so the stored value round-trips byte-identically. */ reviewThread: z.ZodEffects; /** Full 40-hex git commit SHA the rule was frozen at. */ commitSha: z.ZodString; }, "strip", z.ZodTypeAny, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }>; export type MinedProvenanceRecord = z.infer; /** * ADR-112 §4 — the preimage-differential SOURCE for one fixture, a discriminated * union on `kind` (declared PER FIXTURE; not a fixed binding to landed commits). * The materializer (slice C/D) fires the matcher on the preimage and asserts it * is SILENT on the postimage — a matcher that fires only on the fixed form is * fix-shaped and is NOT a legitimate positive control (FM(i)): * - `lesson` (PRIMARY, review-caught repos): the lesson corpus' `badExample` * (preimage — fire) / `goodExample` (postimage — silent). `lessonRef` is an * IMMUTABLE lesson id/hash (the `hashLesson` codomain, `LESSON_REF_RE`), * never a path/mutable alias (§8 identity discipline). * - `commit` (FALLBACK, land-then-fix repos): the pre-fix parent * (`preimageCommitSha` — fire) / post-fix merge (`mergeCommitSha` — silent). * - `record` (Prop 310 § Design 10 + Amendment 1): DERIVED at intake from a * `.totem/rules/.rule.yaml` record's `examples[ordinal]` pair, joined by * the `(ruleId, ordinal)` key with the CR-blind `pairHash` as drift sensor. * The bad/good text is carried inline exactly as the `lesson` branch carries * it, so the differential evaluates identically; the key is what differs. * Amendment 1 makes the record's `examples` block the EDITABLE home — this * branch is the derived side and is never hand-authored (an inline * `preimageSource` in the authored envelope is a migration error, rejected by * name at intake). * * `z.discriminatedUnion` (not `z.union`): both branches carry a REQUIRED literal * `kind`, so Zod routes a parse error to the matched branch instead of emitting * "no union member matched" noise (cf. `cert-corpus-seed.ts`'s `window`). The * OPTIONAL-discriminator round-trip reason `ProvenanceRecordSchema` documents for * its `z.union` does NOT apply — `preimageSource` is a new field with no persisted * authored set. Each branch is `.strict()` so a cross-branch key (e.g. a * `badExample` under `kind:'commit'`) fails LOUD (FM(d) posture) rather than being * silently stripped. All refines are NON-mutating (no `.trim()`) to preserve the * manifest-hash stability discipline. */ export declare const PreimageSourceSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{ kind: z.ZodLiteral<"lesson">; /** IMMUTABLE lesson id/hash (the 16-hex `hashLesson` codomain) — never a path/mutable alias (§4/§8). */ lessonRef: z.ZodString; /** * The defect PREIMAGE exemplar the matcher must FIRE on (§4). This is a lesson * corpus `badExample` — distinct from `CompiledRuleBaseSchema.badExample` (an * optional human-readable code snippet on a compiled rule); here it is the * load-bearing positive-control preimage, so non-empty is required. */ badExample: z.ZodEffects; /** The fixed POSTIMAGE exemplar the matcher must stay SILENT on (§4) — a lesson `goodExample`. */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The PARENT (pre-fix) commit where the DEFECT is present — the matcher must FIRE on this (ADR-112 §4). */ preimageCommitSha: z.ZodString; /** The PR's merge/squash commit — the post-fix (defect-absent) anchor; the matcher must stay SILENT on this. */ mergeCommitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"record">; /** * Prop 310 § Design 10 — half of the join key. The ADR-112 §8 producer-minted * rule id the record was ingested under; pinned to the mint's codomain so a * derivation that lost the id fails LOUD instead of anchoring the pair to a * free-text label. */ ruleId: z.ZodString; /** The `examples[i]` ordinal within the record — the other half of the join key (§ Design 10). */ ordinal: z.ZodNumber; /** * Amendment 1 item 3 — the CR-blind per-pair content hash (`ruleExamplePairHash`), * computed over the LF-image of the pair's material. The § Design 10 DRIFT SENSOR: * an `examples` edit flips it, which flips the ledger `contentHash`, which reads * `revised`. There is no second mechanism. */ pairHash: z.ZodString; /** The record's `examples[ordinal].bad` — the defect preimage the matcher must FIRE on (§4). */ badExample: z.ZodEffects; /** The record's `examples[ordinal].good` — the fixed postimage the matcher must stay SILENT on (§4). */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }>]>; export type PreimageSource = z.infer; /** * ADR-112 §3 — one real lc instance an authored rule claims to catch. ALL such * fixtures are TRAIN-side (the §5 leakage guard); the preimage-differential * (§4) is evaluated in slice C/D, but the record CARRIES the declared * `preimageSource` (lesson | commit) + the defect locus here so derivation is * possible. `matchedSpan` + `contentHash` are the line-drift-stable locus * (cf. `firingLabelId`), not just the file. */ export declare const AuthoredFixtureSchema: z.ZodEffects; /** IMMUTABLE lesson id/hash (the 16-hex `hashLesson` codomain) — never a path/mutable alias (§4/§8). */ lessonRef: z.ZodString; /** * The defect PREIMAGE exemplar the matcher must FIRE on (§4). This is a lesson * corpus `badExample` — distinct from `CompiledRuleBaseSchema.badExample` (an * optional human-readable code snippet on a compiled rule); here it is the * load-bearing positive-control preimage, so non-empty is required. */ badExample: z.ZodEffects; /** The fixed POSTIMAGE exemplar the matcher must stay SILENT on (§4) — a lesson `goodExample`. */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The PARENT (pre-fix) commit where the DEFECT is present — the matcher must FIRE on this (ADR-112 §4). */ preimageCommitSha: z.ZodString; /** The PR's merge/squash commit — the post-fix (defect-absent) anchor; the matcher must stay SILENT on this. */ mergeCommitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"record">; /** * Prop 310 § Design 10 — half of the join key. The ADR-112 §8 producer-minted * rule id the record was ingested under; pinned to the mint's codomain so a * derivation that lost the id fails LOUD instead of anchoring the pair to a * free-text label. */ ruleId: z.ZodString; /** The `examples[i]` ordinal within the record — the other half of the join key (§ Design 10). */ ordinal: z.ZodNumber; /** * Amendment 1 item 3 — the CR-blind per-pair content hash (`ruleExamplePairHash`), * computed over the LF-image of the pair's material. The § Design 10 DRIFT SENSOR: * an `examples` edit flips it, which flips the ledger `contentHash`, which reads * `revised`. There is no second mechanism. */ pairHash: z.ZodString; /** The record's `examples[ordinal].bad` — the defect preimage the matcher must FIRE on (§4). */ badExample: z.ZodEffects; /** The record's `examples[ordinal].good` — the fixed postimage the matcher must stay SILENT on (§4). */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }>]>; /** File the defect locus lives in. */ filePath: z.ZodEffects; /** Line-range or AST-node path — the defect locus, not just the file. */ matchedSpan: z.ZodEffects; /** Span content hash, line-drift-stable (cf. `firingLabelId`). */ contentHash: z.ZodEffects; }, "strict", z.ZodTypeAny, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>; export type AuthoredFixture = z.infer; /** * ADR-112 §3/§6 (strategy#770) — the source of a SILENCE-ONLY near-miss: the one * exemplar a negative control's matcher must stay SILENT on. Source-pluggable per §4 * (a synthetic lesson `example` PRIMARY / a `commitSha` state FALLBACK) but ONE side * only — a near-miss has NO must-fire leg, so this is NOT the positiveFixtures * bad/good `preimageSource` pair (a negative control is a one-leg silence assertion, * a positive control a two-leg differential — §6 L142 arity). `z.discriminatedUnion` * + `.strict()` branches mirror `PreimageSourceSchema` (cross-branch key fails LOUD, * FM(d)); refines are NON-mutating for manifest-hash stability. */ export declare const NearMissSourceSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{ kind: z.ZodLiteral<"lesson">; /** The synthetic near-miss exemplar the matcher must stay SILENT on (§6). */ example: z.ZodEffects; /** * OPTIONAL immutable lesson id — a synthetic near-miss may have no lesson origin, * so unlike the positiveFixtures `lessonRef` it is optional; but WHEN present it * carries the same §8 discipline (the 16-hex `hashLesson` codomain, never a * path/mutable alias), so it can't be a free-form mutable alias. */ lessonRef: z.ZodOptional; }, "strict", z.ZodTypeAny, { kind: "lesson"; example: string; lessonRef?: string | undefined; }, { kind: "lesson"; example: string; lessonRef?: string | undefined; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The commit whose state the matcher must stay SILENT on (§6, land-then-fix fallback). */ commitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; commitSha: string; }, { kind: "commit"; commitSha: string; }>]>; export type NearMissSource = z.infer; /** * ADR-112 §3/§6 (strategy#770) — a declared near-miss the rule must stay SILENT on, * feeding §6 `controls.negative[]` (a fire on it is a §3.3 cull, never a corpus FP). * SILENCE-ONLY: a locus (`filePath` + `matchedSpan`) + the one-side `nearMissSource`. * It deliberately carries NO `pr` (a synthetic near-miss has no corpus position — the * §5 leakage guard targets corpus-drawn fixtures, so there is nothing to train-side- * attest), NO `contentHash`, and NO bad/good pair / anti-vacuity `superRefine` (there * is no pair to be vacuously identical). `.strict()` so a leftover positiveFixtures * key (e.g. `preimageSource`/`pr`) from a mis-migrated fixture fails LOUD (FM(d)). */ export declare const AuthoredNegativeFixtureSchema: z.ZodObject<{ /** File the near-miss locus lives in. */ filePath: z.ZodEffects; /** Line-range or AST-node path — the near-miss locus, not just the file. */ matchedSpan: z.ZodEffects; /** The §4-pluggable silence target — ONE side (the matcher must not fire on it). */ nearMissSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{ kind: z.ZodLiteral<"lesson">; /** The synthetic near-miss exemplar the matcher must stay SILENT on (§6). */ example: z.ZodEffects; /** * OPTIONAL immutable lesson id — a synthetic near-miss may have no lesson origin, * so unlike the positiveFixtures `lessonRef` it is optional; but WHEN present it * carries the same §8 discipline (the 16-hex `hashLesson` codomain, never a * path/mutable alias), so it can't be a free-form mutable alias. */ lessonRef: z.ZodOptional; }, "strict", z.ZodTypeAny, { kind: "lesson"; example: string; lessonRef?: string | undefined; }, { kind: "lesson"; example: string; lessonRef?: string | undefined; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The commit whose state the matcher must stay SILENT on (§6, land-then-fix fallback). */ commitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; commitSha: string; }, { kind: "commit"; commitSha: string; }>]>; }, "strict", z.ZodTypeAny, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }>; export type AuthoredNegativeFixture = z.infer; /** * ADR-112 §3 — the AUTHORED variant of the `ProvenanceRecord` union. A * hand-authored rule is anchored to a real historical DEFECT (the pre-image, * NOT its fix — ADR-110 §4 TP-def) via ≥1 train-side `positiveFixtures` entry. * `kind: 'authored'` is REQUIRED (the discriminator), so this can never be * mistaken for a mined record and an authored record can never round-trip as * mined. Attributable (`author` never anonymous); the embargo/ledger * attestations ride the §8 authoring-ledger, not this marker. */ export declare const AuthoredProvenanceRecordSchema: z.ZodObject<{ kind: z.ZodLiteral<"authored">; /** Agent-id or operator handle — attributable, never anonymous. */ author: z.ZodEffects; /** ISO-8601 authoring date — a real calendar date (`YYYY-MM-DD`) or a full timestamp. */ authoredAt: z.ZodEffects; /** The declared DEFECT the rule targets — the pre-image, not its fix. */ targetDefect: z.ZodEffects; /** ≥1 real lc instance the rule claims to catch — ALL train-side (§5). */ positiveFixtures: z.ZodArray; /** IMMUTABLE lesson id/hash (the 16-hex `hashLesson` codomain) — never a path/mutable alias (§4/§8). */ lessonRef: z.ZodString; /** * The defect PREIMAGE exemplar the matcher must FIRE on (§4). This is a lesson * corpus `badExample` — distinct from `CompiledRuleBaseSchema.badExample` (an * optional human-readable code snippet on a compiled rule); here it is the * load-bearing positive-control preimage, so non-empty is required. */ badExample: z.ZodEffects; /** The fixed POSTIMAGE exemplar the matcher must stay SILENT on (§4) — a lesson `goodExample`. */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The PARENT (pre-fix) commit where the DEFECT is present — the matcher must FIRE on this (ADR-112 §4). */ preimageCommitSha: z.ZodString; /** The PR's merge/squash commit — the post-fix (defect-absent) anchor; the matcher must stay SILENT on this. */ mergeCommitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"record">; /** * Prop 310 § Design 10 — half of the join key. The ADR-112 §8 producer-minted * rule id the record was ingested under; pinned to the mint's codomain so a * derivation that lost the id fails LOUD instead of anchoring the pair to a * free-text label. */ ruleId: z.ZodString; /** The `examples[i]` ordinal within the record — the other half of the join key (§ Design 10). */ ordinal: z.ZodNumber; /** * Amendment 1 item 3 — the CR-blind per-pair content hash (`ruleExamplePairHash`), * computed over the LF-image of the pair's material. The § Design 10 DRIFT SENSOR: * an `examples` edit flips it, which flips the ledger `contentHash`, which reads * `revised`. There is no second mechanism. */ pairHash: z.ZodString; /** The record's `examples[ordinal].bad` — the defect preimage the matcher must FIRE on (§4). */ badExample: z.ZodEffects; /** The record's `examples[ordinal].good` — the fixed postimage the matcher must stay SILENT on (§4). */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }>]>; /** File the defect locus lives in. */ filePath: z.ZodEffects; /** Line-range or AST-node path — the defect locus, not just the file. */ matchedSpan: z.ZodEffects; /** Span content hash, line-drift-stable (cf. `firingLabelId`). */ contentHash: z.ZodEffects; }, "strict", z.ZodTypeAny, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, "many">; /** * Declared SILENCE-ONLY near-misses the rule must stay silent on (feeds §6 * `controls.negative[]`). The silence-only `nearMissSource` shape, NOT the * positiveFixtures bad/good pair (strategy#770 — different arity, §6 L142). */ negativeFixtures: z.ZodOptional; /** Line-range or AST-node path — the near-miss locus, not just the file. */ matchedSpan: z.ZodEffects; /** The §4-pluggable silence target — ONE side (the matcher must not fire on it). */ nearMissSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{ kind: z.ZodLiteral<"lesson">; /** The synthetic near-miss exemplar the matcher must stay SILENT on (§6). */ example: z.ZodEffects; /** * OPTIONAL immutable lesson id — a synthetic near-miss may have no lesson origin, * so unlike the positiveFixtures `lessonRef` it is optional; but WHEN present it * carries the same §8 discipline (the 16-hex `hashLesson` codomain, never a * path/mutable alias), so it can't be a free-form mutable alias. */ lessonRef: z.ZodOptional; }, "strict", z.ZodTypeAny, { kind: "lesson"; example: string; lessonRef?: string | undefined; }, { kind: "lesson"; example: string; lessonRef?: string | undefined; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The commit whose state the matcher must stay SILENT on (§6, land-then-fix fallback). */ commitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; commitSha: string; }, { kind: "commit"; commitSha: string; }>]>; }, "strict", z.ZodTypeAny, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }>, "many">>; }, "strip", z.ZodTypeAny, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }>; export type AuthoredProvenanceRecord = z.infer; /** * ADR-112 §3 — `provenance` is a discriminated UNION on `kind` * (`mined | authored`), the first multi-producer attribute on a rule * (Consequence 3). Built as a `z.union` (NOT `z.discriminatedUnion`) on * purpose: the mined wire keeps `kind` OPTIONAL for byte-identical legacy * round-trip, which a required-discriminator schema cannot express. The two * branches are disjoint on their required fields (`authored` requires * `kind:'authored'` + author/targetDefect/fixtures; the mined branch is the * only one a legacy `{mergedPr, reviewThread, commitSha}` record satisfies), so * the union is unambiguous. `Authored` is listed FIRST so a record carrying * `kind:'authored'` never matches the mined branch. */ export declare const ProvenanceRecordSchema: z.ZodUnion<[z.ZodObject<{ kind: z.ZodLiteral<"authored">; /** Agent-id or operator handle — attributable, never anonymous. */ author: z.ZodEffects; /** ISO-8601 authoring date — a real calendar date (`YYYY-MM-DD`) or a full timestamp. */ authoredAt: z.ZodEffects; /** The declared DEFECT the rule targets — the pre-image, not its fix. */ targetDefect: z.ZodEffects; /** ≥1 real lc instance the rule claims to catch — ALL train-side (§5). */ positiveFixtures: z.ZodArray; /** IMMUTABLE lesson id/hash (the 16-hex `hashLesson` codomain) — never a path/mutable alias (§4/§8). */ lessonRef: z.ZodString; /** * The defect PREIMAGE exemplar the matcher must FIRE on (§4). This is a lesson * corpus `badExample` — distinct from `CompiledRuleBaseSchema.badExample` (an * optional human-readable code snippet on a compiled rule); here it is the * load-bearing positive-control preimage, so non-empty is required. */ badExample: z.ZodEffects; /** The fixed POSTIMAGE exemplar the matcher must stay SILENT on (§4) — a lesson `goodExample`. */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The PARENT (pre-fix) commit where the DEFECT is present — the matcher must FIRE on this (ADR-112 §4). */ preimageCommitSha: z.ZodString; /** The PR's merge/squash commit — the post-fix (defect-absent) anchor; the matcher must stay SILENT on this. */ mergeCommitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"record">; /** * Prop 310 § Design 10 — half of the join key. The ADR-112 §8 producer-minted * rule id the record was ingested under; pinned to the mint's codomain so a * derivation that lost the id fails LOUD instead of anchoring the pair to a * free-text label. */ ruleId: z.ZodString; /** The `examples[i]` ordinal within the record — the other half of the join key (§ Design 10). */ ordinal: z.ZodNumber; /** * Amendment 1 item 3 — the CR-blind per-pair content hash (`ruleExamplePairHash`), * computed over the LF-image of the pair's material. The § Design 10 DRIFT SENSOR: * an `examples` edit flips it, which flips the ledger `contentHash`, which reads * `revised`. There is no second mechanism. */ pairHash: z.ZodString; /** The record's `examples[ordinal].bad` — the defect preimage the matcher must FIRE on (§4). */ badExample: z.ZodEffects; /** The record's `examples[ordinal].good` — the fixed postimage the matcher must stay SILENT on (§4). */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }>]>; /** File the defect locus lives in. */ filePath: z.ZodEffects; /** Line-range or AST-node path — the defect locus, not just the file. */ matchedSpan: z.ZodEffects; /** Span content hash, line-drift-stable (cf. `firingLabelId`). */ contentHash: z.ZodEffects; }, "strict", z.ZodTypeAny, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, "many">; /** * Declared SILENCE-ONLY near-misses the rule must stay silent on (feeds §6 * `controls.negative[]`). The silence-only `nearMissSource` shape, NOT the * positiveFixtures bad/good pair (strategy#770 — different arity, §6 L142). */ negativeFixtures: z.ZodOptional; /** Line-range or AST-node path — the near-miss locus, not just the file. */ matchedSpan: z.ZodEffects; /** The §4-pluggable silence target — ONE side (the matcher must not fire on it). */ nearMissSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{ kind: z.ZodLiteral<"lesson">; /** The synthetic near-miss exemplar the matcher must stay SILENT on (§6). */ example: z.ZodEffects; /** * OPTIONAL immutable lesson id — a synthetic near-miss may have no lesson origin, * so unlike the positiveFixtures `lessonRef` it is optional; but WHEN present it * carries the same §8 discipline (the 16-hex `hashLesson` codomain, never a * path/mutable alias), so it can't be a free-form mutable alias. */ lessonRef: z.ZodOptional; }, "strict", z.ZodTypeAny, { kind: "lesson"; example: string; lessonRef?: string | undefined; }, { kind: "lesson"; example: string; lessonRef?: string | undefined; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The commit whose state the matcher must stay SILENT on (§6, land-then-fix fallback). */ commitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; commitSha: string; }, { kind: "commit"; commitSha: string; }>]>; }, "strict", z.ZodTypeAny, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }>, "many">>; }, "strip", z.ZodTypeAny, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }>, z.ZodObject<{ /** * ADR-112 discriminator. OPTIONAL on the mined wire so legacy records (which * have no `kind`) round-trip byte-identical; absence is read as `'mined'` by * `provenanceKind()`. A new mined artifact MAY carry `kind: 'mined'` only * where the resulting hash churn is intentional. */ kind: z.ZodOptional>; /** Merged PR the rule was mined from (positive integer PR number). */ mergedPr: z.ZodNumber; /** * Reference to the review thread that adjudicated the rule. Rejects empty and * whitespace-only via a NON-MUTATING refinement (greptile/CR #2186): a * `.trim()` transform would silently normalize a padded value on parse, so a * stamped rule's on-disk JSON could differ from its parsed form and churn the * manifest hash on the next `verify-manifest`. `.refine` validates without * mutating, so the stored value round-trips byte-identically. */ reviewThread: z.ZodEffects; /** Full 40-hex git commit SHA the rule was frozen at. */ commitSha: z.ZodString; }, "strip", z.ZodTypeAny, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }>]>; export type ProvenanceRecord = z.infer; /** * ADR-112 — the canonical reader of a provenance record's producer kind. An * absent discriminator (every legacy mined record) reads as `'mined'`. Use this * + the guards below instead of touching `.kind` directly, so the * absent-⇒-mined default lives in exactly one place (Tenet 20). */ export declare function provenanceKind(p: ProvenanceRecord): 'mined' | 'authored'; /** ADR-112 — type-narrowing guard for the mined branch (mined-only field reads). */ export declare function isMinedProvenance(p: ProvenanceRecord): p is MinedProvenanceRecord; /** ADR-112 — type-narrowing guard for the authored branch. */ export declare function isAuthoredProvenance(p: ProvenanceRecord): p is AuthoredProvenanceRecord; /** * mmnto-ai/totem#2183 — the three **peer** legs of the ADR-110 §3 legitimacy * bar, mapping 1:1 onto the strategy#666 Tenet-9 three-check so the Gate-1 * wind-tunnel reads per-rule eligibility off the marker with no translation * layer: `provenance` (§3.1) / `positiveControl` (§3.2) / `negativeControl` * (§3.3). Controls are pass/fail booleans, **required** when `legitimacy` is * present (never defaulted, so an absent control can't silently read as a * failed one); the evidence behind each pass lives in the wind-tunnel manifest. */ export declare const LegitimacySchema: z.ZodObject<{ provenance: z.ZodUnion<[z.ZodObject<{ kind: z.ZodLiteral<"authored">; /** Agent-id or operator handle — attributable, never anonymous. */ author: z.ZodEffects; /** ISO-8601 authoring date — a real calendar date (`YYYY-MM-DD`) or a full timestamp. */ authoredAt: z.ZodEffects; /** The declared DEFECT the rule targets — the pre-image, not its fix. */ targetDefect: z.ZodEffects; /** ≥1 real lc instance the rule claims to catch — ALL train-side (§5). */ positiveFixtures: z.ZodArray; /** IMMUTABLE lesson id/hash (the 16-hex `hashLesson` codomain) — never a path/mutable alias (§4/§8). */ lessonRef: z.ZodString; /** * The defect PREIMAGE exemplar the matcher must FIRE on (§4). This is a lesson * corpus `badExample` — distinct from `CompiledRuleBaseSchema.badExample` (an * optional human-readable code snippet on a compiled rule); here it is the * load-bearing positive-control preimage, so non-empty is required. */ badExample: z.ZodEffects; /** The fixed POSTIMAGE exemplar the matcher must stay SILENT on (§4) — a lesson `goodExample`. */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The PARENT (pre-fix) commit where the DEFECT is present — the matcher must FIRE on this (ADR-112 §4). */ preimageCommitSha: z.ZodString; /** The PR's merge/squash commit — the post-fix (defect-absent) anchor; the matcher must stay SILENT on this. */ mergeCommitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"record">; /** * Prop 310 § Design 10 — half of the join key. The ADR-112 §8 producer-minted * rule id the record was ingested under; pinned to the mint's codomain so a * derivation that lost the id fails LOUD instead of anchoring the pair to a * free-text label. */ ruleId: z.ZodString; /** The `examples[i]` ordinal within the record — the other half of the join key (§ Design 10). */ ordinal: z.ZodNumber; /** * Amendment 1 item 3 — the CR-blind per-pair content hash (`ruleExamplePairHash`), * computed over the LF-image of the pair's material. The § Design 10 DRIFT SENSOR: * an `examples` edit flips it, which flips the ledger `contentHash`, which reads * `revised`. There is no second mechanism. */ pairHash: z.ZodString; /** The record's `examples[ordinal].bad` — the defect preimage the matcher must FIRE on (§4). */ badExample: z.ZodEffects; /** The record's `examples[ordinal].good` — the fixed postimage the matcher must stay SILENT on (§4). */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }>]>; /** File the defect locus lives in. */ filePath: z.ZodEffects; /** Line-range or AST-node path — the defect locus, not just the file. */ matchedSpan: z.ZodEffects; /** Span content hash, line-drift-stable (cf. `firingLabelId`). */ contentHash: z.ZodEffects; }, "strict", z.ZodTypeAny, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, "many">; /** * Declared SILENCE-ONLY near-misses the rule must stay silent on (feeds §6 * `controls.negative[]`). The silence-only `nearMissSource` shape, NOT the * positiveFixtures bad/good pair (strategy#770 — different arity, §6 L142). */ negativeFixtures: z.ZodOptional; /** Line-range or AST-node path — the near-miss locus, not just the file. */ matchedSpan: z.ZodEffects; /** The §4-pluggable silence target — ONE side (the matcher must not fire on it). */ nearMissSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{ kind: z.ZodLiteral<"lesson">; /** The synthetic near-miss exemplar the matcher must stay SILENT on (§6). */ example: z.ZodEffects; /** * OPTIONAL immutable lesson id — a synthetic near-miss may have no lesson origin, * so unlike the positiveFixtures `lessonRef` it is optional; but WHEN present it * carries the same §8 discipline (the 16-hex `hashLesson` codomain, never a * path/mutable alias), so it can't be a free-form mutable alias. */ lessonRef: z.ZodOptional; }, "strict", z.ZodTypeAny, { kind: "lesson"; example: string; lessonRef?: string | undefined; }, { kind: "lesson"; example: string; lessonRef?: string | undefined; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The commit whose state the matcher must stay SILENT on (§6, land-then-fix fallback). */ commitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; commitSha: string; }, { kind: "commit"; commitSha: string; }>]>; }, "strict", z.ZodTypeAny, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }>, "many">>; }, "strip", z.ZodTypeAny, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }>, z.ZodObject<{ /** * ADR-112 discriminator. OPTIONAL on the mined wire so legacy records (which * have no `kind`) round-trip byte-identical; absence is read as `'mined'` by * `provenanceKind()`. A new mined artifact MAY carry `kind: 'mined'` only * where the resulting hash churn is intentional. */ kind: z.ZodOptional>; /** Merged PR the rule was mined from (positive integer PR number). */ mergedPr: z.ZodNumber; /** * Reference to the review thread that adjudicated the rule. Rejects empty and * whitespace-only via a NON-MUTATING refinement (greptile/CR #2186): a * `.trim()` transform would silently normalize a padded value on parse, so a * stamped rule's on-disk JSON could differ from its parsed form and churn the * manifest hash on the next `verify-manifest`. `.refine` validates without * mutating, so the stored value round-trips byte-identically. */ reviewThread: z.ZodEffects; /** Full 40-hex git commit SHA the rule was frozen at. */ commitSha: z.ZodString; }, "strip", z.ZodTypeAny, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }>]>; positiveControl: z.ZodBoolean; negativeControl: z.ZodBoolean; }, "strip", z.ZodTypeAny, { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; }, { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; }>; export type Legitimacy = z.infer; /** * mmnto-ai/totem#2183 — derive the enforcement tier from the ADR-110 §3 * legitimacy bar. Pure + deterministic (Tenet 9). A rule is `'hard'` ONLY when * all three legs hold AND the rule is promoted: `legitimacy` present, the * owning rule's ADR-089 `unverified` flag is not `true`, and both controls * passed. Anything else — no legitimacy, unpromoted, or a failed control — is * `'advisory'`. Promotion reads the rule's TOP-LEVEL `unverified` (the single * source of truth; #1485 / #1479 already read it), never a nested copy. * * **Unwired** from `buildCompiledRule` in this slice: the rule-compilation * freeze stands, so the sanctioned writer is spine regeneration (strategy#516), * which owns the wiring. Exposed as a pure helper for that regenerator and for * the consistency superRefine below. */ export declare function deriveRuleClass(rule: { legitimacy?: Legitimacy; unverified?: boolean; }): 'hard' | 'advisory'; export declare const CompiledRuleSchema: z.ZodEffects; /** Tree-sitter S-expression query (required when engine is 'ast') */ astQuery: z.ZodOptional; /** * Flat ast-grep pattern source (a single JS/TS expression). Mutually * exclusive with `astGrepYamlRule` when `engine === 'ast-grep'`; the * superRefine below enforces that. */ astGrepPattern: z.ZodOptional; /** * Compound ast-grep rule (NapiConfig shape). Holds structural trees * that cannot be expressed as a single source snippet (all / any / * not / inside / has / precedes / follows combinators). Mutually * exclusive with `astGrepPattern`; see the superRefine on this * schema. Smoke-test wiring lands in mmnto/totem#1408. */ astGrepYamlRule: z.ZodOptional; }, "passthrough", z.ZodTypeAny, z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">, z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">>>; /** * Optional code snippet the rule is expected to match. Stored from * compiler output so the smoke-test runner (wired in * mmnto/totem#1408) can re-validate the rule offline. Optional in * 1.14.9; flips to required when #1408 turns on the gate. */ badExample: z.ZodOptional; /** * Optional code snippet the rule MUST NOT match. mmnto-ai/totem#1580 * added the over-matching check: the compile-time smoke gate runs the * rule against `goodExample` and rejects it with reason code * `'matches-good-example'` if the pattern fires. Optional at the * persisted-rule boundary for backward compatibility with pre-#1580 * rules; `CompilerOutputSchema` requires it for regex and ast-grep * producers (see `refineGoodExampleRequired`). */ goodExample: z.ZodOptional; /** ISO timestamp of when this rule was compiled */ compiledAt: z.ZodString; /** ISO timestamp of when this rule was first created (survives recompilation) */ createdAt: z.ZodOptional; /** Optional file glob patterns — rule only applies to matching files (e.g., ["*.sh", "*.yml"]) */ fileGlobs: z.ZodOptional>; /** Rule category for Trap Ledger classification */ category: z.ZodOptional>; /** Severity level — error blocks CI, warning reports but doesn't fail */ severity: z.ZodOptional>; /** * Lifecycle status. Four values: * - `'active'` — rule is enforced by `totem lint`/`totem review`. * - `'archived'` — rule is preserved on disk (telemetry continuity) * but skipped at lint time. `loadCompiledRules` * filters these out (`compiler.ts:140`). * - `'untested-against-codebase'` — Stage 4 verifier (mmnto-ai/totem#1682) * ran against the consumer's codebase but found * zero matches. The rule's runtime behavior on * real code is unknown; treated as inert at lint * time the same way `'archived'` is, but with a * distinct lifecycle semantic so a subsequent * compile cycle in a populated repo can re-run * Stage 4 and promote to `'active'`. * - `'pending-verification'` — pack rule installed via `totem install` in * the cloud-compile bootstrap path * (mmnto-ai/totem#1684). Stage 4 verifier has * never run against the consumer's codebase. Inert * at lint time exactly like `'archived'` and * `'untested-against-codebase'`. The first-lint * promotion interceptor invokes Stage 4 against * the consumer's codebase on first encounter and * replaces the status with one of the three * terminal lifecycle values per Stage4Outcome → * status mapping (see `first-lint-promote.ts`). * Lifecycle is one-shot: a rule is `'pending-verification'` * at most once per `lessonHash` per consumer * repository (memoized in `verification-outcomes.json`). * * Distinct from the boolean `unverified` flag below: `unverified` is set * by ADR-089 zero-trust default on every LLM-generated rule (post-Layer-3 * pass); `'untested-against-codebase'` is set by Stage 4 when the * verifier's deterministic codebase walk produced no hits. A rule can be * `unverified: true` AND `status: 'untested-against-codebase'` * simultaneously — they answer different questions (author-trust vs * empirical-firing). */ status: z.ZodOptional>; /** * Stage 4 confidence (mmnto-ai/totem#1682). Set to `'high'` when Stage 4's * codebase walk found in-scope matches that are structurally equivalent * to the rule's `badExample` — the rule fires on real code, and that real * code has the exact authored shape, so the rule is doing what the lesson * intended. Single-valued enum in T1; future Stage 4 phases may add a * `'low'` value (currently no writer; deferred per ticket #1682 Open * Question 2). Absent (undefined) means Stage 4 has not assigned a * confidence — either the rule was archived, the verifier produced * Candidate Debt outcome (forced `severity: 'warning'` carries that * signal instead), or Stage 4 has not yet run on this rule. */ confidence: z.ZodOptional>; /** Reason for archiving (when status is 'archived') */ archivedReason: z.ZodOptional; /** * ISO timestamp of when the rule was first archived (mmnto-ai/totem#1589). * Preserved across compile-write round-trips so the institutional-ledger * semantic of first-archive-provenance survives. Pre-#1589 Zod parses * silently stripped this field during schema round-trips; every compile * cycle erased prior `archivedAt` values from the rules file. Postmerge * archive scripts (`scripts/archive-postmerge-*.cjs`) set this via raw * JSON mutation; the field is additive on the schema side so manual * archive workflows survive a subsequent `totem lesson compile --export`. */ archivedAt: z.ZodOptional; /** * True for rules generated by Pipeline 1 (manual `**Pattern:**` blocks). Set to * `true` in `buildManualRule`. Used by `doctor.ts:checkUpgradeCandidates` and * `compile.ts:logCompiledRule` to identify manual rules without relying on the * fragile `lessonHeading === message` heuristic — that heuristic only worked * pre-#1265 when manual rules had no way to express a custom message and the * compiler hardcoded `message: lesson.heading`. After #1265 added Pipeline 1 * Message field support, manual rules can now have rich messages distinct from * their headings, breaking the heuristic. The `manual` flag is the reliable * post-#1265 signal. Optional + missing for backward compat with pre-#1265 * compiled-rules.json files; the legacy heuristic stays as a fallback. */ manual: z.ZodOptional; /** * Schema marker for ADR-089 Zero-Trust enforcement. * Readers: * - #1485 pack-merge path refuses downgrade to warning/archived locally. * - #1479 Layer 3 security branch rejects outright on verify failure. */ immutable: z.ZodOptional; /** * ADR-088 Phase 1 Layer 3 (mmnto-ai/totem#1480). True when the rule was * compiled from a lesson that lacked an Example Hit block, meaning no * ground-truth fixture exists to verify the pattern against. Pipeline 2 * / Pipeline 3 / Pipeline 1 writers set this when the lesson body carries * no `**Example Hit:**` field. Security rules with `immutable === true` * or `deps.securityContext === true` are rejected outright rather than * shipped unverified (see compile-lesson.ts). * * Absent (undefined) means the rule is verified. Never write literal * `false`; absence preserves pre-#1480 manifest hashes via * canonicalStringify — `{unverified: undefined}` and an absent key * produce identical output. */ unverified: z.ZodOptional; /** * mmnto-ai/totem#2183 — the ADR-110 §3 legitimacy bar (three peer legs). Set * by spine rule-regeneration (strategy#516); **absent on every legacy rule.** * When present, `ruleClass` MUST also be present and equal to * `deriveRuleClass(rule)` — enforced by the superRefine on * `CompiledRuleSchema`. Never written with defaults: absence is the legacy * signal and preserves pre-#2183 manifest hashes via canonicalStringify. */ legitimacy: z.ZodOptional; /** Agent-id or operator handle — attributable, never anonymous. */ author: z.ZodEffects; /** ISO-8601 authoring date — a real calendar date (`YYYY-MM-DD`) or a full timestamp. */ authoredAt: z.ZodEffects; /** The declared DEFECT the rule targets — the pre-image, not its fix. */ targetDefect: z.ZodEffects; /** ≥1 real lc instance the rule claims to catch — ALL train-side (§5). */ positiveFixtures: z.ZodArray; /** IMMUTABLE lesson id/hash (the 16-hex `hashLesson` codomain) — never a path/mutable alias (§4/§8). */ lessonRef: z.ZodString; /** * The defect PREIMAGE exemplar the matcher must FIRE on (§4). This is a lesson * corpus `badExample` — distinct from `CompiledRuleBaseSchema.badExample` (an * optional human-readable code snippet on a compiled rule); here it is the * load-bearing positive-control preimage, so non-empty is required. */ badExample: z.ZodEffects; /** The fixed POSTIMAGE exemplar the matcher must stay SILENT on (§4) — a lesson `goodExample`. */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The PARENT (pre-fix) commit where the DEFECT is present — the matcher must FIRE on this (ADR-112 §4). */ preimageCommitSha: z.ZodString; /** The PR's merge/squash commit — the post-fix (defect-absent) anchor; the matcher must stay SILENT on this. */ mergeCommitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"record">; /** * Prop 310 § Design 10 — half of the join key. The ADR-112 §8 producer-minted * rule id the record was ingested under; pinned to the mint's codomain so a * derivation that lost the id fails LOUD instead of anchoring the pair to a * free-text label. */ ruleId: z.ZodString; /** The `examples[i]` ordinal within the record — the other half of the join key (§ Design 10). */ ordinal: z.ZodNumber; /** * Amendment 1 item 3 — the CR-blind per-pair content hash (`ruleExamplePairHash`), * computed over the LF-image of the pair's material. The § Design 10 DRIFT SENSOR: * an `examples` edit flips it, which flips the ledger `contentHash`, which reads * `revised`. There is no second mechanism. */ pairHash: z.ZodString; /** The record's `examples[ordinal].bad` — the defect preimage the matcher must FIRE on (§4). */ badExample: z.ZodEffects; /** The record's `examples[ordinal].good` — the fixed postimage the matcher must stay SILENT on (§4). */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }>]>; /** File the defect locus lives in. */ filePath: z.ZodEffects; /** Line-range or AST-node path — the defect locus, not just the file. */ matchedSpan: z.ZodEffects; /** Span content hash, line-drift-stable (cf. `firingLabelId`). */ contentHash: z.ZodEffects; }, "strict", z.ZodTypeAny, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, "many">; /** * Declared SILENCE-ONLY near-misses the rule must stay silent on (feeds §6 * `controls.negative[]`). The silence-only `nearMissSource` shape, NOT the * positiveFixtures bad/good pair (strategy#770 — different arity, §6 L142). */ negativeFixtures: z.ZodOptional; /** Line-range or AST-node path — the near-miss locus, not just the file. */ matchedSpan: z.ZodEffects; /** The §4-pluggable silence target — ONE side (the matcher must not fire on it). */ nearMissSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{ kind: z.ZodLiteral<"lesson">; /** The synthetic near-miss exemplar the matcher must stay SILENT on (§6). */ example: z.ZodEffects; /** * OPTIONAL immutable lesson id — a synthetic near-miss may have no lesson origin, * so unlike the positiveFixtures `lessonRef` it is optional; but WHEN present it * carries the same §8 discipline (the 16-hex `hashLesson` codomain, never a * path/mutable alias), so it can't be a free-form mutable alias. */ lessonRef: z.ZodOptional; }, "strict", z.ZodTypeAny, { kind: "lesson"; example: string; lessonRef?: string | undefined; }, { kind: "lesson"; example: string; lessonRef?: string | undefined; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The commit whose state the matcher must stay SILENT on (§6, land-then-fix fallback). */ commitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; commitSha: string; }, { kind: "commit"; commitSha: string; }>]>; }, "strict", z.ZodTypeAny, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }>, "many">>; }, "strip", z.ZodTypeAny, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }>, z.ZodObject<{ /** * ADR-112 discriminator. OPTIONAL on the mined wire so legacy records (which * have no `kind`) round-trip byte-identical; absence is read as `'mined'` by * `provenanceKind()`. A new mined artifact MAY carry `kind: 'mined'` only * where the resulting hash churn is intentional. */ kind: z.ZodOptional>; /** Merged PR the rule was mined from (positive integer PR number). */ mergedPr: z.ZodNumber; /** * Reference to the review thread that adjudicated the rule. Rejects empty and * whitespace-only via a NON-MUTATING refinement (greptile/CR #2186): a * `.trim()` transform would silently normalize a padded value on parse, so a * stamped rule's on-disk JSON could differ from its parsed form and churn the * manifest hash on the next `verify-manifest`. `.refine` validates without * mutating, so the stored value round-trips byte-identically. */ reviewThread: z.ZodEffects; /** Full 40-hex git commit SHA the rule was frozen at. */ commitSha: z.ZodString; }, "strip", z.ZodTypeAny, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }>]>; positiveControl: z.ZodBoolean; negativeControl: z.ZodBoolean; }, "strip", z.ZodTypeAny, { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; }, { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; }>>; /** * mmnto-ai/totem#2183 — the first-class, **derived** enforcement-tier marker * that retires the engine-type proxy (#2181). `'hard'` blocks (subject to the * unchanged severity gate — error blocks, warning does not); `'advisory'` is * printed, non-blocking. Derived from `legitimacy` at mint via * `deriveRuleClass`; the reader TRUSTS this frozen stamp and never re-derives * at lint-time (ADR-110 §1 mint+validate boundary; Tenet-15 * verifiable-freezing). Present **iff** `legitimacy` is present; absent ⇒ the * reader falls back to the legacy engine-type proxy. */ ruleClass: z.ZodOptional>; /** * Prop 310 § Design 7 / mmnto-ai/totem#1574 — first-class structural * exclusions. Entries are POSITIVE-form globs applied as exclusions: a file is * in scope iff it matches some `fileGlobs` entry AND no `excludeGlobs` entry * (`positiveMatch && !excludeMatch`). `!`-negation is a parse error in the * record grammar, so an entry here never carries one. */ excludeGlobs: z.ZodOptional>; /** * Prop 310 § Design 8 — the absence / must-contain block. The rule fires on a * target match at locus L iff `pattern` does NOT match within the declared * scope containing L. `pattern` is a safe-regex2-gated regex evaluated * TEXTUALLY, independent of `engine`; V1 carries exactly one block. * * The scope enum MIRRORS `RequiresScopeSchema` (`spine/rule-record.ts`) rather * than importing it — `compiler-schema.ts` is an import-graph LEAF (zod only) * and `spine/rule-record.ts` transitively imports it, so an import here would * close a cycle. The two are COUPLED by an equality test in * `record-lower.test.ts`, never left to drift on inspection. `block` is * reserved-unimplemented at the grammar (§ Design 8) and therefore can never * reach a compiled rule. */ requires: z.ZodOptional; }, "strip", z.ZodTypeAny, { pattern: string; scope: "line" | "file"; }, { pattern: string; scope: "line" | "file"; }>>; /** * Prop 310 § Design 5 / § Design 10 — certification's PRIMARY PREIMAGE SOURCE * (ADR-112 §4), and per Amendment 1 the record's block is the hand-editable * home (the fixture envelope derives). Carried verbatim, in ordinal order: the * `(ruleId, ordinal)` join key is positional, so a reorder is a re-pair. * * Deliberately NOT projected onto the legacy `badExample`/`goodExample` pair — * that would be Tenet 20's prohibited mirror (two hand-editable homes for one * object). Consumers that need a single exemplar read `examples[0]`. */ examples: z.ZodOptional, "many">>; /** * Prop 310 § Design 6 — the rule's grammar binding: the single declared * language the ast-grep payload was validated under, resolved against the * Map-backed `extensionToLanguage` registry at compile (built-ins + pack * contributions), never a spec-frozen enum. Present only for record-path * ast-grep rules; the record grammar FORBIDS `language` for regex. */ language: z.ZodOptional; /** * Prop 310 § Design 9 (Amendment R4) — the classification block, carried * VERBATIM and **NEVER EVALUATED at V1**. Evaluation is gated by the ADR-103 * Amendment's proof-required-for-enforcement ruling (and any OPA wiring by * Amendment R1's Q2 perf probe); when SMT lands, the verification result binds * to the emitted artifact via the Amendment's R2 certificate chain. Any reader * that starts EXECUTING this field has crossed the R4 gate — a doctrine change, * not a code change. * * The record key keeps its shipped snake_case name (`verification_shadow`, a * named § Design 4 exception); the COMPILED home is camelCase like every other * field here — the rename happens exactly once, at lowering. */ verificationShadow: z.ZodOptional>; /** * Prop 310 § Design 4 — the optional author-supplied recovery hint. Compiled * home added under § Design 12's total-lowering obligation: the parser admits * the construct, so it either lands here or fails compile loud, and failing * loud on a legal § Design 4 field is not an option. See `record-lower.ts` * § "Total lowering, mechanically". */ recoveryHint: z.ZodOptional; /** * Prop 310 § Design 4 (R8) — Prop 270 §8's curation-provenance block, carried * under the § Design 4 collision rename (`curation`, not `provenance` — that * name is the ADR-112 producer's own output field). Compiled home added under * § Design 12's total-lowering obligation, same grounds as `recoveryHint`. * * Shape mirrors `RuleCurationSchema` (`spine/rule-record.ts`) for the same * import-graph-leaf reason as `requires.scope` above, and is coupled by test. * The grammar's all-or-none process-trio refinement is a PARSE-stage rule; a * compiled rule only ever carries a record that already satisfied it. */ curation: z.ZodOptional; curatedAt: z.ZodOptional; baseline5Phase: z.ZodOptional; }, "strip", z.ZodTypeAny, { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; }, { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; }>>; }, "strip", z.ZodTypeAny, { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }, { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }>, { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }, { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }>; export type CompiledRule = z.infer; /** * Machine-readable reason for why a lesson could not be compiled into a rule. * mmnto-ai/totem#1481 upgraded the `nonCompilable` ledger from opaque 2-tuples * to 4-tuples with an explicit reason code so `totem doctor` and downstream * telemetry can distinguish outcomes without string-matching. * * Enum order matches the compile-pipeline exit points (see compile-lesson.ts) * followed by the legacy migration sentinel. `'legacy-unknown'` exists only * so data written by pre-#1481 compile runs (2-tuple shape) round-trips * through the Read schema, up-converts in memory, and re-persists without * losing the hash/title pair. Fresh compile runs MUST NOT emit * `'legacy-unknown'`; enforcement sits at producers, not the schema. */ export declare const NonCompilableReasonCodeSchema: z.ZodEnum<["no-pattern-generated", "pattern-syntax-invalid", "pattern-zero-match", "verify-retry-exhausted", "security-rule-rejected", "no-pattern-found", "out-of-scope", "missing-badexample", "missing-goodexample", "matches-good-example", "context-required", "semantic-analysis-required", "self-suppressing-pattern", "stage4-out-of-scope-match", "legacy-unknown"]>; export type NonCompilableReasonCode = z.infer; /** * Reason codes that represent retry-eligible transient failures, not * permanent non-compilability (mmnto-ai/totem#1627). Writing these to * `nonCompilable` in `compiled-rules.json` marks a lesson as permanently * unfit for a rule, which blocks future compile-worker prompt improvements * from ever producing a rule for that lesson. * * Every member MUST also appear in `NonCompilableReasonCodeSchema`. The * corresponding test at `compiler-schema.test.ts` enforces this as a strict * subset check. The type annotation below also catches a typo at compile * time (a non-member string would fail assignment to * `NonCompilableReasonCode`). */ export declare const LEDGER_RETRY_PENDING_CODES: ReadonlySet; /** * Policy predicate for the `nonCompilable` ledger in `compiled-rules.json` * (mmnto-ai/totem#1627). Returns true for reason codes that represent * permanent structural incapacity (conceptual lessons, context guards, * semantic-analysis-required hazards, security rejections) and false for * retry-eligible transient failures. Callers use the return value to gate * `nonCompilableMap.set` so the ledger reflects "lesson genuinely cannot * be a rule" rather than "compile attempt produced a bad pattern this * time around." */ export declare function shouldWriteToLedger(reasonCode: NonCompilableReasonCode): boolean; /** * Strict Write schema for `nonCompilable` entries. Every persisted entry * carries the 4-tuple `{hash, title, reasonCode, reason?}` shape. Accepts * `'legacy-unknown'` so migrated pre-#1481 2-tuples round-trip to disk * safely on the first post-upgrade compile; the behavioral invariant that * fresh producers never emit `'legacy-unknown'` lives at the call sites, * not here. * * Design precedent: lesson 400fed87 (Read/Write schema invariants). If * writes routed through the permissive Read schema, the union-plus- * transform pipeline would silently re-accept legacy 2-tuples on every * save and the migration would never complete. */ export declare const NonCompilableEntryWriteSchema: z.ZodObject<{ hash: z.ZodString; title: z.ZodString; reasonCode: z.ZodEnum<["no-pattern-generated", "pattern-syntax-invalid", "pattern-zero-match", "verify-retry-exhausted", "security-rule-rejected", "no-pattern-found", "out-of-scope", "missing-badexample", "missing-goodexample", "matches-good-example", "context-required", "semantic-analysis-required", "self-suppressing-pattern", "stage4-out-of-scope-match", "legacy-unknown"]>; reason: z.ZodOptional; }, "strip", z.ZodTypeAny, { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; }, { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; }>; /** * Permissive Read schema for `nonCompilable` entries. Accepts three shapes: * - Legacy string (pre-#1280): just the hash. * - Legacy 2-tuple (#1280 to #1481): `{hash, title}`. * - Modern 4-tuple (#1481+): `{hash, title, reasonCode, reason?}`. * The transform normalizes every shape to the modern 4-tuple. Legacy shapes * get `reasonCode: 'legacy-unknown'` and no `reason`. */ export declare const NonCompilableEntryReadSchema: z.ZodEffects; reason: z.ZodOptional; }, "strip", z.ZodTypeAny, { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; }, { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; }>, z.ZodObject<{ hash: z.ZodString; title: z.ZodString; }, "strip", z.ZodTypeAny, { hash: string; title: string; }, { hash: string; title: string; }>]>, { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; }, string | { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; } | { hash: string; title: string; }>; /** * Public `NonCompilableEntry` type is the inferred 4-tuple shape (post-Read * transform). Downstream code only ever sees this shape. */ export type NonCompilableEntry = z.infer; export declare const CompiledRulesFileSchema: z.ZodObject<{ version: z.ZodLiteral<1>; rules: z.ZodArray; /** Tree-sitter S-expression query (required when engine is 'ast') */ astQuery: z.ZodOptional; /** * Flat ast-grep pattern source (a single JS/TS expression). Mutually * exclusive with `astGrepYamlRule` when `engine === 'ast-grep'`; the * superRefine below enforces that. */ astGrepPattern: z.ZodOptional; /** * Compound ast-grep rule (NapiConfig shape). Holds structural trees * that cannot be expressed as a single source snippet (all / any / * not / inside / has / precedes / follows combinators). Mutually * exclusive with `astGrepPattern`; see the superRefine on this * schema. Smoke-test wiring lands in mmnto/totem#1408. */ astGrepYamlRule: z.ZodOptional; }, "passthrough", z.ZodTypeAny, z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">, z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">>>; /** * Optional code snippet the rule is expected to match. Stored from * compiler output so the smoke-test runner (wired in * mmnto/totem#1408) can re-validate the rule offline. Optional in * 1.14.9; flips to required when #1408 turns on the gate. */ badExample: z.ZodOptional; /** * Optional code snippet the rule MUST NOT match. mmnto-ai/totem#1580 * added the over-matching check: the compile-time smoke gate runs the * rule against `goodExample` and rejects it with reason code * `'matches-good-example'` if the pattern fires. Optional at the * persisted-rule boundary for backward compatibility with pre-#1580 * rules; `CompilerOutputSchema` requires it for regex and ast-grep * producers (see `refineGoodExampleRequired`). */ goodExample: z.ZodOptional; /** ISO timestamp of when this rule was compiled */ compiledAt: z.ZodString; /** ISO timestamp of when this rule was first created (survives recompilation) */ createdAt: z.ZodOptional; /** Optional file glob patterns — rule only applies to matching files (e.g., ["*.sh", "*.yml"]) */ fileGlobs: z.ZodOptional>; /** Rule category for Trap Ledger classification */ category: z.ZodOptional>; /** Severity level — error blocks CI, warning reports but doesn't fail */ severity: z.ZodOptional>; /** * Lifecycle status. Four values: * - `'active'` — rule is enforced by `totem lint`/`totem review`. * - `'archived'` — rule is preserved on disk (telemetry continuity) * but skipped at lint time. `loadCompiledRules` * filters these out (`compiler.ts:140`). * - `'untested-against-codebase'` — Stage 4 verifier (mmnto-ai/totem#1682) * ran against the consumer's codebase but found * zero matches. The rule's runtime behavior on * real code is unknown; treated as inert at lint * time the same way `'archived'` is, but with a * distinct lifecycle semantic so a subsequent * compile cycle in a populated repo can re-run * Stage 4 and promote to `'active'`. * - `'pending-verification'` — pack rule installed via `totem install` in * the cloud-compile bootstrap path * (mmnto-ai/totem#1684). Stage 4 verifier has * never run against the consumer's codebase. Inert * at lint time exactly like `'archived'` and * `'untested-against-codebase'`. The first-lint * promotion interceptor invokes Stage 4 against * the consumer's codebase on first encounter and * replaces the status with one of the three * terminal lifecycle values per Stage4Outcome → * status mapping (see `first-lint-promote.ts`). * Lifecycle is one-shot: a rule is `'pending-verification'` * at most once per `lessonHash` per consumer * repository (memoized in `verification-outcomes.json`). * * Distinct from the boolean `unverified` flag below: `unverified` is set * by ADR-089 zero-trust default on every LLM-generated rule (post-Layer-3 * pass); `'untested-against-codebase'` is set by Stage 4 when the * verifier's deterministic codebase walk produced no hits. A rule can be * `unverified: true` AND `status: 'untested-against-codebase'` * simultaneously — they answer different questions (author-trust vs * empirical-firing). */ status: z.ZodOptional>; /** * Stage 4 confidence (mmnto-ai/totem#1682). Set to `'high'` when Stage 4's * codebase walk found in-scope matches that are structurally equivalent * to the rule's `badExample` — the rule fires on real code, and that real * code has the exact authored shape, so the rule is doing what the lesson * intended. Single-valued enum in T1; future Stage 4 phases may add a * `'low'` value (currently no writer; deferred per ticket #1682 Open * Question 2). Absent (undefined) means Stage 4 has not assigned a * confidence — either the rule was archived, the verifier produced * Candidate Debt outcome (forced `severity: 'warning'` carries that * signal instead), or Stage 4 has not yet run on this rule. */ confidence: z.ZodOptional>; /** Reason for archiving (when status is 'archived') */ archivedReason: z.ZodOptional; /** * ISO timestamp of when the rule was first archived (mmnto-ai/totem#1589). * Preserved across compile-write round-trips so the institutional-ledger * semantic of first-archive-provenance survives. Pre-#1589 Zod parses * silently stripped this field during schema round-trips; every compile * cycle erased prior `archivedAt` values from the rules file. Postmerge * archive scripts (`scripts/archive-postmerge-*.cjs`) set this via raw * JSON mutation; the field is additive on the schema side so manual * archive workflows survive a subsequent `totem lesson compile --export`. */ archivedAt: z.ZodOptional; /** * True for rules generated by Pipeline 1 (manual `**Pattern:**` blocks). Set to * `true` in `buildManualRule`. Used by `doctor.ts:checkUpgradeCandidates` and * `compile.ts:logCompiledRule` to identify manual rules without relying on the * fragile `lessonHeading === message` heuristic — that heuristic only worked * pre-#1265 when manual rules had no way to express a custom message and the * compiler hardcoded `message: lesson.heading`. After #1265 added Pipeline 1 * Message field support, manual rules can now have rich messages distinct from * their headings, breaking the heuristic. The `manual` flag is the reliable * post-#1265 signal. Optional + missing for backward compat with pre-#1265 * compiled-rules.json files; the legacy heuristic stays as a fallback. */ manual: z.ZodOptional; /** * Schema marker for ADR-089 Zero-Trust enforcement. * Readers: * - #1485 pack-merge path refuses downgrade to warning/archived locally. * - #1479 Layer 3 security branch rejects outright on verify failure. */ immutable: z.ZodOptional; /** * ADR-088 Phase 1 Layer 3 (mmnto-ai/totem#1480). True when the rule was * compiled from a lesson that lacked an Example Hit block, meaning no * ground-truth fixture exists to verify the pattern against. Pipeline 2 * / Pipeline 3 / Pipeline 1 writers set this when the lesson body carries * no `**Example Hit:**` field. Security rules with `immutable === true` * or `deps.securityContext === true` are rejected outright rather than * shipped unverified (see compile-lesson.ts). * * Absent (undefined) means the rule is verified. Never write literal * `false`; absence preserves pre-#1480 manifest hashes via * canonicalStringify — `{unverified: undefined}` and an absent key * produce identical output. */ unverified: z.ZodOptional; /** * mmnto-ai/totem#2183 — the ADR-110 §3 legitimacy bar (three peer legs). Set * by spine rule-regeneration (strategy#516); **absent on every legacy rule.** * When present, `ruleClass` MUST also be present and equal to * `deriveRuleClass(rule)` — enforced by the superRefine on * `CompiledRuleSchema`. Never written with defaults: absence is the legacy * signal and preserves pre-#2183 manifest hashes via canonicalStringify. */ legitimacy: z.ZodOptional; /** Agent-id or operator handle — attributable, never anonymous. */ author: z.ZodEffects; /** ISO-8601 authoring date — a real calendar date (`YYYY-MM-DD`) or a full timestamp. */ authoredAt: z.ZodEffects; /** The declared DEFECT the rule targets — the pre-image, not its fix. */ targetDefect: z.ZodEffects; /** ≥1 real lc instance the rule claims to catch — ALL train-side (§5). */ positiveFixtures: z.ZodArray; /** IMMUTABLE lesson id/hash (the 16-hex `hashLesson` codomain) — never a path/mutable alias (§4/§8). */ lessonRef: z.ZodString; /** * The defect PREIMAGE exemplar the matcher must FIRE on (§4). This is a lesson * corpus `badExample` — distinct from `CompiledRuleBaseSchema.badExample` (an * optional human-readable code snippet on a compiled rule); here it is the * load-bearing positive-control preimage, so non-empty is required. */ badExample: z.ZodEffects; /** The fixed POSTIMAGE exemplar the matcher must stay SILENT on (§4) — a lesson `goodExample`. */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }, { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The PARENT (pre-fix) commit where the DEFECT is present — the matcher must FIRE on this (ADR-112 §4). */ preimageCommitSha: z.ZodString; /** The PR's merge/squash commit — the post-fix (defect-absent) anchor; the matcher must stay SILENT on this. */ mergeCommitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }, { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; }>, z.ZodObject<{ kind: z.ZodLiteral<"record">; /** * Prop 310 § Design 10 — half of the join key. The ADR-112 §8 producer-minted * rule id the record was ingested under; pinned to the mint's codomain so a * derivation that lost the id fails LOUD instead of anchoring the pair to a * free-text label. */ ruleId: z.ZodString; /** The `examples[i]` ordinal within the record — the other half of the join key (§ Design 10). */ ordinal: z.ZodNumber; /** * Amendment 1 item 3 — the CR-blind per-pair content hash (`ruleExamplePairHash`), * computed over the LF-image of the pair's material. The § Design 10 DRIFT SENSOR: * an `examples` edit flips it, which flips the ledger `contentHash`, which reads * `revised`. There is no second mechanism. */ pairHash: z.ZodString; /** The record's `examples[ordinal].bad` — the defect preimage the matcher must FIRE on (§4). */ badExample: z.ZodEffects; /** The record's `examples[ordinal].good` — the fixed postimage the matcher must stay SILENT on (§4). */ goodExample: z.ZodEffects; }, "strict", z.ZodTypeAny, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }, { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }>]>; /** File the defect locus lives in. */ filePath: z.ZodEffects; /** Line-range or AST-node path — the defect locus, not just the file. */ matchedSpan: z.ZodEffects; /** Span content hash, line-drift-stable (cf. `firingLabelId`). */ contentHash: z.ZodEffects; }, "strict", z.ZodTypeAny, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }, { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }>, "many">; /** * Declared SILENCE-ONLY near-misses the rule must stay silent on (feeds §6 * `controls.negative[]`). The silence-only `nearMissSource` shape, NOT the * positiveFixtures bad/good pair (strategy#770 — different arity, §6 L142). */ negativeFixtures: z.ZodOptional; /** Line-range or AST-node path — the near-miss locus, not just the file. */ matchedSpan: z.ZodEffects; /** The §4-pluggable silence target — ONE side (the matcher must not fire on it). */ nearMissSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{ kind: z.ZodLiteral<"lesson">; /** The synthetic near-miss exemplar the matcher must stay SILENT on (§6). */ example: z.ZodEffects; /** * OPTIONAL immutable lesson id — a synthetic near-miss may have no lesson origin, * so unlike the positiveFixtures `lessonRef` it is optional; but WHEN present it * carries the same §8 discipline (the 16-hex `hashLesson` codomain, never a * path/mutable alias), so it can't be a free-form mutable alias. */ lessonRef: z.ZodOptional; }, "strict", z.ZodTypeAny, { kind: "lesson"; example: string; lessonRef?: string | undefined; }, { kind: "lesson"; example: string; lessonRef?: string | undefined; }>, z.ZodObject<{ kind: z.ZodLiteral<"commit">; /** The commit whose state the matcher must stay SILENT on (§6, land-then-fix fallback). */ commitSha: z.ZodString; }, "strict", z.ZodTypeAny, { kind: "commit"; commitSha: string; }, { kind: "commit"; commitSha: string; }>]>; }, "strict", z.ZodTypeAny, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }, { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }>, "many">>; }, "strip", z.ZodTypeAny, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }, { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }>, z.ZodObject<{ /** * ADR-112 discriminator. OPTIONAL on the mined wire so legacy records (which * have no `kind`) round-trip byte-identical; absence is read as `'mined'` by * `provenanceKind()`. A new mined artifact MAY carry `kind: 'mined'` only * where the resulting hash churn is intentional. */ kind: z.ZodOptional>; /** Merged PR the rule was mined from (positive integer PR number). */ mergedPr: z.ZodNumber; /** * Reference to the review thread that adjudicated the rule. Rejects empty and * whitespace-only via a NON-MUTATING refinement (greptile/CR #2186): a * `.trim()` transform would silently normalize a padded value on parse, so a * stamped rule's on-disk JSON could differ from its parsed form and churn the * manifest hash on the next `verify-manifest`. `.refine` validates without * mutating, so the stored value round-trips byte-identically. */ reviewThread: z.ZodEffects; /** Full 40-hex git commit SHA the rule was frozen at. */ commitSha: z.ZodString; }, "strip", z.ZodTypeAny, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }, { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; }>]>; positiveControl: z.ZodBoolean; negativeControl: z.ZodBoolean; }, "strip", z.ZodTypeAny, { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; }, { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; }>>; /** * mmnto-ai/totem#2183 — the first-class, **derived** enforcement-tier marker * that retires the engine-type proxy (#2181). `'hard'` blocks (subject to the * unchanged severity gate — error blocks, warning does not); `'advisory'` is * printed, non-blocking. Derived from `legitimacy` at mint via * `deriveRuleClass`; the reader TRUSTS this frozen stamp and never re-derives * at lint-time (ADR-110 §1 mint+validate boundary; Tenet-15 * verifiable-freezing). Present **iff** `legitimacy` is present; absent ⇒ the * reader falls back to the legacy engine-type proxy. */ ruleClass: z.ZodOptional>; /** * Prop 310 § Design 7 / mmnto-ai/totem#1574 — first-class structural * exclusions. Entries are POSITIVE-form globs applied as exclusions: a file is * in scope iff it matches some `fileGlobs` entry AND no `excludeGlobs` entry * (`positiveMatch && !excludeMatch`). `!`-negation is a parse error in the * record grammar, so an entry here never carries one. */ excludeGlobs: z.ZodOptional>; /** * Prop 310 § Design 8 — the absence / must-contain block. The rule fires on a * target match at locus L iff `pattern` does NOT match within the declared * scope containing L. `pattern` is a safe-regex2-gated regex evaluated * TEXTUALLY, independent of `engine`; V1 carries exactly one block. * * The scope enum MIRRORS `RequiresScopeSchema` (`spine/rule-record.ts`) rather * than importing it — `compiler-schema.ts` is an import-graph LEAF (zod only) * and `spine/rule-record.ts` transitively imports it, so an import here would * close a cycle. The two are COUPLED by an equality test in * `record-lower.test.ts`, never left to drift on inspection. `block` is * reserved-unimplemented at the grammar (§ Design 8) and therefore can never * reach a compiled rule. */ requires: z.ZodOptional; }, "strip", z.ZodTypeAny, { pattern: string; scope: "line" | "file"; }, { pattern: string; scope: "line" | "file"; }>>; /** * Prop 310 § Design 5 / § Design 10 — certification's PRIMARY PREIMAGE SOURCE * (ADR-112 §4), and per Amendment 1 the record's block is the hand-editable * home (the fixture envelope derives). Carried verbatim, in ordinal order: the * `(ruleId, ordinal)` join key is positional, so a reorder is a re-pair. * * Deliberately NOT projected onto the legacy `badExample`/`goodExample` pair — * that would be Tenet 20's prohibited mirror (two hand-editable homes for one * object). Consumers that need a single exemplar read `examples[0]`. */ examples: z.ZodOptional, "many">>; /** * Prop 310 § Design 6 — the rule's grammar binding: the single declared * language the ast-grep payload was validated under, resolved against the * Map-backed `extensionToLanguage` registry at compile (built-ins + pack * contributions), never a spec-frozen enum. Present only for record-path * ast-grep rules; the record grammar FORBIDS `language` for regex. */ language: z.ZodOptional; /** * Prop 310 § Design 9 (Amendment R4) — the classification block, carried * VERBATIM and **NEVER EVALUATED at V1**. Evaluation is gated by the ADR-103 * Amendment's proof-required-for-enforcement ruling (and any OPA wiring by * Amendment R1's Q2 perf probe); when SMT lands, the verification result binds * to the emitted artifact via the Amendment's R2 certificate chain. Any reader * that starts EXECUTING this field has crossed the R4 gate — a doctrine change, * not a code change. * * The record key keeps its shipped snake_case name (`verification_shadow`, a * named § Design 4 exception); the COMPILED home is camelCase like every other * field here — the rename happens exactly once, at lowering. */ verificationShadow: z.ZodOptional>; /** * Prop 310 § Design 4 — the optional author-supplied recovery hint. Compiled * home added under § Design 12's total-lowering obligation: the parser admits * the construct, so it either lands here or fails compile loud, and failing * loud on a legal § Design 4 field is not an option. See `record-lower.ts` * § "Total lowering, mechanically". */ recoveryHint: z.ZodOptional; /** * Prop 310 § Design 4 (R8) — Prop 270 §8's curation-provenance block, carried * under the § Design 4 collision rename (`curation`, not `provenance` — that * name is the ADR-112 producer's own output field). Compiled home added under * § Design 12's total-lowering obligation, same grounds as `recoveryHint`. * * Shape mirrors `RuleCurationSchema` (`spine/rule-record.ts`) for the same * import-graph-leaf reason as `requires.scope` above, and is coupled by test. * The grammar's all-or-none process-trio refinement is a PARSE-stage rule; a * compiled rule only ever carries a record that already satisfied it. */ curation: z.ZodOptional; curatedAt: z.ZodOptional; baseline5Phase: z.ZodOptional; }, "strip", z.ZodTypeAny, { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; }, { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; }>>; }, "strip", z.ZodTypeAny, { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }, { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }>, { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }, { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }>, "many">; /** * Lessons that could not be compiled into a rule. 4-tuple shape since * mmnto-ai/totem#1481: {hash, title, reasonCode, reason?}. The Read * schema accepts the pre-#1280 string shape and the #1280-era 2-tuple * and migrates both to the 4-tuple with `reasonCode: 'legacy-unknown'`. * Every write site MUST route through `NonCompilableEntryWriteSchema` * (or an equivalent structural check) to prevent the permissive Read * transform from legitimizing legacy shapes on save. */ nonCompilable: z.ZodOptional; reason: z.ZodOptional; }, "strip", z.ZodTypeAny, { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; }, { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; }>, z.ZodObject<{ hash: z.ZodString; title: z.ZodString; }, "strip", z.ZodTypeAny, { hash: string; title: string; }, { hash: string; title: string; }>]>, { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; }, string | { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; } | { hash: string; title: string; }>, "many">>; }, "strip", z.ZodTypeAny, { version: 1; rules: { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }[]; nonCompilable?: { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; }[] | undefined; }, { version: 1; rules: { message: string; lessonHash: string; lessonHeading: string; pattern: string; engine: "regex" | "ast" | "ast-grep"; compiledAt: string; status?: "active" | "archived" | "untested-against-codebase" | "pending-verification" | undefined; badExample?: string | undefined; goodExample?: string | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; createdAt?: string | undefined; fileGlobs?: string[] | undefined; category?: "security" | "architecture" | "style" | "performance" | undefined; severity?: "error" | "warning" | undefined; confidence?: "high" | undefined; archivedReason?: string | undefined; archivedAt?: string | undefined; manual?: boolean | undefined; immutable?: boolean | undefined; unverified?: boolean | undefined; legitimacy?: { provenance: { mergedPr: number; reviewThread: string; commitSha: string; kind?: "mined" | undefined; } | { kind: "authored"; author: string; authoredAt: string; targetDefect: string; positiveFixtures: { pr: number; preimageSource: { kind: "lesson"; lessonRef: string; badExample: string; goodExample: string; } | { kind: "commit"; preimageCommitSha: string; mergeCommitSha: string; } | { kind: "record"; badExample: string; goodExample: string; ruleId: string; ordinal: number; pairHash: string; }; filePath: string; matchedSpan: string; contentHash: string; }[]; negativeFixtures?: { filePath: string; matchedSpan: string; nearMissSource: { kind: "lesson"; example: string; lessonRef?: string | undefined; } | { kind: "commit"; commitSha: string; }; }[] | undefined; }; positiveControl: boolean; negativeControl: boolean; } | undefined; ruleClass?: "hard" | "advisory" | undefined; excludeGlobs?: string[] | undefined; requires?: { pattern: string; scope: "line" | "file"; } | undefined; examples?: { bad: string; good: string; }[] | undefined; language?: string | undefined; verificationShadow?: { type: string; source: string; } | undefined; recoveryHint?: string | undefined; curation?: { sourceLesson: string; curatedBy?: string | undefined; curatedAt?: string | undefined; baseline5Phase?: number | undefined; } | undefined; }[]; nonCompilable?: (string | { hash: string; title: string; reasonCode: "no-pattern-generated" | "pattern-syntax-invalid" | "pattern-zero-match" | "verify-retry-exhausted" | "security-rule-rejected" | "no-pattern-found" | "out-of-scope" | "missing-badexample" | "missing-goodexample" | "matches-good-example" | "context-required" | "semantic-analysis-required" | "self-suppressing-pattern" | "stage4-out-of-scope-match" | "legacy-unknown"; reason?: string | undefined; } | { hash: string; title: string; })[] | undefined; }>; export type CompiledRulesFile = z.infer; export declare const CompilerOutputSchema: z.ZodEffects; message: z.ZodOptional; fileGlobs: z.ZodOptional>; engine: z.ZodOptional>; astQuery: z.ZodOptional; /** Flat ast-grep pattern source. Mutually exclusive with `astGrepYamlRule`. */ astGrepPattern: z.ZodOptional; /** Compound ast-grep rule (NapiConfig). Mutually exclusive with `astGrepPattern`. */ astGrepYamlRule: z.ZodOptional; }, "passthrough", z.ZodTypeAny, z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">, z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough">>>; /** * Code snippet the rule is expected to match. Flipped from optional to * engine-conditional required in mmnto-ai/totem#1409 - regex and * ast-grep rules must carry a non-empty snippet so the compile-time * smoke gate (#1408) can execute the rule against known-bad code * before it lands in compiled-rules.json. The Zod field stays * optional here; the `refineBadExampleRequired` superRefine below * enforces the engine-conditional requirement so the error message * can name the engine and cite the ticket. */ badExample: z.ZodOptional; /** * Code snippet the rule MUST NOT match. Flipped from optional to * engine-conditional required in mmnto-ai/totem#1580 - regex and * ast-grep rules must carry a non-empty snippet so the compile-time * smoke gate can assert the pattern does not over-match on known-good * code before it lands in compiled-rules.json. The Zod field stays * optional here; the `refineGoodExampleRequired` superRefine below * enforces the engine-conditional requirement so the error message * can name the engine and cite the ticket. */ goodExample: z.ZodOptional; severity: z.ZodOptional>; /** LLM explanation for why a lesson was marked non-compilable */ reason: z.ZodOptional; /** * LLM-emittable classifier code (mmnto-ai/totem#1598, extended by #1634). * Narrower than `NonCompilableReasonCodeSchema` because most reason codes * (`verify-retry-exhausted`, `missing-badexample`, `security-rule-rejected`, * etc.) are emitted by core routing, not the LLM. Exposing the full enum * to the LLM would let it bypass core classification by forging an * internal sentinel. This narrow enum lists only the codes the compile * prompt is allowed to produce. * * Only valid when `compilable === false`. Enforced by * `refineReasonCodeRequiresNonCompilable` below. */ reasonCode: z.ZodOptional>; }, "strip", z.ZodTypeAny, { compilable: boolean; message?: string | undefined; badExample?: string | undefined; goodExample?: string | undefined; pattern?: string | undefined; engine?: "regex" | "ast" | "ast-grep" | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; fileGlobs?: string[] | undefined; severity?: "error" | "warning" | undefined; reasonCode?: "context-required" | "semantic-analysis-required" | undefined; reason?: string | undefined; }, { compilable: boolean; message?: string | undefined; badExample?: string | undefined; goodExample?: string | undefined; pattern?: string | undefined; engine?: "regex" | "ast" | "ast-grep" | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; fileGlobs?: string[] | undefined; severity?: "error" | "warning" | undefined; reasonCode?: "context-required" | "semantic-analysis-required" | undefined; reason?: string | undefined; }>, { compilable: boolean; message?: string | undefined; badExample?: string | undefined; goodExample?: string | undefined; pattern?: string | undefined; engine?: "regex" | "ast" | "ast-grep" | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectOutputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; fileGlobs?: string[] | undefined; severity?: "error" | "warning" | undefined; reasonCode?: "context-required" | "semantic-analysis-required" | undefined; reason?: string | undefined; }, { compilable: boolean; message?: string | undefined; badExample?: string | undefined; goodExample?: string | undefined; pattern?: string | undefined; engine?: "regex" | "ast" | "ast-grep" | undefined; astQuery?: string | undefined; astGrepPattern?: string | undefined; astGrepYamlRule?: z.objectInputType<{ rule: z.ZodRecord; }, z.ZodTypeAny, "passthrough"> | undefined; fileGlobs?: string[] | undefined; severity?: "error" | "warning" | undefined; reasonCode?: "context-required" | "semantic-analysis-required" | undefined; reason?: string | undefined; }>; export type CompilerOutput = z.infer; export interface Violation { /** The rule that was violated */ rule: CompiledRule; /** The file path from the diff where the violation occurred */ file: string; /** The matching line content */ line: string; /** 1-based line number within the diff hunk (approximate) */ lineNumber: number; } /** Syntactic context of a diff line, determined by AST analysis. */ export type AstContext = 'code' | 'string' | 'comment' | 'regex'; export interface DiffAddition { file: string; line: string; lineNumber: number; /** Content of the preceding line in the new file (context or added), null if first in hunk */ precedingLine: string | null; /** Syntactic context from AST analysis — undefined means not classified (fail-open as code) */ astContext?: AstContext; } export interface RegexValidation { valid: boolean; reason?: string; } /** * A parsed Tenet-4 shape-2 fail-soft attestation (mmnto-ai/totem#2214, * strategy#702/#708). Recognized form: `// totem-context: fail-soft * backstop=`, naming the loud systemic backstop that licenses a blanket * fail-soft catch. `backstop` is null when the author claimed `fail-soft` but * named no backstop — malformed, the lint surfaces a non-blocking WARN. The * lint establishes only token-PRESENCE; the backstop's loudness + per-item * accounting are verified at review/ADR level, never by this sensor. */ export interface FailSoftAttestation { kind: 'fail-soft'; /** The named loud systemic backstop, or null when missing/empty (malformed). */ backstop: string | null; } /** Context passed alongside rule events for Trap Ledger integration. */ export interface RuleEventContext { file: string; line: number; justification?: string; /** * Populated on `'suppress'` events when the suppressing `// totem-context:` * directive parses as a structured fail-soft attestation (mmnto-ai/totem#2214). * Carries the typed exemption so downstream ledger writers (#697 Layer-B * capability ledger) can audit attested fail-soft boundaries by named backstop. */ attestation?: FailSoftAttestation; /** AST context where the rule fired (code, string, comment, regex). */ astContext?: AstContext; /** * Populated on `'failure'` events only. Holds the error message surfaced by * the runtime engine (ast-grep `findAll`, regex `exec`, etc.) so `totem * doctor` telemetry can aggregate rules that fail at execution time. Not * used by `'trigger'` or `'suppress'` events. Kept as a string rather than * the raw `unknown` so the callback interface stays cheap to consume. */ failureReason?: string; /** * True when the rule that fired this event was shipped by a pack with * `immutable: true`. Threaded through so downstream ledger writers can * flag immutable-rule bypass events for pack enforcement audit (ADR-089, * mmnto-ai/totem#1485). Absent on events from non-immutable rules. */ immutable?: boolean; } /** * Callback for observability - invoked when a rule is suppressed, triggered, * or fails at runtime. The `'failure'` variant was added in mmnto/totem#1408 * alongside per-rule try/catch in `executeQuery`. It is intentionally distinct * from `'suppress'`: suppression is a user-initiated directive (totem-ignore / * totem-context), while failure is a runtime engine error on a rule that * otherwise compiled. The #1412 postmerge GCA fix established this boundary, * so the two values must NEVER be conflated in the Trap Ledger. */ export type RuleEventCallback = (event: 'trigger' | 'suppress' | 'failure', lessonHash: string, context?: RuleEventContext) => void; //# sourceMappingURL=compiler-schema.d.ts.map