Give every enforced rule an ID, a ledger row and a fixture that proves it fires #29

Parent

#21

What to build

A new docs/architecture-rules.md lists every rule the repository enforces today. Each row has a greppable ID, the rule, its enforcer and its severity, grouped by family: layering, external dependencies, graph hygiene, naming, tests, toolchain, and the existing gates (the ADR, link and manifest checks). A table records the rules considered and rejected, with the reason, so proposing one again starts from the argument. Exemptions live in reviewed JSON files, never as inline suppressions.

The ID appears wherever a failure is reported: in the dependency-cruiser rule names (the existing rules keep their meaning under new names), in the ESLint messages, in the test names, and in the messages of the ADR, link and manifest checks. Every failure is therefore greppable back to its row.

A meta test holds the document and the enforcement together. Every configured rule has a fixture that violates it and is reported under its ID. No fixture exists for a rule that is gone. Every documented rule has an enforcement site, or an entry in a pending list with a reason and what stands in for it meanwhile.

Rules to carry, at minimum: the existing layering rules; no import cycles between files, and a new check for cycles between directories; no orphan or unreachable module; every import resolves; no devDependency in shipped code; production code never imports a test or dist/; a test never imports another test; type-only imports are marked; ESM only; no default export outside tool configs; no computed dynamic import; Node builtins take the node: prefix; kebab-case file names; no I-prefixed interfaces; no any, non-null assertion or @ts-ignore; no empty catch; no floating promises; no .only or .skip; no fixed sleep in a test; no test without an assertion; the coverage ratchet and its explicit include list; a compile target of ES2020 or above; the lockfile is committed.

Also in this ticket:

• A dependency denylist for packages the ADRs already rejected, each entry citing its record: @kubernetes/client-node (0067), ajv as a second validator (0066), zod-to-json-schema because Zod generates JSON Schema itself, and text template engines such as handlebars, ejs, mustache and nunjucks (0067).
• lint-adrs accepts an architecture ADR whose normative: pointer names a section of the new ledger.
• One ADR in docs/adr/architecture/: every enforced rule has an ID, a ledger row and a fixture that proves it fires.

Acceptance criteria

• Each configured rule fails on its fixture, and the failure output contains its ID.
• Removing a rule's enforcement fails the meta test until the rule is enforced again or listed as pending with a reason.
• A documented rule with no enforcement and no pending entry fails the meta test.
• An ADR, link or manifest check failure names its rule ID.
• Importing a denylisted package fails the architecture job.
• An architecture ADR pointing at a real ledger section passes lint:adrs, and one pointing at a missing section fails.

Blocked by

• Run the suite on Vitest and make the tooling strict TypeScript #22
• Split CI into one job per gate under Pipeline Complete #23