archtest

func StandardCellRules ¶

func StandardCellRules() []*CellRule

StandardCellRules returns the platform's curated set of portable architecture invariants — the rules that apply to ANY repository building Cells on the GoCell platform (they reason about how the consumer uses platform APIs like errcode / panicregister, not about GoCell's own internal package layout).

Registered saga rule: SAGA-STEP-COMPENSATE-PURE-01 (CheckSagaStepCompensatePure).

This is the GoCell analog of the []*analysis.Analyzer slice handed to multichecker.Main: a flat, registry-free list. The set grows as more rules are migrated from their legacy _test.go form into importable CellRules (M3 PR-2..N, tracked at issue #1302); the ratchet meta-archtest ARCHTEST-MODULE-PATH-FUNNEL-01 guarantees that migration converges.

Classification (form follows function): a rule migrates to a Check* + a StandardCellRules entry only when it yields a meaningful PURE BAN for an external repo — its allowlist / sanctioned sites are GoCell-internal packages absent from a consumer module, so the constraint genuinely fires on consumer code. A rule whose scan targets GoCell-specific paths / sealed types / floors / waivers (vacuous-green or false-red externally) is NOT registered: it either stays a Check* that GoCell dogfoods but does not register (listed below), or — for a pure self-check with no portable value — keeps its logic in its _test.go with only platform paths derived from PlatformModulePath (e.g. this PR's L2 atomicity, publisher/checkpoint conformance enrollment, outboxtest import boundary, relay isolation, checkpoint tx-bound rules).

Rules intentionally NOT registered (register=no) because they reason about GoCell's own internal package layout / source, not about how a consumer uses platform APIs — so they are vacuous-green or false-red in an external module:

• ERROR-FIRST-API-01 (CheckErrorFirstAPI01): gated by errorFirstEnforcedFiles, a hardcoded 22-path positive allowlist of GoCell-specific files. An external module has no files matching those paths → zero scan → vacuous green-pass with no safety signal. The invariant is still enforced in GoCell itself via TestErrorFirstAPI01.
• ERROR-FIRST-TYPED-NIL-01 (CheckErrorFirstTypedNil01): similarly gated by errorFirstEnforcedFiles via errorFirstPackagePatterns(). Same false-safety concern for external modules. Enforced in GoCell via TestErrorFirstTypedNil01.
• DETAILS-SEALED-FIELD-FROZEN-01 (CheckDetailsSealedFieldFrozen01): a platform-source self-check — it reflects on errcode.PublicDetail/InternalDetail and AST-parses pkg/errcode/details.go. The reflect half is tautological for a consumer (it inspects the imported GoCell dependency type, which the consumer cannot alter); the AST half resolves details.go under the CONSUMER module root (findModuleRoot), where that file does not exist → false-red in a clean external repo. It constrains GoCell's own errcode package shape, so it stays a GoCell-internal self-check enforced via TestDetailsSealedFieldFrozen01.
• SCAFFOLD-LISTENER-MARKER-TYPED-CONST-01 (CheckScaffoldListenerMarkerTypedConst): scans the platform's own tools/codegen/cellgen package + the templates/scaffold-cell.tmpl asset (neither exists in an external Cell repo) → vacuous-green there. Migrated for the unified PlatformModulePath parameterization + fork-safety only; enforced in GoCell via TestScaffoldListenerMarkerTypedConst.
• OUTBOX-TOPIC-FAILOPEN-01 (CheckOutboxTopicFailopen01): kernel/outbox.Entry is sealed — a populated outbox.Entry{...} composite literal outside kernel/outbox is a compile error (OUTBOX-ENTRY-SEALED-CONSTRUCTION-01), so the production scan for fail-open security-topic literals is vacuous in GoCell AND in any external repo; the rule's real coverage is the fixturetest/outbox fake-package fixtures under testdata/. Migrated for PlatformModulePath parameterization + fork-safety only; enforced in GoCell via the dogfood + fixture sub-tests in outbox_invariants_test.go.
• SAGA-COORDINATOR-NO-HEARTBEAT-LOOP-01 (CheckSagaCoordinatorNoHeartbeatLoop): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/false-red in an external module.
• SAGA-EXECUTOR-RAND-INJECTED-01 (CheckSagaExecutorRandInjected): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/ false-red in an external module.
• SAGA-JOURNAL-CONFORMANCE-ENROLLMENT-01 (CheckSagaJournalConformanceEnrollment): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/false-red in an external module.
• SAGA-GLOBALREADER-CONFORMANCE-ENROLL-01 (CheckSagaGlobalReaderConformanceEnrollment): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/false-red in an external module.
• SAGA-JOURNAL-HOLDER-SEAL-01 (CheckSagaJournalHolderSeal): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/ false-red in an external module.
• SAGA-DRIVE-BEHIND-LEADER-GATE-01 (CheckSagaDriveBehindLeaderGate): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/false-red in an external module.
• SAGA-STEP-RUN-OUTSIDE-TX-01 (CheckSagaStepRunOutsideTx): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/ false-red in an external module.
• SAGA-CONSTRUCTOR-NIL-GUARD-01 (CheckSagaConstructorNilGuard): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/ false-red in an external module.
• SAGA-SLOG-INSTANCE-FIELDS-CALLER-01 (CheckSagaSlogInstanceFieldsCaller): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/false-red in an external module.
• SAGA-METRIC-LABEL-VALUES-FROZEN-01 (CheckSagaMetricLabelValuesFrozen): reasons about GoCell-internal runtime/saga layout (or conformance enrollment) → vacuous/false-red in an external module.

An external consumer gets the rules migrated so far plus any cfg.ExtraRules they add. The set expands as additional portable rules land in #1302.

func CheckCrossModuleImportDirection ¶

func CheckCrossModuleImportDirection(g *kerneldepgraph.Graph, coreModule string) []CrossModuleViolation

CheckCrossModuleImportDirection enforces CROSS-MODULE-IMPORT-DIRECTION-01: no package owned by coreModule may import a package owned by a DIFFERENT workspace member module. The base (core) module is the workspace root module (go.work `use .` — github.com/ghbvf/gocell for the platform); satellites (github.com/ghbvf/gocell/mdm, /zerotrust, separate-module examples) may import core, but core must never import a satellite, or extracting a satellite would drag the whole base with it.

It is vacuous in the single-module workspace of today (no other module exists to import); the reverse multi-module fixture exercises the live path.

AI-robust grade: Medium (archtest type-aware via g.Modules + the kerneldepgraph.Classifier longest-prefix owner resolution on each import edge; import-path strings come from the typed packages.Load, not a string anchor). A Hard form for the GENERIC "core ⊀ any satellite" shape is unreachable — Go's type system / package visibility cannot express "a package in module A must not import any package in module B" (same permanent ceiling as #851 / #893 / #1282). The Hard COMPLEMENT lands per concrete satellite at extraction time: a `.golangci.yml` depguard rule banning the satellite's import path from core packages is a path-level compile-fast gate. This generic archtest auto-covers every future satellite (including ones not yet enumerated in depguard); per-satellite depguard Hard-ization is tracked as the close-out task (gh #1590).

Blind spots (see cross_module_import_direction_test.go for the reverse self-checks): a base package reaching a satellite via a string-built import path (not a real edge) is not modeled — depgraph edges come from real packages.Load Imports, so a non-importing reference cannot create an edge.

func Canonical ¶

func Canonical(diags []Diagnostic) []Diagnostic

Canonical deduplicates diags and returns them sorted by (Rel, Line, Message), the same order Report and the golden harness use. Rules that accumulate diagnostics across multiple passes (e.g. a build-tag×N scan) use it to return a stable, duplicate-free slice from their importable Check* body.

func CheckAdapterReturnsDeclaredTypes ¶

func CheckAdapterReturnsDeclaredTypes(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckAdapterReturnsDeclaredTypes runs ADAPTER-RETURNS-DECLARED-TYPES-01 over the running module and returns its diagnostics (single source). It is the importable entry point: GoCell's TestAdapterReturnsDeclaredTypes calls it directly — no parallel rule body.

func CheckAfterCommitHookPureTransient ¶

func CheckAfterCommitHookPureTransient(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckAfterCommitHookPureTransient runs AFTERCOMMIT-HOOK-PURE-TRANSIENT-01 (A1+A2+A3) over the running module's production code and returns its diagnostics. cfg.BuildTags is passed to the production scan so files behind //go:build directives are covered.

This function is intentionally NOT registered in StandardCellRules(): rule A3's drain-caller allowlist names GoCell-internal TxRunner files, so running it against an external module's production code would false-positive on any TxRunner implementation outside that allowlist. GoCell's own dogfood calls this directly from TestAfterCommitHookPureTransient.

The B2/B3 blind-spot escape scan (scanRegisterAfterCommitEscapes) is intentionally absent here — it is the dedicated reverse self-check owned by TestAfterCommitHookPureTransient_BlindSpots_NoEscapeInProduction, not part of the forward rule enforcement.

func CheckAuditHashInputFrozenA2 ¶

func CheckAuditHashInputFrozenA2(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckAuditHashInputFrozenA2 verifies that within runtime/audit/ledger production source any call to crypto/hmac.New is located inside the body of the Protocol.ComputeHash method. The callee identification uses go/types via IsCallToPkgFunc, so import aliases cannot bypass the lock.

Not registered in StandardCellRules: see file godoc.

func CheckAuthAuthtestBoundary ¶

func CheckAuthAuthtestBoundary(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckAuthAuthtestBoundary runs AUTH-AUTHTEST-BOUNDARY-01 (sub-rules A + C) over the running module and returns its diagnostics. It is the importable rule body; GoCell's TestAuthAuthtestBoundary calls it directly — single source, no parallel rule body.

func CheckAuthKeystestBoundary ¶

func CheckAuthKeystestBoundary(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckAuthKeystestBoundary runs AUTH-KEYSTEST-IMPORT-BOUNDARY-01 (sub-rules A/B/C/D) over the running module and returns its diagnostics. It is the importable rule body; GoCell's TestAuthKeystestBoundary calls it directly — single source, no parallel rule body.

func CheckAuthPlanCellsMustNotConstructAuthPlans ¶

func CheckAuthPlanCellsMustNotConstructAuthPlans(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckAuthPlanCellsMustNotConstructAuthPlans enforces AUTH-PLAN-04 (LAYER-09): AuthPlan values (AuthJWT, AuthJWTFromAssembly, AuthMTLS, etc.) are composition-root concerns and must only be constructed in cmd/ and examples/. Cells and runtime (except runtime/bootstrap/ which is the wiring layer) must not instantiate the concrete types — that would couple business logic to listener topology decisions.

Scanned packages:

• all production packages under cells/ and runtime/ (the Production scope already excludes generated/)
• runtime/bootstrap/... is the authorized wiring layer and is skipped

Resolution model — typed (Hard upgrade, PR #615 review fix):

Both branches resolve the symbol's defining package via go/types (*types.Info.Uses / TypeOf), NOT via the AST package-qualifier identifier:

• Constructor calls (`foo.NewAuthJWT(...)`): Uses[sel.Sel] returns a *types.Func; we check fn.Pkg().Path() == authPlanPkgPath and fn.Name() in {NewAuth*}.

• Composite literals (`foo.AuthMTLS{}`, `AuthMTLS{}` inside the auth package itself): we walk the type-AST (SelectorExpr or Ident) to its *ast.Ident, look up Uses[ident] to get a *types.TypeName, and check tn.Pkg().Path() == authPlanPkgPath and tn.Name() in authPlanConstructorNames.

Why typed: parser-only + import-alias allowlist (the previous form) went vacuously empty after the kernel/cell → kernel/auth move because the check was `pkg.Name == "cell"`. Maintaining an explicit alias allow-list ({auth, kauth, …}) makes any new alias a silent bypass — the AI-robust gap the reviewer flagged. Resolving through go/types is alias-agnostic by construction: `import myauth "github.com/ghbvf/gocell/kernel/auth"` still resolves Uses[*ast.Ident{Name:"myauth"}] back to the kernel/auth package object whose Path() is authPlanPkgPath.

Blind spots (documented per ai-robust.md "工具选定后强制盲区自检"):

• reflective construction via reflect.New(reflect.TypeOf(auth.AuthMTLS{})) — the typed walk catches the auth.AuthMTLS{} composite literal, so this form is covered transitively.
• method values / function pointers (e.g. `f := auth.NewAuthJWT`) — the Uses[*ast.Ident] resolution still fires on the SelectorExpr.Sel of the RHS, so the rule still flags the assignment.
• dot-import (`import . "github.com/ghbvf/gocell/kernel/auth"` then `_ = AuthMTLS{}`) — the type-AST is then a bare *ast.Ident, and Uses[ident] still resolves to the kernel/auth *types.TypeName. Covered.
• cgo / unsafe-pointer construction — not expressible for sealed interface implementations like AuthPlan. Out of scope.

func CheckAuthPlanNoCellPolicyTypeUsage ¶

func CheckAuthPlanNoCellPolicyTypeUsage(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckAuthPlanNoCellPolicyTypeUsage enforces AUTH-PLAN-03: cell.Policy is a deleted type. Neither `cell.Policy{…}` composite literals nor `cell.Policy` identifier references should appear in any .go file.

func CheckAuthPlanNoLegacyPolicySelectorExpressions ¶

func CheckAuthPlanNoLegacyPolicySelectorExpressions(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckAuthPlanNoLegacyPolicySelectorExpressions enforces AUTH-PLAN-02: the seven deleted bootstrap.Policy* factory functions must not be referenced anywhere in the codebase. This catches accidental re-introduction of the old API.

func CheckAuthPlanNoLegacyPolicyStringLiterals ¶

func CheckAuthPlanNoLegacyPolicyStringLiterals(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckAuthPlanNoLegacyPolicyStringLiterals enforces AUTH-PLAN-01: the string values that were used as cell.Policy.Name discriminators ("jwt", "mtls", "service-token", "stack[") must not appear as bare string literals in production .go files outside the canonical allowlist.

Allowlisted files (see authPlanStringAllowlist) may contain these strings because they own the canonical Describe() definitions or use them as observability labels rather than dispatch keys.

func CheckAuthzMutationApplyFunnel01 ¶

func CheckAuthzMutationApplyFunnel01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckAuthzMutationApplyFunnel01 runs Rule (a) of AUTHZ-MUTATION-APPLY-FUNNEL-01: every call to domain.User.SetStatus or domain.User.SetPasswordResetRequired in non-test production code must originate from an enclosing FuncDecl whose canonical identity (types.Func.FullName) is listed in setMutatorCallsiteAllowlist.

func CheckBcryptCostFunnel01 ¶

func CheckBcryptCostFunnel01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckBcryptCostFunnel01 runs both A1 and A2 sub-rules of BCRYPT-COST-FUNNEL-01 over the running module and returns their combined diagnostics. It is the importable rule body and the single source for the rule: GoCell's TestBCRYPT_COST_FUNNEL_01 dogfoods it via Report(...), so the exact scan an external cell would import is the one GoCell enforces (no parallel rule body).

Not registered in StandardCellRules: allowlist is gocell-hardcoded with no ConfigForExternalCell consumer-extension → would false-red an external cell's own auth code; kept importable & module-path-agnostic but vacuous-green externally.

func CheckCASProtocolCompositionRoot01 ¶

func CheckCASProtocolCompositionRoot01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckCASProtocolCompositionRoot01 runs CAS-PROTOCOL-COMPOSITION-ROOT-01 over the running module and returns its diagnostics.

cas.NewProtocol may only be invoked from cmd/* (composition root) or runtime/state/cas/* (the package itself). Cells, runtime/* (non-cas), and adapters/* must receive an injected *cas.Protocol — not construct one.

cmd/ and examples/ are intentionally outside the scan scope:

• cmd/* is the composition root by definition.
• examples/* each carry their own composition root; allowing them mirrors the AUTH-PLAN-04 / LAYER-09 carve-out for example projects.

func CheckCapabilityProviderFunnel ¶

func CheckCapabilityProviderFunnel(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckCapabilityProviderFunnel enforces CAPABILITY-PROVIDER-FUNNEL-01: the shared-infra adapter constructors may only be called from cmd/corebundle/cap_wiring.go. Cell module files must consume the injected capability.PGProvider / capability.RedisProvider. It scans the running module's cmd/ production packages and returns the diagnostics it observes; GoCell's TestCapabilityProviderFunnel_CompositionRootOnly calls it directly — single source, no parallel rule body.

func CheckCelltestImportBoundary ¶

func CheckCelltestImportBoundary(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckCelltestImportBoundary enforces CELLTEST-IMPORT-BOUNDARY-01 (A/B/C) across the full module:

• A: no non-_test.go file (except celltest's own sources) imports celltest.
• B: no kernel/ file (except celltest itself and kernel/cell/ _test.go) imports celltest.
• C: no examples/ non-_test.go file imports celltest.

t.Fatalf is used only for infrastructure failures (collectGoFiles, parseImports, moduleImportPath). Violations are returned as []Diagnostic; callers use Report to surface them.

func CheckCelltestImportScope ¶

func CheckCelltestImportScope(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckCelltestImportScope enforces CELLTEST-IMPORT-SCOPE-01:

No production Go file (i.e. NOT *_test.go and NOT in a test-infrastructure directory) may import a package whose import path matches cells/[a-z]+/[a-z]+test$. Those packages are cell-level testutil packages and importing them from production code would embed test fixtures and t-bound helpers in a release binary, signaling a layering mistake.

The check is discovery-based: any new cells/{X}/{X}test/ package is automatically covered without further edits to this file.

t.Fatalf is used only for infrastructure load failures (collectGoFiles, parseImports, moduleImportPath). Violations are returned as []Diagnostic and never cause t.Errorf — callers use Report to surface them.

func CheckClockPositionalInjection ¶

func CheckClockPositionalInjection(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckClockPositionalInjection runs CLOCK-POSITIONAL-INJECTION-01 against the running module and returns its diagnostics. Does not call t.Errorf — callers funnel diagnostics through Report.

Not registered in StandardCellRules: see file godoc.

func CheckContractPathQueryCoverage01 ¶

func CheckContractPathQueryCoverage01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckContractPathQueryCoverage01 runs CONTRACT-PATH-QUERY-COVERAGE-01 over the running module and returns diagnostics. It does NOT call t.Errorf; the caller should funnel results through Report(t, "CONTRACT-PATH-QUERY-COVERAGE-01", ...).

Not registered in StandardCellRules: gocell-internal-layout funnel; vacuous- green/false-red in an external module; enforced in GoCell via TestContractPathQueryCoverage01.

func CheckContractPathQueryParamNameLiteral01 ¶

func CheckContractPathQueryParamNameLiteral01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckContractPathQueryParamNameLiteral01 runs CONTRACT-PATH-QUERY-PARAM-NAME-LITERAL-01 over the running module and returns diagnostics. It does NOT call t.Errorf; the caller should funnel results through Report(t, "CONTRACT-PATH-QUERY-PARAM-NAME-LITERAL-01", ...).

Not registered in StandardCellRules: gocell-internal-layout funnel; vacuous- green/false-red in an external module; enforced in GoCell via TestContractPathQueryParamNameLiteral01.

func CheckContracttestLoadByIDLiteral01 ¶

func CheckContracttestLoadByIDLiteral01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckContracttestLoadByIDLiteral01 runs CONTRACTTEST-LOADBYID-LITERAL-01 over the running module and returns diagnostics. It does NOT call t.Errorf; the caller should funnel results through Report(t, "CONTRACTTEST-LOADBYID-LITERAL-01", ...).

Not registered in StandardCellRules: gocell-internal-layout funnel; vacuous-green in an external module; enforced in GoCell via TestContracttestLoadByIDLiteral01.

func CheckCredentialAuthorityAssertFunnel01 ¶

func CheckCredentialAuthorityAssertFunnel01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckCredentialAuthorityAssertFunnel01 runs CREDENTIAL-AUTHORITY-ASSERT-FUNNEL-01 over the running module and returns its diagnostics.

This is the importable CellRule body. GoCell's own Test* functions in credential_authority_assert_funnel_test.go call the same detectors — single source, no parallel rule body.

The rule is intentionally NOT registered in StandardCellRules: it reasons about GoCell's own internal package layout (credentialauthority / domain / session slices), making it vacuous-green or false-red for an external module.

func CheckCredentialInvalidateApplierCanonical01 ¶

func CheckCredentialInvalidateApplierCanonical01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckCredentialInvalidateApplierCanonical01 runs CREDENTIAL-INVALIDATE-APPLIER-INTERFACE-CANONICAL-01: the Apply signature matching credentialinvalidate.Applier must only appear in the credentialinvalidate package.

func CheckCredentialInvalidateFunnel01 ¶

func CheckCredentialInvalidateFunnel01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckCredentialInvalidateFunnel01 runs CREDENTIAL-INVALIDATE-FUNNEL-01: session.Store.RevokeForSubject must only be called from the credentialinvalidate funnel or store implementations.

func CheckCredentialInvalidateUpstreamCaller01 ¶

func CheckCredentialInvalidateUpstreamCaller01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckCredentialInvalidateUpstreamCaller01 runs CREDENTIAL-INVALIDATE-UPSTREAM-CALLER-01: every reference to credentialinvalidate.(*Invalidator).Apply must originate from an enclosing FuncDecl listed in upstreamCallerCallsiteAllowlist.

func CheckCtxkeysPrincipalWriteCaller01 ¶

func CheckCtxkeysPrincipalWriteCaller01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckCtxkeysPrincipalWriteCaller01 runs CTXKEYS-PRINCIPAL-WRITE-CALLER-01 over the running module and returns its diagnostics. It is the importable rule body; GoCell's TestCtxkeysPrincipalWriteCaller01 calls it directly — single source, no parallel rule body.

Not registered in StandardCellRules: the allowlist is gocell-hardcoded (runtime/auth/middleware.go, kernel/outbox/principal.go); an external cell's own auth code would false-red.

func CheckDeadCodeCover ¶

func CheckDeadCodeCover(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckDeadCodeCover enforces DEAD-CODE-01: No production Go file may import a lifecycle: deprecated contract's generated package, nor contain a string literal equal to a deprecated contract.id. Today 0 deprecated → vacuous pass.

Not registered (register=none): gocell-internal-layout/schema funnel; vacuous-green/false-red in an external module; enforced in GoCell via TestDeadCodeCover.

func CheckDeadContractCover ¶

func CheckDeadContractCover(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckDeadContractCover enforces DEAD-CONTRACT-01: Every lifecycle: active contract.yaml must have an entry point appropriate for its kind.

Not registered (register=none): gocell-internal-layout/schema funnel; vacuous-green/false-red in an external module; enforced in GoCell via TestDeadContractCover.

func CheckDetailsSealedFieldFrozen01 ¶

func CheckDetailsSealedFieldFrozen01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckDetailsSealedFieldFrozen01 runs DETAILS-SEALED-FIELD-FROZEN-01 against the platform errcode package's PublicDetail/InternalDetail structs and returns its diagnostics.

Importable for GoCell dogfood / direct invocation, but intentionally NOT registered in StandardCellRules: it is a platform-source self-check, not a consumer-API rule. The reflect half inspects errcode.PublicDetail/InternalDetail — for a consumer that is the imported GoCell dependency type, which they cannot alter (tautological); the AST half (checkPublicDetailInvariants) parses pkg/errcode/details.go resolved under the CONSUMER module root via findModuleRoot, where that file does not exist → false-red in a clean external repo. It constrains GoCell's own errcode package shape, so it stays a GoCell-internal self-check enforced via TestDetailsSealedFieldFrozen01. See external.go's StandardCellRules godoc.

func CheckDistlockLockNotContext01 ¶

func CheckDistlockLockNotContext01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckDistlockLockNotContext01 verifies that *runtime/distlock.Lock does not implement context.Context. Returns anti-vacuity diagnostics when the Lock type or context.Context interface cannot be found, and a violation diagnostic when Lock implements the interface.

Not registered in StandardCellRules: see file godoc.

func CheckDomainAuthzFieldPrivate01 ¶

func CheckDomainAuthzFieldPrivate01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckDomainAuthzFieldPrivate01 runs DOMAIN-AUTHZ-FIELD-PRIVATE-01: domain.User must NOT expose exported fields named Status, PasswordResetRequired, or AuthzEpoch, and must NOT have exported setter methods matching the Set*/Mark*/Clear*/Lock*/Unlock* pattern beyond the two sanctioned ones (SetStatus / SetPasswordResetRequired).

func CheckEmitDeclCover ¶

func CheckEmitDeclCover(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckEmitDeclCover enforces EMIT-DECL-COVER-01: Every outbox.Emit call's topic arg const string must be declared in an active contract (event publisher or triggers entry) for the caller's cell. Non-const topic args also produce a diagnostic.

Not registered (register=none): gocell-internal-layout/schema funnel; vacuous-green/false-red in an external module; enforced in GoCell via TestEmitDeclCover.

func CheckErrcodeKindLiteralBanned ¶

func CheckErrcodeKindLiteralBanned(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckErrcodeKindLiteralBanned runs ERRCODE-KIND-LITERAL-01 over the running module and returns its diagnostics. It is the importable CellRule body wrapped by StandardCellRules; GoCell's TestErrcodeLiteralConstructionBanned calls it directly — single source, no parallel rule body.

func CheckErrcodeMessageConstLiteral ¶

func CheckErrcodeMessageConstLiteral(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckErrcodeMessageConstLiteral runs MESSAGE-CONST-LITERAL-01 over the running module and returns its diagnostics. It is the importable CellRule body wrapped by StandardCellRules. The default build config plus the consumer's cfg.BuildTags are scanned (see runErrcodeTypedScan) so a violation behind a `//go:build` directive in any repo is not missed.

func CheckErrorFirstAPI01 ¶

func CheckErrorFirstAPI01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckErrorFirstAPI01 runs ERROR-FIRST-API-01 over the enforced file list and returns its diagnostics. Importable for GoCell dogfood / direct invocation, but intentionally NOT registered in StandardCellRules: it is gated by the GoCell-specific errorFirstEnforcedFiles allowlist and so is vacuous-green in an external module (see external.go). Enforced in GoCell via TestErrorFirstAPI01.

func CheckErrorFirstTypedNil01 ¶

func CheckErrorFirstTypedNil01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckErrorFirstTypedNil01 runs ERROR-FIRST-TYPED-NIL-01 over the enforced file list and returns its diagnostics. Importable for GoCell dogfood / direct invocation, but intentionally NOT registered in StandardCellRules: it is gated by the GoCell-specific errorFirstEnforcedFiles allowlist and so is vacuous-green in an external module (see external.go). Enforced in GoCell via TestErrorFirstTypedNil01.

func CheckEvalPredicateCentralization01 ¶

func CheckEvalPredicateCentralization01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckEvalPredicateCentralization01 enforces TYPESEVAL-EVAL-PREDICATE-CENTRALIZED-01: every constraint.Expr.Eval callsite in tools/archtest/*_test.go (top-level package, excluding internal/ sub- packages) must pass either typeseval.BuildContextPredicate(...) (Form A) or an inline `func(_ string) bool { return false }` sentinel (Form B). It returns the diagnostics it observes; GoCell's TestEvalPredicateCentralization01 calls it directly — single source, no parallel rule body.

func CheckExportedErrorNew ¶

func CheckExportedErrorNew(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckExportedErrorNew runs EXPORTED-ERROR-NEW-01 over the running module and returns its diagnostics. It is the importable CellRule body wrapped by StandardCellRules. The default build config plus the consumer's cfg.BuildTags are scanned (see runErrcodeTypedScan) so an exported `Err* = errors.New(...)` behind a `//go:build` directive in any repo is not missed.

func CheckFenceTokenMintFunnel ¶

func CheckFenceTokenMintFunnel(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckFenceTokenMintFunnel enforces FENCE-TOKEN-MINT-FUNNEL-01.

Every reference to credentialfence.Mint outside an allowlisted path is a violation — not just a direct call, but any function-value capture or reflect arg as well (see scanFenceTokenMintRefs for the form-complete scan). Combined with the upstream type-system seal (unexported marker method on FenceToken) the only way to obtain a non-nil FenceToken is through Mint; constraining every reference to Mint therefore constrains every non-nil FenceToken's origin.

Scanner: ResolvePackageRef + EachInSubtree[ast.SelectorExpr]. credentialfence.Mint is a package-level function (not a method), so its reference is recorded in types.Info.Uses as a (PkgName, FuncName) pair — ResolveMethodCall would silently miss it (Selections only holds method selectors). The resolver returns the (pkgPath, name) tuple; a selector is a violation only when pkgPath == credentialfence package path and name == "Mint" — exact identity, no name-collision possible across packages, alias-immune.

RED fixture verification: testdata/fence_token_fixtures/external_mint_red/ is loaded separately and the scanner must detect all five reference forms (wantMin=5), proving the rule is form-complete and not a permanently-passing no-op (the reverse RED self-check mandated by ai-robust.md §"工具选定后强制盲区自检").

func CheckFixtureCellIDTypedBuilder ¶

func CheckFixtureCellIDTypedBuilder(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckFixtureCellIDTypedBuilder enforces FIXTURE-CELLID-TYPED-BUILDER-01 (A1): every kernel/metadata-typed cell-id field position must be sourced from metadatatest. It is the importable rule body — GoCell's TestFixtureCellIDTypedBuilder calls it via dogfood, single source.

func CheckGovernanceEmitterConstructorsNeverFuncValue ¶

func CheckGovernanceEmitterConstructorsNeverFuncValue(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckGovernanceEmitterConstructorsNeverFuncValue runs GOVERNANCE-RULE-EMITTER-CONSTRUCTORS-NEVER-FUNCVALUE-01 and returns diagnostics. It does NOT call t.Errorf.

Verifies that kernel/governance contains ZERO references to the emitter constructors (newError/newWarning/newScopedError/newErrorAt) that are not the direct callee of a call expression (i.e. no func-value indirections).

Not registered (register=none): gocell-internal-layout funnel; vacuous-green/ false-red in an external module; enforced in GoCell via TestGovernanceEmitterConstructorsNeverFuncValue.

func CheckGovernanceRuleCodeConstSingleSource ¶

func CheckGovernanceRuleCodeConstSingleSource(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckGovernanceRuleCodeConstSingleSource runs GOVERNANCE-RULE-CODE-CONST-SINGLE-SOURCE-01 and returns diagnostics. It does NOT call t.Errorf.

Every newError/newWarning/newScopedError/newErrorAt call in kernel/governance (excluding *_test.go and rulecodes.go) must pass a RuleCode-typed constant declared in rulecodes.go as its first argument. Every ValidationResult{} composite literal must use a RuleCode const from rulecodes.go as Code: value.

Not registered (register=none): gocell-internal-layout funnel; vacuous-green/ false-red in an external module; enforced in GoCell via TestGovernanceRuleCodeConstSingleSource.

func CheckGovernanceRuleCodeDetectBinding ¶

func CheckGovernanceRuleCodeDetectBinding(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckGovernanceRuleCodeDetectBinding runs GOVERNANCE-RULE-CODE-DETECT-BINDING-01 and returns diagnostics. It does NOT call t.Errorf.

For every entry in kernel/governance allRules, the Rule.Code value must appear as the first argument of at least one newError/newWarning/newScopedError/ newErrorAt call reachable from the entry's Detect method (BFS over same-receiver *Validator method calls).

Not registered (register=none): gocell-internal-layout funnel; vacuous-green/ false-red in an external module; enforced in GoCell via TestGovernanceRuleCodeDetectBinding.

AI-robust grading: Medium (type-aware archtest AST walk). Hard path does not exist — Rule.Code is structurally separate from the detect body's newError argument; no type-system mechanism can enforce their equality at compile time.

func CheckGovernanceRuleErrorFixField ¶

func CheckGovernanceRuleErrorFixField(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckGovernanceRuleErrorFixField runs GOVERNANCE-RULE-ERROR-FIX-FIELD-01 and returns diagnostics. It does NOT call t.Errorf.

Two properties:

1. Fix-arg non-empty: every finding-constructor call must pass a resolvable, non-empty remediation string as its LAST positional argument.
2. Construction funnel: no raw ValidationResult{} composite literal may appear in the governance package outside locator.go.

Not registered (register=none): gocell-internal-layout funnel; vacuous-green/ false-red in an external module; enforced in GoCell via TestGovernanceRuleErrorFixField.

func CheckGovernanceRulesRegistrationGuard ¶

func CheckGovernanceRulesRegistrationGuard(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckGovernanceRulesRegistrationGuard runs GOVERNANCE-RULES-REGISTRATION-GUARD-01 and returns diagnostics. It does NOT call t.Errorf.

Verifies set equality: declared == registered, where:

• declared = *Validator methods with signature func() []ValidationResult AND name prefix in {validate, checkDEP, checkCH}.
• registered = method names extracted from the allRules package-level var in rules_registry.go.

Not registered (register=none): gocell-internal-layout funnel; vacuous-green/ false-red in an external module; enforced in GoCell via TestGovernanceRulesRegistrationGuard.

AI-robust grading (INV-1):

• downstream Hard: every allRules Detect must resolve to a real *Validator method expression — a typo'd method expression fails to compile.
• upstream Medium: declared==registered set equality is archtest. The naming prefix {validate,checkDEP,checkCH} is a naming convention (Soft tier); the prefix filter is kept at the same tier as the pre-M3 validate* filter.

func CheckHandlerDeclCover ¶

func CheckHandlerDeclCover(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckHandlerDeclCover enforces HANDLER-DECL-COVER-01: Every concrete type in cells/* + examples/* that implements a generated contracts/http/.../Service interface must trace to an existing contracts/<id-path>/contract.yaml with lifecycle: active.

Not registered (register=none): gocell-internal-layout/schema funnel; vacuous-green/false-red in an external module; enforced in GoCell via TestHandlerDeclCover.

func CheckImplDeclCover ¶

func CheckImplDeclCover(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckImplDeclCover enforces IMPL-DECL-COVER-01: Production Go files under cells/<A>/... must not import packages from a different cell cells/<B>/... unless the import path is under cells/<B>/<B>test/ (the public test helper boundary).

Portable cell-architecture rule (cross-cell import boundary). NOT registered in StandardCellRules in this batch to preserve behavior-zero-change (registration adds new external-consumer runtime behavior beyond the module-path-agnostic migration); StandardCellRules registration is tracked holistically by epic #1302 (checklist item "凡适用外部仓库的规则进入 StandardCellRules()"). Enforced in GoCell via TestImplDeclCover.

func CheckKernelCellDoesNotImportRuntime ¶

func CheckKernelCellDoesNotImportRuntime(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckKernelCellDoesNotImportRuntime scans the kernel/cell package to confirm it imports neither runtime/* nor adapters/*. Returns diagnostics for each forbidden import found. Not registered in StandardCellRules (gocell-internal layout check, vacuous for external repos).

func CheckKernelCellRegistrarDefinedHere ¶

func CheckKernelCellRegistrarDefinedHere(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckKernelCellRegistrarDefinedHere confirms that the Registrar interface type is declared in kernel/cell (not aliased from another package). Not registered in StandardCellRules (gocell-internal layout check).

func CheckKernelClockLeafFallback ¶

func CheckKernelClockLeafFallback(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckKernelClockLeafFallback runs KERNEL-CLOCK-LEAF-FALLBACK-01 against the running module and returns its diagnostics. Does not call t.Errorf — callers funnel diagnostics through Report.

Not registered in StandardCellRules: see file godoc.

func CheckKernelClockResetRelativeProd ¶

func CheckKernelClockResetRelativeProd(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckKernelClockResetRelativeProd runs KERNEL-CLOCK-RESET-RELATIVE-PROD-01 against the running module and returns its diagnostics. Does not call t.Errorf — callers funnel diagnostics through Report.

Not registered in StandardCellRules: see file godoc.

func CheckMQTTClientIDNamespace ¶

func CheckMQTTClientIDNamespace(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckMQTTClientIDNamespace runs the MQTT-CLIENT-ID-NAMESPACE-01 A2+A3 scans (the A1 field-freeze is reflect-based and lives in the dogfood Test).

register=no — gocell-internal-layout (scans adapters/mqtt), NOT in StandardCellRules() and NOT promised to run externally — these dogfood-only rules target a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via the per-rule Tests).

func CheckMQTTReasonNameRedaction ¶

func CheckMQTTReasonNameRedaction(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckMQTTReasonNameRedaction runs the REASON-NAME-REDACTION-01 scan and returns its diagnostics.

register=no — gocell-internal-layout (scans adapters/mqtt), NOT in StandardCellRules() and NOT promised to run externally — this dogfood-only rule targets a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via the per-rule Tests).

func CheckMQTTTopicNamespace ¶

func CheckMQTTTopicNamespace(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckMQTTTopicNamespace runs the MQTT-TOPIC-NAMESPACE-01 A2+A3 scans (the A1 field-freeze is reflect-based and lives in the dogfood Test).

register=no — gocell-internal-layout (scans adapters/mqtt), NOT in StandardCellRules() and NOT promised to run externally — these dogfood-only rules target a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via the per-rule Tests).

func CheckMetadatatestImportScope ¶

func CheckMetadatatestImportScope(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckMetadatatestImportScope enforces METADATATEST-IMPORT-SCOPE-01: no production (.go non-_test.go) file may import metadatatest. It is the importable rule body — GoCell's TestMetadatatestImportScope calls it via dogfood, single source.

func CheckNoDeletedAuthSymbols01 ¶

func CheckNoDeletedAuthSymbols01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckNoDeletedAuthSymbols01 runs NO-DELETED-AUTH-SYMBOLS-01 over the running module and returns its diagnostics. It is the importable rule body; GoCell's TestNO_DELETED_AUTH_SYMBOLS_01 calls it directly — single source, no parallel rule body.

Not registered in StandardCellRules: allowlist is gocell-hardcoded with no ConfigForExternalCell consumer-extension → would false-red an external cell's own auth code; kept importable & module-path-agnostic but vacuous-green externally.

func CheckNotFoundTestStrict ¶

func CheckNotFoundTestStrict(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckNotFoundTestStrict enforces POSTGRES-NOTFOUND-TEST-OTHER-ERROR-MIXUP-ARCHTEST-01 module-wide and returns diagnostics for every violation found. The caller should pass the results to Report(t, "POSTGRES-NOTFOUND-TEST-OTHER-ERROR-MIXUP-ARCHTEST-01", diags).

func CheckOutboxHandleResultFactoryPreferred01 ¶

func CheckOutboxHandleResultFactoryPreferred01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckOutboxHandleResultFactoryPreferred01 enforces OUTBOX-HANDLERESULT-FACTORY-PREFERRED-01 downstream: production code (non-_test.go) in the running module must not construct outbox.HandleResult{...} composite literals outside the files in handleResultLiteralAllowlist.

It scans the running module's production code (Production → findModuleRoot), covering tag-gated files via cfg.BuildTags, and returns the diagnostics it observes. It does NOT call t.Errorf — the caller (Report / RunStandardCellRules) does that.

scanner.Canonical deduplicates the overlap between the default-tag pass and the tagged pass (identical to CheckScaffoldDerivedForceOverwrite's contract).

func CheckOutboxReconstructionCaller01 ¶

func CheckOutboxReconstructionCaller01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckOutboxReconstructionCaller01 enforces the FORWARD leg of OUTBOX-RECONSTRUCTION-CALLER-01: every production reference to outbox.UnmarshalEnvelope and (outbox.EntryScan).ToEntry must occur in a sanctioned site — a GoCell platform package (isGoCellPlatformPkgPath) whose module-relative path is listed in reconstructionFunnelAllowlist. This is the portable, externally-runnable half of the rule.

The REVERSE leg — anti-vacuity / no-stale-allowlist (every allowlisted file must still host a live reference) — is a GoCell-internal self-check (checkReconstructionAntiVacuity, exercised by the _test.go dogfood), NOT part of this Check: it reasons about GoCell's own allowlist hygiene, which is meaningless in an external consumer module.

It scans the running module's production code (Production → findModuleRoot), covering tag-gated files via cfg.BuildTags, and returns the diagnostics it observes without calling t.Errorf (the caller — typically Report or RunStandardCellRules — funnels diagnostics uniformly).

External Cell repo semantics: the allowlisted infra files live in GoCell's own adapters/runtime packages, not in a consumer's own source. A clean consumer module has zero references to either funnel in its own code → vacuous-green, no false positives.

func CheckOutboxTopicFailopen01 ¶

func CheckOutboxTopicFailopen01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckOutboxTopicFailopen01 enforces OUTBOX-TOPIC-FAILOPEN-01: an outbox.Entry composite literal whose Topic or EventType string constant matches one of the security-sensitive prefixes must not set FailurePolicy: outbox.FailurePolicyFailOpen.

It scans the running module's production code (Production → findModuleRoot), covering tag-gated files via cfg.BuildTags, and returns the diagnostics it observes. It does NOT call t.Errorf — the caller (Report / RunStandardCellRules) does that.

External Cell repo: this rule is deliberately NOT registered in StandardCellRules (see the OUTBOX-TOPIC-FAILOPEN-01 section of this file's package godoc). kernel/outbox.Entry is sealed — a populated outbox.Entry{...} composite literal outside kernel/outbox is a compile error (OUTBOX-ENTRY-SEALED-CONSTRUCTION-01) — so the production scan is vacuous in GoCell AND in any external repo; the rule's real coverage is the fixturetest/outbox fixtures, exercised by the dogfood sub-tests. This exported Check exists for that single-source fixture reuse + PlatformModulePath parameterization, NOT to gate external consumer production code.

func CheckPGRepoAmbientTx ¶

func CheckPGRepoAmbientTx(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckPGRepoAmbientTx enforces PG-REPO-AMBIENT-TX-01 module-wide and returns diagnostics for every violation found. The caller should pass the results to Report(t, "PG-REPO-AMBIENT-TX-01", diags).

R1/R2 are file-extension-scoped global predicates; R3/R4 are global predicates over all production files. See package godoc for full rule specification.

func CheckPGRepoApprovedSealed ¶

func CheckPGRepoApprovedSealed(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckPGRepoApprovedSealed enforces the pgrepoapproved.Approval interface seal and returns diagnostics for any violation. The caller should pass the results to Report(t, "PG-REPO-APPROVED-SEALED", diags). Seal violations are returned as []Diagnostic (via scanSealedInterface) rather than emitted with t.Errorf, so the whole rule routes through Report — file:line anchored, sorted, deduped.

func CheckPanicRegistered ¶

func CheckPanicRegistered(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckPanicRegistered runs PANIC-REGISTERED-01 over the running module and returns its diagnostics. It is the importable CellRule body wrapped by StandardCellRules; GoCell's TestPanicRegistered calls it directly so the gate has a single source. The scan SCOPE is the running module (resolved from its go.mod by Run(t, Typed(...))); cfg.BuildTags supplies the build tags for the second pass so panics behind the consumer's //go:build directives are scanned too.

The default build config is always scanned; when cfg.BuildTags is non-empty a second Run(t, Typed(...)) load covers files behind those tags, deduped by "rel:line:reason". GoCell's dogfood passes FlatNonDefaultTags(); an external repo passes its own production tags. See the long note in the prior TestPanicRegistered body / ADR 202605190000 §Alternatives for why a single union load is insufficient.

func CheckParserMatcherExamplesSymmetry01 ¶

func CheckParserMatcherExamplesSymmetry01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckParserMatcherExamplesSymmetry01 runs PARSER-MATCHER-EXAMPLES-SYMMETRY-01 over the running module and returns diagnostics. It does NOT call t.Errorf; the caller should funnel results through Report(t, "PARSER-MATCHER-EXAMPLES-SYMMETRY-01", ...).

Not registered in StandardCellRules: gocell-internal-layout funnel; vacuous- green/false-red in an external module; enforced in GoCell via TestParserMatcherExamplesSymmetry01.

func CheckPolicyRepoConformanceEnrollment01 ¶

func CheckPolicyRepoConformanceEnrollment01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckPolicyRepoConformanceEnrollment01 runs POLICYREPO-CONFORMANCE-ENROLLMENT-01 over the running module and returns its diagnostics.

This is the importable CellRule body. GoCell's own Test* functions in policy_repo_conformance_enrollment_test.go call the same detectors — single source, no parallel rule body.

The rule is intentionally NOT registered in StandardCellRules: it reasons about GoCell's own internal package layout (accesscore ports/conformance), making it vacuous-green or false-red for an external module.

func CheckProdClockInjection ¶

func CheckProdClockInjection(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckProdClockInjection runs PROD-CLOCK-INJECTION-01 against the running module and returns its diagnostics. Does not call t.Errorf — callers funnel diagnostics through Report.

Not registered in StandardCellRules: see file godoc.

func CheckProjectionApplyHookFunnel01 ¶

func CheckProjectionApplyHookFunnel01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckProjectionApplyHookFunnel01 enforces PROJECTION-APPLY-HOOK-FUNNEL-01 downstream: Coordinator.Subscribe in any production package may be called only from kernel/projection/ itself, _test.go files, or the single bootstrap projection drain (runtime/bootstrap/phases_projection.go).

It scans the running module's production code (Production → findModuleRoot), covering tag-gated files via cfg.BuildTags, and returns the diagnostics it observes.

External Cell repo semantics (this rule is registered in StandardCellRules): the sanctioned drain and kernel/projection/ live in GoCell's platform module, not in a consumer module — the rule degrades to a pure ban there. A clean external repo with no Coordinator.Subscribe calls is vacuous-green.

func CheckRMQChannelDestructionViaConn ¶

func CheckRMQChannelDestructionViaConn(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckRMQChannelDestructionViaConn runs the RMQ-CHANNEL-DESTRUCTION-VIA-CONN-01 production scan and returns all diagnostics.

cfg is unused: adapters/rabbitmq has no build-tagged production files, so a single default-config scan is complete.

register=no — gocell-internal-layout (scans adapters/rabbitmq), NOT in StandardCellRules() and NOT promised to run externally — these dogfood-only rules target a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via TestRMQChannelDestructionViaConn01).

func CheckRMQChannelMaxPerConn ¶

func CheckRMQChannelMaxPerConn(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckRMQChannelMaxPerConn runs the RMQ-CHANNEL-MAX-PER-CONN-01 production scan (sub-rules A/B/C) and returns all diagnostics.

cfg is unused: adapters/rabbitmq has no build-tagged production files, so a single default-config scan is complete.

register=no — gocell-internal-layout (scans adapters/rabbitmq), NOT in StandardCellRules() and NOT promised to run externally — these dogfood-only rules target a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via TestRMQChannelMaxPerConn01_*).

func CheckRMQPublisherFailureHandling ¶

func CheckRMQPublisherFailureHandling(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckRMQPublisherFailureHandling runs the RMQ-PUBLISHER-FAILURE-HANDLING-01 production scan (sub-rules A/B/C/D) and returns all diagnostics.

cfg is unused: adapters/rabbitmq has no build-tagged production files, so a single default-config scan is complete.

register=no — gocell-internal-layout (scans adapters/rabbitmq), NOT in StandardCellRules() and NOT promised to run externally — these dogfood-only rules target a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via TestRMQPublisherFailureHandling01_*).

func CheckRMQPublisherReleasesChannel ¶

func CheckRMQPublisherReleasesChannel(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckRMQPublisherReleasesChannel runs the RMQ-PUBLISHER-RELEASES-CHANNEL-01 production scan and returns all diagnostics.

cfg is unused: adapters/rabbitmq has no build-tagged production files, so a single default-config scan is complete.

register=no — gocell-internal-layout (scans adapters/rabbitmq), NOT in StandardCellRules() and NOT promised to run externally — these dogfood-only rules target a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via TestRMQPublisherReleasesChannel01).

func CheckRMQStopIntakeInflightWait ¶

func CheckRMQStopIntakeInflightWait(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckRMQStopIntakeInflightWait runs the RMQ-STOPINTAKE-INFLIGHT-WAIT-01 production scan and returns all diagnostics.

cfg is unused: adapters/rabbitmq has no build-tagged production files, so a single default-config scan is complete.

register=no — gocell-internal-layout (scans adapters/rabbitmq), NOT in StandardCellRules() and NOT promised to run externally — these dogfood-only rules target a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via TestRMQStopIntakeInflightWait01_*).

func CheckReconstituteUserCallerAllowlist01 ¶

func CheckReconstituteUserCallerAllowlist01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckReconstituteUserCallerAllowlist01 runs RECONSTITUTE-USER-CALLER-01 over the running module and returns its diagnostics.

This is the importable CellRule body. GoCell's own Test* functions in reconstitute_user_caller_allowlist_test.go call the same detectors — single source, no parallel rule body.

The rule is intentionally NOT registered in StandardCellRules: it reasons about GoCell's own internal package layout (accesscore domain/mem/postgres), making it vacuous-green or false-red for an external module.

func CheckRefreshAmbientTX01 ¶

func CheckRefreshAmbientTX01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckRefreshAmbientTX01 runs REFRESH-AMBIENT-TX-01 over the running module and returns its diagnostics. GoCell's own TestRefreshAmbientTX01 calls it directly — single source.

func CheckRefreshCrossStoreTX01 ¶

func CheckRefreshCrossStoreTX01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckRefreshCrossStoreTX01 runs REFRESH-CROSS-STORE-TX-01 over the running module and returns its diagnostics. GoCell's own TestRefreshCrossStoreTX01 calls it directly — single source.

func CheckRefreshInvalidIndexSingleSource01 ¶

func CheckRefreshInvalidIndexSingleSource01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckRefreshInvalidIndexSingleSource01 runs REFRESH-INVALID-INDEX-SINGLE-SOURCE-01 over the running module and returns its diagnostics. GoCell's own TestRefreshInvalidIndexSingleSource01 calls it directly — single source.

func CheckRefreshRevokeUserFunnel01 ¶

func CheckRefreshRevokeUserFunnel01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckRefreshRevokeUserFunnel01 runs REFRESH-REVOKE-USER-FUNNEL-01: refresh.Store.RevokeUser must only be called from the credentialinvalidate funnel or store implementations.

func CheckRequiredDepNilGuardA2 ¶

func CheckRequiredDepNilGuardA2(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckRequiredDepNilGuardA2 verifies that in every service.go (in slices/ or internal/ directories) whose Service struct has a gocell:"required" field, every NewXxx constructor calls validateRequired() exactly once, after the options loop, consuming the error canonically.

Not registered in StandardCellRules: see file godoc.

func CheckRequiredDepNilGuardA3 ¶

func CheckRequiredDepNilGuardA3(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckRequiredDepNilGuardA3 verifies that no hand-written service.go calls validation.IsNilInterface to guard a gocell:"required" field.

Not registered in StandardCellRules: see file godoc.

func CheckRequiredDepNilGuardA4 ¶

func CheckRequiredDepNilGuardA4(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckRequiredDepNilGuardA4 verifies that all gocell struct tag values in production source are in {"", "required"}.

Not registered in StandardCellRules: see file godoc.

func CheckSafeIDUpstreamFunnelHard01 ¶

func CheckSafeIDUpstreamFunnelHard01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckSafeIDUpstreamFunnelHard01 runs SAFEID-UPSTREAM-FUNNEL-HARD-01 over the running module and returns its diagnostics. It is the importable rule body; GoCell's TestSAFEIDUpstreamFunnelHard01 calls it directly — single source, no parallel rule body.

Not registered in StandardCellRules: allowlist is gocell-hardcoded with no ConfigForExternalCell consumer-extension → would false-red an external cell's own auth code; kept importable & module-path-agnostic but vacuous-green externally.

func CheckSafeIDWireMessageUsage01 ¶

func CheckSafeIDWireMessageUsage01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSafeIDWireMessageUsage01 runs SAFEID-WIREMESSAGE-USAGE-01 over the running module and returns its diagnostics. It is the importable rule body; GoCell's TestSAFEIDWireMessageUsage01 calls it directly — single source, no parallel rule body.

Not registered in StandardCellRules: allowlist is gocell-hardcoded with no ConfigForExternalCell consumer-extension → would false-red an external cell's own auth code; kept importable & module-path-agnostic but vacuous-green externally.

func CheckSagaConstructorNilGuard ¶

func CheckSagaConstructorNilGuard(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaConstructorNilGuard is the importable form of SAGA-CONSTRUCTOR-NIL-GUARD-01. Not registered in StandardCellRules.

func CheckSagaCoordinatorNoHeartbeatLoop ¶

func CheckSagaCoordinatorNoHeartbeatLoop(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaCoordinatorNoHeartbeatLoop is the importable form of SAGA-COORDINATOR-NO-HEARTBEAT-LOOP-01. It scans runtime/saga/ production files (excluding runtime/saga/executor/) for any .Heartbeat SelectorExpr whose receiver implements the Heartbeater-shape signature. Not registered in StandardCellRules (targets GoCell's own runtime/saga).

func CheckSagaDriveBehindLeaderGate ¶

func CheckSagaDriveBehindLeaderGate(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaDriveBehindLeaderGate is the importable form of SAGA-DRIVE-BEHIND-LEADER-GATE-01. Not registered in StandardCellRules.

func CheckSagaExecutorRandInjected ¶

func CheckSagaExecutorRandInjected(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaExecutorRandInjected is the importable form of SAGA-EXECUTOR-RAND-INJECTED-01. It scans runtime/saga/executor/ production files for package-level global rand calls. Not registered in StandardCellRules (targets GoCell's own runtime/saga/executor).

func CheckSagaGlobalReaderConformanceEnrollment ¶

func CheckSagaGlobalReaderConformanceEnrollment(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaGlobalReaderConformanceEnrollment is the importable form of SAGA-GLOBALREADER-CONFORMANCE-ENROLL-01. Not registered in StandardCellRules.

func CheckSagaJournalConformanceEnrollment ¶

func CheckSagaJournalConformanceEnrollment(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaJournalConformanceEnrollment is the importable form of SAGA-JOURNAL-CONFORMANCE-ENROLLMENT-01. It scans the running module for concrete journal.Journal implementations that lack a conformance suite call. Not registered in StandardCellRules (targets GoCell-internal journal impls).

func CheckSagaJournalHolderSeal ¶

func CheckSagaJournalHolderSeal(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaJournalHolderSeal is the importable form of SAGA-JOURNAL-HOLDER-SEAL-01. Not registered in StandardCellRules.

func CheckSagaMetricLabelValuesFrozen ¶

func CheckSagaMetricLabelValuesFrozen(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaMetricLabelValuesFrozen is the importable form of SAGA-METRIC-LABEL-VALUES-FROZEN-01. It covers the A2 callsite/assignment guard only: it enforces that no production code reaches a metric label via an inline literal or a raw string(reason) conversion. The A1 enum-value-set- frozen check (enumerating declared consts vs the sagaLabelEnumWant golden) is GoCell-internal (golden-bound via sagaLabelEnumWant) and intentionally stays in TestSagaMetricLabelValuesFrozen01, not exported. Not registered in StandardCellRules.

func CheckSagaSlogInstanceFieldsCaller ¶

func CheckSagaSlogInstanceFieldsCaller(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaSlogInstanceFieldsCaller is the importable form of SAGA-SLOG-INSTANCE-FIELDS-CALLER-01. It runs both sub-checks:

• A1: guarded keys (instance_id, lease_id) must only appear inside the sagalog.InstanceFields carrier body (scanSagaSlogInstanceFieldsFile).
• B4: slog.Attr composite literals with guarded keys are banned outside the carrier body (scanSagaSlogAttrLiteralsFile).

Not registered in StandardCellRules.

func CheckSagaStepCompensatePure ¶

func CheckSagaStepCompensatePure(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaStepCompensatePure is the importable, registered form of SAGA-STEP-COMPENSATE-PURE-01. It scans the running module's production code and enforces the COMPLETE invariant (not just the direct forbidden-call scan), so an external Cell repo gets the same escape-hatch guards GoCell dogfoods:

• A1: CompensateFunc bodies must not call forbidden persistent interfaces (outbox.Writer, outbox.Emitter, persistence.TxRunner, *sql.Tx, pgx.Tx).
• B1: a CompensateFunc literal body must not exceed sagaMaxCompensateStmts top-level statements (long bodies can hide helper-indirected side effects).
• B2: no reflect MethodByName dispatch inside a CompensateFunc body.
• B3: a CompensateFunc value must not be passed as a function argument (outside the sanctioned safeRunCompensate transport funnel).

Consumer-scan contract (matches the other registered CellRules, e.g. errcode): it scans the consumer's DEFAULT build config first, then re-scans with cfg.BuildTags when non-empty, de-duplicating by (Rel, Line, Message). This catches a violation behind a //go:build tag without false-red on tag-only files, and a false-green on default-build files that a hardcoded foreign tag union would miss. GoCell's dogfood passes FlatNonDefaultTags() as cfg.BuildTags.

Registered in StandardCellRules.

func CheckSagaStepRunOutsideTx ¶

func CheckSagaStepRunOutsideTx(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSagaStepRunOutsideTx is the importable form of SAGA-STEP-RUN-OUTSIDE-TX-01. Not registered in StandardCellRules.

func CheckScaffoldDerivedForceOverwrite ¶

func CheckScaffoldDerivedForceOverwrite(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckScaffoldDerivedForceOverwrite enforces SCAFFOLD-DERIVED-FORCEOVERWRITE-01 downstream: pathsafe.DerivedOverwrite in any production package may be referenced only as a direct call from planDerivedArtifact (tools/codegen/cellgen/stage_render.go). It scans the running module's production code (Production → findModuleRoot), covering tag-gated files via cfg.BuildTags, and returns the diagnostics it observes.

External Cell repo semantics (this rule is registered in StandardCellRules): the sanctioned planDerivedArtifact site lives in GoCell's own cellgen and does not exist in a consumer module, so the allowlist never matches there — the rule degrades to a PURE BAN. That is intended: pathsafe.DerivedOverwrite is a GoCell platform-internal codegen primitive with no valid use in external Cell code; a clean external repo simply has zero references (vacuous-green).

func CheckScaffoldListenerMarkerTypedConst ¶

func CheckScaffoldListenerMarkerTypedConst(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckScaffoldListenerMarkerTypedConst enforces SCAFFOLD-LISTENER-MARKER-TYPED-CONST-01: it verifies the cellgen.ListenerMarker typed const and the scaffold-cell template's use of {{.ListenerMarker}}, returning the diagnostics it observes.

func CheckSecurityDefaults ¶

func CheckSecurityDefaults(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckSecurityDefaults runs SEC-FAIL-CLOSED-02..10 and returns all violations as []Diagnostic, each message prefixed with its precise sub-rule id (so the aggregate surface stays self-describing even when an external caller Reports the whole slice under one id). The dogfood TestSecurityDefaults instead Reports each sub-rule separately for native per-id output. It does not call t.Errorf; callers use Report to surface the result. t.Fatalf is used only for infrastructure load failures.

SEC-FAIL-CLOSED-01 is skipped (retired; see security_defaults_test.go).

func CheckSeedRoleIface01 ¶

func CheckSeedRoleIface01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckSeedRoleIface01 runs SEED-ROLE-IFACE-01 over the running module and returns its diagnostics. It scans every production .go file (entire module, excluding _test.go, generated, vendor, worktrees, testdata, internal/mem itself) and reports any file that imports cells/accesscore/internal/mem AND references mem.RoleRepository in any AST position. It is the importable rule body; GoCell's TestSEED_ROLE_IFACE_01 calls it directly — single source, no parallel rule body.

func CheckServiceownedHandlerOwnerCheck01 ¶

func CheckServiceownedHandlerOwnerCheck01(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckServiceownedHandlerOwnerCheck01 runs B1+B2+B3 predicates of SERVICEOWNED-HANDLER-OWNER-CHECK-01 against the running module and returns diagnostics. It does NOT call t.Errorf; the caller should funnel results through Report(t, "SERVICEOWNED-HANDLER-OWNER-CHECK-01", ...).

Not registered in StandardCellRules: gocell-internal-layout funnel; vacuous-green/false-red in an external module; enforced in GoCell via TestSERVICEOWNED_HANDLER_OWNER_CHECK_01.

func CheckSessionProtocolCompositionRoot01 ¶

func CheckSessionProtocolCompositionRoot01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSessionProtocolCompositionRoot01 runs SESSION-PROTOCOL-COMPOSITION-ROOT-01 over the running module and returns its diagnostics.

session.NewProtocol may only be invoked from cmd/* (composition root) or runtime/auth/session/* (the package itself + storetest helpers). Cells, runtime/* (non-session), adapters/*, and tests outside session/* must receive an injected *session.Protocol — not construct one.

cmd/ and examples/ are intentionally outside the scan scope:

• cmd/* is the composition root by definition — wiring authority owns session.NewProtocol construction.
• examples/* each carry their own composition root; allowing them mirrors the AUTH-PLAN-04 / LAYER-09 carve-out for example projects.

func CheckSessionrefreshNoSessionCreate01 ¶

func CheckSessionrefreshNoSessionCreate01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSessionrefreshNoSessionCreate01 runs SESSIONREFRESH-NO-SESSION-CREATE-01 over the running module and returns its diagnostics. GoCell's own TestSessionrefreshNoSessionStoreMutation_01 calls it directly — single source.

func CheckSvctokenCallerCellRequired01 ¶

func CheckSvctokenCallerCellRequired01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckSvctokenCallerCellRequired01 runs SVCTOKEN-CALLER-CELL-REQUIRED-01 over the running module and returns its diagnostics: every call to auth.GenerateServiceToken must pass a valid cell-ID string literal as its second argument (callerCell). It is the importable rule body; GoCell's TestSVCTOKEN_CALLER_CELL_REQUIRED_01 dogfoods it directly — single source, no parallel rule body.

Not registered in StandardCellRules: allowlist is gocell-hardcoded with no ConfigForExternalCell consumer-extension → would false-red an external cell's own auth code; kept importable & module-path-agnostic but vacuous-green externally.

func CheckTagGroupLoopForbidsTypedRun ¶

func CheckTagGroupLoopForbidsTypedRun(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckTagGroupLoopForbidsTypedRun runs TAGGROUP-LOOP-FORBIDS-TYPED-RUN-01 against tools/archtest/*_test.go (direct children only) and returns its diagnostics. GoCell's TestTagGroupLoopForbidsTypedRun calls this directly — single source, no parallel rule body. cfg.BuildTags is threaded into the scan's TypedOpts.Tags so files behind build directives are not missed.

NOTE: This is a META rule — it governs how the archtest package itself uses typed-scope Run and KnownNonDefaultTags, so its scan scope is internal to GoCell (tools/archtest). It is intentionally NOT added to StandardCellRules() because external Cell repos do not contain archtest code; the rule would be vacuously green (empty scan set) and provide no value to external consumers. The symbol is exported only so the rule library is uniformly addressable — an external repo that calls it directly is likewise vacuously green, since the scan target ./tools/archtest/... does not exist outside GoCell. cfg is consumed for BuildTags only; the scan scope is fixed to GoCell's own archtest package.

func CheckTestwaitExternalReasonLiteral ¶

func CheckTestwaitExternalReasonLiteral(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckTestwaitExternalReasonLiteral enforces TEST-POLLING-EXTERNAL-REASON-LITERAL-01 module-wide and returns diagnostics for every violation found. The caller should pass the results to Report(t, "TEST-POLLING-EXTERNAL-REASON-LITERAL-01", diags).

Two-load coverage (mirror PANIC-REGISTERED-01 plumbing): Load 1 (tags=nil) catches reverse build directives; Load 2 (FlatNonDefaultTags) catches all forward-tagged files in one union. Test-variant load (Tests:true) included in both so *_test.go callers of testwait.External are scanned.

func CheckUserAuthzEpochBumpFunnel01 ¶

func CheckUserAuthzEpochBumpFunnel01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckUserAuthzEpochBumpFunnel01 runs USER-AUTHZ-EPOCH-BUMP-FUNNEL-01: ports.UserRepository.BumpAuthzEpoch must only be called from the credentialinvalidate funnel or repository implementations.

func CheckUserRepoConformanceEnrollment01 ¶

func CheckUserRepoConformanceEnrollment01(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckUserRepoConformanceEnrollment01 runs USERREPO-CONFORMANCE-ENROLLMENT-01 over the running module and returns its diagnostics.

This is the importable CellRule body. GoCell's own Test* functions in user_repo_conformance_enrollment_test.go call the same detectors — single source, no parallel rule body.

The rule is intentionally NOT registered in StandardCellRules: it reasons about GoCell's own internal package layout (accesscore ports/conformance), making it vacuous-green or false-red for an external module.

func CheckWebhookHMACFunnel ¶

func CheckWebhookHMACFunnel(t *testing.T, _ ConfigForExternalCell) []Diagnostic

CheckWebhookHMACFunnel runs the WEBHOOK-HMAC-FUNNEL-01 production scan (A1/A2/A3/B6) and returns all diagnostics.

cfg is unused: kernel/webhook has no build-tagged production files, so a single default-config scan is complete.

register=no — gocell-internal-layout (scans kernel/webhook), NOT in StandardCellRules() and NOT promised to run externally — this dogfood-only rule targets a package an external repo lacks, so a manual ExtraRules caller does not get a clean pass; migrated for unified PlatformModulePath parameterization + fork-safety, dogfooded via TestWebhookHMACFunnel).

func CheckYAMLQuoteFunnel ¶

func CheckYAMLQuoteFunnel(t *testing.T, cfg ConfigForExternalCell) []Diagnostic

CheckYAMLQuoteFunnel runs YAML-QUOTE-FUNNEL-01 over the running module's production code and returns its diagnostics. GoCell's TestYAMLQuoteFunnel calls it directly (single source, no parallel rule body). cfg.BuildTags is wired into the TypedOpts.Tags for the production scan.

Deliberately NOT registered in StandardCellRules: the rule only constrains conversions of the gocell-internal pkg/yamlsafe.Scalar type, so it is vacuous for an external Cell repo that never imports yamlsafe. It stays importable (non-test file, single source) for the dogfood Test, but external_repo wiring is out of scope — see external.go StandardCellRules godoc + M3 issue #1302.

func Run ¶

func Run(t testing.TB, scope RunScope, rule Rule) []Diagnostic

Run is the single rule-dispatch entry point. It executes rule over scope and returns the union of every rule invocation's diagnostics; pass the slice to Report with a rule ID. The t parameter is testing.TB (a *testing.T satisfies it) so the StandaloneModule fatal-path spy tests can drive Run with a tbFatalSpy.

scope selects the mode and source. Scope quick-pick:

• No go/types needed (pure AST) → AST
• Need go/types over the main module → Typed
• Same as Typed but generated/ excluded (hand-written-source rules) → Production
• Loading archtest_fixture-tagged fixture packages → Fixture
• Standalone testdata module with its own go.mod → StandaloneModule

All failure modes (nil scope, nil rule, module-root not found, load error, parse error, non-absolute StandaloneModule dir) fail-loud via t.Fatalf.

Typed rules read pass.TypesInfo (and pass.Pkg) for resolution; AST-only helpers (EachInSubtree etc.) work unchanged on pass.Files in either mode.

func AST ¶

func AST(fs Scope) RunScope

AST wraps the file-enumeration Scope fs into a dispatch RunScope for AST-only rule execution. Run parses every file in fs into ONE shared token.FileSet and constructs ONE Pass containing all parsed files; Pass.Pkg and Pass.TypesInfo are nil.

For rules that need go/types resolution, use Typed; for production-only loads (generated/ excluded), Production; for standalone fixture modules, StandaloneModule.

func Fixture ¶

func Fixture(opts FixtureOpts, patterns []string) RunScope

Fixture builds a typed RunScope over packages tagged with the archtest_fixture build tag. It is the typed funnel for fixture-package archtest loading; all fixture-load sites across archtest *_test.go MUST use Run(t, Fixture(...), rule). The framework-internal exceptions are limited to files in passFunnelPermanentExempt (pass_funnel_test.go, pass_test.go, archtest_test.go in tools/archtest/), which call typeseval.SharedResolver directly because they implement or directly test the funnel machinery and cannot be expressed through Pass without circular dependency — see pass_funnel_test.go's passFunnelPermanentExempt godoc for the structural justification.

The archtest_fixture build tag is supplied exclusively by the Run dispatch for a fixtureRunScope (pass.go) — not by this constructor's caller. The unified Run accepts testing.TB; the fixture scope has no spy fatal-path requirement, so no caller distinction is needed. See ADR 202605141519 §Migration path Stage 4.

AI-robust (funnel double-lock):

• Outward Hard (business callers, downstream funnel side): FixtureOpts has no Tags field, and the unified Run takes a sealed RunScope (no tag parameter at all) — there is no public surface that carries a build tag.
• Cross-package Form D Hard (type system, #944): fixtureBuildTag is unexported, so business code outside package archtest cannot feed it to a loader — a compile error, not an archtest finding.
• Upstream Hard (façade bypass closure): PASS-FUNNEL-FIXTURE-TAG-01 archtest rejects any (callee, arg) pair where the callee resolves to a loader (archtest.runTypedWithRoot, or typeseval.SharedResolver / LoadPackages / LoadProductionPackages) AND any arg subtree contains an Expr that EvaluateConstString resolves to "archtest_fixture", OR an *ast.Ident bound (same file) to a slice literal carrying such an Expr. This catches the raw literal / same-pkg const Ident / BinaryExpr const-concat / same-file var-binding forms uniformly via the helper's resolution lattice (archtest-bound (callee, arg) form-uniqueness — isomorphic to charter §Hard 范本 第 2 条 panic(panicregister.Approved) form; see pass_funnel_test.go diagsFixtureTagBypass godoc for full evidence + accepted Blind spots).
• Inward Medium (framework internal): the field set of FixtureOpts itself is frozen by TestRun_Fixture_FixtureOptsLacksTagsField via reflect assertion (NumField == 1, sole field "Tests" of kind Bool) — drift here is a test failure, not a compile error.

func Production ¶

func Production(opts TypedOpts) RunScope

Production builds a typed RunScope over the main module's production package set ONLY — every package whose import path is under <module>/generated/ is excluded by the constructor. Choosing Production IS the typed choice that makes generated/ exclusion non-bypassable: a Pass it yields can never contain a generated/ file, and there is no patterns argument to widen the set.

"Production" here means GENERATED-excluded, NOT test-excluded: opts.Tests is still honored, so Production(TypedOpts{Tests: true}) loads each package's test variant (its *_test.go files) just like Typed — the "ONLY" qualifier is about the generated/ filter, not about *_test.go. Use Tests: false for a hand-written-non-test walk; Tests: true to also see test files.

Use this for rules that reason over hand-written source and must never observe codegen output (false-positive risk + duplicated declarations). It is the Pass-model successor of typeseval.LoadProductionPackages / ProductionResolver: the generated/ filter is applied by the driver, NOT by a per-callsite `if pass.IsGenerated(f) { continue }` discipline (which an author can forget — a Hard→Soft regression).

AI-robust: downstream Hard (scanning generated/ output is not expressible through this scope — a Pass it yields never contains a generated/ file). Upstream Medium (honest caveat): a rule author can still write Run(t, Typed(opts, []string{"./..."}), rule) + a manual pass.IsGenerated(f) skip per file; that form compiles and runs. The Hard "upstream" property (violation unrepresentable at the call site) is not achievable without sealing the Typed scope, which would break fixture-module and partial-scan rules. See PASS-PRODUCTION-UPSTREAM-HARD-01 (#722) for the upstream Hard candidate; this constructor does not, on its own, close that gap.

func StandaloneModule ¶

func StandaloneModule(dir string, opts TypedOpts, patterns []string) RunScope

StandaloneModule builds a typed RunScope loading patterns from the standalone module rooted at dir. dir must be an absolute path to a directory containing its own go.mod (a fixture module isolated from the main module). Patterns are resolved relative to dir.

This is the correct scope for rules that target intentional-violation fixtures in testdata/: those fixtures intentionally import or call constructs that production archtest rules forbid, and must therefore live in a separate module so they do not pollute the main module's build.

Pass.Rel returns paths relative to dir (the fixture module root), not the main module root — so "usage.go" rather than "tools/archtest/testdata/.../usage.go".

AI-robust: Hard — the three-line Hard defense is preserved unchanged:

• Defense #1: Pass.Pkg is still *types.Package (not *packages.Package); rule authors cannot reach .Syntax or reconstruct INV-1 cross-load bugs.
• Defense #2: depguard bans archtest *_test.go from directly importing golang.org/x/tools/go/packages; Run is the approved funnel.
• Defense #3: meta-archtest PASS-FUNNEL-LOADPACKAGES-01 bans direct typeseval.LoadPackages and typeseval.SharedResolver calls; the Run driver is the only approved entry for fixture-module loads.

ref: golang.org/x/tools go/analysis/analysistest/analysistest.go (analysistest.Run receives dir string as the module root for the test programs; same pattern applied here for isolated fixture modules).

func Typed ¶

func Typed(opts TypedOpts, patterns []string) RunScope

Typed builds a typed RunScope loading patterns once through the process-wide typeseval.SharedResolver cache from the main module root. Run invokes rule with one Pass per loaded package — Files dedup'd via *ast.File pointer identity across the regular and ".test" synthetic variants.

For loading a standalone testdata fixture module (one with its own go.mod), use StandaloneModule instead.

func DirsScope ¶

func DirsScope(modRoot string, dirs []string, opts ...ScopeOption) Scope

DirsScope creates a Scope limited to dirs (relative to modRoot). See scanner.DirsScope for the full contract.

func ModuleScope ¶

func ModuleScope(modRoot string, opts ...ScopeOption) Scope

ModuleScope creates a Scope rooted at modRoot that walks the entire module, skipping the default directory set: vendor, testdata, worktrees, generated, .git, node_modules.

func ExcludeRels ¶

func ExcludeRels(rels ...string) ScopeOption

ExcludeRels returns a ScopeOption that excludes specific module-relative file paths from the scope's file set. Slash-separated; post-Clean matching.

func IncludeGenerated ¶

func IncludeGenerated() ScopeOption

IncludeGenerated allows the walk to descend into "generated" directories. Use for repo-wide rules whose invariant must also bind codegen output.

func IncludeTestdata ¶

func IncludeTestdata() ScopeOption

IncludeTestdata allows the walk to descend into "testdata" directories. Legal only when paired with DirsScope dirs containing a "testdata" segment.

func IncludeTests ¶

func IncludeTests() ScopeOption

IncludeTests returns a ScopeOption that includes *_test.go files in the scope's file set.

func MatchRels ¶

func MatchRels(pred func(rel string) bool) ScopeOption

MatchRels returns a ScopeOption that retains only files whose module-relative slash path satisfies pred. Composes AND with default skip + ExcludeRels.