CortexBuild — Foundational Rule Pack (v0.1 outline)¶

This is the catalogue of rules in the foundational pack. Each rule's full body will be extracted/written during Phase 0.

The pack divides into 3 sections:

1. Engineering Hygiene (10 rules)¶

ID	Severity	Applies to	What it enforces
`rule-parameterized-sql`	critical	builder, pr-reviewer	No string-concat SQL; type casts on user input
`rule-secrets-handling`	critical	builder, security	No secrets in code; KMS/Vault/env only
`rule-audit-logging`	high	builder, security	Permission-affecting mutations write audit entry in same tx
`rule-rbac-registry`	high	planner, builder	New role/permission → registered in SSoT
`rule-pii-classification`	high	planner, security	New PII column → classified + retention + permission gate
`rule-tenant-isolation`	critical	builder, security	Multi-tenant rows scoped by tenant_id in every query
`rule-canonical-hostnames`	high	builder	Env-driven hostnames; never hard-code infra domains
`rule-schema-migration-safety`	high	builder	Migrations: reversible, no long locks, online-only
`rule-dependency-vulnerability-gate`	high	pr-reviewer	New deps scanned via OSV/Snyk; CVEs block merge
`rule-cost-budget-gate`	medium	orchestrator	Per-task / per-project LLM spend gates

ID	Severity	Applies to	What it enforces
`rule-phase-sequence`	high	orchestrator	Wave model; Tester ∥ Security ∥ Optimizer parallel
`rule-plan-confirmation`	high	planner	Stop after plan.md for medium+ risk plans
`rule-critic-gate`	high	orchestrator, planner	Critic runs between Planner and Builder for medium+ risk
`rule-pre-mortem`	high	planner, critic	plan.md needs ≥3 concrete failure modes
`rule-source-citation`	high	all agents	Repo-behavior claims cite file:line
`rule-self-audit-on-complete`	high	all agents	task_complete needs `self_audit:` YAML
`rule-requirement-completeness`	high	planner	Every user requirement maps to API + Frontend + DB tasks
`rule-computed-field-fanout`	medium	planner	Derived fields returned by ALL endpoints that show them
`rule-test-evidence`	high	pr-reviewer	PR body needs compile/build/test outputs
`rule-contract-parity`	high	pr-reviewer	Schema ↔ API ↔ DB ↔ Frontend verified
`rule-rollback-readiness`	high	pr-reviewer	High-risk PR documents reverse migration + prior tag
`rule-stale-branch-guard`	critical	orchestrator	Preflight: branch not behind main for touched paths
`rule-progress-heartbeat`	medium	all agents	Emit progress every ≤90s
`rule-read-only`	high	explore, critic	These agents never edit/run state-mutating commands
`rule-token-efficient-search`	medium	all agents	Graph → LSP → glob → grep order
`rule-repo-specific-paths`	medium	planner	No generic "the API layer"; cite exact paths

ID	Severity	Applies to	What it enforces
`rule-recurrence-ledger-consult`	high	all agents	Read ledger at session start; surface relevant open guards
`rule-feedback-loop-mandatory`	critical	orchestrator	User-reports-same-class-recurrence → STOP backlog, add guard
`rule-postmortem-input-required`	high	recurrence-guard	Need postmortem file path + fix diff to act
`rule-skill-extraction`	medium	pr-reviewer	Approved PRs with reusable patterns → propose skill
`rule-draft-only-no-merge`	critical	recurrence-guard	Recurrence-guard never merges; user reviews draft PR

ID	Severity	Applies to	What it enforces
`rule-responsive-layout`	medium	builder, tester	Validated at 375/768/1440
`rule-accessibility-wcag-aa`	medium	builder, tester	Contrast, keyboard nav, semantic markup
`rule-multi-surface-contract`	high	builder, pr-reviewer	API + SDK + CLI + MCP parity (whichever apply)
`rule-build-time-env-baking`	high	builder	Env vars baked at build, not runtime, are documented

ID	Severity	Applies to	What it enforces
`rule-index-evidence`	medium	optimizer	New index needs EXPLAIN ANALYZE showing ≥20% cost reduction
`rule-websocket-throttle`	high	builder, optimizer	WS producers throttled; 10× load test
`rule-autoscaler-trigger-required`	critical	builder, optimizer	Auto-scaled service has at least one scaling trigger

Located in CortexBuild-core/rules/adaptive/. Brownfield analyser turns these on:

ID	Enabled when...
`rule-mobile-first`	Mobile framework (Expo, React Native, Flutter, native iOS/Android) detected
`rule-edge-parity`	Multiple deployment tiers detected (cloud + edge runtime)
`rule-multi-region`	Terraform `region` variable detected with > 1 value, or multi-region IaC
`rule-ml-pipeline`	ML training detected (PyTorch / TensorFlow / scikit-learn imports + training script)
`rule-realtime-fan-out`	WebSocket / SSE routes detected in > 5% of API surface
`rule-multi-tenant`	`tenant_id` / `org_id` / `workspace_id` columns detected across schema
`rule-event-sourced`	Event-store pattern detected (event_log table, append-only)
`rule-microservices`	> 5 services with independent deploy pipelines detected

Generated per-project. Examples:

Pattern detected	Inferred rule
87% of API routes use `@with_error_handling` decorator	`rule-inferred-error-handling-decorator`
All controllers extend `BaseController`	`rule-inferred-base-controller`
All tests use `fixtures/` directory with specific naming	`rule-inferred-test-fixture-convention`
All migrations include `down()` method	`rule-inferred-reversible-migrations`
All Pydantic models inherit from custom `BaseModel`	`rule-inferred-pydantic-base`
All API routes return `{success: bool, data: ..., error: ...}` envelope	`rule-inferred-response-envelope`

User confirms / discards each inferred rule. Confirmed ones become enforced; discarded ones logged so analyser doesn't re-suggest.

Goal: severity skewed to high so most rules block merge; critical reserved for "production data could be corrupted."