| Manifest shape validation |
enforced |
@cellfence/schema and @cellfence/engine |
Draft 2020-12 manifest, baseline, and resource-evidence JSON Schemas are package subpath exports; TypeScript validators remain authoritative for cross-record semantic checks such as cell references and duplicate contract IDs |
JSON Schema parity fixtures and cellfence check |
| Duplicate cell ID detection |
enforced |
@cellfence/engine |
Detects IDs inside one manifest file |
invalid fixture |
| Owned path overlap detection |
partially_enforced |
@cellfence/engine |
Literal prefix overlap is segment-aware; arbitrary glob intersection remains conservative |
invalid fixture and API regression tests |
| Strict governed-source ownership |
enforced |
@cellfence/engine with manifest.governance.requireOwnership |
Enforces that included source files are owned by a cell and imports cannot target governed unowned source; governed symlinks must resolve inside the owning cell; cellfence init enables it, while disabled coverage emits a warning for compatibility |
strict ownership and symlink fixtures |
| Public entry and artifact ownership |
enforced |
@cellfence/engine |
Public entries and optional publicPaths must be covered by the declaring cell's ownedPaths; non-external artifact lanes must also be covered, while external lanes document runtime/output paths outside source ownership; glob containment is conservative |
ownership fixtures |
| Private cross-cell import rejection |
enforced |
@cellfence/engine |
Static analysis only; ES imports, export-from edges, TypeScript import = require(...), selected CommonJS require forms (require, module.require, simple aliases), and selected createRequire(...) aliases are analyzed; computed dynamic imports and computed require() calls are fail-closed errors under the built-in required-rule profile; NodeNext runtime .js specifiers and tsconfig path aliases, including extends, are resolved before boundary checks |
invalid fixture |
| Undeclared consumer rejection |
enforced |
@cellfence/engine |
Applies to repository-local cells |
invalid fixture |
| Public entry existence |
enforced |
@cellfence/engine |
One primary public entry per cell; optional publicPaths can expose additional public sub-entry paths |
invalid fixture and publicPaths regression tests |
| Public symbol match |
enforced |
@cellfence/engine |
Export forms are limited to common TypeScript declarations/named exports and common Python __all__ or top-level declarations |
invalid fixture and Python fixtures |
| Artifact lane declaration |
enforced |
@cellfence/engine |
File path lanes only in v0.x |
invalid fixture |
| Static resource contract declaration |
partially_enforced |
@cellfence/engine |
Detects selected string-literal file, SQL table, queue/topic, HTTP patterns, Node fs read/write/destructive calls, Prisma delegates, TypeORM entities/repositories/query builders, Drizzle table operations, string-literal query builders, BullMQ, KafkaJS, NestJS routes, Fastify routes, FastAPI routes, Django URLConf/model manager calls, SQLAlchemy query/table calls, and Celery task/publish calls; general dynamic dataflow is not inferred; this repository's self-manifest keeps every built-in resource adapter enabled |
valid and invalid resource fixtures plus npm run cellfence:self-check |
| Adapter-scoped resource detection |
partially_enforced |
@cellfence/engine |
ORM, query builder, HTTP-framework, and broker-client coverage is per adapter; unsupported libraries require a dedicated adapter or runtime evidence |
adapter fixtures and documentation |
| Unresolved resource access fail-closed |
enforced |
@cellfence/engine |
Unsafe raw SQL, selected dynamic SQL assembly, known SQL receivers with non-literal arguments, dynamic HTTP URL calls, TypeORM query-builder dynamic tables, and Drizzle dynamic table arguments fail instead of becoming silent blind spots |
invalid dynamic SQL, HTTP, and adapter fixtures |
| Runtime resource evidence |
enforced |
@cellfence/schema, @cellfence/engine, and cellfence evidence check |
Requires explicit evidence JSON; CellFence does not observe live infrastructure by itself |
evidence fixtures and CLI tests |
| Runtime trace hook |
partially_enforced |
@cellfence/trace |
Node.js fs read/write and fetch tracing plus explicit database/HTTP/queue helper records in v0.x; source-code module loading is ignored |
trace tests |
| External dependency policy |
enforced |
@cellfence/engine and baseline metrics |
npm package roots and Python import roots are observed through the resolver; claim violations override baseline grandfathering, unclaimed additions are ratcheted, and locked cells reject dependency-set expansion |
external dependency fixtures |
| Plugin API v1 |
enforced |
@cellfence/plugin-api and @cellfence/engine |
Programmatic rules and adapters are supported through checkRepository({ plugins }); manifest plugins and extends are rejected in v0.x instead of being silently ignored |
plugin API tests |
| Official rule plugins |
enforced |
@cellfence/plugin-agent-budget, @cellfence/plugin-blast-radius, @cellfence/plugin-legacy-strangler, @cellfence/plugin-quants-trend, @cellfence/plugin-geo-purity, and @cellfence/plugin-dependency-sovereignty |
Programmatic Plugin API packages; CLI manifest auto-loading is intentionally not enabled in v0.x |
official plugin tests |
| Official reporter plugin |
enforced |
@cellfence/reporter-economy-matrix |
Renders architecture flow summaries; it is visualization, not an enforcement substitute |
official plugin tests |
| Official adapter packages |
partially_enforced |
@cellfence/adapter-call-pattern and @cellfence/adapter-opentelemetry |
Declarative call-pattern adapter handles static call forms; OpenTelemetry converter imports supplied spans but does not collect traces by itself |
official plugin tests |
| Rule severity policy |
enforced |
@cellfence/schema and @cellfence/engine |
Repository, cell, path override, and CLI severity settings are supported; built-in core rules and manifest requiredRules cannot be weakened below error |
plugin API tests |
| Resource access baseline inventory |
enforced |
@cellfence/engine baseline metrics |
Captures selected static and supplied runtime evidence inventory; arbitrary ORM and broker coupling remain outside v0.x inference |
baseline resource fixtures |
| Baseline ratchets |
enforced |
@cellfence/engine |
New baselines store accepted cell IDs, ownership sets, public entry paths, public symbol sets, isolated declaration-derived public surface hashes, dependency edges, artifact contracts, resource inventory, and external dependency inventory; public signature mismatch messages do not print the replacement hash; legacy count fields remain for compatibility |
baseline fixture tests |
| Baseline seal |
enforced |
@cellfence/engine and cellfence baseline create/check/update/sign/verify |
Ed25519 signatures are supported for asymmetric baseline authorization; HMAC remains available for isolated verifier setups; hand-edited files fail when a verifier is configured; locked cells require a configured verifier during baseline check |
CLI tests |
| Locked baseline update protection |
enforced |
@cellfence/engine and cellfence baseline update |
Enforces locked cells across count metrics, contract sets, isolated declaration-derived public surface hashes, resource inventory, and external dependency inventory; locked resource contracts are context and diagnostic contract metadata in v0.x |
CLI tests |
| Agent context projection |
enforced |
@cellfence/engine and cellfence context |
Projects manifest and baseline state; it does not grant permissions or approve contract expansion |
CLI tests |
| Agent auto-allocation projection |
enforced |
@cellfence/engine and cellfence context --auto-allocate |
Heuristic task-to-cell matching from manifest text; empty selections require a human-selected cell or clearer task |
CLI tests |
| Agent instruction installer |
enforced |
cellfence install |
Writes checksumed managed blocks for AGENTS.md or CLAUDE.md; install --check fails on missing, stale, hand-edited, or duplicated unmanaged fence instructions |
CLI tests |
| MCP agent server |
enforced |
cellfence serve --mcp |
Exposes context, changed-check, claim creation, and finding explanation tools over stdio JSON-RPC; it is a tool surface, not an external authorization boundary |
CLI tests |
| Agent claim leases |
enforced |
@cellfence/engine and cellfence claim create/check/list |
Uses a JSON claim store, defaulting to .cellfence/claims.json; local claim create writes are serialized with a lock file and atomic rename; cross-machine coordination still depends on a reliable shared claim store |
CLI tests |
| Coupling graph output |
enforced |
@cellfence/engine and cellfence graph |
Emits observed and declared coupling as JSON or Mermaid; visualization is not an enforcement substitute |
CLI tests |
| Diagnostic explanations |
enforced |
@cellfence/engine JSON findings |
Findings explain observed facts, applied contracts, judgments, and unverified items; normal diagnostics omit remediation patches, replacement imports, manifest additions, and baseline-update suggestions |
CLI tests |
| Stable finding fingerprints |
enforced |
@cellfence/engine JSON findings |
Fingerprints ignore human message text and are used by changed-finding diffs and audit summaries |
engine and CLI tests |
| Changed findings diff |
enforced |
@cellfence/engine and cellfence check --changed |
Uses a temporary Git worktree on a base-cache miss and compares stable finding fingerprints; only finding-free base results are cacheable, and identity binds the base commit, engine/schema implementation, Node/TypeScript/Python runtime, policy paths, severity configuration, and explicit plugin identity |
CLI and engine API tests |
| History replay research harness |
partially_enforced |
scripts/history-replay-study.mjs and precision evidence scripts |
Replays exact before/after commits and introduced finding fingerprints without target installs or scripts; reviewed reuse-before rows can be sealed as precision-candidate evidence, but raw replay findings still require event labels, external manifest attestations, and normal claim gates before precision or upstream-defect claims |
history replay, evidence bundle, preflight, and claim tests |
| History replay mechanism smoke |
enforced |
scripts/history-replay-smoke.mjs |
Builds a local exact-commit replay fixture and verifies introduced private-import plus baseline replay findings without relying on external repositories |
history replay smoke tests |
| Public-surface replay mechanism smoke |
enforced |
scripts/public-surface-replay-smoke.mjs |
Builds local public-surface drift fixtures, reuses the before reviewed copy manifest after the drift, and seals a CELLFENCE_PUBLIC_SYMBOL_MISMATCH rule-scoped next-cycle packet; it is synthetic mechanism validation, not public-OSS precision evidence |
public-surface replay smoke tests |
| Mutation injection research harness |
enforced |
scripts/mutation-injection-study.mjs |
Creates reviewed synthetic repositories and injects known violations to measure controlled recall of expected rules; it is not public-OSS precision or recall evidence |
mutation injection script tests |
| Precision evidence pipeline smoke |
enforced |
scripts/precision-pipeline-smoke.mjs |
Builds a local reviewed-manifest corpus report, freezes a bundle, injects independent labels, validates hashes, and expects an insufficient-evidence claim decision for the tiny sample |
precision pipeline smoke tests |
| Precision frontier report |
enforced |
scripts/precision-frontier-report.mjs |
Ranks remaining evidence gaps and candidate pools; raw precisionEligible findings are candidate material only, externally attested/labeled findings are forwarded to claim preflight rather than counted as claim evidence, and the work plan reports rule sample deficits, repository-balance dilution, external-label gaps, and external-manifest-attestation gaps without promoting agent-only evidence |
frontier report tests and Round33 artifact |
| Precision evidence gap worklist |
enforced |
scripts/precision-evidence-gap-worklist.mjs |
Converts failed claim preflights into explicit handoff tasks, including gate-failure manifest-attestation gaps and bundle-enriched manifest copy SHA256 templates; it does not create labels, attestations, or claim evidence |
gap worklist tests and Round34 projection |
| External manifest attestation worklist |
enforced |
scripts/precision-manifest-attestation-worklist.mjs |
Builds sealed per-subject manifest-review assignment packages from an evidence bundle, including manifest copy paths and SHA-256 values but no reviewer-created evidence; output directories must be separate from the sealed bundle and force replacement only deletes marked worklists |
manifest attestation worklist tests |
| External manifest attestation validation |
enforced |
scripts/precision-manifest-attestations-validate.mjs |
Validates returned human/organization manifest-review attestations against a sealed evidence bundle and can write an updated reviewed corpus only after every required subject attestation matches the sealed manifest copy hash; with --worklist, returned reviewer attestations must also match the sealed per-subject assignment set, returned worklistArtifactSetSha256 must be present and match the supplied sealed reviewer packet, and --expected-worklist-artifact-set-sha256 pins validation to the intended packet from the operator side; it rejects agent/Codex-style reviewer identities and does not create external evidence |
manifest attestation validator tests |
| Precision protocol worklist binding |
enforced |
scripts/precision-bind-worklists.mjs |
Hash-binds sealed label worklists back into claim protocols after worklist generation, avoiding manual protocol/worklist digest drift while preserving the sealed assignment-package filter binding |
protocol binding tests and Round33 preflight |
| Rule-scoped precision next cycle |
enforced |
scripts/precision-next-cycle.mjs |
Freezes supplemental worklists for a declared subset of included rules while preserving the full sealed bundle; rule-scoped packets do not satisfy broader all-rule claims without a new protocol, worklist, labels, and preflight |
precision next-cycle tests |
| Reviewed corpus gate |
enforced |
scripts/reviewed-corpus-validate.mjs |
Rejects infer and unreviewed copy manifests for blocking-precision claims; it validates corpus eligibility, not repository correctness |
reviewed corpus validator tests and precision pipeline smoke |
| Precision label readiness |
enforced |
scripts/precision-labels-validate.mjs |
Requires sampled precision-eligible findings to have independent labels, and conflicting labels to have a separate adjudicator; returned labels may self-identify the sealed assignment packet with worklistArtifactSetSha256, which is rejected if it does not match the supplied worklist, and label readiness/preflight/claim reports surface returned-label digest binding coverage as return-evidence provenance rather than precision evidence; statistical sufficiency remains the claim evaluator's job |
label readiness tests and precision pipeline smoke |
| Precision label transfer strict mode |
enforced |
scripts/precision-label-transfer.mjs |
Stable-finding label transfer can require canonical claim metadata before writing transferred labels; strict claim transfer requires a target sealed worklist and rebinds carried labels to it so stale assignment IDs, evidence package IDs, worklist digests, or mismatched target-bundle digests are not promoted into a claim label file |
label transfer tests |
| Evidence graph verifier |
enforced |
scripts/evidence-graph-verify.mjs, cellfence check --evidence-graph, and scripts/evidence-graph-smoke.mjs |
Validates graph schema, canonical ordering, node/edge references, finding witnesses, and file anchors; v1 also verifies required witness facts for a limited supported rule set, while unsupported rules are reported without being counted as policy verified; changed-file checks do not emit full graph artifacts |
evidence graph verifier, CLI, and corpus harness tests |
| Signed waiver attestations |
enforced |
@cellfence/engine and cellfence waivers list |
Source comments must reference attestation:<id>; external HMAC attestations bind repository, HEAD, source hash, file, line, rule, finding fingerprint, expiry, and approver allowlist; source approved-by is rejected as self-claimed metadata |
waiver allowlist and CLI tests |
| Waiver request/sign flow |
enforced |
@cellfence/engine and cellfence waivers request/sign |
Request generation emits an unsigned attestation template and never edits source; signing requires a trusted HMAC secret and refuses required-rule or over-90-day exceptions |
CLI tests |
| Expiring waivers |
enforced |
@cellfence/engine and cellfence waivers list |
Line-local source comments only; missing expiry, expiry beyond 30 days, missing or weak approver identity, concrete-rule wildcard, or missing reason fails the check; governance.requiredRules findings remain unwaivable |
CLI tests |
| Waiver request generation |
enforced |
@cellfence/engine and cellfence waivers request |
Generates approval text only; it never edits source or grants an exception by itself |
CLI tests |
| TypeScript/JavaScript source analysis |
enforced |
@cellfence/engine |
Static imports, export-from edges, TypeScript import = require(...), selected CommonJS require forms, and exported namespaces are recognized; parser diagnostics, computed imports, and computed CommonJS require() calls are reported as unsupported fail-closed findings under the built-in required-rule profile; public surface hashes are isolated declaration-output fingerprints, not full TypeScript semantic-versioning proofs |
fixture tests |
| Python source analysis |
partially_enforced |
@cellfence/engine |
.py files are governed source; imports, public surface, and selected Django/FastAPI/SQLAlchemy/Celery resource patterns are extracted with Python ast; module-level imports count as public module attributes unless hidden or constrained by __all__; unsupported syntax and template-like Python files are fail-closed findings; absolute imports resolve through manifest-derived roots plus common pyproject.toml, setup.cfg, and static setup.py package roots; arbitrary Python framework plugin behavior and dataflow remain outside v0.x static inference |
Python import, packaging-inference, public-surface, framework-resource, unsupported-syntax fixtures, and OSS Python onboarding pilot |
| External resolution and SARIF oracles |
enforced |
scripts/*-oracle-conformance.mjs |
TypeScript, Python, and official SARIF comparisons cover declared local fixture families; unsupported semantic families are explicit not_comparable results rather than agreement |
npm run conformance:oracles and CI |
| Product corpus evidence |
enforced |
scripts/product-evidence-corpus.mjs and scripts/github-corpus-collector.mjs |
Exact-commit collection and no-install execution record robustness, scale, and comparison candidates; findings remain unlabeled and do not establish precision |
injected API, local corpus, and safety tests |
| Adversarial evidence replay |
enforced |
scripts/adversarial-evidence-verify.mjs |
Replays pinned local fixtures and emits bypass candidates without modifying tests; witness metadata is submitted evidence, not independent human validation |
adversarial evidence verifier tests |
| CLI exit codes |
enforced |
cellfence package |
Internal errors are grouped under exit code 3 |
CLI tests |
| Human-readable, Markdown, JSON, and SARIF output |
enforced |
cellfence package |
Markdown is optimized for PR comments; SARIF maps CellFence findings to code-scanning results without changing enforcement semantics |
CLI tests |
| Coverage visibility report |
enforced |
cellfence coverage and @cellfence/engine |
Reports unresolved imports, resources, and public-surface observations; it is diagnostic and does not grant exceptions |
coverage tests |
| Baseline governance gate |
enforced |
cellfence baseline gate and packages/github-action-baseline-gate |
CLI compares baseline files or refs; bundled private Action labels/comments PRs and checks baseline-owner approval, while required-check configuration remains external |
baseline gate tests |
| GitHub Actions support |
partially_enforced |
.github/workflows and action wrappers |
Required-check configuration must be set externally; workflow actions are pinned to commit SHAs with tag comments; packages/github-action invokes the published CLI with npx; packages/github-action-baseline-gate runs a bundled detector; release verification fails if the CLI wrapper's version input drifts from the package version; CI includes Linux Node 20, Node 22 smoke tests for Linux/macOS/Windows, Linux Node 24 smoke tests, and a ReDoS regression check; uncovered coverage:100 deficits are recorded by ci-counts but are not yet a required gate |
workflow files, release verification, and self-check |
| Commit identity hygiene |
enforced |
.mailmap, scripts/git-identity-verify.mjs, and scripts/forbidden-source-scan.mjs |
Release verification rejects placeholder local author configuration and requires non-destructive mailmap coverage for legacy placeholder commit emails; the provenance scan includes .mailmap and only allows placeholder email text in valid remap lines; it does not rewrite pushed history |
git identity, forbidden-source, and release verification tests |
| Semantic workflow-control detector v3.2 |
partially_enforced |
@cellfence/engine reference detector and research fixtures |
Dependency-free reference implementation freezes workflow deletion and suppression replacement behavior; full YAML-aware protected-path enforcement is a follow-up |
tests/workflow-controls.test.mjs and research freeze docs |
| npm package smoke verification |
enforced |
scripts/pack-smoke.mjs and CI pack-smoke job |
Uses local tarballs to validate npm install, CLI execution, README/LICENSE inclusion, and forbidden generated metadata exclusion before registry publish |
npm run pack:smoke |
| CODEOWNERS |
documented |
.github/CODEOWNERS |
Enforcement requires repository settings |
root-of-trust document |
| Protected branches |
documented |
external repository settings |
Not enforceable by repository files alone |
root-of-trust document |
| External immutable checker |
planned |
external service or pinned workflow |
Not implemented in v0.x |
root-of-trust document |
| Sealed hash ledger |
planned |
external ledger |
Not implemented in v0.x |
root-of-trust document |
| Credential separation |
documented |
external repository and npm settings |
Not enforceable by package code |
root-of-trust document |
| npm trusted publishing |
partially_enforced |
.github/workflows/npm-publish.yml, npm Trusted Publisher settings, and GitHub protected environment |
Manual workflow defaults to dry_run=true, requires a matching v* tag ref, explicit confirmation for real publish, and the protected npm-publish environment; the configured publish set uses npm Trusted Publisher settings, while first-time scoped packages stay out until their ownership path is approved |
docs/publishing.md and release workflow |
| npm provenance attestations |
partially_enforced |
npm trusted publishing or token-based npm publish --provenance fallback |
Trusted publishing is the configured publish path for the current publish set; registry provenance should be verified after each release and token fallback must use explicit provenance |
docs/publishing.md |
| SBOM generation |
enforced |
scripts/sbom-generate.mjs |
Generates a CycloneDX SBOM from the lockfile into ignored reports/; release attachment remains a maintainer action |
npm run sbom:generate |
| GitHub Release artifacts |
documented |
GitHub Release UI or CLI |
Release creation and artifact attachment require maintainer action after CI passes |
docs/publishing.md |
| Provenance or forbidden-source scan |
enforced |
scripts/forbidden-source-scan.mjs |
Term list is conservative and project-owned |
lint and CI |
| Scale benchmark |
enforced |
scripts/scale-benchmark.mjs and CI scale-benchmark job |
Synthetic hardlinked-file benchmark for 10k/20, 50k/100, and 100k/300 scenarios; not a substitute for consumer-repo profiling |
CI benchmark |