Parent: structure
"Mechanical constraint over social argument" made literal. It has grown from a handful of linters into 55 check-* entries under infra/scripts/ — 45 guards plus 10 self-tests (counted 2026-09-07) — all behind one make lint (fastest-checks-first). make lint is what CI and the pre-push hook run (266c9c945, 2026-09-06, lefthook.yml); pre-commit is partitioned by subproject — one glob-gated block per container, so a commit pays only for what it touched, with check-secrets and env-lint always on (487c8412c, 2026-09-06). They fall into five families:
1 · Structure — the two convergence points. Everything a capability can do, and everything it can ask back for, passes through exactly one place each; the kernel holds no capability and cannot unseal. Six gates, mostly ratchets. → convergence-inbound-and-outbound
2 · Layering. go-arch-lint component arrows; check-domain-acyclic (the domain graph must be acyclic); check-domain-facade-boundary (a domain's implementation is reachable only through its facade); check-domain-layering (DDD order inside each faceted domain); check-routes-not-imported (routes are the topmost layer); check-infra-not-domain; check-internal-dirs (only three kinds of directory exist under internal/). → domain-facade-and-ddd-layout, backend-domain-modules
3 · Shape, not just arrows. check-routes-cyclo ≤ 3 — faces and facades may only declare and delegate; check-boundary-thin (53733b661, 2026-08-01 — a facade may hold only aliases and re-exports, and the dispatcher may hold no json-tagged struct or schema literal); check-max-lines; no-nil-container (collections return empty, never nil); fieldalignment. Cyclomatic complexity cannot see a boundary growing a second copy of the domain's shapes, so shape is gated directly.
4 · One source per UI primitive. Twelve gates: one dropdown, one text input, one scrim, one section heading, one empty state, one z-scale, three time formats, one corpus href — plus sm-* classes must exist, no interpolation in Tailwind arbitrary values, no OS-drawn file picker, and a clipped preview must signal continuation. → one-source-per-ui-primitive
5 · What we ship, and what we say. check-knobs-reachable (every knob the product reads must be settable on the stack we ship — a knob that exists in code and is unreachable from a deployment is not a knob); check-redis-bounded; check-search-index-shipped; check-secrets (nothing leaves the machine); check-no-raw-http (all outbound HTTP through internal/httpx); check-connector-boundary (credentials never leave the vault); backend-no-mock; check-doc-make-targets (a make X printed in docs must run); check-tool-paths-exist; check-instructions-name-sure-tools (a capability's standing instructions may not name a tool that might be absent); check-no-impl-words-at-visitor; check-css-parses; check-i18n-keys (every locale carries every key); check-verify-items (the real-env audit ledger stays well-formed). Two joined after 2026-08-30: check-microsite-imports-declared (bd45353f4, 2026-08-31; renamed with the microsites rename e7fe80e91 — every @standmeet/* package the panel advertises must really be vendored in builder/vendor/) and check-prod-ports-bound-local (fc841f41f, 2026-09-01 — after a pentest found db / redis / minio published on 0.0.0.0, every internal port in the shipped compose must bind 127.0.0.1).
And ten more that attack the other forty-five — plant the forbidden thing, assert red, remove it. → a-gate-that-cannot-go-red
Same instinct as this vault's own pre-commit hooks — and the engineering of the owner's gatekeeper-not-driver philosophy: make the illegal state unrepresentable, don't argue about it in review. The honest caveat is granularity: a gate coarser than the thing it forbids removes working behaviour too, and CI stays green while it does (one-source-per-ui-primitive).