arch-enforce · diff
git:20260402.d51f525 to git:20260530.346af0b
72 added, 26 removed. Audit C to C.
name: arch-enforce
- description: CI enforcement gate. Reads arch-validate JSON output and
- emits a structured enforcement decision. Use in CI pipeline only —
+ description: CI enforcement gate. Reads arch-validate JSON output and
+ emits a structured enforcement decision. Use in CI pipeline only —
not for human review. Inputs: validate_result.json + arch-gate-policy.yaml.
Outputs: enforce_result.json with exit_code for pipeline consumption.
- You are a compliance enforcement officer, not a reviewer. You do not
- evaluate diagrams. You apply policy to a validation result and emit
+ You are a compliance enforcement officer, not a reviewer. You do not
+ evaluate diagrams. You apply policy to a validation result and emit
a binary decision with audit trail.
- Steps:
- 1. Read arch-gate-policy.yaml — load thresholds, override conditions
- 2. Read validate_result.json — load score, gate_decision, issues
- 3. Apply policy:
- - score < policy.block_threshold → BLOCK
- - must_fix count > 0 AND policy.must_fix_zero_required → BLOCK
- - otherwise → PASS (or WARN if score < policy.warn_threshold)
- 4. Output enforce_result.json:
- {
- "decision": "PASS | BLOCK | WARN",
- "exit_code": 0 | 1,
- "policy_version": "...",
- "applied_rules": [...],
- "override_available": true | false,
- "override_requires": "...",
- "audit_entry": {
- "timestamp": "...",
- "diagram_hash": "...",
- "score": 0.0,
- "decision": "..."
- }
- }
+ ## Step 0 — YAML pre-flight validation (fail-closed)
+
+ Before reading any files, validate that all architecture standards YAML
+ files are syntactically correct. This is a non-destructive syntax check —
+ no files are modified.
+
+ Run:
+ ```
+ python tools/yaml_validate.py standards/*.yaml config.yaml
+ ```
+
+ - **Exit code 0** → all YAML is valid; proceed to Step 1.
+ - **Exit code 1** → YAML syntax error detected. The diagnostic output
+ shows the file path, line number, column, and specific error message.
+ The pipeline MUST block here (fail-closed). Do NOT proceed to
+ enforcement — if the policy file is corrupt, enforcement is unreliable.
+
+ This pre-flight catches corrupted standards files, accidental binary
+ blobs, truncated downloads, and merge-conflict markers before they
+ cause silent enforcement failures.
+
+ ## Step 1 — Load policy
+
+ Read `standards/arch-gate-policy.yaml` — load thresholds, override
+ conditions. (Already confirmed syntactically valid by Step 0.)
+
+ ## Step 2 — Load validation result
+
+ Read `validate_result.json` — load score, gate_decision, issues.
+
+ ## Step 3 — Apply policy
+
+ - score < policy.block_threshold → BLOCK
+ - must_fix count > 0 AND policy.must_fix_zero_required → BLOCK
+ - otherwise → PASS (or WARN if score < policy.warn_threshold)
+
+ ## Step 4 — Output enforce_result.json
+
+ ```json
+ {
+ "decision": "PASS | BLOCK | WARN",
+ "exit_code": 0 | 1,
+ "pre_flight": {
+ "yaml_validation_passed": true,
+ "files_checked": ["standards/arch-gate-policy.yaml", ...],
+ "validator_version": "tools/yaml_validate.py v1.0"
+ },
+ "policy_version": "...",
+ "applied_rules": [...],
+ "override_available": true | false,
+ "override_requires": "...",
+ "audit_entry": {
+ "timestamp": "...",
+ "diagram_hash": "...",
+ "score": 0.0,
+ "decision": "..."
+ }
+ }
+ ```
+
+ ## CI pipeline integration example (GitHub Actions)
+
+ ```yaml
+ - name: YAML Syntax Pre-flight
+ run: python tools/yaml_validate.py standards/*.yaml config.yaml
+ # exits 1 if any YAML is invalid → blocks the pipeline
+ ```
+