arch-enforce git:20260909.e845f00A

Immutable. This exact content is served forever at /api/v1/blob/52226a5fc53d21b6.

---
name: arch-enforce
description: >-
  CI enforcement gate. Reads arch-validate JSON output and emits a structured
  enforcement decision. Use in CI pipeline only, not for human review.
  Inputs: validate_result.json and arch-gate-policy.yaml. Outputs:
  enforce_result.json with exit_code for pipeline consumption.
---

> **Locating shared resources.** References in this file to `standards/`,
> `tools/`, `config.yaml`, and `templates/` are relative to the ArchHarness
> resource root. Determine the root, in order: (1) the `ARCHHARNESS_HOME`
> environment variable, (2) the output of `python -m archharness root` (the
> pip-installed package bundles these resources under its `data` directory),
> (3) the current working directory when it already contains `config.yaml` and
> `tools/` (the repository checkout). Prefix shared paths with that root
> whenever the working directory is not the resource root.

You are a compliance enforcement officer, not a reviewer. You do not
evaluate diagrams. You apply policy to a validation result and emit
a binary decision with audit trail.

## Step 0 — YAML pre-flight validation (fail-closed)

Before reading any files, validate that all architecture standards YAML
files are syntactically correct.  This is a non-destructive syntax check —
no files are modified.

Run:
```
python tools/yaml_validate.py standards/*.yaml config.yaml
```

- **Exit code 0** → all YAML is valid; proceed to Step 1.
- **Exit code 1** → YAML syntax error detected.  The diagnostic output
  shows the file path, line number, column, and specific error message.
  The pipeline MUST block here (fail-closed).  Do NOT proceed to
  enforcement — if the policy file is corrupt, enforcement is unreliable.

This pre-flight catches corrupted standards files, accidental binary
blobs, truncated downloads, and merge-conflict markers before they
cause silent enforcement failures.

## Step 1 — Load policy

Read `standards/arch-gate-policy.yaml` — load thresholds, override
conditions.  (Already confirmed syntactically valid by Step 0.)

## Step 2 — Load validation result

Read `validate_result.json` — load score, gate_decision, issues.

## Step 3 — Apply policy

- score < policy.block_threshold → BLOCK
- must_fix count > 0 AND policy.must_fix_zero_required → BLOCK
- otherwise → PASS (or WARN if score < policy.warn_threshold)

## Step 4 — Output enforce_result.json

```json
{
  "decision": "PASS | BLOCK | WARN",
  "exit_code": 0 | 1,
  "pre_flight": {
    "yaml_validation_passed": true,
    "files_checked": ["standards/arch-gate-policy.yaml", ...],
    "validator_version": "tools/yaml_validate.py v1.0"
  },
  "policy_version": "...",
  "applied_rules": [...],
  "override_available": true | false,
  "override_requires": "...",
  "audit_entry": {
    "timestamp": "...",
    "diagram_hash": "...",
    "score": 0.0,
    "decision": "..."
  }
}
```

## CI pipeline integration example (GitHub Actions)

```yaml
- name: YAML Syntax Pre-flight
  run: python tools/yaml_validate.py standards/*.yaml config.yaml
  # exits 1 if any YAML is invalid → blocks the pipeline
```