Docs · Reference
Rule catalog.
The 64 craft rules, each mapped to an OWASP ASI risk. The gate can require 41 of them: those with CRITICAL or HIGH impact mapped to a build phase. The rest are read and confronted, never required by check --strict. Table generated from the stable machine contract runward rules --json.
64 rules · runward v0.38.0 · 14 with a declared territory · 50 declaring they have none
What the gate does not prove
A green row proves a decision was traced to resolving, non-empty (and, if signed, shape-matching) evidence. It never proves the evidence truly implements the rule: the gate reads bytes at rest — it does not execute project code, run tests, or judge semantics. That judgment stays with the operator at the gate (ADR-0001, ADR-0005). Nor does a green row travel forward in time: the operator's judgment was made about the code that existed when the row was written. Every run re-verifies that the cited evidence still resolves and (if sealed) has not drifted, but code added later under the same rule is never re-judged — the gate has no signal that new work fell under an already-accounted-for rule. Confront the rules at the point of action, not only at the crossing. A ratification trace proves a human answered the displayed evidence; it does not prove they understood it.
Declaration read from runward rules --json · gateNonScope
| Rule | Impact | Why |
|---|---|---|
| Day-Zero Project Setup Checklistchecklist-day-zero-project | CRITICAL | Starts a project on the foundation that prevents costly refactors, with the core engineering disciplines wired from the first commit |
| Pre-Production Resilience Checklistchecklist-pre-production-resilience | CRITICAL | Ensures application handles failures gracefully in production |
| Pre-Production Security Checklistchecklist-pre-production-security | CRITICAL | Ensures security requirements are met before production deployment |
| Secrets at the Network Boundary, Never in the Modelconfig-secrets-boundary | CRITICAL | Makes secret disclosure structurally impossible by keeping the real key out of the model and the domain |
| Contract Governance (Versioned, Additive, Expand-then-Contract)contracts-governance | CRITICAL | Lets the system evolve without breaking consumers, by governing the contract at the boundary rather than the implementation behind it |
| Evaluation Loop (Test + Evaluate, Hold-out, Anchored Judge)eval-loop | CRITICAL | Gives a non-deterministic system a trustworthy way to detect behavioural regressions without letting it optimise its own grader |
| Deterministic Boundary of the Modelfrontier-deterministic-boundary | CRITICAL | Keeps every fact, figure and decision that can be checked out of the model, so the system is verifiable and cannot hallucinate load-bearing values |
| The Redone-Task Proofhandover-redone-task-proof | CRITICAL | A hand-over is proven by a real task redone end to end without the departing builder — recorded, dated, pointed at — so autonomy is a fact, not a farewell promise |
| Move the Deterministic out of the Modelhexa-move-deterministic-out | CRITICAL | Reduces LLM costs and latency by moving deterministic logic out of LLM calls |
| Model Provider as an Adapter (Detected, Never Hardcoded)provider-llm-auto-detection | CRITICAL | Keeps the model behind a port so the provider can change by configuration without touching the core |
| Fail-Open for the Non-Critical, Fail-Closed for the Sensitiveresilience-fail-open | CRITICAL | Degrades gracefully where safe and denies safely where it matters, instead of applying one failure policy everywhere |
| If Doubt, Upgrade the Modelrouting-confidence-upgrade | CRITICAL | Prevents quality degradation from incorrect model selection |
| Externalize State for Scalingscaling-state-externalization | CRITICAL | Enables horizontal scaling by removing in-process state dependencies |
| Unexpected Code Execution Runs Sandboxed, Never In-Processsecurity-code-execution-sandbox | CRITICAL | Caps the blast radius of any code the agent runs (generated or tool-provided) by isolating it from the host, secrets and network |
| Pin Every Consumed Tool/MCP Server by Version and Hashsecurity-mcp-server-pinning | CRITICAL | A consumed tool or MCP server is pinned by version and content hash, so a supply-chain swap or rug-pull cannot silently change what the agent may call |
| Untrusted Input, Prompt Injection and the Lethal Trifectasecurity-prompt-injection | CRITICAL | Treats prompt injection as a first-rank, structural threat constrained by architecture rather than detected by heuristics |
| Sovereignty Graduated by Class of Datatopology-sovereignty-by-data-class | CRITICAL | Prevents regulated or personal data from silently landing on a placement that cannot hold its sovereignty |
| Background Job Guardrails (Retry, Idempotency, Bounded Concurrency, Job Observability)async-job-guardrails | HIGH | The four non-negotiables of any background job — bounded retry per step, idempotency under concurrency, capped and partitioned concurrency, and queue lag plus failure rate as first-class metrics |
| Post-Turn Pipeline (Keep the Interactive Turn Thin)async-post-turn-pipeline | HIGH | Keeps response latency bound to what the answer needs by moving extraction, consolidation and summarization into an isolated, event-driven pipeline that runs after the turn |
| Pre-Production Observability Checklistchecklist-pre-production-observability | HIGH | Ensures you can monitor and debug production issues |
| Pre-Production Performance Checklistchecklist-pre-production-performance | HIGH | Ensures application performs well under production load |
| Memory Carries Provenance; an Untrusted Write Cannot Act Unrevieweddata-memory-provenance | HIGH | Every stored memory item carries its origin and trust tier; a memory written from untrusted content is quarantined and cannot influence a privileged action without human review |
| Forward-Only, Branch-First Migrationsdata-migrations-forward-only | HIGH | Keeps schema change safe and auditable by making migrations additive, ordered, and tested on a branch before main |
| The Agent Charter Is Finalized as the Leave-Behindhandover-agents-charter-final | HIGH | AGENTS.md leaves the mission as the standing constraint on every future agent — verification commands, judgment boundaries, never/PR rules — so the next agent inherits the discipline, not just the code |
| The Runbook Is Executable, Not Descriptivehandover-runbook-executable | HIGH | The recovery runbook carries real commands for the gestures that matter at 3 a.m. — start, observe, debug, resume, swap the provider, rerun the bench, process a suspended approval — so an incident meets procedures, not prose |
| The Succession Is Namedhandover-succession-named | HIGH | The system leaves the mission with a named owner, an escalation path and a review cadence — an unowned agentic system in production is an incident with a start date |
| New Feature = New Adapterhexa-adapter-pattern | HIGH | Keeps core business logic clean and external integrations isolated |
| Hexagonal Architecture Structurehexa-architecture | HIGH | Enables testability, maintainability, and clean dependency management |
| A Thin Model Abstraction You Own (Not a Heavy Chain Framework)hexa-typescript-native | HIGH | Reduces token overhead, improves debuggability, removes volatile dependencies by keeping a light abstraction you control instead of a heavy framework |
| Tiered Memory Routerpatterns-memory-router-tiered | HIGH | Order-of-magnitude latency cut on simple queries by fetching only the memory tier the query needs, measured on a reference system — recalibrate on your traffic |
| ADR Discipline and Working Journalprocess-adr-and-journal | HIGH | Makes structural decisions traceable and reversible-by-record, so the system can be picked up by anyone without re-litigating settled choices |
| Graceful Degradation of Optional Servicesprovider-no-crash-missing-env | HIGH | Lets the app start and run wherever it is deployed, enabling features by available config rather than crashing on a missing variable |
| Multi-Provider Fallbackresilience-multi-provider-fallback | HIGH | Ensures LLM availability by falling back to alternative providers |
| LLM Retry with Exponential Backoffresilience-retry-backoff | HIGH | Handles transient LLM failures gracefully without overwhelming the API |
| Model Cost Ratiosrouting-model-cost-ratios | HIGH | Essential reference for cost optimization decisions |
| Smart Routing by Complexityrouting-smart-complexity | HIGH | Order-of-magnitude latency cut on simple requests and a substantial cost reduction through intelligent model selection, measured on a reference system — recalibrate on your traffic |
| Distributed Rate Limitingscaling-distributed-rate-limiting | HIGH | Enables consistent rate limiting across multiple instances |
| Provenance on Every Field, So the Human Never Trusts a Guesssecurity-human-agent-trust | HIGH | Stops a model-proposed value being read as a verified fact at the approval point — the human decides on real provenance, never on fabricated confidence |
| Re-approve a Tool on Any Change to Its Signed Definitionsecurity-tool-change-reapproval | HIGH | A change to a registered tool's definition (name, schema, description, permissions) forces re-approval before the agent may call it, closing the rug-pull window |
| State as an Immutable Journal (Event Sourcing, Replay, Provenance)state-event-sourcing | HIGH | Makes the agent a stateless reducer over an external, replayable journal, so truth, audit and recovery are structural rather than bolted on |
| Tool Registry Patterntools-registry-pattern | HIGH | Replaces giant switch statements with maintainable, extensible tool management |
| Tool Scope and Atomicitytools-scope-atomicity | HIGH | Reduces token usage and improves LLM tool selection accuracy |
| Every Port Has a Named Placementtopology-port-placement-mapped | HIGH | Keeps the execution topology traced port by port, so a placement never drifts unseen behind the domain |
| Trace Export Is a Decision, Because Traces Are Datatopology-trace-export-decision | HIGH | Stops the most sensitive payloads leaving under the name "telemetry" without a named, reviewed decision |
| A Usage Registry, Because Risk Is Classed by Deploymenttopology-usage-registry-present | HIGH | Lets you answer, at audit time, what runs where touching what — risk attaches to a deployment, not a platform |
| Scheduled Maintenance (The Cron Updates and Cools, It Never Destroys Truth)async-scheduled-maintenance | MEDIUM | Keeps memory, derived views and the journal healthy over months of operation through periodic decay, pruning and cold archiving that never touch the source of truth |
| Prompt Cache Stability (a Cost Lever, Provider-Specific)cache-three-tier-architecture | MEDIUM | Cuts input-token cost when a provider bills cached prefixes cheaper, by keeping the stable part of the prompt byte-identical across requests |
| Config Typing with Zodconfig-typing-zod | MEDIUM | Makes configuration type-safe and validated once at the boundary, so the rest of the system trusts it |
| Reversible Memory Consolidation (Merge, Summarize, Keep Pointers)data-memory-consolidation | MEDIUM | Keeps long-term memory compact without destroying evidence, so every consolidated fact can be unfolded back to its sources at audit time |
| Bi-Temporal Memory Invalidation (Contradicted Facts Are Dated, Not Deleted)data-memory-invalidation | MEDIUM | Lets memory change its mind without lying about the past, by tracking when a fact was learned and when it was valid as two separate timelines |
| Memory Scoring Formuladata-memory-scoring | MEDIUM | Provides optimal memory retrieval ranking |
| Orphan Data Cleanupdata-orphan-cleanup | MEDIUM | Prevents data bloat from orphaned records |
| TTL by Data Typedata-ttl-types | MEDIUM | Ensures proper data lifecycle management and compliance |
| Stack Posture (Sober Default plus Trigger), Not a Fixed Stackhexa-recommended-stack | MEDIUM | Replaces a frozen product stack with a portable rule for choosing technology by evidence, so the rule does not age with any vendor |
| Alert Configurationobservability-alert-configuration | MEDIUM | Ensures timely notification of production issues |
| LLM Metrics Trackingobservability-llm-metrics | MEDIUM | Enables cost monitoring, performance optimization, and anomaly detection |
| Structured JSON Logsobservability-structured-json-logs | MEDIUM | Enables log querying, aggregation, and alerting in production |
| Prompt as Program (Prompt Compiler)patterns-prompt-compiler | MEDIUM | Enables versioning, testing, and optimization of prompts |
| Request ID Propagationpatterns-request-id-propagation | MEDIUM | Enables end-to-end request tracing across services |
| Codebase Metrics Thresholdsquality-codebase-metrics | MEDIUM | Identifies code quality issues before they become problems |
| Zod Input Validationquality-zod-input-validation | MEDIUM | Prevents invalid data from entering the system and provides type safety |
| Retryable vs Non-Retryable Errorsresilience-retryable-errors | MEDIUM | Prevents wasted retries and ensures quick failure for unrecoverable errors |
| Database Connection Poolingscaling-db-connection-pooling | MEDIUM | Prevents connection exhaustion under load |
| Log Providers at Startupobservability-startup-provider-log | LOW | Simplifies debugging by showing configuration at startup |
Generated from runward rules --json — run runward explain <slug> for the full text · runward v0.38.0