fix(core): a corpus file that becomes no rules now reaches the report - #635

Closes #575.

The defect, and what turned out not to be one

The loader globs *.rules.json and four shipped files are not rule sets. They were read, produced nothing, and the only trace was a log line — which does not survive --format json, never reaches an exit code, and left the documents out of every denominator the report published. That is the silent drop this project exists to stop, happening inside its own loader.

#575 asked for the accounting first and the files second, and it was right — the files turned out not to need changing:

• GT-649 had already classified three of them by declared $schema.
• The two INFRA rules are genuinely enforced elsewhere: src/rulesets/opa/infrastructure/helm-enforcement.rego, opa-sidecar-bundle.rego, plus the dedicated 29-validate-opa-sidecar-bundles.mjs guard. Wrapping them into the corpus, as the issue suggested, would have double-counted them.

The issue counted three rejected files; there are four. sdlc/phase-gates.rules.json was recognised by filename — filePath.endsWith("phase-gates.rules.json") skipped schema validation and then normalised to zero rules, so it was neither validated nor reported, and no warning ever named it.

The fix

• IRulesetRepository gains CorpusDocumentOutcome and an optional describeLastLoad(). Optional so an implementation that cannot know stays valid; an implementation that drops documents and stays quiet reintroduces this bug.
• The validator emits two rows, deliberately weighted differently:
  • GOV-CORPUS-NOT-A-RULESET — COULD, non-blocking. Names each document that declares a known non-ruleset schema and satisfies it. A fact about the corpus, not a violation.
  • GOV-CORPUS-REJECTED — MUST, blocking. Names each document that claims to be a ruleset and is not, because such a file is indistinguishable downstream from one that was never there.
• phase-gates now dispatches on its declared ruleset-sdlc.schema.json like its neighbours. The path literal is gone and a rename can no longer defeat it. PhaseGateValidatorService reads the file at its own path and is unaffected.

Verified against the built CLI, not asserted

The issue's own proof commands, run on a fresh satellite:

• the row appears in the report and in --format json, naming all four files with the reason for each
• the blocking branch is falsifiable: dropping one deliberately broken *.rules.json into the corpus produced GOV-CORPUS-REJECTED … | YES and exit 2; removing it returned the run to the previous state
• no rules were lost by the phase-gates change: evolith rulesets reports 178 packs / 413 rules before and after

Tests: infra-providers 181, core-domain 1997 (5 new in corpus-load-accounting.spec.ts), CLI 133, core-api 163 — all passing.

Second commit

The front page said the tree "carries 182 ruleset files" and stopped, because a tree-side rule count could not be measured — the published CLI evaluates its bundled corpus regardless of coreRef.path. Building the CLI from this tree answers it (178 packs, 413 rules), and this change explains the 182→178 gap without hand-waving. Both READMEs updated together.

🤖 Generated with Claude Code