Skip to content
Apothem
Conformity gate

Conformity gate

Apothem conformity gate — the mechanical fraction of the fifteen-bar pre-emission gate (M1-M15) every emitted artifact must pass.

The fifteen bars

BarIDMandateCheck classFailure → action
1M1Host-Project AgnosticismReasonedRevise to match host conventions
2M2Editorial Discipline (disclosure ledger)ReasonedAdd disclosure markers
3M3Ten Quality DimensionsMechanical + reasonedRevise on failing dimensions
4M4Self-application (verification block present)ReasonedRecord the verification block
5M5Authority Principle (no fabricated identity / endpoint / secret)MechanicalRoute to inquiry
6M6Expertise Incorporation (surfaced gaps)ReasonedSurface gaps; cite refinements
7M7Option Annotation (Recommended marker + driver rationale)MechanicalAnnotate option sets
8M8Definitiveness (no hedging in prescriptive prose)MechanicalPromote hedges to conditionals
9M9Visual Leverage (structural subjects carry diagrams)Mechanical + reasonedAuthor / refresh diagram
10M10Bidirectional Binding (reciprocal back-pointers closed)MechanicalClose half-edges
11M11Agile Sprints (Goal / Backlog / DoR / DoD / Review / Retrospective)ReasonedRestructure as sprints
12M12Phase Reporting & Canonical LayoutMechanical + reasonedAuthor rollup; relocate to canonical layout
13M13Code Craft (lint / format / type-check; magic-number; bare-except)MechanicalApply per-language code-craft rules
14M14Systemicity (declares upstream / downstream / peers / enforcers)Mechanical + reasonedDeclare; index in registries
15M15Production-Ready (tests + docs + CHANGELOG + conformant commit + CI green + semver-stability)Mechanical + reasonedAdd missing surfaces

The gate runs only machine-checkable validators. The reasoned judgment that the Reasoned bars call for, and the reasoned half of each Mechanical + reasoned bar, is evaluated in review.

Severity ladder

The gate has no Critical, Important or Advisory ladder and no two-finding threshold. Without --strict (or APOTHEM_CONFORMITY_STRICT=1), the gate reports findings and exits 0. With --strict, a single-file or hook check exits 2 when any matcher fails, and a corpus run (--all or --all-perwrite) exits 2 when a blocking validator or matcher fails; advisory findings are reported only. The installed Write/Edit hook does not pass --strict, so it reports findings and the write proceeds unless APOTHEM_CONFORMITY_STRICT=1 is set in its environment.

Validators

The mechanical fraction lives at src/apothem/conformity/, orchestrated by src/apothem/conformity/gate.py. Each validator runs in one of three ways:

  • per-write: on every pending write (--hook), or on every tracked file with --all-perwrite.
  • standalone: across the whole repository with --all, or one at a time with --check <name>.
  • change-set: against a staged diff, run directly as python -m apothem.conformity.semver_stability_grep --staged, not through the gate.

The table below is generated from the validator modules.

The conformity package ships 54 validators: 22 per-write, 31 standalone and 1 change-set. The gate registers the per-write and standalone ones.

ValidatorRunsRule anchorWhat it checks
agent-capability-grepstandaloneagent-capability-discipline (per-harness capability matrix)Verify every harness declares its agentic-capability matrix.
agents-md-coverage-grepstandalonerules/agents-md-convention.mdFlag stale agent-companion files under the root-only AGENTS.md convention.
agnosticism-grepstandalonerules/agnostic-posture.md §3 (harness neutrality) + §1 (default-off)Flag harness bias and re-introduced enforcement presets in shipped surfaces.
always-on-budget-grepper-writeD1 token-budget-discipline §Always-on body budgetBody-budget conformity matcher for always-on rules. Pointed at a rules directory it also holds the loaded always-on set and the rule index to byte ceilings.
bare-except-grepper-writeM13.3 error handlingFlag bare except clauses without typed exceptions or re-raise.
binding-five-direction-grepstandaloneM10 bidirectional-binding §1 (five-direction Bindings section)Require the five-direction Bindings section on every rule, command, agent, and skill.
binding-reciprocity-corpus-grepstandaloneM10 bidirectional-binding §2 (↔ self-reciprocal)Cross-file binding-reciprocity corpus walk — the ↔-symmetric half-edge check.
binding-reciprocity-grepper-writeM10 bidirectional-binding §NotationFlag binding declarations using non-canonical arrow notation.
brand-mark-grepper-writerules/plain-language.md (brand-mark display/identifier casing)Flag brand-mark display/identifier form drift on brand-touched surfaces.
commented-out-code-grepper-writeM13.1 why-not-what commentsFlag substantial commented-out code blocks left in source.
completion-claim-grepper-writerules/session-closure.md (verifiable-close output honesty)Flag unsupported completion / guarantee claims in cohort prose.
conventional-commit-grepstandaloneCLAUDE.md Coding Conventions — Conventional CommitsFlag HEAD commit messages that drift from the Conventional-Commits grammar.
copilot-instructions-presence-grepper-write—GitHub Copilot surface presence check.
cross-platform-matrix-grepstandalonecross-platform OS x Python CI matrixVerify CI declares a cross-platform OS x Python matrix.
determinism-grepstandalonerules/determinism.mdProve every command and skill surface has a deterministic output shape.
diagram-staleness-grepper-writeM9 visual-leverage §FidelityFlag diagrams whose verification date is missing or stale.
dynamism-grepstandalonerules/dynamism.md (static-version embeds)Flag static-string version embeds in dynamism-required surfaces.
editorconfig-presence-grepstandalonesupply-chain SOTA-rigor §editorconfigVerify a canonical .editorconfig is present at the project root.
file-header-grepper-write—Authorship-header presence and canonical-form check.
freshness-token-grepstandalonerules/freshness-facade.mdFlag freshness-narrative phrases on shipped public surfaces.
frontmatter-grepper-writethe per-class frontmatter JSON Schemas (src/apothem/schemas/)Validate per-artifact-class YAML frontmatter against required-key sets.
frontmatter-value-grepstandaloneper-class JSON Schema enum/pattern value constraintsValidate frontmatter VALUES against the per-class JSON Schema enum/pattern constraints.
gate-evidence-grepstandalonecommands/plan-execute.md Gate evidence; rules/pre-emission-gate-bars.md section 2 (attestation schema)Advisory: flag plan-suite gate claims that lack a command, an exit status or output, and a HEAD SHA beside them, and fifteen-bar attestations that omit a field of the rule's schema.
gitattributes-presence-grepstandalonesupply-chain .gitattributes contractVerify the repo-root .gitattributes carries the canonical contract.
harden-runner-grepstandaloneharden-runner egress baselineVerify every workflow job opens with a conformant harden-runner step.
hedging-grepper-writeM8 definitiveness §HedgingFlag hedging vocabulary in prescriptive contexts.
license-author-consistency-grepper-write—LICENSE author-identity presence check.
link-checkper-writerules/code-craft-markdown.md §6 Link DisciplineValidate Markdown internal links against the on-disk reference graph.
magic-number-grepper-writeM13.10 magic numbersFlag magic numbers in source code.
multi-surface-coherence-grepper-write—Shared-claim coherence across AI-conventions surfaces.
naming-grepstandaloneCLAUDE.md Coding Conventions (kebab-case naming)Validate filesystem paths against the canonical naming convention.
no-global-plans-grepstandaloneCLAUDE.md Plans Discipline (no global plans)Walk the git index for tracked plans paths; fail when found.
no-toplevel-docs-grepstandalonesingle-source-of-truth (docs live in site/, not root docs/)Fail when a top-level docs/ directory exists at the repository root.
oidc-trusted-publishing-grepstandaloneOIDC trusted publishingVerify release workflows use OIDC trusted publishing.
option-annotation-grepper-writeM7 option-annotation (H6 per-option bind)Enforce the per-option Recommended label-to-body bind (H6).
orphan-output-grepper-writeM12 canonical-layout + M14 systemicityFlag artifacts emitted to non-canonical locations or without provenance.
permissions-minimum-scope-grepstandaloneminimum-scope workflow permissionsVerify every GitHub Actions workflow declares a minimum-scope permissions: block.
plain-language-grepstandalonerules/plain-language.md — user-facing proseFlag mechanistic / harness-internal vocabulary in user-facing prose.
plan-next-step-consistency-grepstandalonerules/recommend-next-step.mdAdvisory: flag plan-suite infra files whose Recommended-Next-Step footer drifts from the suite's recorded next pipeline stage.
plan-suite-structure-grepstandalonecontext-management-scratch 2 (suite-locality + closed vocab) + canonical-layout-reporting-tiers 2.1 (numeric-prefix discipline)Validate plan-suite structure: suite-locality, closed vocab, numeric prefix.
plans-discipline-language-grepstandaloneCLAUDE.md Plans Discipline (multi-surface language)Verify the canonical Plans Discipline language reaches every required surface.
production-ready-pr-grepper-writeM15 production-ready §Same-change-setFlag commits whose change-set lacks the production-ready four-class shape.
recommend-next-step-grepstandalonerules/recommend-next-step.mdVerify every command file carries a ## Recommended Next Step block.
redundancy-grepstandalonerules/operational-mandates.md §CM-7 coherent-product non-redundancyFlag substantively-duplicated paragraphs across the governed corpus.
reference-token-grepstandalonerules/own-voice-reimplementation.mdFlag leaked reference-platform branding tokens on authored surfaces.
registry-capability-consistency-grepstandalonerules/agent-capability-discipline.md — registry capability cells backed by evidenceFlag registry capability cells not backed by install / materializer / projection evidence.
secret-leak-grepper-writeM13.8 security + M15 production-readyBlock emission of artifacts containing hardcoded credentials.
semver-stability-grepchange-setM15 semver-stabilitySemver stability matcher (M15 mechanical fraction).
smoke-install-grepstandaloneproduction-ready section 8.1 paired install scriptsSmoke-test the paired install scripts at the repository root.
static-version-grepstandalonerules/dynamism.md §static-version-resolutionVerify version-bearing sites resolve dynamically, not as static literals.
token-efficiency-grepper-writeclean-room-generation §5 + token-efficiency-rewriteFlag filler phrases, throat-clearing openers, and content-free qualifiers.
unpinned-action-grepper-writeM15 production-ready §Supply-chainFlag GitHub Actions workflows that pin actions to mutable refs.
user-confirm-grepper-writeM5 authority-inquiry §10Block emission of artifacts containing unresolved authority placeholders.
workflow-concurrency-grepstandaloneworkflow concurrency + per-job timeoutsEnforce concurrency + per-job timeout discipline on GitHub workflows.

Running the gate

On an installed harness the gate runs automatically: Claude Code's settings.json wires it as a PreToolUse hook that invokes the materialized copy at ~/.claude/.apothem/support/conformity/gate.py before every Write/Edit. The gate then checks only writes under its hook scope, and a write outside the scope passes silently; Running the conformity gate lists the scope. From a source checkout, the module form drives the same code; prefix each python command below with PYTHONPATH=src. The gate is advisory by default: it reports findings and exits 0. Add --strict to exit 2 on a blocking finding. An unknown validator name exits 3.

# Every standalone validator across the repository:
python -m apothem.conformity.gate --all .

# The same sweep, failing on a blocking finding (the CI form):
python -m apothem.conformity.gate --all --strict .

# Every per-write validator against every tracked file:
python -m apothem.conformity.gate --all-perwrite .

# One validator by name (names come from --list):
python -m apothem.conformity.gate --check naming-grep .

# List every registered validator as JSON:
python -m apothem.conformity.gate --list

# Single-file dispatch (mimics the PreToolUse hook):
echo '{"tool_input": {"file_path": "path/to/file", "content": "..."}}' \
    | python -m apothem.conformity.gate --hook

python -m apothem.conformity.gate --help prints the usage summary. See Running the conformity gate for the full procedure.

Reference

On this page