Skip to content
Apothem
一致性门禁

合规闸门

Apothem 合规闸门——每个发布的工件都必须通过的十五道预发布闸门关卡(M1-M15)中的机械部分。

十五道关卡

关卡ID强制规定检查类别失败 → 行动
1M1宿主项目无关性推理判断修订以匹配宿主约定
2M2编辑纪律(披露账本)推理判断添加披露标记
3M3十项质量维度机械 + 推理判断针对未通过的维度进行修订
4M4自我应用(存在验证块)推理判断记录验证块
5M5权威原则(不捏造身份 / 端点 / 机密)机械转交询问
6M6专业知识融入(已揭示的缺口)推理判断揭示缺口;引用改进之处
7M7选项标注(推荐标记 + 驱动因素理由)机械标注选项集
8M8确定性(规定性文字中不含含糊措辞)机械将含糊措辞提升为条件句
9M9视觉杠杆(结构性主题配有图示)机械 + 推理判断编写 / 刷新图示
10M10双向绑定(互逆的反向指针已闭合)机械闭合半边
11M11敏捷冲刺(目标 / 待办列表 / 就绪定义 / 完成定义 / 评审 / 回顾)推理判断重构为冲刺
12M12阶段报告与规范布局机械 + 推理判断编写汇总;迁移到规范布局
13M13代码工艺(lint / 格式化 / 类型检查;魔法数字;裸 except)机械应用各语言的代码工艺规则
14M14系统性(声明上游 / 下游 / 同级 / 执行者)机械 + 推理判断声明;在登记册中编入索引
15M15生产就绪(测试 + 文档 + CHANGELOG + 合规提交 + CI 绿色 + semver 稳定性)机械 + 推理判断补齐缺失的表面

闸门只运行可由机器检查的校验器。推理判断类关卡所要求的推理判断,以及每个机械 + 推理判断类关卡中的推理判断部分,都在评审中评估。

严重级别阶梯

闸门没有关键、重要或建议性的分级,也没有两项发现的阈值。不带 --strict(或 APOTHEM_CONFORMITY_STRICT=1)时,闸门只报告发现项,并以 0 退出。带 --strict 时,单文件或钩子检查在任一匹配器失败时以 2 退出;语料库运行(--all 或 --all-perwrite)在某个阻断性校验器或匹配器失败时以 2 退出;建议性发现项只报告。已安装的 Write/Edit 钩子不传递 --strict,因此它只报告发现项,写入会继续进行,除非其环境中设置了 APOTHEM_CONFORMITY_STRICT=1。

校验器

机械部分位于 src/apothem/conformity/,由 src/apothem/conformity/gate.py 编排。每个校验器以下列三种方式之一运行:

  • per-write:在每次待处理的写入时运行(--hook),或用 --all-perwrite 对每个已跟踪的文件运行。
  • standalone:用 --all 在整个仓库范围内运行,或用 --check <name> 逐个运行。
  • change-set:针对已暂存的差异,直接以 python -m apothem.conformity.semver_stability_grep --staged 运行,不经由闸门。

下表由校验器模块生成。

The conformity package ships 54 validators: 22 per-write, 31 standalone and 1 change-set. The gate registers the per-write and standalone ones.

ValidatorRunsRule anchorWhat it checks
agent-capability-grepstandaloneagent-capability-discipline (per-harness capability matrix)Verify every harness declares its agentic-capability matrix.
agents-md-coverage-grepstandalonerules/agents-md-convention.mdFlag stale agent-companion files under the root-only AGENTS.md convention.
agnosticism-grepstandalonerules/agnostic-posture.md §3 (harness neutrality) + §1 (default-off)Flag harness bias and re-introduced enforcement presets in shipped surfaces.
always-on-budget-grepper-writeD1 token-budget-discipline §Always-on body budgetBody-budget conformity matcher for always-on rules. Pointed at a rules directory it also holds the loaded always-on set and the rule index to byte ceilings.
bare-except-grepper-writeM13.3 error handlingFlag bare except clauses without typed exceptions or re-raise.
binding-five-direction-grepstandaloneM10 bidirectional-binding §1 (five-direction Bindings section)Require the five-direction Bindings section on every rule, command, agent, and skill.
binding-reciprocity-corpus-grepstandaloneM10 bidirectional-binding §2 (↔ self-reciprocal)Cross-file binding-reciprocity corpus walk — the ↔-symmetric half-edge check.
binding-reciprocity-grepper-writeM10 bidirectional-binding §NotationFlag binding declarations using non-canonical arrow notation.
brand-mark-grepper-writerules/plain-language.md (brand-mark display/identifier casing)Flag brand-mark display/identifier form drift on brand-touched surfaces.
commented-out-code-grepper-writeM13.1 why-not-what commentsFlag substantial commented-out code blocks left in source.
completion-claim-grepper-writerules/session-closure.md (verifiable-close output honesty)Flag unsupported completion / guarantee claims in cohort prose.
conventional-commit-grepstandaloneCLAUDE.md Coding Conventions — Conventional CommitsFlag HEAD commit messages that drift from the Conventional-Commits grammar.
copilot-instructions-presence-grepper-write—GitHub Copilot surface presence check.
cross-platform-matrix-grepstandalonecross-platform OS x Python CI matrixVerify CI declares a cross-platform OS x Python matrix.
determinism-grepstandalonerules/determinism.mdProve every command and skill surface has a deterministic output shape.
diagram-staleness-grepper-writeM9 visual-leverage §FidelityFlag diagrams whose verification date is missing or stale.
dynamism-grepstandalonerules/dynamism.md (static-version embeds)Flag static-string version embeds in dynamism-required surfaces.
editorconfig-presence-grepstandalonesupply-chain SOTA-rigor §editorconfigVerify a canonical .editorconfig is present at the project root.
file-header-grepper-write—Authorship-header presence and canonical-form check.
freshness-token-grepstandalonerules/freshness-facade.mdFlag freshness-narrative phrases on shipped public surfaces.
frontmatter-grepper-writethe per-class frontmatter JSON Schemas (src/apothem/schemas/)Validate per-artifact-class YAML frontmatter against required-key sets.
frontmatter-value-grepstandaloneper-class JSON Schema enum/pattern value constraintsValidate frontmatter VALUES against the per-class JSON Schema enum/pattern constraints.
gate-evidence-grepstandalonecommands/plan-execute.md Gate evidence; rules/pre-emission-gate-bars.md section 2 (attestation schema)Advisory: flag plan-suite gate claims that lack a command, an exit status or output, and a HEAD SHA beside them, and fifteen-bar attestations that omit a field of the rule's schema.
gitattributes-presence-grepstandalonesupply-chain .gitattributes contractVerify the repo-root .gitattributes carries the canonical contract.
harden-runner-grepstandaloneharden-runner egress baselineVerify every workflow job opens with a conformant harden-runner step.
hedging-grepper-writeM8 definitiveness §HedgingFlag hedging vocabulary in prescriptive contexts.
license-author-consistency-grepper-write—LICENSE author-identity presence check.
link-checkper-writerules/code-craft-markdown.md §6 Link DisciplineValidate Markdown internal links against the on-disk reference graph.
magic-number-grepper-writeM13.10 magic numbersFlag magic numbers in source code.
multi-surface-coherence-grepper-write—Shared-claim coherence across AI-conventions surfaces.
naming-grepstandaloneCLAUDE.md Coding Conventions (kebab-case naming)Validate filesystem paths against the canonical naming convention.
no-global-plans-grepstandaloneCLAUDE.md Plans Discipline (no global plans)Walk the git index for tracked plans paths; fail when found.
no-toplevel-docs-grepstandalonesingle-source-of-truth (docs live in site/, not root docs/)Fail when a top-level docs/ directory exists at the repository root.
oidc-trusted-publishing-grepstandaloneOIDC trusted publishingVerify release workflows use OIDC trusted publishing.
option-annotation-grepper-writeM7 option-annotation (H6 per-option bind)Enforce the per-option Recommended label-to-body bind (H6).
orphan-output-grepper-writeM12 canonical-layout + M14 systemicityFlag artifacts emitted to non-canonical locations or without provenance.
permissions-minimum-scope-grepstandaloneminimum-scope workflow permissionsVerify every GitHub Actions workflow declares a minimum-scope permissions: block.
plain-language-grepstandalonerules/plain-language.md — user-facing proseFlag mechanistic / harness-internal vocabulary in user-facing prose.
plan-next-step-consistency-grepstandalonerules/recommend-next-step.mdAdvisory: flag plan-suite infra files whose Recommended-Next-Step footer drifts from the suite's recorded next pipeline stage.
plan-suite-structure-grepstandalonecontext-management-scratch 2 (suite-locality + closed vocab) + canonical-layout-reporting-tiers 2.1 (numeric-prefix discipline)Validate plan-suite structure: suite-locality, closed vocab, numeric prefix.
plans-discipline-language-grepstandaloneCLAUDE.md Plans Discipline (multi-surface language)Verify the canonical Plans Discipline language reaches every required surface.
production-ready-pr-grepper-writeM15 production-ready §Same-change-setFlag commits whose change-set lacks the production-ready four-class shape.
recommend-next-step-grepstandalonerules/recommend-next-step.mdVerify every command file carries a ## Recommended Next Step block.
redundancy-grepstandalonerules/operational-mandates.md §CM-7 coherent-product non-redundancyFlag substantively-duplicated paragraphs across the governed corpus.
reference-token-grepstandalonerules/own-voice-reimplementation.mdFlag leaked reference-platform branding tokens on authored surfaces.
registry-capability-consistency-grepstandalonerules/agent-capability-discipline.md — registry capability cells backed by evidenceFlag registry capability cells not backed by install / materializer / projection evidence.
secret-leak-grepper-writeM13.8 security + M15 production-readyBlock emission of artifacts containing hardcoded credentials.
semver-stability-grepchange-setM15 semver-stabilitySemver stability matcher (M15 mechanical fraction).
smoke-install-grepstandaloneproduction-ready section 8.1 paired install scriptsSmoke-test the paired install scripts at the repository root.
static-version-grepstandalonerules/dynamism.md §static-version-resolutionVerify version-bearing sites resolve dynamically, not as static literals.
token-efficiency-grepper-writeclean-room-generation §5 + token-efficiency-rewriteFlag filler phrases, throat-clearing openers, and content-free qualifiers.
unpinned-action-grepper-writeM15 production-ready §Supply-chainFlag GitHub Actions workflows that pin actions to mutable refs.
user-confirm-grepper-writeM5 authority-inquiry §10Block emission of artifacts containing unresolved authority placeholders.
workflow-concurrency-grepstandaloneworkflow concurrency + per-job timeoutsEnforce concurrency + per-job timeout discipline on GitHub workflows.

运行闸门

在已安装的工具上,闸门会自动运行:Claude Code 的 settings.json 将其接入为一个 PreToolUse 钩子,在每次 Write/Edit 之前调用位于 ~/.claude/.apothem/support/conformity/gate.py 的物化副本。随后闸门只检查其钩子范围内的写入,范围之外的写入会无声通过;该范围列于运行合规闸门。在源码检出中,模块形式驱动同一套代码;请在下面每条 python 命令前加上 PYTHONPATH=src。闸门默认是建议性的:它报告发现项并以 0 退出。添加 --strict 可在出现阻断性发现项时以 2 退出。未知的校验器名称以 3 退出。

# Every standalone validator across the repository:
python -m apothem.conformity.gate --all .

# The same sweep, failing on a blocking finding (the CI form):
python -m apothem.conformity.gate --all --strict .

# Every per-write validator against every tracked file:
python -m apothem.conformity.gate --all-perwrite .

# One validator by name (names come from --list):
python -m apothem.conformity.gate --check naming-grep .

# List every registered validator as JSON:
python -m apothem.conformity.gate --list

# Single-file dispatch (mimics the PreToolUse hook):
echo '{"tool_input": {"file_path": "path/to/file", "content": "..."}}' \
    | python -m apothem.conformity.gate --hook

python -m apothem.conformity.gate --help 会打印用法摘要。完整流程参见运行合规闸门。

参考

On this page