workspace-rules

A repo's rules sit at two layers: what its workspace tells a model before a line exists, and what its build catches after one is written. Telling costs a line in a file the model already reads; catching costs a red build, a turn, and a check somebody maintains forever. A rule belongs at the cheapest layer that holds it, and getting that call right is most of this pass. One test governs both: if you could have written the rule without opening this repo, the model already knows it and the line is a tax.

Which layer, and this is the judgment the rest hangs on

Take the capability away before writing any rule. Delete the export, narrow the visibility, drop the dependency, remove the tool. A reviewer shipped without an edit tool cannot fix the code it reviews, which no instruction achieves and no compacted context forgets. Then read the default posture, because omission from an allow list is not removal.

Sort what is left by what it hands the model. Information it could not infer costs nothing to obey and holds with no gate, no judge and no repetition: what this repo does not have, which of two sources wins, where the local default is wrong and how widely. A cost it must pay against its own task is not held by prose at any volume. Loudness and frequency buy nothing, and the loudest rule in this evidence sits beside a settings file granting the very access it forbids.

If a script could count compliance, something must count it. Best-evidenced claim here, and it runs one way only: every countable rule nobody counted was found violated, most often by the file stating it. A file carrying a two hundred line target ran five hundred and fifty three, and a field no downstream reader consumed was blank in thirty-seven of thirty-nine notes.

Where a cost remains and the capability cannot go, put the result in front of somebody who did not produce it, reading primary evidence rather than the producer's account. The one controlled comparison here is exactly that: reviews handed a summary found none of the blockers, reviews handed the diff found twelve. A self-reported pass is worse than no check, because it launders trust downstream.

What is left is a cost no script can count, and that is the handful worth writing down. No script reads degree or intent, so none tells a surgical cut from a rewrite. None reaches a truth living outside the repo, like what someone else's binary does with your flags after their next release. None sees how you checked, only what you wrote, so render it and look at it is out of reach. And none gets any signal when the violation still works, which covers every judgment about where a thing belongs. Write those. Write almost nothing else twice.