Rule Catalog

Checks that the configured module root exists and contains the expected module directories.

Reports when ArchPilot falls back from a specific implementation profile to default validation behavior.

Checks that the architecture overview document exists.

Checks that expected module baseline artifacts are present.

Checks that registered module paths exist as directories.

Checks that every registered module contract file resolves.

Checks that module contract identity and field shape align with the registry.

Checks that registered module public entrypoints match the public surfaces declared in module contracts.

Checks that the project rule configuration file can be parsed and used.

Checks that the ArchPilot project configuration is valid JSON.

Checks that project identity fields are present and usable.

Flags direct circular dependencies between modules.

Flags dependencies blocked by dependency rule configuration.

Flags cross-module imports that do not use a public module entrypoint.

Flags an actual cross-module import that is not declared in the source module contract.

Flags imports that reach into another module's internals instead of its public entrypoint.

Flags a module contract dependency that no longer appears in implementation imports.

Flags modules with no declared or actual inbound/outbound module dependencies.

Flags dependency cycles that emerge through multiple module hops.

Flags modules with a high number of inbound dependencies.

Flags dependencies that point against the configured architecture layer direction.

Checks that an OpenAPI contract is present for REST API review.

Checks that GraphQL endpoint exposure is documented when OpenAPI is used as the API review artifact.

Checks that same-schema multi-tenant tables include tenant discriminator evidence.

Checks that the SQL baseline artifact exists for database validation.

Checks that the configured ADR directory exists.

Checks that ADR files include a top-level title.

Checks that ADR files include a recognized decision status.

Checks that key architecture topics have ADR coverage.

Checks that different-schema tenant modeling decisions are captured in an ADR.

Checks that architecture overview documentation mentions RBAC or role-based access control where expected.

Checks that suppression entries include a reason.

Flags suppression entries whose expiry date has passed.

Reports suppression entries that no longer match an active finding.

Flags duplicate suppression entries.

Checks that suppression expiry dates use a valid format.

Flags risky architecture changes that lack ADR evidence.

Flags risky changes without rollback plan evidence.

Flags risky changes without staged rollout or feature-flag evidence.

Flags query paths where multi-tenant SQL lacks clear tenant-filter evidence.

Flags broad SELECT * usage in paths where explicit projection is safer.

Flags list/query paths without obvious limit or pagination controls.

Flags database access that reaches into another module's owned data boundary directly.