Nomos42 Quality Gates & ERR_* Dictionary
Paste any ERR_* diagnostic code, protocol vector (TC-AGT-*), or gate ID (G-01..G-42) emitted by nomos verify to inspect its invariant, failure trigger, and remediation.
Canonical ERR_* Error Lookup
ERR_TRUNK_LOCKED Trigger: Direct git commit or file mutation attempted on protected trunk branch (main).
Remediation: Provision an isolated worktree via nomos task chore "<title>" or nomos task start <KEY> --edit.
ERR_CANONICAL_VIOLATION Trigger: Non-canonical task key prefix (outside INT-<N> / SUB-<N>) or duplicate CLI alias detected.
Remediation: Use canonical INT-<N> or SUB-<N> task identifiers and remove duplicate wrapper aliases.
ERR_DIRECT_DB_ACCESS_FORBIDDEN Trigger: Agent or script attempted raw sqlite3 queries or direct mutation of internal .db files.
Remediation: Interact strictly through encapsulated CLI commands (nomos task and nomos mem).
ERR_SYMLINK_FORBIDDEN Trigger: Symbolic link created inside repository tree violating Canonical Singularity.
Remediation: Remove the filesystem symlink and import the canonical source module or SSoT contract directly.
ERR_CROSS_PLANE_MUTATION Trigger: Single task commit mutated both Intent specifications (intent/) and Substrate code (substrate/).
Remediation: Split work across twinned INT-<N> and SUB-<N> tasks via nomos task pair so each commit stays single-plane.
ERR_TRIVIAL_PASS_SHIM Trigger: Gate function or test assertion returns a constant literal true/nil shim without AST or state evaluation.
Remediation: Replace placeholder stub returns with concrete logic and table-driven assertions, then run nomos verify.
ERR_FORBIDDEN_LITERAL Trigger: Hardcoded workstation path literal, environment secret, or magic string detected in source.
Remediation: Resolve paths dynamically through config discovery and replace magic literals with typed constants.
ERR_ZERO_ASSETS_DISCOVERED Trigger: Schema parity or asset walker matched 0 files (vacuous pass trap) or detected SHA-256 byte drift.
Remediation: Verify discovery globs match compiled Go SSoT structs and regenerate reflected JSON Schemas.
ERR_CAPBAC_PREFLIGHT Trigger: Write or sync attempted outside an active EDIT/REVIEW capability lease or without walkthrough proof.
Remediation: Run nomos handshake to inspect active phase status and transition cleanly via nomos task edit or sync.
All 42 Matching Quality Gates
Complexity Audit
Parses the Go AST to compute cyclomatic complexity per function. Flags deeply nested conditionals, switch cases, and high-cyclomatic logic hotspots.
Comment Density Check
Enforces genuine, descriptive multi-line documentation above exported functions, types, and variables. Boilerplate copy-pasted comments are rejected.
Boy Scout Docstring Check
Verifies that every newly added exported type, interface, method, or package-level function includes comprehensive Go docstrings before merging.
AST Magic String Detector
Scans the AST for raw string literals passed into critical domain APIs and state transitions, requiring strongly-typed constants instead.
Anti-OOP Abstraction Check
Enforces YAGNI by rejecting single-implementation interfaces and premature dependency injection wrappers. Shallow procedural code is prioritized.
Goroutine Lifecycle Check
Audits concurrent channel operations, context cancellation propagation, and sync.WaitGroup counters to prevent memory leaks and zombie routines.
Coupling Analysis Check
Measures afferent and efferent package coupling across internal modules, preventing circular dependencies and spaghetti architectures.
Duplicate Struct Check
Prevents copy-pasted model declarations across disparate subpackages by requiring shared model structs in core packages.
DRY Candidate Audit
Runs sliding-window AST comparison across staged files to surface multi-line structural duplicates before code reaches the repository trunk.
Go Format & Vet
Executes compiler-grade format and vet checks in sub-50ms to ensure 100% canonical Go syntax across all modified source trees.
Phase Discipline Check
Enforces the 6-phase lifecycle (IDLE -> PLAN -> EDIT -> REVIEW -> SYNC -> LEARN). Source code is read-only in PLAN and locked until Human PO authorization.
Protocol Symmetry Gate
Asserts the Axiom of Topological Symmetry: whenever substrate Go logic mutates, AGENTS.md protocols must be synchronized.
Asset Synchronization Gate
Prevents drift between compiled Go CLI subcommands and master markdown workflow documentation in src/nomos/core/assets.
Task ID Validation Gate
Enforces that every Git commit and worktree mutation is bound to an active, valid Task ID registered in SQLite (nomos_global.db).
Data Integrity Gate
Blocks autonomous agents from directly tampering with internal SQLite database files or task state JSON outside deterministic CLI boundaries.
Workflow Determinism Audit
Scans workflow playbooks to ensure only valid, deterministic CLI commands are declared inside executable bash blocks.
Open Core Architecture Check
Protects open-source repositories from accidental leakage of proprietary Tier 2 Nomos Code, Swarm, or Cockpit enterprise modules.
Contract-First Gate
Validates that Go function signatures, parameters, and return types conform strictly to interface specifications declared in contracts.yaml.
Blast Radius Constraint
Limits chore tasks to a tight blast radius of 3 files. Larger architectural mutations must be declared as structured Tasks or Cycles.
CrossRepoWorktreeGate
Asserts that all upstream dependent repositories linked via go.work have their task branches verified and committed prior to downstream merging.
Stash Audit Guard
Scans the root repository for uncommitted WIP stashes, preventing dirty state leaks from polluting hermetic worktree sandboxes.
Broken Wire & Zombie Agent Detector
Monitors task execution telemetry. Trips circuit breaker if an agent loops with 5 consecutive verification failures or remains dormant for > 12h.
Dependency Drift Gate
Asserts that hermetic worktrees across sibling repositories are rebased on the latest trunk commit, preventing merge skew.
Path Hardcoding Blocker
Blocks hardcoded host system or hidden workspace directory paths in application source code, requiring standard path discovery helpers.
Generated Code Blocker
Protects compiler-generated protobuf, OpenAPI, and mock files from manual edits, requiring generation pipeline re-runs.
Security Audit
Executes static security analysis to detect dynamic DOM XSS sinks, SQL injections, insecure deserialization, and hardcoded tokens.
Secret in Local Config Gate
Scans repository workspace files for accidental API keys, tokens, or private secrets, requiring centralized storage in environment variables.
Git Identity Gate
Verifies that commit author name and email are valid and configured, blocking placeholder test identities like Test User or [email protected].
Legacy Code Blocker
Blocks deprecated runtime libraries, unmaintained dependencies, and forbidden third-party frameworks listed in banned_imports.json.
Go Tests
Executes unit tests across all modified Go packages to guarantee zero behavioral regressions before merge approval.
TDD Coverage Check
Asserts that every modified logic unit has an accompanying test case in the change unit. Prevents untestable production code.
Doc Drift Check
Detects public function and CLI command signature changes, asserting that target documentation markdown files are updated in the same change unit.
Dead Code Detector
Scans package symbols to detect newly introduced functions, constants, or types that have no caller references anywhere in the repository tree.
Refactor Checks
Evaluates structural refactoring debt and hotspot scores, ensuring large files are split into cohesive single-responsibility units.
Churn-vs-Complexity Audit
Multiplies Git commit churn frequency by cyclomatic complexity to identify high-risk files that demand immediate decomposition.
Cross-Repo SSoT Gate
Detects redundant struct declarations across go.work sibling modules, requiring shared SDK types from upstream nomos core packages.
Config Drift Detector
Scans os.Getenv and process.env calls across the codebase to verify all accessed environment variables are documented in .env.example.
System Health Doctor
Audits SQLite database schemas, active locks, and Git pre-commit hooks, automatically repairing local environment anomalies.
Metric Parity Auditor
Verifies that empirical benchmarks and performance numbers cited in Living Vault handbooks match verified raw dispatch records with byte-exact consistency.
Bilateral Seam Parity Auditor
Audits bidirectional Universal Seams between Intent and Substrate hemispheres, enforcing cryptographic byte parity on all compiled contract schemas.
Dynamic Polyglot Tree-sitter Gate
Employs WebAssembly-compiled Tree-sitter grammars to perform concrete AST syntactic parsing and boundary checking across Go, Python, TypeScript, and Rust.
CapBAC Capability Lease Gate
Validates non-forgible Capability-Based Access Control (CapBAC) object leases on every task worktree and automatically verifies self-healing pre-commit defense hooks.