refactor: align rule.yaml gate shape with daemon-native policy

The first cut had its own `gate.when` / `gate.on_hit` / `gate.require_strong`
shape that the CLI would have to translate before installing. Aligning the
schema with what the daemon already understands (`gate.match` /
`gate.evaluate`) means an install is a verbatim copy of the gate block
into the daemon's policy YAML.

`require_strong` is dropped from v1 — once the daemon exposes a
strong-signer requirement on individual gates we can re-introduce it.

Build-index + site card updated to surface the first evaluator's action
instead of the old on_hit field.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: knhn1004

docs/adding-a-rule.md

@@ -29,9 +29,9 @@ Edit `rules/my-new-rule/rule.yaml`. The schema lives at `schema/rule.schema.json
 | `description` | 1–3 sentences of why the rule exists. |
 | `severity` | `info`, `low`, `medium`, `high`, `critical`. |
 | `tags` | Free-form, lowercase. Used by site search. |
-| `gate.when` | Match conditions — same shape as the OpenAgentLock policy `when` block. |
-| `gate.on_hit` | `allow`, `deny`, `monitor`, or `warn`. |
-| `gate.require_strong` | `true` if this rule should refuse weak signers (unattested / software). |
+| `gate.match` | Match conditions in OpenAgentLock-native shape: `tool`, `any_command_regex` (array), `any_path_regex`, `any_url_regex`, `path_glob`. |
+| `gate.evaluate` | Array of evaluator entries. v1 supports `kind: always` with `action` ∈ {`allow`, `deny`, `monitor`, `warn`}. Richer evaluators (`allowlist`, `typosquat`) are passed through verbatim. |
+| `gate.mode` | (optional) Per-gate mode override: `monitor` or `firewall`. |
 
 Then write `README.md` for your rule. Cover:
 

graphify-out/GRAPH_REPORT.md

@@ -0,0 +1,58 @@
+# Graph Report - openagentlock-rules  (2026-05-02)
+
+## Corpus Check
+- 3 files · ~2,879 words
+- Verdict: corpus is large enough that graph structure adds value.
+
+## Summary
+- 13 nodes · 19 edges · 3 communities detected
+- Extraction: 100% EXTRACTED · 0% INFERRED · 0% AMBIGUOUS
+- Token cost: 0 input · 0 output
+
+## Community Hubs (Navigation)
+- [[_COMMUNITY_Community 0|Community 0]]
+- [[_COMMUNITY_Community 1|Community 1]]
+- [[_COMMUNITY_Community 2|Community 2]]
+
+## God Nodes (most connected - your core abstractions)
+1. `ruleCard()` - 5 edges
+2. `render()` - 5 edges
+3. `el()` - 4 edges
+4. `main()` - 3 edges
+5. `readmeExcerpt()` - 2 edges
+6. `buildIndex()` - 2 edges
+7. `INSTALL_CMD()` - 2 edges
+8. `severityClass()` - 2 edges
+9. `activeSeverities()` - 2 edges
+
+## Surprising Connections (you probably didn't know these)
+- `ruleCard()` --calls--> `el()`  [EXTRACTED]
+  site/app.js → site/app.js  _Bridges community 0 → community 2_
+
+## Communities
+
+### Community 0 - "Community 0"
+Cohesion: 0.6
+Nodes (4): activeSeverities(), el(), main(), render()
+
+### Community 1 - "Community 1"
+Cohesion: 1.0
+Nodes (2): buildIndex(), readmeExcerpt()
+
+### Community 2 - "Community 2"
+Cohesion: 0.67
+Nodes (3): INSTALL_CMD(), ruleCard(), severityClass()
+
+## Knowledge Gaps
+- **Thin community `Community 1`** (3 nodes): `buildIndex()`, `readmeExcerpt()`, `build-index.ts`
+  Too small to be a meaningful cluster - may be noise or needs more connections extracted.
+
+## Suggested Questions
+_Questions this graph is uniquely positioned to answer:_
+
+- **Why does `ruleCard()` connect `Community 2` to `Community 0`?**
+  _High betweenness centrality (0.038) - this node is a cross-community bridge._
+- **Why does `render()` connect `Community 0` to `Community 2`?**
+  _High betweenness centrality (0.028) - this node is a cross-community bridge._
+- **Why does `el()` connect `Community 0` to `Community 2`?**
+  _High betweenness centrality (0.005) - this node is a cross-community bridge._

graphify-out/cache/22d671ef00e87ab061e075ba1d830d8a37dda942bccc807206d4f16c13512f4c.json

@@ -0,0 +1 @@
+{"nodes": [{"id": "users_oliver_code_openagentlock_rules_tools_build_index_ts", "label": "build-index.ts", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L1"}, {"id": "build_index_readmeexcerpt", "label": "readmeExcerpt()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L50"}, {"id": "build_index_buildindex", "label": "buildIndex()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L59"}], "edges": [{"source": "users_oliver_code_openagentlock_rules_tools_build_index_ts", "target": "node_fs", "relation": "imports_from", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L8", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_tools_build_index_ts", "target": "node_path", "relation": "imports_from", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L9", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_tools_build_index_ts", "target": "node_url", "relation": "imports_from", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L10", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_tools_build_index_ts", "target": "yaml", "relation": "imports_from", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L11", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_tools_build_index_ts", "target": "build_index_readmeexcerpt", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L50", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_tools_build_index_ts", "target": "build_index_buildindex", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L59", "weight": 1.0}, {"source": "build_index_buildindex", "target": "build_index_readmeexcerpt", "relation": "calls", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L87", "weight": 1.0}], "raw_calls": [{"caller_nid": "build_index_readmeexcerpt", "callee": "trim", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L51"}, {"caller_nid": "build_index_readmeexcerpt", "callee": "replace", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L51"}, {"caller_nid": "build_index_readmeexcerpt", "callee": "replace", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L51"}, {"caller_nid": "build_index_readmeexcerpt", "callee": "replace", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L51"}, {"caller_nid": "build_index_readmeexcerpt", "callee": "slice", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L56"}, {"caller_nid": "build_index_buildindex", "callee": "readdirSync", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L61"}, {"caller_nid": "build_index_buildindex", "callee": "join", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L62"}, {"caller_nid": "build_index_buildindex", "callee": "isDirectory", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L63"}, {"caller_nid": "build_index_buildindex", "callee": "statSync", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L63"}, {"caller_nid": "build_index_buildindex", "callee": "join", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L65"}, {"caller_nid": "build_index_buildindex", "callee": "parse", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L66"}, {"caller_nid": "build_index_buildindex", "callee": "readFileSync", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L66"}, {"caller_nid": "build_index_buildindex", "callee": "readFileSync", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L70"}, {"caller_nid": "build_index_buildindex", "callee": "join", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L70"}, {"caller_nid": "build_index_buildindex", "callee": "push", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L75"}, {"caller_nid": "build_index_buildindex", "callee": "trim", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L78"}, {"caller_nid": "build_index_buildindex", "callee": "sort", "source_file": "/Users/oliver/code/openagentlock-rules/tools/build-index.ts", "source_location": "L90"}]}

graphify-out/cache/49a607514c74bba28b2f7fd6a86ddca57ab5fdfe7dbc95f9f68be186ffec5301.json

@@ -0,0 +1 @@
+{"nodes": [{"id": "users_oliver_code_openagentlock_rules_site_app_js", "label": "app.js", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L1"}, {"id": "app_install_cmd", "label": "INSTALL_CMD()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L11"}, {"id": "app_severityclass", "label": "severityClass()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L20"}, {"id": "app_activeseverities", "label": "activeSeverities()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L26"}, {"id": "app_matches", "label": "matches()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L32"}, {"id": "app_el", "label": "el()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L45"}, {"id": "app_rulecard", "label": "ruleCard()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L65"}, {"id": "app_render", "label": "render()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L122"}, {"id": "app_main", "label": "main()", "file_type": "code", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L141"}], "edges": [{"source": "users_oliver_code_openagentlock_rules_site_app_js", "target": "app_install_cmd", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L11", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_site_app_js", "target": "app_severityclass", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L20", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_site_app_js", "target": "app_activeseverities", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L26", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_site_app_js", "target": "app_matches", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L32", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_site_app_js", "target": "app_el", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L45", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_site_app_js", "target": "app_rulecard", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L65", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_site_app_js", "target": "app_render", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L122", "weight": 1.0}, {"source": "users_oliver_code_openagentlock_rules_site_app_js", "target": "app_main", "relation": "contains", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L141", "weight": 1.0}, {"source": "app_rulecard", "target": "app_install_cmd", "relation": "calls", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L66", "weight": 1.0}, {"source": "app_rulecard", "target": "app_el", "relation": "calls", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L68", "weight": 1.0}, {"source": "app_rulecard", "target": "app_severityclass", "relation": "calls", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L70", "weight": 1.0}, {"source": "app_render", "target": "app_activeseverities", "relation": "calls", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L124", "weight": 1.0}, {"source": "app_render", "target": "app_el", "relation": "calls", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L131", "weight": 1.0}, {"source": "app_render", "target": "app_rulecard", "relation": "calls", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L137", "weight": 1.0}, {"source": "app_main", "target": "app_el", "relation": "calls", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L152", "weight": 1.0}, {"source": "app_main", "target": "app_render", "relation": "calls", "confidence": "EXTRACTED", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L157", "weight": 1.0}], "raw_calls": [{"caller_nid": "app_severityclass", "callee": "includes", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L21"}, {"caller_nid": "app_activeseverities", "callee": "map", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L28"}, {"caller_nid": "app_activeseverities", "callee": "filter", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L28"}, {"caller_nid": "app_matches", "callee": "has", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L33"}, {"caller_nid": "app_matches", "callee": "toLowerCase", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L35"}, {"caller_nid": "app_matches", "callee": "includes", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L37"}, {"caller_nid": "app_matches", "callee": "toLowerCase", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L37"}, {"caller_nid": "app_matches", "callee": "includes", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L38"}, {"caller_nid": "app_matches", "callee": "toLowerCase", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L38"}, {"caller_nid": "app_matches", "callee": "includes", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L39"}, {"caller_nid": "app_matches", "callee": "toLowerCase", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L39"}, {"caller_nid": "app_matches", "callee": "some", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L40"}, {"caller_nid": "app_matches", "callee": "includes", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L41"}, {"caller_nid": "app_matches", "callee": "toLowerCase", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L41"}, {"caller_nid": "app_el", "callee": "createElement", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L46"}, {"caller_nid": "app_el", "callee": "entries", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L48"}, {"caller_nid": "app_el", "callee": "entries", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L51"}, {"caller_nid": "app_el", "callee": "setAttribute", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L52"}, {"caller_nid": "app_el", "callee": "isArray", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L56"}, {"caller_nid": "app_el", "callee": "appendChild", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L59"}, {"caller_nid": "app_el", "callee": "createTextNode", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L59"}, {"caller_nid": "app_rulecard", "callee": "appendChild", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L74"}, {"caller_nid": "app_rulecard", "callee": "appendChild", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L76"}, {"caller_nid": "app_rulecard", "callee": "appendChild", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L79"}, {"caller_nid": "app_rulecard", "callee": "appendChild", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L87"}, {"caller_nid": "app_rulecard", "callee": "addEventListener", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L99"}, {"caller_nid": "app_render", "callee": "trim", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L123"}, {"caller_nid": "app_render", "callee": "filter", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L125"}, {"caller_nid": "app_render", "callee": "replaceChildren", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L127"}, {"caller_nid": "app_render", "callee": "appendChild", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L130"}, {"caller_nid": "app_render", "callee": "appendChild", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L137"}, {"caller_nid": "app_main", "callee": "fetch", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L143"}, {"caller_nid": "app_main", "callee": "json", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L145"}, {"caller_nid": "app_main", "callee": "replaceChildren", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L151"}, {"caller_nid": "app_main", "callee": "addEventListener", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L158"}, {"caller_nid": "app_main", "callee": "addEventListener", "source_file": "/Users/oliver/code/openagentlock-rules/site/app.js", "source_location": "L159"}]}