[Rexy-5097]

Canonical identifier: Milestone M2 · Epic E4 · Issue #13
Dependencies: #6 ✔, #12 ✔ (merged as 530a412)
Selection: eligibility recomputed by parsing origin/main:docs/tis/TIS-v1.0.md §15. Eligible set {#13 Order 13, #14 Order 14, #15 Order 15}; lowest Order selects #13.

ADR-0026's Verification clause asks for "a kernel-zero-imports test plus six import-direction tests, each with a deliberate-violation case". The kernel test landed with #10, the domain/ stdlib-only rule with #12. This is the six.

The rule was inexpressible, not merely unenforced

check() permitted any import whose top-level root matched policy.root. For contexts.evaluation that root is contexts — so importing contexts.method counted as importing itself. ADR-0026's fifth dependency rule could not be stated, let alone violated. Demonstrated before changing anything:

policy.package : contexts.evaluation
policy.root    : contexts
permitted      : ['contexts', 'contracts', 'domain']

Fixed by matching self-imports against the policy's dotted package rather than its root, via a new imported_paths() that preserves full dotted paths. imported_roots() is retained — root granularity is still correct for classifying stdlib and third party.

This is a strict tightening. #6's own 17 self-tests pass unchanged and the real gate still exits 0. No gate was weakened.

The six rules, encoded as ADR-0026 writes them

Context	May import	Source
ingest · curation · groundtruth · method	contracts, domain, kernel	ADR-0026 + each README
evidence	contracts, domain, kernel	TIS E11 §10 uses kernel.provenance.ancestors()
evaluation	contracts, domain	ADR-0026 as written

No policy grants the contexts root, so no context may import another. Third-party roots are not pre-granted: the ADR grants none, and a context needing astropy should add one reviewable line rather than inherit a permission nobody voted for (STD-11).

Architecture Contradiction — reported, not resolved (AC-001)

ADR-0026: "Evaluation imports contracts and domain only." TIS E10 §7 requires an Evaluation to carry its own digest. ADR-0005 reserves minting to the kernel. Those three cannot all hold.

Encoded exactly as frozen, and reported for resolution by ADR before M7/#30. Quietly adding kernel to R5 would be weakening a gate to fit an unwritten future need.

Separately, ADR-0026 states R5 twice and inconsistently — the context table says "Depends on contracts only", the Decision says "contracts and domain only". The precise Decision wording is taken as operative, following the DR-006 precedent (DR-007).

Empty contexts, and why these rules are not decoration

contexts/* holds six READMEs and no Python. So none of the 55 architecture tests assert over the real tree — each builds a violating module on disk and asserts the analyser reports it. The verdict is about the analyser, which exists.

Two tests make the rules bind on the day code arrives rather than the day someone remembers them:

• every context declares populated=False, and the gate rejects that declaration the moment a module appears — the first .py file in any context goes red until that issue states what it may import
• a seventh context added without a policy fails, because undeclared() finds packages by __init__.py and none of these directories has one

Without these entries a new module under contexts/ would be governed by nothing at all.

Feature-level integration

Six rejection tests are all satisfied by a rule set that rejects everything. tests/integration/test_context_rules_with_platform.py asks the complementary question, which needs three real subsystems at once: does the rule set permit the composition the architecture calls for?

A plausible Ingest module builds a domain Observation, validates it against the real contracts schema, and registers it in the kernel provenance store. The gate permits it — and the same source then genuinely runs, producing a schema-valid, DAG-linked artifact with ingest_time null and nothing fabricated.

Then the point of the whole gate, stated as a test: the violating variant executes perfectly. It differs by one import; strip that line and the remainder is byte-identical. No test that runs the context would ever notice the coupling.

And the same text is permitted under R1 and refused under R5 — the verdict changes with the context, which is what makes these rules directional rather than one global allow-list.

Verification

unit (kernel + domain)   322 passed
tests/architecture       460 passed   (+55)
tests/integration         63 passed   (+6)
research/tests/v2        188 passed
links / imports / contracts gates      clean
imports gate: 30 modules, 134 imports, 9 policies

clean export (git archive HEAD):
  unit 322 · architecture 460 · integration 39 passed + 24 pre-existing errors
  (identical 24 on origin/main before this change — see the report)

CI impact

No workflow change. Both new files land in jobs that already run — tests/architecture/ in architecture, tests/integration/ in integration. Still eight required contexts, no new job.

🤖 Generated with Claude Code