Why these tools can be trusted
The doctrine
None of these rules is decorative: each is enforced by a named test somewhere in the estate, and most were paid for by a production incident first. The catalog records the incidents as edge cases.
The parser refuses; it does not guess.
Unknown fields, unlabeled numbers, empty provenance, any spelling of expiry — refused with a teaching message. A parser that guesses turns every consumer into a second, silent spec.
A vendored file is byte-identical to canon or it is a defect.
Vendored scripts fail by disagreeing, not by breaking — silently, about exactly the field somebody just changed. Copies are compared byte-for-byte against canon, and re-vendoring precedes trusting any change.
Checkers are differentialled, never eyeballed.
Every vendored checker runs beside its package over the same documents; any disagreement about the verdict fails. Eleven identical copies once agreed with each other perfectly and disagreed with the spec in four places.
Docs are pinned to code.
References render from data modules and drift tests assert they match the real surface. Add a tool, and the reference fails until it is documented. The docs once described an API that never shipped; an integrator found out by reading source.
Say which branch you measured.
Reading a working checkout reports your checkout, not the repository. That mistake reported secret scanning at 35/35 when it was 15/35 — twice, in different tools, four hours apart.
Committed is not served.
The estate learned it three times: charters in every repo, served by none. Structural checks pass on files; only a fetch over the network, the way a stranger would, proves a surface exists.
A badge is a measurement, not a decision.
LIVE is granted by a URL answering. Registers name what each repository is; surveys check the registers against reality; and a check that cannot look fails rather than skips, because a green it did not earn is believed.
A number you can raise at will is an engineering gate, not a metric.
Ratios over counts, denominators nobody can pad, and the published figure is the one that moves only when somebody else acts.
Emitted commits carry [skip ci].
Record-keeping must never eat the deploy budget: 54% of one day’s commits were emitters refreshing fragments, against a 100-a-day build limit, and nothing anywhere was red.
A generated file is regenerated, never hand-edited.
Fragments, lockfiles, built directories are outputs. Editing one is a change the next run silently discards.
Measure the gap before building the fix.
A dated audit of every published @tetherto/* WDK package, module by module, came before any code — so wdk-policy-guard and wdk-staking-kit exist because the audit named two specific things missing (a per-agent spending cap, a staking primitive), not because a team guessed at what an integrator might want.
This property is not exempt: its own suite runs the vendored charter checker, the Activation check (all four artifacts), and an AAO launch gate that reads the same conformance package any stranger would install.
The measure-before-building rule above is not abstract: wdk-policy-guard and wdk-staking-kit are its most recent instance, cited in full on their catalog pages.