Ratified naming vocabulary: lexicon parsing, the hardcoded malware-term floor, the attributed escape, and the scanner that finds retired or prohibited terms in added lines
| Tier | foundation |
| Role | value_object |
| Path | crates/foundation/lexicon |
| Edition | 2021 |
| Targets | foundation_lexicon |
| Public items | 26 across 0 modules |
| Tests | 77 |
What it is for
Gate 1.3 naming check — the mechanism behind the naming rule.
Gate 1.3 says a name must describe the thing rather than the accusation against it. Written as prose that is a convention, and by this repo's own rule (Gate 3.0b) a rule with no mechanism is not a gate. This is the mechanism.
It blocks self-descriptive malware vocabulary in staged additions. The word is not banned outright — naming an attack in order to engineer against it is exactly what a threat model is for. It is banned unattributed: every legitimate use carries an inline NAMING-ALLOW: <reason> marker, so it is visible in review and greppable later, which is the same shape as INVARIANT-EXCEPTION: and primitives-extension:.
Class of failure this prevents: crates/infrastructure/screen-capture/Cargo.toml which propagated to cargo metadata, docs.rs, docs/AI_CONTEXT.md and docs/ONBOARDING.md. It meant "handle with the care raw input deserves." It read as an admission. Fixed in 7902a0e5; this stops the next one.
Capabilities
crate root
Gate 1.3 naming check — the mechanism behind the naming rule.
| Item |
|---|
pub const PROFANITY: & (& str, & str, & str) |
pub const SELF_DESCRIPTIVE_MALWARE_TERMS: & (& str, & str, & str) |
pub const ALLOW_MARKER: & str |
pub const FILE_ALLOW_MARKER: & str |
pub const FILE_MARKER_HEADER_LINES: usize |
fn file_attributed(text : & str) -> bool |
pub const OWNER_PATHS: & & str |
pub const GENERATED_PATHS: & & str |
fn split_camel_case(line : & str) -> String |
fn contains_word(haystack : & str, term : & str) -> bool |
fn autofix(path : & str, text : & str, tsv : & str) ->(String, usize) |
fn surface_form(matched : & str, term : & str, replacement : & str) -> Option <String> |
BrokenName
Gate 1.3 naming check — the mechanism behind the naming rule.
| Item |
|---|
pub struct BrokenName |
fn broken_names(text : & str, tsv : & str) -> Vec <BrokenName> |
Entry
Gate 1.3 naming check — the mechanism behind the naming rule.
| Item |
|---|
pub struct Entry |
Entry :: fn applies_to(& self, path : & str) -> bool |
fn parse_lexicon(tsv : & str) -> Vec <Entry> |
fn floor() -> Vec <Entry> |
fn lexicon(tsv : & str) -> Vec <Entry> |
Finding
Gate 1.3 naming check — the mechanism behind the naming rule.
| Item |
|---|
pub struct Finding |
fn scan(path : & str, added : & String) -> Vec <Finding> |
fn scan_with(path : & str, added : & String, tsv : & str) -> Vec <Finding> |
fn explain(f : & Finding) -> String |
Pictograph
Gate 1.3 naming check — the mechanism behind the naming rule.
| Item |
|---|
pub struct Pictograph |
fn pictographs(text : & str) -> Vec <Pictograph> |
fn is_pictograph(c : char) -> bool |
How to use it
No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.
Module structure
No public modules: the crate root is its whole surface.
Public surface
`crate root`
| Item | What it is |
|---|---|
pub const PROFANITY: & (& str, & str, & str) | Terms that describe our own capability with the name of the malware it resembles |
pub const SELF_DESCRIPTIVE_MALWARE_TERMS: & (& str, & str, & str) | — |
pub const ALLOW_MARKER: & str | The marker that attributes a legitimate use — threat model, detection, or a contrast drawn deliberately |
pub const FILE_ALLOW_MARKER: & str | The same attribution, declared once for a whole document |
pub const FILE_MARKER_HEADER_LINES: usize | How far into a document the file-scope marker is honoured. |
fn file_attributed(text : & str) -> bool | Whether a document declares itself attributed as a whole. |
pub struct Entry | One lexicon row, from docs/reference/lexicon-policy.tsv. |
Entry :: fn applies_to(& self, path : & str) -> bool | Whether this row applies to path, per its scope column. |
fn parse_lexicon(tsv : & str) -> Vec <Entry> | Parse docs/reference/lexicon-policy.tsv |
fn floor() -> Vec <Entry> | The hardcoded floor, as Entry rows |
fn lexicon(tsv : & str) -> Vec <Entry> | — |
pub struct Finding | One flagged line. |
pub struct Pictograph | One pictograph found in text: the character, and its codepoint so a reader can locate a glyph they may not be able to see or type. |
fn pictographs(text : & str) -> Vec <Pictograph> | Every pictograph in text (operator ruling: no emoji, 2026-09-10) |
fn is_pictograph(c : char) -> bool | The character ranges pictographs refuses |
pub const OWNER_PATHS: & & str | Paths that must state the terms in order to check for them |
pub const GENERATED_PATHS: & & str | — |
fn scan(path : & str, added : & String) -> Vec <Finding> | Scan added lines for unattributed self-descriptive malware vocabulary |
fn split_camel_case(line : & str) -> String | scan, against the floor plus a lexicon TSV |
fn contains_word(haystack : & str, term : & str) -> bool | — |
fn scan_with(path : & str, added : & String, tsv : & str) -> Vec <Finding> | — |
fn autofix(path : & str, text : & str, tsv : & str) ->(String, usize) | Apply every unambiguous replacement in text, case-insensitively, preserving everything else |
pub struct BrokenName | One place where a vocabulary rewrite welded a multi-word replacement into a name, leaving a space inside an identifier. |
fn broken_names(text : & str, tsv : & str) -> Vec <BrokenName> | — |
fn surface_form(matched : & str, term : & str, replacement : & str) -> Option <String> | Cast a ratified replacement into the surface form of the text it replaces |
fn explain(f : & Finding) -> String | Human-facing explanation for a finding |
No pub use re-exports: every item above is declared in this crate.
Boundary
Depends on no other workspace tier.
Shares tier foundation with 27 other crates: foundation-audit-log, foundation-basemodels, foundation-bounded-io, foundation-conversation-closure, foundation-crypto-sign, foundation-decisioning, foundation-encounter-vocabulary, foundation-fs-metadata, … (27 total).
_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._
Where it sits
| Tier (ontology) | foundation |
| Architectural role (taxonomy) | value_object |
| Location | crates/foundation/lexicon |
| Vocabulary in force (lexicon) | current |
Dependencies
Runtime, from outside the workspace.
| Crate | Requirement | Features | Optional | Only on |
|---|---|---|---|---|
regex | ^1 | — | no | always |
Development. None.
Build. None.
Depended on by. 5 workspace crates.
Signal flow — what reaches this crate, and what it reaches.
flowchart LR n_operations_control_plane["operations-control-plane"] -->|uses| SELF n_tools_corpus["tools-corpus"] -->|uses| SELF n_tools_doc_truth["tools-doc-truth"] -->|uses| SELF n_tools_githooks["tools-githooks"] -->|uses| SELF n_tools_packet_compile["tools-packet-compile"] -->|uses| SELF SELF["foundation-lexicon"] classDef self fill:#1f883d,stroke:#1f883d,color:#fff; class SELF self;
Feature flags
No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.
Targets
| Kind | Name | Source |
|---|---|---|
| lib | foundation_lexicon | `src/lib.rs` |
Error model
No public error type was detected: no public item declares a type named *Error, and no public signature returns one.
Operational characteristics
| Property | Evidence |
|---|---|
| async public surface | none detected |
| async runtime | none detected |
| database access | none detected |
| network I/O | none detected |
| unsafe code | none detected |
| environment variables | none detected |
No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.
Configuration
No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.
Related capabilities
5 workspace crates depend on this one: operations-control-plane, tools-corpus, tools-doc-truth, tools-githooks, tools-packet-compile.
Verification
| Kind | Count |
|---|---|
| Unit tests | 77 |
| Integration tests | 0 |
| Examples | 0 |
| Doctests | 0 |
Evidence by module. How often each public module is named by something executable.
| Module | Tests | Examples | Consumers |
|---|---|---|---|
crate root | 25 | 0 | 36 |
What the tests establish, by name:
a_bare_filename_in_a_link_target_survives_capitalisation_too—src/lib.rsa_bare_filename_in_prose_is_a_path_and_is_never_rewritten—src/lib.rsa_capitalized_match_capitalizes_the_replacement—src/lib.rsa_document_can_attribute_itself_whole_in_its_header—src/lib.rsa_document_without_the_marker_is_unaffected—src/lib.rsa_filename_used_as_link_text_is_a_path_too—src/lib.rsa_floor_term_is_never_auto_fixable—src/lib.rsa_free_standing_term_is_still_replaced—src/lib.rsa_governed_term_matches_the_word_and_not_every_word_containing_it—src/lib.rsa_malformed_lexicon_does_not_block_every_commit—src/lib.rsa_markdown_link_target_is_a_path_and_is_never_rewritten—src/lib.rsa_multi_word_replacement_never_lands_inside_a_joined_identifier—src/lib.rsa_multi_word_term_matches_on_the_whole_phrase—src/lib.rsa_pictograph_is_found_with_the_character_that_caused_it—src/lib.rsa_plural_match_pluralizes_the_replacements_last_word—src/lib.rsa_replacement_already_plural_is_left_alone—src/lib.rsa_repo_path_in_prose_is_never_rewritten—src/lib.rsa_single_word_replacement_may_still_join—src/lib.rsa_single_word_replacement_still_inflects—src/lib.rsa_term_auto_fixable_in_prose_is_still_a_judgment_call_in_code—src/lib.rsa_term_ending_in_s_is_not_treated_as_a_plural—src/lib.rsa_term_only_inside_a_filename_is_a_citation_not_a_naming_choice—src/lib.rsa_tsv_row_cannot_weaken_a_floor_term—src/lib.rsa_tsv_row_cannot_weaken_a_floor_term_whatever_scope_it_claims—src/lib.rsa_variation_selector_does_not_smuggle_one_past_the_check—src/lib.rsallows_a_marker_on_the_preceding_line_for_prose—src/lib.rsallows_a_threat_model_use_that_is_attributed—src/lib.rsan_all_caps_match_upcases_the_whole_replacement—src/lib.rsan_unbalanced_backtick_protects_the_rest_of_the_line—src/lib.rsan_unrelated_match_is_refused—src/lib.rs- _… 47 more_
Documentation coverage
| Measure | Documented | Total |
|---|---|---|
| Public items with rustdoc | 20 | 26 |
Public modules with a //! block | 0 | 0 |
pie showData
title Public items with rustdoc
"Documented" : 20
"No rustdoc detected" : 6
Metrics
| Metric | Value |
|---|---|
| Rust source files | 1 |
| Source lines | 1932 |
| Code lines | 1330 |
| Public API items | 26 |
| Public modules | 0 |
| Tests | 77 |
| Examples | 0 |
| Cargo features | 0 |
| Direct runtime dependencies | 1 |
| Workspace reverse dependencies | 5 |
pie showData
title Public API by kind
"constant" : 7
"function" : 14
"method" : 1
"struct" : 4
pie showData
title Rust source composition
"Code" : 1330
"Blank or comment" : 602
Generation
Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.