Prompt-pack validation — 5 public repositories#

This records the pre-ship validation of blueprint-author.md against the council acceptance gate: the pack ships only if ≥4 of 5 diverse public OSS repos produce a valid, toothed, non-vacuous blueprint whose gate verdict is explainable (not absurd). If acceptance fails, the pack is demoted to a [later] item and only the quickstart ships.

Result: 5 / 5 — the pack ships.

Every repo below is a public project; the names are used as public projects. Each was git clone --depth 1'd and the pack was followed as the drafting agent would: survey → pick one real invariant → bce author → bce validate → bce teeth → bce gate. The engine was the built dist CLI run inside a pinned node:22 container (the repo's own hazard-safe build path).

Method#

For each repo the agent chose ONE real architectural invariant the repo genuinely upholds, expressed it with a forbidden* constraint over the plugin-surface profile pointed at the repo's real source glob, and required:

bce validate → blueprint VALID
bce teeth --no-pin --extractor ast → toothed, exit 0 (the blueprint is not vacuous — a realistic change could redden it)
bce gate --extractor ast → an explainable verdict (a PASS on a repo that genuinely upholds the invariant; a RED only when a real violation is present)

Per-repo results#

#	Repo	Language / shape	Invariant (constraint)	Scope glob	Files scanned	`validate`	`teeth`	`gate` verdict	Explainable?
1	expressjs/express	JS, `lib/`	core must not import `lodash` (`forbiddenDependency:lodash`)	`lib/*.js`	6	VALID	toothed (1/1)	PASS, score 100, exit 0	✅ express deliberately ships without lodash
2	tj/commander.js	JS, `lib/`	core must not import `lodash` (`forbiddenDependency:lodash`)	`lib/*.js`	6	VALID	toothed (1/1)	PASS, score 100, exit 0	✅ commander is a zero-dependency library
3	colinhacks/zod	TS, `packages/zod/src/`	source must not import a third-party runtime dep (`forbiddenDependency:lodash`)	`packages/zod/src/*/.ts`	286	VALID	toothed (1/1)	PASS, score 100, exit 0	✅ zod ships zero runtime dependencies
4	fastify/fastify	JS, `lib/`	core must not import a direct HTTP client (`forbiddenDependency:axios`)	`lib/*.js`	32	VALID	toothed (1/1)	PASS, score 100, exit 0	✅ fastify's core has no HTTP client dependency
5	vuejs/core	TS monorepo, `packages/*/src/`	`@vue/reactivity` must not import the `@vue/runtime-dom` layer (`forbiddenDependency:@vue/runtime-dom`)	`packages/reactivity/src/*/.ts`	13	VALID	toothed (1/1)	PASS, score 100, exit 0	✅ reactivity is a lower layer; its `package.json` depends only on `@vue/shared`

All five: valid, toothed, explainable. Acceptance (≥4/5) is met with 5/5.

Why the PASS verdicts are meaningful, not vacuous#

Every real-repo verdict above is a PASS — because each repo genuinely upholds the invariant chosen for it. A skeptic's fair question is whether a PASS proves anything or just reflects that "the forbidden thing happens not to be there." Two facts answer that:

teeth is TOOTHED on every one. The engine independently confirmed, per repo, that a realistic change would redden the constraint — so the green verdict is a claim the code upholds the rule, not a formality that could never fail.
The RED direction is proven on a real repo. A copy of vuejs/core with a single injected line — import { render } from '@vue/runtime-dom' prepended to packages/reactivity/src/effect.ts (the exact layering violation the invariant forbids) — was gated with the same blueprint:

   ::error::blueprint vue-reactivity-layering@0.1.0 FAILED — score 80: 1 NEW violation(s).
   ::error::  forbidden-dependency-vue-runtime-dom (high): 1 violation(s)
   ::error::    - [forbidden-dependency-vue-runtime-dom/high] file:packages/reactivity/src/effect.ts
             observed: forbidden edge file:packages/reactivity/src/effect.ts -> @vue/runtime-dom is present
             expected: no @vue/runtime-dom edge
             at:       packages/reactivity/src/effect.ts#L1

Clean tree → exit 0 (PASS); drifted tree → exit 1 (RED), naming the offending file and line. Same blueprint, opposite verdicts by real process exit codes. The PASS on the real repo is therefore a meaningful "this layering holds," not a vacuous green.

Honest limits observed#

The invariants that generalized cleanly across arbitrary repos were the forbidden* content/dependency constraints over the plugin-surface profile — exactly what the pack steers the agent toward. The structural requiredComponent/requiredDependency constraints depend on the extractor recognizing a repo's specific component shape and are not the portable first choice (the pack says so).
Extraction is TypeScript/JavaScript only. All five repos are TS/JS; a non-TS/JS target is out of scope for the shipped extractor (the pack says so, and names Python as the next community target).
teeth and gate scan wall-times observed: 1–8 s per repo (the 286-file zod source was the slowest at 8 s) — well within an interactive agent loop.

Reproducing this#

The runs are deterministic (a pinned tree, no network in the grader). To reproduce one row, e.g. vuejs/core:

git clone --depth 1 https://github.com/vuejs/core /tmp/core
bce author --id vue-reactivity-layering \
  --name "vue reactivity layering — @vue/reactivity must not import the runtime-dom layer" \
  --intent-ref "policy/architectural-boundary" \
  --constraint "forbiddenDependency:@vue/runtime-dom:high" \
  --extraction-profile plugin-surface --scope-paths "packages/reactivity/src/**/*.ts" --min-files 8 \
  --repo /tmp/core --out vue-reactivity-layering.blueprint.json
bce validate --blueprint vue-reactivity-layering.blueprint.json
bce teeth --blueprint vue-reactivity-layering.blueprint.json --ct-repo /tmp/core --no-pin --extractor ast
mkdir -p /tmp/core/.blueprints && cp vue-reactivity-layering.blueprint.json /tmp/core/.blueprints/
bce gate --repo /tmp/core --extractor ast --all   # PASS (exit 0)