T15 — Rule pages: the schema, the generator, the index, and the first four rules

From: docs/briefs/direction__one-rule-a-stranger-can-paste-is-the-way-in.md §3.2, §4.1 · Size: a day and a half
Status: done, v1.37.0 (8 October 2026)

Why

The path from a stranger to a customer breaks before anybody tries anything. The first step on the site today is twenty minutes of prompts. The lead's memo of 7 October names the smaller unit: a page that asks do you want your agent to do this?, and, if not, gives the one line to add.

What to build

• site/rules/<id>.json, one file per rule: id (RM-R0001), version, changelog, question,

  capability (from the pinned vocabulary), shapes (the vaults where it is a row, with the row's barrier), answer (never or ask-first), line, paragraph, barrier_of_the_line (expectation, always), stronger (settings and boundaries, each with a source URL and the date read, or an explicit none known), before_after (empty until T16), status (drafted, run, tried).

• scripts/site/build-rules.mjs [--check]: validates every rule against the vocabulary and the

  vaults' grants, refuses a rule without a barrier statement, refuses any score-shaped field, and writes site/rules/index.html and site/rules/<id>.html with the shared chrome, the way build-stories.mjs does. Add the --check to package.json and CI.

• The index: filter by shape, by capability, by never or ask first. Each card is the question.
• The first four, from the memo:
  1. RM-R0001 other sessions' history: read.record.history, never.
  2. RM-R0002 other sessions' secrets: read.credential.host, never.
  3. RM-R0003 schedules on its own: create.schedule.tenant, ask first.
  4. RM-R0004 your connectors: authenticate-as.credential.tenant, ask first.
• Each page: the question as the title; the row behind it and the shapes; the line and the paragraph

  with copy buttons; this line is an expectation, then what stronger barrier exists or that none does; the before and after section, empty and saying so; and the close, a rule is one row; the ABP is every row for your agent, linking the vaults and the levels.

• Register the index and the four pages in site/pages.json under *Try it*'s place (unlisted pages),

  and link the index first on try-it.html.

Rules

• ask-first is this site's extension of the mandate; the page and the JSON say so.
• A vendor setting named on a page is quoted from the vendor's own page with the date it was read. If

  it was not read, the field is none known and the page says we have not found one.

• No severity, colour or level on a rule. Never the policy alone.

Done when

The four pages and the index are live, linked first from try-it.html, build-rules.mjs --check runs in npm run check, and a fifth rule can be added by writing one JSON file.