Module catalog

Phase 4. Written 2026-08-14. Authoritative for: the module set — identity, rung, dependencies, conflicts, parameters, and what each ships. Not authoritative for: the pattern definitions (those are pattern-catalog.md), the module file format (ADR-0003), or detection (ADR-0004).

Turns the ~80 extracted patterns into an installable set. Every module cites the patterns it implements; it does not restate them.

1. The set

15 modules. Rung is the maturity ladder — add states it and asks for confirmation when a repo is installing above its level.

Dependency graph

graph TD
  instructions[instructions] --> gates[gates]
  instructions --> backlog[backlog]
  instructions --> workflows[workflows]
  instructions --> skills[skills]
  backlog --> findings[findings]
  findings --> audit[audit]
  gates --> ci[ci]
  gates --> docauth["doc-authority"]
  backlog --> release[release]
  ci --> release
  backlog --> concurrency[concurrency]
  gates --> concurrency
  ci --> concurrency
  backlog --> designsync["design-sync"]
  skills --> designsync
  adr[adr]:::free
  session[session]:::free
  specs[specs]:::free
  classDef free stroke-dasharray: 4 3

adr, session and specs (dashed) have no dependencies — they can be installed alone.

Three dependencies exist because a source repo violated them and paid:

• audit → findings → backlog — hexguard ran a good audit prompt 268 times into 268 documents, because no register existed to hold rows and no work-item object existed to close them into.
• workflows → skills (soft: skills supplies the invocation discipline) — hexguard-templates’s 9-step procedure is the best in the corpus and its AGENTS.md reads “placeholder for future additions.”
• doc-authority → gates — axiom-mesh’s non-negotiable doc rules were enforced by review only, and decayed inside the file that states them.

add refuses to install a module whose dependencies are unmet, naming the incident.

2. Module specifications

Each entry: rung · deps · conflicts · params · ships · cost · provenance. ships uses ADR-0003’s dispositions — files (create) · rules (render) · skills (copy) · fragments (merge) · gates (declare). (A sixth, docs, was dropped from ADR-0003 on first use — it had the same disposition as files.)

instructions

Rung 0 · deps: none · conflicts: none

The only module every repo installs. Owns ADR-0001’s entire output surface.

Authored 2026-08-14 — modules/instructions/.

Current version: 1.1.0.

• params: harnesses (list: claude, copilot, cursor, agents-md) · core_budget (default 200 lines — vendor guidance, see harness-landscape §3)
• files: AGENTS.md skeleton (identity · non-negotiables · repo map · validation matrix · routing) · CLAUDE.md bridge · .ai/rungs.toml · .ai/rules/ scaffold
• fragments: owns AGENTS.md and .gitignore — every other module merges into them
• gates: core-size (declared — core over budget) · render-current (declared — generate-derivable) · repo-map-current (declared) · shell-backticks (hook, Claude only)
• cost: one file to keep true; re-render on rule edits
• implements: entry-point agents-md-bridge scoped-instructions core-size-budget validation-matrix repo-map narrowest-anchor-loop negative-conventions comms-style shell-editing-rules isolation-boundary-declaration
• provenance: 4/4 repos for the entry point; hexguard for scoping; rift-forge for the bridge and the shell rules; openhands for the isolation boundary — documented, then broken three more times, then made a hook

gates

Rung 1 · deps: instructions · conflicts: none

Owns the runner, the registry, and the ledger. Every other module registers its gates here rather than emitting scripts (ADR-0002).

Authored 2026-08-14 — modules/gates/. Its own gate set was trimmed during authoring: ids-unique and generated-current were listed here but are module-specific (backlog-ids, instructions-render-current), and what gates actually contributes is the engines they run on. What it keeps is repo-agnostic — plus two that no source repo had: rules-declare-enforcement (failure mode F1 made detectable) and self-tests-both-directions (the meta-gate).

• params: tiers (default fast, full) · ledger (default on)
• files: .ai/gates.toml registry · ledger .gitignore entry
• gates: the structural set, all declared — links-resolve · ids-unique · required-sections · referenced-paths-exist · frontmatter-valid · generated-current
• cost: near-zero to run; the runner is invoked as npx @rungs/cli check
• implements: structural-gates gate-self-test read-the-negation reasoned-exemption computed-claims generate-derivable enforcement-declaration ageing-signal tool-level-hook
• provenance: rift-forge — 42 check: gates with 27 self-tests, and 82 registry entries with hand-typed durations that motivated the ledger

enforcement-declaration is enforced here: every rule any module generates is tagged gated or review-only, and doctor reports rules that claim MANDATORY with no gate behind them. This is the module that makes failure mode F1 detectable.

backlog

Rung 1 · deps: instructions · conflicts: none

Authored 2026-08-14 — modules/backlog/ is the format exemplar.

• params: id_prefix (default WI) · root (default backlog) · integration_branch (default main) · branch_prefix (default feature)
• files: docs/{{root}}/README.md (the methodology) · BACKLOG.md board · TEMPLATE.md · items/
• skills: work-item (execute one end to end) · backlog-summary (per-category open items, ranking, workflow health)
• fragments: an AGENTS.md block naming the id scheme and the branch convention
• gates: ids (declared — uniqueness, citation integrity) · stale-blocker (declared — a doc may not say it is waiting for work that has finished) · merged-status (declared, one-directional — a merged branch cannot still be awaiting review)
• cost: one file per unit of work; a status field to keep true
• implements: work-item-lifecycle item-template-required-fields branch-per-item planning-rides-trunk scope-discipline epics-and-subitems bookkeeping-gates

sprint-archive and backlog-spaces were listed here and are deferred, found while authoring. Both are optional sections of the methodology, and ADR-0003 has no conditionals — so shipping them here would put sprint ceremony in front of every repo that installs a backlog. The evidence says defer: none of the four source repos started with sprints and only one ended with them (rift-forge, at 4 sprints against 543 archived items). What backlog keeps is plain archive-on-demand, since a container outgrowing itself is a rung-1 problem. Sprints become a rung-2 sprints module when a repo needs them.

• provenance: rift-forge — 102 live + 543 archived items; the two bookkeeping gates caught 37 items at review with code already landed, and one in_progress eight days past its own merge

findings

Rung 1 · deps: backlog

• params: id_prefix (default F) · path (default docs/{{backlog.root}}/FINDINGS.md)
• files: the register + its README
• skills: record-finding — record, and triage (promote · fix · dismiss with a reason)
• gates: findings-ids (declared) · findings-disposition-has-reason (declared) · self-declared-closure (declared — an open detail section cannot declare its own finding fixed)
• cost: near-zero per finding — that is the point
• implements: findings-log record-without-derailing finding-promotion audit-to-register
• provenance: rift-forge — 91 findings in the initial survey, plus the 2026-08-15 self-declared-closure gate. A finding is the observation; a work item is the decision. The object hexguard lacked under 268 audit reports. The closure gate is text-only by design: it catches a record contradiction and does not infer code-level closure.

adr

Rung 1 · deps: none · conflicts: none · current version: 1.1.0

• params: path (default docs/decisions) · id_format (default ADR-####)
• files: index.md with the admission rule · TEMPLATE.md
• gates: adr-index-current (declared) · adr-admission-fields (declared)
• cost: one record per constraining decision — the admission rule is what keeps that small
• implements: adr-record adr-admission-rule
• provenance: axiom-mesh — 48 ADRs stayed navigable because most candidates were routed elsewhere by a five-criterion gate

session

Rung 1 · deps: none · conflicts: none · current version: 1.1.0

• params: path (default .ai/session.md) · archive (default .ai/archive)
• files: .ai/session.md with fixed sections · .ai/archive/
• gates: session-sections-present (declared) · archive-named (declared)
• cost: a few minutes per session close, in file mode
• implements: session-handoff settled-decisions-lock dated-session-archive event-stream-not-audit-log (narrative continuity, not an event log or audit record)
• provenance: axiom-mesh plus the microsoft-agent-framework/openhands accountability warning — 21 dated archives, and the “Active Constraints / Decisions Since Last Archive” section that stops a fresh session relitigating settled questions

ci

Rung 1 · deps: gates

• params: provider (default github) · trigger (push | land)
• files: one workflow calling npx @rungs/cli check, matrix over packages where relevant
• gates: workflow-proliferation (declared — near-identical workflow files over a threshold)
• cost: CI minutes; the land trigger option exists because they are billed
• implements: matrix-not-per-item-ci workflow-proliferation-check ci-at-land-time
• provenance: hexguard — 98 near-identical per-package release workflows, because a phase checklist told the agent to add one each time. The proliferation gate exists so that cannot recur silently

specs

Rung 2 · deps: none

• params: path (default docs/specs) · id_format (default <PREFIX>-F## / <PREFIX>-US-###) · split_lines (default 600)
• files: README.md conventions · spec template with a mandatory scope section
• gates: spec-status-evidence (declared — a ✅ story names the commit that closed it; a 🟡 carries its note) · spec-ids-unique (declared)
• cost: a spec per surface; status kept per story
• implements: spec-ids-and-status mandatory-scope-section demo-not-done split-threshold reference-implementation-pointer adoption-guide
• provenance: hexguard-templates — “Demo ≠ done… a spec that overclaims integration is worse than no spec”, which needed a gate more than it needed a sentence

workflows

Rung 2 · deps: instructions · current version: 1.1.0

Decision procedures. Content, not mechanism — the mechanism is skills.

• params: path (default docs/workflows) · plan_path (default docs/plans) · upstream_repo (enables the extend-upstream branch of the reuse table)
• rules: the reuse decision table · doc-tier selection · per-concern decomposition · bounded invocation · invocation boundaries
• skills: decompose — the numbered per-concern planning procedure
• cost: authoring only; Tier 0 means trivial work stays undocumented
• implements: reuse-decision-table second-consumer-threshold doc-tier-selection per-concern-decomposition multi-story-batching numbered-workflow-steps phase-checklist lifecycle-verbs controlled-performance-comparison agent-facing-interface bounded-agent-loop ownership-changing-handoff protocol-with-escape-hatch resumable-approval-state approval-bound-to-request explicit-output-designation
• provenance: hexguard-templates, swe-agent, pydantic-ai, openai-agents-sdk, and microsoft-agent-framework — “Use this table instead of ‘use judgment’”, and Tier 0 must exist or the process gets routed around

skills

Rung 2 · deps: instructions · current version: 1.1.0

Not “the ability to have skills” — every module ships skills via ADR-0003. This is the authoring discipline and the gates that hold it.

• params: dir (resolved by harness set per ADR-0001: .claude/skills/ or .agents/skills/)
• rules: how to write a description: that routes · the neighbour convention
• gates: skill-spec-pure (declared — frontmatter restricted to the six Agent Skills fields unless extensions are opted in) · skill-names-neighbours (declared) · skill-writes-artifact (declared — a skill’s body names where its output lands)
• cost: near-zero
• implements: invocable-procedure skill-neighbours prompt-writes-artifact operating-skills prompt-index-routing agent-facing-interface explicit-output-designation
• provenance: rift-forge (13 skills, each naming its neighbours because at that count descriptions alone stop disambiguating) · axiom-mesh (21 playbooks with no invocation surface, whose content is directly portable now that SKILL.md is a standard) · openai-agents-sdk and microsoft-agent-framework for explicit ownership and output boundaries

audit

Rung 2 · deps: findings

• params: subject (what gets audited: package, service, surface) · criteria (list)
• skills: assess-<subject> — run the criteria, emit rows into the findings register
• gates: audit-output-is-rows (declared — refuses a per-subject document tree)
• cost: one run per subject; the register absorbs the output
• implements: audit-to-register lifecycle-verbs
• provenance: hexguard — the audit prompt was good enough to run 268 times; the output form was the defect. This module exists to keep the prompt and change the output

release

Rung 3 · deps: backlog, ci

• params: candidate_prefix · stable_branch · deploy_branch_prefix · changelog_dir · version_scheme
• skills: cut-release — initialize the consumed-through boundary → decide version → gate the current tree → assemble/delete fragments and advance the boundary → bump versions → gate the exact prepared tree → tag/deploy branch → next candidate, plus hotfix and rollback through the same boundary/bump/final-gate sequence
• gates: release-changelog-fragment (declared) · release-fragment-current (declared) · release-version-consistent (declared)
• cost: one procedure per release
• implements: candidate-and-release-lines release-skill
• provenance: rift-forge

design-sync

Rung 3 · deps: backlog, skills

• params: source (the external design authority) · mirror (default design-system/)
• skills: design-pull (down-sync only) · design-align (route every delta to a backlog item, a phase-gated future item, or an upstream change request)
• gates: design-deltas-routed (declared — no delta without a destination)
• cost: one pull-and-align pass per upstream change
• implements: external-authority-precedence two-way-design-sync
• provenance: rift-forge (industrialized) · hexguard-templates (the precedence rule: the design project is “layout/visual guidance, not a functional spec”). Never silent divergence

doc-authority

Rung 4 · deps: gates

For repos where several documentation surfaces restate each other. Expensive, and the highest-value module in the catalog when it applies.

• params: registry_path · scope_headers (bool)
• files: doc_ownership.md — topic · authoritative doc · must NOT appear in
• gates: ownership-respected (declared — the must-not-appear-in column, checked by term) · scope-headers-present (declared) · working-rules (declared — rule × surfaces propagation) · no-redirect-stubs (declared)
• cost: ongoing rule curation — a real recurring cost, stated at install
• implements: doc-ownership-registry scope-headers stub-rule no-paraphrase no-redirect-stubs working-rule-propagation defect-register-split inline-gap-callout
• provenance: axiom-mesh’s registry married to rift-forge’s gate — the combination neither repo has. axiom-mesh wrote the best ownership model in the corpus and checked none of it; rift-forge built the propagation gate after measuring five working rules that had changed and reached none of the files that teach them

concurrency

Rung 5 · deps: backlog, gates, ci

add states the threshold and requires confirmation: below ~5 concurrent sessions on one integration branch this is pure overhead. Selling this to a rung-1 repo is the most likely way this tool does harm.

• params: integration_branch · green_ref · worktree_root
• files: .gitattributes merge-driver declarations · setup script
• gates: no-integration-checkout (declared) · generated-not-text-merged (driver)
• cost: high — a real tooling surface with its own failure modes
• implements: green-ref failure-attribution land-protocol lock-not-checkout no-pre-land-full-verify preflight conflict-classes regenerate-never-merge id-claiming worktree-lifecycle ci-at-land-time
• provenance: rift-forge at 401 branches and 51 worktrees in the initial survey. Ships with its corrections included: the checkout-based lock that blocked every session and did not work, and the pre-land full verify that caused three of five refused lands

3. Deliberately not modules

The pattern catalog is research; not every pattern earns a module.

A testing module was specified in pattern-catalog §L’s proposed set and is dropped here. Its three patterns split cleanly into the three rows above, and what remained was stack-specific. That proposal was written before ADRs 0002–0003 set the no-stack-specific boundary.

4. Install profiles

rungs init offers these rather than a checkbox list of 15:

Profiles are starting points; add and remove work per module afterwards.

5. Corpus expectation matrix

Per ADR-0004 §5, a module whose [detect] block misclassifies any of the four source repos is not finished. This is the Phase 6 acceptance criterion, stated up front.

The matrix below is the initial corpus baseline, run 2026-08-14. It preserves the evidence that shaped module detection; it is not a live inventory of the refreshed Rift Forge candidate. Current candidate deltas and portability decisions are in rift-forge-capability-matrix.md.

C create · A adopt · P partial (adopt + install the gap) · ¶ paradigm difference, report only · — not applicable

The two cells that justify the whole product: gates on rift-forge (it has more gate machinery than anyone and no ledger, and gets one without a single file of its own being touched) and doc-authority across axiom-mesh + rift-forge (each has exactly the half the other lacks).

6. Next

1. Author modules/backlog/ in full — done 2026-08-14, modules/backlog/. The format survived, with two amendments it forced: ADR-0003’s redundant docs/ disposition was dropped, and sprint-archive / backlog-spaces were deferred out of this module because substitution-only templating cannot make a section optional.
2. instructions and gates — done 2026-08-14. The tracked profile’s spine is authored: the two modules that own every shared surface the others merge into.
3. Then findings, adr, session — done 2026-08-14. The tracked profile is complete: six modules, every rung-0 and rung-1 module in the catalog.
4. Then rung 2, then rung 3+ — done 2026-08-14. All fifteen modules are authored. Phase 4 is complete.
5. Phase 5. Executed 2026-08-14–15. The CLI, engines, render pipeline, and gate tables are running; detection was verified against the four source repos. The remaining Phase 6 milestone is a real install into a source repo, tracked in docs/roadmap.md.

Remaining format probes as of 2026-08-15: a live command gate shipped by a module (the gates module adopts existing validators but ships none), a conflicts entry, and a detect.paradigm path beyond the verified source-repo cases. These are test gaps, not claims that the engines do not exist.

Format findings so far — eleven across six modules, all applied to their sources rather than noted. ADR-0003’s redundant docs/ disposition dropped · sprint-archive/backlog-spaces deferred because substitution-only cannot make a section optional · hooks resolved as a gate trigger, not a sixth thing a module ships · markers use the target file’s comment syntax · fragments count against the entry document’s line budget · optional prose ships commented out · substitution vs. behavioural parameters (consumed_by) · cross-module parameter references for declared dependencies · a path parameter may contain separators · a parameter meaning “do nothing” is the absence of the module · and one dead parameter caught only by auditing all six at once.

Rung 2 added three more, one of them the most consequential yet:

• ${{ … }} is never substituted — GitHub Actions expressions share the delimiter, so without a $-passthrough rule the ci module silently corrupts its own workflow file at install.
• A behavioural parameter reaches file content through a managed block, never a conditional (ci.trigger regenerates the on: block).
• A fragment is a routing stanza, not a summary. Found by assembling the whole profile: a 73-line skeleton plus ten ~12-line fragments is 193 of the 200-line budget with nothing left for the repo’s own conventions. The budget binds at profile scale, not per module — which no single module could have revealed. Rewritten as routing stanzas the profile assembles to 134, leaving 66.

Rung 3+ added two more: a parameter never holds a value decided at runtime (release first declared candidate/{{version}}, referencing a version that does not exist at install time), and a module may declare a [threshold] with confirm = true — used only by concurrency, because the maturity ladder is advice until something enforces it.

Sixteen findings across fifteen modules, and the character changed twice: the early ones were corrections to the format, the middle ones were constraints only visible when modules compose, and the last were refinements. A full fifteen-module install assembles to 165 of the 200-line budget.