Module rules 

The rule layer.

Eight rules cover seven failure modes; the webhook case is split into a signature-mismatch rule and a timestamp-staleness rule so they can fire independently and arbitration ranks them by confidence. Public surface:

• The Rule trait. One implementation per failure mode.
• all_rules — returns the registered rules in evaluation order.
• diagnose — runs every rule, sorts by descending confidence, returns a Report.
• diagnose_traced — same as diagnose but also returns a RuleTrace per rule (wall-clock timing + outcome). Used by the CLI’s --trace flag and by benches/diagnose.rs.

Adding a rule

1. Add a private struct that implements Rule.
2. Register it in all_rules.
3. Add a positive fixture (fixtures/cases/<name>/case.json) and a paired negative under _negatives/ that looks similar but must not classify.
4. Add an expected_rule_id label to every calibration fixture that should exercise the rule.
5. Document the rule’s confidence rubric in docs/confidence_model.md.
6. Run cargo test and cargo insta review to accept the new snapshots.

Confidence model

Confidence values are not arbitrary; the rubric in docs/confidence_model.md lays out the bands (dispositive, strong, moderate, inadmissible) and tests/calibration.rs enforces them via Brier score over the labelled corpus.

Structs

RuleTrace

Per-rule trace entry produced by diagnose_traced.

Traits

Rule

One diagnostic rule.

Functions

all_rules

Return the registered rules in evaluation order.

diagnose

Run every rule, sort firing diagnoses by descending confidence, and return a Report with the top hit as primary and the rest in also_considered.

diagnose_traced

Same as diagnose but also returns a per-rule trace recording each rule’s wall-clock evaluation time and whether it fired.