---
title: "Audit Rule Catalog"
slug: "audit-rule-catalog"
category: "knowledge-vaults"
tags: ["knowledge-vaults", "audit", "linting", "quality-gates", "schema", "reference"]
status: "stable"
last_updated: 2026-09-01
summary: "Every auditor rule id with its severity and bucket, the M000 meta rule, spec-level severity overrides, and the mechanical tier autofix may repair."
related: ["[[knowledge-vaults/vault-audit]]", "[[knowledge-vaults/vault-frontmatter-schema]]", "[[knowledge-vaults/semantic-audit]]", "[[knowledge-vaults/decision-journals]]", "[[knowledge-vaults/source-verification]]", "[[knowledge-vaults/vault-schema-migration]]", "[[knowledge-vaults/rigor-frameworks]]"]
---

## Overview

The rule ids are the shared vocabulary between the auditor script, the triage step, and the agent acting on the report. A finding is cited by id, a severity override in the spec is keyed by id, and a run-over-run delta is counted by id. This page is the reference. How to run the auditor and triage what it finds is in [[knowledge-vaults/vault-audit]].

## Read the structural rules as framework-agnostic

C-rules fire on every vault regardless of framework. They check shape, links, dates, and whichever fields the spec declares required.

| Rule | Finding | Severity |
| --- | --- | --- |
| C000 | Frontmatter unparseable | critical |
| C001 | Orphan atom, no inbound or outbound links | warning |
| C002 | Broken wikilink | warning |
| C003 | Missing frontmatter | warning |
| C004 | Filename does not match the type's pattern | warning |
| C005 | Decision modified after its decision date | critical |
| C006 | Undigested source, zero atoms extracted past the age threshold | info |
| C007 | Decision past its expected resolution date | warning |
| C008 | Required field missing or empty | warning |
| C009 | Atom past the atomicity byte threshold | warning |
| C010 | Stale seedling | info |
| C011 | Publishable claim failing the corroboration or legal gate | critical |
| C012 | Stale verification on a decision-relevant claim | warning |
| C013 | Unresolved contradiction past its aging threshold | info |
| C014 | Note filed outside its type's folder | warning |
| C015 | Content note with an absent or unmappable type | warning |

The three criticals protect provenance. Unparseable frontmatter (C000) hides a note from every other check. A decision edited after its date (C005) is a hindsight rewrite, per [[knowledge-vaults/decision-journals]]. An under-corroborated publishable claim (C011) breaks the gate in [[knowledge-vaults/source-verification]].

C015 matters more than it looks. Without it, a note with no `type` silently evades every per-type check, so the cleanest way to pass the audit would be to strip the field that makes a note checkable.

## Read the schema rules as prefix-triggered

S-rules encode a rigor framework and fire only on notes that opt in by type or filename prefix, per [[knowledge-vaults/rigor-frameworks]]. Existing notes in another framework are untouched.

| Rule | Finding | Severity |
| --- | --- | --- |
| S003 | Theme atom with fewer than three linked data points | warning |
| S004 | Result atom not linked to a hypothesis | warning |
| S006 | Objective atom missing concept, example, or assessment links | warning |
| S007 | ADR missing an alternatives section | warning |
| S008 | Decision missing `key_atoms` | warning |
| S009 | Naked link dump in an atom | info |

S001, S002, and S005 are reserved for future built-in rules. Custom rules a vault declares take a `U` prefix (U001, U002) so they never collide with a reserved slot.

## Treat M000 as a failed run, not a warning

M000 fires when `vault-spec.yaml` is missing or unparseable and the auditor fell back to built-in defaults. It is emitted as a warning precisely so the run exits non-zero, and `spec_status` in the JSON summary reads `missing` or `invalid`. A clean count sitting next to M000 says nothing about the vault's real rules; generate or repair the spec before triaging anything else.

## Override severities in the spec, never in the script

`severity_overrides` in the spec maps a rule id to a severity. The defaults stay in the script; the vault's opinion lives in its spec, alongside the per-type fields described in [[knowledge-vaults/vault-frontmatter-schema]].

## Autofix only the mechanical tier

The auditor's `--fix` mode repairs what it can derive with certainty and nothing else.

- **C003, missing frontmatter.** Adds a block, with `type` taken from the folder when that folder maps to exactly one type.
- **C008, missing required field.** Fills `id` from the filename, `created` and `modified` from file mtime, `status` with the seedling default, and the structural tags. Semantic fields (`title`, `sources`, `confidence`, `decision_date`) stay open for a human.
- **C015, untyped note.** Sets `type` from an unambiguous folder.
- **C002, broken link.** Repairs only when exactly one filename matches the target.

Everything else is left alone. An autofix that invents a `title`, a `source`, or a `confidence` value is fabricating research provenance. Dry run is the default, `--apply` writes, and an un-versioned vault is refused without a further `--force`, because there is no undo otherwise. The case where a field becomes newly required across many notes is handled as a migration in [[knowledge-vaults/vault-schema-migration]].

## Related

- [[knowledge-vaults/vault-audit]]
- [[knowledge-vaults/vault-frontmatter-schema]]
- [[knowledge-vaults/semantic-audit]]
- [[knowledge-vaults/decision-journals]]
- [[knowledge-vaults/source-verification]]
- [[knowledge-vaults/vault-schema-migration]]
- [[knowledge-vaults/rigor-frameworks]]