---
id: OBPI-0.0.22-06-rule-file-matrix-scorecard
parent: ADR-0.0.22-security-sensitivity-doctrine
item: 6
lane: Heavy
status: Completed
depends_on:
  - OBPI-0.0.22-03-validate-sensitivity-scope
  - OBPI-0.0.22-04-requires-security-review-attestation
  - OBPI-0.0.22-05-gate5-walkthrough-arb-slot
---

# OBPI-0.0.22-06-rule-file-matrix-scorecard: Rule file plus AGENTS.md matrix plus advisory scorecard entry

## ADR Item

- **Source ADR:** `docs/design/adr/foundation/ADR-0.0.22-security-sensitivity-doctrine/ADR-0.0.22-security-sensitivity-doctrine.md`
- **Checklist Item:** #6 - "Rule file + AGENTS.md matrix + advisory scorecard — Author `.gzkit/rules/security-sensitivity.md`; AGENTS.md three-axis matrix; advisory-rules-audit.md scorecard entry (Mechanical); `gz agent sync control-surfaces` propagates to mirrors; foundation-kind closeout walkthrough per ADR-0.0.18"

**Status:** Draft

## Objective

After this OBPI lands, `.gzkit/rules/security-sensitivity.md` exists as the canonical addressable home for the third-axis doctrine — the Invariant, the registry contract at `data/security_surfaces.json`, the `gz validate --sensitivity` floor + escalate-not-escape behavior, the heightened Gate 5 walkthrough enumeration, and the scanner-unavailable failure mode — and is locked in by an AGENTS.md matrix citation, a Mechanical-classified scorecard entry in `docs/governance/advisory-rules-audit.md` (so `gz validate --advisory-scorecard` fails closed against silent removal), vendor-mirror propagation via `gz agent sync control-surfaces`, and REQ-derived tests covering every cross-surface binding.

## Lane

**Heavy** - This OBPI changes a command/API/schema/runtime contract surface.

> Heavy is reserved for command/API/schema/runtime-contract changes. Process,
> documentation, and template-only work stays Lite unless it changes one of
> those external surfaces.

## Allowed Paths

<!-- What files/directories are IN SCOPE? Be explicit with paths. -->

- `docs/design/adr/foundation/ADR-0.0.22-security-sensitivity-doctrine/ADR-0.0.22-security-sensitivity-doctrine.md` — parent ADR for intent and scope
- `docs/design/adr/foundation/ADR-0.0.22-security-sensitivity-doctrine/obpis/OBPI-0.0.22-06-rule-file-matrix-scorecard.md` — this brief
- `.gzkit/rules/security-sensitivity.md` — canonical rule file authored by this OBPI
- `.claude/rules/security-sensitivity.md` — Claude mirror, regenerated by `gz agent sync control-surfaces`
- `.agents/rules/security-sensitivity.md` — Codex mirror, regenerated by sync (if surface exists)
- `.github/instructions/security-sensitivity.md` — Copilot mirror, regenerated by sync
- `AGENTS.md` — final-projection matrix update if matrix lives in AGENTS.md (kept in sync with OBPI-04's matrix change)
- `src/gzkit/templates/agents.md` — template source for AGENTS.md regeneration
- `src/gzkit/sync_surfaces.py` — surface-sync logic if rule-mirror wiring requires it
- `docs/governance/advisory-rules-audit.md` — scorecard entry classifying the new rule as Mechanical
- `tests/governance/**` — advisory-scorecard coverage and rule-frontmatter tests

## Denied Paths

<!-- What files/directories are OUT OF SCOPE? Agents will not touch these. -->

- Paths not listed in Allowed Paths
- New dependencies
- CI files, lockfiles

## Requirements (FAIL-CLOSED)

<!-- Constraints that MUST hold for THIS brief's scope. Cross-brief invariants
     live in the parent ADR Decision; per-brief requirements assert this brief's
     contract only. -->

1. REQUIREMENT: A new canonical rule file `.gzkit/rules/security-sensitivity.md` exists with valid frontmatter (per `RuleFrontmatter` in `src/gzkit/rules.py`), a body-level `<!-- rule-version: 0.1.0 -->` marker, a visible `> **Rule version:** \`0.1.0\`` block quote with rationale, and content declaring the invariant.
1. REQUIREMENT: The rule file documents (a) the canonical invariant ("security work needs heightened review regardless of lane or kind"), (b) the registry contract (self-bootstrapping, edits require `sensitivity: security`), (c) the `gz validate --sensitivity` scope behavior (auto-detect floor + escalate-not-escape), (d) the heightened walkthrough enumeration consumed by `gz obpi complete`, and (e) the scanner-unavailable failure mode.
1. REQUIREMENT: AGENTS.md is updated with the "Lane & Kind & Sensitivity Attestation Matrix" section (the third-axis projection added in OBPI-04) — this OBPI confirms the section is final, cites the rule file, and ports cleanly to other GovZero-compliant repos.
1. REQUIREMENT: `docs/governance/advisory-rules-audit.md` carries a scorecard entry for `security-sensitivity.md` classified as **Mechanical** (the rule has a `gz validate --sensitivity` enforcer; doctrine-only entries are Judgment per the trust-doctrine page).
1. REQUIREMENT: `gz agent sync control-surfaces` propagates `.gzkit/rules/security-sensitivity.md` to the vendor mirrors at `.claude/rules/`, `.agents/rules/`, and `.github/instructions/` per `.claude/rules/skill-surface-sync.md`. Mirrors carry the same body-level `<!-- rule-version: ... -->` marker; sync produces no warnings.
1. REQUIREMENT: After this OBPI lands, `uv run gz validate --advisory-scorecard` passes (the new rule has its scorecard entry) and `uv run gz validate --documents` passes (rule frontmatter is schema-valid).
1. REQUIREMENT: Foundation-kind closeout walkthrough per ADR-0.0.18 fires on this OBPI's `gz obpi complete` (foundation-kind rigor at brief level, regardless of lane).
1. REQUIREMENT: NEVER author the schema/frontmatter field, the registry, the validate scope, the audit OR predicate, the walkthrough extension, or the ARB canonical command slot in this OBPI — those belong to OBPIs 01-05.

> STOP-on-BLOCKERS: if prerequisites are missing, print a BLOCKERS list and halt.

## Discovery Checklist

<!-- What to read before implementation. Complete this checklist first. -->

**Governance (read once, cache):**

- [ ] `.github/discovery-index.json` - repo structure
- [ ] `AGENTS.md` or `CLAUDE.md` - agent operating contract
- [ ] Parent ADR - understand full context

**Context:**

- [ ] Parent ADR: `docs/design/adr/foundation/ADR-0.0.22-security-sensitivity-doctrine/ADR-0.0.22-security-sensitivity-doctrine.md`
- [ ] Related OBPIs in same ADR

**Prerequisites (check existence, STOP if missing):**

- [ ] Required path exists or is intentionally created in this OBPI: `docs/design/adr/foundation/ADR-0.0.22-security-sensitivity-doctrine/ADR-0.0.22-security-sensitivity-doctrine.md`
- [ ] Required path exists or is intentionally created in this OBPI: `.gzkit/rules/security-sensitivity.md`
- [ ] Parent ADR evidence artifacts referenced by this brief are present

**Existing Code (understand current state):**

- [ ] Existing tests adjacent to the Allowed Paths reviewed before implementation
- [ ] Parent ADR integration points reviewed for local conventions

## Quality Gates

<!-- Which gates apply and how to verify them. -->

### Gate 1: ADR

- [ ] Intent and scope recorded in this OBPI brief
- [ ] Parent ADR checklist item quoted

### Gate 2: TDD (Red-Green-Refactor)

- [ ] Tests derived from brief acceptance criteria, not from implementation
- [ ] Red-Green-Refactor cycle followed per behavior increment
- [ ] Tests pass: `uv run gz test`
- [ ] Validation commands recorded in evidence with real outputs

### Code Quality

- [ ] Lint clean: `uv run gz lint`
- [ ] Type check clean: `uv run gz typecheck`

<!-- Heavy lane only: -->
### Gate 3: Docs (Heavy only)

- [ ] Docs build: `uv run mkdocs build --strict`
- [ ] Relevant docs updated

### Gate 4: BDD (Heavy only)

- [ ] Acceptance scenarios pass: `uv run -m behave features/`

### Gate 5: Human (Heavy only)

- [ ] Human attestation recorded

## Verification

<!-- What commands verify this work? Use real repo commands, then paste the
     outputs into Evidence. -->

```bash
uv run gz validate --documents
uv run gz lint
uv run gz typecheck
uv run gz test

# Specific verification for this OBPI
test -f docs/design/adr/foundation/ADR-0.0.22-security-sensitivity-doctrine/ADR-0.0.22-security-sensitivity-doctrine.md
test -f .gzkit/rules/security-sensitivity.md
rg -n "^## Persona$" AGENTS.md
test -f src/gzkit/templates/agents.md
test -f src/gzkit/templates/adr.md
test -f src/gzkit/sync_surfaces.py
```

## Acceptance Criteria

<!--
Specific, testable criteria for completion.
Each checkbox MUST carry a deterministic REQ ID:
REQ-<semver>-<obpi_item>-<criterion_index>
-->

- [ ] REQ-0.0.22-06-01: Given `.gzkit/rules/security-sensitivity.md` after this OBPI lands, when read, then the file has valid `RuleFrontmatter`, a body-level `<!-- rule-version: 0.1.0 -->` marker, and a visible `> **Rule version:** \`0.1.0\`` block quote with rationale.
- [ ] REQ-0.0.22-06-02: Given the rule file body, when read, then it documents the invariant, the registry contract, the validate scope behavior, the walkthrough enumeration, and the scanner-unavailable failure mode (each as a labelled section).
- [ ] REQ-0.0.22-06-03: Given AGENTS.md after this OBPI lands, when read, then the "Lane & Kind & Sensitivity Attestation Matrix" section exists, cites the rule file, and lists every (kind × lane × sensitivity) cell.
- [ ] REQ-0.0.22-06-04: Given `docs/governance/advisory-rules-audit.md`, when read, then a scorecard entry for `security-sensitivity.md` exists classified as Mechanical with a citation to `gz validate --sensitivity`.
- [ ] REQ-0.0.22-06-05: Given `.gzkit/rules/security-sensitivity.md`, when `uv run gz agent sync control-surfaces` runs, then `.claude/rules/security-sensitivity.md` and the other vendor mirrors exist with matching content and matching `<!-- rule-version: ... -->` markers; sync emits no stale-or-divergent warnings.
- [ ] REQ-0.0.22-06-06: Given the repo state after this OBPI lands, when `uv run gz validate --advisory-scorecard` runs, then it passes; when `uv run gz validate --documents` runs, then it passes (rule frontmatter and AGENTS.md remain schema-valid).

## Completion Checklist

<!-- Verify all gates before marking OBPI accepted. -->

- [ ] **Gate 1 (ADR):** Intent recorded in brief
- [ ] **Gate 2 (TDD):** RGR cycle followed, tests derived from brief, coverage maintained
- [ ] **Code Quality:** Lint, format, type checks clean
- [ ] **Value Narrative:** Problem-before vs capability-now is documented
- [ ] **Key Proof:** One concrete usage example is included
- [ ] **OBPI Acceptance:** Evidence recorded below

> For ceremony steps and lane-inheritance attestation rules, see `AGENTS.md` section `OBPI Acceptance Protocol`.

## Evidence

<!-- Record observations during/after implementation.
     Command outputs, file:line references, dates. -->

### Gate 1 (ADR)

- [ ] Intent and scope recorded

### Gate 2 (TDD — Red-Green-Refactor)

```text
# Paste test output here
```

### Code Quality

```text
# Paste lint/format/type check output here
```

### Gate 3 (Docs)

```text
# Paste docs-build output here when Gate 3 applies
```

### Gate 4 (BDD)

```text
# Paste behave output here when Gate 4 applies
```

### Gate 5 (Human)

```text
# Record attestation text here when required by parent lane
```

### Value Narrative

<!-- What problem existed before this OBPI, and what capability exists now? -->

### Key Proof


```
$ uv run gz validate --advisory-scorecard
Validated: advisory_scorecard
✓ All validations passed (1 scopes).

$ uv run gz validate --documents
Validated: documents
✓ All validations passed (1 scopes).

$ uv run gz validate --sensitivity
Validated: sensitivity
✓ 587 brief(s) checked; no escape attempts and registry healthy.

$ uv run gz covers OBPI-0.0.22-06 --json --output /tmp/covers.json
$ python3 -c "import json; print(json.load(open('/tmp/covers.json'))['summary'])"
{'total_reqs': 6, 'covered_reqs': 6, 'uncovered_reqs': 0}

$ uv run gz arb step --name unittest -- uv run -m unittest -q
...
Ran 3801 tests in 28.640s
OK (skipped=1)
arb step name=unittest exit_status=0 receipt=...arb-step-unittest-db6183904da943309eb7ef0fe501a057.json
```

Receipts: lint `arb-ruff-d116abb155664a0591f9f8996d6866c8`; typecheck `arb-step-typecheck-883de2493cfb4aed869fd721df5e02dc`; unittest (full, 3801 OK) `arb-step-unittest-db6183904da943309eb7ef0fe501a057`; OBPI-scoped unittest `arb-step-unittest-786eb610068c4a81bf99f984e2e04e64`; mkdocs strict `arb-step-mkdocs-93d282421bd44e008f473806c2cd2abe`.

### Implementation Summary


- Files created: `.gzkit/rules/security-sensitivity.md` (canonical rule with 6 labelled sections — Invariant, Registry contract, `gz validate --sensitivity` scope, Heightened walkthrough enumeration, Scanner-unavailable failure mode, Anti-patterns); `tests/governance/test_security_sensitivity_rule.py` (7 REQ-decorated tests across 2 fixture classes)
- Files modified: `AGENTS.md` and `src/gzkit/templates/agents.md` (matrix paragraph now cites the rule file as the doctrine home for the third axis); `docs/governance/advisory-rules-audit.md` (new `### Security Sensitivity` section row #48 classified Mechanical, summary count 34->35, promotion-order row #18 pointing at ADR-0.0.22); `tests/governance/test_security_surfaces_registry.py` (forward-looking absence guard `test_security_sensitivity_rule_not_authored` inverted to backward-looking presence-witness `test_security_sensitivity_rule_authored_at_named_path`, matching OBPI-04's pattern for `_requires_security_review_attestation`)
- Files generated by `gz agent sync control-surfaces`: `.claude/rules/security-sensitivity.md`; `.github/instructions/security_sensitivity.instructions.md`; refreshed nested `AGENTS.md` mirrors under `docs/`, `src/`, `tests/`
- Tests added: 7 — covers REQ-01 through REQ-06; `gz covers OBPI-0.0.22-06` reports `uncovered: 0 / 6`
- Date completed: 2026-04-29
- Attestation status: operator attestation received in Stage 4 (`attest completed`); relayed via `--attestor-present` because the active pipeline marker satisfies the GHI #292 co-presence proxy
- Defects noted: none — pre-existing failure of `test_no_inbound_references_to_legacy_paths_in_live_files` was a transient consequence of an early stale ARB receipt (since deleted) plus an authored citation of the retired `attestation-enrichment.md` path (rewritten to point at `AGENTS.md § Attestation` and `docs/governance/arb-middleware.md`)

## Tracked Defects

<!-- Record GitHub defect linkage when defects are discovered during this OBPI.
     Use one bullet per issue so status surfaces can preserve traceability. -->

_No defects tracked._

## Human Attestation

- Attestor: `Jeffry Babb`
- Attestation: attest completed — Heavy-lane + foundation-kind brief-level human attestation per the three-axis matrix at AGENTS.md § Lane & Kind & Sensitivity Attestation Matrix. Authored .gzkit/rules/security-sensitivity.md as the canonical addressable home for the third-axis doctrine (Invariant, Registry contract, gz validate --sensitivity scope, heightened Gate 5 walkthrough, scanner-unavailable failure mode); cited it from AGENTS.md and src/gzkit/templates/agents.md; landed Mechanical scorecard entry #48 in docs/governance/advisory-rules-audit.md with summary 34->35; vendor mirrors propagated via gz agent sync control-surfaces. 7 REQ-decorated tests cover REQ-01..REQ-06 (gz covers OBPI-0.0.22-06 reports 0/6 uncovered). Receipts: lint arb-ruff-d116abb155664a0591f9f8996d6866c8; typecheck arb-step-typecheck-883de2493cfb4aed869fd721df5e02dc; unittest 3801/3801 OK arb-step-unittest-db6183904da943309eb7ef0fe501a057; mkdocs strict arb-step-mkdocs-93d282421bd44e008f473806c2cd2abe.
- Date: 2026-04-29

---

**Brief Status:** Completed

**Date Completed:** 2026-04-29

**Evidence Hash:** -
