feat/one-api

README.md points to non-existent .claude/rules/ auth rules — ADR-008 was not distilled

domains/core/README.md:76

Line 76 says 'See .claude/rules/ auth rules for detailed architecture (historically ADR-008)' but no auth*.md rule file exists. A developer following this pointer finds nothing.

INTEGRATION_STANDARDS.md line 7 retains 'on top of ADR-011' inline without redirect

services/metrics/integrations/INTEGRATION_STANDARDS.md:7

Line 5 was correctly updated but line 7 still reads 'additions on top of ADR-011' with no pointer to .claude/rules/infrastructure.md where those conventions now live.

docs/architecture/*.md files have broken relative links to now-deleted ADR files

docs/architecture/2.4-cfe-architecture-v2.md

2.4-cfe-architecture-v2.md and 2.4-cfe-bill-collection-engine-architecture.md link to docs/ADRs/013, 016, etc which were deleted in this commit.

REVOKE rule omits service_role without explaining why

.claude/rules/rls-checklist.md

The rule says REVOKE FROM 'authenticated, anon, public' but never explains that service_role is a superuser where EXECUTE revoke has no effect. A future author may try to add it (breaking backend) or wonder if it's missing. Add: 'service_role intentionally omitted — it is a superuser; revoking EXECUTE has no effect'.

Existing SECURITY DEFINER helpers (get_user_org_ids, get_user_admin_org_ids) have no REVOKE — inconsistent with the new rule

packages/database/drizzle/0019_rls_helpers_and_storage.sql

The new rule says 'any new SECURITY DEFINER function ships with REVOKE' but the canonical helper examples don't have one. A future AI-authored migration could cite them as precedent and omit REVOKE on a more dangerous function. Rule should carve out 'RLS helpers scoped to auth.uid() are an exception' or ship a retroactive REVOKE.

Trigger-returning function REVOKE exemption is correct but lacks the reasoning

.claude/rules/rls-checklist.md

The rule says 'Trigger-returning functions are not RPC-exposable and need no revoke' with no explanation. Add: 'PostgreSQL prevents direct invocation of RETURNS TRIGGER functions — they require a trigger call frame and cannot be invoked via SQL or PostgREST'.

CDC parse-failure log guarantee partially depends on caller not logging raw onParseError argument

.claude/rules/contracts-read-model.md

The claim 'parse-failure logs never include row contents' holds for current callers but would silently break if a future consumer wires up an onParseError callback that logs the raw argument.

contracts-read-model.md path glob misses packages/database/src/schema/utility-contract-overview.ts

.claude/rules/contracts-read-model.md

The Drizzle schema file is where engineers make column/policy changes that this rule guards. Without it in the glob the rule never auto-loads when editing that file. Add 'packages/database/src/schema/utility-contract-overview.ts' to the paths frontmatter.

New cross-domain _tag uniqueness rule conflicts with existing code (ContractNotFound defined in two files)

.claude/rules/domain-patterns.md

domains/utility/src/cfe-job/cfe-job.errors.ts and utility-contract.errors.ts both define ContractNotFound; JobNotFound appears in cfe-job.errors.ts and tariff-job.errors.ts. The rule is correct as aspiration but immediately misleads a contributor who finds existing duplicates. Needs a note that existing duplicates are grandfathered and renamed on next touch.

doc-check SKILL.md description field still says 'ADRs' and Step 3 has dead guidance

.claude/skills/doc-check/SKILL.md

The table row was updated but the frontmatter description says '…detect structural changes (new entities, ADRs, packages…)' and Step 3 says '- Root CLAUDE.md Architecture References (if new ADRs added)'. Both need updating.

scope.md template and create-pr skill still have 'Relevant ADRs' sections

.claude/templates/scope.md

scope.md template has '## Relevant ADRs & Patterns' with ADR-0XX placeholder; create-pr SKILL.md has '### ADRs Referenced'; intent.md has '- ADRs consulted'. Should be renamed to Relevant Rules & Patterns.

branch-provisioning SKILL.md scope.md field still called 'Relevant ADRs'

.claude/skills/branch-provisioning/SKILL.md

Step 2 lists '- **Relevant ADRs**: Which architecture decisions apply and how' as a required scope.md field. Should be '- **Relevant Rules**: Which .claude/rules/*.md files apply and how'.

infrastructure.md ## Account Segmentation (ADR-011) heading lacks retirement notice

.claude/rules/infrastructure.md

Unlike domain-patterns.md and contracts-read-model.md, the infrastructure.md heading just uses 'ADR-011' without a retirement note. Should add '(historically ADR-011 — ADR file retired; this section is its home)'.

No CI check enforces SECURITY DEFINER + REVOKE pairing in migrations

.github/workflows/

check-rls-coverage.ts validates table policies but does not scan migration SQL for unpaired SECURITY DEFINER / REVOKE. A grep in pr-checks.yml scanning .sql files would close this gap.

Cross-domain _tag uniqueness has no compile-time or runtime check

domains/cross-domain/src/

The uniqueness guarantee rests on naming discipline. A type-level AssertNoTagCollision helper would mechanically enforce this if cross-domain coordinator error composition becomes a pain point.

Escape hatch 'skip the shell for a simple read' is unsafe for org-scoped tables without an RLS caveat

.claude/rules/domain-patterns.md

The rule says 'Skip the shell for a simple read touching one table with no events and no authorization logic.' In this codebase RLS is only active inside a createRLSDb() transaction — a raw db.select() outside of one runs as service_role and bypasses all row-level policies. A contributor reading this escape hatch for an org-scoped table (bills, contracts, sites) would skip createRLSDb() and silently leak cross-org data. Must add: 'org-scoped reads must still use createRLSDb() even without events — see rls-checklist.md. Only skip the shell for tables that are intentionally service_role-only (outbox, idempotency).' rls-checklist.md already warns about this but domain-patterns.md's escape hatch contradicts it without cross-referencing.

SECURITY DEFINER REVOKE rule duplicated verbatim in rls-checklist.md AND contracts-read-model.md

.claude/rules/contracts-read-model.md

Both files have nearly identical paragraphs about REVOKE EXECUTE including the same 0046 incident. Duplicate normative rules drift. contracts-read-model.md should reduce to a one-line cross-reference to rls-checklist.md § Helper Functions.

BAT-152 issue number in canonical-form.md prescriptive rule will become opaque over time

.claude/rules/canonical-form.md

The 'Audit before reshaping' paragraph cites 'BAT-152 SG-2' as a motivating example. Issue numbers are opaque to readers without Linear access. The same paragraph already names the concrete artifacts (periodsPersisted, persistedBillFiles) — these are self-contained. Drop the issue citation or replace with the PR number.