feat: rulebook mechanism, static engine and check CLI (P1)

[joao-oliveira-softtor]

Summary

First slice of the rulebook mechanism (P1 of the Jev plan): a machine-readable rulebook (YAML, validated with Zod at runtime), a dependency-free static engine, the nestjs-hexagonal-check CLI, the run.sh entry point with the per-project opt-in gate, golden fixtures and CI. Semantic rules are declared (questions, state slices, per-primitive thresholds) but inert: nothing is sent to any network in this version, and the tests assert that fetch is never called.

• rulebooks/hexagonal.rulebook.yaml (18 rules: 12 static, 5 semantic, 1 runtime) and rulebooks/softtor-conventions.rulebook.yaml (3 static), each rule pointing at its review-subdomain check or architecture-reviewer smell; rulebooks/project.example.rulebook.yaml shows extends with sha256 stamps and an override.
• scripts/check.ts: --rulebook <path|id>, --project-rulebook, --files, --diff <base>, --classes, --format json|text, --strict, --explain.
• scripts/run.sh (POSIX sh): opt-in gate (no .claude/rulebook.yaml and no NESTJS_HEXAGONAL_RULEBOOK → exit 0), NESTJS_HEXAGONAL_DISABLE=1, path containment, single execution source (project node_modules/.bin preferred), fail-open with an actionable message, bun → node fallback.
• package.json + bun.lock (deps: zod, yaml; devDependency @types/bun), no bunfig.toml, no lifecycle scripts; version 1.2.0-dev.0 in package.json, plugin.json and marketplace.json with a CI parity check.
• 105 tests (bun test ./scripts), tsc --noEmit clean, examples/ passes --strict with 0 FAIL.

Design notes and deviations from the plan are listed in the commits and in CLAUDE.md/README.md ("Rulebook & CLI"). Hooks (hooks/hooks.json), the Jev client and calibration come in the next PRs (P2/P3).

How to test

bun install --frozen-lockfile
bun test ./scripts
bun scripts/check.ts --rulebook hexagonal --files 'examples/**/*.ts' --classes static --strict
CLAUDE_PROJECT_DIR=/tmp CLAUDE_PLUGIN_ROOT=$PWD sh scripts/run.sh --hook; echo $?   # 0, silent

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-20T19:44:06.515990Z	088bb0c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.