strictmode.lock

Rules come from your policy source, not from a preset. The lock is what gets checked, what gets diffed in review, and what the record points back to. Below is an excerpt of this site's own.

{
  "lockVersion": 1,
  "policyVersion": "1.0.0",
  "sourceHash": "sha256:a6f1a30116348f50145ba7d280a151e6fe84fa318fb1f02eb42b39a046fc938e",
  "compiledAt": "2026-08-22T13:30:47.775Z",
  "engine": "@strictmodeai/core@0.4.0",
  "source": ["app/**/*.scss", "styles/**/*.scss"],
  "rows": [
    {
      "id": "SM001",
      "primitive": "forbid-pattern",
      "description": "Raw color values are forbidden outside styles/tokens and styles/themes. Use a token.",
      "pattern": "#[0-9a-fA-F]{3,8}\b|\b(?:rgba?|hsla?|oklch|oklab|lab|lch|color)\([^)\n]*\)",
      "adapters": ["scss"],
      "exemptClasses": ["generated", "token-source", "test", "brand-identity"],
      "owner": "tom",
      "source": "CLAUDE.md#scss-tokens"
    }
  ],
  "allowances": [
    {
      "file": "app/marketing/components/diagram/CompiledRuleSet/CompiledRuleSet.module.scss",
      "ruleId": "SM003",
      "value": "$font-mono",
      "reason": "The compiled rule-set diagram is a genuine data block; monospace is functionally required for its indentation to align. The one permitted exception.",
      "owner": "tom"
    }
  ],
  "knownNonconformities": [
    {
      "file": "app/marketing/components/diagram/EnforcementSchematic/EnforcementSchematic.module.scss",
      "ruleId": "SM001",
      "value": "#fff",
      "reason": "Raw white predates the token pass on this component.",
      "fix": "Replace with the inverse-text or surface token in tokens/colors; verify in both appearances.",
      "owner": "tom",
      "expires": "2026-11-30"
    }
  ],
  "uncovered": []
}

The source hash is the policy's identity. A changed rule, allowance, or ledger entry stales the lock, and a stale lock refuses to run. An allowance carries a reason, an owner, and an expiry. A ledger entry tolerates a known defect with a named fix, and fails the scan the moment the defect disappears. Nothing rots silently.

The scanner, the policy schema, the adapters, and the CLI ship under MIT. No runtime dependencies. Adapters read CSS, SCSS, and JavaScript and TypeScript source; a config can add one for another file type. The engine knows nothing about your design system until a rule pack tells it.

A rule can declare how it is enforced. Only static rules run; a rule that needs a browser, a runtime, or a human is reported as uncovered on every scan, so the distance between what the policy says and what the scanner checks stays visible.

A pack is policy rows over a small set of primitives. Token prefixes, property lists, role vocabularies, and paths are the row's, never the engine's. The first pack is Form Logic's. Yours is a file.

forbid-pattern

a pattern that may not appear in governed text

restrict-literal

a literal that may not appear in a matching declaration's value

require-token-value

a matching declaration's value must be a token or an allowed word

forbid-cooccurrence

two patterns that may not both appear in one file

confine-pattern

a pattern allowed only inside the given paths

require-catalog-coverage

every item must appear somewhere in the catalog files

• Not a component library.
• Not a design system.
• Not a Figma tool.
• Not an agent-context server.
• Not a lint preset.
• Not a consulting audit that ends in a report.

npm i -D @strictmodeai/core

Built and running: the engine, the lock, the evidence record, the CSS, SCSS and JS adapters, and policy rows. All of it governs Form Logic and this site today, and the published package is the same code.

Not yet: rule packs for design systems other than Form Logic, and the first design-partner engagement. The lock format is 0.x, so its source hash can still change before 1.0.