From bfb2324dd95aaa0a4df96d07f92a7565e0126236 Mon Sep 17 00:00:00 2001
From: Danijel Martinek <danijel@fraqtal.xyz>
Date: Tue, 12 May 2026 23:48:35 +0200
Subject: [PATCH] =?UTF-8?q?docs(work):=20story=2003.b=20=E2=80=94=20AST-aw?=
 =?UTF-8?q?are=20ESLint=20rules?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../03-b-ast-eslint-rules/_story.md           | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 docs/work/conformance-system-v1/03-b-ast-eslint-rules/_story.md

diff --git a/docs/work/conformance-system-v1/03-b-ast-eslint-rules/_story.md b/docs/work/conformance-system-v1/03-b-ast-eslint-rules/_story.md
new file mode 100644
index 0000000..5e77f6a
--- /dev/null
+++ b/docs/work/conformance-system-v1/03-b-ast-eslint-rules/_story.md
@@ -0,0 +1,45 @@
+---
+id: 03-b-ast-eslint-rules
+epic: conformance-system-v1
+title: AST-aware ESLint rules (no-undeclared-event-publish, no-undeclared-audit)
+type: technical-story
+status: in-progress
+feature: core-eslint
+depends-on: [03-a-structural-eslint-rules]
+blocks: [04-ci-drift-gate]
+---
+
+## Goal
+Ship two AST-aware rules that catch manifest ↔ use-case drift inside factory bodies:
+- `no-undeclared-event-publish`: `bus.publish("X")` in a factory must match `manifest.useCases[name].publishes`
+- `no-undeclared-audit`: `auditLog.record({ type: "X" })` must match `manifest.useCases[name].audits`
+
+## Why
+Boot assertion + structural rules can't see what happens inside a factory body. AST-aware rules catch publish/audit drift the moment a developer (or agent) saves the file.
+
+## Done when
+- Manifest AST parser extracts per-use-case publishes/audits arrays
+- Two rules registered in the conformance plugin
+- Tests cover positive (declared event) and negative (undeclared event) cases for each rule
+- `pnpm lint` passes (auth's signUp has empty publishes/audits today → no false positives)
+
+## In scope
+- `_manifest-ast.js` helper using `@typescript-eslint/parser` to extract per-use-case arrays
+- `_usecase-name.js` helper (file slug → camelCase use-case key)
+- The two rules + RuleTester tests
+- Plugin + base.js wiring
+
+## Out of scope
+- Bus / auditLog parameter detection beyond the conventional names `bus` and `auditLog`
+- Detection of dynamic event names (`bus.publish(eventVar, payload)` is allowed without warning)
+- Conditional / nested calls — rules only check top-level CallExpressions in factory bodies
+
+## Tasks
+- [ ] Story 03.b scaffold
+- [ ] Manifest AST parser + tests
+- [ ] Use-case name helper + tests
+- [ ] `no-undeclared-event-publish` rule + tests
+- [ ] `no-undeclared-audit` rule + tests
+- [ ] Plugin update + base.js wiring
+- [ ] Verify `pnpm lint` passes
+- [ ] Final verification + story closeout (tick 03 + 03.b in epic)