agentic-dev/docs/work/epics/security-headers-rate-limit-sbom/03-no-undeclared-rate-limit-eslint-rule/_story.md

id, epic, title, type, status, feature, depends-on, blocks, created, updated

id	epic	title	type	status	feature	depends-on	blocks	created	updated
03-no-undeclared-rate-limit-eslint-rule	security-headers-rate-limit-sbom	`no-undeclared-rate-limit` ESLint rule	technical-story	done	core-eslint	01-rate-limit-type-primitives	05-auth-signin-rate-limit-backfill	2026-05-20T00:00:00Z	2026-05-20T08:45:03.170Z

Goal

Add the no-undeclared-rate-limit ESLint rule (warn severity) that catches rateLimit.consume("X", _) calls where "X" is not declared in the manifest's rateLimit array, and declared budget names that are never consumed in the use-case body — giving AI agents and developers lint-time enforcement of rate-limit drift.

Why

Without a lint rule, an agent could add a consume("foo", ...) call that has no corresponding manifest declaration, or declare a budget that silently goes unused. The ESLint rule closes this gap at the same latency as the existing no-undeclared-audit and no-undeclared-consent-check rules, making the rate-limit channel structurally consistent with the rest of the conformance system.

Done when

• packages/core-eslint/rules/no-undeclared-rate-limit.js is registered at warn severity in plugin.js + base.js.
• packages/core-eslint/rules/_manifest-ast.js parser extracts the rateLimit field from a feature manifest.
• RuleTester fixtures cover: matching budgetName in call and manifest (pass), budgetName in call absent from manifest (warn), declared budget never consumed in use-case body (warn), non-use-case file (no-op).
• Prior-art shape mirrors no-undeclared-audit.js and no-undeclared-consent-check.js.
• pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff all pass.

In scope

• no-undeclared-rate-limit.js rule implementation.
• _manifest-ast.js extension for rateLimit field extraction.
• Rule registration in plugin.js + base.js at warn severity.
• RuleTester fixtures (declared/undeclared/unused/non-use-case).

Out of scope

• CLAUDE.md + conformance-quickref.md rule-count bump (12 → 13) — Story 11.
• withRateLimit wrapper — Story 04.
• Auth backfill applying the rule — Story 05.

Tasks

• Add no-undeclared-rate-limit rule in packages/core-eslint/rules/no-undeclared-rate-limit.js (warn severity); extend packages/core-eslint/rules/_manifest-ast.js to extract the rateLimit field; register the rule in plugin.js + base.js; add RuleTester fixtures: declared budget + matching call (pass), undeclared budget name in call (warn), declared budget never consumed (warn), non-use-case file (no-op); all gates pass.