feat: how to build the gate that keeps a rule true

[daniellam258]

Why

cmk:rule's audit workflow ends by arguing for a mechanical gate and then says nothing about how to write one. Building the first real gate against a large tree surfaced failure modes that were not obvious from the rule being enforced, and none of them are specific to that rule or that repository.

What this adds

A ## Workflow: Gate section in skills/rule/SKILL.md, covering the ways a first-draft gate is simultaneously too loud and too quiet:

Too quiet — three boundary failures, each of which had live instances that the gate reported clean:

• matching one case, when the same token arrives lowercase through a branch name and uppercase through a citation
• ending matches on \b, which cannot fire before _, hiding every snake_case and SCREAMING_CASE spelling
• scoping by an extension allowlist, which fails open on unlisted file types — and machine-read configuration is precisely where names live

Too loud — a rule written as a shape rather than a roster. The shape that catches the intended thing also catches fixtures, identifiers, and standard names that merely resemble it, and a gate that cries wolf gets suppressed wherever it is inconvenient.

Exemption design — what keeps a carve-out reviewable instead of a blanket skip: scope it as narrowly as its reason allows, make any approved count measure what the exemption actually admits rather than a proxy for it, prefer a carve-out the repository itself validates over one somebody has to maintain, and pin the set of files the check exempts itself.

skills/agent-instructions/references/rules-naming.md gains the resolvability test that makes the coordinate rule decidable: a label is a reference if a reader holding only the repository or a public specification can resolve it. Shape decides nothing on its own — seat identifiers, invoice fixtures, and cipher names all look like a ticket.

Versions

• cmk:rule 0.3.0 → 0.4.0 (new workflow)
• cmk:agent-instructions 0.2.1 → 0.2.2 (rule refinement)

Testing

• scripts/skill-lint.sh — OK across skills/ (frontmatter, size, references, citations, paths, eval.json)
• skills/rule/SKILL.md is 72 lines against the 150-line budget
• Genericity scan over the added lines: no product, vendor, or tracker vocabulary

Provenance

Every item is a corrected defect from building a real gate, not a hypothetical. The boundary failures each had live instances in the tree that the gate reported clean until the boundary was fixed.