Skip to content
RuleRoster

Verified reference directory

Platform Rules

Check what an official platform source says, the exact scope of the rule, and when its supporting evidence was last verified.

30 current rules across 10 platforms

1 verified rule

Cloudflare

Latest verification

  • Cloudflare d1 database size limit

    Cloudflare D1 Free databases have a stated maximum size of 500 MB per database; the specific enforcement action is not stated.

    Verified

1 verified rule

crates.io

Latest verification

  • crates.io yanked-version resolution behavior

    Yanking a crates.io version prevents Cargo from selecting it during dependency resolution by default, but does not delete data, block direct downloads, or affect existing lock files. Resolution errors if no compatible versions remain.

    Verified

4 verified rules

Deno

Latest verification

  • Deno frozen lockfile dependency-change behavior

    Deno uses a lockfile by default to record exact dependency versions and integrity hashes. When `lock.frozen` is `true`, Deno errors if any dependency changes; default lockfile use is distinct from frozen mode, and the lockfile can be disabled explicitly with `"lock": false`.

    Verified

  • Deno local ESM import file-extension requirement

    For ECMAScript modules in Deno, local import specifiers must include the full file extension; it cannot be omitted. This rule is scoped to local ESM imports and does not assert requirements for package specifiers, URLs, CommonJS, import-map keys, or arbitrary API strings.

    Verified

  • Deno pack dirty Git-tree refusal

    By default, `deno pack` refuses to pack when the Git working tree has uncommitted changes so releases are reproducible from the commit hash. `--allow-dirty` is the explicit opt-out; this rule applies only to `deno pack`.

    Verified

  • Deno sensitive system I/O permissions

    Deno runs code in a secure sandbox. By default, most sensitive system I/O is denied and explicit read, write, network, environment, subprocess, system, FFI, or import permission is required; explicit deny flags take precedence over allow flags. Some I/O remains available in limited capacity by default, so this is not a claim that all I/O is denied. `--allow-all` disables the sandbox rather than preserving least privilege.

    Verified

5 verified rules

Docker Hub

Latest verification

8 verified rules

GitHub

Latest verification

2 verified rules

Homebrew

Latest verification

  • Homebrew GitHub tap repository prefix requirement

    For the one-argument `brew tap` form on GitHub, the repository must be named `homebrew-<repository>` while the `homebrew-` prefix is omitted from the command. The two-argument form with an explicit supported Git URL does not impose this naming convention.

    Verified

  • Homebrew supported formula version count limit

    Homebrew supports no more than five versions of a formula in `homebrew/core` at one time, including the main formula, unless they are popular. More than 1,000 installs over 90 days is an example, not a guaranteed entitlement; removals are intended to consider usage and support status rather than age.

    Verified

3 verified rules

Kubernetes

Latest verification

  • Kubernetes CronJob name length limit

    A Kubernetes CronJob name must be no longer than 52 characters because the controller appends 11 characters and Job names are limited to 63 characters.

    Verified

  • Kubernetes Secret size limit

    Kubernetes limits each individual Secret to 1 MiB; the specific enforcement action is not stated.

    Verified

1 verified rule

npm

Latest verification

  • npm unscoped package visibility

    Unscoped npm packages are always public. The reviewed source does not state an exception or enforcement action.

    Verified

2 verified rules

pnpm

Latest verification

  • pnpm 10 approve-builds configuration

    In pnpm's 10.x documentation, approve-builds records approved dependencies in onlyBuiltDependencies and unapproved dependencies in ignoredBuiltDependencies in pnpm-workspace.yaml. This archived configuration is not the current allowBuilds map or the permissions-aware rule.

    Verified

  • pnpm approve-builds allowBuilds and permissions rules

    The pinned pnpm documentation says approve-builds writes approved dependencies as true and unapproved dependencies as false in allowBuilds in pnpm-workspace.yaml. Since v12.11.0, if that file already has permissions, it writes the decisions there as the build capability instead.

    Verified

3 verified rules

PyPI

Latest verification

  • PyPI yanked release selection

    PyPI currently yanks entire releases, not individual files. Installers normally ignore a yanked release unless it is the only release matching a `==` or `===` version specifier.

    Verified

Publication boundary

How rules qualify

Every listed rule has current source evidence and passes its publication and discovery checks. Staged noindex records and rules awaiting source review do not appear in this directory.