The catalog flags missing evidence on pull requests, GitHub issues, workflow runs, deployment reviews, and deployments. Pull-request rule configurations can opt into merge-blocking; rules on other event types preserve findings and audit evidence without acting as a pull-request gate. First enablement uses a subset; keep the rest as later.
Each row is the rule name and rule_key. Where the console still shows Rule 1–13, that chip is the same rule, not a second catalog.
Console jobs: Tickets, Review, Quality, Timing. Custom is a sixth tab, not a catalog tab.
Tickets
Association, ownership, issue quality, and production change traceability. Require a linked ticket (pull_request.linked_ticket) accepts GitHub or Linear in Warestack’s store; the Linear-first pack uses Require a Linear issue (custom.linear_issue_required).
| Rule | What it checks | Runs on |
|---|---|---|
Require a linked ticketpull_request.linked_ticket · Rule 6 | Flag pull requests that are not linked to a Linear or GitHub issue | Pull request |
Require linked ticket to be assignedpull_request.linked_ticket_assignee · Rule 7 | Flag pull requests with a linked Linear or GitHub issue without an assignee · First | Pull request |
Require active linked ticketpull_request.linked_ticket_state · Rule 8 | Flag pull requests whose linked ticket is inactive. Confirm which workflow names count as active · First | Pull request |
Require timely acknowledgment of high-priority linked ticketspull_request.urgent_ticket_review_sla · Rule 11 | Flag unacknowledged reviews when the linked Linear issue is Urgent or the GitHub issue is Critical/Urgent | Pull request |
Require failure evidence for urgent fixespull_request.urgent_fix_failure_evidence | Flag corrective pull requests linked to an Urgent Linear issue when the issue does not document the broken behavior | Pull request |
Close implementation issues after deliveryissue.implementation_evidence | Flag closed GitHub implementation issues that have no linked merged pull request | GitHub issue |
Require acceptance criteria before assignmentissue.acceptance_criteria | Flag assigned GitHub issues whose description does not define verifiable acceptance criteria | GitHub issue |
Require production deployment traceabilitydeployment.production_change_traceability | Flag production deployments that cannot be traced to an observed pull request | Deployment |
Review
Who reviews, how many humans, bot findings, sensitive paths, and production approval.
| Rule | What it checks | Runs on |
|---|---|---|
Route review requests based on branch prefixespull_request.branch_reviewer_routing · Rule 3 | Route review requests to named people from configurable branch prefixes | Pull request |
Route review requests based on file pathspull_request.path_reviewer_routing · Rule 4 | Route review requests to named people from configurable file paths | Pull request |
Detect review fatiguepull_request.reviewer_capacity · Rule 5 | Flag reviewers who hold more open review requests than the configured threshold | Pull request |
Require approvals by branch prefixpull_request.branch_approval_policy · Rule 13 | Require the configured number of human approvals by branch prefix. Bots and the author do not count · First | Pull request |
Resolve automated review findingspull_request.review_findings_resolved | Flag pull requests with current actionable review-bot findings that are not resolved or addressed | Pull request |
Require owner approval for sensitive changespull_request.sensitive_change_approval | Flag sensitive-path changes without an independent observed code-owner approval | Pull request |
Require independent production approvaldeployment_review.independent_approval | Flag production deployment reviews approved only by the requestor | Deployment review |
Require production verification evidencedeployment.production_verification | Flag successful production deployments without health, smoke, or verification evidence | Deployment |
Quality
Size, atomicity, scope drift, release jobs, and failed-deploy diagnostics.
| Rule | What it checks | Runs on |
|---|---|---|
Require concise pull requestspull_request.size_limit · Rule 1 | Flag pull requests that exceed the configured line cap, excluding lock-file changes | Pull request |
Require atomic commitspull_request.commit_size_limit · Rule 2 | Flag commits that exceed the configured lines-per-commit cap | Pull request |
Detect pull request scope driftpull_request.scope_alignment · Rule 12 | Flag pull requests whose diff does not match the linked issue · First | Pull request |
Require successful release jobsworkflow_run.release_jobs_successful | Flag release workflows when an observed required job does not complete successfully | Workflow run |
Require diagnostics for failed production deploymentsdeployment.production_failure_diagnostics | Flag failed production deployments without a diagnostic description or persisted log URL | Deployment |
Timing
Findings about elapsed time. Slack DMs are chains, not these rules. Require timely acknowledgment of review requests (pull_request.review_acknowledgment_sla) is not pull_request_review_sla.
| Rule | What it checks | Runs on |
|---|---|---|
Require timely acknowledgment of review requestspull_request.review_acknowledgment_sla · Rule 9 | Flag pull requests whose requested reviews are not acknowledged inside the deadline | Pull request |
Require timely updates for draft pull requestspull_request.draft_staleness · Rule 10 | Flag draft pull requests with no update inside the deadline | Pull request |
Keep workflow runs within budgetworkflow_run.duration_budget | Flag workflow runs whose elapsed time exceeds the configured duration budget | Workflow run |
Custom IDs (not catalog rules)
These slugs are documented custom controls. Their console number is space-local. Do not treat live canary rows as catalog IDs.
| Rule | Propose when |
|---|---|
Require a Linear issue in Warestack’s storecustom.linear_issue_required | Tightens Require a linked ticket (pull_request.linked_ticket) so a GitHub issue alone does not pass |
Branch, PR, and commit conventionscustom.conventions | Branch + Conventional Commit + summary/bullets/Testing/Refs: + matching commit trail |
Feature test evidencecustom.feature_test_evidence | feat/ without tests or a concrete Testing reason; generic “N/A” fails |
Evidence in the approval bodycustom.evidence_in_approval_body | LGTM / “tested” with no named result |
A saved repository configuration for the same catalog rule suppresses the team-scoped version, even when the repository configuration is disabled. For an inherited team rule that would apply to a repo that should stay isolated, add an explicit disabled repository configuration; do not change the team rule.
Recommended first-enablement list: Change-management pack.