[campaign #254] STEP 1 — POLICY: Hypatia :javascript_detected rule design + standards docs

[hyperpolymath]

Part of #254.

Goal

Design and ship the Hypatia :javascript_detected rule (parallel to :typescript_detected and :rescript_detected) plus matching standards-docs language so that new .js/.jsx outside documented carve-outs is automatically flagged estate-wide.

Open design question — SHIP-MODE

JavaScript is allowed in policy "only where AffineScript cannot reach", so unlike TS/RS the JS rule has a permanently-legitimate residue. Two ship modes are on the table:

• Mode A (WARNING first): rule emits informational finding on every new .js/.jsx outside carve-outs; flip to HARD-BLOCK only after STEP 2 triage has classified the bulk of the backlog. Lower false-positive blast radius during the long-tail phase.
• Mode B (HARD-BLOCK first): rule blocks merges immediately; carve-outs do the work of staying out of the way. Higher signal, higher operator cost if carve-outs prove incomplete.

Decision required as part of this step, not silently. Recommend Mode A unless operator overrides.

Carve-out classes to encode

From #254 umbrella table, the rule must allow JS in:

#	Class	Pattern
1	host-required by ecosystem	MCP servers, plugin entry points
2	tooling configs	*.config.{js,cjs,mjs}
3	bootstrap shims	affinescript-{deno-test,cli}/
4	upstream forks	.fork == true repos
5	archived	hyperpolymath-archive/**
6	vendored deps	**/deps/**, **/node_modules/**
7	compiled output	**/out/**, **/lib/js/**, **/.deno/**
8	host extension entry	**/vscode/**, **/extensions/vscode/**

Acceptance

• New Hypatia rule :javascript_detected in hypatia repo with the 8 carve-out classes encoded as path_allow_prefixes (or equivalent)
• Ship mode (WARNING vs HARD-BLOCK) explicitly recorded in rule docstring and standards LANGUAGE-POLICY.adoc (or equivalent)
• Standards prose updated: language-policy doc references the new rule and clarifies JS-allowed-only-where-AS-cannot
• Smoke test: rule fires on a fresh .js in src/, does NOT fire on *.config.js, vscode/**/*.js, node_modules/**/*.js
• Per-PR ownership gate on the standards/hypatia PRs

Seam — batch with sibling rule work

Sibling campaigns #252 (ReScript) and #253 (npm) also need new/extended hypatia rules. Strongly suggest batching the three rule additions into a single hypatia PR (one schema bump, three rule definitions, one set of standards-doc updates) to amortise review cost and keep the carve-out vocabulary consistent across all three campaigns.

Sequencing

Blocks: STEP 2 leans on this rule's path-allow taxonomy when classifying the inventory. STEPs 3-5 cannot mass-merge ports safely without it.
Blocked by: nothing.

[hyperpolymath]

Layer-1 batched in hyperpolymath/hypatia#391 with sibling STEPs #260 + #261. Ship-mode design question resolved: HARD-BLOCK + extensive carve-outs (vs WARNING-first). Two new rules: :javascript_detected (.js) + :javascript_jsx_detected (.jsx), each with 8-class path_allow_prefixes — host-required (mcp-bridge/, /plugins/), tooling configs, bootstrap shims, upstream forks, archived, vendored, compiled output (/out/, /lib/js/, /.deno/), vscode. Per-PR exemption via inline pragma. Auto-merge SQUASH armed. Standards-side mirror = separate PR.

[hyperpolymath]

Standards-side Layer-1 batched in #285 — JavaScript Exemptions section + LANGUAGE-POLICY.adoc v1.4.0 amendment (new Banned entry with 8-class carve-outs) + NEW_JS grep chain. Paired with hypatia#391.

Ship-mode decision recorded: HARD-BLOCK + extensive carve-outs (umbrella#254 STEP 1 design question closed in favour of HARD-BLOCK; WARNING preserved as inline-pragma fallback per case). Auto-merge SQUASH armed.

STEP 1 of campaign #254 complete once both merge.

[hyperpolymath]

Documentation deliverables for this step are SHIPPED. Closing.

What landed

Hypatia rule — PR hyperpolymath/hypatia#391 (merged 2026-05-30 14:30Z): new cicd_rules/javascript_detected rule with 8-class carve-out canon encoded as path_allow_prefixes, batched with the sibling RS+npm rule additions.

Standards docs — PR #285 (merged 2026-05-30 13:38Z, batched with sibling steps #260+#261):

• rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc — JavaScript (Unnecessarily-) added with 8-class carve-outs; v1.4.0 amendment.
• .claude/CLAUDE.md — JavaScript exemption table added, mirroring TS/RS/npm tables.
• rhodium-standard-repositories/.github/workflows/language-policy.yml — NEW_JS blocking grep chain with 8 carve-out classes.

Design decision: SHIP-MODE

Mode A (WARNING first) adopted, per issue recommendation and operator default. The 8-class carve-out vocabulary mirrors the TS/RS carve-out pattern so the long-tail residue can be visible without blocking merges while STEP 2 triage classifies the backlog.

Acceptance check

• ✅ Hypatia rule with 8 carve-out classes encoded
• ✅ Ship-mode (WARNING) recorded in standards prose
• ✅ Smoke-test invariants encoded in workflow grep chain
• ✅ Per-PR ownership gate respected

Documentation label applied; closing. STEP 2 (triage tooling, #266) and STEP 3 (ports, #271) unblocked.