For agents: start with the agent guide. Every page is Markdown by default; add Accept: text/html for HTML.

Debt ledger

“Debt only shrinks.”

Total: 208 directives.

Count by directive kind

• effect-diagnostics: 96
• oxlint: 108
• typescript: 4

The vendored tools/oxlint/anti-slop/ plugin is excluded. It is Dillon Mulroy’s code, not our debt.

Every directive

• apps/cli/ratstack.config.ts:88
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: Vite awaits generateBundle as a plugin hook, so this is the edge where the Effect program runs.
• apps/cli/src/cli.ts:18
  • Directive: oxlint-disable-next-line promise/prefer-await-to-callbacks
  • Reason: Oxlint mistakes this Effect handler for an async Promise callback.
• apps/cli/src/surfaces.ts:1
  • Directive: @effect-diagnostics-next-line nodeBuiltinImport:off
  • Reason: The Node HTTP server is the one place where nothing in Effect wraps the built-in: NodeHttpServer.layer takes a node:http server factory.
• apps/cli/test/cli.e2e.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off asyncFunction:off newPromise:off globalTimers:off
  • Reason: Black-box tests of the built binary: they spawn dist/cli.js as a child process and assert on stdout, stderr, and exit codes. Node built-ins and a Promise-based stdio conversation are the right tools at that boundary, so the Effect-native diagnostics are off here.
• apps/cli/test/cli.e2e.test.ts:72
  • Directive: oxlint-disable-next-line promise/avoid-new
  • Reason: A child process conversation has no library Promise to return.
• apps/cli/test/ratstack.e2e.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off asyncFunction:off newPromise:off globalTimers:off
  • Reason: Black-box tests of the published ratstack package: they spawn dist/npm/ratstack as npm would install it and assert on its files, stdout, and an MCP stdio conversation. Node built-ins and a Promise-based stdio conversation are the right tools at that boundary.
• apps/cli/test/ratstack.e2e.test.ts:61
  • Directive: oxlint-disable-next-line promise/avoid-new
  • Reason: A child process conversation has no library Promise to return.
• apps/infra/alchemy.run.ts:33
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: Every main Stack stage adopts the same production zone; deleting it destroys shared DNS.
• apps/infra/alchemy.run.ts:55
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: This fixed ratstack.sh discovery record is shared with production in every main Stack stage.
• apps/infra/alchemy.run.ts:69
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: This fixed ratstack.sh discovery record is shared with production in every main Stack stage.
• apps/infra/alchemy.run.ts:81
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: Production mail uses this fixed DKIM record across all main Stack stages.
• apps/infra/alchemy.run.ts:93
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: Production mail uses this fixed return-path record across all main Stack stages.
• apps/infra/alchemy.run.ts:104
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: Production mail uses this fixed DMARC record across all main Stack stages.
• apps/infra/alchemy.run.ts:116
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: Disabling routing on the shared ratstack.sh zone breaks production mail in every main Stack stage.
• apps/infra/alchemy.run.ts:126
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: This configured production forwarding destination may be shared by other stages and mail rules.
• apps/infra/alchemy.run.ts:139
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: Every main Stack stage names the same production workshop forwarding rule on ratstack.sh.
• apps/infra/alchemy.run.ts:148
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: Every main Stack stage adopts production DNSSEC; removing it breaks the shared zone’s trust chain.
• apps/infra/src/usage-railway.ts:15
  • Directive: oxlint-disable-next-line rat-stack-patterns/retain-needs-stage-policy
  • Reason: the acidnet project predates this Stack and holds services Alchemy does not own, so no stage may delete it.
• apps/infra/src/usage-service.ts:241
  • Directive: oxlint-disable-next-line rat-stack-patterns/no-shared-pending-cache
  • Reason: Process-lifetime pool and migrations. The build runs in its own fiber: an interrupted caller only leaves; if no caller remains the build is abandoned, its scope³⁵ closed, and nothing cached. Failures expire at once, so the next request rebuilds.
• apps/site/scripts/content-blocks.ts:1
  • Directive: @effect-diagnostics-next-line nodeBuiltinImport:off
  • Reason: Build-only block IDs use SHA-256.
• apps/site/scripts/emit-assets.ts:1
  • Directive: @effect-diagnostics-next-line nodeBuiltinImport:off
  • Reason: Build-only content addressing uses Node’s SHA-256 implementation.
• apps/site/scripts/generate-content.ts:1
  • Directive: @effect-diagnostics-next-line nodeBuiltinImport:off
  • Reason: Build-only hashing uses Node’s stable SHA-256 implementation.
• apps/site/scripts/generate-content.ts:484
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: satori and resvg own this Promise boundary.
• apps/site/scripts/source-regex-policy.ts:43
  • Directive: oxlint-disable-next-line eslint/no-template-curly-in-string
  • Reason: Audited entries preserve literal interpolation syntax in RegExp source.
• apps/site/scripts/source-regex-policy.ts:50
  • Directive: oxlint-disable-next-line eslint/no-template-curly-in-string
  • Reason: Audited entries preserve literal interpolation syntax in RegExp source.
• apps/site/src/a2a.ts:34
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Effect.forEach is the Effect combinator, not Array#forEach with a thisArg.
• apps/site/src/app.ts:533
  • Directive: oxlint-disable-next-line rat-stack-patterns/no-shared-pending-cache
  • Reason: The Mischief router’s layer scope owns this cache: one dynamic import and one MCP³¹ sub-router build over services captured at router construction, with no request-bound I/O.
• apps/site/src/app.ts:547
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: HttpRouter declares asHttpEffect’s error as unknown upstream; the MCP transport answers every request itself, so a failure here is a defect.
• apps/site/src/auth/private-worker.ts:35
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Alchemy intentionally erases exporter layer requirements in its per-event registry.
• apps/site/src/auth/private-worker.ts:40
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: The existing registry layer retains SDK-erased requirements until WorkerBridge provides them.
• apps/site/src/interest/interest-durable-object.ts:28
  • Directive: @effect-diagnostics-next-line returnEffectInGen:off
  • Reason: Alchemy’s DurableObject contract returns the per-instance Effect.
• apps/site/src/interest/interest-index-durable-object.ts:28
  • Directive: @effect-diagnostics-next-line returnEffectInGen:off
  • Reason: Alchemy’s DurableObject contract returns the per-instance Effect.
• apps/site/src/legacy-mcp/durable-object.ts:23
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: the object shares its Worker⁶⁰’s environment, which Alchemy types as a dictionary.
• apps/site/src/legacy-mcp/durable-object.ts:42
  • Directive: @effect-diagnostics-next-line returnEffectInGen:off
  • Reason: Alchemy’s DurableObject contract returns the per-instance Effect.
• apps/site/src/legacy-mcp/runtime.ts:41
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: HttpRouter declares asHttpEffect’s error as unknown upstream; toWebHandler renders every failure as an HTTP response.
• apps/site/src/legacy-mcp/workshop-durable-object.ts:19
  • Directive: @effect-diagnostics-next-line returnEffectInGen:off
  • Reason: Alchemy’s DurableObject contract returns the per-instance Effect.
• apps/site/src/observability.ts:49
  • Directive: oxlint-disable-next-line eslint/no-empty-function
  • Reason: This privacy boundary deliberately discards all untrusted span metadata.
• apps/site/src/observability.ts:188
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Alchemy erases requirements in its per-event exporter registry; WorkerBridge supplies them.
• apps/site/src/observability.ts:190
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: The SDK-erased registered exporter is rebuilt by WorkerBridge inside each event scope.
• apps/site/src/outer-http-privacy.ts:11
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Alchemy intentionally erases exporter layer requirements in its per-event registry.
• apps/site/src/outer-http-privacy.ts:16
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: The existing registry layer retains its SDK-erased requirements until WorkerBridge provides them.
• apps/site/src/rpc-backend-runtime.ts:44
  • Directive: @effect-diagnostics-next-line returnEffectInGen:off
  • Reason: Alchemy’s RPC Worker initialization returns its request Effect.
• apps/site/src/sandbox-worker-loader.ts:1
  • Directive: oxlint-disable-next-line typescript/triple-slash-reference
  • Reason: The Worker runtime module has no Node-resolvable declaration of its own.
• apps/site/src/sandbox-worker-loader.ts:121
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: Cloudflare RPC requires a Promise-returning method at this boundary. This is the sandbox’s way out, so input arrives untrusted and is parsed as JSON before any capability sees it.
• apps/site/src/sandbox-worker-loader.ts:124
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: the sandbox RPC boundary hands over untrusted input, which decodeCallInput parses as JSON.
• apps/site/src/sandbox-worker-loader.ts:287
  • Directive: oxlint-disable-next-line promise/prefer-await-to-callbacks
  • Reason: Oxlint mistakes this Effect handler for a Promise callback.
• apps/site/src/worker.ts:179
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: Alchemy types the Worker environment as a dictionary, so the declared bindings²⁵ need one boundary cast.
• apps/site/src/workshop-mcp-loader.ts:16
  • Directive: oxlint-disable-next-line rat-stack-patterns/no-shared-pending-cache
  • Reason: The router scope owns one lazy module and sub-router build over captured services, with no request-bound I/O.
• apps/site/src/workshop-mcp-loader.ts:31
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: HttpRouter declares an unknown error; the MCP transport renders request failures and router construction defects must propagate.
• apps/site/test/code-mode-runtime.test.ts:55
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Alchemy’s ScratchStack erases provider errors; orDie closes this local runtime boundary⁸.
• apps/site/test/cold-content-runtime.test.ts:20
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Alchemy’s ScratchStack erases provider errors; orDie closes this local runtime boundary.
• apps/site/test/component-registry.test.ts:274
  • Directive: @ts-expect-error
  • Reason: A malformed external registration must fail the build even when it bypasses the TypeScript contract.
• apps/site/test/crash-tail.test.ts:76
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: Alchemy erases native event export types to any.
• apps/site/test/doc-fences.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: The seam test writes a planted fence⁵⁰ module and runs the real effect-tsrs checker on it.
• apps/site/test/fixtures/code-mode-worker.ts:111
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: Alchemy types the test Worker environment as a dictionary, so the binding needs one boundary cast.
• apps/site/test/fixtures/flag-ledger-client.ts:141
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Alchemy’s ScratchStack erases provider errors; orDie closes this test boundary.
• apps/site/test/generated-content.ts:1
  • Directive: @effect-diagnostics-next-line nodeBuiltinImport:off
  • Reason: Module-evaluation fixtures cannot require a runtime; request IO stays inside the StaticAssets Effect layer.
• apps/site/test/interest-capture-runtime.test.ts:20
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Alchemy’s ScratchStack erases provider errors; orDie closes this test boundary.
• apps/site/test/interest-runtime.test.ts:20
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Alchemy’s ScratchStack erases provider errors; orDie closes this test boundary.
• apps/site/test/source-regex-policy.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: These tests write temporary lint fixtures and run the real oxlint binary against them.
• apps/site/test/static-assets.test.ts:40
  • Directive: oxlint-disable-next-line unicorn/no-useless-undefined
  • Reason: An explicit miss preserves the native API Promise type rather than Promise<void>.
• apps/site/test/worker-error-pages.test.ts:38
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: The fake WEBSITE binding implements the native Promise fetch API.
• apps/site/test/worker-error-pages.test.ts:115
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: the layer above provides the Worker init bindings.
• apps/site/test/worker-error-pages.test.ts:130
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: makeRequestHandler erases its response effect type.
• apps/site/test/worker-events.test.ts:105
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: runtimeServices provides the Worker init bindings.
• apps/site/test/worker-events.test.ts:130
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: makeRequestHandler erases its response effect type.
• apps/site/test/worker-runtime-init.test.ts:88
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: runtimeServices provides the Worker init bindings.
• apps/site/test/worker-runtime-init.test.ts:119
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: makeRequestHandler erases its response effect type.
• apps/web/reader-finalization.ts:10
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: Vite awaits finalization after the Foldkit²⁷ prerender hook.
• apps/web/reader-pages.ts:56
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: Vite awaits this build-time virtual module boundary.
• apps/web/test/dev-content-routes.test.ts:29
  • Directive: oxlint-disable-next-line anti-slop-effect/no-manual-tagged-construction
  • Reason: This is the Effect RPC wire message the browser sends; the test writes it by hand on purpose.
• apps/web/test/dev-server.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off asyncFunction:off newPromise:off globalTimers:off globalFetch:off
  • Reason: Black-box test of vite dev: it spawns the real dev server and talks HTTP to it, so Node built-ins, Promises, and fetch are the right tools at that boundary.
• apps/web/test/dev-server.test.ts:18
  • Directive: oxlint-disable-next-line promise/avoid-new
  • Reason: A child process’s first log line has no library Promise to await.
• apps/web/test/dev-server.test.ts:49
  • Directive: oxlint-disable-next-line anti-slop-effect/no-manual-tagged-construction
  • Reason: This is the Effect RPC wire message the browser sends; the black-box test writes it by hand on purpose.
• apps/web/test/production-bundle.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: These tests build the app with the real Vite binary and read the emitted source maps from disk.
• apps/web/vite.config.ts:70
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: Connect middleware and Vite’s module loader use Promises.
• packages/auth/src/auth-service.ts:5
  • Directive: @effect-diagnostics-next-line leakingRequirements:off
  • Reason: Better Auth¹⁸ intentionally retains per-request RuntimeContext requirements.
• packages/auth/src/auth.ts:27
  • Directive: @effect-diagnostics-next-line leakingRequirements:off
  • Reason: Better Auth methods intentionally retain per-request RuntimeContext requirements.
• packages/auth/src/current-person-middleware.ts:27
  • Directive: oxlint-disable-next-line promise/prefer-await-to-callbacks
  • Reason: Effect.tapError needs an Effect continuation, not a Promise callback.
• packages/auth/src/feedback.ts:330
  • Directive: @effect-diagnostics-next-line leakingRequirements:off
  • Reason: Provider operations retain RuntimeContext until the composition root¹⁸ binds them inside a request.
• packages/auth/src/usage-device.ts:57
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: Better Auth database hooks are Promise callbacks.
• packages/capability/src/approval.ts:10
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: Every capability’s decoded input passes through one gate, so its type is erased here; an implementation that shows it to a human encodes it.
• packages/capability/src/call-watch.ts:8
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: The decoded input is erased by implement across heterogeneous capability lists.
• packages/capability/src/catalog-model.ts:114
  • Directive: oxlint-disable-next-line no-use-before-define
  • Reason: printNode and the object/primitive printers are mutually recursive.
• packages/capability/src/catalog-model.ts:145
  • Directive: oxlint-disable-next-line no-use-before-define
  • Reason: printNode and the array printer are mutually recursive.
• packages/capability/src/contract.ts:272
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: the runtime branch matches the literal NeedsApproval type the contract supplies.
• packages/capability/src/implement.ts:54
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: The heterogeneous record erases its handler channels until the public generic type is restored.
• packages/capability/src/implement.ts:81
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: The erased handler of a heterogeneous list; Around preserves whatever channels it has.
• packages/capability/src/sandbox-diagnostic.ts:22
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: Capability failures arrive erased at this schema-decoding boundary.
• packages/capability/src/to-code-mode.ts:1
  • Directive: @effect-diagnostics anyUnknownInErrorContext:off unsafeEffectTypeAssertion:off missingEffectContext:off
  • Reason: See to-toolkit.ts: a projection over a heterogeneous list erases error and requirement types at the boundary and recovers them for callers.
• packages/capability/src/to-code-mode.ts:194
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary erases the handler type; RequirementsOf<Caps> restores it.
• packages/capability/src/to-code-mode.ts:196
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: the sandbox decodes the input with the capability schema before this handler runs.
• packages/capability/src/to-code-mode.ts:289
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: some over the same array computes the literal approval flag Caps carries.
• packages/capability/src/to-code-mode.ts:342
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: every Sandbox JSON-round-trips a successful result before this boundary.
• packages/capability/src/to-command.ts:99
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: a plain field schema needs no CLI services, which never satisfies.
• packages/capability/src/to-command.ts:132
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: PlainSchema has no requirements, so the CLI environment satisfies the codec.
• packages/capability/src/to-command.ts:177
  • Directive: @effect-diagnostics-next-line unstableApiUsage:off
  • Reason: The CLI projection uses the workspace-pinned experimental prompt environment.
• packages/capability/src/to-command.ts:184
  • Directive: @effect-diagnostics-next-line unstableApiUsage:off
  • Reason: Interactive CLI approval uses the workspace-pinned confirmation widget.
• packages/capability/src/to-command.ts:190
  • Directive: @effect-diagnostics-next-line unstableApiUsage:off
  • Reason: Interactive CLI approval uses the workspace-pinned prompt runner.
• packages/capability/src/to-command.ts:267
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary erases the handler channels; the C extractors restore them.
• packages/capability/src/to-command.ts:293
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: Decoded through contract.input, whose Type C makes precise.
• packages/capability/src/to-http-api.ts:1
  • Directive: @effect-diagnostics anyUnknownInErrorContext:off unsafeEffectTypeAssertion:off missingEffectContext:off
  • Reason: See to-toolkit.ts: a projection over a heterogeneous list erases error and requirement types at the boundary and recovers them for callers.
• packages/capability/src/to-http-api.ts:38
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: a generic Failure cannot satisfy HttpApiEndpoint’s non-exported stream check.
• packages/capability/src/to-http-api.ts:50
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: a generic Failure cannot satisfy HttpApiEndpoint’s non-exported stream check.
• packages/capability/src/to-http-api.ts:397
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary erases the hook requirements; the group layer’s context holds them.
• packages/capability/src/to-http-api.ts:401
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: projection boundary: MiddlewareOf recovers the key’s phantom identity and requirements.
• packages/capability/src/to-http-api.ts:420
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: projection boundary: MiddlewareOf recovers the key’s phantom identity and requirements.
• packages/capability/src/to-http-api.ts:435
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: every group comes from groupFor, and GroupOf recomputes its type for callers.
• packages/capability/src/to-http-api.ts:450
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: prefix changes endpoint paths only, so the stable public API type still holds.
• packages/capability/src/to-http-api.ts:507
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: prefix changes endpoint paths only, so ApiOf still names the projected API.
• packages/capability/src/to-http-api.ts:521
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary erases the handler type; RequirementsOf<Caps> restores it.
• packages/capability/src/to-http-api.ts:523
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: HttpApi decodes the endpoint payload schema before calling this handler.
• packages/capability/src/to-http-api.ts:540
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: a loop cannot type the handleAll record that implementations is at runtime.
• packages/capability/src/to-http-api.ts:560
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: projection boundary: the layer serves exactly the group api names plus hook middleware.
• packages/capability/src/to-rpc-group.ts:43
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary: each RPC is built from its contract, which is RpcsOf<Contracts>.
• packages/capability/src/to-rpc.ts:1
  • Directive: @effect-diagnostics anyUnknownInErrorContext:off unsafeEffectTypeAssertion:off missingEffectContext:off
  • Reason: This projection erases each capability’s schema and requirement types while building the heterogeneous RpcGroup and recovers them at its public boundary.
• packages/capability/src/to-rpc.ts:29
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary: map keeps capability order, so the array is ContractsOf<Caps>.
• packages/capability/src/to-rpc.ts:40
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: RpcGroup invokes this only after decoding the RPC payload schema.
• packages/capability/src/to-rpc.ts:47
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary erases the handler type; RequirementsOf<Caps> restores it.
• packages/capability/src/to-rpc.ts:49
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: RpcGroup invokes this only after decoding the RPC payload schema.
• packages/capability/src/to-rpc.ts:58
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: This heterogeneous projection recovers the mapped handlers after the runtime name-indexed loop.
• packages/capability/src/to-rpc.ts:66
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary: the group holds exactly the RPCs derived from the contracts.
• packages/capability/src/to-toolkit.ts:1
  • Directive: @effect-diagnostics anyUnknownInErrorContext:off unsafeEffectTypeAssertion:off missingEffectContext:off
  • Reason: A projection over a heterogeneous list of capabilities erases each one’s error and requirement types at the boundary and recovers them for callers through ToolsOf / RequirementsOf. The three diagnostics above cannot distinguish that boundary from a leak, so they are off for this file only.
• packages/capability/src/to-toolkit.ts:101
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary recovers the tool tuple type that map cannot carry.
• packages/capability/src/to-toolkit.ts:110
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: The toolkit decodes each tool’s parameters before calling; this record erases them because a loop cannot name each capability.
• packages/capability/src/to-toolkit.ts:116
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: projection boundary erases the handler type; RequirementsOf<Caps> restores it.
• packages/capability/src/to-toolkit.ts:118
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: Toolkit decodes the tool parameters schema before calling this handler.
• packages/capability/src/to-toolkit.ts:140
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion, anti-slop/no-chained-type-assertions
  • Reason: projection boundary: the record keyed by capability names is HandlersFrom<ToolsOf<Caps>>.
• packages/capability/test/mcp-harness.ts:1
  • Directive: @effect-diagnostics asyncFunction:off
  • Reason: The fetch shim below must be a Promise-returning function because that is what FetchHttpClient.Fetch calls; everything around it is Effect.
• packages/capability/test/sandbox.test.ts:1
  • Directive: @effect-diagnostics-next-line nodeBuiltinImport:off
  • Reason: This integration test needs a real loopback socket; NodeHttpServer.layer accepts the Node server factory.
• packages/capability/test/to-http-api-routes.test.ts:226
  • Directive: @ts-expect-error
  • Reason: a path parameter must name an input field; this call proves the type check, and toHttpApi’s throw covers contracts only known as AnyContract.
• packages/capability/test/to-http-api-routes.test.ts:336
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: the handler breaks its failure schema on purpose to prove the projection fails closed.
• packages/capability/test/to-http-api-routes.test.ts:366
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: the handler breaks its failure schema on purpose to prove the projection never leaks it.
• packages/capability/test/to-http-api-routes.test.ts:496
  • Directive: @ts-expect-error
  • Reason: from must answer the tag’s service, not a number.
• packages/capability/test/to-http-api-routes.test.ts:507
  • Directive: @ts-expect-error
  • Reason: from may fail only with its declared failure.
• packages/capability/test/to-http-api-routes.test.ts:508
  • Directive: @effect-diagnostics-next-line missingEffectError:off
  • Reason: this hook fails with an undeclared value on purpose, to prove the type error.
• packages/core/src/amp-usage.ts:87
  • Directive: oxlint-disable-next-line promise/prefer-await-to-callbacks
  • Reason: Oxlint mistakes this Effect handler for a Promise callback.
• packages/core/src/config-service.ts:24
  • Directive: @effect-diagnostics-next-line classSelfMismatch:off
  • Reason: The generic factory hands the Self type in from the caller, which is the point of the pattern, so the class-name check does not apply here.
• packages/core/src/config-service.ts:35
  • Directive: oxlint-disable-next-line typescript/no-unsafe-type-assertion
  • Reason: Config.all’s conditional return type cannot be evaluated for a generic record.
• packages/core/src/flag-audit.ts:181
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Expected failures travel in Exit output; an unexpected machine failure is a defect.
• packages/core/src/inspect-machine.ts:71
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: A machine-level error or an early stop is a programming error here: the domain failure travels through the unreadable state, not the actor. A machine’s ErrorFrom is unknown by design (statelyai/xstate#5725), so the unknown-error diagnostic is off for this one call and orDie closes it.
• packages/core/src/interest-machine.ts:360
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: A machine’s ErrorFrom is unknown (statelyai/xstate#5725); a machine-level error here is a programming error and orDie closes it.
• packages/core/src/interest-token.ts:48
  • Directive: oxlint-disable-next-line rat-stack-patterns/no-shared-pending-cache
  • Reason: This service caches CryptoKey import from a fixed secret with no request-bound I/O.
• packages/core/src/join-delivery-machine.ts:171
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Machine-level defects are not domain failures; only the typed IntakeResult leaves the actor.
• packages/core/src/join-interest-port.ts:7
  • Directive: @effect-diagnostics-next-line cryptoRandomUUIDInEffect:off
  • Reason: Web Crypto is available in both Worker and Node composition roots.
• packages/core/src/learn-feedback.ts:6
  • Directive: @effect-diagnostics-next-line schemaClassMissingBrand:off
  • Reason: auth’s Unauthenticated shares this wire shape and must stay assignable to it; a brand splits the two types.
• packages/core/src/tool-usage.ts:31
  • Directive: oxlint-disable-next-line promise/prefer-await-to-callbacks
  • Reason: Oxlint mistakes this Effect handler for a Promise callback.
• packages/core/src/usage-unauthenticated.ts:3
  • Directive: @effect-diagnostics-next-line schemaClassMissingBrand:off
  • Reason: Auth’s Unauthenticated uses this wire shape; identity adapters must be able to return it without importing core into auth.
• packages/core/test/boundaries-rule.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: These tests create temporary source fixtures and run the real oxlint binary against them.
• packages/core/test/bump-checkers.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: This CLI seam test builds isolated repositories and invokes fake package-manager processes.
• packages/core/test/docs-pins.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: This test reads the repository’s manifests and docs from disk.
• packages/core/test/inspect-machine.model.test.ts:192
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Machine-level failures are defects; FileStatsError travels through the final outcome.
• packages/core/test/inspect-machine.test.ts:18
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: A machine’s ErrorFrom is unknown (statelyai/xstate#5725); a machine-level error here is a test failure, not a case under test.
• packages/core/test/no-comments-rule.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: These tests run the real oxlint binary against fixture files, so they use Node’s file system and child process modules directly.
• packages/core/test/patterns-rule.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: These tests create temporary source fixtures and run the real oxlint binary against them.
• packages/core/test/typecheck-parity.parity.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: This compiler seam test reads workspace manifests and runs both installed compilers.
• packages/core/test/unknown-parameters-rule.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: These tests write temporary source fixtures and run the real oxlint binary against them.
• packages/core/test/xstate-effect-rule.test.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: These tests create temporary source fixtures and run the real oxlint binary against them.
• packages/database/src/postgres-migrations.ts:65
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: The pg client exposes Promise-based connection setup.
• packages/database/src/store.ts:82
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Effect.forEach is not Array#forEach; the callback is an effectful mapper.
• packages/database/src/store.ts:91
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Effect.forEach is not Array#forEach; the callback is an effectful mapper.
• packages/database/test/local-layers.ts:80
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: The SQL.js Drizzle adapter exposes Promise-based queries.
• packages/database/test/local-layers.ts:137
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: PGlite exposes the transaction callback as a Promise API.
• packages/database/test/local-layers.ts:140
  • Directive: oxlint-disable-next-line no-await-in-loop
  • Reason: Migration statements must stay ordered inside one transaction.
• packages/database/test/local-layers.ts:154
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: PGlite queries use a Promise API.
• packages/database/test/local-layers.ts:177
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: PGlite’s Drizzle adapter exposes Promise-based queries.
• packages/deploy/src/machine.ts:819
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Step crashes are explicit states; an unexpected machine failure remains a defect.
• packages/deploy/src/poll-machine.ts:194
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: The observation actor cannot fail; a machine-level error or an early stop is a programming error and orDie closes the unknown ErrorFrom (statelyai/xstate#5725).
• packages/deploy/src/rollback.ts:130
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Unexpected recovery machine failures remain defects and never establish health.
• packages/deploy/src/watch.ts:543
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Unexpected watch actor failures remain defects rather than a passing observation.
• packages/deploy/test/machine.model.test.ts:334
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Machine-level errors remain defects; the model checks explicit terminal step outcomes.
• packages/deploy/test/machine.model.test.ts:461
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Machine-level errors remain defects; the property checks the refused verdict.
• packages/deploy/test/worker-version-readback.model.test.ts:178
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Unexpected actor defects are not a passing qualification.
• packages/devtools/src/actor-watcher.ts:47
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: Machine context, state values, and events are user-defined and erased at the XState inspection boundary; turning them into JSON is this function’s job.
• packages/devtools/src/json.ts:42
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: Handler values arrive erased across the heterogeneous capability list; the schema encodes them before anything reads them.
• packages/devtools/test/devtools.test.ts:607
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: CallWatch preserves the erased input across heterogeneous capability lists.
• packages/devtools/test/devtools.test.ts:625
  • Directive: oxlint-disable-next-line anti-slop/no-unknown-parameters
  • Reason: aroundHandlers erases input across a heterogeneous capability list.
• packages/flags/src/cloudflare-ledger.ts:54
  • Directive: @effect-diagnostics-next-line returnEffectInGen:off
  • Reason: Alchemy constructs the per-instance program after resolving its infrastructure bindings.
• packages/flags/src/evaluate.ts:25
  • Directive: oxlint-disable-next-line eslint/no-bitwise
  • Reason: FNV-1a mixes each Unicode code point into a fixed 32-bit hash.
• packages/flags/src/evaluate.ts:29
  • Directive: oxlint-disable-next-line eslint/no-bitwise
  • Reason: Unsigned conversion maps the FNV-1a result into the rollout bucket range.
• packages/intake-live/src/basin-intake-events.ts:41
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Effect.forEach is the Effect combinator, not Array#forEach with a thisArg.
• packages/intake-live/src/hmac-tickets.ts:92
  • Directive: oxlint-disable-next-line rat-stack-patterns/no-shared-pending-cache
  • Reason: This service caches CryptoKey derivation from a fixed secret with no request-bound I/O.
• packages/intake-live/src/read-application.ts:23
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Effect.forEach is the Effect combinator, not an Array method with a thisArg.
• packages/intake-live/src/sealed-intake-events.ts:140
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Effect.forEach is the Effect combinator, not Array#forEach with a thisArg.
• packages/learn/src/commit-machine.ts:55
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Unexpected machine failures are defects; the typed append failure travels through the final output.
• packages/learn/src/feedback-machine.ts:155
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Unexpected machine failures stay defects; expected unauthentication is carried in the final context.
• packages/learn/src/feedback-machine.ts:180
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Credential checks return explicit states; machine failures must not become authentication decisions.
• packages/learn/test/feedback.model.test.ts:49
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Unexpected machine failures must fail the model check.
• packages/learn/test/feedback.model.test.ts:66
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: Unexpected machine failures must fail the model check.
• packages/motion/src/foldkit.ts:114
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Record.map is the Effect record combinator, not Array#map with a thisArg.
• packages/motion/src/foldkit.ts:116
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Record.map is the Effect record combinator, not Array#map with a thisArg.
• packages/motion/src/foldkit.ts:140
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Record.map is the Effect record combinator, not Array#map with a thisArg.
• packages/turbo-cache/test/runtime.test.ts:21
  • Directive: @effect-diagnostics-next-line anyUnknownInErrorContext:off
  • Reason: ScratchStack erases provider errors; this local runtime-test boundary converts failure to a defect.
• packages/usage/src/postgres.ts:463
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Effect.forEach’s second argument is the mapper and options, not a thisArg.
• packages/usage/src/postgres.ts:535
  • Directive: oxlint-disable-next-line unicorn/no-array-method-this-argument
  • Reason: Effect.forEach’s second argument is the mapper and options, not a thisArg.
• scripts/bump-checkers.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: This Node CLI updates exact manifest pins and runs installed checkers.
• scripts/deploy-build.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: This Node CLI fingerprints build outputs and runs the workspace build before a deploy command.
• scripts/find-peers.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: This Node CLI reads manifests and a local roster directly from disk.
• scripts/find-peers.ts:118
  • Directive: @effect-diagnostics-next-line asyncFunction:off
  • Reason: This one-shot Node CLI batches Sourcegraph requests with native Promise I/O.
• scripts/find-peers.ts:125
  • Directive: @effect-diagnostics-next-line globalFetch:off
  • Reason: This Node CLI fetches a public Sourcegraph endpoint outside an Effect runtime.
• scripts/oxlint-plugin-boundaries.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: This Oxlint plugin runs as Node tooling and reads repository files directly.
• scripts/oxlint-plugin-boundaries.ts:106
  • Directive: oxlint-disable-next-line anti-slop/no-runtime-typeof
  • Reason: ESTree Literal also represents numbers and booleans, so module sources need a string boundary check.
• scripts/oxlint-plugin-boundaries.ts:280
  • Directive: oxlint-disable-next-line anti-slop/no-runtime-typeof
  • Reason: ESTree Literal also represents numbers and booleans, so object keys need a string check.
• scripts/oxlint-plugin-boundaries.ts:305
  • Directive: oxlint-disable-next-line anti-slop/no-runtime-typeof
  • Reason: ESTree Literal also represents numbers, booleans, and regexes, so a computed key needs a string check.
• scripts/oxlint-plugin-patterns.ts:1
  • Directive: @effect-diagnostics nodeBuiltinImport:off
  • Reason: This Oxlint plugin runs as Node tooling and reads repository files directly.
• scripts/oxlint-plugin-patterns.ts:68
  • Directive: oxlint-disable-next-line anti-slop/no-runtime-typeof
  • Reason: ESTree Literal also represents numbers, booleans, and regexes, so computed API names need a string check.
• scripts/oxlint-plugin-patterns.ts:92
  • Directive: oxlint-disable-next-line anti-slop/no-runtime-typeof
  • Reason: ESTree Literal also represents numbers and booleans, so destructuring keys need a string check.
• scripts/oxlint-plugin-patterns.ts:111
  • Directive: oxlint-disable-next-line anti-slop/no-runtime-typeof
  • Reason: ESTree Literal also represents numbers and booleans, so contract names need a string check.