Canonical control catalogue¶
Default scan scope is these nine HoEN deterministic controls. Tags match
library/taxonomy/hoen-tags.yaml. Narrow the
set only when the user explicitly asks.
| id | HoEN tag | Control | What "present" looks like |
|---|---|---|---|
local-dev |
1-local-dev |
Local development & IDE | Package manager lockfile, run-locally docs, local hooks (e.g. pre-commit) |
version-control |
1-version-control |
Version control | Branch hygiene, commit-message lint, local commit hooks |
quality-engineering |
2-quality-engineering |
Quality engineering | Lint + test coverage gates (local and CI) |
static-analysis |
3-static-analysis |
Static analysis | Type/lint gates (mypy/ruff/pylint/tsc/ESLint or equivalent) |
standards |
2-standards |
Standards compliance | Naming/layout rules + repo-wide audit (archetype-specific; often N/A) |
deployment |
2-deployment-solutions |
Deployment solutions | PR CI gates + build/deploy pipeline per environment |
security |
2-security-controls |
Security controls | Secret scanning, SAST, dependency/supply-chain scanning |
logging-monitoring |
1-logging-monitoring |
Logging & monitoring | Structured logging, OpenTelemetry (or equivalent), telemetry export |
iac |
2-infrastructure-as-code |
Infrastructure as Code | Terraform/Bicep/Pulumi (or equivalent) with ≥1 consumer path |
Library-pattern adoption signals¶
Check these alongside the control rows — they are evidence the library is landing, not just that a practice exists independently:
git-hygiene(branch / main-protection habits documented or skill-wired)- commit-message lint (
commitlint+.husky/, or equivalent) - docs-lifecycle check (e.g.
docs:check) naming-compliance-review/ embedded naming standards (data-platform archetypes)scientist-pattern(champion/challenger or parity stages)vc-policy-hardening/ protected-main policy evidence
An independent implementation of the same practice with no library asset citation is a backport source, not an adoption signal.