Policies and analyzers

Norn combines model review with repository-owned policy and optional local evidence. Configure both in .norn.yaml.

Policy sources

Load review guidance from local documentation:

policy:
  sources:
    - type: adr
      path: .docflow/adr
    - type: markdown
      path: docs/review-rules.md

Supported source types include adr, markdown, yaml, and pack. Missing optional sources produce warnings.

Policy packs

Packs group prompts, rules, profiles, and analyzer defaults:

policy:
  packs:
    - ./.norn/packs/agentic-code

A pack directory contains pack.yaml. Repository definitions override pack analyzers with the same ID.

Local rules

Rules can define severity, instructions, rationale, remediation, path scope, and enforcement. Path rules and AST rules add deterministic checks for repository structure or syntax. Suppressions must name a rule, paths, and a reason; they may also expire.

Analyzers

Define local commands as named analyzers:

analyzers:
  typecheck:
    enabled: true
    command: "pnpm run typecheck"
    timeoutSeconds: 120
    required: false
  tests:
    enabled: true
    command: "CI=1 pnpm test"
    timeoutSeconds: 300

Analyzer commands run inside the reviewed repository. Treat them as trusted project commands and prefer non-mutating check modes.

Headless review skips optional analyzers unless --run-analyzers is present. Profiles can mark configured analyzers as required, optional, or disabled.

Paths and findings

Use paths.include and paths.exclude to restrict eligible changed files. Exclude filters are applied after include filters.

Set review.findings.minSeverity to filter low-priority output. With requireAnchors: true, unanchored findings remain in the review run but are not eligible for automatic inline staging.

Validate before review

norn config validate --repo-path . --profile frontend-strict
norn doctor --repo-path .

Validation checks configuration shape and policy resolution. Doctor checks that analyzer commands can be resolved but does not execute them.