feat(policy): starter pack + CI exit codes; advertise on the site

Three new starter policies make Lane H actually adoptable instead of
just possible.  Together with the existing no-huge-files.rfl they
cover the four most common review patterns teams want a CI gate on:

  - concentrated-ownership.rfl   bus_factor == 1 on >= 5 commits
  - change-hotspot.rfl           temporal_hotspots.risk_score > 200
  - tightly-coupled-pairs.rfl    coupling_strength_milli > 500 and
                                 co_commits >= 3 (info-severity)

Each runs end-to-end against raysense's own self-baseline today;
agents and CI both get back deterministic, code-reviewable rules.

CI exit codes turn `raysense policy check` from a reporting tool into
a gate.  The shared helper `memory::policy_exit_code` returns 0 for
clean runs, 1 when any policy itself fails to evaluate (parse / type
/ schema error -- "I cannot tell whether the rule passed"), 2 when
every policy parsed but at least one reported an error-severity
finding.  Eval errors outrank findings because a misconfigured policy
is more dangerous than a known violation.  Both the CLI and the MCP
tool surface the code; MCP also keeps a `pass: bool` for ergonomics.

The mutex in src/memory.rs#tests is the cost of having a process-
singleton rayforce runtime: ray_sym_load clobbers the global sym
table on every read, ray_env_set rebinds 18 names per policy run,
and Cargo runs tests across multiple threads.  RAYFORCE_TEST_LOCK
serializes the affected tests; the few that only build a RayMemory
in memory and never read back from disk also take the guard for
safety since ray_sym_intern shares state with the loader path.
Without this the new tests flaked at 4 of 151 fail under contention.
With it: 151/151 stable across repeated runs (~11s wall clock).

Site update: a new "Query + Policy" section on sense.rayforcedb.com
positions the Rayfall + policy-packs surface as the headline
differentiator -- "architectural rules as code, not config."  The
agent-integration block bumps from four to five skills (the new
raysense-query); the capabilities band shifts to alt-bg to keep the
visual rhythm.  llms.txt mirrors the same content for crawlers.

Author: singaraiona

examples/policies/change-hotspot.rfl

@@ -0,0 +1,14 @@
+;; Policy: high churn x high complexity hotspots.
+;;
+;; raysense's temporal_hotspots table already multiplies commits by
+;; max_complexity into a single risk_score. Files past 200 are the
+;; spots most likely to break under further change.
+;;
+;; Demonstrates a single-column threshold on a derived metric.
+
+(select {severity: "warning"
+         code:     "change-hotspot"
+         path:     path
+         message:  "high commit-frequency x complexity; refactor before adding more"
+         from:     temporal_hotspots
+         where:    (> risk_score 200)})

examples/policies/concentrated-ownership.rfl

@@ -0,0 +1,14 @@
+;; Policy: bus-factor risk on long-lived files.
+;;
+;; Files with bus_factor == 1 (one author owns >=50% of commits) plus
+;; non-trivial history (>=5 commits) are a maintenance liability:
+;; if that author leaves, knowledge about the file leaves with them.
+;;
+;; Demonstrates the `and` predicate over a single baseline table.
+
+(select {severity: "warning"
+         code:     "bus-factor-1"
+         path:     path
+         message:  "single owner controls a file with non-trivial history; spread reviews / pair on changes"
+         from:     file_ownership
+         where:    (and (== bus_factor 1) (>= total_commits 5))})

examples/policies/tightly-coupled-pairs.rfl

@@ -0,0 +1,18 @@
+;; Policy: emerging architectural coupling.
+;;
+;; Files that change together more than half the time (per-mille > 500)
+;; AND have at least 3 co-commits are signaling hidden coupling: either
+;; they should live together (extract module) or one is leaking concerns
+;; into the other.  The right-hand partner column is preserved in the
+;; result table so reviewers can see both files - raysense surfaces
+;; extra columns alongside the required severity/code/path/message.
+
+(select {severity: "info"
+         code:     "tight-coupling"
+         path:     left
+         message:  "co-changes with another file more than 50% of the time"
+         partner:  right
+         co_commits: co_commits
+         from:     change_coupling
+         where:    (and (> coupling_strength_milli 500)
+                        (>= co_commits 3))})

site/index.html

@@ -233,7 +233,7 @@ <h2>One binary. A few flags.</h2>
     <div class="section-eyebrow">AGENT INTEGRATION</div>
     <h2>MCP server for any AI coding agent.</h2>
     <p class="section-lead">
-      Raysense ships as a Claude Code plugin and as a stdio MCP server compatible with any client that speaks the Model Context Protocol. Install the plugin and the agent gets four phase-scoped skills it can pick up at the right moments in its edit cycle. Project state lives in <code>&lt;repo&gt;/.raysense/</code>, never in a global registry, so two sessions on two repositories stay strictly independent.
+      Raysense ships as a Claude Code plugin and as a stdio MCP server compatible with any client that speaks the Model Context Protocol. Install the plugin and the agent gets five skills covering the edit loop: scan and baseline at session start, blast radius before edits, regression diff after, audits on demand, and a Rayfall query skill for any question the typed tools do not already answer. Project state lives in <code>&lt;repo&gt;/.raysense/</code>, never in a global registry, so two sessions on two repositories stay strictly independent.
     </p>
 
     <div class="code-block code-block-wide">
@@ -263,11 +263,57 @@ <h3>Verify</h3>
         <h3>Audit</h3>
         <p>On request. Architecture, DSM, evolution, test gaps.</p>
       </div>
+      <div class="phase-card">
+        <div class="phase-step">5</div>
+        <h3>Query</h3>
+        <p>Anytime. Custom Rayfall slices over the saved baseline.</p>
+      </div>
+    </div>
+  </div>
+</section>
+
+<section id="query" class="section">
+  <div class="container">
+    <div class="section-eyebrow">QUERY + POLICY</div>
+    <h2>Architectural rules as code, not config.</h2>
+    <p class="section-lead">
+      Every saved baseline is a queryable columnar database. Agents and humans run Rayfall expressions over the call graph, the import graph, ownership history, and change coupling - select queries for filters and aggregates, <code>.graph.*</code> algorithms for centrality and reachability (PageRank, Louvain, topsort, shortest-path, betweenness), Datalog rules with transitive closure for declarative reachability. Drop the same expression into a <code>.rfl</code> file under <code>.raysense/policies/</code> and it becomes a CI gate. No vendored YAML schema, no plugin SDK to learn - rules ship as code-reviewable files alongside the codebase they govern.
+    </p>
+
+    <div class="code-block code-block-wide">
+      <div class="code-block-head">.raysense/policies/no-huge-files.rfl</div>
+<pre><code><span class="hl-cmt">;; Files over 2000 lines block the merge.</span>
+<span class="hl-cmt">;; Result table columns: severity, code, path, message.</span>
+(select {severity: "error"
+         code:     "huge-file"
+         path:     path
+         message:  "file exceeds 2000 lines, split before merging"
+         from:     files
+         where:    (&gt; lines 2000)})</code></pre>
+    </div>
+
+    <div class="feature-grid">
+      <div class="feature-card">
+        <h3>Ad-hoc Rayfall queries</h3>
+        <p>Agents call <code>raysense_baseline_query</code> with a Rayfall expression. The named baseline table is bound as <code>t</code> and the result returns as JSON. Three modes: select for filter/project/aggregate, <code>.graph.*</code> for centrality and shortest-path, Datalog for transitive reachability that mirrors blast-radius in two lines.</p>
+      </div>
+      <div class="feature-card">
+        <h3>Pinned policies</h3>
+        <p><code>raysense policy check</code> walks <code>.raysense/policies/*.rfl</code>, evaluates each, returns findings in the same envelope as built-in rules. Exit code 0 for pass, 1 for any policy that failed to evaluate, 2 for any error-severity finding. Wire it into a pre-commit hook or a CI gate without touching raysense's release cadence.</p>
+      </div>
+      <div class="feature-card">
+        <h3>One vocabulary, two surfaces</h3>
+        <p>An <code>.rfl</code> policy and an interactive query reference the same baseline tables - <code>files</code>, <code>module_edges</code>, <code>change_coupling</code>, <code>file_ownership</code>, <code>call_edges</code> - because there is only one substrate. Promote a one-off query into a committed rule by renaming the file.</p>
+      </div>
+      <div class="feature-card">
+        <h3>Composable across history</h3>
+        <p>The baseline already carries change-coupling, file-ages, ownership, and rule-violation tables alongside the structural ones. Cross-time queries like "files tightly coupled in the last 60 days that sit on cycles and changed without test edits" stay one Rayfall expression, not three tools.</p>
+      </div>
     </div>
   </div>
 </section>
 
-<section class="section">
+<section class="section section-alt">
   <div class="container">
     <div class="section-eyebrow">CAPABILITIES</div>
     <h2>Beyond the score.</h2>

site/llms.txt

@@ -38,15 +38,25 @@ raysense --mcp          # stdio MCP server for agents
 
 ## Agent integration
 
-Raysense ships as a Claude Code plugin. The plugin gives the agent four phase-scoped skills:
+Raysense ships as a Claude Code plugin. The plugin gives the agent five skills covering the edit loop:
 
 1. Bootstrap. At session start: scan, save baseline, materialise scan results as splayed-table memory.
 2. Impact. Before non-trivial edits: blast radius, coupling, cycle exposure.
 3. Verify. After edits: rescan, rule check, baseline diff.
 4. Audit. On request: architecture, DSM, evolution signals, test gaps.
+5. Query. Anytime: ad-hoc Rayfall expressions over the saved baseline (filter, project, aggregate, graph algorithms, Datalog rules with transitive closure).
 
 Project state lives in `<repo>/.raysense/`, never in a global registry. Two concurrent sessions on two different repos are strictly independent.
 
+## Query and policy
+
+Every saved baseline is a queryable columnar database. Two surfaces share one substrate:
+
+- Ad-hoc query: `raysense_baseline_query` (MCP) or `raysense baseline query <table> <expr>` (CLI). Three modes - select queries for filter/project/aggregate, `.graph.*` algorithms (PageRank, Louvain, topsort, shortest-path, betweenness, closeness, k-shortest, MST, BFS/DFS expand) for centrality and reachability, Datalog rules with transitive closure for declarative reachability.
+- Pinned policy: drop a `.rfl` file in `<repo>/.raysense/policies/` and `raysense policy check` (or the `raysense_policy_check` MCP tool) walks the directory, evaluates each policy, and reports findings using the same RuleFinding envelope as built-in rules. Exit code 0 for pass, 1 if any policy failed to evaluate, 2 if any error-severity finding. Architectural rules ship as code-reviewable files alongside the codebase they govern - no vendored YAML schema, no plugin SDK to learn.
+
+A policy is just a Rayfall expression that returns a table with columns severity, code, path, message. Empty result table = policy passed.
+
 ## Capabilities beyond the score
 
 - Live treemap dashboard. Every file, every metric, every cycle, refreshed on save.

src/cli.rs

@@ -397,7 +397,12 @@ fn run_advanced(command: Command) -> Result<()> {
                 baseline,
                 policies,
                 json,
-            } => run_policy_check(baseline, policies, json)?,
+            } => {
+                let exit = run_policy_check(baseline, policies, json)?;
+                if exit != 0 {
+                    process::exit(exit);
+                }
+            }
         },
         Command::Trend { command } => match command {
             TrendCommand::Record { path, config } => record_trend(&path, config.as_deref())?,
@@ -2886,11 +2891,16 @@ fn default_policies_dir() -> PathBuf {
     PathBuf::from(".raysense/policies")
 }
 
+/// Returns 0 on success, 1 if any policy fails to evaluate (parse / type
+/// error, schema mismatch, missing columns), or 2 if any policy reports an
+/// error-severity finding. Eval errors take precedence over findings:
+/// "I cannot tell whether the rule passed" is worse than "the rule
+/// definitively failed."
 fn run_policy_check(
     baseline: Option<PathBuf>,
     policies: Option<PathBuf>,
     json: bool,
-) -> Result<()> {
+) -> Result<i32> {
     let baseline = baseline.unwrap_or_else(default_baseline_dir);
     let tables_dir = baseline.join("tables");
     let policies_dir = policies.unwrap_or_else(default_policies_dir);
@@ -2903,6 +2913,8 @@ fn run_policy_check(
             )
         })?;
 
+    let exit = crate::memory::policy_exit_code(&results);
+
     if json {
         let payload: Vec<serde_json::Value> = results
             .iter()
@@ -2919,16 +2931,22 @@ fn run_policy_check(
                 }),
             })
             .collect();
-        println!("{}", serde_json::to_string_pretty(&payload)?);
-        return Ok(());
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&serde_json::json!({
+                "exit": exit,
+                "policies": payload,
+            }))?
+        );
+        return Ok(exit);
     }
 
     if results.is_empty() {
         println!(
             "no policies found at {} (looking for *.rfl files)",
             policies_dir.display(),
         );
-        return Ok(());
+        return Ok(exit);
     }
     let mut total = 0usize;
     let mut errors = 0usize;
@@ -2951,12 +2969,13 @@ fn run_policy_check(
         }
     }
     println!(
-        "{} policy file(s) evaluated, {} finding(s), {} eval error(s)",
+        "{} policy file(s) evaluated, {} finding(s), {} eval error(s); exit {}",
         results.len(),
         total,
         errors,
+        exit,
     );
-    Ok(())
+    Ok(exit)
 }
 
 fn parse_columns(columns: Option<&str>) -> Result<Option<Vec<String>>> {

src/mcp.rs

@@ -885,16 +885,12 @@ fn policy_check_tool(args: &Value) -> Result<Value> {
             }),
         })
         .collect();
-    let pass = results.iter().all(|r| match &r.findings {
-        Ok(findings) => !findings
-            .iter()
-            .any(|f| matches!(f.severity, crate::RuleSeverity::Error)),
-        Err(_) => false,
-    });
+    let exit = crate::memory::policy_exit_code(&results);
     Ok(json!({
         "root": root,
         "policies_path": policies_dir,
-        "pass": pass,
+        "pass": exit == 0,
+        "exit": exit,
         "policies": payload,
         "total": results.len(),
     }))