Custom rules
Custom rules use defineRule and receive frozen normalized facts only. A rule
may be async. It reports findings through context.report and cannot mutate
facts. Facts come from public MF options, manifests, stats, and recorded
capabilities — not private plugin state
(limitations).
Register custom rules through extends (alone or inside a
policy pack):