feat(audits): expand standard verb list and add .anc.toml domain_verbs

[brettdavies]

Summary

The p6-may-standard-names audit penalized every CLI shipping its native platform vocabulary. An X CLI's post / like / repost, a Slack CLI's dm, a GitHub CLI's block / mute — none were in the built-in verb list, so the ratio fell below 70 percent and the audit warned. Renaming those verbs to posts create / likes add would worsen agent ergonomics; the right fix is to teach anc the vocabulary.

Two changes:

• Expand STANDARD_VERBS with 18 widely-understood social/notification verbs.
• Read .anc.toml at the audit target root and honor [p6] domain_verbs = [...] as per-CLI extensions. Recognition becomes builtin OR domain; the existing pass/warn semantics stay intact.

Changelog

Added

• Recognize 18 social/notification platform verbs in p6-may-standard-names (archive, block, bookmark, dm, follow, like, mute, post, quote, reply, repost, subscribe, unarchive, unblock, unfollow, unlike, unmute, unsubscribe).
• Load .anc.toml at the audit target root. Honor [p6] domain_verbs = [...] as per-CLI vocabulary extensions to the built-in standard-verb list.

Fixed

• Drop a duplicated "audit" entry from STANDARD_VERBS (HashSet semantics masked the dup; no behavior change).

Type of Change

• feat: New feature (non-breaking change which adds functionality)

Related Issues/Stories

• Plan: /home/brett/dev/xurl-rs/docs/plans/2026-06-02-001-feat-anc-100-percent-compliance-plan.md (U2)

Testing

• 9 unit tests in src/anc_toml.rs covering: absent path, loaded with domain_verbs, empty list, missing [p6] section, wrong-type domain_verbs, syntactically broken TOML, file-as-target, fallback behavior, evidence accessor.
• 5 new unit tests in src/audits/behavioral/standard_names.rs covering: the expanded built-in list, mentions-without-vs-with domain_verbs, empty-slice regression, duplicate-with-builtin harmlessness.
• 3 integration tests in tests/standard_names_integration.rs exercising the full pipeline through the anc binary: pass via domain_verbs, warn on malformed .anc.toml, regression-warn when absent.

Test Summary:

• cargo test: 817 passed, 2 ignored (8 suites)
• cargo clippy --all-targets -- -D warnings: clean
• cargo fmt: clean

Files Modified

Modified:

• src/main.rs — register mod anc_toml;.
• src/audits/behavioral/standard_names.rs — expanded built-in verb list (alphabetized new subgroup); refactored audit_standard_names(help, domain_verbs); StandardNamesAudit::run loads .anc.toml and surfaces parse errors as Warn(msg); existing tests adapted to pass &[] as the new arg; dropped duplicated "audit" entry.

Created:

• src/anc_toml.rs — loader for .anc.toml. ANC_TOML_FILENAME, AncConfig { p6: P6Config }, P6Config { domain_verbs: Vec<String> }, AncConfigLoad::{Absent, Loaded, Invalid}, pub fn load(repo_root: &Path) -> AncConfigLoad.
• tests/standard_names_integration.rs — end-to-end coverage through the anc binary.

Schema

.anc.toml at the audit target's repo root, optional:

[p6]
domain_verbs = [
  "mentions",
  "timeline",
  "whoami",
  # ...per-CLI platform vocab the built-in list deliberately omits
]

Loader contract:

• Missing file -> Absent (additive, never required).
• Parse error -> Invalid(msg) surfaced as the audit's primary signal (Warn with "could not parse .anc.toml: <reason>").
• Non-directory target (binary-mode audits) -> Absent.

Before / After on xurl-rs

anc audit /home/brett/dev/xurl-rs --output json \
  | jq '.results[] | select(.id == "p6-may-standard-names") | {status}'

Before this PR: "status": "warn" (7/35 subcommands matched the standard list).

After this PR (with xurl-rs's committed .anc.toml declaring its X-platform vocabulary): "status": "pass".

Benefits

• Stops penalizing CLIs whose platform vocabulary is the canonical agent-facing surface (X, Slack, GitHub, billing APIs, package registries).
• Establishes .anc.toml as the per-CLI extension point — additive, opt-in, audit-side parse errors surfaced rather than swallowed.
• Built-in list grows conservatively; verbs that don't cleanly cross platforms stay out and land in per-CLI config instead.

Breaking Changes

• No breaking changes

The audit's id, evidence string format, and pass/warn thresholds are unchanged. CLIs without .anc.toml and without vocab in the new social subgroup get identical verdicts.

Deployment Notes

• No special deployment steps required

Checklist

• Code follows project conventions and style guidelines
• Commit messages follow Conventional Commits
• Self-review of code completed
• Tests added/updated and passing
• No new warnings or errors introduced
• Changes are backward compatible