@luxfi/brand-rules

Per-org brand sovereignty banlists for LP-0010 / HIP-0303 / ZIP-0031 / PIP-0006 / LIP-0006 enforcement. One source of truth, consumed by:

• The reusable CI workflow at hanzoai/.github/.github/workflows/brand-sovereignty.yml
• The local pre-push validator (brand-check CLI shipped with this package)
• Any future tooling that needs the canonical banlist per org

Why

Each org's repos must never advertise the brand identity of a sibling org or downstream tenant. Cross-org tooling references (Go module imports, npm packages, container image refs) are legitimate; cross-org brand strings are not. This package codifies the line between the two for each org.

Install

pnpm add -D @luxfi/brand-rules   # or: npm i -D, bun add -D

Use — programmatic

import { rulesFor, SUPPORTED_ORGS } from '@luxfi/brand-rules'

console.log(SUPPORTED_ORGS) // ['lux', 'hanzo', 'zoo', 'pars', 'liquidity']

const lux = rulesFor('lux')
console.log(lux.forbidden_in_source) // ['Liquidity.io', 'Liquidity LLC', ...]
console.log(lux.exempt_paths)        // ['**/go.mod', '**/go.sum', ...]
console.log(lux.exempt_patterns)     // ['github\\.com/luxfi/', ...]

Use — CLI

# inside any git repo
npx brand-check lux             # diff merge-base..HEAD vs lux rules
npx brand-check hanzo all       # full-tree scan vs hanzo rules
npx brand-check liquidity main  # diff main..HEAD vs liquidity rules

Exit codes: 0 clean, 1 violations, 2 usage / config error.

Use — CI workflow (consumer side)

In any repo's .github/workflows/brand-sovereignty.yml:

name: Brand Sovereignty
on:
  pull_request:
  push:
    branches: [main]
jobs:
  check:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: actions/setup-node@v4
        with: { node-version: 22 }
      - run: npm i -g @luxfi/brand-rules@^0.1.0
      - run: brand-check <org>   # one of: lux hanzo zoo pars liquidity

Rule file shape

org: <org-id>
forbidden_in_source:
  - "<literal substring>"      # banned anywhere in source
  - ...
exempt_paths:
  - "**/<glob>"                 # files where forbidden strings are OK
  - ...
exempt_patterns:
  - '<regex>'                   # if a hit line also matches, ignore
  - ...

See rules/ for the per-org files.

Specs

• LP-0010 — Lux brand discovery + sovereignty (canonical)
• HIP-0303 — Hanzo brand discovery (pointer to LP-0010)
• ZIP-0031 — Zoo brand discovery + academic-collab exception (pointer to LP-0010)
• PIP-0006 — Pars brand discovery (pointer to LP-0010)
• LIP-0006 — Liquidity brand discovery (pointer to LP-0010 §7)

Per-org notes

Org	Bans	Tightest rule
lux	Liquidity, Hanzo, Zoo, Pars brand strings	"Liquidity.io" string
hanzo	Lux, Zoo, Pars, Liquidity brand strings	symmetric to lux
zoo	Lux, Hanzo, Pars, Liquidity. Plus academic-collab exempt.	model_card*, *.bib
pars	Lux, Hanzo, Zoo, Liquidity brand strings	symmetric to lux
liquidity	Everything upstream: Lux/luxfi, Hanzo, Zoo, Pars	regulatory isolation

Liquidity is the broadest because it has US-jurisdiction regulatory isolation requirements per LP-0010 §7 and LIP-0006. Tooling imports survive via exempt_patterns.

License

BSD-3-Clause. See LICENSE.