Trial ADR-backed component review rules

[adierkens]

Closes #

Adds a deliberately small Copilot Code Review experiment containing four rules sourced directly from accepted public ADRs. This lets us evaluate review quality and false-positive rates before committing to broader policy coverage or generation infrastructure.

Stacked follow-up: #8174 adds policy generation, the broader catalog, a reviewer skill and agent, validation, and CI integration.

Changelog

New

• Path-scoped component review guidance for children-as-API, component file structure, internal modules, and stable selectors

Changed

• None

Removed

• None

Rollout strategy

• Patch release
• Minor release
• Major release; if selected, include a written rollout or migration plan
• None; repository review guidance only. No published package behavior changes.

Testing & Reviewing

Review whether the four rules are understandable, actionable, and appropriately scoped to newly introduced or expanded contracts. This trial intentionally excludes the broader rule catalog, private outcome imports, reviewer skill and agent, policy manifests, generation scripts, and CI automation; those are proposed separately in the stacked follow-up.

Existing repository audit

• Children as API: No clear non-deprecated violation was found. Current mixed APIs such as FilteredActionList and SelectPanel2 use data props for constrained/filterable content and children for a distinct composition surface. The closest duplicate APIs are already deprecated.
• File structure: 74 direct PascalCase component directories exist; 10 have legacy colocation gaps. There are 63 unprefixed companion files across 20 directories, 16 legacy root-level files, and intentionally nested deprecated/experimental surfaces.
• Internal modules: 43 files already live under src/internal. Hooks and utilities outside it include both intentional public APIs and legacy private candidates, so location alone cannot establish a violation. Package exports are now explicit rather than the historical wildcard described by the ADR.
• Stable identifiers: Production code contains 219 distinct literal data-component values. Nineteen are lexically inconsistent and three more use legacy scope names; these are already listed as migration work in the ADR. Representative components still lack root identifiers because implementation remains pending.

Merge risk

Runtime and package risk is none: this PR changes review instructions only. Review-noise risk is low to moderate if CCR ignores scope and treats existing migration debt as a required retrofit. The instruction therefore limits findings to introduced or expanded contracts, excludes pre-existing migration debt, makes stable identifiers advisory, requires only applicable colocated files, and limits stable-identifier checks to newly added roots and parts.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 443313b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR