@{
    # ── Rules to suppress project-wide ──────────────────────────────────────────
    ExcludeRules = @(
        # All CI scripts use Write-Host for structured output captured by act_runner.
        # Write-Output would interleave with function return values and break callers.
        'PSAvoidUsingWriteHost',

        # Formatting-only rules: generate one warning per line across all existing scripts
        # (thousands of hits). Run locally with Invoke-ScriptAnalyzer -Fix to auto-format;
        # do not use as CI gate until the whole codebase has been reformatted.
        'PSUseConsistentIndentation',
        'PSUseConsistentWhitespace',

        # The codebase uses the param() + -ArgumentList pattern for remote script blocks
        # (Invoke-Command, Start-Job) consistently and correctly. PSSA does not recognise
        # param() inside a ScriptBlock as a local declaration, so it fires a false positive
        # on every parameter. $Using: is an alternative but not required here.
        'PSUseUsingScopeModifierInNewRunspaces',

        # UTF-8 without BOM is the editor default; adding BOM to ~35 files is cosmetic
        # and does not affect PS 5.1 execution.
        'PSUseBOMForUnicodeEncodedFile',

        # Plural nouns in internal helpers (Get-GuestDiagnostics, Remove-OldJobDirs, etc.)
        # are intentional — they describe collections, not single objects.
        'PSUseSingularNouns'
    )

    # ── Rule-specific configuration ──────────────────────────────────────────────
    Rules = @{
        # Security: never eval arbitrary strings
        PSAvoidUsingInvokeExpression = @{
            Enable = $true
        }

        # All state-changing functions must support -WhatIf / ShouldProcess
        PSUseShouldProcessForStateChangingFunctions = @{
            Enable = $true
        }

        # Credentials must flow as [PSCredential], not plain strings
        PSUsePSCredentialType = @{
            Enable = $true
        }

        # No plain-text passwords in params or variables
        PSAvoidUsingPlainTextForPassword = @{
            Enable = $true
        }

        # ConvertTo-SecureString -AsPlainText only acceptable during template setup;
        # use Suppress comments there if needed.
        PSAvoidUsingConvertToSecureStringWithPlainText = @{
            Enable = $true
        }

        # No script-scope globals that bleed across module boundaries
        PSAvoidGlobalVars = @{
            Enable = $true
        }

        # Formatting — 4-space indentation, spaces (not tabs)
        PSUseConsistentIndentation = @{
            Enable              = $true
            IndentationSize     = 4
            PipelineIndentation = 'IncreaseIndentationForFirstPipeline'
            Kind                = 'space'
        }

        PSUseConsistentWhitespace = @{
            Enable                          = $true
            CheckInnerBrace                 = $true
            CheckOpenBrace                  = $true
            CheckOpenParen                  = $true
            CheckOperator                   = $true
            CheckPipe                       = $true
            CheckPipeForRedundantWhitespace = $true
            CheckSeparator                  = $true
            CheckParameter                  = $false
        }

        # Alignment is a style preference; disable to avoid false positives on
        # the deliberate column-aligned hashtable assignments used in this project.
        PSAlignAssignmentStatement = @{
            Enable = $false
        }
    }
}