@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/repo-controls/azure-pipelines.yml

@@ -0,0 +1,274 @@
+trigger:
+  branches:
+    include:
+      - integration
+      - main
+
+pr:
+  branches:
+    include:
+      - integration
+
+variables:
+  - group: enact-dev-secrets
+  - name: NODE_VERSION
+    value: '22.x'
+
+stages:
+  # PR validation is intentionally separate from post-merge delivery. A merge
+  # into integration must not run the test matrix a second time.
+  - stage: Validate
+    displayName: Validate pull request
+    condition: eq(variables['Build.Reason'], 'PullRequest')
+    jobs:
+      - job: Build
+        displayName: bun install, typecheck, test, and pack
+        pool:
+          name: Default
+          demands:
+            - Agent.OS -equals Linux
+        strategy:
+          maxParallel: 3
+          matrix:
+            Node22:
+              NODE_VERSION: '22.x'
+            Node24:
+              NODE_VERSION: '24.x'
+            Node26:
+              NODE_VERSION: '26.x'
+        steps:
+          - checkout: self
+            persistCredentials: true
+            path: enact-repo-controls
+          - task: UseNode@1
+            displayName: Use Node.js $(NODE_VERSION)
+            inputs:
+              version: $(NODE_VERSION)
+          - script: |
+              set -euo pipefail
+              curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.2"
+              echo "##vso[task.prependpath]$HOME/.bun/bin"
+            displayName: Install bun 1.4.2
+          - script: |
+              set -euo pipefail
+              cd $(Pipeline.Workspace)/enact-repo-controls
+              bun install --frozen-lockfile
+              # Scripts run through bun, the repository's runtime, and through the
+              # package's own scripts, which carry --coverage and --timeout (locally:
+              # `just test repo-controls`). npm stays below only where npm itself is
+              # under test -- pack, global install, publish -- because that is how
+              # the package reaches its users.
+              bun run typecheck
+              bun run test
+              # The coverage gate. bunfig's flat 100% threshold used to live here by
+              # implication -- `npm test` enforced it -- and removing that threshold
+              # took CI's only coverage check with it. This is its replacement, and it
+              # is deliberate that it runs in CI and not only in the pre-push hook: a
+              # hook can be uninstalled, bypassed with --no-verify, or never installed
+              # by a fresh clone.
+              git fetch --no-tags --depth=50 origin "$(Build.SourceBranchName)" || true
+              bun run coverage:ratchet
+              tarball=$(npm pack --ignore-scripts --silent)
+              isolated=$(mktemp -d)
+              npm install -g --prefix "$isolated" --no-audit --no-fund \
+                "$(pwd)/$tarball"
+              "$isolated/bin/adl-repo-controls" --version
+              rm -f "$tarball"
+              rm -rf "$isolated"
+            displayName: Validate global install on Node $(NODE_VERSION)
+          - script: |
+              set -euo pipefail
+              if [ "$(NODE_VERSION)" != "26.x" ]; then exit 0; fi
+              cd $(Pipeline.Workspace)/enact-repo-controls
+              target=$(mktemp -d)
+              bindir=$(mktemp -d)
+              ln -s "$(pwd)/bin/adl-repo-controls.ts" "$bindir/adl-repo-controls"
+              git init -q "$target"
+              printf 'version = 1\n' > "$target/adl-config.toml"
+              git -C "$target" add adl-config.toml
+              git -C "$target" -c user.name='CI smoke' -c user.email='ci-smoke@example.invalid' commit -qm 'chore: enroll smoke target'
+              bun bin/adl-repo-controls.ts install --repo "$target"
+              PATH="$bindir:$PATH" bun bin/adl-repo-controls.ts doctor --repo "$target" --json
+              rm -rf "$target" "$bindir"
+            displayName: End-to-end install and doctor smoke test on latest stable Node
+          - script: |
+              set -euo pipefail
+              if [ "$(NODE_VERSION)" != "26.x" ]; then exit 0; fi
+              curl -LsSf https://astral.sh/uv/install.sh | sh
+              echo "##vso[task.prependpath]$HOME/.local/bin"
+            displayName: Install uv
+          - script: |
+              set -euo pipefail
+              if [ "$(NODE_VERSION)" != "26.x" ]; then exit 0; fi
+              cd $(Pipeline.Workspace)/enact-repo-controls/package/adl-compliance
+              uv run pytest
+            displayName: adl-compliance test suite (Python side)
+  # Delivery is independent of Validate: the integration trigger follows a
+  # green PR merge, so repeating the full matrix here is redundant.
+  - stage: BumpPackageVersion
+    displayName: Bump patch version on integration
+    dependsOn: []
+    condition: eq(variables['Build.SourceBranch'], 'refs/heads/integration')
+    jobs:
+      # Build.SourceVersionMessage is populated only after checkout, so decide
+      # release eligibility in a job step and publish it to downstream jobs.
+      - job: DetermineReleaseEligibility
+        displayName: Determine integration release eligibility
+        pool:
+          name: Default
+          demands:
+            - Agent.OS -equals Linux
+        steps:
+          - checkout: self
+          - bash: |
+              set -euo pipefail
+              if [[ "${BUILD_SOURCEVERSIONMESSAGE:-}" == *'***NO_CI***'* ]]; then
+                echo 'Skipping integration delivery for a ***NO_CI*** commit.'
+                echo '##vso[task.setvariable variable=shouldRelease;isOutput=true]false'
+              else
+                echo 'Integration delivery is eligible.'
+                echo '##vso[task.setvariable variable=shouldRelease;isOutput=true]true'
+              fi
+            name: SetReleaseEligibility
+            displayName: Read integration release marker
+      - job: BumpPatchVersion
+        displayName: Bump patch version on integration
+        dependsOn: DetermineReleaseEligibility
+        condition: and(succeeded(), eq(dependencies.DetermineReleaseEligibility.outputs['SetReleaseEligibility.shouldRelease'], 'true'))
+        pool:
+          name: Default
+          demands:
+            - Agent.OS -equals Linux
+        steps:
+          - checkout: self
+            persistCredentials: true
+          - bash: |
+              set -euo pipefail
+              cd "$(Build.SourcesDirectory)"
+              git config user.email "pipeline@build.com"
+              git config user.name "Azure Pipelines"
+              git remote set-url origin \
+                "https://x-token:$(System.AccessToken)@dev.azure.com/amsterdamdatalabs/Enact/_git/enact-repo-controls"
+              git checkout -B integration
+              bash .workflows/version-bump.sh \
+                --file package.json \
+                --branch integration \
+                --integration \
+                --repository enact-repo-controls \
+                --organization https://dev.azure.com/amsterdamdatalabs \
+                --project Enact \
+                --open-pr
+            displayName: Bump patch version (on integration)
+            name: AllocateVersion
+            env:
+              AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
+  # Open or refresh integration -> main only after the integration bump
+  # succeeds. Main remains protected by its owner-approval branch policy.
+  # Auto-complete remains owner-gated by the main branch policies.
+  - stage: PromoteMainPr
+    displayName: Ensure integration to main PR
+    dependsOn: BumpPackageVersion
+    condition: and(
+      succeeded(),
+      eq(dependencies.BumpPackageVersion.outputs['DetermineReleaseEligibility.SetReleaseEligibility.shouldRelease'], 'true'),
+      eq(dependencies.BumpPackageVersion.outputs['BumpPatchVersion.AllocateVersion.VERSION_READY'], 'true')
+      )
+    jobs:
+      - job: EnsurePromotionPr
+        displayName: Create or update integration to main PR
+        pool:
+          name: Default
+          demands:
+            - Agent.OS -equals Linux
+            - Agent.OSArchitecture -equals X64
+        steps:
+          - checkout: none
+
+          - bash: |
+              set -euo pipefail
+              az extension add --name azure-devops --only-show-errors
+              az devops configure --defaults organization=https://dev.azure.com/amsterdamdatalabs project=Enact
+              title="release: promote integration to main"
+              description="Auto-created or updated after successful integration CI for enact-repo-controls build $(Build.BuildNumber). Completes automatically after required owner approval and main branch policies."
+              pr_id=$(az repos pr list --repository enact-repo-controls --source-branch integration --target-branch main --status active --query "[0].pullRequestId" -o tsv)
+              if [ -n "$pr_id" ]; then
+                az repos pr update --id "$pr_id" --title "$title" --description "$description" --auto-complete true --squash false --output none
+                echo "Updated promotion PR $pr_id (auto-complete on; owner approval still required)"
+                exit 0
+              fi
+              output=$(az repos pr create --repository enact-repo-controls --source-branch integration --target-branch main --title "$title" --description "$description" --auto-complete true --squash false --output none 2>&1) || {
+                if echo "$output" | grep -qiE "no commits|no changes|nothing to compare"; then
+                  echo "No promotion PR needed: integration and main are aligned."
+                  exit 0
+                fi
+                echo "$output"
+                exit 1
+              }
+              echo "Created promotion PR (auto-complete on; owner approval still required)"
+            displayName: Create or update integration to main PR
+            env:
+              AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
+  - stage: Publish
+    displayName: Publish to npm
+    dependsOn: []
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+    jobs:
+      - job: PublishNpm
+        displayName: Publish @amsterdamdatalabs/enact-repo-controls
+        pool:
+          name: Default
+          demands:
+            - Agent.OS -equals Linux
+        workspace:
+          clean: all
+        steps:
+          - checkout: self
+          - task: UseNode@1
+            displayName: Use Node.js $(NODE_VERSION)
+            inputs:
+              version: $(NODE_VERSION)
+          - script: |
+              set -euo pipefail
+              curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.2"
+              echo "##vso[task.prependpath]$HOME/.bun/bin"
+            displayName: Install bun 1.4.2 for release verification
+          - script: |
+              set -euo pipefail
+              PACKAGE=@amsterdamdatalabs/enact-repo-controls
+              LOCAL=$(node -p "require('./package.json').version")
+              VERSIONS=$(npm view "$PACKAGE" versions --json)
+              PUBLISHED=$(node -e 'const versions = JSON.parse(process.argv[1]); const local = process.argv[2]; process.stdout.write((Array.isArray(versions) ? versions : [versions]).includes(local) ? "true" : "false")' "$VERSIONS" "$LOCAL")
+              echo "Local: $LOCAL | exact version already published: $PUBLISHED"
+              if [ "$PUBLISHED" = "true" ]; then
+                if ! bun workflows/scripts/release/verify-npm-artifact.ts --package "$PACKAGE" --version "$LOCAL" --git-head "$(Build.SourceVersion)" --source src/doctor.ts; then
+                  echo "##vso[task.logissue type=error]Published version $LOCAL does not match this main commit. Bump package.json to an unpublished version; npm versions are immutable."
+                  echo "refusing to skip publication because release provenance is invalid"
+                  exit 1
+                fi
+                echo "Version $LOCAL is already published with verified provenance and packed bytes — skipping."
+                echo "##vso[task.setvariable variable=SKIP_PUBLISH]true"
+              else
+                echo "##vso[task.setvariable variable=SKIP_PUBLISH]false"
+              fi
+            displayName: Check published version
+          - script: |
+              set -euo pipefail
+              echo "//registry.npmjs.org/:_authToken=$(NPM_TOKEN)" > .npmrc
+              npm publish --access public
+            displayName: Publish npm package
+            condition: ne(variables['SKIP_PUBLISH'], 'true')
+          - script: |
+              set -euo pipefail
+              PACKAGE=@amsterdamdatalabs/enact-repo-controls
+              LOCAL=$(node -p "require('./package.json').version")
+              for attempt in $(seq 1 30); do
+                if bun workflows/scripts/release/verify-npm-artifact.ts --package "$PACKAGE" --version "$LOCAL" --git-head "$(Build.SourceVersion)" --source src/doctor.ts; then
+                  exit 0
+                fi
+                echo "Published artifact is not verifiable yet (attempt $attempt/30); waiting 10 seconds."
+                sleep 10
+              done
+              echo "##vso[task.logissue type=error]npm publication completed but the registry artifact never matched this main commit."
+              exit 1
+            displayName: Verify published npm artifact
+            condition: ne(variables['SKIP_PUBLISH'], 'true')

package/packages/repo-controls/bin/adl-repo-controls.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env bun
+import { main } from '../src/cli.ts'
+
+const code = await main(process.argv.slice(2), {
+  out: (line) => console.log(line),
+  err: (line) => console.error(line),
+  env: process.env,
+  cwd: process.cwd(),
+})
+process.exit(code)

package/packages/repo-controls/bunfig.toml

@@ -0,0 +1,58 @@
+# Coverage is a build gate, not a report — but a RATCHET, not a threshold.
+#
+# There was a flat 100% here. That is a FLOOR: it refuses code for not ARRIVING
+# good enough, which is the shape deleted from enact-m5 today for running the
+# ratchet backwards — every failure there was a file trying to enrol and being
+# turned away, so the unenrolled set was unenrollable by construction.
+#
+# It also rested on an assumption that stopped being true. The note used to read:
+# "the bundled enact-m5 scripts (scripts/verbatim/) are never imported by the
+# test process — tests exercise them as subprocesses — so they do not enter this
+# report." That tree is gone. Moving its mechanism into src/ put 389 lines of
+# never-unit-tested Azure push code into the report at once, and 100% became
+# unreachable in a single commit.
+#
+# The package's OWN ratchet replaces it -- `coverageRegressions`, the same one
+# consumers are graded by. This repository is now one of its consumers:
+# `[controls.coverage].produce` builds coverage/coverage-summary.json from the
+# lcov below, `pre_push.coverage_ratchet` grades it against the committed copy,
+# and today's untested LINES may shrink but never grow. Counts rather than
+# percentages, for the reason settled for consumer coverage the same day -- a
+# percentage is derived, so it moves whenever a file's size moves.
+#
+# Nothing bespoke lives here. An earlier pass wrote a second ratchet and a second
+# record file for this repo alone; that was the package failing to eat its own
+# standard, and it is gone.
+#
+# coveragePathIgnorePatterns is still deliberately absent: nothing under src/ is
+# exempt. The ratchet records debt in the open instead of hiding it.
+
+[test]
+# The 30s timeout lives on the `bun test` CLI in package.json, not here, because
+# it is the only form bun 1.4.2 honours in a multi-file run. Measured with a test
+# that deliberately waits 6s:
+#
+#   setDefaultTimeout() in a shared helper   ignored
+#   setDefaultTimeout() at the top of a file ignored
+#   test(name, fn, 30_000) third argument    ignored
+#   bun test --timeout 30000                 honoured
+#
+# Each of the first three passes when its file runs ALONE, which is how a broken
+# fix can look verified.
+#
+# It is DEFENCE, not a cure. An earlier version of this comment blamed the
+# pipeline failure on core contention between parallel test files and a build
+# agent sharing this Mac. That was wrong. The suite was hanging on stdin: the
+# bundled `hooks/pre-push` consumes the pushed refs with `push_updates="$(cat)"`,
+# in-process callers inherited the runner's stdin, and on the agent that stream
+# never closes. Raising the limit only moved the failure from 5015ms to 30057ms.
+# The fix is `RunContext.stdin`; tests/hook-stdin.test.ts pins both directions.
+#
+# The margin stays because these files spawn real subprocesses -- git, bash, the
+# installed CLI, `uv` -- and 5s is tight for that on a loaded machine.
+coverageSkipTestFiles = true
+# `text` for a human reading a failed run; `lcov` because the ratchet compares
+# LINE COUNTS and the text reporter prints only percentages -- a percentage is
+# derived, so it moves whenever a file's size moves.
+coverageReporter = ["text", "lcov"]
+coverageDir = ".coverage-cache"

package/packages/repo-controls/package/adl-compliance/AGENTS.md

@@ -0,0 +1,163 @@
+# adl-compliance
+
+The enforcement package, as a Python package.
+
+A check is a pure function over the set of files it is handed:
+
+```python
+findings = Check().run(context, file_set)
+```
+
+That signature is the design. A check cannot walk a tree (there is nothing to
+walk from), cannot call git, cannot locate itself, and cannot take an argument —
+not because a rule forbids it, but because it is handed a `Context` and a
+`FileSet` and has nowhere to put any of it.
+
+## Why this exists
+
+The shell tree it replaces wrote the literal string `compliance/` **1071 times
+across 248 files**. That is not a variable set wrong; it is a path typed out
+once per use. Here the interpreter resolves the package and
+`importlib.resources` resolves its data, so the string does not appear at all.
+
+Measured against `compliance_new/` at the time of the port:
+
+| | shell | here |
+|---|---|---|
+| `compliance/` path literals | 1071 | 0 |
+| places that read the environment | many | one (`cli.py`) |
+| checks spawning `yq`/`jq` | 48 | 0 (stdlib) |
+| checks driving `ast-grep` | 9 | still a subprocess, correctly |
+
+## Layout
+
+Three layers, and the dependencies only point one way: `checks` → `core` →
+`policy`. Nothing in `core` or `policy` imports a check, and no check imports
+another.
+
+| module | owns |
+|---|---|
+| `core/models.py` | `StrictModel` / `OpenModel` — `extra="forbid"`, `strict=True`, `frozen=True` |
+| `core/context.py` | `Context` and `FileSet` — the only two things a check may read |
+| `core/check.py` | the `Check` base class: the `run` template plus its shared services |
+| `core/finding.py` | `Finding`, `Advisory`, and the one text shape |
+| `core/errors.py` | `CouldNotRun` and `SchemaInvalid`, kept apart on purpose |
+| `core/scope.py` | the applicable-scope formula, and nothing else implements it |
+| `core/verdict.py` | grants arithmetic and the 0/1/2 exit contract |
+| `policy/registry.py` | the registry schema, enforced on load |
+| `policy/grants.py` | `adl.exception-catalog/v1` — owner, reason and expiry all required |
+| `policy/*.yaml` | the policy documents, carried over one-to-one |
+| `checks/<domain>/<name>.py` | one module per gate, under the domain its row declares |
+| `runner.py` | dispatch: row → check → scope → findings → verdict |
+| `cli.py` | the argv surface — the only reader of `os.environ` and the only caller of `git` |
+
+## Writing a check
+
+`run` is a template method. A subclass never overrides it; it fills in two
+hooks, and that split is the distinction this estate keeps having to re-explain:
+
+```python
+class DocsSemantics(Check):
+    id = "DOC-007"
+
+    def structural(self, ctx):          # rules that probe NAMED PATHS
+        ...                             # an absent file is in no file set
+
+    def graded(self, ctx, files):       # rules that read the GIVEN SET
+        ...                             # which files is engine.scope's question
+```
+
+Inherited from the base, because two or more checks each needed it: `report` /
+`advise`, `text` (None means absent, never a silent empty string), `state`
+(missing / empty / present), `missing_markers` / `present_markers`, `scan`
+(line-numbered regex hits), and `parse` (JSON → validated model, raising
+`SchemaInvalid` with the offending field named).
+
+## Strict validation
+
+Every document is parsed into a pydantic model with `extra="forbid"` and
+`strict=True`. The forbid is the one that earns its place: the shell tree read
+the registry with `yq -r '.rows[].engine.script'`, so a row that misspelled the
+key got an empty string, and an empty string was a gate that ran nothing and
+reported clean.
+
+`policy/gate-registry.schema.yaml`'s constraints are now enforced by the loader
+rather than by a driver script in a consumer tree — every pattern, the 80-char
+title cap, ROW-09, and the three uniqueness rules including the
+`<domain>.<name>` one that schema file called "not expressible". ROW-01/06/07/08
+are gone, not merely relocated: they constrained `engine.script` and the
+row-level `test:` field, both deleted outright (owner ruling 2026-09-15) — see
+[`docs/operations/adl-compliance-invariants.md`](../../../../docs/operations/adl-compliance-invariants.md)
+(moved from this package's own `INVARIANTS.md`, 2026-09-27, LAY-006).
+
+Two things opt out, and both are representation rather than value: a YAML array
+materialising as a `tuple`, and an enum arriving as its own member value.
+Documents this package reads but does not own (`package.json`, ast-grep's JSON
+stream) use `OpenModel` — strict about the fields they declare, indifferent to
+the rest, so ast-grep's next release does not fail a gate.
+
+## The consumer's layout arrives
+
+A row names a logical tree; `policy/trees.toml` says where it currently lives.
+
+```yaml
+scope:
+  - <rust>/crates/**/src/*.rs        # backend/crates/**/src/*.rs
+  - <compliance>/policy/inputs/rust-policy.json
+```
+
+253 of the registry's 325 scope entries are placeholders, and named-input
+defaults and `grants:` paths resolve through the same table — so no consumer path
+is written in this package's rows, and moving a tree is one line. `<name>`, not
+`{name}`: braces are already glob alternation and eleven rows use it. An unknown
+tree is a load failure, never a pattern that survives unexpanded.
+
+## Applicable scope
+
+```
+applicable scope = (row's engine.scope  ∩  the caller's set)  −  what git cannot see
+```
+
+Three terms, three owners, none of them the check. The third is the CLI's: it
+runs `git ls-files --cached --others --exclude-standard`, so gitignored paths
+never enter a set and no row needs to exclude `node_modules/`.
+
+## Running
+
+```bash
+uv run adl-compliance rust.acp-boundary
+uv run adl-compliance RST-001 --files changed.list
+uv run adl-compliance                      # every row
+```
+
+Exit `0` clean, `1` findings, `2` could not run. A tool failure is never a
+finding.
+
+## Testing
+
+```bash
+uv run pytest
+```
+
+A fixture is a committed directory holding only the files the rule is about, and
+a corpus is pointed at by passing it as the root. Nothing is copied to `$TMPDIR`
+and nothing is exported into the process.
+
+Every gate is a folder: `src/adl_compliance/checks/<domain>/<name>/` holds
+`check.py`, `test_check.py`, and `fixtures/` together — no second tree mirroring
+it. `tests/core/` is the one exception, for the spine (`Check`, `scope`,
+`Registry`, `runner`, `cli`, `Constants`, the tree map) that no single gate owns.
+
+## Status
+
+93 of the registry's 104 rows are ported — counted by importing
+`adl_compliance.checks` and measuring `len(CHECKS)` (`checks/__init__.py`'s
+explicit registry tuple), not by re-reading this paragraph.
+
+The remaining 11 are still shell in `compliance_new/`, which is frozen. A row
+with no Python implementation exits 2 with `no check implements <id>` — never
+a silent pass.
+
+[`docs/operations/adl-compliance-invariants.md`](../../../../docs/operations/adl-compliance-invariants.md)
+records what is not true yet, including two rows that do not
+trigger on their own named inputs and one whose register does not exist.

package/packages/repo-controls/package/adl-compliance/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/packages/repo-controls/package/adl-compliance/conftest.py

@@ -0,0 +1,78 @@
+"""Test-suite-wide setup.
+
+## Why `runner.run` gets a tree map here
+
+The package ships no tree defaults: a tree is a consumer path, and a consumer
+path written inside this package is a dependency on one checkout's shape. A
+repository declares its own in `[controls.compliance.trees]`, and an undeclared
+tree is could-not-run.
+
+That rule applies to the fixture corpora too -- they are laid out in a shape,
+and something has to say what it is. Sixty-five check tests call `runner.run`
+directly, so this declares it once for them instead of sixty-five times.
+
+Two properties keep this from being the packaged default under a new name:
+
+  * It lives in the TEST tree. Nothing shipped reads it. `policy/config.toml`
+    is empty and `test_no_packaged_tree_defaults.py` fails if it ever is not.
+  * It only fills in what a caller did NOT pass. A test that supplies its own
+    `trees` or `declared_trees` -- including every test that exercises the
+    undeclared-tree path -- is untouched.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from fixture_trees import fixture_trees
+
+from adl_compliance import runner
+from adl_compliance.policy import config, registry
+
+
+@pytest.fixture(autouse=True)
+def corpora_declare_their_trees(monkeypatch: pytest.MonkeyPatch) -> None:
+    real = runner.run
+
+    def declared(*args, **kwargs):
+        kwargs.setdefault("trees", fixture_trees())
+        kwargs.setdefault("declared_trees", fixture_trees())
+        return real(*args, **kwargs)
+
+    monkeypatch.setattr(runner, "run", declared)
+
+
+@pytest.fixture(autouse=True)
+def the_corpora_declare_their_shape(
+    request: pytest.FixtureRequest, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Seed the fixture tree map at its single source, for the whole suite.
+
+    `effective_trees({"rust": "x"})` used to mean "x for rust, packaged default
+    for the other fourteen". With the defaults gone it means "x, and nothing
+    else is declared" -- the correct production meaning, and exactly what
+    twenty-two tests did NOT intend: they override one tree of a corpus that
+    has fifteen.
+
+    Patching `config.load` rather than `effective_trees` is deliberate: several
+    tests do `from ... import effective_trees`, binding the name at import, so
+    patching the module attribute would miss them. Every one of those paths
+    still calls `load()` at run time, so this is the one place that reaches
+    them all. `registry.load_tree_map` is the same function under an alias
+    bound at import, so it is patched by name too.
+    """
+    if request.node.get_closest_marker("no_fixture_trees"):
+        # The tests that prove the package ships NO defaults must see the real,
+        # empty packaged map. Seeding it here would make them vacuous.
+        return
+
+    seeded = lambda: config.TreeMap(version=1, trees=fixture_trees())
+    monkeypatch.setattr(config, "load", seeded)
+    monkeypatch.setattr(registry, "load_tree_map", seeded)
+
+
+def pytest_configure(config) -> None:  # noqa: ANN001 - pytest hookspec name
+    config.addinivalue_line(
+        "markers",
+        "no_fixture_trees: see the real (empty) packaged tree map, not the corpus fixture",
+    )

package/packages/repo-controls/package/adl-compliance/pyproject.toml

@@ -0,0 +1,31 @@
+[project]
+name = "adl-compliance"
+version = "0.1.0"
+description = "The adl enforcement package: registry rows, checks, verdicts."
+readme = "AGENTS.md"
+# 3.15 exists only as 3.15.0a8 today (`uv python list`). Pinning the latest
+# STABLE; raise this the day 3.15.0 final lands.
+requires-python = ">=3.14"
+dependencies = ["PyYAML>=6.0.2", "pydantic>=2.9"]
+
+[project.scripts]
+adl-compliance = "adl_compliance.cli:main"
+
+[dependency-groups]
+dev = ["pytest>=8.3.0"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/adl_compliance"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests", "src"]
+pythonpath = ["src", "tests"]
+addopts = "-q --strict-markers"
+
+[tool.ruff]
+line-length = 100
+target-version = "py314"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/__init__.py

@@ -0,0 +1,50 @@
+"""The adl enforcement package.
+
+A check is a pure function over the set of files it is handed:
+
+    findings = Check().run(context, file_set)
+
+`run` is a template method. A subclass fills in two hooks — `structural(ctx)`
+for rules that probe named paths, `graded(ctx, files)` for rules that read the
+given set — and inherits the rest: reporting, reading, marker and line scans,
+and strict schema parsing.
+
+Everything a check is forbidden to do — resolve a root, walk a tree, call git,
+read the registry, decide an exit code — happens in `runner`, once, for all of
+them. Not by convention: a check is handed a `Context` and a `FileSet` and has
+nowhere to put any of it.
+"""
+
+from __future__ import annotations
+
+from .core.check import Check, FileState
+from .core.errors import CouldNotRun, SchemaInvalid
+from .core.context import Context, FileSet
+from .core.finding import Advisory, Finding, Report, Severity
+from .core.verdict import Outcome, Verdict, decide
+from .policy.grants import GrantEntry, GrantsCatalogue, granted
+from .policy.registry import EngineSpec, Registry, RegistryError, Row, load
+
+__all__ = [
+    "Advisory",
+    "Check",
+    "Context",
+    "CouldNotRun",
+    "EngineSpec",
+    "FileSet",
+    "FileState",
+    "Finding",
+    "GrantEntry",
+    "GrantsCatalogue",
+    "Outcome",
+    "Registry",
+    "RegistryError",
+    "Report",
+    "Row",
+    "SchemaInvalid",
+    "Severity",
+    "Verdict",
+    "decide",
+    "granted",
+    "load",
+]