@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/pipeline/phase_disjoint/fixtures/disjoint/gate-registry.yaml

@@ -0,0 +1,13 @@
+# MET-001 corpus — every row in exactly one phase.
+#
+# All four phases appear, so a gate that mistook any single phase name for an
+# overlap fires here. Nothing in this file may be reported.
+rows:
+  - id: OK-01
+    phases: [pre-commit]
+  - id: OK-02
+    phases: [pre-push]
+  - id: OK-03
+    phases: [pr_validation]
+  - id: OK-04
+    phases: [qua_deploy]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/pipeline/phase_disjoint/fixtures/empty/gate-registry.yaml

@@ -0,0 +1,7 @@
+# MET-001 corpus — a registry that decodes to zero rows.
+#
+# A gate that reads nothing and a gate that reads a clean estate reach the same
+# verdict unless the row count is asserted first, and the empty one is a broken
+# gate reporting success. This corpus is what makes that distinction testable:
+# the expected result is exit 2 ("could not run"), never exit 0.
+rows: []

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/pipeline/phase_disjoint/fixtures/overlapping/gate-registry.yaml

@@ -0,0 +1,13 @@
+# MET-001 corpus — a registry that violates both exclusion rules.
+#
+# Two rows, two different overlaps, so a gate that checks only the first pair
+# still fails this corpus. OK-01 is here for the same reason the clean corpus
+# exists: without a row that must NOT be reported, "reported BAD-01" and
+# "reported every row it decoded" look identical.
+rows:
+  - id: OK-01
+    phases: [pre-commit]
+  - id: BAD-01
+    phases: [pre-commit, pre-push]
+  - id: BAD-02
+    phases: [pr_validation, qua_deploy]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/pipeline/phase_disjoint/test_check.py

@@ -0,0 +1,109 @@
+"""PIP-004 — ported from
+`compliance_new/checks/pipeline/phase-disjoint/test.sh`.
+
+Same three named corpora as the shell fixtures, ported byte-for-byte
+(`overlapping`, `disjoint`, `empty`), minus the `policy/` wrapper directory
+the shell version needed to reassemble a whole package around the copied
+gate script — the Python check reads its named input directly, so the
+committed fixture is just the one document each case is about.
+
+This wave's checks are wired into `checks/__init__.py` in a later, single
+pass, so `PhaseDisjoint` is not yet registered under `checks.lookup`. Rather
+than call `runner.run()` — which would resolve `PIP-004` to "no check
+implements it" and report `COULD_NOT_RUN` for the wrong reason, a
+coincidental pass — `run_check` below builds the `Context` directly (with the
+one named input this gate declares) and drives the check the same way
+`runner.run` would, so the real row (`policy/gate-registry.yaml`'s `PIP-004`)
+and the real check class are exercised without depending on the registry
+wiring. This is the same bypass `contracts.transport-boundaries`'s test uses
+for an unwired, entirely-structural gate.
+
+The shell `test.sh` also asserts two cases this port does not reproduce:
+
+* "no set given is could-not-run" — a scope guard `check.sh` itself enforced
+  by hand (`ADL_CHANGED_FILES` unset). Here scope resolution belongs to
+  `runner.run`/the CLI, never to a check (K-29..K-31), and this gate reads no
+  member of the given file set at all (`graded` is unimplemented), so there
+  is no equivalent guard inside `PhaseDisjoint` for a test to exercise.
+* the exact registry source LINE each finding points at (`yq '.id | line'`).
+  `yaml.safe_load` does not carry line numbers back into the parsed model,
+  and no other YAML-register gate ported so far (`layout.directory-ratchet`,
+  `contracts.transport-boundaries`) attaches one either; this port follows
+  that precedent and reports the registry's path without a line.
+
+See `check.py`'s docstring for why neither the currently shipped shell
+registry nor this package's own carries a single row with `phases:` today —
+the scheduling model MET-001 grades was already retired in favour of
+`engine.scope`-based triggering before this row was ported. Ported here
+faithfully anyway, against the same three corpora `check.sh` was proven
+against.
+"""
+
+from __future__ import annotations
+
+import pathlib
+
+from adl_compliance.checks.pipeline.phase_disjoint import PhaseDisjoint
+from adl_compliance.core.context import Context, FileSet
+from adl_compliance.core.errors import CouldNotRun
+from adl_compliance.core.verdict import Outcome, Verdict, could_not_run, decide
+from adl_compliance.policy.registry import load
+
+FIXTURES = pathlib.Path(__file__).parent / "fixtures"
+OVERLAPPING = FIXTURES / "overlapping" / "gate-registry.yaml"
+DISJOINT = FIXTURES / "disjoint" / "gate-registry.yaml"
+EMPTY = FIXTURES / "empty" / "gate-registry.yaml"
+NOT_COMMITTED = FIXTURES / "gone.yaml"
+
+ROW = load().by_id("PIP-004")
+
+
+def run_check(registry: pathlib.Path) -> Verdict:
+    """`runner.run`'s grade-then-decide, against this check directly — the
+    same bypass `contracts.transport-boundaries`'s test uses for an unwired
+    check."""
+    ctx = Context(root=FIXTURES, row=ROW, inputs={"registry": registry})
+    try:
+        findings = tuple(PhaseDisjoint().run(ctx, FileSet()))
+    except CouldNotRun as exc:
+        return could_not_run(ROW, str(exc))
+    return decide(ROW, findings, 0, ())
+
+
+# ------------------------------------------------------------- both overlaps
+
+def test_both_overlaps_are_reported_and_the_clean_row_is_not() -> None:
+    verdict = run_check(OVERLAPPING)
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    assert verdict.rules == ["MET-001", "MET-001"]
+
+    messages = [f.message for f in verdict.findings]
+    assert any("BAD-01 runs at both pre-commit and pre-push" in m for m in messages)
+    assert any("BAD-02 runs at both pr_validation and qua_deploy" in m for m in messages)
+    assert not any("OK-01" in m for m in messages)
+
+
+# --------------------------------------------------------- every row disjoint
+
+def test_a_disjoint_registry_reports_nothing() -> None:
+    verdict = run_check(DISJOINT)
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.findings == ()
+
+
+# ------------------------------------------------- zero rows is could-not-run
+
+def test_a_registry_that_decodes_to_zero_rows_is_could_not_run() -> None:
+    """A decode that yields nothing must not read as a clean estate — the
+    assertion that separates "every row passed" from "the gate read nothing"."""
+    verdict = run_check(EMPTY)
+    assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
+    assert "decoded zero rows" in verdict.message
+
+
+# --------------------------------------------------------- a missing registry
+
+def test_a_missing_registry_is_could_not_run_not_a_pass() -> None:
+    verdict = run_check(NOT_COMMITTED)
+    assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
+    assert "missing input" in verdict.message

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/__init__.py

@@ -0,0 +1 @@
+"""release."""

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/changeset_plan/__init__.py

@@ -0,0 +1,11 @@
+"""The `release.changeset-plan` gate.
+
+A folder rather than a module because this gate's fixture corpora — a clean
+one and a release-relevant one — belong beside the check that reads them.
+"""
+
+from __future__ import annotations
+
+from .check import ChangesetPlan
+
+__all__ = ["ChangesetPlan"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/changeset_plan/check.py

@@ -0,0 +1,149 @@
+"""REL-001 — ported from
+`compliance_new/checks/release/changeset-plan/check.sh`.
+
+Entirely `graded`: the rule is "does the given set contain a release-relevant
+path", and there is no named path this gate probes unconditionally — an empty
+or irrelevant set is a silent pass, exactly as the shell script's own
+`needs_changeset` guard makes it.
+
+**The shell script's own case list, carried over untranslated.** `check.sh`'s
+`case "$path" in .workflows/changesets/package.json | ... | .changeset/*)`
+matches with bash's `case` pattern semantics, where `*` matches any string
+INCLUDING one containing `/` (case patterns are not restricted to filesystem
+pathname semantics the way `for f in *` is). `.changeset/*` therefore matches
+`.changeset/plan.md` and `.changeset/nested/plan.md` alike — the same reach as
+the registry row's own `.changeset/**` scope entry, not a narrower one.
+`fnmatch.fnmatchcase` has the identical property (a straight `*` -> `.*` regex
+translation, no path-separator special-casing) and, unlike plain `fnmatch`,
+no host-dependent case folding either, so it reproduces the shell patterns
+verbatim rather than approximating them with a hand-rolled prefix test.
+
+**Linear, not accumulating**, like the shell version: `fail()` there reports
+one finding and exits immediately, so at most one REL-001 finding ever comes
+out of a single run. Each branch below yields once and returns.
+
+**The jq-optional schema check does not survive.** `check.sh` skips its
+"changeset status output is not a JSON object" check entirely when `jq` is not
+on the host (`echo "... jq not installed for schema check"; exit 0`) — jq was
+an EXTERNAL tool the shell script had no other way to parse JSON with. This
+port has `json.loads` unconditionally, so the schema check always runs; there
+is no equivalent "jq missing" skip because there is nothing here that can be
+missing. This is a deliberate behavioural difference, not an oversight: it
+makes the gate strictly stricter (it now catches a malformed JSON object on
+every host, not only the ones with jq installed), never looser.
+
+**`release/changeset-tooling.sh` is not a registered tree.** It is invoked as
+a literal repository-relative path, exactly as `check.sh` invoked it — never
+through a `<tree>` placeholder, because no `release` entry exists in
+`policy/trees.toml` (K-42 governs a NAMED tree; this is one specific script
+this one gate drives, declared as a plain `inputs` path like any other
+consumer-owned file). Declared via `requires = ("bash",)` because that is the
+interpreter the shell tool was always invoked through and is exactly what
+`Check.requires` exists to verify before this code runs at all.
+
+**A real limit, inherited rather than introduced.** `release/` does not exist
+in this checkout (nor, per `git log`, has it ever been committed at any
+reachable ref), so the "changeset status succeeded and its JSON was graded"
+branch has never been exercised by anything this port can run — the shell
+test's own docstring says the same thing about its own fixture. This port
+proves exactly what the shell test proved: a release-relevant path in the
+given set reaches the tool invocation, and the tool's failure becomes a
+REL-001 finding rather than a crash or a silent pass.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import json
+import subprocess
+import tempfile
+from collections.abc import Iterable
+from pathlib import Path
+from typing import ClassVar
+
+from ....core.check import Check
+from ....core.context import Context, FileSet
+from ....core.finding import Report
+
+
+class ChangesetPlan(Check):
+    id: ClassVar[str] = "REL-001"
+    rule: ClassVar[str] = "REL-001"
+    requires: ClassVar[tuple[str, ...]] = ("bash",)
+
+    # check.sh's own `case "$path" in ...)` alternatives. `VERSION`,
+    # `CHANGELOG.md`, and `.changeset/*` are root-relative subject matter the
+    # gate owns outright, never a consumer's tree choice; the two
+    # `.workflows`-rooted ones are fixed 2026-09-15 (K-42 sweep) — they used
+    # to be hardcoded literals FILTERING the given set (`_is_release_relevant`
+    # below), so a repository declaring `workflows` away from its packaged
+    # default had every real release-relevant change silently excluded and
+    # this gate went quiet over content it never read — the CON-002 shape.
+    ROOT_RELEVANT: ClassVar[tuple[str, ...]] = ("VERSION", "CHANGELOG.md", ".changeset/*")
+
+    inputs: ClassVar[dict[str, str]] = {
+        # A literal repository-relative path, not a `<tree>` placeholder: no
+        # `release` tree is registered in `policy/trees.toml`, and this is the
+        # one script this one gate drives, not a named consumer tree.
+        "changeset_tool": "release/changeset-tooling.sh",
+        "workflows_package": "<workflows>/package.json",
+        "changesets_package": "<workflows>/changesets/package.json",
+        "changesets_lock": "<workflows>/changesets/bun.lock",
+    }
+
+    def graded(self, ctx: Context, files: FileSet) -> Iterable[Report]:
+        release_relevant = self.ROOT_RELEVANT + (
+            ctx.relative(ctx.inputs["workflows_package"]),
+            ctx.relative(ctx.inputs["changesets_package"]),
+            ctx.relative(ctx.inputs["changesets_lock"]),
+        )
+        if not any(self._is_release_relevant(path, release_relevant) for path in files):
+            return
+
+        with tempfile.TemporaryDirectory(prefix="changeset-status.") as work:
+            status_file = Path(work) / "status.json"
+            completed = subprocess.run(
+                (
+                    "bash", str(ctx.inputs["changeset_tool"]),
+                    "changeset", "status", "--output", str(status_file),
+                ),
+                cwd=ctx.root, capture_output=True, text=True, check=False,
+            )
+            if completed.returncode != 0:
+                yield self.report(
+                    ".changeset",
+                    "changeset status could not be computed for a release-relevant change",
+                    "add a .changeset/*.md plan for the release-relevant change, or fix "
+                    "the failing 'release/changeset-tooling.sh changeset status' invocation",
+                )
+                return
+
+            if not status_file.is_file():
+                yield self.report(
+                    ".changeset",
+                    "changeset status did not write its output file",
+                    "investigate why 'release/changeset-tooling.sh changeset status "
+                    "--output <file>' did not create the file",
+                )
+                return
+
+            body = status_file.read_text(encoding="utf-8", errors="replace")
+            try:
+                parsed = json.loads(body)
+            except json.JSONDecodeError:
+                parsed = None
+            if not isinstance(parsed, dict):
+                yield self.report(
+                    "release/changeset-tooling.sh",
+                    "changeset status output is not a JSON object",
+                    "fix release/changeset-tooling.sh's 'changeset status --output' to "
+                    "emit a JSON object",
+                )
+
+    @staticmethod
+    def _is_release_relevant(path: str, patterns: tuple[str, ...]) -> bool:
+        # `fnmatchcase`, not `fnmatch`: the shell `case` statement this ports
+        # is byte-for-byte case-sensitive, and plain `fnmatch` normalises case
+        # through `os.path.normcase` — a no-op on POSIX but not on Windows, so
+        # this would silently diverge from the shell semantics on that host.
+        return any(fnmatch.fnmatchcase(path, pattern) for pattern in patterns)

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/changeset_plan/fixtures/clean/docs/readme.md

@@ -0,0 +1,4 @@
+# fixture
+
+A file that is not release-relevant by check-changeset-plan.sh's own case list.
+Its presence in the given set must not trigger a changeset-status check.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/changeset_plan/fixtures/relevant/VERSION

@@ -0,0 +1 @@
+0.0.1

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/changeset_plan/test_check.py

@@ -0,0 +1,151 @@
+"""REL-001 — ported from
+`compliance_new/checks/release/changeset-plan/test.sh`.
+
+Two committed fixtures, copied byte-for-byte from the shell tree's corpora:
+`fixtures/clean/docs/readme.md` (no release-relevant path) and
+`fixtures/relevant/VERSION` (release-relevant, and the corpus deliberately
+carries no `release/` tree so `bash release/changeset-tooling.sh` fails for
+the same reason every time — see `check.py`'s module docstring for why that
+is this gate's real, inherited limit as a fixture subject, not a gap this port
+introduced).
+
+This check is intentionally NOT wired into `checks/__init__.py` yet (a
+separate step wires this whole wave's checks into the registry in one shot),
+so these tests call `ChangesetPlan.graded` directly against a hand-built
+`Context`/`FileSet` — the same bypass `docs/markdown_ast/test_check.py` and
+`pipeline/parser_tool_range/test_check.py` use for an unwired check, not a
+shortcut around row-scope narrowing.
+
+`test.sh`'s three cases map onto the three tests below exactly: a set with no
+release-relevant path exits 0 and reports nothing; a set naming `VERSION`
+reaches the tool invocation and turns its failure into exactly one REL-001
+finding on `.changeset`; an empty set grades nothing at all.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import shutil
+
+import pytest
+
+from adl_compliance.checks.release.changeset_plan import ChangesetPlan
+from adl_compliance.core.context import Context, FileSet
+from adl_compliance.core.verdict import Outcome, decide
+from adl_compliance.policy.registry import load
+
+FIXTURES = pathlib.Path(__file__).parent / "fixtures"
+CLEAN = FIXTURES / "clean"
+RELEVANT = FIXTURES / "relevant"
+
+ROW = load().by_id("REL-001")
+
+pytestmark = pytest.mark.skipif(
+    shutil.which("bash") is None, reason="release.changeset-plan drives bash"
+)
+
+
+def corpus_files(root: pathlib.Path) -> tuple[str, ...]:
+    """Every file in the corpus, relative to it — the same shape
+    `_corpus-set.sh`'s `corpus_set` produced for the shell test."""
+    return tuple(
+        sorted(
+            str(path.relative_to(root))
+            for path in root.rglob("*")
+            if path.is_file()
+        )
+    )
+
+
+def graded(root: pathlib.Path, given: tuple[str, ...]):
+    ctx = Context(
+        root=root, row=ROW,
+        inputs={
+            "changeset_tool": root / "release" / "changeset-tooling.sh",
+            "workflows_package": root / ".workflows" / "package.json",
+            "changesets_package": root / ".workflows" / "changesets" / "package.json",
+            "changesets_lock": root / ".workflows" / "changesets" / "bun.lock",
+        },
+    )
+    findings = tuple(ChangesetPlan().graded(ctx, FileSet(paths=given)))
+    return decide(ROW, findings, 0, ())
+
+
+def test_the_row_declares_the_gate_this_check_ports() -> None:
+    assert ROW.domain == "release"
+    assert ROW.name == "changeset-plan"
+
+
+def test_the_fixture_premise_holds() -> None:
+    """A mistyped fixture path would leave every assertion below vacuous."""
+    assert (CLEAN / "docs" / "readme.md").is_file()
+    assert (RELEVANT / "VERSION").is_file()
+    assert not (RELEVANT / "release").exists()
+
+
+def test_no_release_relevant_path_is_a_clean_no_op() -> None:
+    verdict = graded(CLEAN, corpus_files(CLEAN))
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.findings == ()
+
+
+def test_a_release_relevant_path_reaches_the_tool_and_reports_its_failure() -> None:
+    verdict = graded(RELEVANT, corpus_files(RELEVANT))
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    assert len(verdict.findings) == 1
+    finding = verdict.findings[0]
+    assert finding.rule == "REL-001"
+    assert finding.path == ".changeset"
+    assert finding.message == (
+        "changeset status could not be computed for a release-relevant change"
+    )
+
+
+def test_an_empty_set_grades_nothing() -> None:
+    verdict = graded(CLEAN, ())
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.findings == ()
+
+
+def test_changeset_star_matches_a_nested_path_like_the_shell_case_pattern() -> None:
+    """bash `case` patterns are not restricted to filesystem pathname
+    semantics: `.changeset/*` matches a path with more than one segment
+    beneath it, the same reach as the row's own `.changeset/**` scope."""
+    patterns = ChangesetPlan.ROOT_RELEVANT + (".workflows/package.json",)
+    assert ChangesetPlan._is_release_relevant(".changeset/nested/plan.md", patterns)
+    assert ChangesetPlan._is_release_relevant(".changeset/plan.md", patterns)
+    assert not ChangesetPlan._is_release_relevant("docs/readme.md", patterns)
+
+
+def test_a_redeclared_workflows_tree_is_honoured() -> None:
+    """FIXED 2026-09-15 (K-42 sweep): the bug this pins is SILENT — the old
+    `RELEASE_RELEVANT` tuple hardcoded `.workflows/...`, and `_is_release_
+    relevant` filtered the given set against it directly. A repository
+    declaring `workflows = "my-workflows"` with a real, changed `my-workflows
+    /package.json` in the given set would have that file match NOTHING,
+    `graded` would return on its very first line, and this gate would go
+    quiet over a release-relevant change it never read — never an error,
+    never a finding, a clean pass over unread content. This drives the real
+    `<workflows>` resolution (not the manual `inputs` override every other
+    test in this file uses) via `runner.resolve_inputs`/`effective_trees`,
+    and a given set containing ONLY the redeclared-tree path (nothing under
+    `.workflows/` at all) — proving the match comes from the resolved tree,
+    not a coincidental literal overlap."""
+    from contextlib import ExitStack
+
+    from adl_compliance import runner
+    from adl_compliance.policy.registry import effective_trees
+
+    tool = RELEVANT / "release" / "changeset-tooling.sh"
+    with ExitStack() as stack:
+        inputs = runner.resolve_inputs(
+            ChangesetPlan, RELEVANT, {ChangesetPlan.id: {"changeset_tool": tool}}, stack,
+            effective_trees({"workflows": "my-workflows"}),
+        )
+        ctx = Context(root=RELEVANT, row=ROW, inputs=inputs)
+        findings = tuple(
+            ChangesetPlan().graded(ctx, FileSet(paths=("my-workflows/package.json",)))
+        )
+    verdict = decide(ROW, findings, 0, ())
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    assert verdict.findings[0].rule == "REL-001"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/release/version_release/__init__.py

@@ -0,0 +1,11 @@
+"""The `release.version-release` gate.
+
+A folder rather than a module because this gate's fixture corpora — an
+aligned checkout and a drifted one — belong beside the check that reads them.
+"""
+
+from __future__ import annotations
+
+from .check import VersionRelease
+
+__all__ = ["VersionRelease"]