@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/banned_commands/test_check.py

@@ -0,0 +1,117 @@
+"""REP-004 — ported from `compliance_new/checks/repository/no-banned-commands/test.sh`.
+
+One corpus, nine files, one property apiece — see `fixtures/no-banned-commands/`.
+Two sets over it: the WHOLE corpus, handed straight to `graded()` (bypassing the
+row's scope narrowing entirely, the same way the shell test invoked `check.sh`
+directly), and the NARROWED set — the seven paths under `compliance/` — through
+`runner.run()` with the real row, exactly what `gate-runner.sh` would hand over
+in production.
+"""
+
+from __future__ import annotations
+
+import pathlib
+
+from adl_compliance import runner
+from adl_compliance.checks.repository.banned_commands import BannedCommands
+from adl_compliance.core.context import Context, FileSet
+from adl_compliance.core.verdict import Outcome, decide
+from fixture_trees import fixture_trees
+from adl_compliance.policy.registry import load
+
+CORPUS = pathlib.Path(__file__).parent / "fixtures" / "no-banned-commands"
+ROW = load().by_id("REP-004")
+
+# The row's real scope is `<compliance>/**`. The fixture's own subdirectory is
+# named to match whatever that resolves to TODAY (see the sibling directory on
+# disk) — resolved here rather than spelled, so a future remap fails this test
+# loudly (file not found) instead of silently narrowing to nothing.
+COMPLIANCE = fixture_trees()["compliance"]
+
+WHOLE = (
+    f"{COMPLIANCE}/checks/git-bad.sh",
+    f"{COMPLIANCE}/checks/git-note.sh",
+    f"{COMPLIANCE}/checks/grep-bad.sh",
+    f"{COMPLIANCE}/checks/grep-trailing.sh",
+    f"{COMPLIANCE}/checks/grep-note.sh",
+    f"{COMPLIANCE}/checks/good.sh",
+    f"{COMPLIANCE}/checks/notes.md",
+    "elsewhere/loose-git.sh",
+    "elsewhere/loose-grep.sh",
+)
+NARROWED = tuple(p for p in WHOLE if p.startswith(f"{COMPLIANCE}/"))
+
+
+def graded_directly(paths: tuple[str, ...]):
+    """Bypasses row-scope narrowing entirely — the check's OWN filtering only.
+    Mirrors the shell test's direct `check.sh` invocation, which is how it
+    proved check.sh performs no location filtering of its own."""
+    ctx = Context(root=CORPUS, row=ROW)
+    findings = tuple(BannedCommands().graded(ctx, FileSet(paths=paths)))
+    return decide(ROW, findings, 0, ())
+
+
+def test_the_whole_set_is_graded_with_no_location_filtering() -> None:
+    """Both elsewhere/ files are in the set, so both must be reported —
+    including the pair a hand-rolled path filter inside check.py would have
+    suppressed."""
+    verdict = graded_directly(WHOLE)
+    assert verdict.outcome is Outcome.FINDINGS
+    paths = {f.path for f in verdict.findings}
+    assert "elsewhere/loose-git.sh" in paths
+    assert "elsewhere/loose-grep.sh" in paths
+    assert sum(f.rule == "GIT-001" for f in verdict.findings) == 2
+    assert sum(f.rule == "GRP-001" for f in verdict.findings) == 3
+
+
+def test_the_narrowed_set_excludes_elsewhere_by_scope_not_by_the_check() -> None:
+    """The row's real `<compliance>/**` scope, through `runner.run()` — what
+    production actually hands the check."""
+    verdict = runner.run(ROW, CORPUS, NARROWED)
+    assert verdict.outcome is Outcome.FINDINGS
+    paths = {f.path for f in verdict.findings}
+    assert "elsewhere/loose-git.sh" not in paths
+    assert "elsewhere/loose-grep.sh" not in paths
+    assert f"{COMPLIANCE}/checks/git-bad.sh" in paths
+    assert f"{COMPLIANCE}/checks/grep-bad.sh" in paths
+    assert f"{COMPLIANCE}/checks/grep-trailing.sh" in paths
+
+
+def test_a_whole_line_comment_naming_the_word_is_not_a_violation() -> None:
+    verdict = runner.run(ROW, CORPUS, NARROWED)
+    paths = {f.path for f in verdict.findings}
+    assert f"{COMPLIANCE}/checks/git-note.sh" not in paths
+    assert f"{COMPLIANCE}/checks/grep-note.sh" not in paths
+
+
+def test_prose_and_a_clean_script_are_not_graded() -> None:
+    verdict = runner.run(ROW, CORPUS, NARROWED)
+    paths = {f.path for f in verdict.findings}
+    assert f"{COMPLIANCE}/checks/notes.md" not in paths
+    assert f"{COMPLIANCE}/checks/good.sh" not in paths
+
+
+def test_no_set_is_could_not_run() -> None:
+    verdict = runner.run(ROW, CORPUS, (), exhaustive=True)
+    assert verdict.outcome is Outcome.COULD_NOT_RUN
+
+
+def test_this_gate_does_not_report_itself() -> None:
+    """A check that forbids a string necessarily contains it. Both words are
+    assembled from fragments, so neither appears in the source as one token."""
+    source = pathlib.Path(__file__).parent / "check.py"
+    body = source.read_text(encoding="utf-8")
+    for entry in BannedCommands().banned():
+        assert entry.word not in body, f"{entry.word!r} appears literally in {source.name}"
+
+
+def test_the_assembled_words_are_still_the_right_ones() -> None:
+    words = {entry.word for entry in BannedCommands().banned()}
+    assert words == {"g" + "it", "g" + "rep"}
+
+
+def test_a_justfile_is_graded_by_name_not_suffix() -> None:
+    check = BannedCommands()
+    assert check._is_shell("compliance/justfile")
+    assert check._is_shell("nested/dir/justfile")
+    assert not check._is_shell("compliance/justfile.md")

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/ignored_paths/__init__.py

@@ -0,0 +1,13 @@
+"""The `repository.ignored-paths` gate.
+
+A folder even though this gate grades no single named document of its own:
+uniform depth means every `check.py` sits at exactly `checks/*/*/check.py`,
+so a relative import out of a check is right for all of them or wrong for
+all of them.
+"""
+
+from __future__ import annotations
+
+from .check import IgnoredPaths
+
+__all__ = ["IgnoredPaths"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/ignored_paths/check.py

@@ -0,0 +1,265 @@
+"""REP-005 -- a path entering the repository that .gitignore says is never
+tracked.
+
+Ported from `compliance_new/checks/repository/ignored-paths/check.sh` and
+`test.sh`. IGN-001 is the only rule.
+
+THE SOURCE IS CORRUPTED THE SAME WAY OTHER PORTED FILES DOCUMENT ALREADY
+(see `checks/framework/agent_hook_wiring/check.py`'s module docstring, and
+`checks/framework/fixture_roots/check.py` /
+`checks/layout/root_closed_set/check.py`): the literal word "git" is missing
+throughout both files. Verified directly -- `python3 -c "'git' in
+open(path).read()"` -> `False` for both `check.sh` and `test.sh` -- and
+actually RUNNING `test.sh` (with a `compliance` symlink pointed at
+`compliance_new/`, since the shell tree addresses itself as `compliance/`
+internally) confirms it cannot execute even once: `env: init: No such file or
+directory`, from `fixture_() { env ... "$@"; }` being called as `fixture_
+init -q`, i.e. `env -C "$FIXTURE" init -q` -- the missing word is the command
+name itself. This is a harder case than `checks/coverage/config_committed`'s:
+that gate's shell tool could still run and its broken behaviour was directly
+observed and ported; here nothing runs even once, so there is no executed
+behaviour to carry forward, only the intent the surrounding text still states
+unambiguously.
+
+What survives unambiguous, from converging evidence rather than assumption
+(K-07): the gate-registry row's own title -- "Never commit a path .gitignore
+excludes" -- names the ignore file `.gitignore`, not `.ignore`; git recognises
+no `.ignore` file at all, so `test.sh`'s `cat > "$FIXTURE/.ignore"` line is
+the same corruption, not a real second convention; every other stripped
+command in check.sh/test.sh (` check-ignore`, ` restore --staged`, ` add`,
+` commit`, ` status`, ` config`, ` init`) is a git subcommand missing exactly
+`git`, matching the pattern already confirmed in the three sibling files
+above; and check.sh's own comment reads "The authority is 's own ignore
+resolution" -- restoring the missing token gives "git's own ignore
+resolution", which is exactly IGN-001's documented rule. This port therefore
+writes correct `git` / `.gitignore` throughout -- recovering the one
+unambiguous original, not inventing a scenario (C-09) -- rather than
+reproducing "` check-ignore`" or "`.ignore`" as literal broken artifacts: what
+is corrupted here is the EXECUTABLE SCAFFOLDING the fixture itself needs to
+exist at all, not a FIX STRING a test asserts byte-for-byte the way
+`agent_hook_wiring`'s ported guard-path text is. A fixture literally named
+`.ignore`, driving a nonexistent `check-ignore` binary, could never
+demonstrate the rule it is supposedly proving, in either language.
+
+WHY THIS CHECK DOES NOT CALL GIT: `AGENTS.md` and K-31 are unambiguous -- no
+check calls git, resolves a root, or performs a discovery walk; `cli.py` is
+the one caller that does (P-11). `git check-ignore` is therefore not portable
+to this architecture as a subprocess call the way `cargo` / `shellcheck` /
+`ast-grep` are elsewhere (those are not banned; only the version-control tool
+is -- see `checks/repository/banned_commands` GIT-001, which this package
+enforces on itself). This gate's rule logic is reimplemented instead:
+`.gitignore` files are DATA a check reads like any other named document
+(`gitignore(5)`'s pattern grammar), never a `git` invocation.
+
+Every `.gitignore` this gate can see is exactly the `.gitignore` files
+present in the GIVEN SET (K-29) -- which, in a real, exhaustive run, is every
+one of them, because `cli.py`'s own
+`git ls-files --cached --others --exclude-standard` returns every tracked
+file including every tracked `.gitignore`, and a force-added, now-ignored
+file (the exact case IGN-001 exists to catch) is `--cached` regardless of
+whether it currently matches an ignore rule. A `.gitignore` outside the given
+set (a caller handing over a narrow diff slice with no `.gitignore` in it) is
+invisible to this port, same as any other gate reading only what it is
+handed -- a real, stated reduction in reach versus the shell tool's
+filesystem-wide `git check-ignore`, not a silent one.
+
+ONE KNOWN GAP, STATED RATHER THAN SILENTLY HANDLED: git's real precedence
+also blocks re-inclusion of a file whose ANCESTOR directory is excluded by an
+unnegated directory rule (`gitignore(5)`: "It is not possible to re-include a
+file if a parent directory of that file is excluded"). Nothing in
+`test.sh`'s own scenario exercises that interaction (its one negation,
+`!keep.log`, sits at the .gitignore's own root, with no excluded ancestor
+directory), so `_decide` below matches each candidate against the combined,
+ordered pattern list (last match wins) without also re-testing every
+ancestor directory through the same ruleset. A gate that needs that exact
+interaction covered needs that walk added, not assumed already present.
+
+  IGN-001  a given path matches an ignore rule that was never negated.
+"""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Iterable
+from typing import ClassVar, NamedTuple
+
+from ....core.check import Check
+from ....core.context import Context, FileSet
+from ....core.finding import Report
+
+
+class _Rule(NamedTuple):
+    origin: str
+    """The `.gitignore`'s own repository-relative path."""
+
+    lineno: int
+    """1-based line number inside that file."""
+
+    text: str
+    """The pattern exactly as written on that line, for the finding message."""
+
+    negated: bool
+    directory: str
+    """The `.gitignore`'s containing directory; `""` for the repository root."""
+
+    regex: re.Pattern[str]
+    """Matched against a candidate path already made relative to `directory`."""
+
+
+def _strip_trailing_unescaped_spaces(line: str) -> str:
+    return re.sub(r"(?<!\\) +$", "", line)
+
+
+def _translate(pattern: str) -> str:
+    """`gitignore(5)`'s glob grammar -> a regex fragment.
+
+    `*` and `?` never cross `/`; `**` does, in each of its three documented
+    shapes (leading `**/`, trailing `/**`, and a bracketing `/**/`). Every
+    other character is escaped; a backslash unescapes the character after it
+    literally, which is how a pattern spells a literal `#`, `!`, or space.
+    """
+    out: list[str] = []
+    i, n = 0, len(pattern)
+    while i < n:
+        if pattern.startswith("**/", i):
+            out.append(r"(?:.*/)?")
+            i += 3
+        elif pattern.startswith("/**/", i):
+            out.append(r"/(?:.*/)?")
+            i += 4
+        elif i + 3 == n and pattern.endswith("/**"):
+            out.append(r"/.*")
+            i = n
+        elif pattern.startswith("**", i):
+            out.append(r".*")
+            i += 2
+        elif pattern[i] == "*":
+            out.append(r"[^/]*")
+            i += 1
+        elif pattern[i] == "?":
+            out.append(r"[^/]")
+            i += 1
+        elif pattern[i] == "[":
+            close = pattern.find("]", i + 1)
+            if close == -1:
+                out.append(re.escape("["))
+                i += 1
+            else:
+                out.append(pattern[i : close + 1])
+                i = close + 1
+        elif pattern[i] == "\\" and i + 1 < n:
+            out.append(re.escape(pattern[i + 1]))
+            i += 2
+        else:
+            out.append(re.escape(pattern[i]))
+            i += 1
+    return "".join(out)
+
+
+def _compile_rule(origin: str, lineno: int, raw: str, directory: str) -> _Rule | None:
+    """One `.gitignore` line -> a `_Rule`, or `None` for blank/comment lines."""
+    line = _strip_trailing_unescaped_spaces(raw)
+    if not line:
+        return None
+    if line.startswith("\\#"):
+        line = line[1:]
+    elif line.startswith("#"):
+        return None
+
+    negated = False
+    if line.startswith("\\!"):
+        line = line[1:]
+    elif line.startswith("!"):
+        negated = True
+        line = line[1:]
+    if not line:
+        return None
+
+    dir_only = line.endswith("/") and not line.endswith("\\/")
+    if dir_only:
+        line = line[:-1]
+
+    anchored = "/" in line
+    if line.startswith("/"):
+        line = line[1:]
+        anchored = True
+
+    body = _translate(line)
+    if dir_only:
+        # A directory rule matches everything UNDER that directory; it never
+        # matches a plain file candidate that only shares the directory's name.
+        body += r"/.*"
+    fragment = f"^{body}$" if anchored else f"^(?:.*/)?{body}$"
+    return _Rule(
+        origin=origin, lineno=lineno, text=raw.strip(), negated=negated,
+        directory=directory, regex=re.compile(fragment),
+    )
+
+
+def _parse(origin: str, directory: str, body: str) -> list[_Rule]:
+    rules = []
+    for lineno, raw in enumerate(body.splitlines(), start=1):
+        rule = _compile_rule(origin, lineno, raw, directory)
+        if rule is not None:
+            rules.append(rule)
+    return rules
+
+
+def _relative_to(directory: str, path: str) -> str | None:
+    """`path` expressed relative to `directory`, or `None` when it is not under it."""
+    if not directory:
+        return path
+    prefix = f"{directory}/"
+    return path[len(prefix) :] if path.startswith(prefix) else None
+
+
+class IgnoredPaths(Check):
+    id: ClassVar[str] = "REP-005"
+    rule: ClassVar[str] = "IGN-001"
+
+    IGNORE_FILENAME: ClassVar[str] = ".gitignore"
+
+    def graded(self, ctx: Context, files: FileSet) -> Iterable[Report]:
+        given = tuple(files)
+        # Shallowest .gitignore first, deepest last: `_decide` keeps the LAST
+        # matching rule, which is exactly git's own precedence -- a deeper
+        # .gitignore's rules override a shallower one's for paths under it.
+        ignore_paths = sorted(
+            (p for p in given if self._is_gitignore(p)), key=lambda p: p.count("/"),
+        )
+        rules: list[_Rule] = []
+        for path in ignore_paths:
+            body = self.text(ctx, path)
+            if body is None:
+                continue
+            directory = path.rsplit("/", 1)[0] if "/" in path else ""
+            rules.extend(_parse(path, directory, body))
+        if not rules:
+            return
+
+        for candidate in sorted(given):
+            if self._is_gitignore(candidate):
+                continue
+            decision = self._decide(candidate, rules)
+            if decision is None or decision.negated:
+                continue
+            yield self.report(
+                candidate,
+                f"{candidate} is staged, but {decision.origin}:{decision.lineno} "
+                f"({decision.text}) says it is never tracked",
+                f"unstage it with 'git restore --staged {candidate}'; if it truly "
+                f"belongs in the repository, remove or negate the rule at "
+                f"{decision.origin}:{decision.lineno} rather than forcing the add",
+            )
+
+    def _is_gitignore(self, path: str) -> bool:
+        return path == self.IGNORE_FILENAME or path.endswith(f"/{self.IGNORE_FILENAME}")
+
+    def _decide(self, candidate: str, rules: list[_Rule]) -> _Rule | None:
+        """The LAST rule (in combined, ordered precedence) that matches, if any."""
+        matched: _Rule | None = None
+        for entry in rules:
+            rel = _relative_to(entry.directory, candidate)
+            if rel is not None and entry.regex.match(rel):
+                matched = entry
+        return matched

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/ignored_paths/fixtures/ignored-paths/keep.log

@@ -0,0 +1 @@
+kept

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/ignored_paths/fixtures/ignored-paths/src/main.rs

@@ -0,0 +1 @@
+fn main() {}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/ignored_paths/test_check.py

@@ -0,0 +1,180 @@
+"""REP-005 -- ported from
+`compliance_new/checks/repository/ignored-paths/test.sh`.
+
+One committed fixture (`fixtures/ignored-paths/`), byte-for-byte the shell
+test's inline `mktemp`/heredoc scenario: a root `.gitignore` excluding
+`node_modules/`, `*.log` (with `!keep.log` readmitting one file), and
+`reports/`, plus one ordinary source file. See `check.py`'s module docstring
+for why the fixture is named `.gitignore` (not `.ignore`, which is what
+`test.sh`'s own corrupted source literally writes) and why this test drives
+`IgnoredPaths` directly rather than through `runner.run()`/the row id:
+REP-005 is not yet listed in `checks/__init__.py` (a later step wires this
+whole wave in one shot), so dispatch-by-id would report `COULD_NOT_RUN` for
+every case regardless of this check's own behaviour -- the same reason
+`coverage/config_committed` and `layout/plans_layout`'s own test suites give
+for the identical choice.
+
+Every scenario below hands `.gitignore` itself in the given set alongside the
+candidate paths, because this check reads `.gitignore` content from the GIVEN
+SET (K-29) rather than walking for it -- see `check.py`'s "WHY THIS CHECK
+DOES NOT CALL GIT" for the reasoning, and
+`test_a_gitignore_outside_the_given_set_is_invisible` for the stated reach
+reduction that follows from it.
+"""
+
+from __future__ import annotations
+
+import re
+
+from helpers import corpus
+
+from adl_compliance.checks.repository.ignored_paths import IgnoredPaths
+from adl_compliance.checks.repository.ignored_paths.check import _compile_rule, _translate
+from adl_compliance.core.context import Context, FileSet
+from adl_compliance.core.finding import Finding
+from adl_compliance.core.verdict import Outcome, decide
+from adl_compliance.policy.registry import load
+
+CORPUS = corpus("repository", "ignored-paths") / "ignored-paths"
+ROW = load().by_id("REP-005")
+GITIGNORE = ".gitignore"
+
+
+def graded_directly(paths: tuple[str, ...]):
+    """Bypasses row-scope narrowing entirely -- the check's OWN behaviour only,
+    the same division `repository/banned_commands`'s own test uses for the
+    identical reason (REP-005 not yet wired, see the module docstring)."""
+    ctx = Context(root=CORPUS, row=ROW)
+    findings = tuple(IgnoredPaths().run(ctx, FileSet(paths=paths)))
+    return decide(ROW, findings, 0, ())
+
+
+def test_the_row_identifies_this_check() -> None:
+    assert ROW.domain == "repository"
+    assert ROW.name == "ignored-paths"
+
+
+# --- IGN-001: staged paths the ignore rules exclude ---------------------------
+
+
+def test_an_ignored_directory_and_extension_are_both_reported() -> None:
+    verdict = graded_directly((GITIGNORE, "node_modules/pkg/index.js", "debug.log"))
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    paths = {f.path for f in verdict.findings}
+    assert "node_modules/pkg/index.js" in paths
+    assert "debug.log" in paths
+    assert all(f.rule == "IGN-001" for f in verdict.findings)
+
+
+def test_the_finding_names_the_deciding_rule_and_its_line() -> None:
+    """The diagnostic names the rule that decided it, not just the path --
+    otherwise the reader has every `.gitignore` in the tree to search by
+    hand."""
+    verdict = graded_directly((GITIGNORE, "node_modules/pkg/index.js"))
+    (finding,) = verdict.findings
+    assert isinstance(finding, Finding)
+    assert ".gitignore:1 (node_modules/)" in finding.message
+
+
+# --- a negation is NOT a violation --------------------------------------------
+
+
+def test_a_path_readmitted_by_a_negation_rule_passes() -> None:
+    """`keep.log` matches `*.log` and is then readmitted by `!keep.log`. The
+    LAST matching rule decides, and that rule is the negation."""
+    verdict = graded_directly((GITIGNORE, "keep.log"))
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+
+
+# --- an already-tracked ignored file is still caught --------------------------
+
+
+def test_an_already_tracked_ignored_file_is_reported() -> None:
+    """`reports/` is ignored, but `reports/run.csv` sits in the given set
+    regardless -- exactly the force-added, now-ignored case IGN-001 exists to
+    catch (see `check.py`'s module docstring: `cli.py`'s own `git ls-files
+    --cached` returns a tracked path whether or not it currently matches an
+    ignore rule)."""
+    verdict = graded_directly((GITIGNORE, "reports/run.csv"))
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    assert verdict.rules == ["IGN-001"]
+    assert verdict.findings[0].path == "reports/run.csv"
+
+
+# --- a clean scope stays silent ------------------------------------------------
+
+
+def test_an_ordinary_source_file_is_not_reported() -> None:
+    verdict = graded_directly((GITIGNORE, "src/main.rs"))
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+
+
+def test_the_whole_corpus_reports_exactly_the_three_ignored_paths() -> None:
+    whole = (
+        GITIGNORE,
+        "src/main.rs",
+        "node_modules/pkg/index.js",
+        "debug.log",
+        "keep.log",
+        "reports/run.csv",
+    )
+    verdict = graded_directly(whole)
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    paths = {f.path for f in verdict.findings}
+    assert paths == {"node_modules/pkg/index.js", "debug.log", "reports/run.csv"}
+
+
+# --- reach: this check reads .gitignore from the GIVEN SET, not a walk --------
+
+
+def test_a_gitignore_outside_the_given_set_is_invisible() -> None:
+    """Stated in `check.py`'s module docstring as a real, deliberate reduction
+    in reach versus the shell tool's filesystem-wide `git check-ignore`: with
+    no `.gitignore` in the given set, this check has no rule to grade against
+    and reports clean even for a path that IS ignored on disk."""
+    verdict = graded_directly(("node_modules/pkg/index.js",))
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+
+
+def test_no_set_is_a_clean_pass() -> None:
+    verdict = graded_directly(())
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+
+
+# --- the pattern engine itself -------------------------------------------------
+
+
+def test_a_directory_pattern_matches_only_paths_beneath_it() -> None:
+    rule = _compile_rule(GITIGNORE, 1, "node_modules/", "")
+    assert rule is not None
+    assert rule.regex.match("node_modules/pkg/index.js")
+    assert not rule.regex.match("node_modules")
+    assert not rule.regex.match("not-node_modules/x")
+
+
+def test_a_slash_free_pattern_matches_at_any_depth() -> None:
+    rule = _compile_rule(GITIGNORE, 1, "*.log", "")
+    assert rule is not None
+    assert rule.regex.match("debug.log")
+    assert rule.regex.match("nested/dir/debug.log")
+    assert not rule.regex.match("debug.logx")
+
+
+def test_a_comment_and_a_blank_line_compile_to_nothing() -> None:
+    assert _compile_rule(GITIGNORE, 1, "# a comment", "") is None
+    assert _compile_rule(GITIGNORE, 2, "", "") is None
+    assert _compile_rule(GITIGNORE, 3, "   ", "") is None
+
+
+def test_a_leading_bang_negates_and_a_leading_escaped_bang_does_not() -> None:
+    negated = _compile_rule(GITIGNORE, 1, "!keep.log", "")
+    literal = _compile_rule(GITIGNORE, 2, "\\!literal-bang", "")
+    assert negated is not None and negated.negated is True
+    assert literal is not None and literal.negated is False
+    assert literal.regex.match("!literal-bang")
+
+
+def test_star_never_crosses_a_path_separator() -> None:
+    assert _translate("*") == "[^/]*"
+    assert re.compile(f"^{_translate('*')}$").match("a") is not None
+    assert re.compile(f"^{_translate('*')}$").match("a/b") is None

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/license_declared/__init__.py

@@ -0,0 +1,12 @@
+"""The `repository.license-declared` gate.
+
+A folder rather than a module because this gate GRADES A DOCUMENT, and the
+document belongs beside the check that reads it. `check.py` is the rule;
+anything else in here is what it grades.
+"""
+
+from __future__ import annotations
+
+from .check import LicenseDeclared
+
+__all__ = ["LicenseDeclared"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/license_declared/check.py

@@ -0,0 +1,84 @@
+"""REP-001 — the repository ships the licence it declares.
+
+The gate asks two things and no more: is there a LICENSE at the repository root,
+and is it the type `[controls.compliance].license` names.
+
+It used to ask something else. Until 2026-09-15 it required the full Apache
+License 2.0 text, rejected a manifest declaring MIT, demanded an Apache
+attribution line in NOTICE, and carried a regex for a donor brand
+(`aionui|aioncore|aionrs|aion`) from the repository it was ported out of. That is
+not a gate enforcing a rule — it is a gate choosing a company's licensing, and
+the estate it chose for ships proprietary. Owner ruling: the licence is the
+repository's declaration, the same way its trees are; the package checks the
+repository against what it declared.
+
+Structural only. LICENSE-MISSING is about a file's ABSENCE, and an absent file
+appears in no file set — a rule that only iterated the set could never report it.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import ClassVar
+
+from ....core.check import Check
+from ....core.context import Context
+from ....core.finding import Report
+
+
+class LicenseDeclared(Check):
+    id: ClassVar[str] = "REP-001"
+
+    KEY: ClassVar[str] = "license"
+
+    # What each licence looks like on disk, keyed by the declared name. A name
+    # absent from this table is not an error: the declaration itself is then the
+    # marker, so an estate may declare a licence this package has never heard of
+    # and still be graded against it. The table is a convenience for the common
+    # ones, never a list of permitted answers.
+    PROFILES: ClassVar[dict[str, tuple[str, ...]]] = {
+        "Proprietary": ("Proprietary", "All rights reserved"),
+        "Apache-2.0": ("Apache License", "Version 2.0"),
+        "MIT": ("MIT License", "Permission is hereby granted"),
+        "BSD-3-Clause": ("BSD 3-Clause", "Redistribution and use"),
+        "GPL-3.0": ("GNU GENERAL PUBLIC LICENSE", "Version 3"),
+    }
+
+    def markers(self, declared: str) -> tuple[str, ...]:
+        return self.PROFILES.get(declared, (declared,))
+
+    def structural(self, ctx: Context) -> Iterable[Report]:
+        declared = ctx.declarations.get(self.KEY, "").strip()
+        if not declared:
+            # Undeclared is a finding against the repository, not a silent pass
+            # and not a default of ours. Choosing one here is the defect this
+            # rewrite removed.
+            yield self.report(
+                "adl-config.toml",
+                "[controls.compliance] declares no `license`, so the repository "
+                "states no licence for LICENSE to be checked against",
+                'add `license = "Proprietary"` (or the licence this repository '
+                "ships under) to [controls.compliance] in adl-config.toml",
+                rule="LICENSE-UNDECLARED",
+            )
+            return
+
+        body = self.text(ctx, "LICENSE")
+        if body is None:
+            yield self.report(
+                "LICENSE",
+                f"missing repository-root LICENSE (adl-config.toml declares {declared})",
+                f"create a LICENSE file at the repository root carrying the {declared} terms",
+                rule="LICENSE-MISSING",
+            )
+            return
+
+        missing = self.missing_markers(body, self.markers(declared))
+        if missing:
+            yield self.report(
+                "LICENSE",
+                f"LICENSE is not {declared} (missing: {', '.join(missing)})",
+                f"replace LICENSE with the {declared} terms, or correct the "
+                "`license` declaration in adl-config.toml to match the file",
+                rule="LICENSE-CONTENT",
+            )