@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.12 → 0.1.28

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/policy/gate-registry.yaml

@@ -32,69 +32,6 @@
 schema: adl.gate-profile/v1
 rows:
 
-  # ---- coverage ----
-  - id: COV-001
-    name: backend-crate
-    domain: coverage
-    title: Run retained backend crate coverage gate
-    severity: M
-    controls:
-      - EC-A.8.29
-    engine:
-      scope:
-        - <rust>/**
-    grants: 0
-    timeout_ms: 60000
-  - id: COV-002
-    name: backend-ratchet
-    domain: coverage
-    title: Reject backend coverage decline below its ratchet
-    severity: H
-    controls:
-      - EC-A.8.28
-    engine:
-      scope:
-        - <rust>/**
-    grants: 0
-    timeout_ms: 60000
-  - id: COV-003
-    name: baseline
-    domain: coverage
-    title: Run retained coverage baseline gate
-    severity: M
-    controls:
-      - EC-A.8.29
-    engine:
-      scope:
-        - <rust>/**
-    grants: 0
-    timeout_ms: 60000
-  - id: COV-004
-    name: config-committed
-    domain: coverage
-    title: Require coverage ratchet data to be committed
-    severity: M
-    controls:
-      - EC-A.8.29
-    engine:
-      scope:
-        - <compliance>/policy/inputs/coverage-baseline.json
-    grants: 0
-    timeout_ms: 60000
-  - id: COV-005
-    name: full
-    domain: coverage
-    title: Run retained coverage gate
-    severity: M
-    controls:
-      - EC-A.8.29
-    engine:
-      scope:
-        - <rust>/**
-        - <compliance>/checks/coverage/full/coverage-modules.list
-    grants: 0
-    timeout_ms: 60000
-
   # ---- docs ----
   - id: DOC-001
     name: adr-lifecycle
@@ -238,7 +175,7 @@ rows:
     grants: 0
     timeout_ms: 60000
 
-  # ---- frontend ----
+  # ---- docs (continued: indexes, ledger, closed-set) ----
   - id: DOC-008
     name: indexes
     domain: docs
@@ -301,6 +238,104 @@ rows:
         - '<docs>/**'
     grants: 0
     timeout_ms: 60000
+  - id: DOC-011
+    name: filename
+    domain: docs
+    title: Require docs/ Markdown stems to be lower-kebab
+    severity: M
+    controls:
+      - EC-A.5.37
+    engine:
+      # docs/ only. The plans tree is deliberately NOT here: its pages answer
+      # to the board (LAY-009 owns plans/ frontmatter) and a filename rule is
+      # no more able to grade them than a profile is.
+      #
+      # The scope below mirrors DOC-006 (docs.okf-profile) EXACTLY -- one
+      # tree, both docs/ content gates walking it -- with the rationale
+      # comments carried over, adjusted only where they were
+      # profile-specific:
+      scope:
+        - <docs>/**
+        # A holding area for work that is not yet a Feature on the board.
+        # DOC-006 excludes it from profiling by design; mirrored here so a
+        # page DOC-006 does not grade is not graded for its filename either.
+        - '!<docs>/proposals/**'
+        # DOC-006 has excluded compliance/ since 2026-09-15, pending a real
+        # compliance audit (its pages answer to audit metadata, not to a
+        # gate a writer can satisfy from the document). The exclusion is
+        # mirrored here unchanged.
+        - '!<docs>/compliance/**'
+        # Tree guides are not pages: AGENTS.md and CLAUDE.md say what
+        # belongs in a directory and are governed by layout.agents-layout.
+        # The check also exempts the two names by rule -- a name may not be
+        # lower-kebab and still be correct -- so these excludes are
+        # belt-and-braces over that exemption, mirroring DOC-006.
+        - '!<docs>/**/AGENTS.md'
+        - '!<docs>/AGENTS.md'
+        - '!<docs>/**/CLAUDE.md'
+        - '!<docs>/CLAUDE.md'
+        # A knowledge index is a catalog of a tree, not a page about the
+        # system (DOC-006's reasoning); its stem ("index") is
+        # kebab-conforming anyway, and the exclusion is mirrored so both
+        # gates walk the same tree.
+        - '!<docs>/**/index.md'
+    grants: 0
+    timeout_ms: 60000
+  - id: DOC-012
+    name: directory-size
+    domain: docs
+    title: Cap each docs/ directory's page count via the directory ratchet
+    severity: M
+    controls:
+      - EC-A.5.38
+    engine:
+      # docs/ only. The plans tree is deliberately NOT here: its pages answer
+      # to the board (LAY-009 owns plans/ frontmatter) and a page-count cap
+      # is no more able to grade them than a filename rule is.
+      #
+      # The cap is CONFIG, not register content (owner ruling 2026-10-02):
+      # it is the repository's declared
+      # [controls.compliance.limits].docs_pages_per_directory, arriving as
+      # the docs-pages-per-directory declaration; absent, the engine default
+      # of 15 stands. The LAY-004 directory-ratchet register holds ONLY
+      # per-directory exemption baselines (docs_pages.baseline): an entry
+      # exempts its directory up to the recorded count; an absent register or
+      # section means NO exemptions, so the cap is enforced bare. At zero
+      # exemptions the register file is deleted. docs/decisions/ is exempt by
+      # rule at any depth below it — the flat ADR log is flat-by-design, not
+      # an over-cap directory.
+      #
+      # The scope below mirrors DOC-006 (docs.okf-profile) EXACTLY -- one
+      # tree, all three docs/ content gates walking it -- with the rationale
+      # comments carried over, adjusted only where they were
+      # filename-specific:
+      scope:
+        - <docs>/**
+        # A holding area for work that is not yet a Feature on the board.
+        # DOC-006 excludes it from profiling by design; mirrored here so a
+        # page DOC-006 does not grade is not counted against the cap either.
+        - '!<docs>/proposals/**'
+        # DOC-006 has excluded compliance/ since 2026-09-15, pending a real
+        # compliance audit (its pages answer to audit metadata, not to a
+        # gate a writer can satisfy from the document). The exclusion is
+        # mirrored here unchanged.
+        - '!<docs>/compliance/**'
+        # Tree guides are not pages: AGENTS.md and CLAUDE.md say what
+        # belongs in a directory and are governed by layout.agents-layout.
+        # The check's rule-level exemption is decisions/ (the flat ADR log,
+        # flat-by-design) rather than these names, so these excludes are
+        # the whole of the guide story here, mirroring DOC-006.
+        - '!<docs>/**/AGENTS.md'
+        - '!<docs>/AGENTS.md'
+        - '!<docs>/**/CLAUDE.md'
+        - '!<docs>/CLAUDE.md'
+        # A knowledge index is a catalog of a tree, not a page about the
+        # system (DOC-006's reasoning); it does not count against the page
+        # cap either, and the exclusion is mirrored so the docs gates walk
+        # the same tree.
+        - '!<docs>/**/index.md'
+    grants: 0
+    timeout_ms: 60000
 
   # ---- layout ----
   - id: LAY-001
@@ -366,6 +401,14 @@ rows:
     controls:
       - EC-A.5.36
     engine:
+      # The ceilings are CONFIG, not register content (generic ratchet
+      # principle, owner ruling 2026-10-02): they live in
+      # [controls.compliance.directory-ratchet].max_children and reach the
+      # engine as the directory-ceilings declaration. The LAY-004 register
+      # records exemption baselines only; an absent register means no
+      # exemptions allowed, so the ceilings are enforced bare. At zero
+      # recorded state the register file is deleted. No ceilings declared
+      # means nothing to enforce — the gate is inert.
       scope:
         - <typescript>/**
         - <rust>/**
@@ -390,11 +433,16 @@ rows:
         - '!**/Cargo.toml'
         - '!**/build.rs'
         - '!**/main.tf'
-        # No named-input entry for the ratchet register: it is package data now
-        # (src/adl_compliance/checks/layout/directory_ratchet/grants.yaml,
-        # read via `resources`, not a consumer path), so editing it does not
-        # select this gate -- the same known gap DOC-006's packaged profile
-        # register has (see INVARIANTS.md, "What is not true yet").
+        # The ratchet register is a named INPUT of this gate, not a scope entry:
+        # it is the CONSUMER's own file (<compliance>/ratchets/
+        # LAY-004-over-limit-directory.yaml -- the estate's settled location for
+        # a consumer-owned ratchet number, see packages/repo-controls/src/
+        # config.ts), and <compliance> is not one of this row's scope trees, so
+        # editing the register does not select this gate -- the same known gap
+        # DOC-006's packaged profile register has. It shipped as package data
+        # once and graded one donor repository's shape against every other
+        # repository (K-42); the `inputs` entry and
+        # test_the_register_is_not_packaged_data guard that return.
     # Tree-scoped only. Every verdict is a directory's DIRECT FILE COUNT, which
     # is only knowable by listing all of that directory's children: on a diff
     # scope DIR-002 can never fire and DIR-001's single-file rule misfires on
@@ -404,7 +452,8 @@ rows:
     # removes. `full` (`selects: all-rows`) picks this row up regardless.
     # Not an exception catalogue: `structural_grant = True` on the check
     # already forces the allowance to 0 regardless of this field. The ratchet
-    # register itself is package data, read via `resources` (see check.py).
+    # register itself is the consumer's own file, reached through the check's
+    # named `inputs`, not package data (see check.py).
     grants: 0
     timeout_ms: 60000
   - id: LAY-006
@@ -466,25 +515,6 @@ rows:
         - <plans>/**
     grants: 0
     timeout_ms: 60000
-  - id: LAY-010
-    name: profile-data
-    domain: layout
-    title: Enforce data-backed layout profile predicates
-    severity: M
-    controls:
-      - EC-A.5.36
-    engine:
-      # The two `*.md` globs are removed. They are residue from the multi-mode
-      # profile-data.sh this engine was split out of: its `layout.markdown-trees`
-      # branch read Markdown, and that branch now lives in its own gate
-      # (check-markdown-tree-location.sh) with its own row. This engine reads
-      # PostgreSQL migrations and nothing else, so the globs only made every
-      # documentation change schedule a gate with nothing to say. A stale scope
-      # is a silent pass in one direction and dead work in the other (K-17).
-      scope:
-        - <rust>/crates/**
-    grants: 0
-    timeout_ms: 60000
   - id: LAY-011
     name: references
     domain: layout
@@ -592,7 +622,7 @@ rows:
   - id: LAY-016
     name: open-work-cap
     domain: layout
-    title: No open plans or open gaps
+    title: Cap open plans and open gaps at ten
     severity: M
     controls:
       - EC-A.5.36
@@ -613,14 +643,16 @@ rows:
     engine:
       scope:
         - '**'
-        # The LFS fixtures are deliberately oversized binaries committed WITHOUT
-        # LFS -- that is precisely what they prove the check detects. Grading
-        # them means a package that fixture-tests "large blobs must use LFS"
-        # can never pass its own gate.
+        # LFS-001's own test cases are generated at test time under tmp_path
+        # (the committed LFS fixtures were retired 2026-10-01), so this gate no
+        # longer commits oversized binaries. The `!**/fixtures/**` exclusion
+        # remains because OTHER gates still commit fixtures, and fixture data
+        # is test input, not repository content to grade.
         - '!**/fixtures/**'
     grants: 0
     timeout_ms: 60000
 
+  # ---- pipeline ----
   - id: PIP-004
     name: phase-disjoint
     domain: pipeline
@@ -675,6 +707,13 @@ rows:
       - EC-A.5.21
     engine:
       scope:
+        # The tree-derived DEFAULT: each half is exactly two entries under its own
+        # tree. A repository whose manifests do not sit one level under its tree
+        # (enact-combined: a brace-union `typescript` tree, manifests at the root and
+        # under apps/*/) states the paths itself with `[controls.compliance.lockfiles]`
+        # (`bun-manifests`/`bun-lockfiles`, `cargo-manifests`/`cargo-lockfiles`); a
+        # declared half REPLACES that half's two entries, in the scope and in what the
+        # check grades. See `LockfileIntegrity.declared_scope`.
         - <rust>/Cargo.toml
         - <rust>/Cargo.lock
         - <typescript>/package.json
@@ -736,56 +775,3 @@ rows:
         - '**'
     grants: 0
     timeout_ms: 60000
-  - id: REL-001
-    name: changeset-plan
-    domain: release
-    title: Run retained changeset-plan gate
-    severity: M
-    controls:
-      - EC-A.8.32
-    engine:
-      scope:
-        # The gate's own "release-relevant" case list, which is six paths, not
-        # one tree. `.changeset/**` alone understated it by five: while the gate
-        # resolved its own diff those five were still tested, so the row and the
-        # code disagreed and the code won. Now the row is the narrowing, so a
-        # missing entry here is a file the gate can no longer see.
-        - .changeset/**
-        - VERSION
-        - CHANGELOG.md
-        - <workflows>/package.json
-        - <workflows>/changesets/package.json
-        - <workflows>/changesets/bun.lock
-    grants: 0
-    timeout_ms: 60000
-  - id: REL-004
-    name: version-release
-    domain: release
-    title: Run retained version-release gate
-    severity: M
-    controls:
-      - EC-A.8.32
-    engine:
-      scope:
-        # The FOUR files check.sh actually reads: VERSION and CHANGELOG.md
-        # directly, plus the two entries in its `versioned_files` array. The
-        # prior brace-glob form, `{VERSION,CHANGELOG.md,backend/Cargo.toml,
-        # frontend/package.json,.changeset}/**`, appended `/**` after each
-        # FILE name -- `_glob_bash_pattern` in lib/glob.sh requires a literal
-        # "/" then more characters after the alternation, which a bare file
-        # never has, so the pattern matched none of VERSION, CHANGELOG.md,
-        # backend/Cargo.toml or frontend/package.json and only `.changeset/**`
-        # ever selected this row (K-13: a positive glob matching nothing
-        # excludes everything). backend/Cargo.toml (0.1.52) and
-        # frontend/package.json (2.1.41) carry their own independent
-        # versioning, not the release VERSION (0.0.11) -- check.sh does not
-        # read either, so they are not restored here; adding them would
-        # trigger this gate for two files it has no logic to grade.
-        - VERSION
-        - CHANGELOG.md
-        - <workflows>/package.json
-        - <workflows>/changesets/package.json
-    grants: 0
-    timeout_ms: 60000
-
-  # ---- rust ----

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/policy/registry.py

@@ -27,7 +27,7 @@ from ..core.constants import Constants
 from ..core.finding import Severity
 from ..core.models import StrictModel
 from ..core.errors import CouldNotRun
-from .config import PLACEHOLDER, TreeMapError, expand
+from .config import PLACEHOLDER, expand
 from collections.abc import Mapping
 
 from .config import load as load_tree_map

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/policy/root_shape.py

@@ -21,10 +21,27 @@ choice — none can be moved into an owning tree without breaking the tool that
 reads them. The same is true of `pyproject.toml` for Python and `Cargo.toml`
 for Rust. A repository using none of a section simply never matches its
 entries; an entry that permits an absent file costs nothing.
+
+**Non-standard entries are declared per repository, not listed here.** The sets
+below hold only what is standard across repositories. A repository that keeps
+something else at its root — a `STATUS.md` register, an `apps/` tree — declares
+it in its own `adl-config.toml` under `[controls.compliance.root]` (`files` and
+`dirs`). That arrives in the engine as the `root-files` and `root-dirs`
+declarations (comma-separated), and `allowed_root_files` / `allowed_root_dirs`
+return the central set UNION those names. The gates compute the effective set at
+grade time from `Context.declarations`; the module-level sets stay the central
+defaults and are never mutated.
 """
 
 from __future__ import annotations
 
+from collections.abc import Mapping
+
+# The `Context.declarations` keys a repository's `[controls.compliance.root]`
+# table is sent under (`--declare root-files=a,b` / `--declare root-dirs=x,y`).
+ROOT_FILES_DECLARATION = "root-files"
+ROOT_DIRS_DECLARATION = "root-dirs"
+
 # ── Files ─────────────────────────────────────────────────────────────────────
 
 VCS_AND_META: frozenset[str] = frozenset({
@@ -63,14 +80,12 @@ GOVERNANCE: frozenset[str] = frozenset({
 # Registers read by whoever picks the work up next. They sit at the root
 # because that is where someone arriving at the repository looks.
 #
-# STATUS.md (the live checklist) and DRIFT.md (the drift audit) are the same
-# kind of object: a register read by whoever picks the work up next, not
-# narrative documentation that belongs under docs/. (Tarun, 2026-09-27.)
+# Only the standard ones. A repository's own registers (a STATUS.md, a DRIFT.md)
+# are not standard: it declares them under `[controls.compliance.root] files`.
+# (Tarun, 2026-10-01 — reverses the 2026-09-27 central listing.)
 REGISTERS: frozenset[str] = frozenset({
     "GAPS-AND-FINDINGS.md",
     "OPEN-ITEMS.md",
-    "STATUS.md",
-    "DRIFT.md",
 })
 
 NODE_TOOLCHAIN: frozenset[str] = frozenset({
@@ -140,6 +155,10 @@ PROJECT_CONFIG: frozenset[str] = frozenset({
     "docker-compose.yml",
     "drizzle.config.ts",
     "adl-config.toml",
+    # An adl-controlled Enact repository carries BOTH config files at its root,
+    # permanently (Tarun, 2026-10-01: "there will be both"). Built in here so no
+    # repository declares it by hand under `[controls.compliance.root] files`.
+    "enact-config.toml",
     "justfile",
 })
 
@@ -184,12 +203,10 @@ KNOWLEDGE_TREES: frozenset[str] = frozenset({
     "specs",
 })
 
+# Only the standard source trees. `apps/` and `packaging/` are not standard — a
+# repository that has them declares them under `[controls.compliance.root] dirs`.
+# (Tarun, 2026-10-01 — reverses the 2026-09-27 central listing.)
 SOURCE_TREES: frozenset[str] = frozenset({
-    # `apps/` (deployables) and `packaging/` are sanctioned root directories in
-    # the Enact monorepo layout this repository follows — the Enact monorepo
-    # itself carries both. (Tarun, 2026-09-27.)
-    "apps",
-    "packaging",
     "backend",
     "compliance",
     "docker",
@@ -248,3 +265,28 @@ ALLOWED_ROOT_DIRS: frozenset[str] = (
 # deliberately tiny: this package installs into repositories whose shape it does
 # not know, and every entry here is a demand made of all of them.
 REQUIRED_ROOT_FILES: frozenset[str] = frozenset({"AGENTS.md"})
+
+
+# ── Per-repository declarations ───────────────────────────────────────────────
+
+
+def declared_root_names(declarations: Mapping[str, str], key: str) -> frozenset[str]:
+    """The names a repository declared under `key` — a comma-separated string.
+
+    Whitespace around a name is stripped and empty entries are dropped, so
+    `" a, ,b,"` is `{"a", "b"}`. An absent key is the empty set, never an error:
+    a repository that declares nothing is graded against the central set alone.
+    """
+    return frozenset(
+        name for name in (part.strip() for part in declarations.get(key, "").split(",")) if name
+    )
+
+
+def allowed_root_files(declarations: Mapping[str, str]) -> frozenset[str]:
+    """Root files permitted for THIS repository: the central set plus `root-files`."""
+    return ALLOWED_ROOT_FILES | declared_root_names(declarations, ROOT_FILES_DECLARATION)
+
+
+def allowed_root_dirs(declarations: Mapping[str, str]) -> frozenset[str]:
+    """Root directories permitted for THIS repository: the central set plus `root-dirs`."""
+    return ALLOWED_ROOT_DIRS | declared_root_names(declarations, ROOT_DIRS_DECLARATION)

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/runner.py

@@ -143,12 +143,20 @@ def applicable_files(
     exhaustive: bool,
     universe: Iterable[str] | None,
     trees: Mapping[str, str] | None,
+    restated: tuple[str, ...] | None = None,
 ) -> FileSet:
-    """Resolve one row's scope once, for both ordinary and batched execution."""
+    """Resolve one row's scope once, for both ordinary and batched execution.
+
+    `restated` is the raw scope a check built from the repository's declarations
+    (`Check.declared_scope`), replacing the row's own; it is expanded and has its
+    absent trees dropped exactly like the registry's, and it is graded whole.
+    """
+    raw_scope = row.engine.scope if restated is None else restated
+    whole_scope = check.whole_scope or restated is not None
     try:
         patterns = tuple(
             expand(pattern, trees)
-            for pattern in row.engine.scope
+            for pattern in raw_scope
             if not absent(pattern, trees)
         )
     except TreeMapError as exc:
@@ -166,7 +174,7 @@ def applicable_files(
             "a scope selecting nothing is could-not-run, never a clean pass"
         )
 
-    if not check.whole_scope or not narrowed:
+    if not whole_scope or not narrowed:
         return narrowed
     if universe is None:
         if not exhaustive:
@@ -292,6 +300,7 @@ def run(
     trees: Mapping[str, str] | None = None,
     declared_trees: Mapping[str, str] | None = None,
     batch_results: Mapping[str, BatchResult] | None = None,
+    committed_sizes: Mapping[str, int] | None = None,
 ) -> Verdict:
     """Grade one row.
 
@@ -303,6 +312,9 @@ def run(
     `universe` is the complete Git-visible tree supplied alongside a narrowed
     set for checks declaring `whole_scope`; without it, a triggered such check
     is could-not-run rather than counting a partial tree.
+    `committed_sizes` is path -> size of the blob Git stores, measured by the CLI
+    (the only caller of git) and carried into `Context` for a check that reads it;
+    a path absent from it has no committed fact and is graded by the worktree.
     """
     try:
         check_class = lookup(row.id)
@@ -310,6 +322,11 @@ def run(
         return could_not_run(row, f"no check implements {row.id}")
 
     try:
+        # A check may restate its scope from what the repository declares; the
+        # default answers `None` and the registry's scope stands. Asked here,
+        # inside the same guard, so a malformed declaration is the row's
+        # could-not-run verdict.
+        restated = check_class.declared_scope(row.engine.scope, declarations or {})
         narrowed = applicable_files(
             row,
             check_class,
@@ -317,11 +334,12 @@ def run(
             exhaustive=exhaustive,
             universe=universe,
             trees=trees,
+            restated=restated,
         )
     except CouldNotRun as exc:
         return could_not_run(row, str(exc))
 
-    if check_class.whole_scope and not narrowed:
+    if (check_class.whole_scope or restated is not None) and not narrowed:
         return decide(row, (), (), ())
 
     missing = [tool for tool in check_class.requires if shutil.which(tool) is None]
@@ -347,6 +365,7 @@ def run(
                 root=root, row=row,
                 inputs=resolve_inputs(check_class, root, inputs, stack, trees, declared_trees),
                 declarations=dict(declarations or {}),
+                committed_sizes=dict(committed_sizes or {}),
                 batch_reports=batch.reports if batch is not None else None,
                 batch_error=batch.error if batch is not None else None,
             )

package/packages/repo-controls/package.json

@@ -14,19 +14,12 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "test": "bun test tests --coverage --timeout 30000",
-    "check": "tsc --noEmit && bun test tests --coverage --timeout 30000",
-    "coverage:ratchet": "bun workflows/scripts/coverage/ci-ratchet.ts",
-    "coverage:produce": "bun test tests --coverage --timeout 30000 && bun workflows/scripts/coverage/command.ts"
+    "check": "tsc --noEmit && bun test tests --coverage --timeout 30000"
   },
   "dependencies": {
-    "@tailwindcss/node": "4.2.1",
-    "istanbul-lib-coverage": "3.2.2",
-    "svelte": "5.38.10",
-    "tailwindcss": "4.1.11",
     "typescript": "5.9.3"
   },
   "devDependencies": {
-    "@types/bun": "1.4.2",
-    "@types/istanbul-lib-coverage": "2.0.6"
+    "@types/bun": "1.4.2"
   }
 }

package/packages/repo-controls/scripts/hooks/post-merge

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Records the activity/deny log row, like every other bundled hook. The Git LFS
+# chaining for this hook (git-lfs installs a post-merge) runs in TypeScript, in
+# src/hook.ts's `runHook` via src/lfs.ts -- the credential environment git
+# handed the hook only exists there; see src/lfs.ts's header.
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+cd "$ROOT"
+
+# shellcheck source=lib/hook-log.sh
+. "$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/lib/hook-log.sh"
+hook_log_init post-merge "$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"

package/packages/repo-controls/scripts/hooks/pre-push

@@ -88,9 +88,9 @@ while IFS= read -r git_variable; do
   unset "$git_variable"
 done < <(git rev-parse --local-env-vars)
 
-# `just azdo-push` supplies its short-lived bearer header through Git's
-# command-scoped config environment. The parent Git process retains it for the
-# HTTPS push, but checks launched by this hook must never inherit it.
+# azdo-push injects no credential (git-ado is the one boundary), but a caller's
+# command-scoped Git config environment may still be set. The parent Git process
+# keeps it for the push; checks launched by this hook must never inherit it.
 if [[ "$git_config_count" =~ ^[0-9]+$ ]]; then
   for ((index = 0; index < git_config_count; index++)); do
     unset "GIT_CONFIG_KEY_${index}" "GIT_CONFIG_VALUE_${index}"