@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.30 → 0.1.32

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/banned_commands/test_check.py

@@ -1,4 +1,4 @@
-"""REP-004 — ported from `compliance_new/checks/repository/no-banned-commands/test.sh`.
+"""REP-004 and REP-006 — ported from `compliance_new/checks/repository/no-banned-commands/test.sh`.
 
 One corpus, nine files, one property apiece — see `fixtures/no-banned-commands/`.
 Two sets over it: the WHOLE corpus, handed straight to `graded()` (bypassing the
@@ -13,16 +13,19 @@ from __future__ import annotations
 import pathlib
 
 from adl_compliance import runner
-from adl_compliance.checks.repository.banned_commands import BannedCommands
+from adl_compliance.checks.repository.legacy_search import LegacySearch
+from adl_compliance.checks.repository.vcs_in_scripts import VcsInScripts
 from adl_compliance.core.context import Context, FileSet
+from adl_compliance.core.scripts import is_shell_script
 from adl_compliance.core.verdict import Outcome, decide
 from fixture_trees import fixture_trees
 from adl_compliance.policy.registry import load
 
 CORPUS = pathlib.Path(__file__).parent / "fixtures" / "no-banned-commands"
-ROW = load().by_id("REP-004")
+SEARCH_ROW = load().by_id("REP-004")
+VCS_ROW = load().by_id("REP-006")
 
-# The row's real scope is `<compliance>/**`. The fixture's own subdirectory is
+# The row's scope is repo-wide (PBI 599). The fixture's own subdirectory is
 # named to match whatever that resolves to TODAY (see the sibling directory on
 # disk) — resolved here rather than spelled, so a future remap fails this test
 # loudly (file not found) instead of silently narrowing to nothing.
@@ -42,76 +45,106 @@ WHOLE = (
 NARROWED = tuple(p for p in WHOLE if p.startswith(f"{COMPLIANCE}/"))
 
 
-def graded_directly(paths: tuple[str, ...]):
+def graded_directly(check, row, paths: tuple[str, ...]):
     """Bypasses row-scope narrowing entirely — the check's OWN filtering only.
     Mirrors the shell test's direct `check.sh` invocation, which is how it
     proved check.sh performs no location filtering of its own."""
-    ctx = Context(root=CORPUS, row=ROW)
-    findings = tuple(BannedCommands().graded(ctx, FileSet(paths=paths)))
-    return decide(ROW, findings, 0, ())
+    ctx = Context(root=CORPUS, row=row)
+    findings = tuple(check.graded(ctx, FileSet(paths=paths)))
+    return decide(row, findings, 0, ())
 
 
 def test_the_whole_set_is_graded_with_no_location_filtering() -> None:
-    """Both elsewhere/ files are in the set, so both must be reported —
-    including the pair a hand-rolled path filter inside check.py would have
-    suppressed."""
-    verdict = graded_directly(WHOLE)
-    assert verdict.outcome is Outcome.FINDINGS
-    paths = {f.path for f in verdict.findings}
-    assert "elsewhere/loose-git.sh" in paths
-    assert "elsewhere/loose-grep.sh" in paths
-    assert sum(f.rule == "GIT-001" for f in verdict.findings) == 2
-    assert sum(f.rule == "GRP-001" for f in verdict.findings) == 3
-
-
-def test_the_narrowed_set_excludes_elsewhere_by_scope_not_by_the_check() -> None:
-    """The row's real `<compliance>/**` scope, through `runner.run()` — what
-    production actually hands the check."""
-    verdict = runner.run(ROW, CORPUS, NARROWED)
-    assert verdict.outcome is Outcome.FINDINGS
-    paths = {f.path for f in verdict.findings}
-    assert "elsewhere/loose-git.sh" not in paths
-    assert "elsewhere/loose-grep.sh" not in paths
-    assert f"{COMPLIANCE}/checks/git-bad.sh" in paths
-    assert f"{COMPLIANCE}/checks/grep-bad.sh" in paths
-    assert f"{COMPLIANCE}/checks/grep-trailing.sh" in paths
+    """PBI 605: each gate reports only its own rule, including the pair a path filter in check.py would hide."""
+    vcs = graded_directly(VcsInScripts(), VCS_ROW, WHOLE)
+    assert vcs.outcome is Outcome.FINDINGS
+    assert {f.path for f in vcs.findings} >= {"elsewhere/loose-git.sh"}
+    assert "elsewhere/loose-grep.sh" not in {f.path for f in vcs.findings}
+    assert {f.rule for f in vcs.findings} == {"GIT-001"}
+    assert len(vcs.findings) == 2
+
+    search = graded_directly(LegacySearch(), SEARCH_ROW, WHOLE)
+    assert search.outcome is Outcome.FINDINGS
+    assert {f.path for f in search.findings} >= {"elsewhere/loose-grep.sh"}
+    assert "elsewhere/loose-git.sh" not in {f.path for f in search.findings}
+    assert {f.rule for f in search.findings} == {"GRP-001"}
+    assert len(search.findings) == 3
+
+
+def test_the_two_gates_are_distinct_rows_with_their_own_addresses() -> None:
+    """PBI 605: REP-004 is the legacy-search gate (GRP-001); REP-006 is the version-control gate (GIT-001)."""
+    registry = load()
+    assert registry.resolve("repository.no-legacy-search").id == "REP-004"
+    assert registry.resolve("repository.no-vcs-in-scripts").id == "REP-006"
+    assert LegacySearch.id == "REP-004" and LegacySearch.rule == "GRP-001"
+    assert VcsInScripts.id == "REP-006" and VcsInScripts.rule == "GIT-001"
+    assert "repository.no-banned-commands" not in {row.address for row in registry.rows}
+
+
+def test_the_two_rows_share_one_repo_wide_scope_but_for_the_managed_projections() -> None:
+    """REP-006 alone leaves the adl-managed projections out (see `test_scope.py`); the rest is shared."""
+    exempt = [entry for entry in VCS_ROW.engine.scope if entry not in SEARCH_ROW.engine.scope]
+    assert exempt and all(entry.startswith("!.") for entry in exempt)
+    assert [e for e in SEARCH_ROW.engine.scope if e not in VCS_ROW.engine.scope] == []
+
+
+def test_the_row_scope_is_repo_wide_so_files_outside_compliance_are_graded() -> None:
+    """PBI 599/601/605: the row is repo-wide, so the `elsewhere/` scripts are reported, one assertion set per gate."""
+    search = runner.run(SEARCH_ROW, CORPUS, WHOLE)
+    assert search.outcome is Outcome.FINDINGS
+    search_paths = {f.path for f in search.findings}
+    assert "elsewhere/loose-grep.sh" in search_paths
+    assert f"{COMPLIANCE}/checks/grep-bad.sh" in search_paths
+    assert f"{COMPLIANCE}/checks/grep-trailing.sh" in search_paths
+
+    vcs = runner.run(VCS_ROW, CORPUS, WHOLE)
+    assert vcs.outcome is Outcome.FINDINGS
+    vcs_paths = {f.path for f in vcs.findings}
+    assert "elsewhere/loose-git.sh" in vcs_paths
+    assert f"{COMPLIANCE}/checks/git-bad.sh" in vcs_paths
 
 
 def test_a_whole_line_comment_naming_the_word_is_not_a_violation() -> None:
-    verdict = runner.run(ROW, CORPUS, NARROWED)
-    paths = {f.path for f in verdict.findings}
+    paths = {f.path for f in runner.run(VCS_ROW, CORPUS, NARROWED).findings}
     assert f"{COMPLIANCE}/checks/git-note.sh" not in paths
+    paths = {f.path for f in runner.run(SEARCH_ROW, CORPUS, NARROWED).findings}
     assert f"{COMPLIANCE}/checks/grep-note.sh" not in paths
 
 
 def test_prose_and_a_clean_script_are_not_graded() -> None:
-    verdict = runner.run(ROW, CORPUS, NARROWED)
-    paths = {f.path for f in verdict.findings}
-    assert f"{COMPLIANCE}/checks/notes.md" not in paths
-    assert f"{COMPLIANCE}/checks/good.sh" not in paths
+    for row in (SEARCH_ROW, VCS_ROW):
+        paths = {f.path for f in runner.run(row, CORPUS, NARROWED).findings}
+        assert f"{COMPLIANCE}/checks/notes.md" not in paths
+        assert f"{COMPLIANCE}/checks/good.sh" not in paths
 
 
 def test_no_set_is_could_not_run() -> None:
-    verdict = runner.run(ROW, CORPUS, (), exhaustive=True)
-    assert verdict.outcome is Outcome.COULD_NOT_RUN
+    for row in (SEARCH_ROW, VCS_ROW):
+        verdict = runner.run(row, CORPUS, (), exhaustive=True)
+        assert verdict.outcome is Outcome.COULD_NOT_RUN
 
 
 def test_this_gate_does_not_report_itself() -> None:
     """A check that forbids a string necessarily contains it. Both words are
     assembled from fragments, so neither appears in the source as one token."""
-    source = pathlib.Path(__file__).parent / "check.py"
-    body = source.read_text(encoding="utf-8")
-    for entry in BannedCommands().banned():
-        assert entry.word not in body, f"{entry.word!r} appears literally in {source.name}"
+    here = pathlib.Path(__file__).parent
+    sources = (
+        here / "base.py",
+        here.parent / "legacy_search" / "check.py",
+        here.parent / "vcs_in_scripts" / "check.py",
+    )
+    for source in sources:
+        body = source.read_text(encoding="utf-8")
+        for check in (LegacySearch(), VcsInScripts()):
+            assert check.WORD not in body, f"{check.WORD!r} appears literally in {source.name}"
 
 
 def test_the_assembled_words_are_still_the_right_ones() -> None:
-    words = {entry.word for entry in BannedCommands().banned()}
-    assert words == {"g" + "it", "g" + "rep"}
+    assert VcsInScripts.WORD == "g" + "it"
+    assert LegacySearch.WORD == "g" + "rep"
 
 
 def test_a_justfile_is_graded_by_name_not_suffix() -> None:
-    check = BannedCommands()
-    assert check._is_shell("compliance/justfile")
-    assert check._is_shell("nested/dir/justfile")
-    assert not check._is_shell("compliance/justfile.md")
+    assert is_shell_script("compliance/justfile")
+    assert is_shell_script("nested/dir/justfile")
+    assert not is_shell_script("compliance/justfile.md")

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/banned_commands/test_scope.py

@@ -0,0 +1,71 @@
+"""REP-004 and REP-006 grade the shell scripts REP-007 selects; REP-006 leaves the managed `.workflows/` projection alone."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from adl_compliance import runner
+from adl_compliance.core.verdict import Outcome, Verdict
+from adl_compliance.policy.registry import load
+
+SEARCH = load().by_id("REP-004")
+VCS = load().by_id("REP-006")
+GIT_CALL = "gi" + "t status\n"
+GREP_CALL = "gr" + "ep -r x .\n"
+
+
+def grade(row, tmp_path: Path, files: dict[str, str]) -> Verdict:
+    for rel, body in files.items():
+        target = tmp_path / rel
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(body, encoding="utf-8")
+    return runner.run(row, tmp_path, tuple(sorted(files)), exhaustive=True)
+
+
+@pytest.mark.parametrize(
+    "name",
+    ["bin/tool", ".husky/pre-commit", "x.just", ".justfile", "Justfile", "bin/zsh-tool"],
+)
+def test_an_unsuffixed_or_alternately_named_script_is_graded(tmp_path: Path, name: str) -> None:
+    shebang = "#!/bin/zsh\n" if name.endswith("zsh-tool") else "#!/bin/sh\n"
+    body = "" if "just" in name.lower() else shebang
+    verdict = grade(VCS, tmp_path, {name: body + GIT_CALL})
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    assert [f.path for f in verdict.findings] == [name]
+
+
+def test_a_shebang_script_is_graded_by_rep_004_too(tmp_path: Path) -> None:
+    verdict = grade(SEARCH, tmp_path, {"bin/tool": "#!/usr/bin/env bash\n" + GREP_CALL})
+    assert [f.rule for f in verdict.findings] == ["GRP-001"]
+
+
+def test_a_non_shell_extensionless_file_is_not_graded(tmp_path: Path) -> None:
+    files = {"bin/py": "#!/usr/bin/env python3\n" + GIT_CALL, "bin/plain": GIT_CALL, "scripts/ok.sh": "echo hi\n"}
+    verdict = grade(VCS, tmp_path, files)
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+
+
+PROJECTIONS = (".workflows", ".agents", ".claude", ".codex", ".cursor", ".kimi-code", ".opencode")
+
+
+@pytest.mark.parametrize("root", PROJECTIONS)
+def test_the_vcs_gate_exempts_each_managed_projection(tmp_path: Path, root: str) -> None:
+    clean = grade(VCS, tmp_path / "a", {f"{root}/hooks/x.sh": GIT_CALL, "scripts/ok.sh": "echo hi\n"})
+    assert clean.outcome is Outcome.CLEAN, clean.render()
+    flagged = grade(VCS, tmp_path / "b", {"scripts/x.sh": GIT_CALL, f"{root}/hooks/x.sh": GIT_CALL})
+    assert [f.path for f in flagged.findings] == ["scripts/x.sh"]
+
+
+@pytest.mark.parametrize("root", PROJECTIONS)
+def test_the_legacy_search_gate_still_grades_each_managed_projection(tmp_path: Path, root: str) -> None:
+    verdict = grade(SEARCH, tmp_path, {f"{root}/hooks/x.sh": GREP_CALL})
+    assert [f.path for f in verdict.findings] == [f"{root}/hooks/x.sh"]
+
+
+@pytest.mark.parametrize("root", PROJECTIONS)
+def test_the_multiline_comment_gate_still_grades_each_managed_projection(tmp_path: Path, root: str) -> None:
+    row = load().by_id("REP-007")
+    verdict = grade(row, tmp_path, {f"{root}/hooks/x.sh": "# one\n# two\n"})
+    assert [f.path for f in verdict.findings] == [f"{root}/hooks/x.sh"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/legacy_search/__init__.py

@@ -0,0 +1,7 @@
+"""The `repository.no-legacy-search` gate (REP-004, GRP-001). Scanner: `..banned_commands.base`."""
+
+from __future__ import annotations
+
+from .check import LegacySearch
+
+__all__ = ["LegacySearch"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/legacy_search/check.py

@@ -0,0 +1,15 @@
+"""REP-004 (GRP-001) on the shared `banned_commands/base.py` scanner."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from ..banned_commands.base import BannedCommand
+
+
+class LegacySearch(BannedCommand):
+    id: ClassVar[str] = "REP-004"
+    rule: ClassVar[str] = "GRP-001"
+    WORD: ClassVar[str] = "gr" + "ep"
+    MESSAGE: ClassVar[str] = "standalone legacy search command is forbidden; use rg"
+    FIX: ClassVar[str] = "replace this invocation with an equivalent rg call"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/legacy_search/test_check.py

@@ -0,0 +1,32 @@
+"""REP-004 (GRP-001) reports its own rule and no other."""
+
+from __future__ import annotations
+
+import pathlib
+
+from adl_compliance import runner
+from adl_compliance.core.verdict import Outcome
+from adl_compliance.policy.registry import load
+
+CORPUS = (
+    pathlib.Path(__file__).parent.parent / "banned_commands" / "fixtures" / "no-banned-commands"
+)
+ROW = load().by_id("REP-004")
+
+
+def _whole() -> tuple[str, ...]:
+    return tuple(
+        sorted(p.relative_to(CORPUS).as_posix() for p in CORPUS.rglob("*") if p.is_file())
+    )
+
+
+def test_reports_only_its_own_rule() -> None:
+    verdict = runner.run(ROW, CORPUS, _whole())
+    assert verdict.outcome is Outcome.FINDINGS
+    assert {f.rule for f in verdict.findings} == {"GRP-001"}
+    assert len(verdict.findings) == 3
+    assert "loose-grep.sh" in {pathlib.PurePosixPath(f.path).name for f in verdict.findings}
+
+
+def test_is_addressable_by_its_registry_name() -> None:
+    assert load().resolve("repository.no-legacy-search").id == "REP-004"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/cargo_lock.py

@@ -67,7 +67,7 @@ specification that is neither a string nor a table, `workspace = true` with no
   * A path dependency that is NOT a workspace member (any path dependency of a manifest
     with no `[workspace]`, or one outside the workspace root) is judged by its own
     presence in the lock only; its own dependencies are not read, so a dependency added
-    to such a crate (enact-combined's `plugins/enact-keychain` is one) is not detected.
+    to such a crate (a repository's `plugins/keychain` crate is one) is not detected.
     Reading them would need that crate's own workspace for its `workspace = true`
     entries and cargo's feature rules for its optional ones (an optional dependency of a
     non-member is locked only when a feature activates it), and a wrong guess is a false

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/check.py

@@ -1,37 +1,23 @@
-"""REP-002 — backend/frontend lockfiles must exist and Cargo must accept the
-backend lock without updates.
+"""REP-002 — lockfiles must exist and Cargo must accept its lock without updates.
 
 Ported from `compliance_new/checks/repository/lockfile-integrity/check.sh`.
-Entirely `structural`: check.sh opens three FIXED, NAMED paths
-(`backend/Cargo.lock`, `frontend/bun.lock`, `backend/Cargo.toml`) and never
-consults the given file set — the row's `engine.scope` decides whether this
-gate runs at all, not which of these three paths it reads.
-
-**Fixed 2026-09-15: these three paths, plus the workspace directory, resolve
-through `inputs` now — `<rust>` and `<typescript>` placeholders, exactly like
-`coverage.backend-ratchet`'s `current`/`config` inputs — instead of the
-hardcoded `ClassVar` literals (`backend`, `backend/Cargo.lock`,
-`backend/Cargo.toml`, `frontend/bun.lock`) this check carried until then.**
-Those literals bypassed tree resolution entirely (K-42): measured for real on
-enact-vps-m5, which declares no `rust` tree (it has none — no Cargo.toml
-anywhere in that checkout), `engine.scope` correctly matched under a declared
-`<typescript>` workspace's `package.json`, and this check then unconditionally
-reported `LCK-001: missing backend/Cargo.lock` — a literal path that
-repository never named and has no Rust code at. A row whose `engine.scope` is
-a union of more than one tree (this one: `<rust>` OR `<typescript>`) can run
-because ONE tree's scope matched, while a check that then hardcodes the
-OTHER tree's default path grades a repository against a path it never
-declared. `<rust>` resolves to `backend` and `<typescript>` resolves to
-`frontend` in the packaged `policy/config.toml` — those are still the
-defaults, just reached through `ctx.inputs` now, the same as every other
-check that names a consumer path.
-
-A tree declared absent (`rust = ""` or `typescript = ""` in
-`[controls.compliance.trees]`) drops the inputs naming it, and each half of this
-row is then graded on its own: a repository declaring no Rust tree is graded on
-its TypeScript lockfile alone and is never asked for a `Cargo.lock`. With
-neither tree left the row is could-not-run (see `structural`) -- it used to raise
-`KeyError`.
+Entirely `structural`: it opens NAMED paths and never consults the given file
+set — the row's `engine.scope` decides whether this gate runs at all, not which
+paths it reads.
+
+**What it grades (Tarun, 2026-10-08, PBI 598).** The `rust` and `typescript`
+trees are deleted; this check no longer resolves any tree. It grades:
+
+  * the REPOSITORY-ROOT pairs, automatically: `Cargo.toml` -> `Cargo.lock` and
+    `package.json` -> `bun.lock`. A root manifest that is present requires its
+    lockfile; a root manifest that is absent requires nothing;
+  * every OTHER lockfile only when the repository declares it under
+    `[controls.compliance.lockfiles]` (see below). A nested manifest nobody
+    declared is not graded: the engine does not guess where a repository keeps
+    its workspaces.
+
+With neither a root manifest nor a declaration there is nothing to grade, and the
+row is clean (`empty_scope_is_clean`; Tarun, 2026-10-08).
 
 Retired 2026-10-01: `coverage.backend-ratchet` and `coverage.backend-crate`,
 named here as precedents, were deleted with the `coverage` domain
@@ -104,16 +90,11 @@ declared by its manifests list and its lockfiles list together:
   bun-manifests     / bun-lockfiles       `package.json` paths or globs / `bun.lock` paths
   cargo-manifests   / cargo-lockfiles     `Cargo.toml` paths or globs  / `Cargo.lock` paths
 
-Why: the registry scope is `<typescript>/package.json` and `<typescript>/bun.lock`
-(and the `<rust>` pair), a tree placeholder joined to a ONE-level file name.
-enact-combined's `typescript` tree is a brace union of directories and its
-manifests sit at the repository ROOT and under `apps/*/` and `packages/*/`, so on
-a whole-tree run `engine.scope` matched no file and the row was could-not-run
-(measured live: a narrowed run passed, the exhaustive run could not). The
-per-gate `bun_lock` input moved the grade and never the scope.
+Why: the registry scope is the four root file names, so a workspace that keeps
+its manifests under `apps/*/` or `packages/*/` is invisible to it. The declaration
+states those paths.
 
-A declared half REPLACES that half's tree defaults, in both places the paths are
-used:
+A declared half ADDS to the root pair, in both places the paths are used:
 
   * scope (`declared_scope`): which changed files select the gate, and, because a
     restated scope is graded whole, which files `graded` is handed;
@@ -127,8 +108,7 @@ at least one file of the complete in-scope set, or the row is could-not-run
 naming the declaration and the entry. A declared glob that matches nothing would
 otherwise shrink what the gate scans to nothing and say OK.
 
-An undeclared half is exactly what it was: tree defaults, the `inputs`, the same
-early-return shape. A malformed declaration (empty, absolute, backslash, `.`/`..`
+An undeclared half is exactly the root pair, with the same early-return shape. A malformed declaration (empty, absolute, backslash, `.`/`..`
 segments, placeholder or brace or negation syntax, duplicate, the wrong file
 name, a glob in a lockfile entry, or a half with only one of its two lists) is
 could-not-run naming the declaration; the engine never grades against a guess at
@@ -160,8 +140,8 @@ class Half(NamedTuple):
     """The `--declare` name carrying the literal lockfile paths."""
     manifest_name: str
     """The file name every manifest entry must end in."""
-    tree: str
-    """Prefix of the registry scope entries a declaration of this half replaces."""
+    lockfile_name: str
+    """The file name of this half's lockfile, beside the manifest at the root."""
 
 
 class Declared(NamedTuple):
@@ -172,22 +152,12 @@ class Declared(NamedTuple):
 class LockfileIntegrity(Check):
     id: ClassVar[str] = "REP-002"
 
-    CARGO: ClassVar[Half] = Half("cargo-manifests", "cargo-lockfiles", "Cargo.toml", "<rust>/")
-    BUN: ClassVar[Half] = Half("bun-manifests", "bun-lockfiles", "package.json", "<typescript>/")
+    CARGO: ClassVar[Half] = Half("cargo-manifests", "cargo-lockfiles", "Cargo.toml", "Cargo.lock")
+    BUN: ClassVar[Half] = Half("bun-manifests", "bun-lockfiles", "package.json", "bun.lock")
     # Cargo first, as the registry lists it and as `structural` grades it.
     HALVES: ClassVar[tuple[Half, ...]] = (CARGO, BUN)
 
-    inputs: ClassVar[dict[str, str]] = {
-        "workspace": "<rust>",
-        "cargo_lock": "<rust>/Cargo.lock",
-        "cargo_manifest": "<rust>/Cargo.toml",
-        "bun_lock": "<typescript>/bun.lock",
-    }
-    """Named, declared, and resolved through the SAME tree map every scope
-    pattern uses (K-42) — the fix for the hardcoded-literal bug this class's
-    docstring describes. A repository declaring `rust = "rust-workspace"` (or
-    no `rust` tree at all) is graded against that declaration, never the
-    packaged `backend`/`frontend` defaults baked into Python."""
+    empty_scope_is_clean: ClassVar[bool] = True
 
     MISSING: ClassVar[str] = "LCK-001"
     STALE: ClassVar[str] = "LCK-002"
@@ -281,12 +251,12 @@ class LockfileIntegrity(Check):
     def declared_scope(
         cls, scope: tuple[str, ...], declarations: Mapping[str, str]
     ) -> tuple[str, ...] | None:
-        """The registry scope with each declared half's tree defaults replaced.
+        """The registry scope (the root pairs) plus every declared manifest and lockfile.
 
-        A half's defaults are the registry entries under its tree prefix
-        (`<rust>/...`, `<typescript>/...`); `test_the_registry_scope_the_hook_
-        replaces_is_two_entries_per_tree` pins that shape. The other half, and
-        anything else the row lists, is kept as it was.
+        A declaration ADDS to the root pair: the root `Cargo.toml` and
+        `package.json` are graded whether or not a repository also declares other
+        workspaces. The scope is restated only when something is declared, and a
+        restated scope is graded whole (`Check.declared_scope`).
         """
         restated = scope
         any_declared = False
@@ -295,77 +265,39 @@ class LockfileIntegrity(Check):
             if declared is None:
                 continue
             any_declared = True
-            restated = (
-                *(pattern for pattern in restated if not pattern.startswith(half.tree)),
-                *declared.manifests,
-                *declared.lockfiles,
-            )
+            restated = (*restated, *declared.manifests, *declared.lockfiles)
         return restated if any_declared else None
 
     # ------------------------------------------------------------- structural
 
-    # The three inputs that all name the `<rust>` tree. They are resolved or
-    # dropped together, so seeing only some of them means a per-gate
-    # `--input REP-002:<name>=...` replaced part of the triple.
-    CARGO_INPUTS: ClassVar[tuple[str, ...]] = ("workspace", "cargo_lock", "cargo_manifest")
-
     def structural(self, ctx: Context) -> Iterable[Report]:
-        # Decision for a tree declared absent (`rust = ""` / `typescript = ""`,
-        # which drops every input naming the tree). Unlike an exclusion path, a
-        # lockfile IS what this row grades, so each half is judged on its own:
-        #
-        #   * a half whose tree is declared absent is not graded -- the owner
-        #     stated there is no such lockfile to require, which is the narrower,
-        #     honest verdict `resolve_inputs` documents ("grades a smaller scope");
-        #   * with NEITHER half left there is nothing to grade, and an empty set of
-        #     findings would read as a pass -- `CouldNotRun`, naming both inputs and
-        #     trees;
-        #   * a half-resolved Cargo triple is `CouldNotRun`, naming what is missing.
-        #
-        # This read `ctx.inputs["cargo_lock"]` and `["bun_lock"]` unguarded: a
-        # `KeyError` traceback (exit 1), not a verdict, whenever either tree was
-        # declared absent.
-        #
-        # A half the repository DECLARES (see the module docstring) is graded from
-        # its declaration and never from the tree or the inputs; the rules above
-        # apply to the halves it did not declare.
-        cargo_declared = self.declared(self.CARGO, ctx.declarations)
-        bun_declared = self.declared(self.BUN, ctx.declarations)
-
-        present_cargo = [name for name in self.CARGO_INPUTS if name in ctx.inputs]
-        if cargo_declared is None and present_cargo and len(present_cargo) != len(self.CARGO_INPUTS):
-            missing = [name for name in self.CARGO_INPUTS if name not in ctx.inputs]
-            raise CouldNotRun(
-                f"{self.id}: the Cargo inputs resolve together from <rust>, but only "
-                f"{present_cargo} are set; missing {missing} -- declare "
-                "[controls.compliance.trees].rust, or override all three"
-            )
-
         # (lockfile, cargo workspace, manifest) per Cargo lockfile to grade.
         cargo: list[tuple[Path, Path, Path]] = []
+        bun: list[Path] = []
+
+        # The repository-root pairs, graded because the root manifest is there.
+        root_manifest = ctx.path(self.CARGO.manifest_name)
+        if self.state(ctx, root_manifest) is not FileState.MISSING:
+            cargo.append((ctx.path(self.CARGO.lockfile_name), ctx.root, root_manifest))
+        if self.state(ctx, ctx.path(self.BUN.manifest_name)) is not FileState.MISSING:
+            bun.append(ctx.path(self.BUN.lockfile_name))
+
+        # Everything else comes only from the repository's own declaration.
+        cargo_declared = self.declared(self.CARGO, ctx.declarations)
         if cargo_declared is not None:
             for relative in cargo_declared.lockfiles:
                 lock = ctx.path(relative)
-                cargo.append((lock, lock.parent, lock.parent / "Cargo.toml"))
-        elif "cargo_lock" in ctx.inputs:
-            cargo.append(
-                (ctx.inputs["cargo_lock"], ctx.inputs["workspace"], ctx.inputs["cargo_manifest"])
-            )
-
-        bun: list[Path] = []
+                if all(lock != known for known, _, _ in cargo):
+                    cargo.append((lock, lock.parent, lock.parent / "Cargo.toml"))
+        bun_declared = self.declared(self.BUN, ctx.declarations)
         if bun_declared is not None:
-            bun = [ctx.path(relative) for relative in bun_declared.lockfiles]
-        elif "bun_lock" in ctx.inputs:
-            bun = [ctx.inputs["bun_lock"]]
+            for relative in bun_declared.lockfiles:
+                lock = ctx.path(relative)
+                if lock not in bun:
+                    bun.append(lock)
 
         if not cargo and not bun:
-            raise CouldNotRun(
-                f"{self.id}: no lockfile to grade -- `cargo_lock` (<rust>/Cargo.lock) and "
-                "`bun_lock` (<typescript>/bun.lock) are both absent because the trees "
-                "<rust> and <typescript> are both declared absent in "
-                "[controls.compliance.trees]; a row that grades nothing is could-not-run, "
-                "never a clean pass"
-            )
+            return
 
         for lock, workspace, _manifest in cargo:
             if self.state(ctx, lock) is not FileState.PRESENT:
@@ -382,18 +314,18 @@ class LockfileIntegrity(Check):
         for lock in bun:
             if self.state(ctx, lock) is not FileState.PRESENT:
                 shown = ctx.relative(lock)
-                typescript_dir = shown.rsplit("/", 1)[0] if "/" in shown else "."
+                bun_dir = shown.rsplit("/", 1)[0] if "/" in shown else "."
                 yield self.report(
                     shown,
                     f"missing {shown}",
-                    f"run: (cd {typescript_dir} && bun install) to generate the "
+                    f"run: (cd {bun_dir} && bun install) to generate the "
                     "lockfile and commit the result",
                     rule=self.MISSING,
                 )
                 return
 
         if not cargo:
-            # Rust declared absent: the TypeScript lockfile above was the whole row.
+            # No Cargo lockfile to grade: the Bun lockfiles above were the whole row.
             return
 
         if shutil.which("cargo") is None:

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/Cargo.lock

@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "fixture"
+version = "0.1.0"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/Cargo.toml

@@ -0,0 +1,4 @@
+[package]
+name = "fixture"
+version = "0.1.0"
+edition = "2021"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/bun.lock

@@ -0,0 +1 @@
+# fixture lock

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/package.json

@@ -0,0 +1 @@
+{}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.96.1"
+components = ["rustfmt", "clippy", "rust-analyzer", "llvm-tools-preview"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/src/main.rs

@@ -0,0 +1 @@
+fn main() {}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/Cargo.lock

@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "fixture"
+version = "0.1.0"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/Cargo.toml

@@ -0,0 +1,4 @@
+[package]
+name = "fixture"
+version = "0.1.0"
+edition = "2021"