@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.30 → 0.1.32

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/package.json

@@ -0,0 +1 @@
+{}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.96.1"
+components = ["rustfmt", "clippy", "rust-analyzer", "llvm-tools-preview"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/src/main.rs

@@ -0,0 +1 @@
+fn main() {}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/test_check.py

@@ -5,9 +5,9 @@ test.sh builds its fixture inline (`mktemp`, `printf`, a `cp` of the real
 `backend/rust-toolchain.toml`, a real `cargo generate-lockfile --offline`) and
 asserts exactly two things:
 
-  1. the built fixture — a valid `backend/Cargo.toml`/`Cargo.lock` pair plus a
-     non-empty `frontend/bun.lock` — passes (`... | rg -F 'OK'`).
-  2. emptying `frontend/bun.lock` afterwards makes the gate fail.
+  1. the built fixture — a valid root `Cargo.toml`/`Cargo.lock` pair plus a
+     non-empty root `bun.lock` beside a `package.json` — passes (`... | rg -F 'OK'`).
+  2. emptying `bun.lock` afterwards makes the gate fail.
 
 Ported here as two COMMITTED fixture directories built the identical way (see
 `fixtures/clean/` and `fixtures/empty-bun-lock/`, and the git history of this
@@ -26,7 +26,6 @@ scenario test.sh does not have.
 from __future__ import annotations
 
 import shutil
-from pathlib import Path
 
 import pytest
 from helpers import corpus, corpus_files
@@ -34,7 +33,7 @@ from helpers import corpus, corpus_files
 from adl_compliance import runner
 from adl_compliance.checks.repository.lockfile_integrity import LockfileIntegrity
 from adl_compliance.core.verdict import Outcome
-from adl_compliance.policy.registry import effective_trees, load
+from adl_compliance.policy.registry import load
 
 FIXTURES = corpus("repository", "lockfile-integrity")
 ROW = load().by_id("REP-002")
@@ -66,46 +65,18 @@ def test_the_row_identifies_this_check() -> None:
 
 
 def test_clean_corpus_passes() -> None:
-    # test.sh: `bash "$gate" --root "$fixture" | rg -F 'OK'` — a real
-    # backend/Cargo.toml + Cargo.lock pair cargo itself generated, plus a
-    # non-empty frontend/bun.lock.
+    # test.sh: `bash "$gate" --root "$fixture" | rg -F 'OK'` on a cargo-generated root pair plus a root bun.lock.
     verdict = run("clean")
     assert verdict.outcome is Outcome.CLEAN, verdict.render()
     assert verdict.findings == ()
 
 
-def test_empty_frontend_lockfile_is_reported() -> None:
+def test_empty_bun_lockfile_is_reported() -> None:
     # test.sh: `: > "$fixture/frontend/bun.lock"` then asserts the gate fails.
     verdict = run("empty-bun-lock")
     assert verdict.outcome is Outcome.FINDINGS, verdict.render()
     assert len(verdict.findings) == 1
     finding = verdict.findings[0]
     assert finding.rule == "LCK-001"
-    assert finding.path == "frontend/bun.lock"
-    assert finding.message == "missing frontend/bun.lock"
-
-
-def test_a_redeclared_rust_tree_is_honoured(tmp_path: Path) -> None:
-    """The bug this pins: `WORKSPACE`/`CARGO_LOCK`/`CARGO_MANIFEST`/`BUN_LOCK`
-    used to be hardcoded `ClassVar`s (`"backend"`, `"backend/Cargo.lock"`,
-    `"backend/Cargo.toml"`, `"frontend/bun.lock"`) that bypassed tree
-    resolution entirely, unlike every other check's `inputs` mapping (K-42).
-
-    Measured for real on enact-vps-m5 (no `rust` tree at all — no Cargo.toml
-    anywhere in that checkout): once `<typescript>` scope matched a declared
-    workspace's `package.json`, this check still unconditionally reported
-    `LCK-001: missing backend/Cargo.lock` against a literal path that
-    repository never named and has no Rust code at. A repository that
-    declares `rust = "rust-workspace"` (and has no `backend/` at all) must be
-    graded against `rust-workspace/Cargo.lock`, never the packaged default.
-    """
-    trees = effective_trees({"rust": "rust-workspace", "typescript": "ts-workspace"})
-    # The subject here is an EMPTY tree: the lockfile is reported missing because
-    # nothing exists, so the empty corpus is opted into explicitly.
-    verdict = runner.run(ROW, tmp_path, corpus_files(tmp_path, allow_empty=True), trees=trees)
-    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
-    assert len(verdict.findings) == 1
-    finding = verdict.findings[0]
-    assert finding.rule == "LCK-001"
-    assert finding.path == "rust-workspace/Cargo.lock"
-    assert finding.message == "missing rust-workspace/Cargo.lock"
+    assert finding.path == "bun.lock"
+    assert finding.message == "missing bun.lock"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/test_declared_paths.py

@@ -7,13 +7,12 @@ and a lockfiles list together:
     bun-manifests / bun-lockfiles       `package.json` paths or globs / `bun.lock` paths
     cargo-manifests / cargo-lockfiles   `Cargo.toml` paths or globs  / `Cargo.lock` paths
 
-Why this exists, measured on enact-combined (2026-10-01): its `typescript` tree is
-a brace union of directories, and its manifests sit at the repository ROOT and
-under `apps/*/` and `packages/*/`. The registry scope `<typescript>/package.json`
-expands to `{apps,packages,...}/package.json`, a ONE-level path that matches
-nothing, so the whole-tree run was could-not-run while a narrowed run passed. The
-declaration restates the scope (which files select the gate) and the grade (which
-lockfiles must exist) from the same lists.
+Why this exists: a workspace keeps its manifests at the repository ROOT and under
+`apps/*/` and `packages/*/`. The registry scope is the four root file names, so a
+nested manifest is invisible to it unless the repository declares it. Since
+PBI 598 (Tarun, 2026-10-08) the declaration ADDS to the root pair: it extends the
+scope (which files select the gate) and the grade (which lockfiles must exist)
+from the same lists.
 
 This file is separate from `test_check.py` on purpose: that module carries a
 module-level cargo skip and an autouse patch of `runner.lookup`, and nothing in it
@@ -27,7 +26,6 @@ from collections.abc import Mapping
 from pathlib import Path
 
 import pytest
-from fixture_trees import fixture_trees
 from helpers import corpus, corpus_files
 
 from adl_compliance import runner
@@ -42,13 +40,9 @@ CLEAN_CORPUS = corpus("repository", "lockfile-integrity") / "clean"
 
 requires_cargo = pytest.mark.skipif(shutil.which("cargo") is None, reason="cargo is not installed")
 
-# enact-combined's declared trees, as `adl-config.toml` states them.
-ENACT_TREES = {
-    "rust": "",
-    "frontend": "",
-    "typescript": "{apps,packages,workflows,infra,tests,dev,live-probes}",
-}
-# The declaration enact-combined needs (see .scratchpad/rep002-scope/enact-combined-patch.toml).
+# No trees: REP-002 resolves none (PBI 598).
+NO_TREES: dict[str, str] = {}
+# The declaration a repository with nested workspaces writes.
 BUN = {
     "bun-manifests": "package.json,apps/*/package.json,packages/*/package.json",
     "bun-lockfiles": "bun.lock",
@@ -58,7 +52,7 @@ CARGO = {
     "cargo-lockfiles": "backend/Cargo.lock",
 }
 
-ENACT_FILES = {
+WORKSPACE_FILES = {
     "README.md": "# repo\n",
     "package.json": "{}\n",
     "bun.lock": "lock\n",
@@ -102,40 +96,38 @@ def grade(
     )
 
 
-# ------------------------------------------------------------ the enact-combined shape
+# ------------------------------------------------------------ the nested-workspace shape
 
 
-def test_undeclared_the_enact_shape_is_still_could_not_run_on_a_whole_tree(tmp_path: Path) -> None:
-    """The default is unchanged: no declaration, no new behaviour. This is the
-    verdict that was measured live, kept as the pin that declaring nothing does
-    not move it."""
-    files = write(tmp_path, ENACT_FILES)
-    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations={})
-    assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
-    assert "engine.scope matches no file on disk" in verdict.message
+def test_undeclared_nested_manifests_are_not_graded_on_a_whole_tree(tmp_path: Path) -> None:
+    """Declaring nothing grades the root pair alone; nested package.json files are not asked for a lockfile."""
+    files = write(tmp_path, WORKSPACE_FILES)
+    verdict = grade(tmp_path, files, trees=NO_TREES, declarations={})
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.units == 2  # package.json and bun.lock at the root
 
 
-def test_declared_the_enact_shape_is_clean_on_a_whole_tree(tmp_path: Path) -> None:
-    files = write(tmp_path, ENACT_FILES)
-    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations=BUN)
+def test_declared_the_nested_workspace_shape_is_clean_on_a_whole_tree(tmp_path: Path) -> None:
+    files = write(tmp_path, WORKSPACE_FILES)
+    verdict = grade(tmp_path, files, trees=NO_TREES, declarations=BUN)
     assert verdict.outcome is Outcome.CLEAN, verdict.render()
     assert verdict.units == IN_SCOPE
 
 
-def test_declared_the_enact_shape_is_clean_on_a_narrowed_run(tmp_path: Path) -> None:
+def test_declared_the_nested_workspace_shape_is_clean_on_a_narrowed_run(tmp_path: Path) -> None:
     """One changed manifest selects the gate, and the gate is graded over every
     declared path in the complete universe."""
-    files = write(tmp_path, ENACT_FILES)
+    files = write(tmp_path, WORKSPACE_FILES)
     verdict = grade(
-        tmp_path, files, trees=ENACT_TREES, declarations=BUN, given=("apps/web/package.json",)
+        tmp_path, files, trees=NO_TREES, declarations=BUN, given=("apps/web/package.json",)
     )
     assert verdict.outcome is Outcome.CLEAN, verdict.render()
     assert verdict.units == IN_SCOPE
 
 
 def test_declared_a_changed_lockfile_alone_selects_the_gate(tmp_path: Path) -> None:
-    files = write(tmp_path, ENACT_FILES)
-    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations=BUN, given=("bun.lock",))
+    files = write(tmp_path, WORKSPACE_FILES)
+    verdict = grade(tmp_path, files, trees=NO_TREES, declarations=BUN, given=("bun.lock",))
     assert verdict.outcome is Outcome.CLEAN, verdict.render()
     assert verdict.units == IN_SCOPE
 
@@ -145,26 +137,12 @@ def test_declared_a_change_outside_every_declared_path_does_not_select_the_gate(
 ) -> None:
     """Selection follows the declaration. With nothing declared changed, the gate
     does not apply: the missing lockfile below is not probed on this run."""
-    files = write(tmp_path, {**ENACT_FILES, "bun.lock": ""})
-    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations=BUN, given=("README.md",))
+    files = write(tmp_path, {**WORKSPACE_FILES, "bun.lock": ""})
+    verdict = grade(tmp_path, files, trees=NO_TREES, declarations=BUN, given=("README.md",))
     assert verdict.outcome is Outcome.CLEAN, verdict.render()
     assert verdict.findings == ()
 
 
-def test_declared_the_lockfile_input_is_not_consulted(tmp_path: Path) -> None:
-    """The declaration drives the grade: a per-gate `bun_lock` input pointing at
-    nothing cannot fail a repository whose declared lockfile is present."""
-    files = write(tmp_path, ENACT_FILES)
-    verdict = grade(
-        tmp_path,
-        files,
-        trees=ENACT_TREES,
-        declarations=BUN,
-        inputs={"REP-002": {"bun_lock": tmp_path / "nowhere" / "bun.lock"}},
-    )
-    assert verdict.outcome is Outcome.CLEAN, verdict.render()
-
-
 # ----------------------------------------------------------------- the lockfile grade
 
 
@@ -172,12 +150,12 @@ def test_declared_the_lockfile_input_is_not_consulted(tmp_path: Path) -> None:
 def test_declared_a_missing_or_empty_lockfile_is_the_same_finding(
     tmp_path: Path, body: str | None
 ) -> None:
-    files = dict(ENACT_FILES)
+    files = dict(WORKSPACE_FILES)
     if body is None:
         del files["bun.lock"]
     else:
         files["bun.lock"] = body
-    verdict = grade(tmp_path, write(tmp_path, files), trees=ENACT_TREES, declarations=BUN)
+    verdict = grade(tmp_path, write(tmp_path, files), trees=NO_TREES, declarations=BUN)
     assert verdict.outcome is Outcome.FINDINGS, verdict.render()
     [finding] = verdict.findings
     assert finding.rule == "LCK-001"
@@ -187,18 +165,12 @@ def test_declared_a_missing_or_empty_lockfile_is_the_same_finding(
 
 
 def test_declared_and_undeclared_report_a_missing_lockfile_identically(tmp_path: Path) -> None:
-    """Same corpus, graded once through the tree default and once through the
-    declaration (with the tree pointed elsewhere, so only the declaration can
-    reach the file): the finding is equal, field for field."""
-    files = write(tmp_path, {"frontend/package.json": "{}\n", "frontend/bun.lock": ""})
-    undeclared = grade(
-        tmp_path, files, trees={"rust": "", "typescript": "frontend"}, declarations={}
-    )
+    """The automatic root pair and an explicit declaration of the same files give equal findings."""
+    files = write(tmp_path, {"package.json": "{}\n", "bun.lock": ""})
+    undeclared = grade(tmp_path, files, trees=NO_TREES, declarations={})
     declared = grade(
-        tmp_path,
-        files,
-        trees={"rust": "", "typescript": "elsewhere"},
-        declarations={"bun-manifests": "frontend/package.json", "bun-lockfiles": "frontend/bun.lock"},
+        tmp_path, files, trees=NO_TREES,
+        declarations={"bun-manifests": "package.json", "bun-lockfiles": "bun.lock"},
     )
     assert undeclared.outcome is Outcome.FINDINGS, undeclared.render()
     assert declared.findings == undeclared.findings
@@ -206,40 +178,40 @@ def test_declared_and_undeclared_report_a_missing_lockfile_identically(tmp_path:
 
 def test_declared_two_present_lockfiles_are_clean(tmp_path: Path) -> None:
     declarations = {
-        "bun-manifests": "package.json,infra/docker/opencode-stack/package.json",
-        "bun-lockfiles": "bun.lock,infra/docker/opencode-stack/bun.lock",
+        "bun-manifests": "package.json,services/web/package.json",
+        "bun-lockfiles": "bun.lock,services/web/bun.lock",
     }
     both = {
-        **ENACT_FILES,
-        "infra/docker/opencode-stack/package.json": "{}\n",
-        "infra/docker/opencode-stack/bun.lock": "lock\n",
+        **WORKSPACE_FILES,
+        "services/web/package.json": "{}\n",
+        "services/web/bun.lock": "lock\n",
     }
-    verdict = grade(tmp_path, write(tmp_path, both), trees=ENACT_TREES, declarations=declarations)
+    verdict = grade(tmp_path, write(tmp_path, both), trees=NO_TREES, declarations=declarations)
     assert verdict.outcome is Outcome.CLEAN, verdict.render()
 
 
 def test_declared_the_second_lockfile_missing_is_reported_by_its_own_path(tmp_path: Path) -> None:
     declarations = {
-        "bun-manifests": "package.json,infra/docker/opencode-stack/package.json",
-        "bun-lockfiles": "bun.lock,infra/docker/opencode-stack/bun.lock",
+        "bun-manifests": "package.json,services/web/package.json",
+        "bun-lockfiles": "bun.lock,services/web/bun.lock",
     }
-    files = {**ENACT_FILES, "infra/docker/opencode-stack/package.json": "{}\n"}
-    verdict = grade(tmp_path, write(tmp_path, files), trees=ENACT_TREES, declarations=declarations)
+    files = {**WORKSPACE_FILES, "services/web/package.json": "{}\n"}
+    verdict = grade(tmp_path, write(tmp_path, files), trees=NO_TREES, declarations=declarations)
     [finding] = verdict.findings
-    assert finding.path == "infra/docker/opencode-stack/bun.lock"
-    assert finding.message == "missing infra/docker/opencode-stack/bun.lock"
-    assert "(cd infra/docker/opencode-stack && bun install)" in finding.fix
+    assert finding.path == "services/web/bun.lock"
+    assert finding.message == "missing services/web/bun.lock"
+    assert "(cd services/web && bun install)" in finding.fix
 
 
 def test_declared_both_lockfiles_missing_reports_only_the_first(tmp_path: Path) -> None:
     """check.sh's shape: the first problem ends the run."""
     declarations = {
-        "bun-manifests": "package.json,infra/docker/opencode-stack/package.json",
-        "bun-lockfiles": "bun.lock,infra/docker/opencode-stack/bun.lock",
+        "bun-manifests": "package.json,services/web/package.json",
+        "bun-lockfiles": "bun.lock,services/web/bun.lock",
     }
-    files = {k: v for k, v in ENACT_FILES.items() if k != "bun.lock"}
-    files["infra/docker/opencode-stack/package.json"] = "{}\n"
-    verdict = grade(tmp_path, write(tmp_path, files), trees=ENACT_TREES, declarations=declarations)
+    files = {k: v for k, v in WORKSPACE_FILES.items() if k != "bun.lock"}
+    files["services/web/package.json"] = "{}\n"
+    verdict = grade(tmp_path, write(tmp_path, files), trees=NO_TREES, declarations=declarations)
     assert [f.path for f in verdict.findings] == ["bun.lock"]
 
 
@@ -251,12 +223,12 @@ def test_declared_both_lockfiles_missing_reports_only_the_first(tmp_path: Path)
 def test_a_declared_manifest_matching_no_file_is_could_not_run_naming_it(
     tmp_path: Path, dead: str, narrowed: bool
 ) -> None:
-    files = write(tmp_path, ENACT_FILES)
+    files = write(tmp_path, WORKSPACE_FILES)
     declarations = {**BUN, "bun-manifests": f"package.json,{dead}"}
     verdict = grade(
         tmp_path,
         files,
-        trees=ENACT_TREES,
+        trees=NO_TREES,
         declarations=declarations,
         given=("package.json",) if narrowed else None,
     )
@@ -270,11 +242,11 @@ def test_a_dead_declaration_is_loud_even_though_other_declared_paths_match(
 ) -> None:
     """The scope is non-empty (the live entries match), so the runner's own
     empty-scope guard is silent; only the per-declaration check can see it."""
-    files = write(tmp_path, ENACT_FILES)
+    files = write(tmp_path, WORKSPACE_FILES)
     verdict = grade(
         tmp_path,
         files,
-        trees=ENACT_TREES,
+        trees=NO_TREES,
         declarations={**BUN, "bun-manifests": "package.json,services/*/package.json"},
     )
     assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
@@ -286,9 +258,9 @@ def test_the_check_itself_refuses_a_dead_declaration_given_a_complete_set(tmp_pa
     """Not only through the runner: a caller building a Context by hand gets the
     same refusal, because the check is what knows what it was told to scan."""
     ctx = Context(root=tmp_path, row=ROW, declarations=BUN | {"bun-manifests": "app/*/package.json"})
-    write(tmp_path, ENACT_FILES)
+    write(tmp_path, WORKSPACE_FILES)
     with pytest.raises(CouldNotRun) as raised:
-        tuple(LockfileIntegrity().run(ctx, FileSet(paths=tuple(sorted(ENACT_FILES)))))
+        tuple(LockfileIntegrity().run(ctx, FileSet(paths=tuple(sorted(WORKSPACE_FILES)))))
     assert "`bun-manifests`" in str(raised.value)
     assert "app/*/package.json" in str(raised.value)
 
@@ -317,7 +289,7 @@ MALFORMED = [
     pytest.param(bun("package.json, ,apps/*/package.json"), "bun-manifests", id="manifest blank entry"),
     pytest.param(bun("package.json,package.json"), "bun-manifests", id="manifest duplicate"),
     pytest.param(bun("!apps/web/package.json"), "bun-manifests", id="manifest negation"),
-    pytest.param(bun("<typescript>/package.json"), "bun-manifests", id="manifest placeholder"),
+    pytest.param(bun("<tree>/package.json"), "bun-manifests", id="manifest placeholder"),
     pytest.param(bun("apps/{web,x}/package.json"), "bun-manifests", id="manifest brace union"),
     pytest.param(bun("apps/web/README.md"), "bun-manifests", id="manifest wrong file name"),
     pytest.param(bun("apps/web/"), "bun-manifests", id="manifest directory"),
@@ -343,8 +315,8 @@ MALFORMED = [
 def test_a_malformed_declaration_is_could_not_run_naming_it(
     tmp_path: Path, declarations: dict[str, str], named: str
 ) -> None:
-    files = write(tmp_path, ENACT_FILES)
-    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations=declarations)
+    files = write(tmp_path, WORKSPACE_FILES)
+    verdict = grade(tmp_path, files, trees=NO_TREES, declarations=declarations)
     assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
     assert f"`{named}`" in verdict.message, verdict.message
 
@@ -353,7 +325,7 @@ def test_a_malformed_declaration_is_could_not_run_naming_it(
 def test_the_check_refuses_a_malformed_declaration_without_the_runner(
     tmp_path: Path, declarations: dict[str, str], named: str
 ) -> None:
-    files = write(tmp_path, ENACT_FILES)
+    files = write(tmp_path, WORKSPACE_FILES)
     ctx = Context(root=tmp_path, row=ROW, declarations=declarations)
     with pytest.raises(CouldNotRun) as raised:
         tuple(LockfileIntegrity().run(ctx, FileSet(paths=files)))
@@ -368,10 +340,12 @@ def test_an_absent_declaration_restates_nothing() -> None:
     assert LockfileIntegrity.declared_scope(ROW.engine.scope, {"license": "Proprietary"}) is None
 
 
-def test_a_declared_bun_half_replaces_only_the_typescript_entries() -> None:
+ROOT_SCOPE = ("Cargo.toml", "Cargo.lock", "package.json", "bun.lock")
+
+
+def test_a_declared_bun_half_adds_to_the_root_pairs() -> None:
     assert LockfileIntegrity.declared_scope(ROW.engine.scope, BUN) == (
-        "<rust>/Cargo.toml",
-        "<rust>/Cargo.lock",
+        *ROOT_SCOPE,
         "package.json",
         "apps/*/package.json",
         "packages/*/package.json",
@@ -379,17 +353,17 @@ def test_a_declared_bun_half_replaces_only_the_typescript_entries() -> None:
     )
 
 
-def test_a_declared_cargo_half_replaces_only_the_rust_entries() -> None:
+def test_a_declared_cargo_half_adds_to_the_root_pairs() -> None:
     assert LockfileIntegrity.declared_scope(ROW.engine.scope, CARGO) == (
-        "<typescript>/package.json",
-        "<typescript>/bun.lock",
+        *ROOT_SCOPE,
         "backend/Cargo.toml",
         "backend/Cargo.lock",
     )
 
 
-def test_both_halves_declared_leave_no_tree_default() -> None:
+def test_both_halves_declared_still_keep_the_root_pairs() -> None:
     assert LockfileIntegrity.declared_scope(ROW.engine.scope, {**BUN, **CARGO}) == (
+        *ROOT_SCOPE,
         "backend/Cargo.toml",
         "backend/Cargo.lock",
         "package.json",
@@ -399,14 +373,9 @@ def test_both_halves_declared_leave_no_tree_default() -> None:
     )
 
 
-def test_the_registry_scope_the_hook_replaces_is_two_entries_per_tree() -> None:
-    """The hook drops a declared half's defaults by their tree prefix, so a row
-    that grew an entry under a prefix would be dropped by a declaration without
-    anyone deciding it. This pins the shape the replacement relies on."""
-    scope = ROW.engine.scope
-    assert sorted(scope) == sorted(
-        ["<rust>/Cargo.toml", "<rust>/Cargo.lock", "<typescript>/package.json", "<typescript>/bun.lock"]
-    )
+def test_the_registry_scope_is_the_four_root_files() -> None:
+    """Root-literal names with no tree placeholder: the pairs graded automatically."""
+    assert tuple(ROW.engine.scope) == ROOT_SCOPE
 
 
 def test_both_registry_files_carry_the_same_text() -> None:
@@ -418,26 +387,25 @@ def test_both_registry_files_carry_the_same_text() -> None:
 
 
 @requires_cargo
-def test_declared_cargo_paths_are_graded_instead_of_the_rust_tree(tmp_path: Path) -> None:
-    shutil.copytree(CLEAN_CORPUS, tmp_path, dirs_exist_ok=True)
+def test_declared_cargo_paths_are_graded_and_undeclared_nested_ones_are_not(tmp_path: Path) -> None:
+    shutil.copytree(CLEAN_CORPUS, tmp_path / "backend")
     files = corpus_files(tmp_path)
-    trees = {**fixture_trees(), "rust": "somewhere-else"}
 
-    undeclared = grade(tmp_path, files, trees=trees, declarations={})
-    assert [f.path for f in undeclared.findings] == ["somewhere-else/Cargo.lock"]
+    undeclared = grade(tmp_path, files, trees=NO_TREES, declarations={})
+    assert undeclared.outcome is Outcome.CLEAN, undeclared.render()
 
-    declared = grade(tmp_path, files, trees=trees, declarations=CARGO)
+    declared = grade(tmp_path, files, trees=NO_TREES, declarations=CARGO)
     assert declared.outcome is Outcome.CLEAN, declared.render()
 
 
 @requires_cargo
 def test_declared_cargo_missing_lockfile_is_the_missing_finding(tmp_path: Path) -> None:
-    shutil.copytree(CLEAN_CORPUS, tmp_path, dirs_exist_ok=True)
+    shutil.copytree(CLEAN_CORPUS, tmp_path / "backend")
     (tmp_path / "backend" / "Cargo.lock").unlink()
     verdict = grade(
         tmp_path,
         corpus_files(tmp_path),
-        trees={**fixture_trees(), "rust": "somewhere-else"},
+        trees=NO_TREES,
         declarations=CARGO,
     )
     [finding] = verdict.findings
@@ -461,7 +429,7 @@ def test_declared_cargo_rejection_is_lck_002_against_the_lockfiles_own_directory
     """
     from adl_compliance.checks.repository.lockfile_integrity import check as module
 
-    write(tmp_path, {"nested/ws/Cargo.toml": "[package]\n", "nested/ws/Cargo.lock": "lock\n", "frontend/bun.lock": "lock\n"})
+    write(tmp_path, {"nested/ws/Cargo.toml": "[package]\n", "nested/ws/Cargo.lock": "lock\n"})
     calls: list[tuple[list[str], Path]] = []
 
     def fake_run(argv: list[str], *, cwd: Path, **_: object) -> object:
@@ -473,7 +441,7 @@ def test_declared_cargo_rejection_is_lck_002_against_the_lockfiles_own_directory
     verdict = grade(
         tmp_path,
         corpus_files(tmp_path),
-        trees=fixture_trees(),
+        trees=NO_TREES,
         declarations=cargo("nested/*/Cargo.toml", "nested/ws/Cargo.lock"),
     )
     [finding] = verdict.findings
@@ -489,35 +457,32 @@ def test_declared_cargo_rejection_is_lck_002_against_the_lockfiles_own_directory
 
 @requires_cargo
 def test_declared_cargo_workspace_is_the_lockfiles_directory(tmp_path: Path) -> None:
-    """A workspace nested where no tree points: cargo is driven from the lock's
-    own directory, so the rust-toolchain override beside it applies."""
-    shutil.copytree(CLEAN_CORPUS / "backend", tmp_path / "crates" / "ws")
-    write(tmp_path, {"frontend/bun.lock": "lock\n"})
+    """A nested workspace: cargo runs from the lock's directory, so its rust-toolchain override applies."""
+    shutil.copytree(CLEAN_CORPUS, tmp_path / "crates" / "ws")
     verdict = grade(
         tmp_path,
         corpus_files(tmp_path),
-        trees=fixture_trees(),
+        trees=NO_TREES,
         declarations=cargo("crates/*/Cargo.toml", "crates/ws/Cargo.lock"),
     )
     assert verdict.outcome is Outcome.CLEAN, verdict.render()
 
 
 @requires_cargo
-def test_an_undeclared_half_keeps_its_tree_defaults_beside_a_declared_one(tmp_path: Path) -> None:
-    """Bun declared, Cargo not: the Rust tree still supplies the Cargo half."""
+def test_the_root_cargo_pair_is_graded_beside_a_declared_bun_half(tmp_path: Path) -> None:
+    """Bun declared, Cargo not: the root Cargo pair is still graded automatically."""
     shutil.copytree(CLEAN_CORPUS, tmp_path, dirs_exist_ok=True)
-    write(tmp_path, ENACT_FILES)
+    write(tmp_path, WORKSPACE_FILES)
     files = corpus_files(tmp_path)
-    trees = {"rust": "backend", "typescript": ENACT_TREES["typescript"]}
 
-    clean = grade(tmp_path, files, trees=trees, declarations=BUN)
+    clean = grade(tmp_path, files, trees=NO_TREES, declarations=BUN)
     assert clean.outcome is Outcome.CLEAN, clean.render()
-    assert clean.units == IN_SCOPE + 2  # + backend/Cargo.toml and backend/Cargo.lock
+    assert clean.units == IN_SCOPE + 2  # + Cargo.toml and Cargo.lock at the root
 
     (tmp_path / "bun.lock").unlink()
-    broken = grade(tmp_path, corpus_files(tmp_path), trees=trees, declarations=BUN)
+    broken = grade(tmp_path, corpus_files(tmp_path), trees=NO_TREES, declarations=BUN)
     assert [f.path for f in broken.findings] == ["bun.lock"]
 
-    (tmp_path / "backend" / "Cargo.lock").unlink()
-    both = grade(tmp_path, corpus_files(tmp_path), trees=trees, declarations=BUN)
-    assert [f.path for f in both.findings] == ["backend/Cargo.lock"], "the Cargo half is reported first, as before"
+    (tmp_path / "Cargo.lock").unlink()
+    both = grade(tmp_path, corpus_files(tmp_path), trees=NO_TREES, declarations=BUN)
+    assert [f.path for f in both.findings] == ["Cargo.lock"], "the Cargo half is reported first, as before"