@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.30 → 0.1.32

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/markdown_trees/check.py

@@ -3,8 +3,8 @@
   LAY-006  a Markdown file outside the declared docs trees and not on the
            exclusion list.
 
-The allowed roots are RESOLVED, not listed: `<docs>`, `<plans>`, `<compliance>`,
-`<rust>`, `<frontend>` and `<workflows>` come from
+The allowed roots are RESOLVED, not listed: `<docs>`, `<plans>`, `<compliance>`
+and `<workflows>` come from
 `[controls.compliance.trees]`, so a repository that spells a tree differently is
 graded against its own spelling. The only literals left are `*/LEDGER.md` (a
 register beside the tree it records) and the exclusion list below.
@@ -15,14 +15,6 @@ directory whose Markdown is site or application content rather than
 documentation. A declared root only ever WIDENS the allowlist, so declaring
 nothing is the stricter grade.
 
-This docstring used to read "docs/, .plans/, .specs/, or .changeset/" and three
-of those four were wrong. `.specs` was deleted 2026-09-16 as a path that matched
-nothing in this estate and never could; `.plans` became the resolvable `<plans>`
-when 7b8c057 renamed the tree; `.changeset/*.md` went the same way as `.specs`,
-for the same reason -- zero files across all four repositories. A rule's own
-description is the first thing anyone reads, and this one described the
-pre-migration world.
-
   LAY-006  a Markdown file outside the allowed docs trees and not on the
            exclusion list.
 
@@ -54,11 +46,11 @@ from ....policy.root_shape import (
     GOVERNANCE,
     GUIDES,
     REGISTERS,
-    ROOT_FILES_DECLARATION,
     declared_root_names,
 )
 from ....core.check import Check
 from ....core.context import Context, FileSet
+from ....core.declarations import declared_root_files
 from ....core.errors import CouldNotRun
 from ....core.finding import Report
 
@@ -83,16 +75,11 @@ class MarkdownTrees(Check):
         # Agent DEFINITIONS, same reasoning and same shape as the skill
         # definitions two lines up: `name`/`description`/`model`/`tools`
         # frontmatter, loaded by the runtime, not read as prose. Caught live
-        # against enact-extensions: `extensions/plugin-dev/agents/{agent-
+        # against the extensions repository: `extensions/plugin-dev/agents/{agent-
         # creator,plugin-validator,skill-reviewer}.md` were reported as
         # documentation outside the allowed docs trees. COVERAGE COST, stated
-        # not buried: 5 `agents/*.md` files across the four managed repos stop
-        # being graded by this check (enact-extensions 3, enact-m5 2 — the
-        # enact-m5 pair, `docs/architecture/agents/{mcp-servers,
-        # orchestration}.md`, are prose docs already reachable via `docs/*.md`
-        # in ALLOWED below, so this exclusion changes nothing about whether
-        # they are reported, only widens what would also excuse them if they
-        # ever moved outside `docs/`).
+        # not buried: `agents/*.md` files stop being graded by this check; prose
+        # docs among them are still reachable via `docs/*.md` in ALLOWED below.
         "agents/*", "*/agents/*",
         # Root governance and guides come from policy/root_shape.py, the single list
         # 63cd856 created when three gates were found carrying three drifting copies
@@ -104,14 +91,9 @@ class MarkdownTrees(Check):
         # `_excluded`.
         *sorted(GOVERNANCE | GUIDES | REGISTERS),
         "AGENTS.md", "CLAUDE.md", "CHANGELOG.md", "RELEASE.md",
-        "INVARIANTS.md", "README.md", "CLAUDE-INVARIANTS.md",
-        "INDEPENDENT-VERIFICATION.md",
+        "INVARIANTS.md", "README.md",
         "*/AGENTS.md", "*/CLAUDE.md", "*/SKILLS.md", "*/CHANGELOG.md",
         "*/README.md",
-        # A tree's CLAUDE-INVARIANTS.md is the same class of control artifact
-        # as its AGENTS.md and CLAUDE.md above; the root one is allowed two
-        # patterns up and nowhere else.
-        "*/CLAUDE-INVARIANTS.md",
     )
 
     # FIXED 2026-09-16 (K-42 sweep, LOUD form, approved): these five patterns
@@ -124,39 +106,19 @@ class MarkdownTrees(Check):
     # literal below its resolved root: named subject matter, not a resolvable
     # path.
     EXCLUDED_TEMPLATES: ClassVar[tuple[tuple[str, str], ...]] = (
-        ("frontend_root", ".claude/*"),
         ("workflows_root", "changesets/*"),
-        # Two patterns, not three — see check.sh's comment: the nested form
-        # needs its own line because the literal `tests/` anchors it, and
-        # `tests/fixture*/*` already covers the zero-directory case.
-        ("rust_root", "crates/*/tests/fixture*/*"),
-        ("rust_root", "crates/*/tests/*/fixture*/*"),
-        ("rust_root", "crates/enact-session/src/backend/codex_init_prompt.md"),
-        ("frontend_root", "examples/*"),
-        ("workflows_root", "COVERAGE.md"),
     )
 
     # Allowlisted Markdown roots.
     # `plans/`, not `.plans/`: 7b8c057 renamed the tree and `config.toml` now reads
     # `plans = "plans"`. This list did not follow, so every file in the tree the
     # registry points at was reported as being outside it -- 18 findings against
-    # enact-m5 alone. The dotted spelling stays alongside it because a repository
+    # a managed repository alone. The dotted spelling stays alongside it because a repository
     # that has not migrated yet is not thereby wrong.
     # FIXED 2026-09-16 (K-42 sweep, LOUD form, approved): `docs/*.md`/
-    # `docs/*.mdx`, `plans/*.md`, and `.specs/*.md` were also hardcoded
-    # literals -- the current packaged default for each tree, spelled out
-    # directly rather than resolved. `.plans/*.md` (legacy dotted spelling)
-    # and bare `specs/*.md` (no documented migration away from `.specs`)
-    # stay literal alternate-spelling allowances, exactly as before -- this
-    # fix only moves the entry that stood for "the packaged default",
-    # leaving the other spelling in each pair untouched.
+    # `docs/*.mdx` and `plans/*.md` were also hardcoded literals -- the packaged
+    # default for each tree, spelled out directly rather than resolved.
     ALLOWED: ClassVar[tuple[str, ...]] = (
-        # `specs/*.md` deleted 2026-09-16. It was copy-paste from the
-        # `plans/`/`.plans/` pair, which stood for a REAL rename. No repository
-        # in this estate has `specs/` or `.specs/`, and nothing records an
-        # undotted spelling as a rename target -- it matched nothing and never
-        # could. The resolvable `<specs>` spelling is handled with the other
-        # declared trees above.
         # A LEDGER beside the tree it records. `root_shape.REGISTERS` already
         # permits a register at the repository root "because that is where
         # someone arriving at the repository looks" -- a per-tree ledger is the
@@ -185,20 +147,11 @@ class MarkdownTrees(Check):
         "registers": "<compliance>",
         "docs_root": "<docs>",
         "plans_root": "<plans>",
-        "rust_root": "<rust>",
-        "frontend_root": "<frontend>",
         "workflows_root": "<workflows>",
     }
 
-    # `<specs>` only ever ADDS allowlist entries here. enact-m5 has no specs
-    # tree; requiring one would push the owner to declare a directory that does
-    # not exist, and a false declaration is undetectable. Absent -> stricter.
-    #
-    # This input is reachable only by a caller that builds a Context by hand (the
-    # unit tests do): `cli.py` routes global inputs to batch rows alone, so no
-    # `adl-config.toml` key ever reached `specs_root`. A repository's own extra
-    # Markdown roots arrive through the `markdown-roots` declaration below.
-    widening_inputs: ClassVar[frozenset[str]] = frozenset({"specs_root"})
+    # `registers` only ever ADDS allowlist entries (PBI 599); no ratchet means the fixed list alone.
+    widening_inputs: ClassVar[frozenset[str]] = frozenset({"registers"})
 
     # `[controls.compliance.markdown].roots` -- directories a repository declares
     # as homes for Markdown it authors outside every tree above, e.g. an Astro
@@ -251,9 +204,6 @@ class MarkdownTrees(Check):
         plans_root = ctx.inputs.get("plans_root")
         if plans_root is not None:
             allowed = (*allowed, f"{ctx.relative(plans_root)}/*.md")
-        specs_root = ctx.inputs.get("specs_root")
-        if specs_root is not None:
-            allowed = (*allowed, f"{ctx.relative(specs_root)}/*.md")
         # A declared root admits both suffixes this gate grades, like `docs_root`
         # -- admitting `.md` and reporting `.mdx` beside it would look like half
         # the declaration was ignored. Escaped: `_matches_any` is `fnmatchcase`, so
@@ -270,16 +220,12 @@ class MarkdownTrees(Check):
             root = ctx.inputs.get(input_name)
             if root is not None:
                 excluded = (*excluded, f"{ctx.relative(root)}/{suffix}")
-        # Root Markdown the repository declared under `[controls.compliance.root]
-        # files` (the `root-files` declaration). Matched EXACTLY: `_matches_any`
-        # is `fnmatchcase`, so a declared name carrying `*`, `?` or `[` must be
-        # escaped or it would exclude more than it names. A root name has no `/`,
-        # so a nested file of the same name is not the declared one.
+        # Root Markdown declared under `[controls.compliance.root] files`, matched exactly (no globs).
         declared = sorted(
-            name for name in declared_root_names(ctx.declarations, ROOT_FILES_DECLARATION)
+            name for name in declared_root_files(ctx.declarations)
             if "/" not in name and name.endswith(self.MARKDOWN_SUFFIXES)
         )
-        return (*excluded, *(glob.escape(name) for name in declared))
+        return (*excluded, *declared)
 
     def graded(self, ctx: Context, files: FileSet) -> Iterable[Report]:
         allowed = self._allowed(ctx)
@@ -295,13 +241,7 @@ class MarkdownTrees(Check):
             yield self.report(
                 relative,
                 "documentation file outside the allowed docs trees",
-                # The remedy names the trees THIS repository declared, resolved
-                # the same way the rule was graded. It used to read
-                # "docs/, plans/, .specs/, or .changeset/" -- two retired trees
-                # and a hardcoded literal -- so a reader following it moved the
-                # file somewhere no repository has, and the gate failed again.
-                # A fix line that cannot be followed is worse than none: it
-                # spends the reader's trust and returns nothing.
+                # The remedy names the trees THIS repository declared.
                 f"move {relative} under one of this repository's declared doc "
                 f"trees ({', '.join(declared) if declared else 'none declared'}), "
                 "or add it to the exclusion list in this gate if it is a "

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/markdown_trees/test_check.py

@@ -3,10 +3,10 @@
 Two corpora, committed byte-for-byte from the shell tree's fixtures:
 `markdown-trees-stray/` puts one Markdown page outside every allowed tree
 beside one that IS allowed, so the gate must report exactly the first;
-`markdown-trees-clean/` holds four files, each excluded or allowed for a
-DIFFERENT reason — an allowed tree, a second allowed tree, a control artifact
-(`backend/AGENTS.md`), and a crate test fixture — so that a gate reporting
-every `.md` it sees, or one exclusion family rotting silently, would fail it.
+`markdown-trees-clean/` holds two files, each allowed for a DIFFERENT reason —
+an allowed tree and a control artifact (`backend/AGENTS.md`) — so that a gate
+reporting every `.md` it sees would fail it. (The crate test fixture it used to
+hold was a consumer-layout exemption, deleted by PBI 598.)
 
 This check is not yet wired into `checks/__init__.py` (a later step wires this
 port's whole wave into the registry in one shot, to avoid concurrent edits to
@@ -40,7 +40,6 @@ CLEAN = FIXTURES / "markdown-trees-clean"
 
 STRAY_FILES = ("backend/notes.md", "docs/page.md")
 CLEAN_FILES = (
-    "backend/crates/enact-example/tests/fixtures/sample.md",
     "backend/AGENTS.md",
     "docs/page.md",
 )
@@ -54,9 +53,6 @@ def graded(root: pathlib.Path, given: tuple[str, ...]):
         inputs={
             "docs_root": root / "docs",
             "plans_root": root / "plans",
-            "specs_root": root / ".specs",
-            "rust_root": root / "backend",
-            "frontend_root": root / "frontend",
             "workflows_root": root / ".workflows",
         },
     )
@@ -91,13 +87,26 @@ def test_a_clean_corpus_of_allowed_and_excluded_paths_reports_nothing() -> None:
 
 
 def test_each_exclusion_family_is_independently_load_bearing() -> None:
-    """Without this, a corpus of nothing but allowed-tree files also passes
-    against a gate that reports every .md it is handed, and either exclusion
-    family (control artifact, crate test fixture) could rot unnoticed."""
+    """A corpus of only allowed-tree files must not pass a gate that reports every .md."""
     assert graded(CLEAN, ("backend/AGENTS.md",)).findings == ()
-    assert graded(
-        CLEAN, ("backend/crates/enact-example/tests/fixtures/sample.md",)
-    ).findings == ()
+
+
+def test_a_workflows_coverage_note_is_no_longer_excluded() -> None:
+    """Deliberate: the exemption named one consumer's file; the tree is graded like any other."""
+    verdict = graded(CLEAN, (".workflows/COVERAGE.md",))
+    assert [f.path for f in verdict.findings] == [".workflows/COVERAGE.md"]
+
+
+def test_former_rust_and_frontend_exclusions_are_gone() -> None:
+    """PBI 598: the crate-fixture, frontend and session-prompt exclusions are deleted with their trees."""
+    former = (
+        "backend/crates/x/tests/fixtures/sample.md",
+        "backend/crates/x/tests/a/fixture-b/sample.md",
+        "frontend/.claude/notes.md",
+        "frontend/examples/demo.md",
+    )
+    verdict = graded(CLEAN, former)
+    assert sorted(f.path for f in verdict.findings) == sorted(former), verdict.render()
 
 
 # ------------------------------------------- intersection, half one: the set
@@ -131,7 +140,7 @@ def test_a_register_in_the_declared_compliance_tree_is_allowed(tmp_path) -> None
     """A markdown register belongs beside the data it registers.
 
     `ALLOWED` is a fixed tuple, so before this the only homes for a `.md` file
-    were `docs/`, `plans/`, `specs/` and `.changeset/` — and a repository
+    were `docs/` and `plans/` — and a repository
     declaring `compliance = "compliance"` (the tree holding its own ratchets)
     could not put a register there without tripping this gate. The tree is the
     REPOSITORY's declaration; hardcoding `compliance/*.md` here would have been
@@ -186,8 +195,8 @@ def test_a_redeclared_estate_still_allows_and_excludes_the_resolved_entries(
 ) -> None:
     """The LOUD false-finding this check shipped with.
 
-    `docs/*.md`/`docs/*.mdx`, `plans/*.md`, `.specs/*.md` in ALLOWED, and the
-    `backend/...`/`frontend/...`/`.workflows/...` entries in EXCLUDED, were
+    `docs/*.md`/`docs/*.mdx` and `plans/*.md` in ALLOWED, and the
+    `.workflows/...` entries in EXCLUDED, were
     all hardcoded literals. A repository whose corresponding root is not the
     packaged default had a real, legitimately-admitted or -excluded file fail
     every one of those patterns and get reported "outside the allowed docs
@@ -199,21 +208,13 @@ def test_a_redeclared_estate_still_allows_and_excludes_the_resolved_entries(
     given = (
         "documentation/page.md",
         "roadmap/plan.md",
-        "specifications/note.md",
-        "webapp/.claude/notes.md",
         "automation/changesets/note.md",
-        "rustcode/crates/enact-example/tests/fixture-a/sample.md",
-        "webapp/examples/demo.md",
-        "automation/COVERAGE.md",
     )
     ctx = Context(
         root=tmp_path, row=ROW,
         inputs={
             "docs_root": tmp_path / "documentation",
             "plans_root": tmp_path / "roadmap",
-            "specs_root": tmp_path / "specifications",
-            "rust_root": tmp_path / "rustcode",
-            "frontend_root": tmp_path / "webapp",
             "workflows_root": tmp_path / "automation",
         },
     )
@@ -269,13 +270,11 @@ def test_a_declared_root_name_is_excluded_at_the_root_only(tmp_path) -> None:
     assert [f.path for f in verdict.findings] == ["backend/STATUS.md"], verdict.render()
 
 
-def test_a_declared_name_is_matched_literally_not_as_a_glob(tmp_path) -> None:
-    """`_matches_any` uses `fnmatchcase`, so a declared name carrying glob
-    characters must be escaped: `a[b].md` excludes that file and not `ab.md`."""
-    verdict = graded_declaring(tmp_path, {"root-files": "a[b].md"}, ("a[b].md", "ab.md"))
-    assert [f.path for f in verdict.findings] == ["ab.md"], verdict.render()
-    verdict = graded_declaring(tmp_path, {"root-files": "*.md"}, ("anything.md",))
-    assert [f.path for f in verdict.findings] == ["anything.md"], verdict.render()
+def test_a_declared_name_carrying_glob_characters_is_could_not_run(tmp_path) -> None:
+    """A glob in `root-files` is refused for every gate that reads it, not matched literally."""
+    for bad in ("a[b].md", "*.md"):
+        with pytest.raises(CouldNotRun, match="root-files"):
+            graded_declaring(tmp_path, {"root-files": bad}, ("a[b].md", "ab.md"))
 
 
 def test_a_root_dirs_declaration_does_not_exclude_a_root_markdown_file(tmp_path) -> None:
@@ -412,3 +411,7 @@ def test_a_malformed_declared_markdown_root_is_could_not_run_through_the_runner(
     )
     assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
     assert DECLARED_ROOTS in verdict.message
+
+
+def test_widening_inputs_name_only_declared_inputs() -> None:
+    assert set(MarkdownTrees.widening_inputs) <= set(MarkdownTrees.inputs)

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/placement/check.py

@@ -1,43 +1,26 @@
-"""LAY-008 — reject out-of-place STAGED files, by four independent rules.
+"""LAY-008 — reject stray artifacts: throwaway files and undeclared images.
 
-Ported from `compliance_new/checks/layout/placement/check.sh`, which grades
-the given set only (K-29..K-31): no walk, no git call, no self-location. The
-row is entirely `graded()` — every rule is answered by the path SHAPE of a
-member of the given set, never by probing a named path, so `structural()` has
-nothing to contribute.
+Ported from `compliance_new/checks/layout/placement/check.sh`, which graded the
+given set only: no walk, no git call, no self-location. The row is entirely
+`graded()` — the rule is answered by the path SHAPE of a member of the given
+set, so `structural()` has nothing to contribute.
 
-Four rules, evaluated independently per path (a single path can trip more than
-one):
+One rule, evaluated per path (Tarun, 2026-10-08, PBI 599/601). The shell script's
+other rules are deleted: the root allowlist duplicated LAY-012 (`root-closed-set`),
+and "`apps/` is retired" was one monorepo's history.
 
-  1. root allowlist    a file with no `/` must be on the allowlist of files
-                        legitimately committed at the repository root: the
-                        central set in `policy/root_shape.py` plus whatever the
-                        repository itself declares (`root-files`).
-  2. apps/ retired      any path under the retired `apps/` tree -- unless the
-                        repository declares `apps` among its root directories
-                        (`root-dirs`), which says `apps/` is live there.
-  3. stray artifacts    a throwaway extension (`.log`/`.tmp`/`.bak`/`.swp`,
-                         checked STRICTLY, everywhere) or a screenshot/image
-                         basename outside the enumerated asset directories.
-  4. md sprawl          a `.md` file inside `backend/` or `agent/`'s `src/`
-                         tree, except the two exempted files.
+  stray artifacts    a throwaway extension (`.log`/`.tmp`/`.bak`/`.swp`, checked
+                     STRICTLY, everywhere, asset directories included) or a
+                     screenshot/image basename outside the asset directories the
+                     REPOSITORY DECLARES.
 
-**One rule id for all four, and it does not match this row.** The shell
-`check.sh` hardcodes `RULE_ID=LAY-007` — but `LAY-007` is a DIFFERENT row
-(`layout.pipeline-templates`); this row's own id is `LAY-008`. That is exactly
-the "a check never spells its own id" defect `compliance_new/AGENTS.md`
-documents for `FRM-009`/`FRM-010` (both hardcoded a rule literal that had
-drifted from their row). It is reproduced here rather than silently
-corrected, because the port's job is the shell tree's ACTUAL behaviour —
-`test.sh` asserts findings prefixed `^LAY-007 ` — not the behaviour it should
-have had; the mismatch is called out in the porting notes instead.
+The declaration is `asset-dirs` (`--declare asset-dirs=a/b,c`, from
+`[controls.compliance.placement] asset_dirs`), a comma-separated list of
+repository-relative directories. An image anywhere under one is admitted; the
+registry names no consumer layout, so with no declaration every image is reported.
 
-The shell source's own comments and finding messages have a second, unrelated
-defect: substring-corrupted prose (`"legitimate"` reads `"leimate"`, the
-throwaway/screenshot messages read `"-artifact:"` with their lead word gone
-entirely). Message TEXT is not the rule the row grades, so this port writes
-clean prose rather than reproducing the corruption; the logic — which
-extensions, which prefixes, which exemptions — is carried over faithfully.
+**The rule id.** The shell `check.sh` hardcoded `RULE_ID=LAY-007`, a DIFFERENT
+row's id; this port reports under this row's own `LAY-008`.
 """
 
 from __future__ import annotations
@@ -48,174 +31,48 @@ from typing import ClassVar
 
 from ....core.check import Check
 from ....core.context import Context, FileSet
+from ....core.errors import CouldNotRun
 from ....core.finding import Report
-from ....policy.root_shape import (
-    ALLOWED_ROOT_FILES,
-    ROOT_DIRS_DECLARATION,
-    allowed_root_files,
-    declared_root_names,
-)
+from ....policy.root_shape import declared_root_names
 
 
 class Placement(Check):
     id: ClassVar[str] = "LAY-008"
-    # Matches check.sh's hardcoded RULE_ID exactly (see module docstring: this
-    # is the shell tree's real, if mismatched, behaviour — not a typo here).
-    # Was "LAY-007" — a copy-paste that printed every finding of this gate under
-    # the neighbouring gate's id, so a reader chasing a placement violation was
-    # sent to the pipeline-templates gate instead.
     rule: ClassVar[str] = "LAY-008"
 
-    # The shared root policy, not a fourth copy of it. This gate's own list had
-    # already drifted from LAY-012's: it still carried the shell script's typos
-    # `.attributes` and `.ignore`, which LAY-012 had long since corrected to
-    # `.gitattributes` and `.gitignore` — so the same file was permitted by one
-    # gate and reported by the other.
-    #
-    # This is the CENTRAL default only. What is actually graded is the effective
-    # set, `allowed_root_files(ctx.declarations)`: this plus the names the
-    # repository declares under `[controls.compliance.root] files`.
-    ROOT_ALLOWLIST: ClassVar[frozenset[str]] = ALLOWED_ROOT_FILES
+    # `[controls.compliance.placement] asset_dirs`, sent as `--declare asset-dirs=a,b`.
+    ASSET_DIRS_DECLARATION: ClassVar[str] = "asset-dirs"
 
     THROWAWAY_SUFFIXES: ClassVar[tuple[str, ...]] = (
         ".log", ".LOG", ".tmp", ".TMP", ".bak", ".BAK", ".swp", ".SWP",
     )
 
-    inputs: ClassVar[dict[str, str]] = {
-        "docs_root": "<docs>", "rust_root": "<rust>",
-        "frontend_root": "<frontend>",
-    }
-    """FIXED 2026-09-16 (K-42 sweep, approved): every `docs/...`/`backend/...`/
-    `.specs/...`/`frontend/...` entry below (ASSET_DIR_PREFIXES,
-    ASSET_EXACT_FILES, MD_SRC_EXEMPT, MD_SRC_TREES's `backend/`) was a
-    hardcoded literal. `_asset_exempt` is a LOUD shape -- a repository whose
-    root is not the packaged default had a real, legitimately-placed asset
-    fail the exemption and get reported "looks like a screenshot", a visible
-    wrong finding. `MD_SRC_TREES`/`MD_SRC_EXEMPT` are the opposite, SILENT
-    shape: a redeclared rust root meant `_md_sprawl`'s own `startswith` never
-    matched, so real `.md` sprawl under that tree went unreported entirely.
-    `agent/` (MD_SRC_TREES, MD_SRC_EXEMPT) stays literal -- there is no
-    `<agent>` tree in `policy/config.toml`. Every other suffix stays literal
-    below its resolved root: named subject matter, not a resolvable path."""
-
-    # Enumerated product asset directories — a screenshot/image basename is
-    # legitimate ONLY under one of these (a directory prefix) or as this one
-    # exact file. Checked ahead of the screenshot/image basename test, exactly
-    # as check.sh's nested `case "$f"` does before falling through to
-    # `case "$base"`.
-    ASSET_DIR_TEMPLATES: ClassVar[tuple[tuple[str, str], ...]] = (
-        ("docs_root", "assets/research/mobile-reference/"),
-        ("rust_root", "crates/enact-app/assets/builtin-assistants/avatars/"),
-        ("rust_root", "crates/enact-assets/assets/logos/"),
-        ("frontend_root", "mobile/assets/images/"),
-        ("frontend_root", "packages/desktop/src/renderer/assets/logos/"),
-        ("frontend_root", "packages/desktop/src/renderer/assets/themes/"),
-        ("frontend_root", "public/pwa/"),
-        ("frontend_root", "resources/"),
-    )
-    ASSET_EXACT_FILE_TEMPLATES: ClassVar[tuple[tuple[str, str], ...]] = (
-        ("frontend_root", "tests/e2e/helpers/screenshots.ts"),
-    )
-
     SCREENSHOT_PATTERN: ClassVar[re.Pattern[str]] = re.compile("screenshot", re.IGNORECASE)
     IMAGE_SUFFIXES: ClassVar[tuple[str, ...]] = (
         ".png", ".PNG", ".jpg", ".JPG", ".jpeg", ".JPEG",
     )
 
-    MD_SRC_EXEMPT_LITERAL: ClassVar[tuple[str, ...]] = (
-        "agent/crates/enact-providers/src/snapshots/README.md",
-    )
-    MD_SRC_EXEMPT_TEMPLATES: ClassVar[tuple[tuple[str, str], ...]] = (
-        ("rust_root", "crates/enact-session/src/backend/codex_init_prompt.md"),
-    )
-    MD_SRC_TREES_LITERAL: ClassVar[tuple[str, ...]] = ("agent/",)
-
-    def _asset_dir_prefixes(self, ctx: Context) -> tuple[str, ...]:
-        return tuple(
-            f"{ctx.relative(ctx.inputs[input_name])}/{suffix}"
-            for input_name, suffix in self.ASSET_DIR_TEMPLATES
-            if input_name in ctx.inputs  # a widening input: absent -> no entry
-        )
-
-    def _asset_exact_files(self, ctx: Context) -> tuple[str, ...]:
-        return tuple(
-            f"{ctx.relative(ctx.inputs[input_name])}/{suffix}"
-            for input_name, suffix in self.ASSET_EXACT_FILE_TEMPLATES
-            if input_name in ctx.inputs
-        )
-
-    def _md_src_exempt(self, ctx: Context) -> tuple[str, ...]:
-        return self.MD_SRC_EXEMPT_LITERAL + tuple(
-            f"{ctx.relative(ctx.inputs[input_name])}/{suffix}"
-            for input_name, suffix in self.MD_SRC_EXEMPT_TEMPLATES
-            if input_name in ctx.inputs
-        )
-
-    def _md_src_trees(self, ctx: Context) -> tuple[str, ...]:
-        # Decision for a tree declared absent (`rust = ""`, which drops
-        # `rust_root` from the resolved inputs): the rust root only contributes
-        # an extra PREFIX to the trees whose `src/` Markdown is reported, so a
-        # repository with no Rust tree has nothing under it to report and
-        # contributes nothing. The literal `agent/` tree still governs. This read
-        # `ctx.inputs['rust_root']` unguarded -- a `KeyError` traceback (exit 1),
-        # not a verdict, on any `.md` path.
-        rust_root = ctx.inputs.get("rust_root")
-        if rust_root is None:
-            return self.MD_SRC_TREES_LITERAL
-        return self.MD_SRC_TREES_LITERAL + (f"{ctx.relative(rust_root)}/",)
-
     def graded(self, ctx: Context, files: FileSet) -> Iterable[Report]:
-        # `LC_ALL=C sort` in the shell is a byte-order sort; Python's default
-        # string ordering matches it for the ASCII repository-relative paths
-        # this row ever sees.
+        asset_dirs = self._asset_dirs(ctx)
         for relative in sorted(files):
-            yield from self._root_allowlist(ctx, relative)
-            yield from self._apps_retired(ctx, relative)
-            yield from self._stray_artifact(ctx, relative)
-            yield from self._md_sprawl(ctx, relative)
-
-    # -- Rule 1: root-level allowlist ---------------------------------------
-
-    def _root_allowlist(self, ctx: Context, relative: str) -> Iterable[Report]:
-        if "/" in relative:
-            return
-        if relative in allowed_root_files(ctx.declarations):
-            return
-        # The allowlist is ~60 entries. Printing all of them per finding buries
-        # the one fact the line is reporting, and five findings produced three
-        # hundred lines of identical noise.
-        yield self.report(
-            relative,
-            f"root: '{relative}' is not on the root allowlist",
-            f"move '{relative}' into an owning subdirectory, or declare it under "
-            "[controls.compliance.root] files in this repository's adl-config.toml "
-            "if it genuinely belongs at the root",
-        )
-
-    # -- Rule 2 (numbered 4 in check.sh): apps/ is retired ------------------
-
-    def _apps_retired(self, ctx: Context, relative: str) -> Iterable[Report]:
-        # A repository that declares `apps` as a root directory has said `apps/`
-        # is live there; "apps is retired" would contradict its own declaration.
-        if "apps" in declared_root_names(ctx.declarations, ROOT_DIRS_DECLARATION):
-            return
-        if relative.startswith("apps/"):
-            yield self.report(
-                relative,
-                f"apps-retired: '{relative}' is staged under retired apps/; "
-                "use the owning current tree",
-                f"move '{relative}' into frontend/ (or the current owning tree) "
-                "and remove it from apps/",
-            )
-
-    # -- Rule 3 (numbered 2 in check.sh): stray test/ artifacts -------------
-
-    def _stray_artifact(self, ctx: Context, relative: str) -> Iterable[Report]:
-        # check.sh's `case "$f" in /*) ;; *) ... esac` skips this whole rule
-        # for a path beginning with a literal `/`. The given set is always
-        # repository-relative (never absolute), so this arm is inert in
-        # practice — carried over rather than dropped, since it is what the
-        # shell source actually branches on.
+            yield from self._stray_artifact(relative, asset_dirs)
+
+    def _asset_dirs(self, ctx: Context) -> tuple[str, ...]:
+        """The directories the repository declared as homes for images; malformed ones are could-not-run."""
+        dirs: list[str] = []
+        for name in sorted(declared_root_names(ctx.declarations, self.ASSET_DIRS_DECLARATION)):
+            directory = name.rstrip("/")
+            if name.startswith("/") or any(part in ("", ".", "..") for part in directory.split("/")):
+                raise CouldNotRun(
+                    f"{self.id}: `{self.ASSET_DIRS_DECLARATION}` declares {name!r}, which is not "
+                    "a repository-relative directory; fix [controls.compliance.placement] "
+                    "asset_dirs in adl-config.toml"
+                )
+            dirs.append(directory)
+        return tuple(dirs)
+
+    def _stray_artifact(self, relative: str, asset_dirs: tuple[str, ...]) -> Iterable[Report]:
+        # check.sh skipped a leading `/`; inert here (paths are repo-relative), kept from the shell source.
         if relative.startswith("/"):
             return
 
@@ -231,38 +88,14 @@ class Placement(Check):
             )
             return
 
-        if self._asset_exempt(ctx, relative):
+        if any(relative.startswith(f"{directory}/") for directory in asset_dirs):
             return
 
         if self.SCREENSHOT_PATTERN.search(base) or base.endswith(self.IMAGE_SUFFIXES):
             yield self.report(
                 relative,
-                f"'{relative}' looks like a screenshot — belongs in "
-                ".gitignore, not committed",
-                f"move '{relative}' under a gitignored path or into one of "
-                "the enumerated asset directories, then unstage it from the commit",
+                f"'{relative}' looks like a screenshot or image outside the declared "
+                "asset directories — belongs in .gitignore or an asset directory",
+                f"move '{relative}' under a gitignored path, or declare its directory under "
+                "[controls.compliance.placement] asset_dirs in this repository's adl-config.toml",
             )
-
-    def _asset_exempt(self, ctx: Context, relative: str) -> bool:
-        if relative in self._asset_exact_files(ctx):
-            return True
-        return any(relative.startswith(prefix) for prefix in self._asset_dir_prefixes(ctx))
-
-    # -- Rule 4 (numbered 3 in check.sh): .md sprawl into backend//agent/ src/ --
-
-    def _md_sprawl(self, ctx: Context, relative: str) -> Iterable[Report]:
-        if not relative.endswith(".md"):
-            return
-        if relative in self._md_src_exempt(ctx):
-            return
-        if not relative.startswith(self._md_src_trees(ctx)):
-            return
-        if "/src/" not in relative:
-            return
-        yield self.report(
-            relative,
-            f"md-sprawl: '{relative}' is a markdown file inside a src/ tree "
-            "— narrative docs belong in docs/ or plans/",
-            f"move '{relative}' into docs/ or plans/, or add it to check.py's "
-            "src/ Markdown exemption list if it must stay",
-        )

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/layout/placement/fixtures/placement-allowed/README.md

@@ -0,0 +1 @@
+# allowed