@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.4

package/packages/repo-controls/scripts/hooks/commit-msg

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Enforce the conventional commit subject contract.
+set -euo pipefail
+
+ALLOWED_TYPES='feat|fix|docs|refactor|perf|chore|release'
+ALLOWED_TYPES_DISPLAY="${ALLOWED_TYPES//|/, }"
+FORMAT_RE="^(${ALLOWED_TYPES})"'(\([a-z0-9][a-z0-9-]*\))?: .+'
+TYPE_RE='^([A-Za-z0-9]+)(\(|:)'
+ALLOWED_TYPE_RE="^(${ALLOWED_TYPES})$"
+SCOPE_RE='^[A-Za-z0-9]+\(([^)]*)\)'
+
+message_file="${1:?commit message file is required}"
+subject="$(head -n 1 "$message_file")"
+
+# shellcheck source=lib/hook-log.sh
+. "$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/lib/hook-log.sh"
+hook_log_init commit-msg "$subject"
+
+# Git-generated merge/revert messages and maintainer version bumps are exempt.
+if [[ "$subject" == Merge\ * || "$subject" == Revert\ \"* || "$subject" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  exit 0
+fi
+
+reject() {
+  # Record the actual reason, not just a non-zero exit: "what keeps failing?"
+  # is only answerable if the row names the rule that fired. No separate
+  # message: `decision` (below, via hook_log_write's first argument) already
+  # names commit-msg exactly — the CSV format's old third column hardcoded
+  # the literal string 'commit-msg' here, redundant with the common JSON
+  # format's own `event` field (Tarun, 2026-09-27, §5a hard cut).
+  hook_log_write "FAIL — $1" "$subject" ''
+  echo "commit-msg: FAIL — $1" >&2
+  echo "  Subject: ${subject}" >&2
+  if [[ "${2:-}" == format ]]; then
+    echo "  Allowed types: ${ALLOWED_TYPES_DISPLAY}" >&2
+    echo '  Format: <type>(<scope>): <subject>  (scope optional)' >&2
+  fi
+  exit 1
+}
+
+if [[ ! "$subject" =~ $FORMAT_RE ]]; then
+  if [[ "$subject" =~ $TYPE_RE ]]; then
+    parsed_type="${BASH_REMATCH[1]}"
+    if [[ ! "$parsed_type" =~ $ALLOWED_TYPE_RE ]]; then
+      reject "type '${parsed_type}' is not allowed" format
+    fi
+    if [[ "$subject" =~ $SCOPE_RE ]]; then
+      reject "scope '${BASH_REMATCH[1]}' must be lowercase kebab-case" format
+    fi
+  fi
+  reject 'subject does not match <type>(<scope>): <subject>' format
+fi
+
+if ((${#subject} > 80)); then
+  reject "subject is ${#subject} characters; max is 80"
+fi
+
+description="${subject#*: }"
+if [[ "$description" != "${description,,}" || "$description" == *. ]]; then
+  reject 'subject must be lowercase and have no trailing period'
+fi
+
+exit 0

package/packages/repo-controls/scripts/hooks/lib/hook-log.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Record one row per git-hook invocation, via the shared `.adl/logs/`
+# JSON-Lines writer every adl tool uses (agent-hooks' `writeLogEntry`,
+# docs/architecture/cli-design.md §5a) — a bash script cannot import that writer directly,
+# so this hands the row to `adl repo controls log` (`src/cli.ts` ->
+# `src/hook-log.ts`), the same `adl` command every hook already requires on
+# PATH to run at all (see install.ts's `stubText`; adl-m3-finish item 1,
+# 2026-09-27 — `adl-repo-controls` is retired, no compat shim).
+#
+# BEHAVIOUR CHANGE (Tarun, 2026-09-27, §5a): this used to `printf` CSV rows
+# straight into `.enact/logs/adl-repo-controls-{activity,deny}.log`. That is a
+# hard cut: nothing here writes to `.enact/logs/` any more, and whatever rows
+# are already there are left in place, never migrated (see
+# `install.ts`'s `LEGACY_LOG_QUARANTINES`).
+#
+# The activity row is every invocation, passed or failed; the deny row is
+# only a FAIL. Until the original CSV log existed the git hooks recorded
+# nothing, which left two separate questions unanswerable. "What keeps
+# failing?" — a handful of distinct causes, each hit once, reads as constant
+# failure when you only ever see the latest in the terminal. And "did the
+# gate run at all?" — a checkout with no core.hooksPath is silent in exactly
+# the same way as a clean pass.
+#
+# Logging must never change a hook's outcome: the CLI call is best-effort and
+# the EXIT trap preserves and re-returns the original status.
+
+HOOK_LOG_NAME=""
+HOOK_LOG_CONTEXT=""
+HOOK_LOG_DONE=""
+
+# hook_log_write <reason> <command> <message>
+#
+# <reason> is PASS, "FAIL exit=<n>", or — when a hook calls this directly,
+# as commit-msg's `reject()` does — the hook's own specific "FAIL — <why>".
+# That specific reason is why this exists at all: the TS wrapper that runs
+# this script (`hook.ts`'s `runHook`, via `runBundled`) does so with stdio
+# `'inherit'`, so it can never see what a hook prints to the terminal.
+hook_log_write() {
+  local reason="$1" command="$2" message="$3"
+  HOOK_LOG_DONE=1
+  command -v adl >/dev/null 2>&1 || return 0
+  adl repo controls log "$HOOK_LOG_NAME" "$reason" "${command:0:2000}" "${message:0:2000}" >/dev/null 2>&1 || true
+}
+
+hook_log_on_exit() {
+  local status=$?
+  if [[ -z "$HOOK_LOG_DONE" ]]; then
+    if ((status == 0)); then
+      hook_log_write 'PASS' "$HOOK_LOG_CONTEXT" ''
+    else
+      hook_log_write "FAIL exit=${status}" "$HOOK_LOG_CONTEXT" 'reason printed to the terminal by the hook'
+    fi
+  fi
+  return "$status"
+}
+
+# hook_log_init <hook-name> [context]
+hook_log_init() {
+  HOOK_LOG_NAME="$1"
+  HOOK_LOG_CONTEXT="${2:-}"
+  trap hook_log_on_exit EXIT
+}

package/packages/repo-controls/scripts/hooks/post-checkout

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# The worktree-count backstop itself runs in TypeScript, BEFORE this script —
+# see ../../src/worktree-guard.ts and ../../src/hook.ts's `runHook`. By the
+# time this bundled script runs, either the checkout was not a `git worktree
+# add` at all, or it already survived (or was removed by) that check. This
+# script only records the activity/deny log, the same as every other bundled
+# hook.
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+cd "$ROOT"
+
+# shellcheck source=lib/hook-log.sh
+. "$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/lib/hook-log.sh"
+hook_log_init post-checkout "$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo HEAD)"

package/packages/repo-controls/scripts/hooks/post-commit

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Release deferred summary publish lock, then clear dangling/regressing summary MM.
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+cd "$ROOT"
+# The package's scripts/ directory. These hooks live at scripts/hooks/ now,
+# one level shallower than the old scripts/verbatim/workflows/hooks/.
+HOOK_REPO_ROOT="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"
+
+# shellcheck source=lib/hook-log.sh
+. "$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/lib/hook-log.sh"
+hook_log_init post-commit "$(git rev-parse --abbrev-ref HEAD 2>/dev/null)"
+
+# Coverage lock release and summary sanitising used to run here, through the
+# package's copy of the consumer's coverage code. Both are PRODUCTION concerns:
+# they serialise a measurement and tidy its output, so they belong to whoever
+# produces the summary. This package keeps the ratchet and nothing else.

package/packages/repo-controls/scripts/hooks/pre-commit

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Fast staged-file policy: .scratchpad paths/references, whitespace,
+# and changed-file coverage. Exact proofs are reused; the full suite never runs.
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+cd "$ROOT"
+# The package's scripts/ directory. These hooks live at scripts/hooks/ now,
+# one level shallower than the old scripts/verbatim/workflows/hooks/.
+HOOK_REPO_ROOT="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"
+
+# shellcheck source=lib/hook-log.sh
+. "$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/lib/hook-log.sh"
+hook_log_init pre-commit "$(git rev-parse --abbrev-ref HEAD 2>/dev/null)"
+
+scratchpad_allowlisted() {
+  case "$1" in
+    # `.workflows/hooks/pre-commit` is where this file is DEPLOYED in a consumer;
+    # `scripts/hooks/pre-commit` is where it LIVES in adl-repo-controls. Both
+    # are this same policy naming the thing it polices, which is what this
+    # allowlist is for.
+    .gitignore | .dockerignore | AGENTS.md | .workflows/hooks/pre-commit | scripts/hooks/pre-commit | src/integrity.ts | workflows/scripts/tests/hooks/*) return 0 ;;
+  esac
+  return 1
+}
+
+staged_files=()
+scratchpad_paths=()
+while IFS= read -r -d '' file; do
+  staged_files+=("$file")
+  case "$file" in
+    .scratchpad | .scratchpad/*) scratchpad_paths+=("$file") ;;
+  esac
+done < <(git diff --cached --name-only --diff-filter=ACMR -z)
+
+if ((${#scratchpad_paths[@]} > 0)); then
+  echo 'pre-commit: FAIL — .scratchpad files cannot be committed.' >&2
+  echo '  Staged .scratchpad path(s):' >&2
+  printf '    - %s\n' "${scratchpad_paths[@]}" >&2
+  exit 1
+fi
+
+offenders=()
+for file in "${staged_files[@]}"; do
+  scratchpad_allowlisted "$file" && continue
+  if git diff --cached -- "$file" | grep '^+' | grep -v '^+++' | grep -Fq '.scratchpad'; then
+    offenders+=("$file")
+  fi
+done
+
+if ((${#offenders[@]} > 0)); then
+  echo 'pre-commit: FAIL — .scratchpad references are not allowed in committed files.' >&2
+  echo '  .scratchpad is agent-only ephemeral storage (see AGENTS.md).' >&2
+  echo '  Staged file(s) with new .scratchpad references:' >&2
+  printf '    - %s\n' "${offenders[@]}" >&2
+  echo '  Allowed: ignore files, AGENTS.md, and the hook policy/tests.' >&2
+  exit 1
+fi
+
+git diff --cached --check
+
+# Linting, formatting and dead-code analysis used to run HERE, as a hardcoded
+# `node_modules/.bin/biome` behind a skip list of one repository's vocabulary:
+# bun.lock, package.json, .svelte-check/, test-results/, .terraform.lock.hcl.
+# This package has no Terraform and no Svelte, and it is language agnostic --
+# a Rust or Python repository shares none of that. The repository now declares
+# `pre_commit.static_checks = [{ label, run }]`, which `adl repo controls hook
+# pre-commit` runs before this script. No tool is named here.
+
+# Pre-commit must remain isolated to the index. TypeScript and Knip evaluate the
+# complete checkout, so they belong in CI/PR hygiene / pre-push HEAD export.
+# ADL_SKIP_STAGED_COVERAGE=1 skips coverage (used by tests/tools); pre-push no
+# longer nests this hook — push must not lint the dirty index.
+# Hooks call the coverage script directly; Just is for human workflows only.
+# Staged coverage moved OUT of this script. `adl repo controls hook pre-commit`
+# runs it before this hook, through the repository's declared
+# [controls.coverage].produce command -- see `stagedCoverageStep` in src/hook.ts.
+# It used to shell into "$HOOK_REPO_ROOT/coverage/command.ts",
+# a path into THIS PACKAGE running the package's copy of the consumer's coverage
+# code. `workflows/` is the tree the repository declares and owns.
+
+exit 0

package/packages/repo-controls/scripts/hooks/pre-push

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# Protect the pushed branch, then static checks against the HEAD tip being
+# pushed (not the dirty index/worktree), then JSON-ratchet coverage summaries.
+# Do NOT nest pre-commit here: Biome/scratchpad on `git diff --cached` couples
+# same-checkout agents (foreign staged dirt can fail an unrelated push).
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+cd "$ROOT"
+# The package's scripts/ directory. These hooks live at scripts/hooks/ now,
+# one level shallower than the old scripts/verbatim/workflows/hooks/.
+HOOK_REPO_ROOT="$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"
+
+# shellcheck source=lib/hook-log.sh
+. "$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/lib/hook-log.sh"
+hook_log_init pre-push "$(git rev-parse --abbrev-ref HEAD 2>/dev/null)"
+push_updates="$(cat)"
+
+# Serialize branch delivery across same-checkout agents.
+# TF401028 (concurrent ref update) is handled by retrying the push, in
+# `src/azdo-push.ts`. A branch push lock used to be acquired here and
+# released on EXIT, which serialised THIS HOOK rather than the network push,
+# so the window it claimed to close stayed open the whole time.
+PUSH_TREE=""
+cleanup_pre_push() {
+  local status=$?
+  if [[ -n "${PUSH_TREE}" && -d "${PUSH_TREE}" ]]; then
+    rm -rf -- "${PUSH_TREE}"
+  fi
+  # errexit would otherwise abort here when $status != 0, skipping hook_log_on_exit.
+  set +e
+  (exit "$status")
+  hook_log_on_exit
+  local log_status=$?
+  set -e
+  return "$log_status"
+}
+trap cleanup_pre_push EXIT
+
+# The branch push lock lived here, acquired and released through the package's
+# copy of the consumer's coverage code. It serialises a MEASUREMENT, so it went
+# with the mechanism to the repository that produces one.
+
+ALLOWED_PREFIXES="${ADL_REPO_CONTROLS_BRANCH_PREFIXES:?}"
+ALLOWED_PREFIXES_DISPLAY="${ALLOWED_PREFIXES//|/, }"
+
+validate_remote_branch() {
+  local branch="$1"
+  local prefix
+
+  if [[ "$branch" =~ ^(${ADL_REPO_CONTROLS_PROTECTED_BRANCHES:?})$ ]]; then
+    echo "pre-push: FAIL — direct pushes to protected branch '${branch}' are not allowed; use a PR." >&2
+    exit 1
+  fi
+  if [[ "$branch" =~ ^(${ALLOWED_PREFIXES})/ ]]; then
+    if [[ ! "$branch" =~ ^(${ALLOWED_PREFIXES})/[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+      echo "pre-push: FAIL — description must be lowercase kebab-case with exactly one '/'." >&2
+      echo "  Branch: ${branch}" >&2
+      echo '  Format: <prefix>/<description>' >&2
+      exit 1
+    fi
+    return
+  fi
+
+  prefix="${branch%%/*}"
+  if [[ "$branch" == */* && -n "$prefix" ]]; then
+    echo "pre-push: FAIL — prefix '${prefix}' is not allowed." >&2
+  else
+    echo 'pre-push: FAIL — branch does not match <prefix>/<description>.' >&2
+  fi
+  echo "  Branch: ${branch}" >&2
+  echo "  Allowed prefixes: ${ALLOWED_PREFIXES_DISPLAY}" >&2
+  exit 1
+}
+
+# Each pre-push record is <local ref> <local oid> <remote ref> <remote oid>.
+# The protected and prefix rules govern the branch being delivered, which is
+# the remote branch — not the checkout the delivery happens to originate from.
+while IFS=' ' read -r _local_ref _local_oid remote_ref _remote_oid; do
+  [[ "$remote_ref" == refs/heads/* ]] || continue
+  validate_remote_branch "${remote_ref#refs/heads/}"
+done <<<"$push_updates"
+
+# Git exports repository-local variables to hooks. Do not leak those into the
+# staged-file checks: their fixture repositories must use their own Git metadata.
+git_config_count="${GIT_CONFIG_COUNT:-0}"
+while IFS= read -r git_variable; do
+  unset "$git_variable"
+done < <(git rev-parse --local-env-vars)
+
+# `just azdo-push` supplies its short-lived bearer header through Git's
+# command-scoped config environment. The parent Git process retains it for the
+# HTTPS push, but checks launched by this hook must never inherit it.
+if [[ "$git_config_count" =~ ^[0-9]+$ ]]; then
+  for ((index = 0; index < git_config_count; index++)); do
+    unset "GIT_CONFIG_KEY_${index}" "GIT_CONFIG_VALUE_${index}"
+  done
+fi
+unset GIT_CONFIG_COUNT
+
+# Static checks run against HEAD (the tip being pushed), not the dirty index or
+# worktree, so same-checkout staged/unstaged foreign breakage cannot block delivery.
+# so same-checkout uncommitted foreign breakage cannot block delivery.
+# Reuse a prior pass for the same immutable tree OID under .coverage-cache/.
+HEAD_TREE_OID="$(git rev-parse 'HEAD^{tree}')"
+STATIC_CACHE="$ROOT/.coverage-cache/pre-push-static/${HEAD_TREE_OID}.ok"
+if [[ -f "$STATIC_CACHE" ]]; then
+  echo "pre-push: reusing static-check pass for tree ${HEAD_TREE_OID}"
+else
+  echo 'pre-push: exporting HEAD tree for static checks'
+  PUSH_TREE="$(mktemp -d "${TMPDIR:-/tmp}/adl-pre-push-head.XXXXXX")"
+  git archive HEAD | tar -x -C "$PUSH_TREE"
+  # Untracked paths the export needs, declared by the repository. This was
+  # `ln -s "$ROOT/node_modules"` -- a package that calls itself language
+  # agnostic assuming JavaScript. A Rust repo links `target/`, a Python one its
+  # virtualenv, and a repo with no ecosystem links nothing.
+  while IFS= read -r export_link; do
+    [[ -n "$export_link" ]] || continue
+    [[ -e "$ROOT/$export_link" ]] || continue
+    mkdir -p "$(dirname -- "$PUSH_TREE/$export_link")"
+    ln -s "$ROOT/$export_link" "$PUSH_TREE/$export_link"
+  done <<<"${ADL_REPO_CONTROLS_EXPORT_LINKS:-}"
+
+  static_check_labels=()
+  while IFS=$'\t' read -r static_check_label static_check_command; do
+    [[ -n "$static_check_label" ]] || continue
+    echo "pre-push: ${static_check_label} (HEAD)"
+    (cd "$PUSH_TREE" && bash -c "$static_check_command" </dev/null)
+    static_check_labels+=("$static_check_label")
+  done <<<"${ADL_REPO_CONTROLS_STATIC_CHECKS?}"
+  # The PreToolUse deny corpus is the only thing asserting that destructive
+  # commands stay denied, and nothing else ran it — `git update-ref` sat in
+  # its ALLOW list while being exactly what strands a shared checkout. Cheap
+  # enough to assert on every push.
+
+  mkdir -p "$ROOT/.coverage-cache/pre-push-static"
+  printf '%s\n%s\n' "${static_check_labels[*]}" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$STATIC_CACHE"
+  echo "pre-push: recorded static-check pass for tree ${HEAD_TREE_OID}"
+fi
+
+# The outgoing-commit coverage ratchet moved to `coverageRatchetStep` in
+# src/hook.ts, which runs before this script. It used to pipe into the package's
+# copy of the consumer's coverage code; the package now reads the summary at the
+# path the repository declared and grades it, and produces nothing itself.