@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.4

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/license_declared/fixtures/license-declared-clean/LICENSE

@@ -0,0 +1,10 @@
+Proprietary License
+
+Copyright (c) 2026 Amsterdam Data Labs B.V.
+
+All rights reserved.
+
+This software and its source code are the confidential and proprietary property
+of Amsterdam Data Labs B.V. No part of it may be reproduced, distributed or
+transmitted in any form or by any means without the prior written permission of
+the copyright holder.

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/license_declared/fixtures/license-declared-mismatch/LICENSE

@@ -0,0 +1,3 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/license_declared/fixtures/license-declared-missing/README.md

@@ -0,0 +1 @@
+# no LICENSE here

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/license_declared/test_check.py

@@ -0,0 +1,66 @@
+"""REP-001 — the repository ships the licence it DECLARES.
+
+Every case turns on the declaration, because that is the whole gate. The same
+LICENSE file is clean under one declaration and a violation under another, and
+`test_the_same_file_is_graded_against_what_was_declared` is the case that would
+have caught the original defect: the check held "Apache-2.0" itself, so no
+declaration could change its answer.
+
+All three rules are structural — asserted BY PATH. LICENSE-MISSING is about a
+file's ABSENCE, and an absent file appears in no file set.
+"""
+
+from __future__ import annotations
+
+from helpers import corpus, verdict_for
+
+from adl_compliance.core.verdict import Outcome
+
+CORPORA = corpus("repository", "license-declared")
+CLEAN = CORPORA / "license-declared-clean"
+MISSING = CORPORA / "license-declared-missing"
+MISMATCH = CORPORA / "license-declared-mismatch"
+
+PROPRIETARY = {"license": "Proprietary"}
+
+
+def test_a_licence_matching_its_declaration_is_silent() -> None:
+    verdict = verdict_for("REP-001", CLEAN, declarations=PROPRIETARY)
+    assert verdict.outcome is Outcome.CLEAN, verdict.findings
+
+
+def test_an_absent_licence_is_reported_though_it_is_in_no_file_set() -> None:
+    verdict = verdict_for("REP-001", MISSING, declarations=PROPRIETARY)
+    rules = {finding.rule for finding in verdict.findings}
+    assert rules == {"LICENSE-MISSING"}, verdict.findings
+
+
+def test_the_same_file_is_graded_against_what_was_declared() -> None:
+    """The regression guard. An Apache LICENSE is correct for a repository that
+    declares Apache and wrong for one that declares Proprietary — one corpus,
+    two verdicts. Before the rewrite the check named Apache-2.0 itself and both
+    of these passed, which is a gate dictating rather than enforcing."""
+    apache = verdict_for("REP-001", MISMATCH, declarations={"license": "Apache-2.0"})
+    assert apache.outcome is Outcome.CLEAN, apache.findings
+
+    proprietary = verdict_for("REP-001", MISMATCH, declarations=PROPRIETARY)
+    rules = {finding.rule for finding in proprietary.findings}
+    assert rules == {"LICENSE-CONTENT"}, proprietary.findings
+
+
+def test_an_undeclared_licence_is_a_finding_not_a_default() -> None:
+    """No declaration must never resolve to a licence of the package's choosing;
+    picking one is exactly the defect this gate was rewritten to remove."""
+    verdict = verdict_for("REP-001", CLEAN, declarations={})
+    rules = {finding.rule for finding in verdict.findings}
+    assert rules == {"LICENSE-UNDECLARED"}, verdict.findings
+
+
+def test_an_unknown_licence_name_is_graded_against_the_name_itself() -> None:
+    """The profile table is a convenience for common licences, not a list of
+    permitted answers: an estate may declare one this package never heard of."""
+    verdict = verdict_for("REP-001", CLEAN, declarations={"license": "Proprietary License"})
+    assert verdict.outcome is Outcome.CLEAN, verdict.findings
+
+    other = verdict_for("REP-001", CLEAN, declarations={"license": "EUPL-1.2"})
+    assert {f.rule for f in other.findings} == {"LICENSE-CONTENT"}, other.findings

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/__init__.py

@@ -0,0 +1,11 @@
+"""The `repository.lockfile-integrity` gate.
+
+A folder rather than a module because the ported test carries its own fixture
+corpus beside the check, same as every other gate in this package.
+"""
+
+from __future__ import annotations
+
+from .check import LockfileIntegrity
+
+__all__ = ["LockfileIntegrity"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/check.py

@@ -0,0 +1,167 @@
+"""REP-002 — backend/frontend lockfiles must exist and Cargo must accept the
+backend lock without updates.
+
+Ported from `compliance_new/checks/repository/lockfile-integrity/check.sh`.
+Entirely `structural`: check.sh opens three FIXED, NAMED paths
+(`backend/Cargo.lock`, `frontend/bun.lock`, `backend/Cargo.toml`) and never
+consults the given file set — the row's `engine.scope` decides whether this
+gate runs at all, not which of these three paths it reads.
+
+**Fixed 2026-09-15: these three paths, plus the workspace directory, resolve
+through `inputs` now — `<rust>` and `<typescript>` placeholders, exactly like
+`coverage.backend-ratchet`'s `current`/`config` inputs — instead of the
+hardcoded `ClassVar` literals (`backend`, `backend/Cargo.lock`,
+`backend/Cargo.toml`, `frontend/bun.lock`) this check carried until then.**
+Those literals bypassed tree resolution entirely (K-42): measured for real on
+enact-vps-m5, which declares no `rust` tree (it has none — no Cargo.toml
+anywhere in that checkout), `engine.scope` correctly matched under a declared
+`<typescript>` workspace's `package.json`, and this check then unconditionally
+reported `LCK-001: missing backend/Cargo.lock` — a literal path that
+repository never named and has no Rust code at. A row whose `engine.scope` is
+a union of more than one tree (this one: `<rust>` OR `<typescript>`) can run
+because ONE tree's scope matched, while a check that then hardcodes the
+OTHER tree's default path grades a repository against a path it never
+declared. `<rust>` resolves to `backend` and `<typescript>` resolves to
+`frontend` in the packaged `policy/config.toml` — those are still the
+defaults, just reached through `ctx.inputs` now, the same as every other
+check that names a consumer path.
+
+  LCK-001   a required lockfile is missing or empty (`[ -s FILE ]` in check.sh
+            — MISSING and EMPTY are the same finding, worded the same way).
+  LCK-002   `cargo metadata --locked` rejects `backend/Cargo.lock` against
+            `backend/Cargo.toml` — the lock exists but does not satisfy the
+            manifest.
+
+**check.sh stops at the first problem.** Each of the three failure branches
+ends in `report_summary; exit` — a missing frontend lockfile is never reported
+alongside a missing backend one, and a stale lock is never reached if either
+lockfile is absent. Ported as the same early-return shape below rather than
+accumulating every applicable finding.
+
+**Cargo is required conditionally, not unconditionally**, same pattern
+`coverage.backend-crate` and `database.migration-provenance` already use for
+their own `cargo`/`atlas` calls: check.sh's `command -v cargo || exit 2` sits
+AFTER both `[ -s ... ]` guards, so a corpus missing either lockfile never
+reaches it. This is why this check does not declare `requires = ("cargo",)`
+on the class (which the runner enforces before the check ever runs at all,
+unconditionally) — it raises `CouldNotRun` itself, exactly where check.sh's
+`exit 2` sits.
+
+**Two failures share check.sh's own separation.** `cargo --version` (needs no
+manifest, no lock — fails only if the toolchain itself cannot dispatch) is
+distinguished from `cargo metadata --locked` (fails when the lock is
+genuinely stale, or when cargo cannot run at all — the ambiguity check.sh's
+own comment explains). The former is always `CouldNotRun`; the latter is a
+finding (`LCK-002`) here exactly as it is in check.sh — this check trusts
+`cargo --version` having already ruled out "cargo cannot run at all" for the
+same reason check.sh does.
+
+cargo resolves its toolchain from the WORKING DIRECTORY — rustup applies
+`backend/rust-toolchain.toml` as a directory override, and `--manifest-path`
+does not change that: toolchain selection precedes reading the manifest. So
+both cargo calls run with `cwd` set to the workspace directory, not the
+manifest's own directory, matching check.sh's identical comment.
+"""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+from collections.abc import Iterable
+from typing import ClassVar
+
+from ....core.check import Check, FileState
+from ....core.context import Context
+from ....core.errors import CouldNotRun
+from ....core.finding import Report
+
+
+class LockfileIntegrity(Check):
+    id: ClassVar[str] = "REP-002"
+
+    inputs: ClassVar[dict[str, str]] = {
+        "workspace": "<rust>",
+        "cargo_lock": "<rust>/Cargo.lock",
+        "cargo_manifest": "<rust>/Cargo.toml",
+        "bun_lock": "<typescript>/bun.lock",
+    }
+    """Named, declared, and resolved through the SAME tree map every scope
+    pattern uses (K-42) — the fix for the hardcoded-literal bug this class's
+    docstring describes. A repository declaring `rust = "rust-workspace"` (or
+    no `rust` tree at all) is graded against that declaration, never the
+    packaged `backend`/`frontend` defaults baked into Python."""
+
+    MISSING: ClassVar[str] = "LCK-001"
+    STALE: ClassVar[str] = "LCK-002"
+
+    # ------------------------------------------------------------- structural
+
+    def structural(self, ctx: Context) -> Iterable[Report]:
+        cargo_lock = ctx.inputs["cargo_lock"]
+        bun_lock = ctx.inputs["bun_lock"]
+
+        if self.state(ctx, cargo_lock) is not FileState.PRESENT:
+            shown = ctx.relative(cargo_lock)
+            yield self.report(
+                shown,
+                f"missing {shown}",
+                f"run: (cd {ctx.relative(ctx.inputs['workspace'])} && "
+                "cargo generate-lockfile) and commit the result",
+                rule=self.MISSING,
+            )
+            return
+
+        if self.state(ctx, bun_lock) is not FileState.PRESENT:
+            shown = ctx.relative(bun_lock)
+            typescript_dir = shown.rsplit("/", 1)[0] if "/" in shown else "."
+            yield self.report(
+                shown,
+                f"missing {shown}",
+                f"run: (cd {typescript_dir} && bun install) to generate the "
+                "lockfile and commit the result",
+                rule=self.MISSING,
+            )
+            return
+
+        if shutil.which("cargo") is None:
+            raise CouldNotRun(
+                "repository.lockfile-integrity: cargo is required; tool failure, "
+                "not a finding"
+            )
+
+        workspace = ctx.inputs["workspace"]
+        version_check = subprocess.run(
+            ["cargo", "--version"],
+            cwd=workspace,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if version_check.returncode != 0:
+            raise CouldNotRun(
+                f"repository.lockfile-integrity: cargo could not run in "
+                f"{ctx.relative(workspace)}; tool failure, not a finding"
+            )
+
+        manifest = ctx.inputs["cargo_manifest"]
+        metadata_run = subprocess.run(
+            [
+                "cargo", "metadata", "--locked", "--offline", "--no-deps",
+                "--format-version", "1", "--manifest-path", str(manifest),
+            ],
+            cwd=workspace,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if metadata_run.returncode != 0:
+            lock_shown = ctx.relative(cargo_lock)
+            manifest_shown = ctx.relative(manifest)
+            yield self.report(
+                lock_shown,
+                f"{lock_shown} does not satisfy {manifest_shown}",
+                f"run: (cd {ctx.relative(workspace)} && cargo update) to "
+                f"resync {lock_shown} with {manifest_shown}, then commit "
+                "the result",
+                rule=self.STALE,
+            )

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/backend/Cargo.lock

@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "fixture"
+version = "0.1.0"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/backend/Cargo.toml

@@ -0,0 +1,4 @@
+[package]
+name = "fixture"
+version = "0.1.0"
+edition = "2021"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/backend/rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.96.1"
+components = ["rustfmt", "clippy", "rust-analyzer", "llvm-tools-preview"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/backend/src/main.rs

@@ -0,0 +1 @@
+fn main() {}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/clean/frontend/bun.lock

@@ -0,0 +1 @@
+# fixture lock

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/backend/Cargo.lock

@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "fixture"
+version = "0.1.0"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/backend/Cargo.toml

@@ -0,0 +1,4 @@
+[package]
+name = "fixture"
+version = "0.1.0"
+edition = "2021"

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/backend/rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.96.1"
+components = ["rustfmt", "clippy", "rust-analyzer", "llvm-tools-preview"]

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/fixtures/empty-bun-lock/backend/src/main.rs

@@ -0,0 +1 @@
+fn main() {}

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/test_check.py

@@ -0,0 +1,109 @@
+"""REP-002 — ported from
+`compliance_new/checks/repository/lockfile-integrity/test.sh`.
+
+test.sh builds its fixture inline (`mktemp`, `printf`, a `cp` of the real
+`backend/rust-toolchain.toml`, a real `cargo generate-lockfile --offline`) and
+asserts exactly two things:
+
+  1. the built fixture — a valid `backend/Cargo.toml`/`Cargo.lock` pair plus a
+     non-empty `frontend/bun.lock` — passes (`... | rg -F 'OK'`).
+  2. emptying `frontend/bun.lock` afterwards makes the gate fail.
+
+Ported here as two COMMITTED fixture directories built the identical way (see
+`fixtures/clean/` and `fixtures/empty-bun-lock/`, and the git history of this
+file for the exact commands that produced them), rather than reconstructed at
+test time — the same shift every other ported check.sh/test.sh pair in this
+package already made, and the one this task calls out `coverage.backend-ratchet`
+(`COV-002`) as its concrete precedent for.
+
+A real Rust toolchain and a real `cargo` invocation are both required to prove
+the `LCK-002` branch (`cargo metadata --locked` rejecting a stale lock), but
+test.sh itself never exercises that branch either — it only ever builds a
+lockfile that *does* satisfy its manifest. Nothing here invents a third
+scenario test.sh does not have.
+"""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+import pytest
+from helpers import corpus, corpus_files
+
+from adl_compliance import runner
+from adl_compliance.checks.repository.lockfile_integrity import LockfileIntegrity
+from adl_compliance.core.verdict import Outcome
+from adl_compliance.policy.registry import effective_trees, load
+
+FIXTURES = corpus("repository", "lockfile-integrity")
+ROW = load().by_id("REP-002")
+
+requires_cargo = pytest.mark.skipif(shutil.which("cargo") is None, reason="cargo is not installed")
+pytestmark = requires_cargo
+
+
+@pytest.fixture(autouse=True)
+def _wired(monkeypatch: pytest.MonkeyPatch) -> None:
+    # REP-002 is not yet in `checks/__init__.py`'s CHECKS tuple — a later step
+    # wires this wave of checks into the registry in one shot, to avoid
+    # concurrent edits to that shared file. Until then, `runner.lookup` cannot
+    # find this row, so the dispatch path (`runner.run`) is exercised here with
+    # its one lookup call patched to resolve REP-002 to this module's class —
+    # everything else (scope intersection, structural/graded split, verdict
+    # decision) runs for real.
+    monkeypatch.setattr(runner, "lookup", lambda gate_id: LockfileIntegrity)
+
+
+def run(case: str) -> object:
+    root = FIXTURES / case
+    return runner.run(ROW, root, corpus_files(root))
+
+
+def test_the_row_identifies_this_check() -> None:
+    assert ROW.domain == "repository"
+    assert ROW.name == "lockfile-integrity"
+
+
+def test_clean_corpus_passes() -> None:
+    # test.sh: `bash "$gate" --root "$fixture" | rg -F 'OK'` — a real
+    # backend/Cargo.toml + Cargo.lock pair cargo itself generated, plus a
+    # non-empty frontend/bun.lock.
+    verdict = run("clean")
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.findings == ()
+
+
+def test_empty_frontend_lockfile_is_reported() -> None:
+    # test.sh: `: > "$fixture/frontend/bun.lock"` then asserts the gate fails.
+    verdict = run("empty-bun-lock")
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    assert len(verdict.findings) == 1
+    finding = verdict.findings[0]
+    assert finding.rule == "LCK-001"
+    assert finding.path == "frontend/bun.lock"
+    assert finding.message == "missing frontend/bun.lock"
+
+
+def test_a_redeclared_rust_tree_is_honoured(tmp_path: Path) -> None:
+    """The bug this pins: `WORKSPACE`/`CARGO_LOCK`/`CARGO_MANIFEST`/`BUN_LOCK`
+    used to be hardcoded `ClassVar`s (`"backend"`, `"backend/Cargo.lock"`,
+    `"backend/Cargo.toml"`, `"frontend/bun.lock"`) that bypassed tree
+    resolution entirely, unlike every other check's `inputs` mapping (K-42).
+
+    Measured for real on enact-vps-m5 (no `rust` tree at all — no Cargo.toml
+    anywhere in that checkout): once `<typescript>` scope matched a declared
+    workspace's `package.json`, this check still unconditionally reported
+    `LCK-001: missing backend/Cargo.lock` against a literal path that
+    repository never named and has no Rust code at. A repository that
+    declares `rust = "rust-workspace"` (and has no `backend/` at all) must be
+    graded against `rust-workspace/Cargo.lock`, never the packaged default.
+    """
+    trees = effective_trees({"rust": "rust-workspace", "typescript": "ts-workspace"})
+    verdict = runner.run(ROW, tmp_path, corpus_files(tmp_path), trees=trees)
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    assert len(verdict.findings) == 1
+    finding = verdict.findings[0]
+    assert finding.rule == "LCK-001"
+    assert finding.path == "rust-workspace/Cargo.lock"
+    assert finding.message == "missing rust-workspace/Cargo.lock"