@event4u/agent-config 6.1.0 → 7.0.0

package/src/scripts/validate_pack_yaml.py

@@ -1,179 +0,0 @@
-#!/usr/bin/env python3
-"""Validate every ``packages/*/pack.yaml`` against the pack schema.
-
-road-to-6.0.0-D Phase 0 Step 2 — "validate-on-load with a clear fail
-message on a typo'd / non-existent reference." Two checks per manifest:
-
-1. **Shape** — the manifest validates against
-   ``scripts/schemas/pack.schema.json`` (Draft-07, via ``jsonschema``).
-2. **References resolve** — every ``dependencies.skills`` slug backs a real
-   ``skills/<slug>/SKILL.md``; every ``dependencies.rules`` slug backs a real
-   ``rules/<slug>.md``; every ``requires`` / ``suggests`` / ``dependencies.packs``
-   id is a known pack id (closed vocabulary in ``src/config/discovery/packs.yml``
-   plus the physical ``packages/*/`` ids).
-
-Exit codes: 0 = all valid · 1 = at least one violation · 3 = internal error.
-"""
-from __future__ import annotations
-
-import json
-import sys
-from pathlib import Path
-
-import yaml
-
-sys.path.insert(0, str(Path(__file__).resolve().parent))
-from _lib.agent_src import resolve_logical  # noqa: E402
-
-ROOT = Path(__file__).resolve().parents[2]
-PACKAGES = ROOT / "packages"
-SRC_PACKS = ROOT / "src" / "packs"
-SRC_DOMAINS = ROOT / "src" / "domains"
-PACKS_VOCAB = ROOT / "src" / "config" / "discovery" / "packs.yml"
-
-
-def _manifest_dirs() -> list[Path]:
-    """Every directory that may own a ``pack.yaml`` — 6.0.x ``src/packs/*/``
-    (manifest-only capability packs incl. core) + ``src/domains/*/`` (command-
-    bearing) + legacy ``packages/*/`` (back-compat during the move window)."""
-    dirs: list[Path] = []
-    for parent in (SRC_PACKS, SRC_DOMAINS, PACKAGES):
-        if parent.is_dir():
-            dirs.extend(sorted(p for p in parent.iterdir()
-                               if p.is_dir() and not p.name.startswith("_")))
-    return dirs
-SCHEMA = ROOT / "src" / "scripts" / "schemas" / "pack.schema.json"
-ALLOWLIST = ROOT / "src" / "scripts" / "pack_dependency_allowlist.json"
-
-
-def _load_allowlist() -> set[tuple[str, str]]:
-    """Baseline of pre-existing (pack_id, slug) references to skip.
-
-    road-to-6.0.0-D Phase 0 is move-only; pre-existing `skills:` entries that
-    point at command-routing targets or non-existent skills are tracked for a
-    6.1 cleanup rather than edited now (council convergence, 2026-06-03).
-    """
-    if not ALLOWLIST.exists():
-        return set()
-    try:
-        data = json.loads(ALLOWLIST.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError):
-        return set()
-    return {
-        (e["pack"], e["slug"])
-        for e in data.get("entries", [])
-        if isinstance(e, dict) and "pack" in e and "slug" in e
-    }
-
-
-def _known_pack_ids() -> set[str]:
-    """Closed pack-id vocabulary: discovery vocab ids + physical pack ids."""
-    ids: set[str] = set()
-    try:
-        vocab = yaml.safe_load(PACKS_VOCAB.read_text(encoding="utf-8")) or []
-        for entry in vocab:
-            if isinstance(entry, dict) and isinstance(entry.get("id"), str):
-                ids.add(entry["id"])
-    except (OSError, yaml.YAMLError):
-        pass
-    if PACKAGES.is_dir():
-        for pkg in PACKAGES.iterdir():
-            if pkg.is_dir():
-                # mirror _pack_id_from_dir: strip a leading "pack-"
-                ids.add(pkg.name[5:] if pkg.name.startswith("pack-") else pkg.name)
-    if SRC_DOMAINS.is_dir():
-        for dom in SRC_DOMAINS.iterdir():
-            if dom.is_dir() and not dom.name.startswith("_"):
-                ids.add(dom.name)
-    return ids
-
-
-def _slug_resolves(slug: str, kind: str) -> bool:
-    """A dependency reference resolves if it backs a real skill OR rule.
-
-    The `dependencies.skills` / `dependencies.rules` buckets are derived from
-    each command's `skills:` / `rules:` frontmatter, which authors use loosely
-    as a general artefact-dependency marker — a rule frequently appears under
-    `skills:`. Accepting skill OR rule keeps this validator consistent with the
-    transitive hasher in condense.py (`_slug_to_logical` checks both) rather
-    than enforcing a `skills: must be skills` contract that never held at
-    runtime (council convergence claude-sonnet-4-5 + gpt-4o, 2026-06-03).
-    """
-    del kind  # symmetric: resolve against skills first, then rules
-    return (
-        resolve_logical(f"skills/{slug}/SKILL.md") is not None
-        or resolve_logical(f"rules/{slug}.md") is not None
-    )
-
-
-def _validate_manifest(path: Path, schema: dict, known_packs: set[str],
-                       allowlist: set[tuple[str, str]]) -> list[str]:
-    import jsonschema  # local import — maintainer/CI dependency only
-
-    errors: list[str] = []
-    try:
-        data = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
-    except (OSError, yaml.YAMLError) as exc:
-        return [f"{path}: cannot parse YAML — {exc}"]
-
-    validator = jsonschema.Draft7Validator(schema)
-    for err in sorted(validator.iter_errors(data), key=lambda e: list(e.path)):
-        loc = "/".join(str(p) for p in err.path) or "<root>"
-        errors.append(f"{path}: schema error at {loc}: {err.message}")
-
-    pack_id = data.get("id", path.parent.name)
-    deps = data.get("dependencies") or {}
-    for kind in ("skills", "rules"):
-        for slug in deps.get(kind, []) or []:
-            if (pack_id, slug) in allowlist:
-                continue
-            if not _slug_resolves(slug, kind):
-                errors.append(
-                    f"{path}: dependencies.{kind} references '{slug}' but no "
-                    f"skill or rule with that slug exists (typo or unmoved artefact?)"
-                )
-    for field in ("requires", "suggests"):
-        for pid in data.get(field, []) or []:
-            if pid not in known_packs:
-                errors.append(
-                    f"{path}: {field} references unknown pack id '{pid}'"
-                )
-    for pid in deps.get("packs", []) or []:
-        if pid not in known_packs:
-            errors.append(
-                f"{path}: dependencies.packs references unknown pack id '{pid}'"
-            )
-    return errors
-
-
-def main() -> int:
-    if not SCHEMA.exists():
-        print(f"❌  pack schema not found: {SCHEMA}", file=sys.stderr)
-        return 3
-    schema = json.loads(SCHEMA.read_text(encoding="utf-8"))
-    manifest_dirs = _manifest_dirs()
-    if not manifest_dirs:
-        print("no pack homes (packages/ or src/domains/) — nothing to validate")
-        return 0
-    known_packs = _known_pack_ids()
-    allowlist = _load_allowlist()
-    all_errors: list[str] = []
-    count = 0
-    for pkg in manifest_dirs:
-        manifest = pkg / "pack.yaml"
-        if not manifest.exists():
-            continue
-        count += 1
-        all_errors.extend(_validate_manifest(manifest, schema, known_packs, allowlist))
-    if all_errors:
-        for e in all_errors:
-            print(f"❌  {e}", file=sys.stderr)
-        print(f"\n{len(all_errors)} pack.yaml violation(s) across {count} manifest(s).",
-              file=sys.stderr)
-        return 1
-    print(f"✅  {count} pack.yaml manifest(s) valid (schema + references resolve).")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

package/src/scripts/validate_safe_paths.py

@@ -1,118 +0,0 @@
-#!/usr/bin/env python3
-"""Sensitive-path denylist — refuses files that almost certainly hold secrets or PII.
-
-Phase 0 of step-16-telegraph-substance. Gates Phase 2 (`scripts/condense_memory.py`):
-any consumer-supplied path must pass `assert_safe()` before bytes are read or
-shipped to a third-party API.
-
-Ported from Telegraph `plugins/telegraph/skills/telegraph-condense/scripts/condense.py`
-(upstream `63a91ec`). Adapted to repo conventions: explicit `SensitivePathError`,
-CLI entry point, no `anthropic` import.
-
-Public API:
-    is_sensitive(path: pathlib.Path) -> bool
-    assert_safe(path: pathlib.Path) -> None     # raises SensitivePathError
-
-CLI:
-    python3 scripts/validate_safe_paths.py <path>   # exit 0 = safe, 2 = sensitive
-"""
-from __future__ import annotations
-
-import re
-import sys
-from pathlib import Path
-
-__all__ = ["SensitivePathError", "is_sensitive", "assert_safe"]
-
-
-class SensitivePathError(ValueError):
-    """Raised when a path matches the sensitive-file denylist."""
-
-
-# Filenames that almost certainly hold secrets or PII. Matched against the
-# basename only (case-insensitive). Condenseing or shipping these to an LLM API
-# is a third-party data boundary developers on sensitive codebases cannot cross.
-SENSITIVE_BASENAME_REGEX = re.compile(
-    r"(?ix)^("
-    r"\.env(\..+)?"
-    r"|\.netrc"
-    r"|credentials(\..+)?"
-    r"|secrets?(\..+)?"
-    r"|passwords?(\..+)?"
-    r"|id_(rsa|dsa|ecdsa|ed25519)(\.pub)?"
-    r"|authorized_keys"
-    r"|known_hosts"
-    r"|.*\.(pem|key|p12|pfx|crt|cer|jks|keystore|asc|gpg)"
-    r")$"
-)
-
-# Path components (any segment, case-insensitive) that mark a sensitive
-# directory. Catches `~/.ssh/known_hosts` even when the basename slips past the
-# regex above.
-SENSITIVE_PATH_COMPONENTS = frozenset({".ssh", ".aws", ".gnupg", ".kube", ".docker"})
-
-# Substring tokens checked against the normalised basename (separators stripped
-# so `api-key`, `api_key`, `apikey` all match). Catches creative renames like
-# `prod-secret-token.txt` that bypass the explicit basename regex.
-SENSITIVE_NAME_TOKENS = (
-    "secret",
-    "credential",
-    "password",
-    "passwd",
-    "apikey",
-    "accesskey",
-    "token",
-    "privatekey",
-)
-
-_SEP_STRIP_RE = re.compile(r"[_\-\s.]")
-
-
-def is_sensitive(path: Path) -> bool:
-    """Return True if `path` matches the sensitive-file denylist."""
-    name = path.name
-    if SENSITIVE_BASENAME_REGEX.match(name):
-        return True
-    lowered_parts = {p.lower() for p in path.parts}
-    if lowered_parts & SENSITIVE_PATH_COMPONENTS:
-        return True
-    lower = _SEP_STRIP_RE.sub("", name.lower())
-    return any(tok in lower for tok in SENSITIVE_NAME_TOKENS)
-
-
-def assert_safe(path: Path) -> None:
-    """Raise `SensitivePathError` if `path` matches the denylist.
-
-    Intended as a hard guard at the top of any function that reads bytes from
-    a consumer-supplied path and ships them to a third-party API. Override is
-    intentional: the user must rename the file if the heuristic is wrong.
-    """
-    if is_sensitive(path):
-        raise SensitivePathError(
-            f"Refusing to operate on {path}: filename or path looks sensitive "
-            "(credentials, keys, secrets, or known private directories). "
-            "Rename the file if this is a false positive."
-        )
-
-
-def _main(argv: list[str]) -> int:
-    if len(argv) != 2 or argv[1] in ("-h", "--help"):
-        print(
-            "usage: validate_safe_paths.py <path>\n"
-            "  exit 0 — path is safe\n"
-            "  exit 2 — path matches the sensitive-file denylist",
-            file=sys.stderr,
-        )
-        return 0 if (len(argv) == 2 and argv[1] in ("-h", "--help")) else 2
-    target = Path(argv[1])
-    try:
-        assert_safe(target)
-    except SensitivePathError as exc:
-        print(f"SensitivePathError: {exc}", file=sys.stderr)
-        return 2
-    print(f"safe: {target}")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(_main(sys.argv))

package/src/scripts/validate_telegraph_carveouts.py

@@ -1,129 +0,0 @@
-#!/usr/bin/env python3
-"""Mechanical carve-out validator for telegraph-condensed replies.
-
-Given a pre-condensation reply and a post-condensation reply, assert that
-every carve-out region from `.agent-src.uncondensed/rules/telegraph-speak.md`
-§ Carve-outs survived byte-for-byte:
-
-  1. Triple-backtick code blocks (any language).
-  2. Numbered-option lines  (`^>?\\s*\\d+\\.\\s` plus the
-     `**Recommendation:**` / `**Empfehlung:**` label).
-  3. Backtick spans (file paths, command names, identifiers).
-  4. Status / error marker lines (prefix `❌`, `⚠️`, `✅`).
-  5. Triple-backtick ALL-CAPS Iron-Law literal fences (subset of (1) —
-     reported separately for diagnostics).
-
-Stdlib only. Exit 0 = all carve-outs preserved; exit 1 = drift detected.
-"""
-from __future__ import annotations
-
-import argparse
-import difflib
-import re
-import sys
-from pathlib import Path
-
-# Triple-backtick fenced blocks (greedy across lines). Group 1 = body.
-RE_CODE_FENCE = re.compile(r"```[^\n]*\n(.*?)\n```", re.DOTALL)
-# Numbered-option line: optional `> ` quote prefix, digits, dot, space.
-RE_NUMBERED = re.compile(r"^>?\s*\d+\.\s.*$", re.MULTILINE)
-# Recommendation labels (both languages).
-RE_RECOMMEND = re.compile(r"^\*\*(Recommendation|Empfehlung):\*\*.*$", re.MULTILINE)
-# Backtick spans — single-tick, non-greedy, no newlines inside.
-RE_BACKTICK_SPAN = re.compile(r"`[^`\n]+`")
-# Status / error marker lines (full line containing the marker).
-RE_STATUS_LINE = re.compile(r"^.*[❌⚠✅].*$", re.MULTILINE)
-# Iron-Law ALL-CAPS fence body — letters + spaces + basic punctuation, ≥ 80 % uppercase.
-RE_ALLCAPS_LINE = re.compile(r"^[A-Z0-9 ,\.\-—:'\"·/\(\)]+$")
-
-
-def _extract_code_fences(text: str) -> list[str]:
-    return [m.group(0) for m in RE_CODE_FENCE.finditer(text)]
-
-
-def _extract_lines(text: str, pattern: re.Pattern) -> list[str]:
-    return [m.group(0) for m in pattern.finditer(text)]
-
-
-def _extract_backtick_spans(text: str) -> list[str]:
-    # Excludes triple-backtick fences (handled separately).
-    stripped = RE_CODE_FENCE.sub("", text)
-    return RE_BACKTICK_SPAN.findall(stripped)
-
-
-def _is_allcaps_fence_body(body: str) -> bool:
-    lines = [ln.strip() for ln in body.splitlines() if ln.strip()]
-    if not lines:
-        return False
-    return all(RE_ALLCAPS_LINE.match(ln) for ln in lines)
-
-
-def _extract_allcaps_fences(text: str) -> list[str]:
-    out: list[str] = []
-    for m in RE_CODE_FENCE.finditer(text):
-        if _is_allcaps_fence_body(m.group(1)):
-            out.append(m.group(0))
-    return out
-
-
-CHECKS = (
-    ("code_fences", _extract_code_fences),
-    ("numbered_options", lambda t: _extract_lines(t, RE_NUMBERED)),
-    ("recommendation_labels", lambda t: _extract_lines(t, RE_RECOMMEND)),
-    ("backtick_spans", _extract_backtick_spans),
-    ("status_markers", lambda t: _extract_lines(t, RE_STATUS_LINE)),
-    ("allcaps_iron_law_fences", _extract_allcaps_fences),
-)
-
-
-def validate(pre: str, post: str) -> list[tuple[str, list[str]]]:
-    """Return list of (carve_out_name, unified_diff_lines) per drifted category."""
-    failures: list[tuple[str, list[str]]] = []
-    for name, extractor in CHECKS:
-        pre_list = extractor(pre)
-        post_list = extractor(post)
-        if pre_list == post_list:
-            continue
-        diff = list(difflib.unified_diff(
-            [s + "\n" for s in pre_list],
-            [s + "\n" for s in post_list],
-            fromfile=f"pre/{name}",
-            tofile=f"post/{name}",
-            lineterm="",
-        ))
-        failures.append((name, diff))
-    return failures
-
-
-def _render(failures: list[tuple[str, list[str]]]) -> str:
-    out = ["telegraph carve-out validator: DRIFT DETECTED", ""]
-    for name, diff in failures:
-        out.append(f"❌ carve-out `{name}` drifted:")
-        out.extend(diff)
-        out.append("")
-    return "\n".join(out)
-
-
-def main(argv: list[str] | None = None) -> int:
-    p = argparse.ArgumentParser(description=__doc__.splitlines()[0])
-    p.add_argument("pre", type=Path, help="Pre-condensation reply file.")
-    p.add_argument("post", type=Path, help="Post-condensation reply file.")
-    args = p.parse_args(argv)
-    if not args.pre.is_file():
-        print(f"pre file not found: {args.pre}", file=sys.stderr)
-        return 2
-    if not args.post.is_file():
-        print(f"post file not found: {args.post}", file=sys.stderr)
-        return 2
-    pre = args.pre.read_text(encoding="utf-8")
-    post = args.post.read_text(encoding="utf-8")
-    failures = validate(pre, post)
-    if failures:
-        print(_render(failures))
-        return 1
-    print("telegraph carve-out validator: all carve-outs preserved ✅")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

package/src/scripts/verify_before_complete_hook.py

@@ -1,216 +0,0 @@
-#!/usr/bin/env python3
-"""Platform-agnostic hook for the `verify-before-complete` rule.
-
-Records observable evidence that a verification command (tests, quality
-tools, build) ran. The rule body cites the resulting state file as the
-source of truth for the "have I verified this turn?" question. The hook
-itself never blocks — it is observability infra, not control flow.
-
-Wired to multiple events via the manifest:
-  - session_start / user_prompt_submit → reset turn-scoped counters
-  - post_tool_use → inspect tool + command, record verifications
-  - stop                                → record stop fired (claim-done window)
-
-Output: `agents/runtime/state/verify-before-complete.json`
-  {
-    "schema_version": 1,
-    "session_id": "<str>",
-    "turn_started_at": "<iso8601|null>",
-    "last_verification": {"command": ..., "tool": ..., "at": ...} | null,
-    "verifications_this_turn": <int>,
-    "verifications_this_session": <int>,
-    "last_stop_at": "<iso8601|null>",
-    "verified_this_turn": <bool>,
-    "checked_at": "<iso8601>"
-  }
-
-Exit code is always 0.
-"""
-from __future__ import annotations
-
-import argparse
-import datetime as _dt
-import json
-import re
-import sys
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent))
-from hooks.state_io import atomic_write_json  # noqa: E402
-
-STATE_FILE = Path("agents") / "state" / "verify-before-complete.json"
-
-# Tool names across platforms whose `command` / `tool_input.command` field
-# carries a shell command we can inspect. Edit tools are deliberately
-# excluded — they cannot run verification.
-COMMAND_TOOLS = frozenset({
-    "launch-process", "launch_process",     # Augment
-    "Bash", "BashTool",                     # Claude Code
-    "run-process", "runProcess",            # variants
-    "shell", "execute_shell",               # generic / Cline
-    "RunShellCommand",                      # Cursor
-})
-
-# Permissive verification-command pattern. Observability — false positives
-# are cheaper than false negatives. Word-boundary anchored on common
-# shell separators so chained commands (`task sync && task ci`) match.
-_VERIFICATION_RE = re.compile(
-    r'(?:^|[\s;&|`(])('
-    r'task\s+(?:ci|test|tests|lint|check|qa|phpstan|rector|ecs|pest|pytest)'
-    r'|(?:\./|\.venv/bin/|vendor/bin/)?(?:pest|phpunit|phpstan|psalm|rector|ecs)\b'
-    r'|(?:python3?|\.venv/bin/python3?)\s+-m\s+pytest'
-    r'|pytest\b'
-    r'|(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|check|lint|typecheck|tsc)'
-    r'|cargo\s+(?:test|check|clippy)'
-    r'|go\s+test'
-    r'|make\s+(?:test|check|lint)'
-    r'|composer\s+(?:test|check|lint|phpstan)'
-    r'|(?:php\s+)?artisan\s+test'
-    r')',
-    re.IGNORECASE,
-)
-
-
-def _now() -> str:
-    return _dt.datetime.now(_dt.timezone.utc).isoformat(timespec="seconds")
-
-
-def _empty_state() -> dict:
-    return {
-        "schema_version": 1,
-        "session_id": "",
-        "turn_started_at": None,
-        "last_verification": None,
-        "verifications_this_turn": 0,
-        "verifications_this_session": 0,
-        "last_stop_at": None,
-        "verified_this_turn": False,
-        "checked_at": _now(),
-    }
-
-
-def _load_state(target: Path) -> dict:
-    if not target.is_file():
-        return _empty_state()
-    try:
-        decoded = json.loads(target.read_text(encoding="utf-8"))
-        if isinstance(decoded, dict):
-            return {**_empty_state(), **decoded}
-    except (OSError, json.JSONDecodeError):
-        pass
-    return _empty_state()
-
-
-def _extract_command(payload: dict) -> tuple[str | None, str | None]:
-    """Return (tool_name, command_text) from a tool-event payload."""
-    tool = (payload.get("tool_name") or payload.get("toolName")
-            or payload.get("tool"))
-    if not isinstance(tool, str) or tool not in COMMAND_TOOLS:
-        return (tool if isinstance(tool, str) else None, None)
-    ti = payload.get("tool_input")
-    if isinstance(ti, dict):
-        for key in ("command", "cmd", "shell_command"):
-            v = ti.get(key)
-            if isinstance(v, str) and v:
-                return (tool, v)
-    # Some platforms surface the command at the top level.
-    for key in ("command", "cmd"):
-        v = payload.get(key)
-        if isinstance(v, str) and v:
-            return (tool, v)
-    return (tool, None)
-
-
-def _is_verification(command: str) -> bool:
-    return bool(_VERIFICATION_RE.search(command))
-
-
-def _reset_turn(state: dict, session_id: str) -> dict:
-    state["session_id"] = session_id or state.get("session_id") or ""
-    state["turn_started_at"] = _now()
-    state["verifications_this_turn"] = 0
-    state["verified_this_turn"] = False
-    return state
-
-
-def _update(state: dict, event: str, envelope: dict) -> dict:
-    session_id = envelope.get("session_id") or state.get("session_id") or ""
-    if session_id and session_id != state.get("session_id"):
-        # Session boundary — reset session-scoped counters.
-        state["session_id"] = session_id
-        state["verifications_this_session"] = 0
-        state = _reset_turn(state, session_id)
-
-    payload = envelope.get("payload") or {}
-    if not isinstance(payload, dict):
-        payload = {}
-
-    if event in ("session_start", "user_prompt_submit"):
-        state = _reset_turn(state, session_id)
-    elif event == "post_tool_use":
-        tool, cmd = _extract_command(payload)
-        if cmd and _is_verification(cmd):
-            state["last_verification"] = {
-                "command": cmd[:512],
-                "tool": tool,
-                "at": _now(),
-                "platform": envelope.get("platform") or "",
-            }
-            state["verifications_this_turn"] = int(
-                state.get("verifications_this_turn") or 0) + 1
-            state["verifications_this_session"] = int(
-                state.get("verifications_this_session") or 0) + 1
-            state["verified_this_turn"] = True
-    elif event == "stop":
-        state["last_stop_at"] = _now()
-
-    state["checked_at"] = _now()
-    return state
-
-
-def run(stdin_text: str, *, consumer_root: Path, verbose: bool = False) -> int:
-    envelope: dict = {}
-    if stdin_text.strip():
-        try:
-            decoded = json.loads(stdin_text)
-            if isinstance(decoded, dict):
-                envelope = decoded
-        except json.JSONDecodeError:
-            envelope = {}
-
-    event = envelope.get("event") or ""
-    target = consumer_root / STATE_FILE
-    state = _load_state(target)
-    state = _update(state, event, envelope)
-
-    try:
-        atomic_write_json(target, state)
-    except OSError:
-        if verbose:
-            print("verify-before-complete-hook: state write failed",
-                  file=sys.stderr)
-        return 0
-
-    if verbose:
-        print(
-            f"verify-before-complete-hook: event={event} "
-            f"verified_this_turn={state.get('verified_this_turn')} "
-            f"verifications_this_turn={state.get('verifications_this_turn')}",
-            file=sys.stderr,
-        )
-    return 0
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--platform", default="generic",
-                        help="informational platform tag")
-    parser.add_argument("--verbose", action="store_true",
-                        help="emit one stderr line per invocation")
-    args = parser.parse_args(argv)
-    return run(sys.stdin.read(), consumer_root=Path.cwd(),
-               verbose=args.verbose)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    sys.exit(main())