claude-dev-env 1.44.0 → 1.46.0

package/hooks/blocking/test_code_rules_enforcer.py

@@ -15,6 +15,8 @@ from __future__ import annotations
 
 import ast
 import importlib.util
+import io
+import json
 import sys
 from pathlib import Path
 from types import ModuleType
@@ -59,6 +61,28 @@ from hooks_constants.stuttering_check_config import (  # noqa: E402
 PRODUCTION_FILE_PATH = "packages/claude-dev-env/hooks/blocking/example_production.py"
 
 
+def test_should_treat_repo_relative_hook_path_as_hook_infrastructure() -> None:
+    relative_hook_path = "packages/claude-dev-env/hooks/blocking/code_rules_enforcer.py"
+    assert code_rules_enforcer.is_hook_infrastructure(relative_hook_path) is True
+
+
+def test_should_treat_backslash_repo_relative_hook_path_as_hook_infrastructure() -> None:
+    relative_hook_path = "packages\\claude-dev-env\\hooks\\blocking\\code_rules_enforcer.py"
+    assert code_rules_enforcer.is_hook_infrastructure(relative_hook_path) is True
+
+
+def test_should_not_treat_unrelated_repo_relative_path_as_hook_infrastructure() -> None:
+    relative_source_path = "packages/claude-dev-env/skills/bugteam/scripts/runner.py"
+    assert code_rules_enforcer.is_hook_infrastructure(relative_source_path) is False
+
+
+def test_should_exempt_repo_relative_hook_file_from_function_length() -> None:
+    body_lines = "\n".join(f"    bound_{each_index} = {each_index}" for each_index in range(70))
+    grown_function_source = "def grown_function() -> None:\n" + body_lines + "\n"
+    relative_hook_path = "packages/claude-dev-env/hooks/blocking/code_rules_enforcer.py"
+    assert code_rules_enforcer.check_function_length(grown_function_source, relative_hook_path) == []
+
+
 def test_should_expose_all_banned_identifiers_from_config() -> None:
     expected_banned_identifiers = frozenset({
         "result", "data", "output", "response", "value", "item", "temp",
@@ -1213,3 +1237,1368 @@ def test_validate_content_honors_empty_full_file_content_for_thin_wrapper_check(
     assert not any("thin wrapper" in each.lower() for each in issues), (
         f"empty post-edit file must not be flagged as a thin wrapper, got: {issues!r}"
     )
+
+
+def test_isolation_check_does_not_flag_expanduser_without_tilde_argument() -> None:
+    """expanduser of a tilde-free string does not probe HOME and must not fire."""
+    source = (
+        "import os\n"
+        "def test_resolves_relative() -> None:\n"
+        "    target = os.path.expanduser('relative/path')\n"
+        "    assert target\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == [], f"tilde-free expanduser must not be flagged, got: {issues!r}"
+
+
+def test_isolation_check_flags_expanduser_with_tilde_argument() -> None:
+    """expanduser of a leading-tilde string resolves HOME and must fire."""
+    source = (
+        "import os\n"
+        "def test_reads_home() -> None:\n"
+        "    target = os.path.expanduser('~/.config/x')\n"
+        "    assert target\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("expanduser" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_path_constructor_expanduser_method() -> None:
+    """`Path('~/x').expanduser()` expands the home directory through the bound
+    Path object and must fire even though it bypasses the static probe chain."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_reads_dotfile() -> None:\n"
+        "    target = Path('~/x').expanduser()\n"
+        "    target.read_text()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("expanduser" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_aliased_path_constructor_expanduser_method() -> None:
+    """`from pathlib import Path as P` then `P('~/x').expanduser()` resolves the
+    constructor through alias canonicalization and must fire."""
+    source = (
+        "from pathlib import Path as P\n"
+        "def test_reads_dotfile() -> None:\n"
+        "    target = P('~/x').expanduser()\n"
+        "    target.read_text()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("expanduser" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_tempfile_named_temporary_file() -> None:
+    """`tempfile.NamedTemporaryFile()` allocates in the shared temp dir and must
+    fire as a temp-isolation probe."""
+    source = (
+        "import tempfile\n"
+        "def test_writes_named_temp() -> None:\n"
+        "    handle = tempfile.NamedTemporaryFile()\n"
+        "    handle.write(b'x')\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("NamedTemporaryFile" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_exempts_tempfile_factory_with_explicit_dir() -> None:
+    """A tempfile factory given an explicit `dir=` argument allocates under the
+    supplied sandbox, so it must not fire as a shared-temp isolation probe."""
+    source = (
+        "import tempfile\n"
+        "def test_writes_named_temp(tmp_path) -> None:\n"
+        "    handle = tempfile.NamedTemporaryFile(dir=tmp_path)\n"
+        "    handle.write(b'x')\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == []
+
+
+def test_isolation_check_flags_tempfile_factory_with_dir_constant_none() -> None:
+    """`dir=None` selects the default shared temp directory, so the factory
+    still allocates from shared temp and must fire."""
+    source = (
+        "import tempfile\n"
+        "def test_writes_named_temp() -> None:\n"
+        "    handle = tempfile.NamedTemporaryFile(dir=None)\n"
+        "    handle.write(b'x')\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("NamedTemporaryFile" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_tempfile_factory_with_dir_getenv_tmpdir() -> None:
+    """`dir=os.getenv('TMPDIR')` resolves to a shared-temp env source, so the
+    factory still allocates from shared temp and must fire."""
+    source = (
+        "import os\n"
+        "import tempfile\n"
+        "def test_makes_temp_dir() -> None:\n"
+        "    holder = tempfile.mkdtemp(dir=os.getenv('TMPDIR'))\n"
+        "    print(holder)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("mkdtemp" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_exempts_tempfile_factory_with_dir_tmp_path() -> None:
+    """`dir=tmp_path` allocates under the pytest sandbox, so the factory is
+    isolated and must not fire."""
+    source = (
+        "import tempfile\n"
+        "def test_makes_temp_dir(tmp_path) -> None:\n"
+        "    holder = tempfile.mkdtemp(dir=tmp_path)\n"
+        "    print(holder)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == []
+
+
+def test_isolation_check_flags_class_level_probe_in_nested_class_body() -> None:
+    """A Path.home() initializer in a nested class body runs at class-creation
+    time during the test, so it must fire."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_defines_inner_class() -> None:\n"
+        "    class Inner:\n"
+        "        root = Path.home()\n"
+        "    assert Inner is not None\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("Path.home" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_from_os_import_path_expanduser() -> None:
+    """`from os import path` binds `path` to `os.path`, so `path.expanduser`
+    must resolve to the canonical `os.path.expanduser` probe and fire."""
+    source = (
+        "from os import path\n"
+        "def test_reads_dotfile() -> None:\n"
+        "    target = path.expanduser('~/.config/x')\n"
+        "    open(target).read()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("expanduser" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_expandvars_with_windows_percent_userprofile() -> None:
+    """expandvars expands Windows `%USERPROFILE%` percent syntax, so a percent
+    reference to a home env var must fire."""
+    source = (
+        "import os\n"
+        "def test_expands_userprofile() -> None:\n"
+        "    target = os.path.expandvars('%USERPROFILE%\\\\.cfg')\n"
+        "    open(target).read()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("expandvars" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_ignores_expandvars_with_unrelated_windows_percent_var() -> None:
+    """A percent reference to an unrelated env var does not probe HOME/TMP and
+    must not fire."""
+    source = (
+        "import os\n"
+        "def test_expands_unrelated() -> None:\n"
+        "    token = os.path.expandvars('%MY_APP_TOKEN%')\n"
+        "    print(token)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == []
+
+
+def test_isolation_check_flags_environ_get_via_local_binding() -> None:
+    """`e = os.environ` then `e.get('HOME')` reads HOME through a local alias
+    and must fire just like the subscript `e['HOME']` form."""
+    source = (
+        "import os\n"
+        "def test_resolves_home() -> None:\n"
+        "    e = os.environ\n"
+        "    home = e.get('HOME')\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("HOME" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_scopes_path_bindings_to_their_own_test() -> None:
+    """A `p = Path('~/x')` binding in one test must not make an unrelated
+    `p.expanduser()` in a sibling test a finding; bindings are per-test."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_a() -> None:\n"
+        "    p = Path('~/x')\n"
+        "    p.expanduser()\n"
+        "def test_b(p) -> None:\n"
+        "    p.expanduser()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("test_a" in each_issue for each_issue in issues)
+    assert not any("test_b" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_scopes_environ_bindings_to_their_own_test() -> None:
+    """An `e = os.environ` binding in one test must not make an unrelated
+    `e['HOME']` in a sibling test a finding; bindings are per-test."""
+    source = (
+        "import os\n"
+        "def test_a() -> None:\n"
+        "    e = os.environ\n"
+        "    home = e['HOME']\n"
+        "    print(home)\n"
+        "def test_b(e) -> None:\n"
+        "    home = e['HOME']\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("test_a" in each_issue for each_issue in issues)
+    assert not any("test_b" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_ignores_path_constructor_expanduser_with_tilde_free_argument() -> None:
+    """`Path('/tmp/x').expanduser()` carries no leading tilde, so it expands no
+    home directory and must stay symmetric with `os.path.expanduser` of a
+    tilde-free literal — neither fires."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_resolves_absolute() -> None:\n"
+        "    target = Path('/tmp/x').expanduser()\n"
+        "    target.read_text()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == []
+
+
+def test_isolation_check_ignores_static_pathlib_expanduser_with_dynamic_argument() -> None:
+    """`pathlib.Path.expanduser(some_path)` with a non-constant argument cannot
+    be inspected for a leading tilde, so it follows the conservative rule and
+    does not fire — symmetric with `os.path.expanduser(some_path)`."""
+    source = (
+        "import pathlib\n"
+        "def test_resolves_dynamic(some_path) -> None:\n"
+        "    target = pathlib.Path.expanduser(some_path)\n"
+        "    target.read_text()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == []
+
+
+def test_isolation_check_flags_path_home_via_function_local_class_alias() -> None:
+    """`path_class = Path` then `path_class.home()` reaches the real home
+    directory through a per-test class alias and must fire just like the bare
+    `Path.home()` form."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_reads_home() -> None:\n"
+        "    path_class = Path\n"
+        "    home_dir = path_class.home()\n"
+        "    (home_dir / '.myapp').write_text('x')\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("home" in each_issue.lower() for each_issue in issues)
+
+
+def test_isolation_check_flags_getenv_via_function_local_callable_alias() -> None:
+    """`read_env = os.getenv` then `read_env('HOME')` reads HOME through a
+    per-test callable alias and must fire just like the bare `os.getenv('HOME')`
+    form."""
+    source = (
+        "import os\n"
+        "def test_reads_home() -> None:\n"
+        "    read_env = os.getenv\n"
+        "    home = read_env('HOME')\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("HOME" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_tempfile_spooled_temporary_file() -> None:
+    """`tempfile.SpooledTemporaryFile()` allocates in the shared temp dir and
+    must fire as a temp-isolation probe alongside the other tempfile factories."""
+    source = (
+        "import tempfile\n"
+        "def test_writes_spooled_temp() -> None:\n"
+        "    handle = tempfile.SpooledTemporaryFile()\n"
+        "    handle.write(b'x')\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("SpooledTemporaryFile" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_tempfile_gettempdirb() -> None:
+    """`tempfile.gettempdirb()` returns the shared temp dir as bytes and must
+    fire just like the string-returning `tempfile.gettempdir()`."""
+    source = (
+        "import tempfile\n"
+        "def test_resolves_temp_bytes() -> None:\n"
+        "    base = tempfile.gettempdirb()\n"
+        "    print(base)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("gettempdirb" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_flags_module_level_from_os_import_environ_subscript() -> None:
+    """A module-level `from os import environ` binds `environ` to `os.environ`,
+    so `environ['HOME']` inside a test must fire even without a per-test
+    local binding."""
+    source = (
+        "from os import environ\n"
+        "def test_resolves_home() -> None:\n"
+        "    home = environ['HOME']\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("HOME" in each_issue for each_issue in issues)
+
+
+def test_isolation_check_reports_probes_in_source_order_on_new_file() -> None:
+    """On a new file (``all_changed_lines is None``) every probe is in scope and
+    reported in source order — none dropped by the cap, which now trims only
+    out-of-scope advisory noise."""
+    probe_count = 20
+    repeated_probes = "\n".join(
+        f"    p{each_index} = Path.home()" for each_index in range(probe_count)
+    )
+    source = (
+        f"from pathlib import Path\ndef test_many_probes() -> None:\n{repeated_probes}\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    first_probe_line_number = 3
+    reported_line_numbers = [
+        int(each_issue.split(":", maxsplit=1)[0].removeprefix("Line ").strip())
+        for each_issue in issues
+    ]
+    expected_line_numbers = [
+        first_probe_line_number + each_offset for each_offset in range(probe_count)
+    ]
+    assert reported_line_numbers == expected_line_numbers
+
+
+def test_exempt_comment_rejects_noqa_prefixed_prose_lacking_boundary() -> None:
+    """A comment body that merely starts with `noqa` followed by non-boundary
+    characters is not a real noqa directive and must stay subject to the
+    no-new-comments rule."""
+    source = "x = compute()  # noqa-but-not-really: explanation\n"
+    issues = code_rules_enforcer.check_comments_python(source)
+    assert issues
+
+
+def test_exempt_comment_keeps_bare_and_coded_noqa_exempt() -> None:
+    """A bare `# noqa` and a coded `# noqa: E501` remain exempt under the
+    tightened boundary rule."""
+    bare_source = "x = compute()  # noqa\n"
+    coded_source = "x = compute()  # noqa: E501\n"
+    assert code_rules_enforcer.check_comments_python(bare_source) == []
+    assert code_rules_enforcer.check_comments_python(coded_source) == []
+
+
+def test_exempt_comment_keeps_colon_terminated_markers_without_trailing_space() -> None:
+    """A colon-terminated marker (`pylint:`, `type:`, `pragma:`) is self-bounded
+    by its own colon, so the directive stays exempt even when the next character
+    follows the colon immediately."""
+    pylint_source = "import os  # pylint:disable=unused-import\n"
+    type_ignore_source = "x = compute()  # type:ignore\n"
+    pragma_source = "x = compute()  # pragma:no-cover\n"
+    assert code_rules_enforcer.check_comments_python(pylint_source) == []
+    assert code_rules_enforcer.check_comments_python(type_ignore_source) == []
+    assert code_rules_enforcer.check_comments_python(pragma_source) == []
+
+
+def test_exempt_comment_still_flags_noqa_glued_to_prose_without_boundary() -> None:
+    """The colon-terminated allowance must not loosen the boundary rule for
+    markers that do not end in a colon: `# noqaFOO` still lacks a real boundary
+    after `noqa` and stays subject to the no-new-comments rule."""
+    source = "x = compute()  # noqaFOO\n"
+    assert code_rules_enforcer.check_comments_python(source)
+
+
+def test_banned_noun_word_skips_non_aliased_upstream_import() -> None:
+    """A non-aliased upstream import the author cannot rename
+    (`from typing import ItemsView`) must not be flagged, while an
+    author-coined alias still is."""
+    production_path = "packages/myapp/services/customer_pipeline.py"
+    upstream_issues = code_rules_enforcer.check_banned_noun_word_boundary(
+        "from typing import ItemsView\n", production_path
+    )
+    aliased_issues = code_rules_enforcer.check_banned_noun_word_boundary(
+        "import legacy_helper as cached_response\n", production_path
+    )
+    assert upstream_issues == []
+    assert any("cached_response" in each_issue for each_issue in aliased_issues)
+
+
+def test_function_length_message_does_not_cite_file_length_section() -> None:
+    """The blocking message must cite a function-length basis, not the
+    advisory file-length section (CODE_RULES §6.5)."""
+    assert "6.5" not in code_rules_enforcer.FUNCTION_LENGTH_BLOCKING_MESSAGE_SUFFIX
+    assert "Clean Code" in code_rules_enforcer.FUNCTION_LENGTH_BLOCKING_MESSAGE_SUFFIX
+
+
+def _function_node_named(source: str, function_name: str) -> ast.FunctionDef:
+    syntax_tree = ast.parse(source)
+    for each_node in syntax_tree.body:
+        if isinstance(each_node, ast.FunctionDef) and each_node.name == function_name:
+            return each_node
+    raise AssertionError(f"no function named {function_name!r} in source")
+
+
+def test_collect_pathlib_path_bindings_only_sees_the_scope_node_function() -> None:
+    """The Path-binding collector must scope its walk to the function node it
+    is given. A `p = Path('~/x')` binding in test_a must not appear when the
+    collector is handed test_b's node (test_b never binds `p` to a Path)."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_a() -> None:\n"
+        "    p = Path('~/x')\n"
+        "    p.expanduser()\n"
+        "def test_b(p) -> None:\n"
+        "    p.expanduser()\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    test_a_node = _function_node_named(source, "test_a")
+    test_b_node = _function_node_named(source, "test_b")
+
+    test_a_bindings = code_rules_enforcer._collect_pathlib_path_local_binding_names(
+        test_a_node, alias_map
+    )
+    test_b_bindings = code_rules_enforcer._collect_pathlib_path_local_binding_names(
+        test_b_node, alias_map
+    )
+
+    assert "p" in test_a_bindings
+    assert "p" not in test_b_bindings
+
+
+def test_collect_os_environ_bindings_only_sees_the_scope_node_function() -> None:
+    """The environ-binding collector must scope its walk to the function node
+    it is given. An `e = os.environ` binding in test_a must not appear when the
+    collector is handed test_b's node (test_b never binds `e`)."""
+    source = (
+        "import os\n"
+        "def test_a() -> None:\n"
+        "    e = os.environ\n"
+        "    home = e['HOME']\n"
+        "    print(home)\n"
+        "def test_b(e) -> None:\n"
+        "    home = e['HOME']\n"
+        "    print(home)\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    test_a_node = _function_node_named(source, "test_a")
+    test_b_node = _function_node_named(source, "test_b")
+
+    test_a_bindings = code_rules_enforcer._collect_os_environ_local_binding_names(
+        test_a_node, alias_map
+    )
+    test_b_bindings = code_rules_enforcer._collect_os_environ_local_binding_names(
+        test_b_node, alias_map
+    )
+
+    assert "e" in test_a_bindings
+    assert "e" not in test_b_bindings
+
+
+def test_function_local_from_os_import_environ_does_not_leak_into_sibling_test() -> None:
+    """bugbot-1: a function-local `from os import environ` in test_a binds
+    `environ` only for test_a's runtime. A sibling test_b that references the
+    bare name `environ` without importing it must not be flagged, while the
+    test that actually imports and probes HOME (test_a) must be flagged."""
+    source = (
+        "def test_a() -> None:\n"
+        "    from os import environ\n"
+        "    home = environ['HOME']\n"
+        "    print(home)\n"
+        "def test_b() -> None:\n"
+        "    home = environ['HOME']\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("test_a" in each_issue for each_issue in issues), (
+        f"test_a's own function-local environ import must be flagged, got: {issues!r}"
+    )
+    assert not any("test_b" in each_issue for each_issue in issues), (
+        "test_b references bare `environ` it never imports, so the function-local "
+        f"import in test_a must not leak into it, got: {issues!r}"
+    )
+
+
+def test_function_local_aliased_module_import_does_not_leak_into_sibling_test() -> None:
+    """bugbot-1 sibling: a function-local `import os as o` in test_a aliases
+    `o` only for test_a. test_b referencing `o.getenv('HOME')` without its own
+    import must not be flagged; test_a's own probe must be flagged."""
+    source = (
+        "def test_a() -> None:\n"
+        "    import os as o\n"
+        "    home = o.getenv('HOME')\n"
+        "    print(home)\n"
+        "def test_b() -> None:\n"
+        "    home = o.getenv('HOME')\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("test_a" in each_issue for each_issue in issues), (
+        f"test_a's own function-local aliased import must be flagged, got: {issues!r}"
+    )
+    assert not any("test_b" in each_issue for each_issue in issues), (
+        "test_b references alias `o` it never bound, so the function-local "
+        f"import in test_a must not leak into it, got: {issues!r}"
+    )
+
+
+def test_build_alias_map_excludes_function_local_imports() -> None:
+    """bugbot-1: the module-wide alias canonicalization map must be built only
+    from top-level imports. A function-local `import os as o` and a
+    function-local `from os import environ` must not appear in the shared map."""
+    source = (
+        "import tempfile as module_temp\n"
+        "def test_a() -> None:\n"
+        "    import os as o\n"
+        "    from os import environ\n"
+        "    print(o, environ)\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    assert alias_map.get("module_temp") == "tempfile", (
+        f"top-level alias must be recorded, got: {alias_map!r}"
+    )
+    assert "o" not in alias_map, (
+        f"function-local `import os as o` must not leak into the module map, got: {alias_map!r}"
+    )
+    assert "environ" not in alias_map, (
+        f"function-local `from os import environ` must not leak into the module map, got: {alias_map!r}"
+    )
+
+
+def test_module_level_from_os_import_environ_still_flags_every_referencing_test() -> None:
+    """bugbot-1 guard: a genuine module-level `from os import environ` binds the
+    name for the whole module, so every test that probes HOME through it must
+    still be flagged. The per-function scoping must not suppress this case."""
+    source = (
+        "from os import environ\n"
+        "def test_a() -> None:\n"
+        "    print(environ['HOME'])\n"
+        "def test_b() -> None:\n"
+        "    print(environ['HOME'])\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("test_a" in each_issue for each_issue in issues)
+    assert any("test_b" in each_issue for each_issue in issues), (
+        f"module-level import must flag every probing test, got: {issues!r}"
+    )
+
+
+def test_build_alias_map_excludes_class_body_imports() -> None:
+    """A probe alias imported inside a class body binds only inside that class
+    scope, so it must not enter the module-wide alias canonicalization map. A
+    genuine module-level alias in the same source must still be recorded."""
+    source = (
+        "import tempfile as module_temp\n"
+        "class TestAlpha:\n"
+        "    import tempfile as t\n"
+        "    def test_alpha_probe(self) -> None:\n"
+        "        assert self.t is not None\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    assert alias_map.get("module_temp") == "tempfile", (
+        f"top-level alias must be recorded, got: {alias_map!r}"
+    )
+    assert "t" not in alias_map, (
+        f"class-body `import tempfile as t` must not leak into the module map, got: {alias_map!r}"
+    )
+
+
+def test_class_body_aliased_import_does_not_leak_into_sibling_test() -> None:
+    """A class-body `import tempfile as t` aliases `t` only inside that class.
+    A sibling top-level test taking `t` as a parameter and calling `t.mkdtemp()`
+    must not be flagged, since the class-scoped alias never enters the
+    module-wide map."""
+    source = (
+        "class TestAlpha:\n"
+        "    import tempfile as t\n"
+        "    def test_alpha_probe(self) -> None:\n"
+        "        assert self.t is not None\n"
+        "def test_sibling(t) -> None:\n"
+        "    t.mkdtemp()\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert not any("test_sibling" in each_issue for each_issue in issues), (
+        "class-body alias must not leak into a sibling test through the "
+        f"module-wide map, got: {issues!r}"
+    )
+
+
+def test_build_alias_map_records_module_top_level_but_excludes_function_and_class_imports() -> None:
+    """Only true module-top-level imports enter the alias map. Imports lexically
+    inside a function body or a class body are excluded, while a module-level
+    try-guarded optional import is still recorded module-wide."""
+    source = (
+        "try:\n"
+        "    import tempfile as guarded_temp\n"
+        "except ImportError:\n"
+        "    guarded_temp = None\n"
+        "def test_function_local() -> None:\n"
+        "    import tempfile as function_temp\n"
+        "    assert function_temp is not None\n"
+        "class TestBeta:\n"
+        "    import tempfile as class_temp\n"
+        "    def test_beta_probe(self) -> None:\n"
+        "        assert self.class_temp is not None\n"
+    )
+    syntax_tree = ast.parse(source)
+    alias_map = code_rules_enforcer._build_alias_canonicalization_map(syntax_tree)
+    assert alias_map.get("guarded_temp") == "tempfile", (
+        f"module-level try-guarded alias must be recorded, got: {alias_map!r}"
+    )
+    assert "function_temp" not in alias_map, (
+        f"function-local alias must not enter the module map, got: {alias_map!r}"
+    )
+    assert "class_temp" not in alias_map, (
+        f"class-body alias must not enter the module map, got: {alias_map!r}"
+    )
+
+
+def _oversized_function_source(name: str) -> str:
+    body_line_count = code_rules_enforcer.FUNCTION_LENGTH_BLOCKING_THRESHOLD - 1
+    body_lines = [
+        f"    bound_{each_index} = {each_index}" for each_index in range(body_line_count)
+    ]
+    return f"def {name}() -> None:\n" + "\n".join(body_lines) + "\n"
+
+
+def test_function_length_edit_does_not_block_untouched_long_function() -> None:
+    """loop5-1: editing a short region of a file that already contains an
+    untouched oversized function must not produce a blocking function-length
+    violation at the PreToolUse layer."""
+    untouched_long_function = _oversized_function_source("untouched_long")
+    short_helper_before = "def short_helper() -> int:\n    return 1\n"
+    short_helper_after = "def short_helper() -> int:\n    return 2\n"
+    prior_full_file = untouched_long_function + "\n" + short_helper_before
+    post_edit_full_file = untouched_long_function + "\n" + short_helper_after
+    issues = code_rules_enforcer.validate_content(
+        short_helper_after,
+        "/project/src/edited_module.py",
+        old_content=short_helper_before,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    assert not any(
+        "untouched_long" in each_issue for each_issue in issues
+    ), f"untouched long function must not block on an unrelated edit, got: {issues!r}"
+
+
+def test_function_length_edit_blocks_function_grown_on_changed_lines() -> None:
+    """loop5-1: when the edit itself grows a function past the threshold, the
+    function-length violation must still block at the PreToolUse layer."""
+    short_function_before = "def grows_now() -> int:\n    return 1\n"
+    grown_function_after = _oversized_function_source("grows_now")
+    prior_full_file = short_function_before
+    post_edit_full_file = grown_function_after
+    issues = code_rules_enforcer.validate_content(
+        grown_function_after,
+        "/project/src/edited_module.py",
+        old_content=short_function_before,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    assert any(
+        "grows_now" in each_issue for each_issue in issues
+    ), f"function grown past threshold on changed lines must block, got: {issues!r}"
+
+
+def test_isolation_edit_does_not_block_untouched_probe() -> None:
+    """loop5-3: editing a short region of a test file that already contains an
+    untouched HOME probe must not block at the PreToolUse layer."""
+    untouched_probe_function = (
+        "def test_reads_home() -> None:\n"
+        "    target_path = Path.home()\n"
+        "    assert target_path\n"
+    )
+    short_test_before = "def test_addition() -> None:\n    assert 1 + 1 == 2\n"
+    short_test_after = "def test_addition() -> None:\n    assert 2 + 2 == 4\n"
+    header = "from pathlib import Path\n"
+    prior_full_file = header + untouched_probe_function + "\n" + short_test_before
+    post_edit_full_file = header + untouched_probe_function + "\n" + short_test_after
+    issues = code_rules_enforcer.validate_content(
+        short_test_after,
+        "/project/src/test_edited_module.py",
+        old_content=short_test_before,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    assert not any(
+        "test_reads_home" in each_issue for each_issue in issues
+    ), f"untouched isolation probe must not block on an unrelated edit, got: {issues!r}"
+
+
+def test_isolation_edit_blocks_probe_added_on_changed_lines() -> None:
+    """loop5-3: when the edit introduces a HOME probe, the isolation violation
+    must still block at the PreToolUse layer."""
+    test_before = "def test_writes() -> None:\n    assert True\n"
+    test_after = (
+        "def test_writes() -> None:\n"
+        "    target_path = Path.home()\n"
+        "    assert target_path\n"
+    )
+    header = "from pathlib import Path\n"
+    prior_full_file = header + test_before
+    post_edit_full_file = header + test_after
+    issues = code_rules_enforcer.validate_content(
+        test_after,
+        "/project/src/test_edited_module.py",
+        old_content=test_before,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    assert any(
+        "test_writes" in each_issue and "Path.home" in each_issue
+        for each_issue in issues
+    ), f"isolation probe added on changed lines must block, got: {issues!r}"
+
+
+def test_isolation_edit_blocks_probe_unisolated_by_signature_line_change() -> None:
+    """Removing the ``monkeypatch`` fixture from a test's signature line
+    un-isolates a HOME probe in its unchanged body; the violation must block
+    because the enclosing function's span covers the changed signature line."""
+    test_before = (
+        "def test_reads_home(monkeypatch) -> None:\n"
+        "    target_path = Path.home()\n"
+        "    assert target_path\n"
+    )
+    test_after = (
+        "def test_reads_home() -> None:\n"
+        "    target_path = Path.home()\n"
+        "    assert target_path\n"
+    )
+    header = "from pathlib import Path\n"
+    prior_full_file = header + test_before
+    post_edit_full_file = header + test_after
+    issues = code_rules_enforcer.validate_content(
+        test_after,
+        "/project/src/test_edited_module.py",
+        old_content=test_before,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    assert any(
+        "test_reads_home" in each_issue and "Path.home" in each_issue
+        for each_issue in issues
+    ), f"signature-line change that un-isolates a probe must block, got: {issues!r}"
+
+
+def test_isolation_message_carries_enclosing_function_definition_span() -> None:
+    """The isolation message must carry the enclosing test's definition line
+    and line span so the commit gate can scope by the same function span the
+    enforcer uses, while keeping the ``Line N:`` probe-line prefix intact."""
+    header = "from pathlib import Path\n"
+    test_body = (
+        "def test_reads_home() -> None:\n"
+        "    target_path = Path.home()\n"
+        "    assert target_path\n"
+    )
+    source = header + test_body
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    definition_line = 2
+    function_span = 3
+    expected_span_fragment = (
+        f"(defined at line {definition_line}, spanning {function_span} lines)"
+    )
+    assert any(
+        each_issue.startswith("Line ") and expected_span_fragment in each_issue
+        for each_issue in issues
+    ), f"isolation message must carry the def-line + span fragment, got: {issues!r}"
+
+
+def test_function_length_reports_only_in_scope_violation_on_terminal_edit() -> None:
+    """A terminal diff-scoped Edit reports only the function whose changed-line
+    span grew past the threshold; untouched oversized functions earlier in the
+    file are out of scope and dropped, regardless of how many precede it."""
+    leading_function_count = 6
+    leading_functions = "\n".join(
+        _oversized_function_source(f"leading_long_{each_index}")
+        for each_index in range(leading_function_count)
+    )
+    short_target_before = "def target_function() -> int:\n    return 1\n"
+    grown_target_after = _oversized_function_source("target_function")
+    prior_full_file = leading_functions + "\n" + short_target_before
+    post_edit_full_file = leading_functions + "\n" + grown_target_after
+    issues = code_rules_enforcer.validate_content(
+        grown_target_after,
+        "/project/src/many_functions.py",
+        old_content=short_target_before,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    function_length_issues = [
+        each_issue for each_issue in issues if "defined at line" in each_issue
+    ]
+    assert any(
+        "target_function" in each_issue for each_issue in function_length_issues
+    ), f"in-scope grown function must still block, got: {issues!r}"
+    assert not any(
+        "leading_long_" in each_issue for each_issue in function_length_issues
+    ), f"untouched functions must stay out of scope, got: {function_length_issues!r}"
+
+
+def test_new_file_write_reports_every_in_scope_long_function_uncapped() -> None:
+    """loop7-bugbot: a new-file Write passes ``all_changed_lines is None``; every
+    line was just authored and is in scope, so every long function is reported
+    with no ceiling on the count."""
+    function_count = 6
+    all_functions = "\n".join(
+        _oversized_function_source(f"new_long_{each_index}")
+        for each_index in range(function_count)
+    )
+    issues = code_rules_enforcer.validate_content(
+        all_functions,
+        "/project/src/freshly_written_module.py",
+        old_content="",
+    )
+    function_length_issues = [
+        each_issue for each_issue in issues if "defined at line" in each_issue
+    ]
+    assert len(function_length_issues) == function_count, (
+        "every long function in a new file is in scope and must be reported, "
+        f"got: {function_length_issues!r}"
+    )
+
+
+def test_new_file_write_reports_every_in_scope_isolation_probe_uncapped() -> None:
+    """loop7-bugbot: a new test file Write passes ``all_changed_lines is None``;
+    every HOME probe is in scope, so each one is reported with no count ceiling."""
+    probe_count = 6
+    probing_tests = "".join(
+        f"def test_probe_{each_index}() -> None:\n"
+        f"    home_dir_{each_index} = Path.home()\n"
+        f"    assert home_dir_{each_index}\n"
+        for each_index in range(probe_count)
+    )
+    source = "from pathlib import Path\n" + probing_tests
+    issues = code_rules_enforcer.validate_content(
+        source,
+        "/project/src/test_freshly_written_module.py",
+        old_content="",
+    )
+    home_probe_issues = [
+        each_issue for each_issue in issues if "Path.home" in each_issue
+    ]
+    assert len(home_probe_issues) == probe_count, (
+        "every HOME probe in a new test file is in scope and must be reported, "
+        f"got: {home_probe_issues!r}"
+    )
+
+
+def test_banned_noun_word_defers_scope_to_caller_when_requested() -> None:
+    """loop7-P1: when the gate sets the deferral flag, the banned-noun check must
+    return every violation so ``split_violations_by_scope`` can scope by added
+    line before reporting the in-scope set."""
+    binding_count = 5
+    source = "".join(
+        f"BINDING_{each_index}_RESULT_PATH = {each_index}\n"
+        for each_index in range(binding_count)
+    )
+    issues = code_rules_enforcer.check_banned_noun_word_boundary(
+        source,
+        "/project/src/many_nouns.py",
+        defer_scope_to_caller=True,
+    )
+    assert len(issues) == binding_count, (
+        "deferral must return every banned-noun violation, "
+        f"got: {issues!r}"
+    )
+
+
+def test_banned_noun_word_keeps_in_scope_binding_among_untouched_ones() -> None:
+    """loop7-P1: an Edit whose changed line introduces a banned-noun identifier
+    among several pre-existing untouched ones must still report the new in-scope
+    binding while leaving the untouched bindings out of scope."""
+    leading_count = 5
+    leading_bindings = "".join(
+        f"LEADING_{each_index}_RESULT_PATH = {each_index}\n"
+        for each_index in range(leading_count)
+    )
+    target_before = "PLACEHOLDER_NAME = 0\n"
+    target_after = "INTRODUCED_RESULT_PATH = 0\n"
+    prior_full_file = leading_bindings + target_before
+    post_edit_full_file = leading_bindings + target_after
+    issues = code_rules_enforcer.validate_content(
+        target_after,
+        "/project/src/many_nouns.py",
+        old_content=target_before,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    assert any(
+        "INTRODUCED_RESULT_PATH" in each_issue for each_issue in issues
+    ), f"in-scope banned-noun past the cap window must still block, got: {issues!r}"
+
+
+def test_module_import_inside_top_level_try_is_retained_in_alias_map() -> None:
+    """loop7-P2 (2566): a module-level ``try: import os as o`` is genuinely
+    module-scoped; its alias must enter the shared canonicalization map so a
+    later ``o.path.expanduser('~')`` inside a test is flagged."""
+    source = (
+        "try:\n"
+        "    import os as o\n"
+        "except ImportError:\n"
+        "    o = None\n"
+        "def test_reads_home() -> None:\n"
+        "    discovered = o.path.expanduser('~')\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_optional_import.py"
+    )
+    assert any(
+        "test_reads_home" in each_issue for each_issue in issues
+    ), f"module import nested in top-level try must be retained, got: {issues!r}"
+
+
+def test_direct_module_aliased_import_is_retained_in_alias_map() -> None:
+    """loop7-P2 (2566): a plain top-level ``import os as o`` must still resolve so
+    ``o.path.expanduser('~')`` inside a test is flagged."""
+    source = (
+        "import os as o\n"
+        "def test_reads_home() -> None:\n"
+        "    discovered = o.path.expanduser('~')\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_direct_import.py"
+    )
+    assert any(
+        "test_reads_home" in each_issue for each_issue in issues
+    ), f"direct module aliased import must resolve, got: {issues!r}"
+
+
+def test_function_local_import_does_not_enter_shared_alias_map() -> None:
+    """loop7-P2 (2566): an import inside one test must not canonicalize a
+    same-named reference in a sibling test that never imported it."""
+    source = (
+        "def test_imports_locally() -> None:\n"
+        "    import os as o\n"
+        "    assert o\n"
+        "def test_sibling_uses_o() -> None:\n"
+        "    o = make_unrelated_object()\n"
+        "    discovered = o.path.expanduser('~')\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_local_import_scope.py"
+    )
+    assert not any(
+        "test_sibling_uses_o" in each_issue for each_issue in issues
+    ), f"function-local import must not leak to a sibling test, got: {issues!r}"
+
+
+def test_import_inside_nested_helper_does_not_leak_to_outer_test_overlay() -> None:
+    """loop7-P2 (2690): an import inside a standalone nested helper runs in its own
+    callable scope; its alias must not enter the outer test's overlay and flag a
+    sibling reference in the outer body."""
+    source = (
+        "def test_outer() -> None:\n"
+        "    def nested_helper() -> None:\n"
+        "        import os as o\n"
+        "        assert o\n"
+        "    o = make_unrelated_object()\n"
+        "    discovered = o.path.expanduser('~')\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_nested_helper_scope.py"
+    )
+    assert not any(
+        "test_outer" in each_issue for each_issue in issues
+    ), f"nested-helper import must not leak to the outer test, got: {issues!r}"
+
+
+def test_environ_binding_inside_nested_helper_does_not_leak_to_outer_test() -> None:
+    """loop7-P2 (2690 sibling): an ``os.environ`` binding inside a standalone
+    nested helper runs in its own scope; a same-named outer reference must not be
+    attributed to that binding."""
+    source = (
+        "import os\n"
+        "def test_outer() -> None:\n"
+        "    def nested_helper() -> None:\n"
+        "        captured = os.environ\n"
+        "        assert captured\n"
+        "    captured = make_unrelated_mapping()\n"
+        "    discovered = captured['HOME']\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_environ_nested_scope.py"
+    )
+    assert not any(
+        "test_outer" in each_issue for each_issue in issues
+    ), f"nested-helper environ binding must not leak to the outer test, got: {issues!r}"
+
+
+def test_pathlib_binding_inside_nested_helper_does_not_leak_to_outer_test() -> None:
+    """loop7-P2 (2690 sibling): a home-tilde ``Path('~')`` binding inside a
+    standalone nested helper runs in its own scope; a same-named outer
+    ``.expanduser()`` call must not be attributed to that binding."""
+    source = (
+        "from pathlib import Path\n"
+        "def test_outer() -> None:\n"
+        "    def nested_helper() -> None:\n"
+        "        candidate = Path('~/config')\n"
+        "        assert candidate\n"
+        "    candidate = make_unrelated_path()\n"
+        "    discovered = candidate.expanduser()\n"
+        "    assert discovered\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_pathlib_nested_scope.py"
+    )
+    assert not any(
+        "test_outer" in each_issue for each_issue in issues
+    ), f"nested-helper pathlib binding must not leak to the outer test, got: {issues!r}"
+
+
+def test_banned_noun_edit_drops_untouched_out_of_scope_binding() -> None:
+    """An Edit that touches none of the banned-noun bindings reports nothing —
+    the check now routes through the reconstructed effective content and the
+    edit's changed lines, exactly like check_function_length, so an untouched
+    binding outside the edit hunk must not block."""
+    leading = "".join(
+        f"LEADING_{each_index}_RESULT_PATH = {each_index}\n" for each_index in range(5)
+    )
+    edited_tail = "def compute_total() -> int:\n    running_sum = 0\n    return running_sum\n"
+    prior_full_file = leading + "def compute_total() -> int:\n    running_sum = 0\n    return 0\n"
+    post_edit_full_file = leading + edited_tail
+    issues = code_rules_enforcer.validate_content(
+        edited_tail,
+        "/project/src/many_nouns.py",
+        old_content="def compute_total() -> int:\n    running_sum = 0\n    return 0\n",
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    assert not any(
+        "RESULT_PATH" in each_issue for each_issue in issues
+    ), f"untouched banned-noun bindings must stay out of scope, got: {issues!r}"
+
+
+def test_banned_noun_edit_keeps_touched_binding_in_scope() -> None:
+    """An Edit whose changed line introduces a banned-noun binding reports it,
+    using the reconstructed effective content and the edit's changed lines."""
+    leading = "".join(
+        f"LEADING_{each_index}_VALUE_PATH = {each_index}\n" for each_index in range(5)
+    )
+    prior_tail = "PLACEHOLDER_NAME = 0\n"
+    edited_tail = "INTRODUCED_RESULT_PATH = 0\n"
+    prior_full_file = leading + prior_tail
+    post_edit_full_file = leading + edited_tail
+    issues = code_rules_enforcer.validate_content(
+        edited_tail,
+        "/project/src/introduces_noun.py",
+        old_content=prior_tail,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    assert any(
+        "INTRODUCED_RESULT_PATH" in each_issue for each_issue in issues
+    ), f"introduced banned-noun binding must block, got: {issues!r}"
+
+
+def test_banned_noun_message_carries_binding_line_span() -> None:
+    """A banned-noun binding carries its own binding line as a one-line span so
+    the commit gate reconstructs it through the same shared span mechanism the
+    other diff-scoped checks use, while keeping the Line N: prefix intact. The
+    binding-line granularity matches the companion exact-match
+    check_banned_identifiers and avoids re-flagging a pre-existing binding when
+    an unrelated line of its enclosing function is edited."""
+    source = (
+        "def aggregate() -> list[int]:\n"
+        "    canned_results = [1, 2, 3]\n"
+        "    return canned_results\n"
+    )
+    issues = code_rules_enforcer.check_banned_noun_word_boundary(
+        source, "/project/src/has_noun.py"
+    )
+    binding_line = 2
+    expected_fragment = f"(binding span at line {binding_line}, spanning 1 lines)"
+    assert any(
+        each_issue.startswith(f"Line {binding_line}:") and expected_fragment in each_issue
+        for each_issue in issues
+    ), f"banned-noun message must carry the binding-line span fragment, got: {issues!r}"
+
+
+def test_banned_noun_message_module_level_binding_spans_one_line() -> None:
+    """A module-level banned-noun binding spans its own binding line alone
+    (span 1)."""
+    source = "SAFE_OUTPUT_PATH = '/var/run/x'\n"
+    issues = code_rules_enforcer.check_banned_noun_word_boundary(
+        source, "/project/src/module_noun.py"
+    )
+    expected_fragment = "(binding span at line 1, spanning 1 lines)"
+    assert any(expected_fragment in each_issue for each_issue in issues), (
+        f"module-level banned-noun span must be one line, got: {issues!r}"
+    )
+
+
+def test_banned_noun_edit_does_not_reflag_param_when_unrelated_body_line_changes() -> None:
+    """Editing a body line of a function that already has a banned-noun
+    parameter must not re-flag that pre-existing parameter: the binding-line
+    span keeps the parameter out of scope unless its own declaration line is in
+    the changed set."""
+    prior_full_file = (
+        "def transform(canned_results: int) -> int:\n"
+        "    midpoint = canned_results\n"
+        "    return midpoint\n"
+    )
+    post_edit_full_file = (
+        "def transform(canned_results: int) -> int:\n"
+        "    midpoint = canned_results + 1\n"
+        "    return midpoint\n"
+    )
+    issues = code_rules_enforcer.validate_content(
+        "    midpoint = canned_results + 1\n",
+        "/project/src/has_param.py",
+        old_content="    midpoint = canned_results\n",
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+    assert not any(
+        "canned_results" in each_issue for each_issue in issues
+    ), f"pre-existing param must not re-flag on unrelated body edit, got: {issues!r}"
+
+
+def test_unreadable_prior_yields_no_prior_and_no_reconstruction() -> None:
+    """When the on-disk prior cannot be read for an Edit, the prior/post helper
+    returns (None, None): a missing prior must not be fabricated as an empty
+    string that would diff every line as changed and defeat edit scoping."""
+    missing_path = "/project/src/does_not_exist_anywhere.py"
+    prior_content, post_edit_content = code_rules_enforcer.prior_and_post_edit_content(
+        missing_path,
+        old_string="placeholder = 0\n",
+        new_string="placeholder = 1\n",
+    )
+    assert prior_content is None
+    assert post_edit_content is None
+
+
+def test_readable_prior_yields_consistent_prior_and_reconstruction(tmp_path) -> None:
+    """When the prior reads cleanly, the helper returns the same prior content it
+    reconstructed the post-edit view from, so the two never diverge across two
+    independent reads."""
+    source_file = tmp_path / "module.py"
+    original = "alpha = 1\nbeta = 2\n"
+    source_file.write_text(original, encoding="utf-8")
+    prior_content, post_edit_content = code_rules_enforcer.prior_and_post_edit_content(
+        str(source_file),
+        old_string="beta = 2\n",
+        new_string="beta = 3\n",
+    )
+    assert prior_content == original
+    assert post_edit_content == "alpha = 1\nbeta = 3\n"
+    changed = code_rules_enforcer.changed_line_numbers(prior_content, post_edit_content)
+    assert changed == {2}
+
+
+def _run_main_with_edit_payload(
+    file_path: str,
+    old_string: str,
+    new_string: str,
+    monkeypatch: object,
+    capsys: object,
+) -> str:
+    """Drive ``main()`` through its stdin entry point for an Edit and return stdout.
+
+    Args:
+        file_path: The on-disk path the Edit targets.
+        old_string: The Edit's ``old_string`` fragment.
+        new_string: The Edit's ``new_string`` fragment.
+        monkeypatch: The pytest fixture used to redirect ``sys.stdin``.
+        capsys: The pytest fixture used to capture the deny payload on stdout.
+
+    Returns:
+        The captured stdout, which holds the deny payload when violations fire.
+    """
+    edit_payload = json.dumps(
+        {
+            "tool_name": "Edit",
+            "tool_input": {
+                "file_path": file_path,
+                "old_string": old_string,
+                "new_string": new_string,
+            },
+        }
+    )
+    getattr(monkeypatch, "setattr")(code_rules_enforcer.sys, "stdin", io.StringIO(edit_payload))
+    try:
+        code_rules_enforcer.main()
+    except SystemExit:
+        pass
+    captured = getattr(capsys, "readouterr")()
+    return captured.out
+
+
+def test_edit_with_missing_old_string_runs_whole_file_against_on_disk_content(
+    tmp_path_factory: object, monkeypatch: object, capsys: object,
+) -> None:
+    """When an Edit's old_string is absent from the file, ``prior_and_post_edit_content``
+    yields ``(None, None)``; ``main()`` must analyze the real on-disk file whole-file
+    rather than the new_string fragment, so an oversized function elsewhere in the
+    file is still reported with its true line numbers."""
+    production_directory = getattr(tmp_path_factory, "mktemp")("production_pkg")
+    untouched_long_function = _oversized_function_source("untouched_long")
+    short_helper = "def short_helper() -> int:\n    return 1\n"
+    on_disk_content = untouched_long_function + "\n" + short_helper
+    source_file = production_directory / "edited_module.py"
+    source_file.write_text(on_disk_content, encoding="utf-8")
+    absent_fragment_old = "def absent_function() -> int:\n    return 0\n"
+    short_fragment_new = "def absent_function() -> int:\n    return 2\n"
+    stdout = _run_main_with_edit_payload(
+        str(source_file), absent_fragment_old, short_fragment_new, monkeypatch, capsys,
+    )
+    assert "untouched_long" in stdout, (
+        "an unreconstructable Edit must fall back to whole-file on-disk analysis, "
+        f"so the oversized function is still reported; got stdout: {stdout!r}"
+    )
+
+
+def test_edit_with_unreadable_file_does_not_analyze_fragment_as_whole_file(
+    tmp_path_factory: object, monkeypatch: object, capsys: object,
+) -> None:
+    """When the on-disk file cannot be read, no well-defined post-edit content
+    exists; ``main()`` must exit cleanly rather than analyze the new_string
+    fragment as if it were the whole file, so the fragment's own function-length
+    violation does not surface as a deny payload."""
+    production_directory = getattr(tmp_path_factory, "mktemp")("production_pkg")
+    missing_path = str(production_directory / "never_created.py")
+    oversized_fragment_old = "def grows() -> int:\n    return 0\n"
+    oversized_fragment_new = _oversized_function_source("grows")
+    stdout = _run_main_with_edit_payload(
+        missing_path,
+        oversized_fragment_old,
+        oversized_fragment_new,
+        monkeypatch,
+        capsys,
+    )
+    assert stdout == "", (
+        "an unreadable Edit target has no well-defined whole-file content, so the "
+        f"fragment must not be analyzed as the whole file; got stdout: {stdout!r}"
+    )
+
+
+def test_isolation_check_exempts_usefixtures_monkeypatch_decorator() -> None:
+    """A test isolated via ``@pytest.mark.usefixtures("monkeypatch")`` injects the
+    monkeypatch fixture without a signature parameter and must be exempt from the
+    HOME/TMP probe, mirroring the signature-parameter suppression."""
+    source = (
+        "import os\n"
+        "import pytest\n"
+        "@pytest.mark.usefixtures('monkeypatch')\n"
+        "def test_reads_home() -> None:\n"
+        "    home = os.environ['HOME']\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert issues == [], (
+        "a test decorated with usefixtures('monkeypatch') is isolated and must "
+        f"not be flagged; got: {issues!r}"
+    )
+
+
+def test_isolation_check_still_flags_usefixtures_without_monkeypatch() -> None:
+    """``@pytest.mark.usefixtures("tmp_path")`` does not inject monkeypatch, so a
+    HOME probe in its body must still be flagged."""
+    source = (
+        "import os\n"
+        "import pytest\n"
+        "@pytest.mark.usefixtures('tmp_path')\n"
+        "def test_reads_home() -> None:\n"
+        "    home = os.environ['HOME']\n"
+        "    print(home)\n"
+    )
+    issues = code_rules_enforcer.check_tests_use_isolated_filesystem_paths(
+        source, "/project/src/test_module.py"
+    )
+    assert any("HOME" in each_issue for each_issue in issues), (
+        "usefixtures('tmp_path') does not intercept env reads, so the HOME probe "
+        f"must still be flagged; got: {issues!r}"
+    )
+
+
+def test_banned_noun_word_boundary_flags_plural_results_identifier() -> None:
+    """A plural banned noun ('results') embedded in an identifier must flag.
+
+    ``ALL_BANNED_NOUN_WORDS`` contains plural forms (results, outputs,
+    responses, values, items) in addition to the singular nouns, so an
+    identifier such as ``canned_results`` is flagged even though no singular
+    exact-match identifier appears.
+    """
+    source = "canned_results = []\n"
+    issues = code_rules_enforcer.check_banned_noun_word_boundary(
+        source, "/project/src/pipeline.py"
+    )
+    assert any("canned_results" in each_issue for each_issue in issues), (
+        "a plural banned-noun identifier must be flagged by the word-boundary "
+        f"check; got: {issues!r}"
+    )