claude-dev-env 1.90.0 → 1.92.0

package/hooks/blocking/test_verified_commit_gate.py

@@ -12,6 +12,7 @@ import os
 import pathlib
 import subprocess
 import sys
+from collections.abc import Callable
 
 import pytest
 
@@ -568,3 +569,13 @@ def test_minted_verdict_from_other_worktree_with_wrong_hash_denies(
     deny_reason = deny_reason_for_directory(str(work_dir), str(transcript_path))
     assert deny_reason is not None
     assert "VERIFIED_COMMIT_GATE" in deny_reason
+
+
+def test_gate_imports_under_foreign_config_shadow(
+    run_under_config_shadow: Callable[[str], subprocess.CompletedProcess[str]],
+) -> None:
+    completed_probe = run_under_config_shadow(
+        "import verified_commit_gate\nprint('IMPORT_OK')\n"
+    )
+    assert completed_probe.returncode == 0, completed_probe.stderr
+    assert "IMPORT_OK" in completed_probe.stdout

package/hooks/blocking/test_verifier_verdict_minter.py

@@ -21,6 +21,7 @@ import json
 import pathlib
 import subprocess
 import sys
+from collections.abc import Callable
 
 _HOOK_DIR = pathlib.Path(__file__).parent
 if str(_HOOK_DIR) not in sys.path:
@@ -389,3 +390,13 @@ def test_attested_manifest_hash_binds_over_cwd_surface(tmp_path: pathlib.Path) -
     finally:
         if verdict_path is not None and verdict_path.exists():
             verdict_path.unlink()
+
+
+def test_minter_imports_under_foreign_config_shadow(
+    run_under_config_shadow: Callable[[str], subprocess.CompletedProcess[str]],
+) -> None:
+    completed_probe = run_under_config_shadow(
+        "import verifier_verdict_minter\nprint('IMPORT_OK')\n"
+    )
+    assert completed_probe.returncode == 0, completed_probe.stderr
+    assert "IMPORT_OK" in completed_probe.stdout

package/hooks/blocking/verdict_directory_write_blocker.py

@@ -41,6 +41,12 @@ hooks_directory = str(Path(__file__).resolve().parent.parent)
 if hooks_directory not in sys.path:
     sys.path.append(hooks_directory)
 
+from verified_commit_config_bootstrap import (  # noqa: E402
+    register_verified_commit_constants,
+)
+
+register_verified_commit_constants()
+
 from config.verified_commit_constants import (  # noqa: E402
     ALL_GATED_TOOL_NAMES,
     ALL_VERDICT_PATH_SEGMENT_BODIES,

package/hooks/blocking/verification_verdict_store.py

@@ -25,14 +25,22 @@ blocking_directory = str(Path(__file__).resolve().parent)
 if blocking_directory not in sys.path:
     sys.path.insert(0, blocking_directory)
 
+from verified_commit_config_bootstrap import (  # noqa: E402
+    register_verified_commit_constants,
+)
+
+register_verified_commit_constants()
+
 from config.verified_commit_constants import (
     AGENT_META_SIDECAR_SUFFIX,
     AGENT_META_TYPE_KEY,
     AGENT_TRANSCRIPT_GLOB,
     BRANCH_REFERENCE_PREFIX,
+    BRANCH_REMOTE_CONFIG_KEY_TEMPLATE,
     BRANCH_WORKTREE_ABSENT_MESSAGE,
     CLAUDE_HOME_DIRECTORY_NAME,
     CONFTEST_FILE_NAME,
+    DETACHED_HEAD_LABEL,
     DOCS_ONLY_EXTENSIONS,
     ALL_FALLBACK_BASE_REFERENCES,
     EMPTY_SURFACE_GUARD_MESSAGE,
@@ -122,13 +130,65 @@ def _tracked_upstream_reference(repo_root: str) -> str | None:
     )
 
 
+def _head_branch_name(repo_root: str) -> str | None:
+    """Read the short name of the branch HEAD points at.
+
+    Args:
+        repo_root: The repository top-level directory.
+
+    Returns:
+        The short branch name, or None when HEAD is detached or git fails.
+    """
+    branch_name = run_git(repo_root, "rev-parse", "--abbrev-ref", "HEAD")
+    if not branch_name or branch_name == DETACHED_HEAD_LABEL:
+        return None
+    return branch_name
+
+
+def _upstream_is_own_remote_counterpart(repo_root: str, tracked_upstream: str) -> bool:
+    """Decide whether HEAD's upstream is the current branch's own remote ref.
+
+    ::
+
+        branch feature  tracks origin/feature   -> True   (own counterpart)
+        branch feature  tracks origin/develop   -> False  (different branch)
+
+    A branch tracking its own remote counterpart makes the merge base against
+    that ref resolve to the branch tip itself, masking the branch's real state
+    versus the default branch — so the caller ranks that ref below the
+    default-branch fallbacks.
+
+    Args:
+        repo_root: The repository top-level directory.
+        tracked_upstream: HEAD's configured upstream tracking reference.
+
+    Returns:
+        True when the upstream names ``<remote>/<current-branch>``; False when
+        it names a different branch, HEAD is detached, or git fails.
+    """
+    branch_name = _head_branch_name(repo_root)
+    if branch_name is None:
+        return False
+    configured_remote = run_git(
+        repo_root, "config", BRANCH_REMOTE_CONFIG_KEY_TEMPLATE.format(branch_name=branch_name)
+    )
+    if not configured_remote:
+        return False
+    return tracked_upstream == f"{configured_remote}/{branch_name}"
+
+
 def candidate_base_references(repo_root: str) -> tuple[str, ...]:
     """Collect the upstream references to probe for the merge base, in order.
 
-    Probes ``origin/HEAD`` first, then HEAD's configured upstream tracking
-    reference (so a non-standard default branch like ``origin/develop`` is
-    found regardless of its name), then the fixed ``origin/main`` /
-    ``origin/master`` fallbacks for checkouts with no tracking ref set.
+    Probes ``origin/HEAD`` first, then a tracked upstream that names a
+    different branch (so a differently-named default like ``origin/develop`` is
+    found), then the fixed ``origin/main`` / ``origin/master`` fallbacks. A
+    tracked upstream that is the current branch's own remote counterpart
+    (``origin/<current-branch>``) ranks last, below the fallbacks: on a PR
+    branch whose fork carries ``origin/main`` the merge base comes from
+    ``origin/main`` rather than the branch's stale pushed ref, while a repo
+    whose default branch is the tracked branch itself (no ``origin/main`` or
+    ``origin/master`` present) still falls through to that own-counterpart ref.
 
     Args:
         repo_root: The repository top-level directory.
@@ -138,10 +198,18 @@ def candidate_base_references(repo_root: str) -> tuple[str, ...]:
     """
     upstream_head = run_git(repo_root, "symbolic-ref", "--quiet", "refs/remotes/origin/HEAD")
     tracked_upstream = _tracked_upstream_reference(repo_root)
+    high_priority_upstream: tuple[str, ...] = ()
+    demoted_upstream: tuple[str, ...] = ()
+    if tracked_upstream:
+        if _upstream_is_own_remote_counterpart(repo_root, tracked_upstream):
+            demoted_upstream = (tracked_upstream,)
+        else:
+            high_priority_upstream = (tracked_upstream,)
     ordered_references = (
         ((upstream_head,) if upstream_head else ())
-        + ((tracked_upstream,) if tracked_upstream else ())
+        + high_priority_upstream
         + ALL_FALLBACK_BASE_REFERENCES
+        + demoted_upstream
     )
     return tuple(dict.fromkeys(ordered_references))
 

package/hooks/blocking/verified_commit_config_bootstrap.py

@@ -0,0 +1,51 @@
+"""Deterministic loader for the verified-commit constants module.
+
+The blocking hooks import their shared constants as
+``from config.verified_commit_constants import ...``. In the installed hook
+tree a second, unrelated ``config`` package can sit ahead of this package on
+``sys.path`` and win that dotted name by path order, so the import binds to the
+wrong file and raises ImportError on any constant the stale copy lacks. This
+module binds the dotted name to the sibling ``config/verified_commit_constants``
+file by explicit location, so resolution never depends on ``sys.path`` order.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+
+
+def register_verified_commit_constants() -> None:
+    """Bind ``config.verified_commit_constants`` to the sibling config file.
+
+    ::
+
+        sys.path = ["<installed hooks>", "<blocking>"]  # foreign config first
+        register_verified_commit_constants()
+        from config.verified_commit_constants import DETACHED_HEAD_LABEL
+        ok: bound to <blocking>/config/verified_commit_constants.py
+
+    A ``from config.verified_commit_constants import`` that follows this call
+    reads the entry straight from ``sys.modules``, so it resolves to this file
+    whatever else owns the ``config`` name. An entry already cached is left in
+    place, so the call is idempotent and never displaces a module a caller
+    loaded on purpose.
+
+    Returns:
+        None. The effect is the ``sys.modules`` registration.
+    """
+    config_module_dotted_name = "config.verified_commit_constants"
+    if config_module_dotted_name in sys.modules:
+        return
+    constants_file_path = (
+        Path(__file__).resolve().parent / "config" / "verified_commit_constants.py"
+    )
+    module_spec = importlib.util.spec_from_file_location(
+        config_module_dotted_name, constants_file_path
+    )
+    if module_spec is None or module_spec.loader is None:
+        return
+    constants_module = importlib.util.module_from_spec(module_spec)
+    sys.modules[config_module_dotted_name] = constants_module
+    module_spec.loader.exec_module(constants_module)

package/hooks/blocking/verified_commit_gate.py

@@ -42,6 +42,12 @@ _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
+from verified_commit_config_bootstrap import (  # noqa: E402
+    register_verified_commit_constants,
+)
+
+register_verified_commit_constants()
+
 from config.verified_commit_constants import (
     ALL_GIT_BINARY_NAMES,
     CORRECTIVE_MESSAGE,

package/hooks/blocking/verifier_verdict_minter.py

@@ -35,6 +35,12 @@ blocking_directory = str(Path(__file__).resolve().parent)
 if blocking_directory not in sys.path:
     sys.path.insert(0, blocking_directory)
 
+from verified_commit_config_bootstrap import (  # noqa: E402
+    register_verified_commit_constants,
+)
+
+register_verified_commit_constants()
+
 from config.verified_commit_constants import (
     MINTING_AGENT_TYPE,
     VERDICT_KEY_MANIFEST_SHA256,

package/hooks/hooks.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 -c \"import sys; sys.path.insert(0, r'${CLAUDE_PLUGIN_ROOT}/hooks'); from validators.run_all_validators import main; sys.exit(main())\"",
+            "command": "python3 -c \"import sys; sys.path.insert(0, r'${CLAUDE_PLUGIN_ROOT}/hooks'); from validators.run_all_validators import main; sys.exit(main())\" --pre-tool-use",
             "timeout": 15
           }
         ]
@@ -55,6 +55,11 @@
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/gh_body_arg_blocker.py",
             "timeout": 10
           },
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/nas_ssh_binary_enforcer.py",
+            "timeout": 10
+          },
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/volatile_path_in_post_blocker.py",
@@ -88,7 +93,7 @@
           {
             "type": "command",
             "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/pr_description_enforcer.py",
-            "timeout": 10
+            "timeout": 30
           },
           {
             "type": "command",

package/hooks/hooks_constants/CLAUDE.md

@@ -38,6 +38,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `js_conventions_constants.py` | Banned identifier set, boolean-prefix pattern, and declaration/JSDoc patterns for the JavaScript convention checks |
 | `messages.py` | Short user-facing notice strings shown when a Stop hook redirects agent behavior |
 | `multi_edit_reconstruction.py` | `apply_edits()` / `edits_for_tool()` — shared helpers that reconstruct the post-edit content of an Edit or MultiEdit, imported by the blockers that judge post-edit content |
+| `nas_ssh_binary_enforcer_constants.py` | Bash tool name, the NAS address pattern, ssh-family basenames, OpenSSH binary path suffixes, launcher-wrapper set, shell control-operator tokens and split pattern, leading-assignment and duration patterns, the batch-mode pattern, and the two deny messages for the NAS ssh binary enforcer |
 | `open_questions_in_plans_blocker_constants.py` | Patterns for detecting unresolved open questions in plan documents |
 | `orphan_css_class_constants.py` | Scan radius and selector patterns for the orphan-CSS-class check |
 | `package_inventory_stale_blocker_constants.py` | Inventory document names, production code extensions, backtick token pattern, smallest inventory size, exempt names, scan budget, and block-message text for the package-inventory stale-entry blocker |
@@ -47,6 +48,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `pr_converge_bugteam_enforcer_constants.py` | State keys and timing config for the bugteam-parallel enforcer |
 | `pr_converge_bugteam_enforcer_state.py` | State-file helpers for the bugteam enforcer |
 | `pr_description_enforcer_constants.py` | PR-description shape rules and command patterns |
+| `pr_description_proof_of_work_constants.py` | Proof-part detection patterns, gh command tokens, and corrective messages for the proof-of-work comment audit |
 | `pre_tool_use_stdin.py` | `read_hook_input_dictionary_from_stdin()` — shared stdin parser for PreToolUse hooks |
 | `precommit_code_rules_gate_constants.py` | Scope argument and exit-code constants for the precommit gate |
 | `project_paths_reader.py` | Loads `~/.claude/project-paths.json` — the per-user project-path registry |

package/hooks/hooks_constants/code_rules_path_utils_constants.py

@@ -24,6 +24,7 @@ ALL_CONFIG_DIRECTORY_NAMES = frozenset(
         "bugteam_scripts_constants",
         "implement_scripts_constants",
         "log_audit_constants",
+        "usage_pause_constants",
         "dev_env_scripts_constants",
     }
 )

package/hooks/hooks_constants/code_verifier_spawn_preflight_gate_constants.py

@@ -26,6 +26,9 @@ MERGE_TREE_CONFLICT_EXIT_CODE: int = 1
 MERGE_TREE_CLEAN_EXIT_CODE: int = 0
 MERGE_TREE_TIMEOUT_SECONDS: int = 30
 
+ALL_MERGE_HEAD_PROBE_FLAGS: tuple[str, ...] = ("rev-parse", "--verify", "--quiet", "MERGE_HEAD")
+ALL_UNMERGED_PATHS_DIFF_FLAGS: tuple[str, ...] = ("diff", "--name-only", "--diff-filter=U")
+
 ALL_NAME_ONLY_WORKTREE_DIFF_FLAGS: tuple[str, ...] = (
     "-c",
     "core.quotePath=false",

package/hooks/hooks_constants/nas_ssh_binary_enforcer_constants.py

@@ -0,0 +1,59 @@
+"""Constants for the NAS ssh binary enforcer hook.
+
+Holds the Bash tool name, the NAS host-token pattern, the ssh-family command
+basenames, the Windows OpenSSH binary path suffixes, the launcher-wrapper set, the
+shell control-operator tokens and their split pattern, the leading-assignment and
+launcher-duration patterns, the batch-mode pattern, and the two deny messages.
+"""
+
+import re
+
+BASH_TOOL_NAME = "Bash"
+
+NAS_HOST_TOKEN_PATTERN = re.compile(r"(?:^|@)192\.168\.1\.100(?::|$)")
+"""Match the NAS address only as a connection host.
+
+Anchored to token start or an ``@`` and followed by ``:`` or token end, so the
+address is matched as a bare host (``192.168.1.100``), a ``user@host``
+(``jon@192.168.1.100``), or a ``host:path`` target (``192.168.1.100:/vol1/``,
+``jon@192.168.1.100:/vol1/``). The address inside a remote-command argument
+(``"ping 192.168.1.100"``) or a remote path component on another host
+(``jon@other:/backup/192.168.1.100/``) does not count as a NAS connection.
+"""
+
+ALL_SSH_FAMILY_COMMAND_BASENAMES = frozenset(
+    {"ssh", "scp", "sftp", "ssh.exe", "scp.exe", "sftp.exe"}
+)
+ALL_OPENSSH_BINARY_PATH_SUFFIXES = (
+    "/openssh/ssh.exe",
+    "/openssh/scp.exe",
+    "/openssh/sftp.exe",
+)
+ALL_LAUNCHER_WRAPPER_COMMANDS = frozenset({"timeout", "nohup", "nice", "stdbuf", "setsid", "env"})
+ALL_SHELL_CONTROL_OPERATOR_TOKENS = frozenset({"&&", "||", ";", "|", "&", "|&"})
+CONTROL_OPERATOR_SPLIT_PATTERN = re.compile(r"(&&|\|\||;|\|&|\||(?<!>)&(?!>))")
+LEADING_ASSIGNMENT_PATTERN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
+LAUNCHER_DURATION_PATTERN = re.compile(r"^\d+[a-z]*$", re.IGNORECASE)
+BATCH_MODE_PATTERN = re.compile(r"batchmode\s*=\s*yes", re.IGNORECASE)
+
+BARE_SSH_BINARY_MESSAGE = (
+    "BLOCKED [nas-ssh-binary]: Git Bash's MSYS ssh reads ~/.ssh/id_ed25519 as "
+    "world-readable through its ACL mapping, rejects the key as bad permissions, "
+    "and falls back to an interactive password prompt that hangs unattended "
+    "sessions against the NAS at 192.168.1.100.\n\n"
+    "Use the Windows OpenSSH binary, which authenticates the key without prompting:\n"
+    '  "/c/Windows/System32/OpenSSH/ssh.exe" -o BatchMode=yes -o ConnectTimeout=10 '
+    '-p 9222 jon@192.168.1.100 "<cmd>"\n\n'
+    "See ~/.claude/rules/nas-ssh-invocation.md for full guidance."
+)
+
+MISSING_BATCH_MODE_MESSAGE = (
+    "BLOCKED [nas-ssh-binary]: this NAS ssh command uses the Windows OpenSSH binary "
+    "but omits -o BatchMode=yes, so an authentication regression falls back to an "
+    "interactive password prompt that hangs unattended sessions against the NAS at "
+    "192.168.1.100.\n\n"
+    "Add -o BatchMode=yes so a key failure exits loudly rather than prompting:\n"
+    '  "/c/Windows/System32/OpenSSH/ssh.exe" -o BatchMode=yes -o ConnectTimeout=10 '
+    '-p 9222 jon@192.168.1.100 "<cmd>"\n\n'
+    "See ~/.claude/rules/nas-ssh-invocation.md for full guidance."
+)

package/hooks/hooks_constants/pr_description_enforcer_constants.py

@@ -41,6 +41,7 @@ ALL_HEAVY_TESTING_HEADERS: frozenset[str] = frozenset(
     {TEST_PLAN_HEADER, TESTING_HEADER, TESTS_HEADER, VERIFICATION_HEADER, VALIDATION_HEADER}
 )
 GH_PR_COMMAND_MIN_TOKEN_COUNT: int = 3
+ALL_PR_NUMBER_BEARING_GH_PR_SUBCOMMANDS: frozenset[str] = frozenset({"edit", "comment", "ready"})
 BODY_FILE_STDIN_SENTINEL: str = "-"
 ATOMIC_WRITE_TEMP_SUFFIX: str = ".tmp"
 SELF_CLOSING_REFERENCE_MESSAGE_PREFIX: str = "PR body references its own PR number #"
@@ -134,6 +135,7 @@ __all__ = [
     "FLESCH_SYLLABLES_PER_WORD_COEFFICIENT",
     "FLESCH_WORDS_PER_SENTENCE_COEFFICIENT",
     "GH_PR_COMMAND_MIN_TOKEN_COUNT",
+    "ALL_PR_NUMBER_BEARING_GH_PR_SUBCOMMANDS",
     "HEADING_LINE_PATTERN",
     "HEAVY_MIN_BODY_CHARS_FOR_CLASSIFICATION",
     "HEAVY_SHAPE",

package/hooks/hooks_constants/pr_description_proof_of_work_constants.py

@@ -0,0 +1,111 @@
+"""Configuration constants for the proof-of-work PR-comment audit.
+
+Holds the proof-part detection patterns, the gap and linkage word lists,
+the gh command tokens the audit runs to read a PR's comments and diff, and
+the corrective messages returned when a proof part is missing or when
+``gh pr ready`` runs with no passing proof comment on the PR.
+"""
+
+from __future__ import annotations
+
+import re
+
+ALL_PROOF_HEADING_KEYWORDS: tuple[str, ...] = ("proof", "verification")
+
+PR_READY_INVOCATION_PATTERN: re.Pattern[str] = re.compile(r"(?:^|[;&|])\s*gh\s+pr\s+ready\b")
+PR_READY_UNDO_FLAG: str = "--undo"
+
+GH_EXECUTABLE: str = "gh"
+GH_API_SUBCOMMAND: str = "api"
+GH_PAGINATE_FLAG: str = "--paginate"
+GH_SLURP_FLAG: str = "--slurp"
+PR_COMMENTS_API_PATH_TEMPLATE: str = "repos/{{owner}}/{{repo}}/issues/{pr_number}/comments"
+ALL_PR_DIFF_SUBCOMMANDS: tuple[str, ...] = ("pr", "diff")
+PR_DIFF_NAME_ONLY_FLAG: str = "--name-only"
+ALL_PR_VIEW_NUMBER_ARGUMENTS: tuple[str, ...] = ("pr", "view", "--json", "number")
+PR_NUMBER_JSON_FIELD: str = "number"
+COMMENT_BODY_JSON_FIELD: str = "body"
+GH_COMMAND_TIMEOUT_SECONDS: int = 6
+MAX_DIFF_SCAN_CHARS: int = 200000
+
+ALL_VISUAL_FILE_SUFFIXES: frozenset[str] = frozenset(
+    {".png", ".jpg", ".jpeg", ".gif", ".webp", ".avif", ".svg", ".ico", ".html", ".css"}
+)
+HEX_COLOR_ADDED_LINE_PATTERN: re.Pattern[str] = re.compile(r"^\+.*#[0-9A-Fa-f]{6}\b", re.MULTILINE)
+IMAGE_EMBED_PATTERN: re.Pattern[str] = re.compile(r"!\[[^\]]*\]\([^)\s]+\)")
+ISSUE_REFERENCE_PATTERN: re.Pattern[str] = re.compile(r"#\d+")
+PLAN_LINKAGE_KEYWORD_PATTERN: re.Pattern[str] = re.compile(
+    r"\b(?:issue|phase|plan|parent|advanc\w*|milestone|part of)\b", re.IGNORECASE
+)
+DIGIT_PATTERN: re.Pattern[str] = re.compile(r"\d")
+ALL_HONEST_GAP_PHRASES: tuple[str, ...] = (
+    "gap",
+    "limitation",
+    "cannot",
+    "does not show",
+    "not shown",
+    "unverified",
+    "not covered",
+)
+
+PROOF_PART_COMMAND_MESSAGE: str = (
+    "proof comment missing a fenced command block showing the exact command(s) run on real data"
+)
+PROOF_PART_MEASURED_MESSAGE: str = (
+    "proof comment missing a measured-value element -- add a table row or bullet fact carrying "
+    "the numbers read from the produced artifact"
+)
+PROOF_PART_PLAN_LINKAGE_MESSAGE: str = (
+    "proof comment missing a plan-linkage sentence -- add one line naming the parent issue or "
+    "phase this PR advances, with its #number"
+)
+PROOF_PART_VISUAL_MESSAGE: str = (
+    "proof comment missing a visual element on a visual change -- embed an image (color "
+    "swatches, before/after screenshots) for values a human cannot read at a glance"
+)
+PROOF_PART_HONEST_GAPS_MESSAGE: str = (
+    "proof comment missing an honest-gaps statement -- say plainly what this offline proof "
+    "cannot show and what covers that gap"
+)
+
+PR_READY_GATE_MESSAGE_TEMPLATE: str = (
+    "BLOCKED: [PROOF_OF_WORK] PR #{pr_number} carries no passing proof-of-work comment. "
+    "Post one comment with a proof or verification heading carrying: "
+    "(1) the exact command(s) run on real data in a fenced code block, "
+    "(2) measured outcomes from the produced artifact as a table row or bullet facts, "
+    "(3) one sentence naming the parent issue or phase this PR advances, with its #number, "
+    "(4) an image embed when the diff touches images, HTML, CSS, or hex color values, and "
+    "(5) an honest statement of what the offline proof cannot show. "
+    "Then re-run gh pr ready."
+)
+
+__all__ = [
+    "ALL_HONEST_GAP_PHRASES",
+    "ALL_PROOF_HEADING_KEYWORDS",
+    "ALL_PR_DIFF_SUBCOMMANDS",
+    "ALL_PR_VIEW_NUMBER_ARGUMENTS",
+    "ALL_VISUAL_FILE_SUFFIXES",
+    "COMMENT_BODY_JSON_FIELD",
+    "DIGIT_PATTERN",
+    "GH_API_SUBCOMMAND",
+    "GH_COMMAND_TIMEOUT_SECONDS",
+    "GH_EXECUTABLE",
+    "GH_PAGINATE_FLAG",
+    "GH_SLURP_FLAG",
+    "HEX_COLOR_ADDED_LINE_PATTERN",
+    "IMAGE_EMBED_PATTERN",
+    "ISSUE_REFERENCE_PATTERN",
+    "MAX_DIFF_SCAN_CHARS",
+    "PLAN_LINKAGE_KEYWORD_PATTERN",
+    "PROOF_PART_COMMAND_MESSAGE",
+    "PROOF_PART_HONEST_GAPS_MESSAGE",
+    "PROOF_PART_MEASURED_MESSAGE",
+    "PROOF_PART_PLAN_LINKAGE_MESSAGE",
+    "PROOF_PART_VISUAL_MESSAGE",
+    "PR_COMMENTS_API_PATH_TEMPLATE",
+    "PR_DIFF_NAME_ONLY_FLAG",
+    "PR_NUMBER_JSON_FIELD",
+    "PR_READY_GATE_MESSAGE_TEMPLATE",
+    "PR_READY_INVOCATION_PATTERN",
+    "PR_READY_UNDO_FLAG",
+]