claude-dev-env 1.90.0 → 1.92.1

package/hooks/blocking/precommit_code_rules_gate.py

@@ -122,7 +122,10 @@ def run_staged_gate(repository_root: Path) -> tuple[int, str]:
     """Run the shared code_rules_gate engine in staged mode.
 
     Args:
-        repository_root: Repository root passed to the gate's --repo-root.
+        repository_root: Repository root passed to the gate's --repo-root
+            and used as the gate subprocess working directory, so relative
+            paths the gate's checks resolve land in the committing worktree
+            rather than the hook's own working directory.
 
     Returns:
         Tuple of the gate exit code and its stderr report. A missing gate
@@ -147,6 +150,7 @@ def run_staged_gate(repository_root: Path) -> tuple[int, str]:
             encoding="utf-8",
             errors="replace",
             timeout=GATE_TIMEOUT_SECONDS,
+            cwd=str(repository_root),
         )
     except subprocess.TimeoutExpired:
         return 1, (

package/hooks/blocking/test_code_rules_enforcer_comment_string_awareness.py

@@ -17,6 +17,8 @@ import sys
 from pathlib import Path
 from types import SimpleNamespace
 
+import pytest
+
 _BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
 _HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
 if _BLOCKING_DIRECTORY not in sys.path:
@@ -119,11 +121,15 @@ def test_check_comment_changes_skips_removal_when_old_python_un_parseable() -> N
     assert issues == []
 
 
-def test_check_comment_changes_still_detects_removal_on_parseable_python() -> None:
+def test_check_comment_changes_advises_without_blocking_on_removal_on_parseable_python(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
     old_content = 'x = 1  # existing comment\n'
     new_content = 'x = 1\n'
     issues = code_rules_enforcer.check_comment_changes(old_content, new_content, "foo.py")
-    assert any("Existing comment removed" in each_issue for each_issue in issues)
+    assert not any("Existing comment removed" in each_issue for each_issue in issues)
+    captured = capsys.readouterr()
+    assert "[CODE_RULES advisory] Existing comment removed" in captured.err
 
 
 def test_python_check_should_exempt_directive_without_space_after_hash() -> None:

package/hooks/blocking/test_code_verifier_spawn_preflight_gate.py

@@ -287,6 +287,37 @@ def make_conflict_repository(tmp_path: Path) -> Path:
     return repository_root
 
 
+def make_stale_self_upstream_conflict_repository(tmp_path: Path) -> Path:
+    repository_root = make_conflict_repository(tmp_path)
+    feature_sha = run_git(repository_root, "rev-parse", "HEAD")
+    run_git(repository_root, "remote", "add", "origin", str(repository_root))
+    run_git(repository_root, "update-ref", "refs/remotes/origin/feature", feature_sha)
+    run_git(repository_root, "config", "branch.feature.remote", "origin")
+    run_git(repository_root, "config", "branch.feature.merge", "refs/heads/feature")
+    return repository_root
+
+
+def make_merge_in_progress_repository(tmp_path: Path) -> Path:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    initialize_repository(repository_root)
+    base_sha = commit_file(repository_root, "shared.py", SHARED_BASE_SOURCE, "add shared")
+    run_git(repository_root, "update-ref", "refs/remotes/origin/main", base_sha)
+    run_git(repository_root, "checkout", "-b", "feature")
+    commit_file(repository_root, "shared.py", SHARED_FEATURE_SOURCE, "feature edit")
+    advance_origin_main_divergent(repository_root, base_sha, "shared.py", SHARED_DIVERGENT_SOURCE)
+    return repository_root
+
+
+def start_conflicting_merge(repository_root: Path) -> None:
+    subprocess.run(
+        ["git", "-C", str(repository_root), "merge", "--no-edit", "origin/main"],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+
 def test_non_code_verifier_agent_is_no_op(tmp_path: Path) -> None:
     repository_root = make_conflict_repository(tmp_path)
     write_working_tree_file(repository_root, "violator.py", VIOLATING_MODULE_SOURCE)
@@ -473,6 +504,46 @@ def test_conflict_and_violation_single_deny_names_both(tmp_path: Path) -> None:
     assert "violator.py" in reason
 
 
+def test_stale_self_upstream_still_judges_default_branch(tmp_path: Path) -> None:
+    repository_root = make_stale_self_upstream_conflict_repository(tmp_path)
+    tracked_upstream = run_git(
+        repository_root, "rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"
+    )
+    assert tracked_upstream == "origin/feature", "fixture must track the branch's own remote ref"
+    payload = write_agent_payload("code-verifier", "verify the change", repository_root)
+    result = run_hook(payload, repository_root)
+    assert not is_allow(result)
+    reason = deny_reason(result)
+    assert "shared.py" in reason
+    assert "Merge conflicts vs" in reason
+
+
+def test_staged_resolved_merge_allows(tmp_path: Path) -> None:
+    repository_root = make_merge_in_progress_repository(tmp_path)
+    start_conflicting_merge(repository_root)
+    write_working_tree_file(repository_root, "shared.py", SHARED_FEATURE_SOURCE)
+    run_git(repository_root, "add", "shared.py")
+    remaining_unmerged = run_git(repository_root, "diff", "--name-only", "--diff-filter=U")
+    assert remaining_unmerged == "", "the staged resolution must clear every unmerged index entry"
+    merge_head_sha = run_git(repository_root, "rev-parse", "--verify", "--quiet", "MERGE_HEAD")
+    assert merge_head_sha, "a merge must still be in progress so MERGE_HEAD is present"
+    payload = write_agent_payload("code-verifier", "verify the change", repository_root)
+    result = run_hook(payload, repository_root)
+    assert is_allow(result)
+
+
+def test_unresolved_merge_keeps_denying(tmp_path: Path) -> None:
+    repository_root = make_merge_in_progress_repository(tmp_path)
+    start_conflicting_merge(repository_root)
+    remaining_unmerged = run_git(repository_root, "diff", "--name-only", "--diff-filter=U")
+    assert "shared.py" in remaining_unmerged, "the merge must leave shared.py unmerged"
+    payload = write_agent_payload("code-verifier", "verify the change", repository_root)
+    result = run_hook(payload, repository_root)
+    assert not is_allow(result)
+    reason = deny_reason(result)
+    assert "shared.py" in reason
+
+
 def test_hook_imports_real_config_when_parent_holds_shadowing_config(
     tmp_path: Path,
 ) -> None:

package/hooks/blocking/test_nas_ssh_binary_enforcer.py

@@ -0,0 +1,168 @@
+"""Unit tests for nas-ssh-binary-enforcer PreToolUse hook."""
+
+import importlib.util
+import pathlib
+import sys
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+
+hook_spec = importlib.util.spec_from_file_location(
+    "nas_ssh_binary_enforcer",
+    _HOOK_DIR / "nas_ssh_binary_enforcer.py",
+)
+assert hook_spec is not None
+assert hook_spec.loader is not None
+hook_module = importlib.util.module_from_spec(hook_spec)
+hook_spec.loader.exec_module(hook_module)
+_find_nas_ssh_violation = hook_module._find_nas_ssh_violation
+
+from hooks_constants.nas_ssh_binary_enforcer_constants import (
+    BARE_SSH_BINARY_MESSAGE as _BARE_SSH_BINARY_MESSAGE,
+    MISSING_BATCH_MODE_MESSAGE as _MISSING_BATCH_MODE_MESSAGE,
+)
+
+
+def test_bare_ssh_to_nas_is_denied_with_binary_message() -> None:
+    assert (
+        _find_nas_ssh_violation('ssh -p 9222 jon@192.168.1.100 "ls /volume1"')
+        == _BARE_SSH_BINARY_MESSAGE
+    )
+
+
+def test_bare_scp_to_nas_is_denied() -> None:
+    assert (
+        _find_nas_ssh_violation("scp -P 9222 file.txt jon@192.168.1.100:/volume1/")
+        == _BARE_SSH_BINARY_MESSAGE
+    )
+
+
+def test_bare_sftp_to_nas_is_denied() -> None:
+    assert _find_nas_ssh_violation("sftp -P 9222 jon@192.168.1.100") == _BARE_SSH_BINARY_MESSAGE
+
+
+def test_bare_ssh_to_nas_behind_launcher_wrapper_is_denied() -> None:
+    assert (
+        _find_nas_ssh_violation('timeout 10 ssh -p 9222 jon@192.168.1.100 "uptime"')
+        == _BARE_SSH_BINARY_MESSAGE
+    )
+
+
+def test_bare_ssh_to_nas_after_shell_operator_is_denied() -> None:
+    assert (
+        _find_nas_ssh_violation('cd /tmp && ssh -p 9222 jon@192.168.1.100 "uptime"')
+        == _BARE_SSH_BINARY_MESSAGE
+    )
+
+
+def test_bare_ssh_to_nas_after_glued_operator_is_denied() -> None:
+    assert (
+        _find_nas_ssh_violation('true;ssh -p 9222 jon@192.168.1.100 "uptime"')
+        == _BARE_SSH_BINARY_MESSAGE
+    )
+
+
+def test_bare_ssh_to_nas_after_pipe_ampersand_operator_is_denied() -> None:
+    assert (
+        _find_nas_ssh_violation('echo start |& ssh -p 9222 jon@192.168.1.100 "echo hi"')
+        == _BARE_SSH_BINARY_MESSAGE
+    )
+
+
+def test_full_openssh_binary_to_nas_without_batchmode_is_denied() -> None:
+    assert (
+        _find_nas_ssh_violation(
+            '"/c/Windows/System32/OpenSSH/ssh.exe" -o ConnectTimeout=10 '
+            '-p 9222 jon@192.168.1.100 "uptime"'
+        )
+        == _MISSING_BATCH_MODE_MESSAGE
+    )
+
+
+def test_full_openssh_scp_to_nas_without_batchmode_is_denied() -> None:
+    assert (
+        _find_nas_ssh_violation(
+            '"/c/Windows/System32/OpenSSH/scp.exe" -P 9222 file.txt jon@192.168.1.100:/volume1/'
+        )
+        == _MISSING_BATCH_MODE_MESSAGE
+    )
+
+
+def test_full_openssh_binary_to_nas_with_batchmode_is_allowed() -> None:
+    assert (
+        _find_nas_ssh_violation(
+            '"/c/Windows/System32/OpenSSH/ssh.exe" -o BatchMode=yes '
+            '-o ConnectTimeout=10 -p 9222 jon@192.168.1.100 "uptime"'
+        )
+        is None
+    )
+
+
+def test_full_openssh_binary_glued_batchmode_flag_is_allowed() -> None:
+    assert (
+        _find_nas_ssh_violation(
+            '"/c/Windows/System32/OpenSSH/ssh.exe" -oBatchMode=yes '
+            '-p 9222 jon@192.168.1.100 "uptime"'
+        )
+        is None
+    )
+
+
+def test_bare_ssh_to_other_host_is_allowed() -> None:
+    assert _find_nas_ssh_violation('ssh -p 22 jon@example.com "uptime"') is None
+
+
+def test_full_openssh_binary_to_other_host_without_batchmode_is_allowed() -> None:
+    assert (
+        _find_nas_ssh_violation(
+            '"/c/Windows/System32/OpenSSH/ssh.exe" -p 22 jon@example.com "uptime"'
+        )
+        is None
+    )
+
+
+def test_nas_ip_as_echoed_data_is_allowed() -> None:
+    assert _find_nas_ssh_violation('echo "connect via ssh to 192.168.1.100"') is None
+
+
+def test_nas_ip_mentioned_without_ssh_command_word_is_allowed() -> None:
+    assert _find_nas_ssh_violation("ping -c 1 192.168.1.100") is None
+
+
+def test_ssh_family_word_only_in_remote_command_argument_is_allowed() -> None:
+    assert (
+        _find_nas_ssh_violation(
+            '"/c/Windows/System32/OpenSSH/ssh.exe" -o BatchMode=yes '
+            '-p 9222 jon@192.168.1.100 "grep ssh /etc/config"'
+        )
+        is None
+    )
+
+
+def test_nas_ip_in_different_segment_than_ssh_is_allowed() -> None:
+    assert _find_nas_ssh_violation('echo 192.168.1.100 && ssh -p 22 jon@example.com "id"') is None
+
+
+def test_ssh_to_other_host_with_nas_ip_in_remote_command_is_allowed() -> None:
+    assert (
+        _find_nas_ssh_violation('ssh -p 22 jon@example.com "ping -c1 192.168.1.100"') is None
+    )
+
+
+def test_scp_to_other_host_with_nas_ip_in_remote_path_is_allowed() -> None:
+    assert (
+        _find_nas_ssh_violation("scp -P 22 f.txt jon@example.com:/backup/192.168.1.100/") is None
+    )
+
+
+def test_similar_ip_prefix_is_not_matched() -> None:
+    assert _find_nas_ssh_violation('ssh -p 22 jon@192.168.1.1000 "id"') is None
+
+
+def test_empty_command_is_allowed() -> None:
+    assert _find_nas_ssh_violation("") is None
+
+
+def test_unbalanced_quotes_command_is_allowed() -> None:
+    assert _find_nas_ssh_violation("ssh 'unterminated 192.168.1.100") is None

package/hooks/blocking/test_pr_description_enforcer_proof_gate.py

@@ -0,0 +1,175 @@
+"""Entry-flow tests for the proof-of-work gates in pr_description_enforcer.
+
+Each test drives hook main() with a real Bash PreToolUse payload on stdin,
+mirroring test_pr_description_enforcer.py. The single gh subprocess boundary
+in pr_description_proof_of_work is patched with a fake runner, so command
+recognition, body extraction, and the proof audit run the production paths.
+"""
+
+import contextlib
+import importlib.util
+import io
+import json
+import pathlib
+import sys
+from unittest.mock import patch
+
+import pytest
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+_HOOKS_ROOT = _HOOK_DIR.parent
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+
+from blocking import pr_description_proof_of_work as proof_module  # noqa: E402
+from blocking import pr_description_readability as readability_module  # noqa: E402
+
+hook_spec = importlib.util.spec_from_file_location(
+    "pr_description_enforcer_proof_gate",
+    _HOOK_DIR / "pr_description_enforcer.py",
+)
+assert hook_spec is not None
+assert hook_spec.loader is not None
+hook_module = importlib.util.module_from_spec(hook_spec)
+hook_spec.loader.exec_module(hook_module)
+
+
+@pytest.fixture(autouse=True)
+def _isolate_readability_state(
+    tmp_path_factory: pytest.TempPathFactory, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Redirect the three readability state files to per-test temp paths.
+
+    The enabled file is written with enabled=False so readability scoring
+    stays out of these entry-flow tests and the live state directory is
+    never touched.
+    """
+    per_test_state_dir = tmp_path_factory.mktemp("proof_gate_readability_state")
+    monkeypatch.setattr(
+        readability_module, "READABILITY_STATE_FILE", per_test_state_dir / "strikes.json"
+    )
+    monkeypatch.setattr(
+        readability_module,
+        "READABILITY_THRESHOLD_OVERRIDE_FILE",
+        per_test_state_dir / "overrides.json",
+    )
+    enabled_path = per_test_state_dir / "enabled.json"
+    enabled_path.write_text(json.dumps({"enabled": False}))
+    monkeypatch.setattr(readability_module, "READABILITY_ENABLED_STATE_FILE", enabled_path)
+
+
+PASSING_PROOF_COMMENT_BODY = (
+    "## Summary\n\n"
+    "Recolored the launcher icons and checked every produced asset by hand "
+    "against the palette the plan names.\n\n"
+    "## Verification\n\n"
+    "```\n"
+    "C:\\Python313\\python.exe scripts/recolor.py --input themes/dawn\n"
+    "```\n\n"
+    "| Artifact | Measured |\n"
+    "| --- | --- |\n"
+    "| icons.zip | 48 files, 412,993 bytes |\n\n"
+    "This advances phase 2 of issue #12.\n\n"
+    "Known gap: the offline proof cannot show the on-device rendering; the "
+    "store preview covers that.\n"
+)
+
+ORDINARY_COMMENT_BODY = (
+    "The retry logic here mirrors what the uploader does for chunked "
+    "transfers, so the two stay in step."
+)
+
+
+def _run_hook_main_with_command(command: str) -> str:
+    hook_input_json = json.dumps({"tool_name": "Bash", "tool_input": {"command": command}})
+    captured_stdout = io.StringIO()
+    with (
+        patch("sys.stdin", io.StringIO(hook_input_json)),
+        patch("sys.stdout", captured_stdout),
+        contextlib.suppress(SystemExit),
+    ):
+        hook_module.main()
+    return captured_stdout.getvalue()
+
+
+def _install_fake_gh_responses(monkeypatch, all_comment_bodies, all_diff_names):
+    all_comment_records = [{"body": each_body} for each_body in all_comment_bodies]
+
+    def _fake_run_gh_command(all_gh_arguments):
+        if all_gh_arguments and all_gh_arguments[0] == "api":
+            return json.dumps([all_comment_records])
+        if "--name-only" in all_gh_arguments:
+            return "\n".join(all_diff_names)
+        if list(all_gh_arguments[:2]) == ["pr", "view"]:
+            return json.dumps({"number": 123})
+        if list(all_gh_arguments[:2]) == ["pr", "diff"]:
+            return ""
+        return None
+
+    monkeypatch.setattr(proof_module, "_run_gh_command", _fake_run_gh_command)
+
+
+def test_main_blocks_gh_pr_ready_without_proof_comment(monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fake_gh_responses(monkeypatch, [], ["src/parser.py"])
+    decision_output = _run_hook_main_with_command("gh pr ready 123")
+    assert "deny" in decision_output
+    assert "proof" in decision_output.lower()
+
+
+def test_main_allows_gh_pr_ready_with_passing_proof_comment(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _install_fake_gh_responses(monkeypatch, [PASSING_PROOF_COMMENT_BODY], ["src/parser.py"])
+    decision_output = _run_hook_main_with_command("gh pr ready 123")
+    assert "deny" not in decision_output
+
+
+def test_main_allows_complete_proof_comment_post(
+    tmp_path: pathlib.Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fake_gh_responses(monkeypatch, [], ["src/parser.py"])
+    body_file = tmp_path / "proof.md"
+    body_file.write_text(PASSING_PROOF_COMMENT_BODY)
+    decision_output = _run_hook_main_with_command(f"gh pr comment 123 --body-file {body_file}")
+    assert "deny" not in decision_output
+
+
+def test_main_blocks_proof_comment_missing_visual_on_visual_change(
+    tmp_path: pathlib.Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fake_gh_responses(monkeypatch, [], ["assets/icon.png"])
+    body_file = tmp_path / "proof.md"
+    body_file.write_text(PASSING_PROOF_COMMENT_BODY)
+    decision_output = _run_hook_main_with_command(f"gh pr comment 123 --body-file {body_file}")
+    assert "deny" in decision_output
+    assert "visual" in decision_output
+
+
+def test_main_leaves_ordinary_comment_untouched(
+    tmp_path: pathlib.Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    all_recorded_calls: list[list[str]] = []
+
+    def _recording_run_gh_command(all_gh_arguments):
+        all_recorded_calls.append(list(all_gh_arguments))
+
+    monkeypatch.setattr(proof_module, "_run_gh_command", _recording_run_gh_command)
+    body_file = tmp_path / "comment.md"
+    body_file.write_text(ORDINARY_COMMENT_BODY)
+    decision_output = _run_hook_main_with_command(f"gh pr comment 123 --body-file {body_file}")
+    assert "deny" not in decision_output
+    assert all_recorded_calls == []
+
+
+def test_main_allows_gh_pr_ready_undo_without_queries(monkeypatch: pytest.MonkeyPatch) -> None:
+    all_recorded_calls: list[list[str]] = []
+
+    def _recording_run_gh_command(all_gh_arguments):
+        all_recorded_calls.append(list(all_gh_arguments))
+
+    monkeypatch.setattr(proof_module, "_run_gh_command", _recording_run_gh_command)
+    decision_output = _run_hook_main_with_command("gh pr ready 123 --undo")
+    assert "deny" not in decision_output
+    assert all_recorded_calls == []

package/hooks/blocking/test_pr_description_proof_of_work.py

@@ -0,0 +1,162 @@
+"""Behavior tests for the proof-of-work comment audit and gh pr ready gate.
+
+Each test drives the public audit surface of pr_description_proof_of_work
+with real comment bodies. The single gh subprocess boundary is patched with
+a fake runner, so parsing, part detection, and gate decisions all run the
+production code paths.
+"""
+
+import json
+import pathlib
+import sys
+
+import pytest
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+_HOOKS_ROOT = _HOOK_DIR.parent
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
+
+from blocking import pr_description_proof_of_work as proof_module  # noqa: E402
+from blocking.pr_description_proof_of_work import (  # noqa: E402
+    audit_proof_comment_body,
+    evaluate_pr_ready_gate,
+    is_pr_ready_command,
+    is_proof_shaped_body,
+)
+
+PASSING_PROOF_COMMENT_BODY = (
+    "## Summary\n\n"
+    "Recolored the launcher icons and checked every produced asset by hand "
+    "against the palette the plan names.\n\n"
+    "## Verification\n\n"
+    "```\n"
+    "C:\\Python313\\python.exe scripts/recolor.py --input themes/dawn\n"
+    "```\n\n"
+    "| Artifact | Measured |\n"
+    "| --- | --- |\n"
+    "| icons.zip | 48 files, 412,993 bytes |\n\n"
+    "This advances phase 2 of issue #12.\n\n"
+    "Known gap: the offline proof cannot show the on-device rendering; the "
+    "store preview covers that.\n"
+)
+
+VISUAL_PROOF_COMMENT_BODY = (
+    PASSING_PROOF_COMMENT_BODY + "\n![](https://placehold.co/20x20/AABBCC/AABBCC.png)\n"
+)
+
+BARE_PROOF_COMMENT_BODY = "## Verification\n\nLooks good overall to me.\n"
+
+ORDINARY_COMMENT_BODY = (
+    "The retry logic here mirrors what the uploader does for chunked "
+    "transfers, so the two stay in step."
+)
+
+
+def _install_fake_gh(monkeypatch, all_comment_bodies, all_diff_names, diff_text):
+    all_comment_records = [{"body": each_body} for each_body in all_comment_bodies]
+
+    def _fake_run_gh_command(all_gh_arguments):
+        if all_gh_arguments and all_gh_arguments[0] == "api":
+            return json.dumps([all_comment_records])
+        if list(all_gh_arguments[:2]) == ["pr", "view"]:
+            return json.dumps({"number": 77})
+        if "--name-only" in all_gh_arguments:
+            return "\n".join(all_diff_names)
+        if list(all_gh_arguments[:2]) == ["pr", "diff"]:
+            return diff_text
+        return None
+
+    monkeypatch.setattr(proof_module, "_run_gh_command", _fake_run_gh_command)
+
+
+def test_is_proof_shaped_body_detects_verification_heading() -> None:
+    assert is_proof_shaped_body(PASSING_PROOF_COMMENT_BODY)
+
+
+def test_is_proof_shaped_body_skips_ordinary_comment() -> None:
+    assert not is_proof_shaped_body(ORDINARY_COMMENT_BODY)
+
+
+def test_is_pr_ready_command_matches_ready() -> None:
+    assert is_pr_ready_command("gh pr ready 123")
+
+
+def test_is_pr_ready_command_skips_undo() -> None:
+    assert not is_pr_ready_command("gh pr ready 123 --undo")
+
+
+def test_is_pr_ready_command_matches_after_shell_operator() -> None:
+    assert is_pr_ready_command("git fetch && gh pr ready 5")
+
+
+def test_is_pr_ready_command_ignores_phrase_inside_commit_message() -> None:
+    assert not is_pr_ready_command(
+        'git commit -m "block gh pr ready without a proof comment"'
+    )
+
+
+def test_is_pr_ready_command_ignores_phrase_inside_search_argument() -> None:
+    assert not is_pr_ready_command('grep -r "gh pr ready" packages/')
+
+
+def test_audit_passes_complete_proof_on_non_visual_change(monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fake_gh(monkeypatch, [], ["src/parser.py"], "+ plain code line")
+    assert audit_proof_comment_body(PASSING_PROOF_COMMENT_BODY, 123) == []
+
+
+def test_audit_flags_missing_visual_on_image_diff(monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fake_gh(monkeypatch, [], ["assets/icon.png"], "")
+    all_missing_parts = audit_proof_comment_body(PASSING_PROOF_COMMENT_BODY, 123)
+    assert any("visual" in each_part for each_part in all_missing_parts)
+
+
+def test_audit_accepts_image_embed_on_image_diff(monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fake_gh(monkeypatch, [], ["assets/icon.png"], "")
+    assert audit_proof_comment_body(VISUAL_PROOF_COMMENT_BODY, 123) == []
+
+
+def test_audit_detects_visual_change_from_hex_colors(monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fake_gh(monkeypatch, [], ["src/theme.py"], '+ accent = "#AABBCC"')
+    all_missing_parts = audit_proof_comment_body(PASSING_PROOF_COMMENT_BODY, 123)
+    assert any("visual" in each_part for each_part in all_missing_parts)
+
+
+def test_audit_names_every_missing_part_of_bare_proof(monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fake_gh(monkeypatch, [], ["src/parser.py"], "")
+    all_missing_parts = audit_proof_comment_body(BARE_PROOF_COMMENT_BODY, 123)
+    assert len(all_missing_parts) == 4
+
+
+def test_ready_gate_blocks_when_no_proof_comment_exists(monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fake_gh(monkeypatch, [ORDINARY_COMMENT_BODY], ["src/parser.py"], "")
+    denial_reason = evaluate_pr_ready_gate("gh pr ready 123")
+    assert denial_reason is not None
+    assert "proof" in denial_reason.lower()
+
+
+def test_ready_gate_allows_with_passing_proof_comment(monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fake_gh(monkeypatch, [PASSING_PROOF_COMMENT_BODY], ["src/parser.py"], "")
+    assert evaluate_pr_ready_gate("gh pr ready 123") is None
+
+
+def test_ready_gate_blocks_when_proof_comment_is_incomplete(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _install_fake_gh(monkeypatch, [BARE_PROOF_COMMENT_BODY], ["src/parser.py"], "")
+    denial_reason = evaluate_pr_ready_gate("gh pr ready 123")
+    assert denial_reason is not None
+    assert "123" in denial_reason
+    assert "proof" in denial_reason.lower()
+
+
+def test_ready_gate_fails_open_when_gh_is_unavailable(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(proof_module, "_run_gh_command", lambda all_gh_arguments: None)
+    assert evaluate_pr_ready_gate("gh pr ready 123") is None
+
+
+def test_ready_gate_resolves_pr_number_from_current_branch(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _install_fake_gh(monkeypatch, [PASSING_PROOF_COMMENT_BODY], ["src/parser.py"], "")
+    assert evaluate_pr_ready_gate("gh pr ready") is None