claude-dev-env 2.11.0 → 2.13.0

package/hooks/blocking/code_verifier_spawn_preflight_gate.py

@@ -1,483 +0,0 @@
-#!/usr/bin/env python3
-"""PreToolUse hook: pre-flight gate for the code-verifier subagent spawn.
-
-The hook fires on an ``Agent`` or ``Task`` tool call whose ``subagent_type`` is
-``code-verifier``. Before that verification spawn runs, the hook checks the
-branch for two committability problems against the resolved base ref: a real
-merge conflict (a non-mutating trial-merge of HEAD against the base ref) and a
-CODE_RULES violation on a line added in the working tree since the merge base
-(committed on the branch or uncommitted). When either fires, the hook denies
-the spawn with a reason addressed to the spawning agent that names the
-conflicting files and the violating file:line, so that agent fixes them and
-re-spawns. A CODE_RULES engine import/load failure is fail-closed (deny with a
-named load-failure section). Environmental problems — a non-repo cwd, an
-absent base ref, a git failure, an unreadable file alone, or a timeout — fail
-OPEN because the authoritative fail-closed CODE_RULES enforcement already runs
-at Write time and at commit time. The hook never network-fetches and never
-mutates the index or working tree.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import io
-import json
-import re
-import subprocess
-import sys
-from pathlib import Path
-from typing import TextIO
-
-_blocking_dir = str(Path(__file__).resolve().parent)
-if _blocking_dir not in sys.path:
-    sys.path.insert(0, _blocking_dir)
-
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.append(_hooks_dir)
-
-from verification_verdict_store import (  # noqa: E402
-    candidate_base_references,
-    resolve_merge_base,
-    resolve_repo_root,
-    run_git,
-    untracked_file_paths,
-)
-
-from hooks_constants.code_verifier_spawn_preflight_gate_constants import (  # noqa: E402
-    ALL_CODE_VERIFIER_SPAWN_TOOL_NAMES,
-    ALL_MERGE_HEAD_PROBE_FLAGS,
-    ALL_MERGE_TREE_COMMAND_FLAGS,
-    ALL_NAME_ONLY_WORKTREE_DIFF_FLAGS,
-    ALL_UNIFIED_ZERO_DIFF_FLAGS,
-    ALL_UNMERGED_PATHS_DIFF_FLAGS,
-    CODE_RULES_SECTION_HEADER,
-    CODE_VERIFIER_SUBAGENT_TYPE,
-    DENY_REASON_LEAD,
-    ENGINE_LOAD_FAILURE_SECTION,
-    GATE_SCRIPTS_RELATIVE_PATH,
-    MERGE_CONFLICT_SECTION_HEADER,
-    MERGE_TREE_CLEAN_EXIT_CODE,
-    MERGE_TREE_CONFLICT_EXIT_CODE,
-    MERGE_TREE_TIMEOUT_SECONDS,
-)
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-
-_scripts_dir = str(Path(__file__).resolve().parents[2] / GATE_SCRIPTS_RELATIVE_PATH)
-if _scripts_dir not in sys.path:
-    sys.path.insert(0, _scripts_dir)
-
-from code_rules_gate import (  # noqa: E402
-    ValidateContentCallable,
-    _collect_partitioned_violations,
-    _report_partitioned_violations,
-    is_code_path,
-    load_validate_content,
-    parse_added_line_numbers,
-    whole_file_line_set,
-)
-
-
-def _should_run(payload_by_field: dict[str, object]) -> bool:
-    """Return True only for a code-verifier Agent or Task spawn.
-
-    Args:
-        payload_by_field: The full PreToolUse hook payload (already
-            JSON-parsed), keyed by top-level field name.
-
-    Returns:
-        True when the tool is Agent or Task and ``tool_input.subagent_type``
-        is ``code-verifier``; False for every other shape.
-    """
-    if payload_by_field.get("tool_name", "") not in ALL_CODE_VERIFIER_SPAWN_TOOL_NAMES:
-        return False
-    tool_input = payload_by_field.get("tool_input", {})
-    if not isinstance(tool_input, dict):
-        return False
-    return tool_input.get("subagent_type", "") == CODE_VERIFIER_SUBAGENT_TYPE
-
-
-def _resolve_repo_root_and_base(working_directory: str | None) -> tuple[str, str, str] | None:
-    """Resolve the repo root, merge-base sha, and chosen base ref.
-
-    Args:
-        working_directory: The spawn's working directory from the payload, or
-            None when the payload carries no ``cwd``.
-
-    Returns:
-        A ``(repo_root, merge_base_sha, base_ref)`` triple, or None when the
-        directory is not a work tree or no base ref resolves on disk — the
-        caller fails OPEN on None.
-    """
-    start_directory = working_directory if working_directory else str(Path.cwd())
-    repo_root = resolve_repo_root(start_directory)
-    if repo_root is None:
-        return None
-    merge_base_sha = resolve_merge_base(repo_root)
-    if merge_base_sha is None:
-        return None
-    for each_reference in candidate_base_references(repo_root):
-        if run_git(repo_root, "merge-base", "HEAD", each_reference) is not None:
-            return repo_root, merge_base_sha, each_reference
-    return None
-
-
-def _run_trial_merge(repo_root: str, base_ref: str) -> tuple[int, str] | None:
-    """Run the non-mutating trial-merge and return its exit code and stdout.
-
-    Args:
-        repo_root: The repository top-level directory.
-        base_ref: The base ref to trial-merge HEAD against.
-
-    Returns:
-        A ``(returncode, stdout)`` pair, or None when the command is missing,
-        times out, or raises an OS-level error — the caller fails OPEN on None.
-    """
-    try:
-        completed_process = subprocess.run(
-            ["git", "-C", repo_root, *ALL_MERGE_TREE_COMMAND_FLAGS, base_ref, "HEAD"],
-            capture_output=True,
-            text=True,
-            encoding="utf-8",
-            errors="replace",
-            timeout=MERGE_TREE_TIMEOUT_SECONDS,
-            check=False,
-        )
-    except (OSError, subprocess.TimeoutExpired):
-        return None
-    return completed_process.returncode, completed_process.stdout
-
-
-def _merge_in_progress(repo_root: str) -> bool:
-    """Decide whether an unfinished merge is recorded in the work tree.
-
-    Args:
-        repo_root: The repository top-level directory.
-
-    Returns:
-        True when ``MERGE_HEAD`` resolves — a merge is started but not yet
-        committed; False when no merge is in progress or git fails.
-    """
-    return run_git(repo_root, *ALL_MERGE_HEAD_PROBE_FLAGS) is not None
-
-
-def _staged_merge_conflicts(repo_root: str) -> list[str] | None:
-    """Return the unmerged paths of an in-progress merge from the index.
-
-    A merge whose conflicts are fully resolved and staged leaves zero unmerged
-    index entries, so the resolved state is committable and this returns an
-    empty list. A merge with conflicts still open returns those paths, so the
-    caller keeps denying until the resolution is staged.
-
-    Args:
-        repo_root: The repository top-level directory.
-
-    Returns:
-        The still-unmerged paths (empty when the resolution is fully staged),
-        or None when git fails — the caller fails OPEN on None.
-    """
-    unmerged_text = run_git(repo_root, *ALL_UNMERGED_PATHS_DIFF_FLAGS)
-    if unmerged_text is None:
-        return None
-    return [each_line for each_line in unmerged_text.splitlines() if each_line]
-
-
-def _conflicting_files(repo_root: str, base_ref: str) -> list[str] | None:
-    """Return the files that conflict when HEAD trial-merges against the base.
-
-    While a merge is in progress the branch tip has not yet recorded the
-    resolution, so the trial-merge of the base against HEAD would re-report
-    conflicts the staged index already fixed. In that state the index is the
-    authority: an empty unmerged set is a committable resolution, and any
-    remaining unmerged path is a live conflict.
-
-    Args:
-        repo_root: The repository top-level directory.
-        base_ref: The base ref to trial-merge HEAD against.
-
-    Returns:
-        The conflicting file paths on a conflict exit, an empty list on a
-        clean merge, or None on any infrastructure failure (command missing,
-        timeout, or an exit code that is neither clean nor conflict) — the
-        caller fails OPEN on None.
-    """
-    if _merge_in_progress(repo_root):
-        return _staged_merge_conflicts(repo_root)
-    merge_outcome = _run_trial_merge(repo_root, base_ref)
-    if merge_outcome is None:
-        return None
-    return_code, merge_stdout = merge_outcome
-    if return_code == MERGE_TREE_CLEAN_EXIT_CODE:
-        return []
-    if return_code != MERGE_TREE_CONFLICT_EXIT_CODE:
-        return None
-    return _parse_conflicting_paths(merge_stdout)
-
-
-def _parse_conflicting_paths(merge_stdout: str) -> list[str]:
-    """Extract conflicting paths from trial-merge stdout.
-
-    Args:
-        merge_stdout: The stdout of a conflict-exit trial-merge: the written
-            tree-OID line, then one conflicting path per line, then a blank
-            line and informational text.
-
-    Returns:
-        The conflicting file paths — the lines after the tree-OID up to the
-        first blank line.
-    """
-    all_lines = merge_stdout.splitlines()
-    conflicting_paths: list[str] = []
-    for each_line in all_lines[1:]:
-        if not each_line.strip():
-            break
-        conflicting_paths.append(each_line)
-    return conflicting_paths
-
-
-def _working_tree_added_lines_by_path(
-    repo_root: str, merge_base_sha: str
-) -> tuple[list[Path], dict[Path, set[int]]] | None:
-    """Build the code-file surface and its working-tree-vs-merge-base added lines.
-
-    Args:
-        repo_root: The repository top-level directory.
-        merge_base_sha: The merge-base sha the surface diffs against.
-
-    Returns:
-        A ``(file_paths, added_lines_by_path)`` pair keyed by resolved
-        absolute path, or None when a surface git query fails — the caller
-        fails OPEN on None.
-    """
-    tracked_changed_text = run_git(repo_root, *ALL_NAME_ONLY_WORKTREE_DIFF_FLAGS, merge_base_sha)
-    if tracked_changed_text is None:
-        return None
-    untracked_paths = untracked_file_paths(repo_root)
-    if untracked_paths is None:
-        return None
-    repo_root_path = Path(repo_root)
-    file_paths: list[Path] = []
-    added_lines_by_path: dict[Path, set[int]] = {}
-    for each_relative in tracked_changed_text.splitlines():
-        if not each_relative or not is_code_path(Path(each_relative)):
-            continue
-        resolved_path = (repo_root_path / each_relative).resolve()
-        file_paths.append(resolved_path)
-        added_lines_by_path[resolved_path] = _tracked_file_added_lines(
-            repo_root, merge_base_sha, each_relative
-        )
-    for each_relative in untracked_paths:
-        if not is_code_path(Path(each_relative)):
-            continue
-        resolved_path = (repo_root_path / each_relative).resolve()
-        file_paths.append(resolved_path)
-        added_lines_by_path[resolved_path] = whole_file_line_set(resolved_path)
-    return file_paths, added_lines_by_path
-
-
-def _tracked_file_added_lines(repo_root: str, merge_base_sha: str, relative_path: str) -> set[int]:
-    """Return the working-tree-added line numbers for one tracked file.
-
-    Args:
-        repo_root: The repository top-level directory.
-        merge_base_sha: The merge-base sha the diff runs against.
-        relative_path: The repo-relative path of the tracked changed file.
-
-    Returns:
-        The 1-indexed line numbers added vs the merge base in the working
-        tree, or an empty set when the per-file diff fails.
-    """
-    unified_diff_text = run_git(
-        repo_root, *ALL_UNIFIED_ZERO_DIFF_FLAGS, merge_base_sha, "--", relative_path
-    )
-    if unified_diff_text is None:
-        return set()
-    return parse_added_line_numbers(unified_diff_text)
-
-
-def _code_rules_report(
-    repo_root: str, all_file_paths: list[Path], all_added_lines_by_path: dict[Path, set[int]]
-) -> str | None:
-    """Run the CODE_RULES engine and return a full deny section, or None.
-
-    Args:
-        repo_root: The repository top-level directory.
-        all_file_paths: The resolved code-file paths to inspect.
-        all_added_lines_by_path: Per-file working-tree-added line numbers keyed
-            by resolved absolute path.
-
-    Returns:
-        A full deny section when a blocking violation lands on an added line or
-        the CODE_RULES engine fails to import/load (fail-closed). None when the
-        surface is clean, only an unreadable changed file caused a non-zero gate
-        exit, or an environmental engine error arises — those non-block outcomes
-        fail OPEN. The harness hook timeout in hooks.json is the wall-clock
-        bound on a runaway engine.
-    """
-    if not all_file_paths:
-        return None
-    try:
-        validate_content = load_validate_content()
-    except SystemExit:
-        return ENGINE_LOAD_FAILURE_SECTION
-    except (
-        ImportError,
-        SyntaxError,
-        AttributeError,
-        RuntimeError,
-        TypeError,
-        NameError,
-        OSError,
-        re.error,
-    ):
-        return ENGINE_LOAD_FAILURE_SECTION
-    try:
-        blocking_present, captured_report = _run_gate_capturing_stderr(
-            validate_content, all_file_paths, Path(repo_root), all_added_lines_by_path
-        )
-    except OSError:
-        return None
-    if not blocking_present:
-        return None
-    return f"{CODE_RULES_SECTION_HEADER}\n{captured_report.strip()}"
-
-
-def _run_gate_capturing_stderr(
-    validate_content: ValidateContentCallable,
-    all_file_paths: list[Path],
-    repository_root: Path,
-    all_added_lines_by_path: dict[Path, set[int]],
-) -> tuple[bool, str]:
-    """Run the gate, reporting whether a blocking violation was actually found.
-
-    Args:
-        validate_content: The enforcer ``validate_content`` callable.
-        all_file_paths: The resolved code-file paths to inspect.
-        repository_root: The repository root path the gate resolves against.
-        all_added_lines_by_path: Per-file working-tree-added line numbers keyed
-            by resolved absolute path.
-
-    Returns:
-        A ``(blocking_present, captured_report)`` pair. ``blocking_present`` is
-        True only when at least one blocking violation landed on an added line;
-        an unreadable changed file alone (which exits the gate non-zero) leaves
-        it False, so the caller fails OPEN. ``captured_report`` is the gate's
-        grouped stderr report.
-    """
-    blocking_by_file, advisory_by_file, skipped_unreadable_count = (
-        _collect_partitioned_violations(
-            validate_content,
-            all_file_paths,
-            repository_root,
-            all_added_lines_by_path,
-            False,
-        )
-    )
-    captured_stderr = io.StringIO()
-    with contextlib.redirect_stderr(captured_stderr):
-        _report_partitioned_violations(
-            blocking_by_file,
-            advisory_by_file,
-            repository_root,
-            False,
-            skipped_unreadable_count,
-        )
-    return bool(blocking_by_file), captured_stderr.getvalue()
-
-
-def _build_deny_reason(
-    all_conflicting_files: list[str] | None, base_ref: str, code_rules_report: str | None
-) -> str | None:
-    """Assemble the spawner-addressed deny reason from the two check results.
-
-    Args:
-        all_conflicting_files: The conflicting file paths from the conflict
-            check, an empty list when clean, or None when that check failed open.
-        base_ref: The base ref named in the conflict section header.
-        code_rules_report: A full CODE_RULES deny section (violations or engine
-            load failure), or None when that check found nothing or failed open.
-
-    Returns:
-        The full deny reason when either check fired, or None when neither
-        produced an issue.
-    """
-    reason_sections: list[str] = []
-    if all_conflicting_files:
-        conflict_lines = "\n".join(f"  {each_path}" for each_path in all_conflicting_files)
-        conflict_header = MERGE_CONFLICT_SECTION_HEADER.format(base_ref=base_ref)
-        reason_sections.append(f"{conflict_header}\n{conflict_lines}")
-    if code_rules_report:
-        reason_sections.append(code_rules_report.strip())
-    if not reason_sections:
-        return None
-    return DENY_REASON_LEAD + "\n\n" + "\n\n".join(reason_sections)
-
-
-def _emit_deny_payload(output_stream: TextIO, reason: str) -> None:
-    """Write the PreToolUse deny payload to the provided stream.
-
-    Args:
-        output_stream: Writable text stream — production code passes
-            ``sys.stdout``; tests pass a ``StringIO`` to capture the JSON.
-        reason: The ``permissionDecisionReason`` text for the deny payload.
-    """
-    deny_payload = {
-        "hookSpecificOutput": {
-            "hookEventName": "PreToolUse",
-            "permissionDecision": "deny",
-            "permissionDecisionReason": reason,
-        }
-    }
-    log_hook_block(
-        calling_hook_name="code_verifier_spawn_preflight_gate.py",
-        hook_event="PreToolUse",
-        block_reason=reason,
-    )
-    output_stream.write(json.dumps(deny_payload) + "\n")
-    output_stream.flush()
-
-
-def _preflight_deny_reason(payload_by_field: dict[str, object]) -> str | None:
-    """Run both pre-flight checks and return a deny reason, or None to allow.
-
-    Args:
-        payload_by_field: The full PreToolUse hook payload, keyed by top-level
-            field name.
-
-    Returns:
-        The deny reason when a check fired, or None when both checks pass or
-        fail open.
-    """
-    working_directory = payload_by_field.get("cwd")
-    resolution = _resolve_repo_root_and_base(
-        working_directory if isinstance(working_directory, str) else None
-    )
-    if resolution is None:
-        return None
-    repo_root, merge_base_sha, base_ref = resolution
-    conflicting_files = _conflicting_files(repo_root, base_ref)
-    surface = _working_tree_added_lines_by_path(repo_root, merge_base_sha)
-    code_rules_report = None
-    if surface is not None:
-        file_paths, added_lines_by_path = surface
-        code_rules_report = _code_rules_report(repo_root, file_paths, added_lines_by_path)
-    return _build_deny_reason(conflicting_files, base_ref, code_rules_report)
-
-
-def main() -> None:
-    try:
-        hook_payload = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-    if not isinstance(hook_payload, dict):
-        sys.exit(0)
-    if not _should_run(hook_payload):
-        sys.exit(0)
-    deny_reason = _preflight_deny_reason(hook_payload)
-    if deny_reason is not None:
-        _emit_deny_payload(sys.stdout, deny_reason)
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

package/hooks/blocking/config/code_review_enforcement_constants.py

@@ -1,143 +0,0 @@
-"""Single source of truth for the code-review enforcement gate family.
-
-::
-
-    CLAUDE_CODE_REVIEW_ENFORCEMENT=1  ->  CODE_REVIEW_ENFORCEMENT_ENABLED True
-    (unset)                           ->  CODE_REVIEW_ENFORCEMENT_ENABLED False
-    effort_meets_threshold("xhigh", PUSH_REQUIRED_EFFORT)       -> True
-    effort_meets_threshold("high", PR_CREATE_REQUIRED_EFFORT)   -> False
-
-Every gate reads its thresholds and messages from here, so the effort a push
-needs and the effort a pull request needs never drift apart. The master flag
-tracks the environment, so a machine opts in through its own environment and
-the choice outlives a reinstall that rewrites this shipped file.
-"""
-
-from __future__ import annotations
-
-import os
-
-CODE_REVIEW_ENFORCEMENT_ENV_VAR = "CLAUDE_CODE_REVIEW_ENFORCEMENT"
-ALL_ENFORCEMENT_ENABLED_ENV_VALUES = frozenset({"1", "true", "yes", "on"})
-
-
-def code_review_enforcement_enabled_in_environment() -> bool:
-    """Read whether this machine turns the code-review gates on.
-
-    ::
-
-        CLAUDE_CODE_REVIEW_ENFORCEMENT=1      -> True
-        CLAUDE_CODE_REVIEW_ENFORCEMENT=" On " -> True
-        CLAUDE_CODE_REVIEW_ENFORCEMENT=0      -> False
-        (variable unset)                      -> False
-
-    A machine opts in through its own environment, so an install that rewrites
-    this shipped file leaves the choice standing. Any value outside the enabled
-    set, and an unset variable, read as off, so the gate family stays quiet
-    until someone asks for it.
-
-    Returns:
-        True when the variable holds an enabled value, False otherwise.
-    """
-    raw_environment_setting = os.environ.get(CODE_REVIEW_ENFORCEMENT_ENV_VAR, "")
-    return raw_environment_setting.strip().lower() in ALL_ENFORCEMENT_ENABLED_ENV_VALUES
-
-
-CODE_REVIEW_ENFORCEMENT_ENABLED = code_review_enforcement_enabled_in_environment()
-STAMP_DIRECTORY_NAME = "code-review-stamps"
-ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER = ("low", "medium", "high", "xhigh", "max")
-PUSH_REQUIRED_EFFORT = "low"
-PR_CREATE_REQUIRED_EFFORT = "xhigh"
-STAMP_KEY_EFFORT = "effort"
-STAMP_KEY_MANIFEST_SHA256 = "manifest_sha256"
-STAMP_KEY_RECORDED_AT_EPOCH = "recorded_at_epoch"
-CODE_REVIEW_BYPASS_MARKER = "# code-review-skip"
-GATED_PUSH_SUBCOMMANDS = frozenset({"push"})
-ALL_GATED_SHELL_TOOL_NAMES = ("Bash", "PowerShell")
-ALL_WRITE_EDIT_TOOL_NAMES = ("Write", "Edit", "MultiEdit")
-MCP_CREATE_PULL_REQUEST_TOOL_NAME = "mcp__plugin_github_github__create_pull_request"
-HASH_PREVIEW_LENGTH = 16
-PRE_TOOL_USE_HOOK_EVENT_NAME = "PreToolUse"
-DENY_PERMISSION_DECISION = "deny"
-PUSH_GATE_HOOK_MODULE_NAME = "code_review_push_gate.py"
-PR_CREATE_GATE_HOOK_MODULE_NAME = "code_review_pr_create_gate.py"
-STAMP_WRITE_BLOCKER_HOOK_MODULE_NAME = "code_review_stamp_directory_write_blocker.py"
-SANCTIONED_STAMP_MINTER_FLAG = "--record-stamp"
-PUSH_GATE_CORRECTIVE_MESSAGE = (
-    "BLOCKED: [CODE_REVIEW_PUSH_GATE] This branch surface has no clean "
-    "code-review stamp at effort 'low' or higher. Run "
-    "`python invoke_code_review.py --record-stamp --cwd <dir> "
-    "--session-model <alias> low` (or a higher effort) so a clean review "
-    "mints the stamp before `git push`; any file change after minting "
-    "invalidates it. Append `# code-review-skip` as a trailing shell comment "
-    "only when the verified-commit gate's verify-skip rule for a same-surface "
-    "re-land applies. Exempt automatically: docs/image files, pytest test "
-    "files, and Python files whose docstring- and comment-stripped AST is "
-    "unchanged."
-)
-PR_CREATE_GATE_CORRECTIVE_MESSAGE = (
-    "BLOCKED: [CODE_REVIEW_PR_CREATE_GATE] This branch surface has no clean "
-    "code-review stamp at effort 'xhigh' or higher. Run "
-    "`python invoke_code_review.py --record-stamp --cwd <dir> "
-    "--session-model <alias> xhigh` (or max) so a clean review mints the "
-    "stamp before `gh pr create` or the MCP create_pull_request tool. Any "
-    "file change after minting invalidates the stamp."
-)
-STAMP_DIRECTORY_GUARD_MESSAGE = (
-    "BLOCKED: [CODE_REVIEW_STAMP_DIRECTORY_GUARD] Access to the code-review "
-    "stamp directory (~/.claude/code-review-stamps/) is denied. Only "
-    "invoke_code_review.py --record-stamp mints stamp files; a shell or "
-    "Write/Edit forge here would defeat the push and PR-create gates. "
-    "Earn a stamp by running a clean /code-review through the invoker."
-)
-RELATIVE_STAMP_DIRECTORY_PATTERN = r"(?:^|(?<=[\s;&|(='\"]))code-review-stamps[\\/]"
-STAMP_DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?code-review-stamps[\\/]?['\"]?(?=[\s;&|]|$)"
-STAMP_FILE_REFERENCE_BOUNDARY_PREFIX_PATTERN = r"(?:^|(?<=[\s;&|(='\"\\/]))"
-STAMP_FILE_ROOT_KEY_JSON_SUFFIX_PATTERN = r"[\\/][0-9a-f]{%d}\.json"
-GH_PR_CREATE_INVOCATION_PATTERN = (
-    r"(?:^|[;&|\n`({]|\$\()[ \t]*"
-    r"(?:(?:if|then|else|elif|while|until|do|!)[ \t]+)*"
-    r"(?:[A-Za-z_][A-Za-z0-9_]*=\S+[ \t]+)*"
-    r"gh(?:[ \t]+(?:--[A-Za-z][\w-]*(?:=\S+)?|-[A-Za-z])(?:[ \t]+(?!-)\S+)?)*"
-    r"[ \t]+pr[ \t]+create\b"
-)
-ALL_STAMP_PATH_SEGMENT_NAMES = (".claude", "code-review-stamps")
-ALL_STAMP_PATH_SEGMENT_BODIES = ("claude", "code-review-stamps")
-STAMP_STORE_MODULE_NAME = "code_review_stamp_store"
-STAMP_MINT_FUNCTION_NAME = "record_clean_stamp"
-ALL_STAMP_STORE_FORGE_PATTERNS = (
-    rf"\bimport\s+{STAMP_STORE_MODULE_NAME}\b",
-    rf"\bfrom\s+{STAMP_STORE_MODULE_NAME}\s+import\b",
-    rf"\b{STAMP_MINT_FUNCTION_NAME}\s*\(",
-)
-
-
-def effort_meets_threshold(candidate_effort: str, required_effort: str) -> bool:
-    """Decide whether a recorded effort satisfies a required threshold.
-
-    ::
-
-        effort_meets_threshold("xhigh", "low")  -> True   xhigh outranks low
-        effort_meets_threshold("low", "xhigh")  -> False  low sits below xhigh
-        effort_meets_threshold("ultra", "low")  -> False  ultra is unranked
-
-    A candidate satisfies the threshold when it sits at or above the required
-    token in the ascending order. A token outside the known order — ``ultra``
-    among them — satisfies nothing, so an unrecognized stored effort clears no
-    gate.
-
-    Args:
-        candidate_effort: The effort a recorded stamp was earned at.
-        required_effort: The effort the gate demands for the action.
-
-    Returns:
-        True when both tokens are known and the candidate ranks at or above the
-        required token; False otherwise.
-    """
-    if candidate_effort not in ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER:
-        return False
-    if required_effort not in ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER:
-        return False
-    candidate_rank = ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER.index(candidate_effort)
-    required_rank = ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER.index(required_effort)
-    return candidate_rank >= required_rank