claude-dev-env 2.12.0 → 2.14.0

package/hooks/blocking/config/test_code_review_enforcement_constants.py

@@ -1,166 +0,0 @@
-"""Behavioral tests for the code-review enforcement constants and comparator.
-
-These exercise ``effort_meets_threshold`` against the ordered effort tokens and
-assert the push and pull-request thresholds carry the push-based names the gate
-family reads, so a rename that reintroduces commit terminology fails loudly.
-"""
-
-import importlib.util
-import pathlib
-import re
-
-import pytest
-
-_CONFIG_DIR = pathlib.Path(__file__).parent
-
-SAMPLE_ROOT_KEY_HEX_LENGTH = 16
-
-_constants_spec = importlib.util.spec_from_file_location(
-    "code_review_enforcement_constants",
-    _CONFIG_DIR / "code_review_enforcement_constants.py",
-)
-assert _constants_spec is not None
-assert _constants_spec.loader is not None
-_constants_module = importlib.util.module_from_spec(_constants_spec)
-_constants_spec.loader.exec_module(_constants_module)
-
-effort_meets_threshold = _constants_module.effort_meets_threshold
-CODE_REVIEW_ENFORCEMENT_ENV_VAR = _constants_module.CODE_REVIEW_ENFORCEMENT_ENV_VAR
-code_review_enforcement_enabled_in_environment = (
-    _constants_module.code_review_enforcement_enabled_in_environment
-)
-PUSH_REQUIRED_EFFORT = _constants_module.PUSH_REQUIRED_EFFORT
-PR_CREATE_REQUIRED_EFFORT = _constants_module.PR_CREATE_REQUIRED_EFFORT
-GATED_PUSH_SUBCOMMANDS = _constants_module.GATED_PUSH_SUBCOMMANDS
-ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER = _constants_module.ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER
-PUSH_GATE_CORRECTIVE_MESSAGE = _constants_module.PUSH_GATE_CORRECTIVE_MESSAGE
-SANCTIONED_STAMP_MINTER_FLAG = _constants_module.SANCTIONED_STAMP_MINTER_FLAG
-STAMP_DIRECTORY_GUARD_MESSAGE = _constants_module.STAMP_DIRECTORY_GUARD_MESSAGE
-STAMP_DIRECTORY_NAME = _constants_module.STAMP_DIRECTORY_NAME
-GH_PR_CREATE_INVOCATION_PATTERN = _constants_module.GH_PR_CREATE_INVOCATION_PATTERN
-STAMP_FILE_REFERENCE_BOUNDARY_PREFIX_PATTERN = (
-    _constants_module.STAMP_FILE_REFERENCE_BOUNDARY_PREFIX_PATTERN
-)
-STAMP_FILE_ROOT_KEY_JSON_SUFFIX_PATTERN = _constants_module.STAMP_FILE_ROOT_KEY_JSON_SUFFIX_PATTERN
-
-
-def test_gh_pr_create_pattern_matches_create_but_not_edit() -> None:
-    invocation_pattern = re.compile(GH_PR_CREATE_INVOCATION_PATTERN, re.IGNORECASE)
-    assert invocation_pattern.search("gh pr create --title T --body-file b.md") is not None
-    assert invocation_pattern.search("gh pr edit 1 --title T") is None
-
-
-def test_stamp_file_pattern_fragments_match_a_stamp_file_reference() -> None:
-    stamp_file_pattern = re.compile(
-        STAMP_FILE_REFERENCE_BOUNDARY_PREFIX_PATTERN
-        + re.escape(STAMP_DIRECTORY_NAME)
-        + STAMP_FILE_ROOT_KEY_JSON_SUFFIX_PATTERN % SAMPLE_ROOT_KEY_HEX_LENGTH,
-        re.IGNORECASE,
-    )
-    stamp_file_reference = f"cat {STAMP_DIRECTORY_NAME}/{'a' * SAMPLE_ROOT_KEY_HEX_LENGTH}.json"
-    assert stamp_file_pattern.search(stamp_file_reference) is not None
-    assert stamp_file_pattern.search("cat notes.json") is None
-
-
-def test_higher_effort_meets_a_lower_threshold() -> None:
-    assert effort_meets_threshold("xhigh", "low") is True
-
-
-def test_lower_effort_fails_a_higher_threshold() -> None:
-    assert effort_meets_threshold("low", "xhigh") is False
-
-
-def test_equal_effort_meets_the_threshold() -> None:
-    assert effort_meets_threshold("low", "low") is True
-
-
-def test_ultra_is_unranked_and_meets_nothing() -> None:
-    assert effort_meets_threshold("ultra", "low") is False
-
-
-def test_unknown_required_effort_meets_nothing() -> None:
-    assert effort_meets_threshold("low", "ultra") is False
-
-
-def test_push_requires_the_lowest_effort_token() -> None:
-    every_token_meets_push = all(
-        effort_meets_threshold(each_token, PUSH_REQUIRED_EFFORT)
-        for each_token in ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER
-    )
-    assert every_token_meets_push
-
-
-def test_pr_create_threshold_admits_xhigh_but_rejects_high() -> None:
-    assert effort_meets_threshold("xhigh", PR_CREATE_REQUIRED_EFFORT) is True
-    assert effort_meets_threshold("high", PR_CREATE_REQUIRED_EFFORT) is False
-
-
-def test_gated_push_subcommands_gates_push_not_commit() -> None:
-    assert "push" in GATED_PUSH_SUBCOMMANDS
-    assert "commit" not in GATED_PUSH_SUBCOMMANDS
-
-
-def test_ultra_absent_from_the_ordered_tokens() -> None:
-    assert "ultra" not in ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER
-
-
-def test_push_gate_message_names_the_push_action_and_low_effort() -> None:
-    assert "git push" in PUSH_GATE_CORRECTIVE_MESSAGE
-    assert "CODE_REVIEW_PUSH_GATE" in PUSH_GATE_CORRECTIVE_MESSAGE
-    assert "'low'" in PUSH_GATE_CORRECTIVE_MESSAGE
-
-
-def test_guard_message_directs_users_to_the_sanctioned_minter_flag() -> None:
-    assert SANCTIONED_STAMP_MINTER_FLAG in STAMP_DIRECTORY_GUARD_MESSAGE
-
-
-def test_enforcement_defaults_to_off(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.delenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, raising=False)
-    assert code_review_enforcement_enabled_in_environment() is False
-
-
-@pytest.mark.parametrize("enabling_value", ["1", "true", "TRUE", " yes ", "on"])
-def test_enforcement_turns_on_for_each_enabling_environment_value(
-    monkeypatch: pytest.MonkeyPatch, enabling_value: str
-) -> None:
-    monkeypatch.setenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, enabling_value)
-    assert code_review_enforcement_enabled_in_environment() is True
-
-
-@pytest.mark.parametrize("non_enabling_value", ["0", "false", "off", "", "maybe"])
-def test_enforcement_stays_off_for_a_non_enabling_environment_value(
-    monkeypatch: pytest.MonkeyPatch, non_enabling_value: str
-) -> None:
-    monkeypatch.setenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, non_enabling_value)
-    assert code_review_enforcement_enabled_in_environment() is False
-
-
-def _module_flag_after_a_fresh_import(
-    monkeypatch: pytest.MonkeyPatch, environment_value: str | None
-) -> bool:
-    if environment_value is None:
-        monkeypatch.delenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, raising=False)
-    else:
-        monkeypatch.setenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, environment_value)
-    fresh_spec = importlib.util.spec_from_file_location(
-        "code_review_enforcement_constants_fresh_import",
-        _CONFIG_DIR / "code_review_enforcement_constants.py",
-    )
-    assert fresh_spec is not None
-    assert fresh_spec.loader is not None
-    fresh_module = importlib.util.module_from_spec(fresh_spec)
-    fresh_spec.loader.exec_module(fresh_module)
-    flag_value: bool = fresh_module.CODE_REVIEW_ENFORCEMENT_ENABLED
-    return flag_value
-
-
-def test_module_flag_turns_on_when_the_environment_asks_for_enforcement(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    assert _module_flag_after_a_fresh_import(monkeypatch, "true") is True
-
-
-def test_module_flag_stays_off_when_the_environment_is_unset(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    assert _module_flag_after_a_fresh_import(monkeypatch, None) is False

package/hooks/blocking/config/verified_commit_constants.py

@@ -1,160 +0,0 @@
-"""Constants for the verified-commit gate hook family.
-
-Shared by ``verification_verdict_store.py``, ``verified_commit_gate.py``,
-and ``verifier_verdict_minter.py`` so every tunable lives in one place.
-"""
-
-from __future__ import annotations
-
-GIT_TIMEOUT_SECONDS = 30
-ROOT_KEY_HEX_LENGTH = 16
-VERDICT_JSON_INDENT = 2
-CLAUDE_HOME_DIRECTORY_NAME = ".claude"
-VERDICT_DIRECTORY_NAME = "verification"
-VERDICT_DIRECTORY_NAME_SEPARATOR_PATTERN = r"['\"\\/,\s]+"
-VERDICT_DIRECTORY_PATH_BOUNDARY_PATTERN = r"(?=['\"]*[\\/,])"
-RELATIVE_VERDICT_DIRECTORY_PATTERN = r"(?:^|(?<=[\s;&|(='\"]))verification[\\/]"
-VERDICT_PATH_GLUE_PATTERN = r"['\"+\\/\s]*[\\/]['\"+\\/\s]*"
-VERDICT_DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?verification[\\/]?['\"]?(?=[\s;&|]|$)"
-VERDICT_PATH_JOINED_VARIABLE_PATTERN = r"\$\{?(\w+)\}?[\\/]|[\\/]\$\{?(\w+)\}?"
-VERDICT_PATH_VARIABLE_ASSIGNMENT_PATTERN = r"(?:^|(?<=[\s;&|(]))%s=(\S+)"
-VERDICT_FILE_RELATIVE_REFERENCE_PATTERN = (
-    rf"(?:^|(?<=[\s;&|(='\"\\/]))verification[\\/][0-9a-f]{{{ROOT_KEY_HEX_LENGTH}}}\.json"
-)
-PATH_OBFUSCATION_PRIMITIVE_PATTERN = (
-    r"chr\s*\(|bytes\.fromhex\s*\(|b64decode\s*\(|codecs\.decode\s*\("
-    r"|(?:bytes|bytearray)\s*\(\s*\[|\[char\[?\]?\]"
-)
-ALL_VERDICT_PATH_SEGMENT_NAMES = (".claude", "verification")
-ALL_VERDICT_PATH_SEGMENT_BODIES = ("claude", "verification")
-HEX_TOKEN_PATTERN = r"(?<![0-9a-fx])([0-9a-f]{6,})(?![0-9a-f])"
-BASE64_TOKEN_PATTERN = r"[A-Za-z0-9+/]{8,}={0,2}"
-CHARACTER_CODE_SEQUENCE_PATTERN = r"\d{1,3}(?:\s*,\s*\d{1,3})+"
-CHR_CALL_CHAIN_PATTERN = r"chr\(\s*\d{1,3}\s*\)(?:\s*\+\s*chr\(\s*\d{1,3}\s*\))+"
-CHR_CALL_CODE_PATTERN = r"chr\(\s*(\d{1,3})\s*\)"
-HEX_DIGITS_PER_BYTE = 2
-FILE_WRITE_PRIMITIVE_PATTERN = (
-    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
-    r"|Out-File|Set-Content|Add-Content|\btee\b|>"
-)
-NON_REDIRECT_FILE_WRITE_PRIMITIVE_PATTERN = (
-    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
-    r"|Out-File|Set-Content|Add-Content|\btee\b"
-)
-WRITE_CALL_REGION_PATTERN = (
-    r"(?:\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
-    r"|Out-File|Set-Content|Add-Content|\btee\b)[^;&|\n]*"
-)
-VERDICT_KEY_ALL_PASS = "all_pass"
-VERDICT_KEY_MANIFEST_SHA256 = "manifest_sha256"
-VERDICT_KEY_FINDINGS = "findings"
-VERDICT_FINDING_CHECK_KEY = "check"
-LOGS_DIRECTORY_NAME = "logs"
-VERIFIER_VERDICTS_JSONL_FILENAME = "verifier-verdicts.jsonl"
-LEDGER_KEY_TIMESTAMP = "timestamp"
-LEDGER_KEY_REPO_ROOT = "repo_root"
-LEDGER_KEY_BRANCH = "branch"
-LEDGER_KEY_MANIFEST_HASH = "manifest_hash"
-LEDGER_KEY_ALL_PASS = "all_pass"
-LEDGER_KEY_FINDING_COUNT = "finding_count"
-LEDGER_KEY_FINDING_CHECK_NAMES = "finding_check_names"
-LEDGER_KEY_MINTED_FROM_AGENT_ID = "minted_from_agent_id"
-VERDICT_FILE_GLOB = "*.json"
-SUBAGENTS_DIRECTORY_NAME = "subagents"
-AGENT_TRANSCRIPT_GLOB = "agent-*.jsonl"
-AGENT_META_SIDECAR_SUFFIX = ".meta.json"
-AGENT_META_TYPE_KEY = "agentType"
-TRANSCRIPT_ENTRY_TYPE_KEY = "type"
-TRANSCRIPT_ASSISTANT_ENTRY_TYPE = "assistant"
-TRANSCRIPT_MESSAGE_KEY = "message"
-TRANSCRIPT_CONTENT_KEY = "content"
-TRANSCRIPT_CONTENT_TYPE_KEY = "type"
-TRANSCRIPT_TEXT_CONTENT_TYPE = "text"
-TRANSCRIPT_TEXT_KEY = "text"
-VERDICT_FENCE_PATTERN = r"```verdict\s*\n(.*?)```"
-MANIFEST_HASH_CLI_FLAG = "--manifest-hash"
-MANIFEST_HASH_FOR_BRANCH_CLI_FLAG = "--manifest-hash-for-branch"
-WORKTREE_LIST_PATH_PREFIX = "worktree "
-WORKTREE_LIST_BRANCH_PREFIX = "branch "
-BRANCH_REFERENCE_PREFIX = "refs/heads/"
-EMPTY_SURFACE_GUARD_MESSAGE = (
-    "ERROR: The work tree at {repo_root} has no changed or untracked files "
-    "versus origin/main (empty change surface). This work tree holds nothing "
-    "to verify — you are pointed at the wrong work tree. Run `git worktree list` "
-    "to see all checked-out work trees and target the one on the branch under review."
-)
-BRANCH_WORKTREE_ABSENT_MESSAGE = (
-    "ERROR: No work tree has branch '{branch}' checked out. "
-    "Check it out in a work tree first: "
-    "`git worktree add <path> <branch>` or `git checkout <branch>`."
-)
-DOCS_ONLY_EXTENSIONS = frozenset(
-    {".md", ".txt", ".rst", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".ico"}
-)
-PYTHON_EXTENSION = ".py"
-TEST_FILE_PREFIX = "test_"
-TEST_FILE_SUFFIX = "_test.py"
-CONFTEST_FILE_NAME = "conftest.py"
-MINIMUM_STATUS_FIELD_COUNT = 2
-ALL_FALLBACK_BASE_REFERENCES = ("origin/main", "origin/master")
-DETACHED_HEAD_LABEL = "HEAD"
-BRANCH_REMOTE_CONFIG_KEY_TEMPLATE = "branch.{branch_name}.remote"
-ALL_TOOLING_STATE_PREFIXES = (
-    ".claude/verification/",
-    ".claude/worktrees/",
-    ".claude/daemon/",
-    ".claude/teams/",
-    ".claude/sessions/",
-    ".cursor/worktrees/",
-    ".claude-plugin-data/",
-)
-GATED_GIT_SUBCOMMANDS = frozenset({"commit", "push"})
-ALL_GIT_BINARY_NAMES = frozenset({"git", "git.exe"})
-VALUE_TAKING_GIT_OPTIONS = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace"})
-REPO_DIRECTORY_OPTION = "-C"
-WORK_TREE_OPTION = "--work-tree"
-DIRECTORY_CHANGE_VERBS = frozenset({"cd", "pushd", "set-location", "sl"})
-DIRECTORY_CHANGE_PATH_OPTIONS = frozenset({"-path", "-literalpath"})
-DIRECTORY_CHANGE_OPTION_TERMINATOR = "--"
-DIRECTORY_CHANGE_PATTERN_PREFIX = r"(?:^|(?<=[\s;&|(]))(?:"
-DIRECTORY_CHANGE_PATTERN_SUFFIX = r")(?=\s|$)"
-DIRECTORY_CHANGE_OPTION_PREFIX_PATTERN = r"(?:[ \t]+(?:%s)(?=\s|$))*"
-DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?\S*"
-CLAUDE_HOME_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
-VERDICT_DIRECTORY_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
-COMMAND_AFTER_DIRECTORY_CHANGE_PATTERN = r"[;&|\n][\s]*\S"
-OPTION_WITH_VALUE_STEP = 2
-ALL_GATED_TOOL_NAMES = ("Bash", "PowerShell")
-HASH_PREVIEW_LENGTH = 16
-VERIFICATION_BYPASS_MARKER = "# verify-skip"
-MINTING_AGENT_TYPE = "code-verifier"
-VERDICT_DIRECTORY_GUARD_MESSAGE = (
-    "BLOCKED: [VERDICT_DIRECTORY_GUARD] Shell access to the verification "
-    "verdict directory (~/.claude/verification/) is denied. Only the "
-    "verifier_verdict_minter.py SubagentStop hook writes verdict files; a "
-    "shell write here would forge a passing verdict and defeat the "
-    "verified-commit gate. Spawn the code-verifier agent to earn a verdict "
-    "instead of writing one."
-)
-CORRECTIVE_MESSAGE = (
-    "BLOCKED: [VERIFIED_COMMIT_GATE] This branch surface has no passing "
-    "verification verdict. Clear commit-committability gates first "
-    "(CODE_RULES on changed lines and merge conflicts vs base — the "
-    "code_verifier_spawn_preflight_gate enforces these on the spawn). If a "
-    "prior commit failed on CODE_RULES or staging, fix those before "
-    "re-verifying. Then spawn the code-verifier agent (Agent or Task tool, "
-    "subagent_type 'code-verifier') with the task texts, the diff scope, "
-    "and recorded baselines; when it finishes with a clean verdict the "
-    "SubagentStop hook mints the verdict and this command will pass. Any "
-    "file change after verification invalidates the verdict, so verify "
-    "last only after commit gates are green. The verdict binds to the exact "
-    "surface content (every changed and untracked file's bytes), not to a "
-    "work-tree path, so a commit from a different work tree passes only "
-    "when its surface is byte-identical; a work tree carrying any extra or "
-    "later edit has a surface no verdict covers. To land this change, run "
-    "this command from the work tree that holds the verified surface, or "
-    "verify this surface here. Exempt automatically: docs/image files, "
-    "pytest test files, and "
-    "Python files whose docstring- and comment-stripped AST is unchanged "
-    "(comment-only edits in non-Python files are not exempt)."
-)

package/hooks/blocking/config/verified_commit_context_constants.py

@@ -1,21 +0,0 @@
-"""The additionalContext text the verified-commit gate attaches to a deny.
-
-The gate injects this next to the blocked tool result so the agent learns,
-at the moment of the block, when the '# verify-skip' marker is legitimate
-and when a fresh verification is required instead.
-"""
-
-VERIFY_SKIP_ADDITIONAL_CONTEXT = (
-    "The verified-commit gate honors a one-command escape hatch: appending the "
-    "marker '# verify-skip' as a trailing shell comment (outside every quoted "
-    "region) to the blocked command bypasses the gate for that command only. "
-    "It is allowed only when the branch surface is the "
-    "same code a code-verifier already passed clean and the gate is "
-    "blocking on a verdict that does not cover it (an unminted verdict, "
-    "staging churn, or a reverted concurrent write) — confirm the verified "
-    "suite still passes and the diff holds nothing beyond the clean verdict "
-    "before using it. Any real code change since that clean verdict, a "
-    "first verification, or unrepaired findings all require a fresh "
-    "verification by the code-verifier agent instead. Full rule: "
-    "~/.claude/rules/verified-commit-gate-skip.md."
-)

package/hooks/blocking/config/verified_commit_gate_output_constants.py

@@ -1,14 +0,0 @@
-"""Output-shape constants for the verified-commit gate's deny payload.
-
-Shared by ``verified_commit_gate.py`` and its ``verified_commit_gate_parts``
-package so the PreToolUse event name, the deny decision string, the hook's
-own module name for block logging, and the regex-alternation join separator
-live in one place.
-"""
-
-from __future__ import annotations
-
-PRE_TOOL_USE_HOOK_EVENT_NAME = "PreToolUse"
-DENY_PERMISSION_DECISION = "deny"
-GATE_HOOK_MODULE_NAME = "verified_commit_gate.py"
-REGEX_ALTERNATION_SEPARATOR = "|"

package/hooks/blocking/conftest.py

@@ -1,123 +0,0 @@
-"""Pytest fixture that reproduces foreign-``config`` shadowing for the gate family.
-
-The verified-commit gate hooks import shared constants as
-``from config.verified_commit_constants import ...``. This fixture mirrors the
-installed layout that breaks that import -- a real ``hooks/blocking`` package
-beside a decoy ``hooks/config`` regular package -- and runs a caller-supplied
-driver as a subprocess whose ``sys.path`` places the decoy ahead of
-``blocking``, the ordering under which the wrong ``config`` wins resolution.
-"""
-
-import shutil
-import subprocess
-import sys
-import textwrap
-from collections.abc import Callable
-from pathlib import Path
-
-import pytest
-
-_BLOCKING_SOURCE_DIRECTORY = Path(__file__).resolve().parent
-_HOOKS_CONSTANTS_SOURCE_DIRECTORY = _BLOCKING_SOURCE_DIRECTORY.parent / "hooks_constants"
-_SUBPROCESS_TIMEOUT_SECONDS = 60
-_MIRRORED_BLOCKING_FILE_NAMES = (
-    "verified_commit_gate.py",
-    "verification_verdict_store.py",
-    "verifier_verdict_minter.py",
-    "verdict_directory_write_blocker.py",
-    "verified_commit_config_bootstrap.py",
-    "code_review_enforcement_config_bootstrap.py",
-    "code_review_stamp_store.py",
-)
-_DECOY_CONFIG_INIT_SOURCE = '"""Foreign config package that must never win resolution."""\n'
-_DECOY_CONFIG_CONSTANTS_SOURCE = (
-    '"""Stale stand-in carrying none of the real gate constants."""\n\nIS_DECOY_CONFIG = True\n'
-)
-
-
-def _copy_mirrored_packages(mirrored_hooks_directory: Path, mirrored_blocking_directory: Path) -> None:
-    """Copy the ``config``, gate-parts, and ``hooks_constants`` packages into the mirror."""
-    shutil.copytree(_BLOCKING_SOURCE_DIRECTORY / "config", mirrored_blocking_directory / "config")
-    shutil.copytree(
-        _BLOCKING_SOURCE_DIRECTORY / "verified_commit_gate_parts",
-        mirrored_blocking_directory / "verified_commit_gate_parts",
-        ignore=shutil.ignore_patterns("tests", "__pycache__"),
-    )
-    shutil.copytree(_HOOKS_CONSTANTS_SOURCE_DIRECTORY, mirrored_hooks_directory / "hooks_constants")
-
-
-def _write_decoy_config_package(mirrored_hooks_directory: Path) -> None:
-    """Write the decoy ``config`` package that must never win resolution."""
-    decoy_config_directory = mirrored_hooks_directory / "config"
-    decoy_config_directory.mkdir()
-    (decoy_config_directory / "__init__.py").write_text(_DECOY_CONFIG_INIT_SOURCE, encoding="utf-8")
-    (decoy_config_directory / "verified_commit_constants.py").write_text(
-        _DECOY_CONFIG_CONSTANTS_SOURCE, encoding="utf-8"
-    )
-
-
-def _build_shadowed_hook_tree(tmp_path: Path) -> tuple[Path, Path]:
-    """Mirror the hook tree with a decoy ``config`` package beside ``blocking``.
-
-    Args:
-        tmp_path: The directory the mirrored tree is built under.
-
-    Returns:
-        The mirrored ``hooks`` directory and its ``blocking`` subdirectory.
-    """
-    mirrored_hooks_directory = tmp_path / "hooks"
-    mirrored_blocking_directory = mirrored_hooks_directory / "blocking"
-    mirrored_blocking_directory.mkdir(parents=True)
-
-    for each_file_name in _MIRRORED_BLOCKING_FILE_NAMES:
-        source_file = _BLOCKING_SOURCE_DIRECTORY / each_file_name
-        if source_file.exists():
-            shutil.copy2(source_file, mirrored_blocking_directory / each_file_name)
-
-    _copy_mirrored_packages(mirrored_hooks_directory, mirrored_blocking_directory)
-    _write_decoy_config_package(mirrored_hooks_directory)
-    return mirrored_hooks_directory, mirrored_blocking_directory
-
-
-def _probe_command(mirrored_hooks_directory: Path, mirrored_blocking_directory: Path) -> str:
-    """Build the ``sys.path`` preamble that shadows ``blocking`` with the decoy config."""
-    return textwrap.dedent(
-        f"""\
-        import sys
-        sys.path.insert(0, {str(mirrored_blocking_directory)!r})
-        sys.path.insert(0, {str(mirrored_hooks_directory)!r})
-        """
-    )
-
-
-@pytest.fixture
-def run_under_config_shadow(
-    tmp_path: Path,
-) -> Callable[[str], subprocess.CompletedProcess[str]]:
-    """Return a runner that executes a driver under a foreign-``config`` sys.path.
-
-    ``run_under_config_shadow("import verified_commit_gate")`` returns 0 once
-    the bootstrap seeds the real module, nonzero while the decoy config wins.
-
-    Args:
-        tmp_path: Pytest's per-test temporary directory, fixture-injected.
-
-    Returns:
-        A function taking driver source text and returning the finished
-        subprocess result.
-    """
-    mirrored_hooks_directory, mirrored_blocking_directory = _build_shadowed_hook_tree(tmp_path)
-    sys_path_preamble = _probe_command(mirrored_hooks_directory, mirrored_blocking_directory)
-
-    def run_driver(driver_body: str) -> subprocess.CompletedProcess[str]:
-        probe_script = tmp_path / "probe.py"
-        probe_script.write_text(sys_path_preamble + textwrap.dedent(driver_body), encoding="utf-8")
-        return subprocess.run(
-            [sys.executable, str(probe_script)],
-            check=False,
-            capture_output=True,
-            text=True,
-            timeout=_SUBPROCESS_TIMEOUT_SECONDS,
-        )
-
-    return run_driver