claude-dev-env 2.2.0 → 2.3.0

package/_shared/pr-loop/scripts/tests/test_revoke_project_claude_permissions.py

@@ -31,7 +31,7 @@ def _load_revoke_module() -> ModuleType:
 
 def test_module_imports_constants_from_config_modules() -> None:
     revoke_module = _load_revoke_module()
-    assert revoke_module.ALL_PERMISSION_ALLOW_TOOLS == ("Edit", "Write", "Read")
+    assert revoke_module.ALL_PERMISSION_ALLOW_TOOLS == ("Edit", "Read")
     assert revoke_module.AUTO_MODE_ENVIRONMENT_ENTRY_PREFIX == (
         "Trusted local workspace:"
     )
@@ -49,3 +49,90 @@ def test_revoke_module_guards_sys_path_insert_against_duplicates() -> None:
         "revoke_project_claude_permissions.py must guard sys.path.insert against "
         "duplicate entries on reload (consistent with sibling modules)"
     )
+
+
+def _section_of(settings: dict[str, object], section_key: str) -> dict[str, object]:
+    section = settings[section_key]
+    assert isinstance(section, dict)
+    return section
+
+
+def test_remove_values_from_list_removes_matching_strings() -> None:
+    revoke_module = _load_revoke_module()
+    target_list: list[object] = ["keep", "drop", 7, "drop"]
+    removed_count = revoke_module.remove_values_from_list(target_list, {"drop"})
+    assert removed_count == 2
+    assert target_list == ["keep", 7]
+
+
+def test_remove_rules_from_allow_list_removes_named_rules() -> None:
+    revoke_module = _load_revoke_module()
+    settings: dict[str, object] = {
+        "permissions": {
+            "allow": ["Edit(/proj/.claude/**)", "Read(/proj/.claude/**)"],
+        },
+    }
+    removed_count = revoke_module.remove_rules_from_allow_list(
+        settings, ["Edit(/proj/.claude/**)"]
+    )
+    assert removed_count == 1
+    assert _section_of(settings, "permissions")["allow"] == ["Read(/proj/.claude/**)"]
+
+
+def test_remove_rules_from_deny_list_removes_named_rules() -> None:
+    revoke_module = _load_revoke_module()
+    settings: dict[str, object] = {
+        "permissions": {
+            "deny": ["Edit(/proj/.claude/hooks/**)", "Read(/proj/.claude/hooks/**)"],
+        },
+    }
+    removed_count = revoke_module.remove_rules_from_deny_list(
+        settings, ["Edit(/proj/.claude/hooks/**)"]
+    )
+    assert removed_count == 1
+    assert _section_of(settings, "permissions")["deny"] == [
+        "Read(/proj/.claude/hooks/**)"
+    ]
+
+
+def test_remove_directory_from_additional_directories_removes_entry() -> None:
+    revoke_module = _load_revoke_module()
+    settings: dict[str, object] = {
+        "permissions": {
+            "additionalDirectories": ["/proj", "/other"],
+        },
+    }
+    removed_count = revoke_module.remove_directory_from_additional_directories(
+        settings, "/proj"
+    )
+    assert removed_count == 1
+    assert _section_of(settings, "permissions")["additionalDirectories"] == ["/other"]
+
+
+def test_remove_trust_entries_for_project_removes_every_project_entry() -> None:
+    revoke_module = _load_revoke_module()
+    trust_prefix = revoke_module.AUTO_MODE_ENVIRONMENT_ENTRY_PREFIX
+    project_entry_a = "Trusted local workspace: /proj/.claude/** wording A"
+    project_entry_b = "Trusted local workspace: /proj/.claude/** wording B"
+    other_project_entry = "Trusted local workspace: /other/.claude/** unrelated"
+    settings: dict[str, object] = {
+        "autoMode": {
+            "environment": [project_entry_a, project_entry_b, other_project_entry],
+        },
+    }
+    removed_count = revoke_module.remove_trust_entries_for_project(
+        settings, "/proj", trust_prefix
+    )
+    assert removed_count == 2
+    assert _section_of(settings, "autoMode")["environment"] == [other_project_entry]
+
+
+def test_prune_settings_after_revoke_drops_empty_sections() -> None:
+    revoke_module = _load_revoke_module()
+    settings: dict[str, object] = {
+        "permissions": {"allow": [], "deny": []},
+        "autoMode": {"environment": []},
+    }
+    revoke_module.prune_settings_after_revoke(settings)
+    assert "permissions" not in settings
+    assert "autoMode" not in settings

package/_shared/pr-loop/scripts/tests/test_stale_worktree_rule_sweep.py

@@ -0,0 +1,301 @@
+"""Behavioral tests for stale_worktree_rule_sweep.
+
+Drives the real sweep functions against real temp directories and a real
+temp settings file, and drives the real grant and revoke flows end to end.
+A live worktree directory exists on disk; a dead worktree path does not. The
+sweep keeps every rule whose worktree directory still exists and drops every
+rule whose worktree directory is gone, then removes exact duplicates from
+each rule array. The grant and revoke runs perform that sweep before they
+save, so a run whose only effect is the sweep still persists the cleanup.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+
+def _load_scripts_module(module_name: str) -> ModuleType:
+    scripts_directory = Path(__file__).parent.parent
+    parent_directory = str(scripts_directory.resolve())
+    if parent_directory not in sys.path:
+        sys.path.insert(0, parent_directory)
+    module_path = scripts_directory / f"{module_name}.py"
+    specification = importlib.util.spec_from_file_location(module_name, module_path)
+    assert specification is not None
+    assert specification.loader is not None
+    module = importlib.util.module_from_spec(specification)
+    specification.loader.exec_module(module)
+    return module
+
+
+def _load_sweep_module() -> ModuleType:
+    return _load_scripts_module("stale_worktree_rule_sweep")
+
+
+permissions_common = _load_scripts_module("_claude_permissions_common")
+
+
+def _make_live_worktree_directory(worktrees_root: Path) -> Path:
+    live_worktree_directory = worktrees_root / "repo" / "live-worktree"
+    live_worktree_directory.mkdir(parents=True)
+    return live_worktree_directory
+
+
+def _allow_rule_for(worktree_directory: Path) -> str:
+    return f"Edit({worktree_directory}/.claude/**)"
+
+
+def _deny_rule_for(worktree_directory: Path) -> str:
+    return f"Read({worktree_directory}/.claude/settings*.json)"
+
+
+def _permission_list(all_settings: dict[str, object], list_key: str) -> list[object]:
+    permissions_section = all_settings["permissions"]
+    assert isinstance(permissions_section, dict)
+    rule_list = permissions_section[list_key]
+    assert isinstance(rule_list, list)
+    return rule_list
+
+
+def test_sweep_keeps_live_worktree_rules_and_drops_dead_ones(tmp_path: Path) -> None:
+    sweep_module = _load_sweep_module()
+    live_worktree_directory = _make_live_worktree_directory(tmp_path)
+    dead_worktree_directory = tmp_path / "repo" / "dead-worktree"
+    live_allow_rule = _allow_rule_for(live_worktree_directory)
+    dead_allow_rule = _allow_rule_for(dead_worktree_directory)
+    live_deny_rule = _deny_rule_for(live_worktree_directory)
+    dead_deny_rule = _deny_rule_for(dead_worktree_directory)
+    all_settings: dict[str, object] = {
+        "permissions": {
+            "allow": [live_allow_rule, dead_allow_rule],
+            "deny": [live_deny_rule, dead_deny_rule],
+        },
+    }
+    removed_count = sweep_module.sweep_and_deduplicate_permission_lists(
+        all_settings, tmp_path
+    )
+    assert removed_count == 2
+    assert _permission_list(all_settings, "allow") == [live_allow_rule]
+    assert _permission_list(all_settings, "deny") == [live_deny_rule]
+
+
+def test_sweep_keeps_live_flat_worktree_rules_and_drops_dead_ones(tmp_path: Path) -> None:
+    sweep_module = _load_sweep_module()
+    live_worktree_directory = tmp_path / "flat-live"
+    live_worktree_directory.mkdir(parents=True)
+    dead_worktree_directory = tmp_path / "flat-dead"
+    live_allow_rule = _allow_rule_for(live_worktree_directory)
+    dead_allow_rule = _allow_rule_for(dead_worktree_directory)
+    all_settings: dict[str, object] = {
+        "permissions": {
+            "allow": [live_allow_rule, dead_allow_rule],
+            "deny": [],
+        },
+    }
+    removed_count = sweep_module.sweep_and_deduplicate_permission_lists(
+        all_settings, tmp_path
+    )
+    assert removed_count == 1
+    assert _permission_list(all_settings, "allow") == [live_allow_rule]
+
+
+def test_sweep_leaves_rules_for_projects_outside_the_worktrees_root(
+    tmp_path: Path,
+) -> None:
+    sweep_module = _load_sweep_module()
+    unrelated_project_rule = "Edit(/home/developer/project/.claude/**)"
+    all_settings: dict[str, object] = {
+        "permissions": {"allow": [unrelated_project_rule]},
+    }
+    removed_count = sweep_module.sweep_and_deduplicate_permission_lists(
+        all_settings, tmp_path
+    )
+    assert removed_count == 0
+    assert _permission_list(all_settings, "allow") == [unrelated_project_rule]
+
+
+def test_sweep_removes_exact_duplicate_rules(tmp_path: Path) -> None:
+    sweep_module = _load_sweep_module()
+    live_worktree_directory = _make_live_worktree_directory(tmp_path)
+    live_allow_rule = _allow_rule_for(live_worktree_directory)
+    all_settings: dict[str, object] = {
+        "permissions": {"allow": [live_allow_rule, live_allow_rule]},
+    }
+    removed_count = sweep_module.sweep_and_deduplicate_permission_lists(
+        all_settings, tmp_path
+    )
+    assert removed_count == 1
+    assert _permission_list(all_settings, "allow") == [live_allow_rule]
+
+
+def test_sweep_ignores_malformed_and_non_string_entries(tmp_path: Path) -> None:
+    sweep_module = _load_sweep_module()
+    malformed_entry = "not a rule at all"
+    all_settings: dict[str, object] = {
+        "permissions": {"allow": [malformed_entry, 7, malformed_entry]},
+    }
+    removed_count = sweep_module.sweep_and_deduplicate_permission_lists(
+        all_settings, tmp_path
+    )
+    assert removed_count == 1
+    assert _permission_list(all_settings, "allow") == [malformed_entry, 7]
+
+
+def test_sweep_tolerates_missing_permission_sections(tmp_path: Path) -> None:
+    sweep_module = _load_sweep_module()
+    all_settings: dict[str, object] = {}
+    removed_count = sweep_module.sweep_and_deduplicate_permission_lists(
+        all_settings, tmp_path
+    )
+    assert removed_count == 0
+    assert all_settings == {}
+
+
+def test_sweep_round_trips_through_a_real_temp_settings_file(tmp_path: Path) -> None:
+    sweep_module = _load_sweep_module()
+    worktrees_root = tmp_path / "worktrees"
+    live_worktree_directory = _make_live_worktree_directory(worktrees_root)
+    dead_worktree_directory = worktrees_root / "repo" / "dead-worktree"
+    live_allow_rule = _allow_rule_for(live_worktree_directory)
+    dead_allow_rule = _allow_rule_for(dead_worktree_directory)
+    settings_path = tmp_path / "settings.json"
+    permissions_common.save_settings(
+        settings_path,
+        {"permissions": {"allow": [live_allow_rule, dead_allow_rule]}},
+    )
+    loaded_settings = permissions_common.load_settings(settings_path)
+    sweep_module.sweep_and_deduplicate_permission_lists(loaded_settings, worktrees_root)
+    permissions_common.save_settings(settings_path, loaded_settings)
+    reloaded_settings = permissions_common.load_settings(settings_path)
+    assert _permission_list(reloaded_settings, "allow") == [live_allow_rule]
+
+
+def test_wrapper_resolves_worktrees_root_under_the_user_claude_home(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    sweep_module = _load_sweep_module()
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+    worktrees_root = tmp_path / ".claude" / "worktrees"
+    live_worktree_directory = _make_live_worktree_directory(worktrees_root)
+    dead_worktree_directory = worktrees_root / "repo" / "dead-worktree"
+    live_allow_rule = _allow_rule_for(live_worktree_directory)
+    dead_allow_rule = _allow_rule_for(dead_worktree_directory)
+    all_settings: dict[str, object] = {
+        "permissions": {"allow": [live_allow_rule, dead_allow_rule]},
+    }
+    removed_count = sweep_module.sweep_stale_worktree_rules_from_settings(all_settings)
+    assert removed_count == 1
+    assert _permission_list(all_settings, "allow") == [live_allow_rule]
+
+
+def _prepare_home_with_worktrees(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> tuple[Path, Path, Path]:
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+    worktrees_root = tmp_path / ".claude" / "worktrees"
+    live_worktree_directory = _make_live_worktree_directory(worktrees_root)
+    dead_worktree_directory = worktrees_root / "repo" / "dead-worktree"
+    settings_path = tmp_path / ".claude" / "settings.json"
+    return settings_path, live_worktree_directory, dead_worktree_directory
+
+
+def _make_fake_project(tmp_path: Path) -> Path:
+    fake_project_root = tmp_path / "fake_project"
+    (fake_project_root / ".claude").mkdir(parents=True)
+    return fake_project_root
+
+
+def _seed_allow_rules(settings_path: Path, all_rules: list[object]) -> None:
+    permissions_common.save_settings(
+        settings_path, {"permissions": {"allow": all_rules}}
+    )
+
+
+def _saved_allow_list(settings_path: Path) -> list[object]:
+    saved_settings = permissions_common.load_settings(settings_path)
+    permissions_section = saved_settings.get("permissions")
+    if not isinstance(permissions_section, dict):
+        return []
+    allow_list = permissions_section.get("allow")
+    return allow_list if isinstance(allow_list, list) else []
+
+
+def test_real_grant_run_sweeps_a_dead_worktree_rule_from_saved_settings(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    settings_path, live_directory, dead_directory = _prepare_home_with_worktrees(
+        tmp_path, monkeypatch
+    )
+    live_rule = _allow_rule_for(live_directory)
+    dead_rule = _allow_rule_for(dead_directory)
+    unrelated_rule = "Edit(/home/developer/project/.claude/**)"
+    _seed_allow_rules(settings_path, [live_rule, dead_rule, unrelated_rule])
+    monkeypatch.chdir(_make_fake_project(tmp_path))
+    grant_module = _load_scripts_module("grant_project_claude_permissions")
+    grant_module.grant_permissions_for_current_directory()
+    saved_allow = _saved_allow_list(settings_path)
+    assert dead_rule not in saved_allow
+    assert live_rule in saved_allow
+    assert unrelated_rule in saved_allow
+
+
+def test_real_grant_run_with_only_a_sweep_change_still_saves(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    settings_path, _live_directory, dead_directory = _prepare_home_with_worktrees(
+        tmp_path, monkeypatch
+    )
+    monkeypatch.chdir(_make_fake_project(tmp_path))
+    grant_module = _load_scripts_module("grant_project_claude_permissions")
+    grant_module.grant_permissions_for_current_directory()
+    dead_rule = _allow_rule_for(dead_directory)
+    granted_settings = permissions_common.load_settings(settings_path)
+    _permission_list(granted_settings, "allow").append(dead_rule)
+    permissions_common.save_settings(settings_path, granted_settings)
+    grant_module.grant_permissions_for_current_directory()
+    assert dead_rule not in _saved_allow_list(settings_path)
+
+
+def test_real_revoke_run_sweeps_a_dead_worktree_rule_from_saved_settings(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    settings_path, live_directory, dead_directory = _prepare_home_with_worktrees(
+        tmp_path, monkeypatch
+    )
+    fake_project_root = _make_fake_project(tmp_path)
+    monkeypatch.chdir(fake_project_root)
+    revoke_module = _load_scripts_module("revoke_project_claude_permissions")
+    project_path = str(fake_project_root).replace("\\", "/")
+    project_allow_rules = revoke_module.build_permission_rules(
+        project_path, revoke_module.ALL_PERMISSION_ALLOW_TOOLS
+    )
+    live_rule = _allow_rule_for(live_directory)
+    dead_rule = _allow_rule_for(dead_directory)
+    _seed_allow_rules(settings_path, [*project_allow_rules, live_rule, dead_rule])
+    revoke_module.revoke_permissions_for_current_directory()
+    saved_allow = _saved_allow_list(settings_path)
+    assert dead_rule not in saved_allow
+    assert live_rule in saved_allow
+    for each_project_rule in project_allow_rules:
+        assert each_project_rule not in saved_allow
+
+
+def test_real_revoke_run_with_only_a_sweep_change_still_saves(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    settings_path, _live_directory, dead_directory = _prepare_home_with_worktrees(
+        tmp_path, monkeypatch
+    )
+    dead_rule = _allow_rule_for(dead_directory)
+    _seed_allow_rules(settings_path, [dead_rule])
+    monkeypatch.chdir(_make_fake_project(tmp_path))
+    revoke_module = _load_scripts_module("revoke_project_claude_permissions")
+    revoke_module.revoke_permissions_for_current_directory()
+    assert dead_rule not in _saved_allow_list(settings_path)

package/_shared/pr-loop/scripts/tests/test_stale_worktree_rule_sweep_constants.py

@@ -0,0 +1,85 @@
+"""Behavioral tests for stale_worktree_rule_sweep_constants.
+
+Confirms get_claude_worktrees_root resolves the worktrees directory under
+the user's ~/.claude home, and that the rule-parsing constants carry the
+literal shapes the sweep relies on.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+
+def _load_constants_module() -> ModuleType:
+    scripts_directory = Path(__file__).parent.parent
+    parent_directory = str(scripts_directory.resolve())
+    if parent_directory not in sys.path:
+        sys.path.insert(0, parent_directory)
+    module_path = (
+        scripts_directory
+        / "pr_loop_shared_constants"
+        / "stale_worktree_rule_sweep_constants.py"
+    )
+    specification = importlib.util.spec_from_file_location(
+        "pr_loop_shared_constants.stale_worktree_rule_sweep_constants", module_path
+    )
+    assert specification is not None
+    assert specification.loader is not None
+    module = importlib.util.module_from_spec(specification)
+    specification.loader.exec_module(module)
+    return module
+
+
+def test_worktrees_root_resolves_under_the_user_claude_home(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    constants_module = _load_constants_module()
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+    resolved_worktrees_root = constants_module.get_claude_worktrees_root()
+    assert resolved_worktrees_root == tmp_path / ".claude" / "worktrees"
+
+
+def test_extract_rule_target_path_reads_the_delimited_path() -> None:
+    constants_module = _load_constants_module()
+    extracted_path = constants_module.extract_rule_target_path(
+        "Edit(/repo/wt/.claude/**)"
+    )
+    assert extracted_path == "/repo/wt/.claude/**"
+
+
+def test_extract_rule_target_path_returns_none_for_a_non_rule() -> None:
+    constants_module = _load_constants_module()
+    assert constants_module.extract_rule_target_path("not a rule") is None
+
+
+def test_worktree_directory_for_rule_keeps_nested_segments_below_the_root() -> None:
+    constants_module = _load_constants_module()
+    worktrees_root = Path("/home/dev/.claude/worktrees")
+    resolved_directory = constants_module.worktree_directory_for_rule(
+        "Edit(/home/dev/.claude/worktrees/repo/feature/.claude/**)", worktrees_root
+    )
+    assert resolved_directory == worktrees_root / "repo" / "feature"
+
+
+def test_worktree_directory_for_rule_keeps_one_segment_flat_layout() -> None:
+    constants_module = _load_constants_module()
+    worktrees_root = Path("/home/dev/.claude/worktrees")
+    resolved_directory = constants_module.worktree_directory_for_rule(
+        "Edit(/home/dev/.claude/worktrees/flat-worktree/.claude/**)", worktrees_root
+    )
+    assert resolved_directory == worktrees_root / "flat-worktree"
+
+
+def test_worktree_directory_for_rule_returns_none_outside_the_root() -> None:
+    constants_module = _load_constants_module()
+    worktrees_root = Path("/home/dev/.claude/worktrees")
+    resolved_directory = constants_module.worktree_directory_for_rule(
+        "Edit(/home/dev/project/.claude/**)", worktrees_root
+    )
+    assert resolved_directory is None

package/_shared/pr-loop/worker-spawn.md

@@ -146,7 +146,7 @@ Mode decision:
 | `ThirdParty` | any | `chain` | Headless spawn through `claude_chain_runner` |
 
 The review always runs at effort **high** on model **opus**. Chain mode builds
-a single-turn prompt `/code-review high --fix`, pins `--model opus`, sets
+a single-turn prompt `/code-review xhigh --fix`, pins `--model opus`, sets
 subprocess `cwd` to the PR working tree, and reads stdin from the empty stream
 so the spawn does not wait for input.
 

package/agents/code-verifier.md

@@ -33,7 +33,7 @@ On Windows the same file sits at %USERPROFILE%\.claude\hooks\blocking\verificati
 
 The printed hash commits to every changed and untracked file's content in the verified work tree, so it names that surface no matter which directory you or the committer run from. If the CLI prints an empty-surface or wrong-work-tree error and no hash, you are pointed at a work tree with no changes versus origin/main — re-run with the branch mode to locate the correct work tree.
 
-As the last step before the verdict, put your draft verdict through one best-effort strongest-tier validation pass. Spawn a single validation subagent through the Task tool as the `Explore` agent type at the strongest reachable tier: set the Task `subagent_type` to `Explore`, detect the host profile first per `~/.claude/_shared/advisor/advisor-protocol.md` — the source of truth for host detection, the ladder, and its aliases — then on a Claude host pick the strongest reachable tier on the Fable → Opus → Sonnet → Haiku ladder and on a third-party host use the single third-party tier, and set the Task `model:` field to that tier's alias. The `Explore` type carries no Edit or Write tools and cannot spawn further agents, so the harness itself holds the validator to the no-edit, no-spawn contract the next paragraph names. Hand it the draft verdict together with your evidence — every command you ran with its output, and your two-way diff-to-task mapping — and state that its task is adversarial verification of that supplied draft verdict: refute it against the supplied evidence rather than discover code, naming any gate you misread, any task item you mapped wrong, or any finding that does not hold. When the spawn is unavailable — a Task tool error, an unreachable tier at every rung, or this subagent being barred from spawning further agents — skip the validation pass and emit the draft verdict as it stands, noting the skip in your final message; a spawn failure never blocks the verdict fence from being emitted.
+As the last step before the verdict, put your draft verdict through one best-effort strongest-tier validation pass. Spawn a single validation subagent through the Task tool as the `Explore` agent type at the strongest reachable tier: set the Task `subagent_type` to `Explore`, detect the host profile first per `~/.claude/_shared/advisor/advisor-protocol.md` — the source of truth for host detection, the ladder, and its aliases — then on a Claude host pick the strongest reachable tier on the Fable → Opus → Sonnet → Haiku ladder and on a third-party host use the single third-party tier, and set the Task `model:` field to that tier's alias. The `Explore` type carries no Edit or Write tools and cannot spawn further agents, so the harness itself holds the validator to the no-edit, no-spawn contract the next paragraph names. Hand it the draft verdict together with your evidence — every command you ran with its output, and your two-way diff-to-task mapping — and state that its task is adversarial verification of that supplied draft verdict: refute it against the supplied evidence rather than discover code, naming any gate you misread, any task item you mapped wrong, or any finding that does not hold. This pass is always a cold `Explore` spawn, not a message to the session's warm advisor: the refutation needs a grader with no accumulated session context or prior positions, and the verifier runs in sessions that have no advisor bound. When the spawn is unavailable — a Task tool error, an unreachable tier at every rung, or this subagent being barred from spawning further agents — skip the validation pass and emit the draft verdict as it stands, noting the skip in your final message; a spawn failure never blocks the verdict fence from being emitted.
 
 This validation pass is terminal: the `Explore` type gives the validation subagent no way to spawn a further agent or edit a file, so it answers with prose only. When it refutes any part, re-check that part yourself against the commands and the diff, and correct the verdict before you emit it. When it refutes nothing, the draft verdict stands. Then emit the fenced verdict block below — it stays the last thing in your message so the verifier_verdict_minter hook reads it.
 

package/hooks/blocking/code_rules_shared.py

@@ -412,8 +412,10 @@ def is_ephemeral_path(file_path: str, hook_payload: dict | None = None) -> bool:
     harness session scratchpad. The session scratchpad match reads the session id
     from the payload when one is supplied, and from the harness environment
     variable otherwise, so a caller that holds no payload still gets the match.
-    One call answers path exemption for both families, so a gate that skips
-    throwaway paths need not repeat the two checks itself.
+    The run_all_validators PreToolUse gate calls this predicate to skip a scratch
+    target before it validates. The code-rules and TDD gates call the two path
+    predicates ``is_ephemeral_script_path`` and ``is_under_session_scratchpad``
+    directly.
 
     Args:
         file_path: The candidate path to classify.

package/hooks/blocking/config/verified_commit_constants.py

@@ -48,6 +48,17 @@ WRITE_CALL_REGION_PATTERN = (
 VERDICT_KEY_ALL_PASS = "all_pass"
 VERDICT_KEY_MANIFEST_SHA256 = "manifest_sha256"
 VERDICT_KEY_FINDINGS = "findings"
+VERDICT_FINDING_CHECK_KEY = "check"
+LOGS_DIRECTORY_NAME = "logs"
+VERIFIER_VERDICTS_JSONL_FILENAME = "verifier-verdicts.jsonl"
+LEDGER_KEY_TIMESTAMP = "timestamp"
+LEDGER_KEY_REPO_ROOT = "repo_root"
+LEDGER_KEY_BRANCH = "branch"
+LEDGER_KEY_MANIFEST_HASH = "manifest_hash"
+LEDGER_KEY_ALL_PASS = "all_pass"
+LEDGER_KEY_FINDING_COUNT = "finding_count"
+LEDGER_KEY_FINDING_CHECK_NAMES = "finding_check_names"
+LEDGER_KEY_MINTED_FROM_AGENT_ID = "minted_from_agent_id"
 VERDICT_FILE_GLOB = "*.json"
 SUBAGENTS_DIRECTORY_NAME = "subagents"
 AGENT_TRANSCRIPT_GLOB = "agent-*.jsonl"

package/hooks/blocking/pii_payload_scan.py

@@ -18,6 +18,7 @@ try:
     for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
         if each_bootstrap_directory not in sys.path:
             sys.path.insert(0, each_bootstrap_directory)
+    from code_rules_shared import is_ephemeral_path
     from pii_prevention_blocker_parts.repository_exemption import (
         repository_allowlisted_values,
     )
@@ -47,6 +48,41 @@ except ImportError as import_error:
     ) from import_error
 
 
+def _target_is_ephemeral_outside_repository(
+    file_path: str, hook_payload: dict | None
+) -> bool:
+    """Report whether a write target is a throwaway draft outside every repo.
+
+    ::
+
+        ephemeral path, no repo tree  ->  True   (write scan skipped)
+        ephemeral path inside a repo  ->  False  (write scan kept)
+        ordinary path                 ->  False  (write scan kept)
+
+    A draft under the harness scratchpad or an ephemeral scratch root turns
+    durable only through a surface that keeps its own scan, so scanning it at
+    write time is a false positive. A draft that resolves inside a git tree
+    still carries that repository's own allowlist, so the scan stays.
+
+    Args:
+        file_path: The write target path to classify.
+        hook_payload: The PreToolUse payload carrying the session id, or None to
+            read the session id from the environment alone.
+
+    Returns:
+        True only when the path is ephemeral and no enclosing git repository
+        resolves.
+    """
+    if not file_path:
+        return False
+    if not is_ephemeral_path(file_path, hook_payload):
+        return False
+    resolution_directory = _existing_ancestor_directory(file_path)
+    if resolution_directory is None:
+        return True
+    return resolve_repository_root(resolution_directory) is None
+
+
 def build_deny_reason(all_findings: list[PiiFinding], gate_surface: str) -> str:
     """Return the deny message listing each finding for *gate_surface*.
 
@@ -165,29 +201,16 @@ def _write_path_allowlisted_values(file_path: str) -> frozenset[str]:
     return repository_allowlisted_values(repository_root)
 
 
-def evaluate_write_edit_payload(
-    tool_name: str,
-    all_tool_input: dict[str, object],
-    all_allowlisted_values: frozenset[str] = frozenset(),
+def _write_deny_reason_for_texts(
+    all_texts: list[str],
+    file_path: str,
+    all_allowlisted_values: frozenset[str],
 ) -> str | None:
-    """Return a deny reason when Write/Edit/MultiEdit content carries PII.
-
-    A value in the target repository's PII allowlist is dropped from the
-    findings, so a write under that repository's tree may carry it. Repository
-    resolution for that allowlist runs only after a raw PII hit.
-
-    Args:
-        tool_name: The intercepted tool name.
-        all_tool_input: The tool input mapping.
-        all_allowlisted_values: Extra exact values allowed past the scan,
-            unioned with the target repository's own allowlist.
+    """Return the deny reason for the first text carrying non-allowlisted PII.
 
-    Returns:
-        Deny reason text, or None when the write is clean or out of scope.
+    Repository allowlist resolution runs once, only after a raw PII hit, so a
+    clean payload triggers no git call.
     """
-    if tool_name not in ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES:
-        return None
-    file_path, all_texts = _collect_write_edit_texts(tool_name, all_tool_input)
     resolved_allowlisted_values: frozenset[str] | None = None
     for each_text in all_texts:
         all_raw_findings = scan_text_for_pii(each_text)
@@ -208,6 +231,41 @@ def evaluate_write_edit_payload(
     return None
 
 
+def evaluate_write_edit_payload(
+    tool_name: str,
+    all_tool_input: dict[str, object],
+    all_allowlisted_values: frozenset[str] = frozenset(),
+    hook_payload: dict | None = None,
+) -> str | None:
+    """Return a deny reason when Write/Edit/MultiEdit content carries PII.
+
+    A value in the target repository's PII allowlist is dropped from the
+    findings, so a write under that repository's tree may carry it. A draft
+    under an ephemeral scratch root outside every repository is skipped, since
+    it turns durable only through surfaces that keep their own scans.
+
+    Args:
+        tool_name: The intercepted tool name.
+        all_tool_input: The tool input mapping.
+        all_allowlisted_values: Extra exact values allowed past the scan,
+            unioned with the target repository's own allowlist.
+        hook_payload: The PreToolUse payload carrying the session id, threaded
+            to the ephemeral-path predicate; None reads the session id from the
+            environment alone.
+
+    Returns:
+        Deny reason text, or None when the write is clean or out of scope.
+    """
+    if tool_name not in ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES:
+        return None
+    file_path, all_texts = _collect_write_edit_texts(tool_name, all_tool_input)
+    if not all_texts:
+        return None
+    if _target_is_ephemeral_outside_repository(file_path, hook_payload):
+        return None
+    return _write_deny_reason_for_texts(all_texts, file_path, all_allowlisted_values)
+
+
 def evaluate_post_body_texts(
     all_body_texts: list[str],
     all_allowlisted_values: frozenset[str] = frozenset(),