claude-dev-env 2.28.1 → 2.30.0

package/_shared/pr-loop/scripts/code_rules_gate_parts/enforcer_loading.py

@@ -1,8 +1,8 @@
-"""Load the code-rules enforcer's ``validate_content`` for in-process use.
+"""Load the code-rules enforcer's ``validate_content_for_full_gate`` for in-process use.
 
-The gate runs the same ``validate_content`` the PreToolUse enforcer runs, so it
-locates the ``hooks/blocking/code_rules_enforcer.py`` module from disk, executes
-it with the hooks directory on ``sys.path``, and hands back its callable.
+The gate runs the enforcer's full-gate validation phase, so it locates the
+``hooks/blocking/code_rules_enforcer.py`` module from disk, executes it with
+the hooks directory on ``sys.path``, and hands back its callable.
 """
 
 import importlib.machinery
@@ -138,11 +138,11 @@ def _exec_enforcer_with_hooks_on_path(
         _restore_hooks_constants_modules(all_saved_modules, hooks_root_path)
 
 
-def load_validate_content() -> ValidateContentCallable:
-    """Load ``code_rules_enforcer.validate_content`` for in-process use.
+def load_validate_content_for_full_gate() -> ValidateContentCallable:
+    """Load ``code_rules_enforcer.validate_content_for_full_gate`` for in-process use.
 
     Returns:
-        The ``validate_content`` callable from the enforcer module.
+        The ``validate_content_for_full_gate`` callable from the enforcer module.
 
     Raises:
         SystemExit: When the package root or the enforcer module cannot load.
@@ -153,7 +153,7 @@ def load_validate_content() -> ValidateContentCallable:
     )
     module = importlib.util.module_from_spec(specification)
     _exec_enforcer_with_hooks_on_path(specification, module)
-    return module.validate_content
+    return module.validate_content_for_full_gate
 
 
 def _restore_hooks_constants_modules(

package/_shared/pr-loop/scripts/code_rules_gate_parts/tests/test_enforcer_loading.py

@@ -10,8 +10,8 @@ def test_resolve_claude_dev_env_root_finds_enforcer_bearing_root() -> None:
     assert (resolved_root / "hooks" / "blocking" / "code_rules_enforcer.py").is_file()
 
 
-def test_load_validate_content_returns_callable_passing_a_clean_module() -> None:
-    validate_content = enforcer_loading.load_validate_content()
+def test_load_validate_content_for_full_gate_returns_callable_passing_a_clean_module() -> None:
+    validate_content = enforcer_loading.load_validate_content_for_full_gate()
     clean_module = '"""Clean module."""\n\n\ndef ping() -> str:\n    return "pong"\n'
     issues = validate_content(clean_module, "sample.py", "")
     assert issues == []

package/_shared/pr-loop/scripts/code_rules_gate_parts/tests/test_gate_running.py

@@ -130,7 +130,7 @@ def test_gate_caller_scans_staged_content_with_commit_stage_scope(
 
     resolved_file_path = file_path.resolve()
     exit_code = gate_running.run_gate(
-        validate_content=enforcer_loading.load_validate_content(),
+        validate_content=enforcer_loading.load_validate_content_for_full_gate(),
         all_file_paths=[resolved_file_path],
         repository_root=repository_root,
         all_added_lines_by_path={resolved_file_path: {2, 3}},

package/_shared/pr-loop/scripts/codex_review_scripts_constants/AGENTS.md

@@ -1,18 +1 @@
-# codex_review_scripts_constants
 
-Python package of named constants imported by Codex review scripts under `_shared/pr-loop/scripts/`. Importing from this package keeps magic values out of script bodies.
-
-## Modules
-
-| File | Constants for |
-|---|---|
-| `__init__.py` | Package marker and package docstring. |
-| `run_constants.py` | Binary name, flag strings, custom-instructions prompt, version-probe pattern, timeout default, decode/timeout exit sentinels, flag_token_pattern suffix (whole-token shape match), JSONL keys, and capture outcome class labels for `run_codex_review.py`. |
-| `findings_constants.py` | Finding field keys, fenced-JSON and freeform patterns for `parse_codex_findings.py`. |
-| `classifier_constants.py` | Failure class names and stream markers for `codex_down_classifier.py`. |
-| `run_constants.py` | Binary name, flag strings, custom-instructions prompt, version-probe pattern, timeout default, decode/timeout exit sentinels, flag_token_pattern suffix (whole-token shape match), JSONL keys, JSONL capture filename and newline mode, and capture outcome class labels for `run_codex_review.py`. |
-| `codex_usage_probe_constants.py` | The weekly-usage probe CLI: gate threshold, report JSON keys, app-server JSON-RPC surface, rate-limit field keys, weekly-window sizing, text-status parse patterns, source labels, and exit codes. |
-
-## Convention
-
-Scripts import from this package at module scope. No constant is defined inline in a script body — the hook enforces this at write time.

package/_shared/pr-loop/scripts/pr_converge_scripts_constants/AGENTS.md

@@ -1,18 +1 @@
-# pr_converge_scripts_constants
 
-Constants module for shared PR-loop convergence scripts. Re-exports all runtime/API constants from `pr_converge_skill_constants` and adds script-specific constants for CLI arguments, markdown patterns, and reflow settings.
-
-## Key files
-
-| File | Purpose |
-|---|---|
-| `__init__.py` | Package marker |
-| `pr_converge_constants.py` | Re-exports all constants from `pr_converge_skill_constants.constants` plus adds script-specific values |
-| `reflow_skill_md_constants.py` | Constants for `reflow_skill_md.py`: line width limit, list item patterns, `TARGET_SKILL_PATH` |
-| `convergence_gate_constants.py` | Constants for `check_convergence_gates.py`: short-SHA length, join separators, and the review-threads GraphQL query |
-
-## Conventions
-
-- `pr_converge_constants.py` uses `from pr_converge_skill_constants.constants import ...` (with `# noqa: F401`) to re-export everything so script files can import from one location.
-- `reflow_skill_md_constants.py` resolves `TARGET_SKILL_PATH` from its own `__file__` path, pointing to `SKILL.md` three directories up.
-- Script-specific regex patterns (ordered list items, bullet list items, unfinished markdown link targets, markdown reference definitions) live in `reflow_skill_md_constants.py`.

package/_shared/pr-loop/scripts/pr_converge_skill_constants/AGENTS.md

@@ -1,26 +1 @@
-# pr_converge_skill_constants
 
-Importable Python constants module for shared PR-loop convergence scripts. Script-specific constants (CLI args, markdown patterns, reflow settings) live in `pr_converge_scripts_constants/` beside this package and import from here.
-
-## Key files
-
-| File | Purpose |
-|---|---|
-| `__init__.py` | Package marker |
-| `constants.py` | All runtime and API constants: bot logins, review states, GH API path templates, bugbot/bugteam detection patterns, exit codes |
-
-## Exported constants (selected)
-
-| Constant | Purpose |
-|---|---|
-| `CURSOR_BOT_LOGIN` | Login string for the Cursor bugbot reviewer |
-| `COPILOT_REVIEWER_LOGIN` | Login string for the Copilot reviewer bot |
-| `ALL_COPILOT_CLEAN_REVIEW_STATES` | Tuple of review states that count as clean for Copilot |
-| `BUGBOT_DIRTY_BODY_REGEX` | Regex that matches a bugbot review body reporting findings |
-| `GH_REVIEWS_PATH_TEMPLATE` | `gh api` path template for PR reviews |
-| `GH_INLINE_COMMENTS_PATH_TEMPLATE` | `gh api` path template for PR inline comments |
-
-## Conventions
-
-- All path templates use `str.format(**kwargs)` with keys `owner`, `repo`, `number`.
-- `packages/claude-dev-env/_shared/pr-loop/scripts/pr_converge_scripts_constants/pr_converge_constants.py` re-exports everything here via `from pr_converge_skill_constants.constants import ...` so scripts can import from either location.

package/_shared/pr-loop/scripts/pr_loop_shared_constants/AGENTS.md

@@ -1,26 +1 @@
-# pr_loop_shared_constants
 
-Named constants for every script in `_shared/pr-loop/scripts/`. Each module owns the constants for one script; the module name mirrors the script name with a `_constants` suffix.
-
-## Modules
-
-| File | Constants for |
-|---|---|
-| `claude_permissions_constants.py` | `grant_project_claude_permissions.py` and `revoke_project_claude_permissions.py` — permission rule strings and settings.json keys |
-| `claude_settings_keys_constants.py` | Top-level `~/.claude/settings.json` key names used across the permission helpers |
-| `stale_worktree_rule_sweep_constants.py` | `stale_worktree_rule_sweep.py` — the worktrees subdirectory name, the worktree path segment count, the rule-string delimiters, the `.claude` home path marker, and `get_claude_worktrees_root` |
-| `code_rules_gate_constants.py` | `code_rules_gate.py` — file extensions, git diff subcommands, test filename patterns |
-| `inline_duplicate_body_span_constants.py` | `code_rules_gate.py` — regex and capture-group indices for the same-file inline-duplicate message, which carries both the helper and the enclosing span the gate reconstructs the union from |
-| `fix_hookspath_constants.py` | `fix_hookspath.py` — verification suffix and related strings |
-| `post_audit_thread_constants.py` | `post_audit_thread.py` — HTTP status codes, retry counts, GitHub API paths |
-| `preflight_constants.py` | `preflight.py` — env-var names, git subcommands, pytest exit codes, test discovery patterns |
-| `preflight_self_heal_constants.py` | `preflight_self_heal.py` — git config keys and local-scope detection strings |
-| `reviews_disabled_constants.py` | `reviews_disabled.py` — `CLAUDE_REVIEWS_DISABLED` and `CLAUDE_REVIEWS_ENABLED` env-var names and token taxonomy |
-| `copilot_quota_constants.py` | `copilot_quota.py` — `COPILOT_QUOTA_ACCOUNT` env-var name, `copilot_internal/user` API path, the `premium_interactions` gating field names, the four skip/run exit codes, and the default `.env` path |
-| `terminology_sweep_constants.py` | `terminology_sweep.py` — identifier and prose-token regexes, diff-parsing prefixes, code-file extensions, test-file detection patterns, and the finding-message template |
-| `reviewer_availability_constants.py` | `reviewer_availability.py` — the available/down exit codes for the unified reviewer-availability pre-check |
-| `__init__.py` | Empty package marker |
-
-## Convention
-
-Every constant is `UPPER_SNAKE_CASE` with an explicit type annotation. No magic literals appear in the consuming scripts — all values live here. Test coverage for each module lives in `tests/test_<module_name>.py`.

package/_shared/pr-loop/scripts/tests/AGENTS.md

@@ -1,44 +1 @@
-# _shared/pr-loop/scripts/tests
 
-pytest suite for the scripts and constants in `_shared/pr-loop/scripts/`. Each test file covers one script or one constants module.
-
-## Test files
-
-| File | Covers |
-|---|---|
-| `test__claude_permissions_common.py` | Internal helpers in `_claude_permissions_common.py` (legacy underscore prefix) |
-| `test_claude_permissions_common.py` | Public API of `_claude_permissions_common.py` |
-| `test_claude_permissions_constants.py` | `pr_loop_shared_constants/claude_permissions_constants.py` |
-| `test_claude_settings_keys_constants.py` | `pr_loop_shared_constants/claude_settings_keys_constants.py` |
-| `test_code_rules_gate.py` | `code_rules_gate.py` gate logic |
-| `test_terminology_sweep.py` | `terminology_sweep.py` near-miss detection and exit codes |
-| `test_code_rules_gate_constants.py` | `pr_loop_shared_constants/code_rules_gate_constants.py` |
-| `test_fix_hookspath.py` | `fix_hookspath.py` repair logic |
-| `test_fix_hookspath_constants.py` | `pr_loop_shared_constants/fix_hookspath_constants.py` |
-| `test_grant_project_claude_permissions.py` | `grant_project_claude_permissions.py` end-to-end |
-| `test_post_audit_thread.py` | `post_audit_thread.py` review-posting flow |
-| `test_post_audit_thread_constants.py` | `pr_loop_shared_constants/post_audit_thread_constants.py` |
-| `test_preflight.py` | `preflight.py` pre-flight checks |
-| `test_preflight_constants.py` | `pr_loop_shared_constants/preflight_constants.py` |
-| `test_preflight_self_heal.py` | `preflight_self_heal.py` hooks-path repair |
-| `test_reviews_disabled.py` | `reviews_disabled.py` opt-out gate parsing |
-| `test_copilot_quota.py` | `copilot_quota.py` end-to-end: account resolution, premium-quota classification, exit codes, and skip logging |
-| `test_copilot_quota_constants.py` | `pr_loop_shared_constants/copilot_quota_constants.py` |
-| `test_reviewer_availability.py` | `reviewer_availability.py` end-to-end: Copilot and Bugbot availability, opt-out via `CLAUDE_REVIEWS_DISABLED`, and every Copilot quota outcome |
-| `test_reviewer_availability_constants.py` | `pr_loop_shared_constants/reviewer_availability_constants.py` |
-| `test_revoke_project_claude_permissions.py` | `revoke_project_claude_permissions.py` end-to-end |
-| `test_stale_worktree_rule_sweep.py` | `stale_worktree_rule_sweep.py` sweep and deduplication end-to-end |
-| `test_stale_worktree_rule_sweep_constants.py` | `pr_loop_shared_constants/stale_worktree_rule_sweep_constants.py` worktrees-root resolution and rule-format readers |
-| `test_agent_config_carveout.py` | Agent-config deny-rule carve-out logic |
-| `conftest.py` | Shared pytest fixtures |
-
-## Fixtures
-
-`fixtures/copilot_internal_user_example.json` — a captured `gh api
-copilot_internal/user` response driving `test_copilot_quota.py`.
-
-## Running
-
-```bash
-python -m pytest packages/claude-dev-env/_shared/pr-loop/scripts/tests/
-```

package/_shared/pr-loop/scripts/tests/test_code_rules_gate.py

@@ -735,7 +735,7 @@ def test_run_gate_flags_copied_sibling_when_cwd_is_outside_repo_root(
     copied_file = package_directory / "copied_helper.py"
     existing_file.write_text(_DUPLICATE_HELPER_SOURCE, encoding="utf-8")
     copied_file.write_text(_DUPLICATE_HELPER_SOURCE, encoding="utf-8")
-    validate_content = gate_module.load_validate_content()
+    validate_content = gate_module.load_validate_content_for_full_gate()
 
     monkeypatch.chdir(temporary_git_repository.parent)
     blocking_by_file, _advisory_by_file, _skipped = (
@@ -813,7 +813,7 @@ def test_duplicate_body_span_range_covers_the_definition_through_last_body_line(
     assert span == range(definition_line, last_body_line + 1)
 
 
-def test_split_violations_blocks_duplicate_body_when_span_intersects_added_lines(
+def test_split_violations_by_scope_blocks_duplicate_body_when_span_intersects_added_lines(
     tmp_path: Path,
 ) -> None:
     """A duplicate-body issue whose copied-function span overlaps the diff's added
@@ -829,7 +829,7 @@ def test_split_violations_blocks_duplicate_body_when_span_intersects_added_lines
     assert advisory == []
 
 
-def test_split_violations_advises_duplicate_body_when_span_misses_added_lines(
+def test_split_violations_by_scope_advises_duplicate_body_when_span_misses_added_lines(
     tmp_path: Path,
 ) -> None:
     """A duplicate-body issue for an untouched pre-existing copy — whose span does
@@ -1002,7 +1002,7 @@ def test_collect_partitioned_violations_advises_pre_existing_sibling_duplicate(
         _DUPLICATE_HELPER_SOURCE + "unrelated_constant = 1\n", encoding="utf-8"
     )
     unrelated_added_line = _DUPLICATE_HELPER_SOURCE.count("\n") + 1
-    validate_content = gate_module.load_validate_content()
+    validate_content = gate_module.load_validate_content_for_full_gate()
 
     resolved_copied = copied_file.resolve()
     blocking_by_file, advisory_by_file, _skipped = (
@@ -1055,7 +1055,7 @@ def test_collect_partitioned_violations_blocks_sibling_duplicate_in_added_region
     definition_line = 3
     last_body_line = 15
     all_copied_function_lines = set(range(definition_line, last_body_line + 1))
-    validate_content = gate_module.load_validate_content()
+    validate_content = gate_module.load_validate_content_for_full_gate()
 
     resolved_copied = copied_file.resolve()
     blocking_by_file, _advisory_by_file, _skipped = (
@@ -1549,10 +1549,10 @@ def test_main_blocks_when_function_body_grows_past_threshold_with_def_line_untou
     assert exit_code == 1
 
 
-def test_split_violations_blocks_function_length_when_span_intersects_added_lines() -> None:
+def test_split_violations_by_scope_blocks_function_length_when_span_intersects_added_lines() -> None:
     """A function-length issue whose declared span overlaps the diff's added
     lines is blocking — the body grew, which is exactly Finding B's intent."""
-    validate_content = gate_module.load_validate_content()
+    validate_content = gate_module.load_validate_content_for_full_gate()
     long_function = _build_function_module(
         "oversized", body_line_count=70, leading_lines=3
     )
@@ -1571,12 +1571,12 @@ def test_split_violations_blocks_function_length_when_span_intersects_added_line
     assert advisory == []
 
 
-def test_split_violations_advises_function_length_when_span_misses_added_lines() -> None:
+def test_split_violations_by_scope_advises_function_length_when_span_misses_added_lines() -> None:
     """A function-length issue for an untouched pre-existing function — whose
     declared span does not overlap any added line — is advisory, not blocking.
     This prevents the over-block regression where every pre-existing >=60-line
     function in a touched file was forced into the blocking payload."""
-    validate_content = gate_module.load_validate_content()
+    validate_content = gate_module.load_validate_content_for_full_gate()
     long_function = _build_function_module(
         "oversized", body_line_count=70, leading_lines=3
     )
@@ -1595,7 +1595,7 @@ def test_split_violations_advises_function_length_when_span_misses_added_lines()
 
 
 def _isolation_issues_for_home_probe_test() -> list[str]:
-    validate_content = gate_module.load_validate_content()
+    validate_content = gate_module.load_validate_content_for_full_gate()
     header = "from pathlib import Path\n"
     test_body = (
         "def test_reads_home() -> None:\n"
@@ -1606,7 +1606,7 @@ def _isolation_issues_for_home_probe_test() -> list[str]:
     return [each_issue for each_issue in issues if "probes" in each_issue]
 
 
-def test_split_violations_blocks_isolation_when_function_span_intersects_added_lines() -> None:
+def test_split_violations_by_scope_blocks_isolation_when_function_span_intersects_added_lines() -> None:
     """An isolation issue whose enclosing test-function span overlaps the diff's
     added lines is blocking — a signature-line change that un-isolates an
     unchanged-body probe must block, matching the enforcer's terminal path."""
@@ -1621,7 +1621,7 @@ def test_split_violations_blocks_isolation_when_function_span_intersects_added_l
     assert advisory == []
 
 
-def test_split_violations_advises_isolation_when_function_span_misses_added_lines() -> None:
+def test_split_violations_by_scope_advises_isolation_when_function_span_misses_added_lines() -> None:
     """An isolation issue for an untouched pre-existing probe — whose enclosing
     test-function span does not overlap any added line — is advisory, not
     blocking, mirroring the function-length scope contract."""
@@ -1814,7 +1814,7 @@ def test_check_wrapper_plumb_through_stays_under_function_length_threshold() ->
 
 
 def _banned_noun_parameter_issues() -> list[str]:
-    validate_content = gate_module.load_validate_content()
+    validate_content = gate_module.load_validate_content_for_full_gate()
     source = (
         "def aggregate(canned_results: int) -> int:\n"
         "    doubled = canned_results * 2\n"
@@ -1824,7 +1824,7 @@ def _banned_noun_parameter_issues() -> list[str]:
     return [each_issue for each_issue in issues if "banned noun" in each_issue]
 
 
-def test_split_violations_blocks_banned_noun_when_binding_line_is_added() -> None:
+def test_split_violations_by_scope_blocks_banned_noun_when_binding_line_is_added() -> None:
     """A banned-noun binding is blocking when its own binding line is among the
     added lines. The gate reconstructs the one-line binding span through the
     same shared extractor registry it uses for function-length and isolation,
@@ -1840,7 +1840,7 @@ def test_split_violations_blocks_banned_noun_when_binding_line_is_added() -> Non
     assert advisory == []
 
 
-def test_split_violations_advises_banned_noun_when_binding_line_untouched() -> None:
+def test_split_violations_by_scope_advises_banned_noun_when_binding_line_untouched() -> None:
     """A banned-noun binding whose own line is not among the added lines is
     advisory — editing an unrelated body line does not pull a pre-existing
     binding into scope, mirroring the companion exact-match identifier check."""

package/_shared/process-tree/AGENTS.md

@@ -1,41 +1 @@
-# _shared/process-tree
 
-One home for ending a spawned process together with every descendant it
-started. Callers that capture a CLI's output import it so a grandchild can
-never outlive the run and hold the capture pipe open.
-
-## Consumers
-
-| Caller | Use |
-|---|---|
-| `scripts/grok_headless_runner.py` | Kills a timed-out worker's tree between drain attempts |
-| `_shared/pr-loop/scripts/run_codex_review.py` | Kills the review tree on timeout, then drains |
-| `_shared/pr-loop/scripts/codex_usage_probe.py` | Tears the app-server tree down after the rate-limits exchange |
-
-A PR-loop script reaches this home the way convergence scripts reach
-`_shared/pr-loop/scripts`: it puts the directory on `sys.path` and imports by
-module name. `bin/install.mjs` copies `_shared` and `scripts` together, and
-every install group that carries a consumer carries `_shared`, so the import
-resolves in the repository and under `~/.claude` alike.
-
-## Key files
-
-| File | Purpose |
-|---|---|
-| `scripts/process_tree_kill.py` | `terminate_process_tree` (poll, platform tree kill, re-poll, `Popen.kill()` fallback), `kill_process_tree_by_identifier`, and `should_start_new_session` for the matching `Popen` flag |
-| `scripts/test_process_tree_kill.py` | Behavioral tests for every public entry point here, each platform branch, each failure the helper swallows, and the `Popen.kill()` fallback |
-| `scripts/config/process_tree_scripts_constants/process_tree_kill_constants.py` | The taskkill command, its `/T`, `/F`, and `/PID` flags, and the bound on the kill command |
-| `scripts/pyproject.toml` | mypy configuration; `check.ps1` runs it under the `mypy-process-tree` label |
-
-## Platform guard
-
-Both the branch selector and the POSIX helper compare `sys.platform` against
-the literal `"win32"`. That literal is what mypy narrows on: behind a named
-constant, `os.getpgid`, `os.killpg`, and `signal.SIGKILL` fail type checking on
-Windows.
-
-## Pairing rule
-
-`os.killpg` signals a whole process group, so a child sharing the caller's
-group takes the caller down with it. Every `Popen` whose tree this module ends
-passes `start_new_session=should_start_new_session()`.

package/audit-rubrics/AGENTS.md

@@ -1,43 +1 @@
-# audit-rubrics
 
-Audit rubrics for the PR-loop code-review suite. The rubrics define the 17 bug categories (A–Q), their sub-bucket decompositions, and the prompt templates agents use during an audit pass. Installed into `~/.claude/audit-rubrics/` by `bin/install.mjs`.
-
-## Key file
-
-| File | Purpose |
-|---|---|
-| `audit-categories.json` | Machine-readable A-Q schema: id, title, slug, and sub-bucket id/axis pairs; single source for rubric and prompt skeleton parity |
-| `source-material-section-types.md` | Lookup table for how to chunk an artifact into sections for an audit prompt; covers code PRs, docs, SQL schemas, config files, and more |
-
-## Subdirectories
-
-| Entry | Description |
-|---|---|
-| `category_rubrics/` | One `.md` per category (A–Q): defines what the category audits, example findings, and a sub-bucket decomposition table |
-| `prompts/` | One `.md` per category: the ready-to-use audit prompt template an agent inlines the artifact into |
-
-## Categories
-
-| ID | Name |
-|---|---|
-| A | API contract verification |
-| B | Selector engine compatibility |
-| C | Resource cleanup |
-| D | Scoping and ordering |
-| E | Dead code |
-| F | Silent failures |
-| G | Bounds and overflow |
-| H | Security boundaries |
-| I | Concurrency |
-| J | Code-rules compliance |
-| K | Codebase conflicts |
-| L | Behavior equivalence |
-| M | Producer-consumer cardinality |
-| N | Test name / scenario verifier |
-| O | Docstring vs implementation drift |
-| P | Name vs behavior contract |
-| Q | Cross-surface claim consistency |
-
-## Breaking-change rule
-
-Adding a sub-bucket to a category rubric requires updating `audit-categories.json` and the matching prompt template in `prompts/` in the same commit, then running `audit_category_schema.py --validate`. Skills that reference category IDs (`bugteam`, `findbugs`) rely on stable sub-bucket IDs (A1, A2, … Q-n). Worked examples stay in the rubric markdown only; they are outside the schema.

package/audit-rubrics/category_rubrics/AGENTS.md

@@ -1,37 +1 @@
-# audit-rubrics/category_rubrics
 
-One rubric file per audit category (A–Q). Each file defines what the category covers, gives concrete examples of findings, and provides the sub-bucket decomposition an audit agent uses to structure its pass.
-
-## Files
-
-| File | Category |
-|---|---|
-| `category-a-api-contracts.md` | A — API contract verification |
-| `category-b-selector-engine-compat.md` | B — Selector engine compatibility |
-| `category-c-resource-cleanup.md` | C — Resource cleanup |
-| `category-d-scoping-and-ordering.md` | D — Scoping and ordering |
-| `category-e-dead-code.md` | E — Dead code |
-| `category-f-silent-failures.md` | F — Silent failures |
-| `category-g-bounds-and-overflow.md` | G — Bounds and overflow |
-| `category-h-security-boundaries.md` | H — Security boundaries |
-| `category-i-concurrency.md` | I — Concurrency |
-| `category-j-code-rules-compliance.md` | J — Code-rules compliance |
-| `category-k-codebase-conflicts.md` | K — Codebase conflicts |
-| `category-l-behavior-equivalence.md` | L — Behavior equivalence |
-| `category-m-producer-consumer-cardinality.md` | M — Producer-consumer cardinality |
-| `category-n-test-name-scenario-verifier.md` | N — Test name / scenario verifier |
-| `category-o-docstring-vs-impl-drift.md` | O — Docstring vs implementation drift |
-| `category-p-name-vs-behavior-contract.md` | P — Name vs behavior contract |
-| `category-q-cross-surface-claims.md` | Q — Cross-surface claim consistency |
-
-## Rubric structure
-
-Each file has:
-- A plain-language description of what the category audits
-- Concrete finding examples
-- A companion-reference pointer to `../source-material-section-types.md`
-- A sub-bucket decomposition table with stable IDs (A1, A2, …) and the concrete checks each bucket requires
-
-## Relationship to prompts/
-
-`category_rubrics/` is the human-readable reference. `prompts/` holds the agent-ready prompt templates that inline the same sub-bucket list in a structured prompt format. Keep both in sync when sub-buckets change.

package/audit-rubrics/prompts/AGENTS.md

@@ -1,37 +1 @@
-# audit-rubrics/prompts
 
-Agent-ready audit prompt templates, one per category (A–Q). An agent inlines the artifact under review into the `[INLINE THE FULL ARTIFACT HERE]` placeholder and runs the prompt as-is.
-
-## Files
-
-| File | Category |
-|---|---|
-| `category-a-api-contracts.md` | A — API contract verification |
-| `category-b-selector-engine-compat.md` | B — Selector engine compatibility |
-| `category-c-resource-cleanup.md` | C — Resource cleanup |
-| `category-d-scoping-and-ordering.md` | D — Scoping and ordering |
-| `category-e-dead-code.md` | E — Dead code |
-| `category-f-silent-failures.md` | F — Silent failures |
-| `category-g-bounds-and-overflow.md` | G — Bounds and overflow |
-| `category-h-security-boundaries.md` | H — Security boundaries |
-| `category-i-concurrency.md` | I — Concurrency |
-| `category-j-code-rules-compliance.md` | J — Code-rules compliance |
-| `category-k-codebase-conflicts.md` | K — Codebase conflicts |
-| `category-l-behavior-equivalence.md` | L — Behavior equivalence |
-| `category-m-producer-consumer-cardinality.md` | M — Producer-consumer cardinality |
-| `category-n-test-name-scenario-verifier.md` | N — Test name / scenario verifier |
-| `category-o-docstring-vs-impl-drift.md` | O — Docstring vs implementation drift |
-| `category-p-name-vs-behavior-contract.md` | P — Name vs behavior contract |
-| `category-q-cross-surface-claims.md` | Q — Cross-surface claim consistency |
-
-## Prompt structure
-
-Each template:
-- Scopes the audit to one category only (skip the others)
-- Lists all sub-buckets from the matching `category_rubrics/` file
-- Requires each sub-bucket to produce at least one Shape A finding OR one Shape B proof-of-absence with three or more adversarial probes
-- Uses `find` as the finding ID prefix (single-pass audits) rather than `loop<N>-<K>`
-
-## Relationship to category_rubrics/
-
-`prompts/` is the executable form; `category_rubrics/` is the reference form. When a sub-bucket decomposition changes in a rubric, update the matching prompt in the same commit.