claude-dev-env 2.29.0 → 2.30.0

package/hooks/blocking/test_code_rules_enforcer_precheck_forecast.py

@@ -7,6 +7,8 @@ import subprocess
 import sys
 from pathlib import Path
 
+import pytest
+
 _BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
 _HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
 if _BLOCKING_DIRECTORY not in sys.path:
@@ -16,7 +18,7 @@ if _HOOKS_DIRECTORY not in sys.path:
 
 from code_rules_enforcer import (  # noqa: E402
     main,
-    validate_content,
+    validate_content_for_full_gate as validate_content,
 )
 from code_rules_enforcer_test_support import (  # noqa: E402
     run_enforcer_cli,
@@ -115,7 +117,7 @@ def test_precheck_stream_parameter_carries_no_banned_noun() -> None:
 
 
 def test_precheck_reports_violations_and_exits_nonzero_for_production_candidate(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """A violating candidate judged at a production target prints each violation to
     stdout and exits 1."""
@@ -138,7 +140,7 @@ def test_precheck_reports_violations_and_exits_nonzero_for_production_candidate(
 
 
 def test_precheck_emits_no_output_and_exits_zero_for_clean_candidate(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """A clean candidate produces no stdout and exits 0."""
     staging_directory = getattr(tmp_path_factory, "mktemp")("staging")
@@ -155,7 +157,7 @@ def test_precheck_emits_no_output_and_exits_zero_for_clean_candidate(
 
 
 def test_precheck_target_path_drives_test_file_exemptions(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """Production-shaped content judged against a ``test_*.py`` target passes
     because test-file exemptions apply through the target path."""
@@ -172,7 +174,7 @@ def test_precheck_target_path_drives_test_file_exemptions(
 
 
 def test_precheck_noncode_target_exits_zero_with_no_output(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """A non-code target extension is exempt: the pre-check exits 0 with no output."""
     staging_directory = getattr(tmp_path_factory, "mktemp")("staging")
@@ -186,7 +188,7 @@ def test_precheck_noncode_target_exits_zero_with_no_output(
 
 
 def test_precheck_missing_candidate_errors_on_stderr_without_traceback(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """A nonexistent candidate path prints a one-line stderr error and exits
     nonzero without a Python traceback."""
@@ -204,7 +206,7 @@ def test_precheck_missing_candidate_errors_on_stderr_without_traceback(
 
 
 def test_edit_deny_reason_includes_forecast_and_precheck_hint(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """An Edit whose new_string introduces a violation on a file that already
     contains a separate violation elsewhere blocks on the fragment violation and
@@ -236,7 +238,7 @@ def test_edit_deny_reason_includes_forecast_and_precheck_hint(
 
 
 def test_edit_clean_fragment_on_dirty_file_produces_no_deny_payload(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """A clean Edit fragment on a file that is dirty elsewhere must not block —
     the forecast never converts a clean-fragment edit into a deny."""
@@ -258,7 +260,7 @@ def test_edit_clean_fragment_on_dirty_file_produces_no_deny_payload(
 
 
 def test_every_deny_reason_carries_the_precheck_hint(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """A deny with no forecast still appends the pre-check hint to the reason."""
     production_directory = getattr(tmp_path_factory, "mktemp")("production_pkg")
@@ -287,7 +289,7 @@ def test_every_deny_reason_carries_the_precheck_hint(
 
 
 def test_forecast_skipped_when_edit_prior_is_unreconstructable(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """An Edit whose old_string is absent from the file has no reliable prior to
     diff against, so the full-file forecast must not run: a pre-existing inline
@@ -313,7 +315,7 @@ def test_forecast_skipped_when_edit_prior_is_unreconstructable(
 
 
 def test_forecast_omits_the_fragment_introduced_violation(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """An Edit that introduces the file's only print() blocks on it without the
     forecast re-listing that same violation under its full-file line number."""
@@ -353,7 +355,7 @@ def test_precheck_missing_candidate_value_exits_two_with_usage() -> None:
 
 
 def test_precheck_flag_shaped_candidate_value_exits_two_with_usage(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """``--check`` immediately followed by ``--as`` is a usage error rather than
     an attempt to read a file literally named ``--as``."""
@@ -370,7 +372,7 @@ def test_precheck_flag_shaped_candidate_value_exits_two_with_usage(
 
 
 def test_precheck_rejects_unrecognized_trailing_token_with_usage(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """A pre-check vector carrying a token beyond the supported
     ``--check <candidate> [--as <target>]`` shape is a usage error: an extra
@@ -393,7 +395,7 @@ def test_precheck_rejects_unrecognized_trailing_token_with_usage(
 
 
 def test_precheck_strips_candidate_byte_order_mark_before_validation(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """A UTF-8 byte-order mark on the candidate must not hide AST-based
     violations: the candidate is judged exactly as its decoded content would
@@ -415,7 +417,7 @@ def test_precheck_strips_candidate_byte_order_mark_before_validation(
 
 
 def test_precheck_strips_every_leading_byte_order_mark_before_validation(
-    tmp_path_factory: object,
+    tmp_path_factory: pytest.TempPathFactory,
 ) -> None:
     """Stacked byte-order marks must not hide AST-based violations: every
     leading mark is stripped, so a double-BOM candidate fails exactly like its

package/hooks/blocking/test_code_rules_enforcer_split_entry_1.py

@@ -6,6 +6,8 @@ import sys
 from pathlib import Path
 from types import SimpleNamespace
 
+import pytest
+
 _BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
 _HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
 if _BLOCKING_DIRECTORY not in sys.path:
@@ -17,7 +19,7 @@ from code_rules_annotations_length import (  # noqa: E402
     FUNCTION_LENGTH_BLOCKING_THRESHOLD,
 )
 from code_rules_enforcer import (  # noqa: E402
-    validate_content,
+    validate_content_for_full_gate as validate_content,
 )
 
 code_rules_enforcer = SimpleNamespace(
@@ -38,7 +40,7 @@ def _oversized_function_source(name: str) -> str:
 
 
 def test_should_emit_advisory_for_duplicated_format_patterns_via_validate_content(
-    capsys: object,
+    capsys: pytest.CaptureFixture[str],
 ) -> None:
     repeated_pattern_source = (
         "def get_user(user_id: str) -> str:\n"

package/hooks/blocking/test_code_rules_enforcer_split_entry_2.py

@@ -22,7 +22,7 @@ from code_rules_annotations_length import (  # noqa: E402
 from code_rules_enforcer import (  # noqa: E402
     main,
     prior_and_post_edit_content,
-    validate_content,
+    validate_content_for_full_gate as validate_content,
 )
 from code_rules_enforcer_test_support import (  # noqa: E402
     run_serialized_payload_entrypoint,

package/hooks/blocking/test_code_rules_enforcer_stage.py

@@ -25,7 +25,7 @@ if _PR_LOOP_SCRIPTS_DIRECTORY not in sys.path:
 from code_rules_enforcer import (  # noqa: E402
     _fragment_or_deferred_check,
     main,
-    validate_content,
+    validate_content_for_full_gate as validate_content,
 )
 from code_rules_gate_parts import gate_running  # noqa: E402
 from code_rules_gate_parts.tests._repo_test_helpers import (  # noqa: E402

package/hooks/blocking/test_code_rules_enforcer_string_magic.py

@@ -248,7 +248,7 @@ def test_should_grandfather_unchanged_string_magic_in_wide_edit() -> None:
         "    # wide edit that leaves the magic string in place\n"
         "    return os.environ['STRIPE_SECRET']\n"
     )
-    issues = code_rules_enforcer.validate_content(
+    issues = code_rules_enforcer.validate_content_for_full_gate(
         proposed_fragment,
         PRODUCTION_FILE_PATH,
         prior_fragment,
@@ -272,7 +272,7 @@ def test_should_block_new_string_magic_in_wide_edit() -> None:
         "def fetch_secret() -> str:\n"
         "    return os.environ['STRIPE_SECRET']\n"
     )
-    issues = code_rules_enforcer.validate_content(
+    issues = code_rules_enforcer.validate_content_for_full_gate(
         proposed_fragment,
         PRODUCTION_FILE_PATH,
         prior_fragment,
@@ -300,7 +300,7 @@ def test_should_block_second_identical_string_magic_per_occurrence() -> None:
         "def fetch_backup() -> str:\n"
         "    return os.environ['STRIPE_SECRET']\n"
     )
-    issues = code_rules_enforcer.validate_content(
+    issues = code_rules_enforcer.validate_content_for_full_gate(
         proposed_fragment,
         PRODUCTION_FILE_PATH,
         prior_fragment,
@@ -320,7 +320,7 @@ def test_should_surface_magic_when_gate_defers_scope_with_head_as_old() -> None:
         "    old_number = 9999\n"
         "    return old_number\n"
     )
-    issues = code_rules_enforcer.validate_content(
+    issues = code_rules_enforcer.validate_content_for_full_gate(
         source,
         PRODUCTION_FILE_PATH,
         source,

package/hooks/blocking/test_code_rules_enforcer_thin_wrapper_files.py

@@ -149,7 +149,7 @@ def test_should_flag_thin_wrapper_with_module_docstring() -> None:
     )
 
 
-def test_validate_content_uses_empty_full_file_content_over_pre_edit_fragment() -> None:
+def test_validate_content_for_full_gate_uses_empty_full_file_content_over_pre_edit_fragment() -> None:
     """An empty-string `full_file_content` must be honored, not silently replaced with `content`.
 
     Regression for loop1-8: the `or` short-circuit at line 3775 collapsed
@@ -159,7 +159,7 @@ def test_validate_content_uses_empty_full_file_content_over_pre_edit_fragment()
     not a thin wrapper, but a pre-edit fragment with imports + __all__ is.
     """
     pre_edit_fragment = "from real_module import do_thing\n__all__ = ['do_thing']\n"
-    issues = code_rules_enforcer.validate_content(
+    issues = code_rules_enforcer.validate_content_for_full_gate(
         pre_edit_fragment,
         PRODUCTION_FILE_PATH,
         full_file_content="",

package/hooks/blocking/test_code_rules_enforcer_zero_payload_alias.py

@@ -240,7 +240,7 @@ def test_should_not_flag_recursive_self_call() -> None:
     )
 
 
-def test_should_flag_through_validate_content_for_hook_file() -> None:
+def test_should_flag_through_validate_content_for_full_gate_for_hook_file() -> None:
     source = (
         "def find_bare_path_segments(content: str) -> set[str]:\n"
         "    return {part for part in content.split() if part}\n"
@@ -248,7 +248,7 @@ def test_should_flag_through_validate_content_for_hook_file() -> None:
         "def find_bare_index_segments(content: str) -> set[str]:\n"
         "    return find_bare_path_segments(content)\n"
     )
-    issues = code_rules_enforcer.validate_content(source, HOOK_INFRASTRUCTURE_PATH)
+    issues = code_rules_enforcer.validate_content_for_full_gate(source, HOOK_INFRASTRUCTURE_PATH)
     assert any("find_bare_index_segments" in each for each in issues), (
         f"validate_content must surface the alias for hook files, got: {issues!r}"
     )

package/hooks/blocking/test_code_rules_enforcer_zero_payload_alias_hook_routing.py

@@ -3,7 +3,7 @@
 A pass-through alias inside a hook module is the motivating case for the
 zero-payload-alias check, so the deny must fire on the same PreToolUse path a
 live Write into ``packages/claude-dev-env/hooks/blocking`` would take — not only
-through ``validate_content``, which hook files never reach at PreToolUse. These
+through ``validate_content_for_edit_lane``, which hook files never reach at PreToolUse. These
 tests drive the real ``main()`` stdin entry point and the pre-check CLI with a
 hook-infrastructure target.
 
@@ -66,7 +66,7 @@ def test_write_of_pass_through_alias_into_hook_directory_denies(
     The target lives under a hook-infrastructure path the full code-rules suite
     exempts, so this proves the zero-payload-alias check still fires on the exact
     directory its docstring names as the motivating case — at the PreToolUse Write
-    point, not only through ``validate_content``."""
+    point, not only through ``validate_content_for_edit_lane``."""
     new_file = hook_blocking_dir / "new_blocker.py"
     captured_stdout, _exit_code = run_write_entrypoint(
         main,

package/hooks/blocking/test_code_rules_validation_phase.py

@@ -0,0 +1,281 @@
+"""Tests for the validate_content edit-lane and full-gate phase split."""
+
+from __future__ import annotations
+
+import contextlib
+import importlib
+import importlib.util
+import inspect
+import re
+import shutil
+import sys
+import tempfile
+from pathlib import Path
+from types import ModuleType
+from unittest.mock import DEFAULT, MagicMock, patch
+
+import pytest
+
+
+def _load_module_from_path(module_name: str, module_path: Path) -> ModuleType:
+    """Load and execute the module found at module_path, under module_name."""
+    specification = importlib.util.spec_from_file_location(module_name, module_path)
+    assert specification is not None
+    assert specification.loader is not None
+    module = importlib.util.module_from_spec(specification)
+    specification.loader.exec_module(module)
+    return module
+
+
+_BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+_HOOKS_DIRECTORY = _BLOCKING_DIRECTORY.parent
+_PACKAGE_ROOT = _HOOKS_DIRECTORY.parent
+_PR_LOOP_SCRIPTS_DIRECTORY = str(_PACKAGE_ROOT / "_shared" / "pr-loop" / "scripts")
+
+code_rules_enforcer = _load_module_from_path(
+    "code_rules_enforcer", _BLOCKING_DIRECTORY / "code_rules_enforcer.py"
+)
+validation_phase_constants = _load_module_from_path(
+    "validation_phase_constants",
+    _HOOKS_DIRECTORY / "hooks_constants" / "validation_phase_constants.py",
+)
+
+if _PR_LOOP_SCRIPTS_DIRECTORY not in sys.path:
+    sys.path.insert(0, _PR_LOOP_SCRIPTS_DIRECTORY)
+enforcer_loading = importlib.import_module("code_rules_gate_parts.enforcer_loading")
+gate_running = importlib.import_module("code_rules_gate_parts.gate_running")
+repo_test_helpers = importlib.import_module("code_rules_gate_parts.tests._repo_test_helpers")
+
+PRODUCTION_FILE_PATH = "packages/app/services.py"
+SAMPLE_PYTHON_CONTENT = "def add_one(value: int) -> int:\n    return value + 1\n"
+UNKNOWN_PHASE_NAME = "not_a_real_phase"
+HOOK_INFRASTRUCTURE_FILE_PATH = "/repo/packages/claude-dev-env/hooks/blocking/example.py"
+_HOOK_MODULE_DUPLICATE_BODY_SOURCE = (
+    "def compute_shipping_total(order_total: float, tax_rate: float) -> float:\n"
+    "    taxed_total = order_total * (1 + tax_rate)\n"
+    "    rounded_total = round(taxed_total, 2)\n"
+    "    return rounded_total\n"
+)
+
+
+def test_all_validation_phases_holds_exactly_the_two_phases() -> None:
+    assert validation_phase_constants.ALL_VALIDATION_PHASES == {
+        validation_phase_constants.EDIT_LANE_PHASE,
+        validation_phase_constants.FULL_GATE_PHASE,
+    }
+
+
+def test_unknown_phase_raises_value_error_naming_the_rejected_value() -> None:
+    with pytest.raises(ValueError, match=UNKNOWN_PHASE_NAME):
+        code_rules_enforcer.validate_content_for_phase(
+            SAMPLE_PYTHON_CONTENT, PRODUCTION_FILE_PATH, phase=UNKNOWN_PHASE_NAME
+        )
+
+
+def test_validate_content_for_phase_requires_phase_keyword() -> None:
+    with pytest.raises(TypeError):
+        code_rules_enforcer.validate_content_for_phase(SAMPLE_PYTHON_CONTENT, PRODUCTION_FILE_PATH)
+
+
+def _full_gate_only_default_kwargs() -> dict[str, object]:
+    return {
+        each_name: DEFAULT
+        for each_name in validation_phase_constants.ALL_FULL_GATE_ONLY_CHECK_NAMES
+    }
+
+
+def _patched_full_gate_only_checks() -> contextlib.AbstractContextManager[dict[str, MagicMock]]:
+    """Return the patch.multiple context manager for the six full-gate-only checks.
+
+    ::
+
+        mypy's patch.multiple stub only accepts an ``Any | str`` target, so a
+        dynamically loaded ``ModuleType`` target needs a local type: ignore.
+    """
+    return patch.multiple(  # type: ignore[call-overload]  # mypy stub rejects ModuleType targets
+        code_rules_enforcer, **_full_gate_only_default_kwargs()
+    )
+
+
+def _configure_full_gate_only_mock_returns(all_mocks: dict[str, MagicMock]) -> None:
+    for each_name, each_mock in all_mocks.items():
+        each_mock.return_value = None if each_name == "advise_cross_skill_duplicate_helper" else []
+
+
+def test_edit_lane_calls_none_of_the_six_full_gate_only_checks() -> None:
+    with _patched_full_gate_only_checks() as all_mocks:
+        _configure_full_gate_only_mock_returns(all_mocks)
+        code_rules_enforcer.validate_content_for_edit_lane(
+            SAMPLE_PYTHON_CONTENT, PRODUCTION_FILE_PATH
+        )
+        for each_name, each_mock in all_mocks.items():
+            assert each_mock.call_count == 0, f"edit lane must not call {each_name}"
+
+
+def test_full_gate_calls_all_six_full_gate_only_checks() -> None:
+    with _patched_full_gate_only_checks() as all_mocks:
+        _configure_full_gate_only_mock_returns(all_mocks)
+        code_rules_enforcer.validate_content_for_full_gate(
+            SAMPLE_PYTHON_CONTENT, PRODUCTION_FILE_PATH
+        )
+        for each_name, each_mock in all_mocks.items():
+            assert each_mock.call_count >= 1, f"full gate must call {each_name}"
+
+
+def test_both_phases_report_identical_findings_with_the_six_spied_out() -> None:
+    with _patched_full_gate_only_checks() as all_mocks:
+        _configure_full_gate_only_mock_returns(all_mocks)
+        edit_lane_issues = code_rules_enforcer.validate_content_for_edit_lane(
+            SAMPLE_PYTHON_CONTENT, PRODUCTION_FILE_PATH
+        )
+        full_gate_issues = code_rules_enforcer.validate_content_for_full_gate(
+            SAMPLE_PYTHON_CONTENT, PRODUCTION_FILE_PATH
+        )
+    assert edit_lane_issues == full_gate_issues
+
+
+def test_no_caller_should_reach_a_phase_less_validator() -> None:
+    assert not hasattr(code_rules_enforcer, "validate_content"), (
+        "validate_content must not survive as a callable on the enforcer module"
+    )
+    enforcer_source = inspect.getsource(code_rules_enforcer)
+    assert re.search(r"\bvalidate_content\(", enforcer_source) is None, (
+        "no call site in code_rules_enforcer.py may reach a phase-less validator"
+    )
+
+
+def test_precheck_selects_the_full_gate() -> None:
+    precheck_source = inspect.getsource(code_rules_enforcer._run_precheck)
+    assert "validate_content_for_full_gate(" in precheck_source, (
+        "the --check precheck must run the full-gate verdict"
+    )
+
+
+def test_codex_patch_issues_selects_the_edit_lane() -> None:
+    """Pin the apply_patch mutation path to the edit-lane verdict."""
+    codex_patch_issues_source = inspect.getsource(code_rules_enforcer._codex_patch_issues)
+    assert "validate_content_for_edit_lane(" in codex_patch_issues_source, (
+        "the apply_patch branch must run the edit-lane verdict"
+    )
+
+
+def test_forecast_full_file_violations_selects_the_edit_lane() -> None:
+    """Pin the full-file forecast pass to the edit-lane verdict."""
+    forecast_source = inspect.getsource(code_rules_enforcer._forecast_full_file_violations)
+    assert "validate_content_for_edit_lane(" in forecast_source, (
+        "the full-file forecast pass must run the edit-lane verdict"
+    )
+
+
+def test_report_blocking_violations_selects_the_edit_lane() -> None:
+    """Pin the PreToolUse Write and Edit main path to the edit-lane verdict."""
+    report_blocking_violations_source = inspect.getsource(
+        code_rules_enforcer._report_blocking_violations
+    )
+    assert "validate_content_for_edit_lane(" in report_blocking_violations_source, (
+        "the PreToolUse Write and Edit main path must run the edit-lane verdict"
+    )
+
+
+def _write_scoped_service_file_with_a_committed_baseline(repository_root: Path) -> Path:
+    repo_test_helpers.init_repository(repository_root)
+    return repo_test_helpers.write_commit_and_stage_change(
+        repository_root,
+        "service.py",
+        "def read_port() -> int:\n    return 0\n",
+        "def read_port() -> int:\n    port_number = 9999\n    return port_number\n",
+    )
+
+
+def test_hook_infrastructure_edit_lane_skips_the_cross_file_duplicate_check() -> None:
+    with patch.object(
+        code_rules_enforcer, "check_duplicate_function_body_across_files"
+    ) as mock_check_duplicate_across_files:
+        mock_check_duplicate_across_files.return_value = []
+        code_rules_enforcer._hook_infrastructure_blocking_issues(
+            SAMPLE_PYTHON_CONTENT,
+            HOOK_INFRASTRUCTURE_FILE_PATH,
+            phase=validation_phase_constants.EDIT_LANE_PHASE,
+        )
+    assert mock_check_duplicate_across_files.call_count == 0, (
+        "the hook-infrastructure edit lane must not call the cross-file duplicate-body check"
+    )
+
+
+def test_hook_infrastructure_full_gate_calls_the_cross_file_duplicate_check() -> None:
+    with patch.object(
+        code_rules_enforcer, "check_duplicate_function_body_across_files"
+    ) as mock_check_duplicate_across_files:
+        mock_check_duplicate_across_files.return_value = []
+        code_rules_enforcer._hook_infrastructure_blocking_issues(
+            SAMPLE_PYTHON_CONTENT,
+            HOOK_INFRASTRUCTURE_FILE_PATH,
+            phase=validation_phase_constants.FULL_GATE_PHASE,
+        )
+    assert mock_check_duplicate_across_files.call_count == 1, (
+        "the hook-infrastructure full gate must still call the cross-file duplicate-body check"
+    )
+
+
+def _write_duplicate_helper_pair_under_a_non_test_named_tempdir() -> tuple[Path, str]:
+    """Write a hook-infra sibling pair under a ``tempfile.mkdtemp()`` root.
+
+    ``tempfile.mkdtemp()`` names its directory ``tmp<random>``, carrying no
+    ``test_`` segment, unlike pytest's own ``tmp_path`` fixture — whose
+    directory embeds the test's name and so reads as a test path to
+    ``is_test_file``'s full-path substring match, silently exempting every
+    check the caller means to exercise.
+    """
+    base_directory = Path(tempfile.mkdtemp())
+    hook_blocking_directory = base_directory / "packages" / "claude-dev-env" / "hooks" / "blocking"
+    hook_blocking_directory.mkdir(parents=True)
+    (hook_blocking_directory / "shipping_helper.py").write_text(
+        _HOOK_MODULE_DUPLICATE_BODY_SOURCE, encoding="utf-8"
+    )
+    return base_directory, str(hook_blocking_directory / "shipping_target.py")
+
+
+def test_full_gate_still_catches_a_helper_duplicated_across_two_hook_modules() -> None:
+    base_directory, target_path = _write_duplicate_helper_pair_under_a_non_test_named_tempdir()
+    try:
+        full_gate_issues = code_rules_enforcer._hook_infrastructure_blocking_issues(
+            _HOOK_MODULE_DUPLICATE_BODY_SOURCE,
+            target_path,
+            phase=validation_phase_constants.FULL_GATE_PHASE,
+        )
+        edit_lane_issues = code_rules_enforcer._hook_infrastructure_blocking_issues(
+            _HOOK_MODULE_DUPLICATE_BODY_SOURCE,
+            target_path,
+            phase=validation_phase_constants.EDIT_LANE_PHASE,
+        )
+    finally:
+        shutil.rmtree(base_directory, ignore_errors=False)
+
+    assert any("duplicates" in each_issue for each_issue in full_gate_issues), (
+        "the full gate must still catch a helper duplicated across two hook "
+        f"modules, got: {full_gate_issues!r}"
+    )
+    assert not any("duplicates" in each_issue for each_issue in edit_lane_issues), (
+        "the edit lane must not run the cross-file duplicate-body check against "
+        f"hook infrastructure, got: {edit_lane_issues!r}"
+    )
+
+
+def test_gate_running_selects_the_full_gate(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    file_path = _write_scoped_service_file_with_a_committed_baseline(repository_root)
+
+    loaded_validate_content = enforcer_loading.load_validate_content_for_full_gate()
+    assert loaded_validate_content.__name__ == "validate_content_for_full_gate"
+
+    scoped_violations = gate_running._scoped_violations_for_file(
+        validate_content=loaded_validate_content,
+        resolved_path=file_path,
+        repository_root=repository_root,
+        all_added_lines_for_file={2, 3},
+        should_read_staged_content=True,
+    )
+    assert scoped_violations is not None
+    blocking_violations, _advisory_violations = scoped_violations
+    assert any("9999" in each_issue for each_issue in blocking_violations)

package/hooks/blocking/test_fable_spawn_gate.py

@@ -72,7 +72,7 @@ _ADVISOR_LIFECYCLE_TEXT = (_ADVISOR_REFERENCE_DIR / "lifecycle.md").read_text(
 _ADVISOR_WARM_UP_TEXT = (_ADVISOR_REFERENCE_DIR / "warm-up.md").read_text(
     encoding="utf-8"
 )
-_ALL_CONSUMING_SKILL_NAMES = ("team-advisor", "orchestrator", "orchestrator-refresh")
+_ALL_CONSUMING_SKILL_NAMES = ("team-advisor",)
 _ALL_CONSUMING_SKILL_PATHS = tuple(
     _PACKAGE_ROOT / ".agents" / "skills" / each_skill_name / "SKILL.md"
     for each_skill_name in _ALL_CONSUMING_SKILL_NAMES

package/hooks/blocking/test_pre_tool_use_dispatcher.py

@@ -734,16 +734,31 @@ def test_dispatcher_multi_edit_applies_only_group_b() -> None:
     )
 
 
-def test_proceed_after_run_all_validators_removal_allows() -> None:
-    """The PreToolUse dispatcher allows a Python edit that the removed gate would have processed.
-
-    The inline run_all_validators runner was a PostToolUse gate removed in Stage 4;
-    it was never a PreToolUse hook and never hosted by the PreToolUse dispatcher.
-    A Python Write payload that run_all_validators would have flagged (mypy errors, for
-    instance) still produces ALLOW from the PreToolUse dispatcher because the PreToolUse
-    dispatcher covers only its 23 hosted blocking hooks — none of which includes the
-    validators runner.
+def _assert_roster_names_no_run_all_validators_entry() -> None:
+    """Assert no hosted-roster ``script_relative_path`` names run_all_validators."""
+    all_roster_script_paths = {
+        each_entry.script_relative_path for each_entry in ALL_HOSTED_HOOK_ENTRIES
+    }
+    assert not any(
+        "run_all_validators" in each_script_path
+        for each_script_path in all_roster_script_paths
+    ), (
+        "ALL_HOSTED_HOOK_ENTRIES must name no run_all_validators entry, got: "
+        f"{sorted(all_roster_script_paths)}"
+    )
+
+
+def test_run_all_validators_is_not_hosted_by_pre_tool_use_dispatcher() -> None:
+    """The main PreToolUse dispatcher's hosted roster names no run_all_validators entry.
+
+    ``hooks.json`` registers the ``run_all_validators`` runner as its own
+    PreToolUse ``Write|Edit`` command, separate from the main dispatcher. A
+    Python Write payload that ``run_all_validators`` would flag (a type error,
+    for instance) still produces ALLOW from the main dispatcher, because its
+    roster carries no entry for that runner.
     """
+    _assert_roster_names_no_run_all_validators_entry()
+
     python_content_with_type_error = (
         "def add_one(value: int) -> int:\n"
         "    return value + 1\n\n\n"
@@ -754,8 +769,8 @@ def test_proceed_after_run_all_validators_removal_allows() -> None:
     is_deny, _reason = _parse_hook_decision(dispatcher_result)
     assert not is_deny, (
         "PreToolUse dispatcher must allow a Python Write with a type error — "
-        "mypy validation is PostToolUse-only; the removed run_all_validators gate "
-        "was never a PreToolUse hook"
+        "run_all_validators runs as its own separate PreToolUse command, not "
+        "through this dispatcher's roster"
     )
     assert dispatcher_result.returncode == 0, (
         f"Dispatcher must exit 0, got {dispatcher_result.returncode}"

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -6,6 +6,14 @@ Extracted from code_rules_enforcer.py to satisfy the constants-location rule.
 import re
 import tokenize
 
+from hooks_constants.validation_phase_constants import (  # noqa: F401  re-exported for code_rules_enforcer.py
+    ALL_HOOK_INFRASTRUCTURE_EDIT_LANE_CHECK_NAMES,
+    ALL_VALIDATION_PHASES,
+    EDIT_LANE_PHASE,
+    FULL_GATE_PHASE,
+    UNKNOWN_VALIDATION_PHASE_MESSAGE_TEMPLATE,
+)
+
 ALL_PYTHON_TOKENIZE_FAILURE_EXCEPTIONS: tuple[type[BaseException], ...] = (
     tokenize.TokenError,
     IndentationError,