claude-dev-env 2.30.1 → 2.31.1

package/hooks/validators/test_run_all_validators_pretooluse.py

@@ -19,6 +19,7 @@ from .run_all_validators import (
     ValidatorResult,
     _escapes_temporary_root,
     _hooks_subprocess_working_directory_and_environment,
+    _scope_agnostic_message,
     _scope_new_and_preexisting,
     _temporary_path_preserving_directory_signal,
     _violation_line_number,
@@ -26,11 +27,16 @@ from .run_all_validators import (
     run_validators_entrypoint_subprocess,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 CONFIG_DIR_TARGET_PATH = (
     "CDP Automations/os_update_workflow/config/submission_constants.py"
 )
 PARENT_TRAVERSAL_TARGET_PATH = "../../escape_target.py"
 RELATIVE_CONFIG_TARGET_PATH = "config/x.py"
+PROJECT_ROOTED_PYTEST_SCRATCH_TARGET_PATH = (
+    "/srv/projects/demo/test_edit_introducing_new_viol0/legacy_module.py"
+)
 
 CLEAN_PYTHON_SOURCE = (
     "def add_two_numbers(first_number: int, second_number: int) -> int:\n"
@@ -226,6 +232,38 @@ class TestTemporaryPathPreservingDirectorySignal:
         )
         assert staged_path == staging_root / "legacy_module.py"
 
+    def test_pytest_scratch_segment_stages_flat_outside_every_temporary_root(
+        self, tmp_path: Path
+    ) -> None:
+        staging_root = tmp_path / "staging_root"
+        staging_root.mkdir()
+        staged_path = _temporary_path_preserving_directory_signal(
+            staging_root, PROJECT_ROOTED_PYTEST_SCRATCH_TARGET_PATH
+        )
+        assert staged_path == staging_root / "legacy_module.py"
+
+    def test_test_helpers_directory_keeps_its_exemption_under_a_temporary_root(
+        self, tmp_path: Path
+    ) -> None:
+        helpers_target = tmp_path / "pkg" / "test_helpers" / "worker.py"
+        staging_root = tmp_path / "staging_root"
+        staging_root.mkdir()
+        staged_path = _temporary_path_preserving_directory_signal(
+            staging_root, str(helpers_target)
+        )
+        assert staged_path == staging_root / "test_helpers" / "worker.py"
+
+    def test_scripts_directory_keeps_its_exemption_under_a_temporary_root(
+        self, tmp_path: Path
+    ) -> None:
+        scripts_target = tmp_path / "pkg" / "scripts" / "run_job.py"
+        staging_root = tmp_path / "staging_root"
+        staging_root.mkdir()
+        staged_path = _temporary_path_preserving_directory_signal(
+            staging_root, str(scripts_target)
+        )
+        assert staged_path == staging_root / "scripts" / "run_job.py"
+
     def test_relative_config_path_preserves_config_under_system_temp_cwd(
         self, monkeypatch: pytest.MonkeyPatch
     ) -> None:
@@ -428,6 +466,100 @@ class TestBaselineScopedGate:
         assert '"permissionDecision": "deny"' in completed.stdout
         assert "Magic Values" in completed.stdout
 
+    def test_renaming_a_function_keeps_its_violation_grandfathered(
+        self, tmp_path: Path
+    ) -> None:
+        target_file = tmp_path / "legacy_module.py"
+        target_file.write_text(
+            _over_long_function_source("over_long_function"), encoding="utf-8"
+        )
+        completed = run_gate(
+            {
+                "tool_name": "Edit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "old_string": "def over_long_function(",
+                    "new_string": "def accumulate_running_total(",
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert '"permissionDecision": "deny"' not in completed.stdout
+        assert "Code Quality" in completed.stderr
+
+    def test_renaming_a_function_denies_a_second_violation_of_the_same_shape(
+        self, tmp_path: Path
+    ) -> None:
+        target_file = tmp_path / "legacy_module.py"
+        target_file.write_text(
+            _over_long_function_source("over_long_function"), encoding="utf-8"
+        )
+        completed = run_gate(
+            {
+                "tool_name": "Edit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "old_string": "def over_long_function(",
+                    "new_string": (
+                        _over_long_function_source("second_over_long_function")
+                        + "\n\n"
+                        + "def accumulate_running_total("
+                    ),
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert '"permissionDecision": "deny"' in completed.stdout
+        assert "Code Quality" in completed.stdout
+
+    def test_renaming_a_function_denies_a_new_violation_of_another_validator(
+        self, tmp_path: Path
+    ) -> None:
+        target_file = tmp_path / "legacy_module.py"
+        target_file.write_text(
+            _over_long_function_source("over_long_function"), encoding="utf-8"
+        )
+        completed = run_gate(
+            {
+                "tool_name": "Edit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "old_string": "def over_long_function(",
+                    "new_string": "import os\n\n\ndef accumulate_running_total(",
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert '"permissionDecision": "deny"' in completed.stdout
+        assert "F401" in completed.stdout
+
+    def test_moving_a_violation_to_another_function_keeps_it_grandfathered(
+        self, tmp_path: Path
+    ) -> None:
+        target_file = tmp_path / "legacy_module.py"
+        target_file.write_text(RUFF_DIRTY_FUNCTION_SOURCE, encoding="utf-8")
+        completed = run_gate(
+            {
+                "tool_name": "Edit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "old_string": RUFF_DIRTY_FUNCTION_SOURCE,
+                    "new_string": (
+                        "def compute_total() -> int:\n"
+                        "    return 1\n"
+                        "\n"
+                        "\n"
+                        "def compute_subtotal() -> int:\n"
+                        "    unused_intermediate = 1\n"
+                        "    return 1\n"
+                    ),
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert '"permissionDecision": "deny"' not in completed.stdout
+        assert "F841" in completed.stderr
+
     def test_new_module_scope_ruff_violation_with_dirty_function_denies(
         self, tmp_path: Path
     ) -> None:
@@ -449,6 +581,37 @@ class TestBaselineScopedGate:
         assert "F841" not in completed.stdout
 
 
+class TestScopeAgnosticMessage:
+    def test_masks_the_enclosing_function_name_and_its_metrics(self) -> None:
+        masked_message = _scope_agnostic_message(
+            "over_long_function", "Function 'over_long_function' is 37 lines (max 30)"
+        )
+
+        assert masked_message == "Function '<name>' is <number> lines (max <number>)"
+
+    def test_keeps_the_numbers_of_a_message_that_never_names_its_function(self) -> None:
+        magic_value_message = "Magic number 199 - use named constant"
+
+        masked_message = _scope_agnostic_message("compute_total", magic_value_message)
+
+        assert masked_message == magic_value_message
+
+    def test_keeps_a_module_scope_message_unchanged(self) -> None:
+        ruff_message = "F401 `os` imported but unused"
+
+        masked_message = _scope_agnostic_message("", ruff_message)
+
+        assert masked_message == ruff_message
+
+    def test_masks_only_the_innermost_name_of_a_qualified_scope(self) -> None:
+        masked_message = _scope_agnostic_message(
+            "Ledger.record_entry",
+            "Parameter 'entry' in 'record_entry' missing type annotation",
+        )
+
+        assert masked_message == "Parameter 'entry' in '<name>' missing type annotation"
+
+
 class TestScopeNewAndPreexisting:
     def test_failed_result_without_located_lines_is_treated_as_new(self) -> None:
         summary_only_result = ValidatorResult(

package/hooks/validators/test_run_all_validators_repository_root.py

@@ -0,0 +1,202 @@
+"""Repository-root anchoring tests for the PreToolUse staging walk.
+
+Staging mirrors the destination's exemption-signalling directories through a
+temp path so the save-path checks read the same signals the real path carries.
+The walk must read only the segments the project itself owns. A directory above
+the project root — a home directory named ``tests``, a checkout parked under
+``config`` — belongs to whoever laid out the disk, not to the project, and must
+never lend a production file a test or config exemption.
+"""
+
+from pathlib import Path
+
+import pytest
+
+from .run_all_validators import (
+    _temporary_path_preserving_directory_signal,
+    validate_proposed_file,
+)
+
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
+GIT_MARKER_DIRECTORY_NAME = ".git"
+MAGIC_VALUE_CHECK_NAME = "Magic Values"
+PRODUCTION_CONTENT_WITH_MAGIC_VALUE = "def retry_budget_seconds() -> int:\n    return 3600 * 7\n"
+
+
+def _project_root_under(parent_directory: Path) -> Path:
+    """Create a git-marked project directory under *parent_directory*.
+
+    Args:
+        parent_directory: Directory the project root is created inside.
+
+    Returns:
+        The created project root, holding an empty ``.git`` marker directory.
+    """
+    project_root = parent_directory / "project"
+    (project_root / GIT_MARKER_DIRECTORY_NAME).mkdir(parents=True)
+    return project_root
+
+
+def _staged_relative_path(staging_directory: Path, destination_path: Path) -> str:
+    """Return the posix staged path *destination_path* produces, relative to staging.
+
+    Args:
+        staging_directory: Root of the ephemeral staging tree.
+        destination_path: Real destination the write or edit targets.
+
+    Returns:
+        The staged path relative to *staging_directory*, in posix form.
+    """
+    staged_path = _temporary_path_preserving_directory_signal(
+        staging_directory, str(destination_path)
+    )
+    return staged_path.relative_to(staging_directory).as_posix()
+
+
+def _failed_check_names(destination_path: Path, proposed_content: str) -> list[str]:
+    """Return the names of every save-path check that fails for a destination.
+
+    Args:
+        destination_path: Real destination the write or edit targets.
+        proposed_content: Post-edit content the write would leave on disk.
+
+    Returns:
+        The failing check names, in roster order.
+    """
+    return [
+        each_result.name
+        for each_result in validate_proposed_file(str(destination_path), proposed_content)
+        if not each_result.passed
+    ]
+
+
+def test_should_drop_tests_directory_above_the_project_root(tmp_path: Path) -> None:
+    """A home directory named ``tests`` lends no test exemption to project code."""
+    parent_named_tests = tmp_path / "tests"
+    project_root = _project_root_under(parent_named_tests)
+    staging_directory = tmp_path / "staging"
+    staging_directory.mkdir()
+
+    staged_relative = _staged_relative_path(staging_directory, project_root / "src" / "worker.py")
+
+    assert staged_relative == "worker.py", (
+        f"a tests directory above the project must not stage into the path, got {staged_relative}"
+    )
+
+
+def test_should_drop_config_directory_above_the_project_root(tmp_path: Path) -> None:
+    """A checkout parked under ``config`` lends no config exemption to project code."""
+    parent_named_config = tmp_path / "config"
+    project_root = _project_root_under(parent_named_config)
+    staging_directory = tmp_path / "staging"
+    staging_directory.mkdir()
+
+    staged_relative = _staged_relative_path(staging_directory, project_root / "src" / "worker.py")
+
+    assert staged_relative == "worker.py", (
+        f"a config directory above the project must not stage into the path, got {staged_relative}"
+    )
+
+
+def test_should_report_magic_value_for_production_file_under_a_tests_parent(
+    tmp_path: Path,
+) -> None:
+    """The magic-value check grades project code under a ``tests`` parent directory."""
+    project_root = _project_root_under(tmp_path / "tests")
+
+    all_failed_names = _failed_check_names(
+        project_root / "src" / "worker.py", PRODUCTION_CONTENT_WITH_MAGIC_VALUE
+    )
+
+    assert MAGIC_VALUE_CHECK_NAME in all_failed_names, (
+        f"production code under a tests parent must still be graded, got {all_failed_names}"
+    )
+
+
+def test_should_report_magic_value_for_production_file_under_a_config_parent(
+    tmp_path: Path,
+) -> None:
+    """The magic-value check grades project code under a ``config`` parent directory."""
+    project_root = _project_root_under(tmp_path / "config")
+
+    all_failed_names = _failed_check_names(
+        project_root / "src" / "worker.py", PRODUCTION_CONTENT_WITH_MAGIC_VALUE
+    )
+
+    assert MAGIC_VALUE_CHECK_NAME in all_failed_names, (
+        f"production code under a config parent must still be graded, got {all_failed_names}"
+    )
+
+
+def test_should_keep_test_helpers_directory_inside_the_project(tmp_path: Path) -> None:
+    """A ``test_helpers`` package inside the project keeps its test exemption."""
+    project_root = _project_root_under(tmp_path / "tests")
+    staging_directory = tmp_path / "staging"
+    staging_directory.mkdir()
+
+    staged_relative = _staged_relative_path(
+        staging_directory, project_root / "pkg" / "test_helpers" / "worker.py"
+    )
+
+    assert staged_relative == "test_helpers/worker.py", (
+        f"an in-project test_helpers directory must stage into the path, got {staged_relative}"
+    )
+
+
+def test_should_keep_scripts_directory_inside_the_project(tmp_path: Path) -> None:
+    """A ``scripts`` directory inside the project keeps its CLI-marker signal."""
+    project_root = _project_root_under(tmp_path / "tests")
+    staging_directory = tmp_path / "staging"
+    staging_directory.mkdir()
+
+    staged_relative = _staged_relative_path(
+        staging_directory, project_root / "scripts" / "deploy.py"
+    )
+
+    assert staged_relative == "scripts/deploy.py", (
+        f"an in-project scripts directory must stage into the path, got {staged_relative}"
+    )
+
+
+def test_should_keep_tests_directory_inside_the_project(tmp_path: Path) -> None:
+    """A genuine ``tests`` directory inside the project keeps its test exemption."""
+    project_root = _project_root_under(tmp_path / "config")
+    staging_directory = tmp_path / "staging"
+    staging_directory.mkdir()
+
+    staged_relative = _staged_relative_path(
+        staging_directory, project_root / "tests" / "helpers" / "data.py"
+    )
+
+    assert staged_relative == "tests/helpers/data.py", (
+        f"an in-project tests directory must stage into the path, got {staged_relative}"
+    )
+
+
+def test_should_keep_config_directory_inside_the_project(tmp_path: Path) -> None:
+    """A ``config`` directory inside the project keeps its magic-value exemption."""
+    project_root = _project_root_under(tmp_path / "tests")
+
+    all_failed_names = _failed_check_names(
+        project_root / "config" / "timing.py", PRODUCTION_CONTENT_WITH_MAGIC_VALUE
+    )
+
+    assert MAGIC_VALUE_CHECK_NAME not in all_failed_names, (
+        f"an in-project config module must stay magic-value exempt, got {all_failed_names}"
+    )
+
+
+def test_should_walk_every_segment_for_a_target_with_no_project_root(
+    tmp_path: Path,
+) -> None:
+    """An install-tree target outside every project keeps the whole-path walk."""
+    install_target = tmp_path / ".claude" / "hooks" / "blocking" / "gate.py"
+    staging_directory = tmp_path / "staging"
+    staging_directory.mkdir()
+
+    staged_relative = _staged_relative_path(staging_directory, install_target)
+
+    assert staged_relative == ".claude/hooks/blocking/gate.py", (
+        f"a target with no project root must keep its exemption tail, got {staged_relative}"
+    )

package/hooks/validators/test_validator_base.py

@@ -1,8 +1,11 @@
-"""Tests for shared validator base types."""
+"""Tests for shared validator base types and its shared read and parse."""
+
+import ast
+from pathlib import Path
 
 import pytest
 
-from .validator_base import Violation
+from .validator_base import Violation, source_text, syntax_tree
 
 
 class TestViolation:
@@ -24,3 +27,49 @@ class TestViolation:
         violation = Violation(file="test.py", line=42, message="Test message")
         violation_set = {violation}
         assert violation in violation_set
+
+def test_source_text_reads_the_file_once_for_repeated_callers(tmp_path: Path) -> None:
+    """Two callers asking for the same unchanged file cause one read."""
+    target = tmp_path / "module.py"
+    target.write_text("value = 1\n", encoding="utf-8")
+    first = source_text(target)
+    second = source_text(target)
+    assert first == second == "value = 1\n"
+    assert source_text.__module__ == "validators.validator_base"
+
+
+def test_source_text_reads_again_after_the_file_changes(tmp_path: Path) -> None:
+    """An edited file is read again rather than served from the cache.
+
+    The cache key carries the modification time and the size, so a rewrite
+    between two calls reaches disk a second time.
+    """
+    target = tmp_path / "module.py"
+    target.write_text("value = 1\n", encoding="utf-8")
+    assert source_text(target) == "value = 1\n"
+    target.write_text("value = 2\nvalue = 3\n", encoding="utf-8")
+    assert source_text(target) == "value = 2\nvalue = 3\n"
+
+
+def test_source_text_raises_for_a_missing_file(tmp_path: Path) -> None:
+    """A caller's own error handling still sees the read failure."""
+    with pytest.raises(OSError):
+        source_text(tmp_path / "absent.py")
+
+
+def test_syntax_tree_returns_the_same_tree_for_the_same_source() -> None:
+    """One parse serves every caller asking about the same text."""
+    source = "def handler() -> int:\n    return 1\n"
+    assert syntax_tree(source) is syntax_tree(source)
+
+
+def test_syntax_tree_parses_what_ast_parse_parses() -> None:
+    """The shared parse agrees with a direct ast.parse of the same text."""
+    source = "value = 1\n"
+    assert ast.dump(syntax_tree(source)) == ast.dump(ast.parse(source))
+
+
+def test_syntax_tree_raises_syntax_error_for_unparseable_source() -> None:
+    """A caller's own SyntaxError branch still fires."""
+    with pytest.raises(SyntaxError):
+        syntax_tree("def broken(:\n")

package/hooks/validators/todo_checks.py

@@ -8,7 +8,7 @@ import sys
 from pathlib import Path
 from typing import List
 
-from .validator_base import Violation
+from .validator_base import Violation, source_text
 
 
 TODO_PATTERN = re.compile(r"#\s*(TODO|FIXME)\b(?!.*#\d+)", re.IGNORECASE)
@@ -34,7 +34,7 @@ def check_untracked_todos(source: str, filename: str) -> List[Violation]:
 def validate_file(file_path: Path) -> List[Violation]:
     filename = str(file_path)
     try:
-        source = file_path.read_text(encoding="utf-8")
+        source = source_text(file_path)
     except Exception as error:
         return [Violation(filename, 0, f"Error reading file: {error}")]
 

package/hooks/validators/type_safety_checks.py

@@ -10,7 +10,7 @@ import sys
 from pathlib import Path
 from typing import List
 
-from .validator_base import Violation
+from .validator_base import Violation, source_text, syntax_tree
 
 
 def check_missing_type_hints(tree: ast.AST, filename: str) -> List[Violation]:
@@ -66,8 +66,8 @@ def validate_file(file_path: Path) -> List[Violation]:
     filename = str(file_path)
 
     try:
-        source = file_path.read_text(encoding="utf-8")
-        tree = ast.parse(source)
+        source = source_text(file_path)
+        tree = syntax_tree(source)
     except Exception as error:
         return [Violation(filename, 0, f"Error: {error}")]
 

package/hooks/validators/useless_test_checks.py

@@ -9,7 +9,7 @@ import sys
 from pathlib import Path
 from typing import List
 
-from .validator_base import Violation
+from .validator_base import Violation, source_text, syntax_tree
 
 
 def check_useless_tests(tree: ast.AST, filename: str) -> List[Violation]:
@@ -66,8 +66,8 @@ def validate_file(file_path: Path) -> List[Violation]:
         return []
 
     try:
-        source = file_path.read_text(encoding="utf-8")
-        tree = ast.parse(source)
+        source = source_text(file_path)
+        tree = syntax_tree(source)
     except Exception as error:
         return [Violation(filename, 0, f"Error: {error}")]
 

package/hooks/validators/validator_base.py

@@ -1,9 +1,15 @@
 """Base classes for validators.
 
-Provides shared dataclasses used across all validator modules.
+Provides shared dataclasses used across all validator modules, and the one
+read and the one parse each of those modules shares for a given file.
 """
 
+import ast
 from dataclasses import dataclass
+from functools import lru_cache
+from pathlib import Path
+
+from .config.validator_base_constants import SOURCE_CACHE_ENTRIES, SOURCE_ENCODING
 
 
 @dataclass(frozen=True)
@@ -17,3 +23,69 @@ class Violation:
     def __str__(self) -> str:
         """Format as file:line: message."""
         return f"{self.file}:{self.line}: {self.message}"
+
+
+@dataclass(frozen=True)
+class ValidatorResult:
+    """Result from running a validator."""
+
+    name: str
+    checks: str
+    passed: bool
+    output: str
+    skipped: bool = False
+
+
+@lru_cache(maxsize=SOURCE_CACHE_ENTRIES)
+def _source_text_for_stat(
+    file_path_text: str, modified_nanoseconds: int, size_in_bytes: int
+) -> str:
+    """Read one file, keyed on the stat that identifies this version of it."""
+    return Path(file_path_text).read_text(encoding=SOURCE_ENCODING)
+
+
+def source_text(file_path: Path) -> str:
+    """Return the file's text, reading it once however many checks ask.
+
+    Every check the save-path gate runs reads the same file. The gate hands
+    each of them one freshly written target, so the read is repeated work.
+    The cache key carries the modification time and size, so an edited file
+    is read again.
+
+    That key has one blind spot: a rewrite that leaves the size unchanged
+    inside a single modification-time tick is served from the cache. A hook
+    process handles one payload, so it cannot happen there; a long CLI pass
+    over many files is where a reader needs to know.
+
+    Raises whatever ``read_text`` raises, so a caller's own error handling
+    is unchanged.
+
+    Args:
+        file_path: The file to read.
+
+    Returns:
+        The file's decoded text.
+    """
+    file_status = file_path.stat()
+    return _source_text_for_stat(
+        str(file_path), file_status.st_mtime_ns, file_status.st_size
+    )
+
+
+@lru_cache(maxsize=SOURCE_CACHE_ENTRIES)
+def syntax_tree(source: str) -> ast.Module:
+    """Return the parsed tree for source, parsing it once however many checks ask.
+
+    No check mutates the tree; each one walks it. So one parse serves all of
+    them, and the tree is shared rather than copied.
+
+    Raises ``SyntaxError`` exactly as ``ast.parse`` does, so a caller's own
+    error handling is unchanged.
+
+    Args:
+        source: The file's text.
+
+    Returns:
+        The parsed module.
+    """
+    return ast.parse(source)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "2.30.1",
+    "version": "2.31.1",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/docstring-prose-matches-implementation.md

@@ -34,7 +34,7 @@ Many deterministic shapes of this drift have Write/Edit gates in `~/.claude/hook
 
 A hook module is the sharpest case of the same rule: its docstring lead narrative and its `CORRECTIVE_MESSAGE` describe exactly the shapes the detector flags, and claim no broader trigger surface than the regex enforces.
 
-`hook_prose_detector_consistency` (PreToolUse on Write|Edit of hook modules and their `*_constants.py` companions) blocks prose that claims a trigger the detector never fires on, and names the fix.
+`hook_prose_detector_consistency` (PreToolUse on Write|Edit|MultiEdit of hook modules and their `*_constants.py` companions) blocks prose that claims a trigger the detector never fires on, and names the fix.
 
 After writing a hook, ask: would a token matching every word of this message actually trip the detector? When the message names a shape the regex skips, rewrite the message to name only what the regex catches. The path-shape case is the common overstatement — a detector that keys off a path separator must not claim it blocks an "output-key segment". The corrective message spells the rewrite.
 

package/rules/git-workflow.md

@@ -17,6 +17,8 @@ User-level rule: applies to **every** git repo that uses GitHub with `gh` (no ex
 
 **ALWAYS create PRs as DRAFT:** Use `gh pr create --draft` for ALL PRs
 
+**The pr-description-writer agent writes the body:** Spawn the `pr-description-writer` agent (Agent tool, `subagent_type` `pr-description-writer`), then publish what it returns with `--body-file`. `pr_description_writer_gate.py` (PreToolUse on Bash and PowerShell, hosted by `bash_pre_tool_use_dispatcher`) denies a `gh pr create` when the session records no such spawn. A trailing `# pr-description-skip` comment on the command opts out for a body you write yourself.
+
 ## Git Golden Rules (NON-NEGOTIABLE)
 
 1. **DRAFT BEFORE PUSH**: When pushing ANYTHING to a PR, it MUST be in draft state first

package/rules/testing.md

@@ -22,3 +22,7 @@ Incomplete mocks make it impossible to distinguish "broken code" from "missing d
 ## Tests Exercise Real Behavior
 
 Tests exercise real behavior, real data, and production code paths. A test that asserts on a stand-in for the production path proves the stand-in works.
+
+## The File-Level TDD Gate Reads Content
+
+`tdd_enforcer.py` records each candidate test's content hash at every sighting and compares that hash on the next write. A first sighting requires content that differs from HEAD.

package/scripts/codex_compat_materializer.py

@@ -64,6 +64,8 @@ codex_hook_dependency_manifest = (
     "hooks/blocking/code_rules_comments.py",
     "hooks/blocking/code_rules_constants_config.py",
     "hooks/blocking/codex_apply_patch.py",
+    "hooks/blocking/config/__init__.py",
+    "hooks/blocking/config/codex_apply_patch_constants.py",
     "hooks/blocking/code_rules_docstrings.py",
     "hooks/blocking/code_rules_duplicate_body.py",
     "hooks/blocking/code_rules_enforcer.py",
@@ -101,14 +103,17 @@ codex_hook_dependency_manifest = (
     "hooks/hooks_constants/hook_block_logger.py",
     "hooks/hooks_constants/inline_tuple_string_magic_constants.py",
     "hooks/hooks_constants/js_conventions_constants.py",
+    "hooks/hooks_constants/multi_edit_reconstruction.py",
     "hooks/hooks_constants/orphan_css_class_constants.py",
     "hooks/hooks_constants/paired_test_coverage_constants.py",
     "hooks/hooks_constants/setup_project_paths_constants.py",
     "hooks/hooks_constants/stuttering_check_config.py",
     "hooks/hooks_constants/stuttering_import_binding_constants.py",
+    "hooks/hooks_constants/subprocess_budget_completeness_content.py",
     "hooks/hooks_constants/sys_path_insert_constants.py",
     "hooks/hooks_constants/test_layout_constants.py",
     "hooks/hooks_constants/unused_module_import_constants.py",
+    "hooks/hooks_constants/validation_phase_constants.py",
 )
 full_prune_opt_in_flag = "--allow-prune-all"
 unreadable_source_root_message = (