claude-dev-env 2.31.0 → 2.32.0

package/hooks/validators/test_directory_exemption_constants.py

@@ -8,8 +8,6 @@ from __future__ import annotations
 
 from pathlib import Path
 
-import pytest
-
 from hooks_constants.code_rules_enforcer_constants import ALL_CLI_FILE_PATH_MARKERS
 from hooks_constants.code_rules_path_utils_constants import ALL_CONFIG_DIRECTORY_NAMES
 from validators.config.directory_exemption_constants import (
@@ -19,6 +17,7 @@ from validators.config.directory_exemption_constants import (
     all_directory_segments_in_path_pattern,
     directory_segment_names_from_path_patterns,
     is_filename_like_path_segment,
+    is_pytest_scratch_directory_segment,
     substring_patterns_from_path_patterns,
 )
 from validators.exempt_paths import (
@@ -36,6 +35,9 @@ ALL_SYNTHETIC_DIRECTORY_PATTERNS = frozenset(
     {"/foo/", "\\bar\\", "/baz.py", "plain", "/.hidden/qux/"}
 )
 ALL_EXPECTED_SYNTHETIC_SEGMENTS = frozenset({"foo", "bar", ".hidden", "qux"})
+OVER_LONG_STEM_DIRECTORY_NAME = "test_helpers_for_a_very_long_domain_name0"
+PROJECT_ROOTED_BASETEMP_PATH = "/srv/projects/scratch-basetemp"
+PYTEST_SCRATCH_DIRECTORY_NAME = "test_edit_introducing_new_viol0"
 
 
 def test_is_filename_like_path_segment_detects_extensions() -> None:
@@ -45,6 +47,21 @@ def test_is_filename_like_path_segment_detects_extensions() -> None:
     assert is_filename_like_path_segment(".claude") is False
 
 
+def test_is_pytest_scratch_directory_segment_detects_numbered_test_directories() -> None:
+    assert is_pytest_scratch_directory_segment("test_drops_leading_anchor0") is True
+    assert is_pytest_scratch_directory_segment("test_edit_introducing_new_viol0") is True
+    assert is_pytest_scratch_directory_segment("pytest-of-root") is True
+    assert is_pytest_scratch_directory_segment("pytest-9") is True
+
+
+def test_is_pytest_scratch_directory_segment_keeps_real_project_directories() -> None:
+    assert is_pytest_scratch_directory_segment("test_helpers") is False
+    assert is_pytest_scratch_directory_segment("tests") is False
+    assert is_pytest_scratch_directory_segment("scripts") is False
+    assert is_pytest_scratch_directory_segment("conftest") is False
+    assert is_pytest_scratch_directory_segment(OVER_LONG_STEM_DIRECTORY_NAME) is False
+
+
 def test_all_directory_segments_in_path_pattern_keeps_directory_tokens_only() -> None:
     assert all_directory_segments_in_path_pattern("/.claude/hooks/") == [
         ".claude",
@@ -136,32 +153,21 @@ def test_absolute_system_temp_pytest_shaped_path_stages_flat_basename(
     assert staged_path == staging_root / "legacy_module.py"
 
 
-def test_runner_temp_pytest_shaped_path_stages_flat_basename_when_gettempdir_differs(
+def test_pytest_shaped_path_stages_flat_basename_under_every_basetemp_placement(
     tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    """GHA basetemp lives under RUNNER_TEMP while gettempdir is often /tmp."""
-    runner_temp_root = tmp_path / "runner_temp"
-    os_gettemp = tmp_path / "os_gettemp"
-    runner_temp_root.mkdir()
-    os_gettemp.mkdir()
-    monkeypatch.setenv("RUNNER_TEMP", str(runner_temp_root))
-    monkeypatch.setattr(
-        "validators.system_temporary_roots.tempfile.gettempdir",
-        lambda: str(os_gettemp),
-    )
-    pytest_shaped_target = (
-        runner_temp_root
-        / "pytest-basetemp-pkg"
-        / "test_edit_introducing_new_viol0"
-        / "legacy_module.py"
-    )
+    """A ``--basetemp`` outside every temp root must not change the staged path."""
     staging_root = tmp_path / "staging_root"
     staging_root.mkdir()
-    staged_path = _temporary_path_preserving_directory_signal(
-        staging_root, str(pytest_shaped_target)
-    )
-    assert staged_path == staging_root / "legacy_module.py"
+    all_basetemp_roots = (tmp_path, Path(PROJECT_ROOTED_BASETEMP_PATH))
+    all_staged_paths = {
+        _temporary_path_preserving_directory_signal(
+            staging_root,
+            str(each_root / PYTEST_SCRATCH_DIRECTORY_NAME / "legacy_module.py"),
+        )
+        for each_root in all_basetemp_roots
+    }
+    assert all_staged_paths == {staging_root / "legacy_module.py"}
 
 
 def test_substring_patterns_from_path_patterns_skips_directory_tokens() -> None:

package/hooks/validators/test_fast_save_validators.py

@@ -45,7 +45,7 @@ def test_run_fast_save_validators_covers_every_non_mypy_non_ruff_check(
 
     all_outcomes = run_fast_save_validators([target_file])
 
-    assert {each_outcome.display_name for each_outcome in all_outcomes} == (
+    assert {each_outcome.name for each_outcome in all_outcomes} == (
         _ALL_EXPECTED_FAST_SAVE_VALIDATOR_NAMES
     )
 
@@ -56,8 +56,8 @@ def test_run_fast_save_validators_excludes_mypy_and_ruff(tmp_path: Path) -> None
 
     all_outcomes = run_fast_save_validators([target_file])
 
-    assert all(each_outcome.display_name != "Mypy" for each_outcome in all_outcomes)
-    assert all(each_outcome.display_name != "Ruff" for each_outcome in all_outcomes)
+    assert all(each_outcome.name != "Mypy" for each_outcome in all_outcomes)
+    assert all(each_outcome.name != "Ruff" for each_outcome in all_outcomes)
 
 
 def test_run_fast_save_validators_spawns_no_subprocess(
@@ -98,9 +98,9 @@ def test_magic_values_outcome_matches_direct_validate_file_call(
         all_outcomes = run_fast_save_validators([target_file])
 
     magic_values_outcome = next(
-        each for each in all_outcomes if each.display_name == "Magic Values"
+        each for each in all_outcomes if each.name == "Magic Values"
     )
-    assert magic_values_outcome.violation_report == "\n".join(expected_lines)
+    assert magic_values_outcome.output == "\n".join(expected_lines)
 
 
 def test_todo_outcome_matches_direct_validate_file_call(tmp_path: Path) -> None:
@@ -111,8 +111,8 @@ def test_todo_outcome_matches_direct_validate_file_call(tmp_path: Path) -> None:
 
     all_outcomes = run_fast_save_validators([target_file])
 
-    todo_outcome = next(each for each in all_outcomes if each.display_name == "TODO Tracking")
-    assert todo_outcome.violation_report == "\n".join(expected_lines)
+    todo_outcome = next(each for each in all_outcomes if each.name == "TODO Tracking")
+    assert todo_outcome.output == "\n".join(expected_lines)
 
 
 def test_abbreviations_outcome_reports_clean_for_a_clean_file(tmp_path: Path) -> None:
@@ -125,9 +125,9 @@ def test_abbreviations_outcome_reports_clean_for_a_clean_file(tmp_path: Path) ->
     all_outcomes = run_fast_save_validators([target_file])
 
     abbreviations_outcome = next(
-        each for each in all_outcomes if each.display_name == "Abbreviations"
+        each for each in all_outcomes if each.name == "Abbreviations"
     )
-    assert abbreviations_outcome.is_clean is True
+    assert abbreviations_outcome.passed is True
 
 
 def test_react_outcome_matches_direct_check_function_call(tmp_path: Path) -> None:
@@ -139,8 +139,8 @@ def test_react_outcome_matches_direct_check_function_call(tmp_path: Path) -> Non
 
     all_outcomes = run_fast_save_validators([target_file])
 
-    react_outcome = next(each for each in all_outcomes if each.display_name == "React")
-    assert react_outcome.violation_report == "\n".join(expected_lines)
+    react_outcome = next(each for each in all_outcomes if each.name == "React")
+    assert react_outcome.output == "\n".join(expected_lines)
 
 
 def test_test_safety_outcome_matches_direct_check_function_calls(
@@ -155,8 +155,8 @@ def test_test_safety_outcome_matches_direct_check_function_calls(
 
     all_outcomes = run_fast_save_validators([target_file])
 
-    test_safety_outcome = next(each for each in all_outcomes if each.display_name == "Test Safety")
-    assert test_safety_outcome.violation_report == "\n".join(expected_lines)
+    test_safety_outcome = next(each for each in all_outcomes if each.name == "Test Safety")
+    assert test_safety_outcome.output == "\n".join(expected_lines)
 
 
 def test_no_matching_files_reports_configured_message(tmp_path: Path) -> None:
@@ -166,7 +166,7 @@ def test_no_matching_files_reports_configured_message(tmp_path: Path) -> None:
     all_outcomes = run_fast_save_validators([target_file])
 
     abbreviations_outcome = next(
-        each for each in all_outcomes if each.display_name == "Abbreviations"
+        each for each in all_outcomes if each.name == "Abbreviations"
     )
-    assert abbreviations_outcome.is_clean is True
-    assert abbreviations_outcome.violation_report == "No Python files to check"
+    assert abbreviations_outcome.passed is True
+    assert abbreviations_outcome.output == "No Python files to check"

package/hooks/validators/test_hook_timing_harness.py

@@ -106,8 +106,16 @@ def test_ensure_real_repository_target_accepts_a_repo_file_under_the_os_temp_roo
 
 
 def test_ensure_real_repository_target_refuses_a_scratch_path_outside_the_repository_root(
-    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
 ) -> None:
+    """The refusal is under test, so this pins the temp root it is judged against.
+
+    ``--basetemp`` places ``tmp_path`` wherever the caller asks, so a run that
+    points it outside the OS temp root leaves the scratch target real and this
+    assertion measures the caller's flags. Naming the root here keeps the
+    subject of the test inside the test.
+    """
+    monkeypatch.setattr(tempfile, "gettempdir", lambda: str(tmp_path))
     repository_root = tmp_path / "repo"
     repository_root.mkdir()
     scratch_target = tmp_path / "scratch.py"
@@ -194,6 +202,7 @@ def test_measure_hosted_command_wall_times_honors_a_repository_root_override(
     gap the wrapper-plumb-through check caught.
     """
     monkeypatch.setattr(hook_timing_harness, "write_edit_hook_commands", lambda path: [])
+    monkeypatch.setattr(tempfile, "gettempdir", lambda: str(tmp_path))
     repository_root = tmp_path / "repo"
     real_file = repository_root / "hooks" / "blocking" / "code_rules_shared.py"
     real_file.parent.mkdir(parents=True)

package/hooks/validators/test_run_all_validators.py

@@ -398,3 +398,25 @@ class TestHooksSubprocessWorkingDirectory:
             )
         assert working_directory_string == tempfile.gettempdir()
         assert not working_directory_string.startswith("\\\\")
+
+
+class TestDocstringExamplePaths:
+    def test_module_source_carries_no_home_directory_example_paths(self) -> None:
+        """Example paths avoid /home so the privacy gate reads no personal data.
+
+        The gate allowlists a fixed set of placeholder home usernames, so an
+        invented name outside that set reads as somebody's real home directory
+        and denies the commit. Rooting an example somewhere other than /home
+        keeps the illustration and leaves nothing for the gate to flag.
+        """
+        module_source = (Path(__file__).parent / "run_all_validators.py").read_text(
+            encoding="utf-8"
+        )
+
+        all_home_example_lines = [
+            each_line
+            for each_line in module_source.splitlines()
+            if '"/home/' in each_line
+        ]
+
+        assert all_home_example_lines == []

package/hooks/validators/test_run_all_validators_mutation_tool_parity.py

@@ -0,0 +1,249 @@
+"""Behavioral tests for validator coverage across every mutation tool.
+
+The PreToolUse gate has to reach a MultiEdit and a Codex apply_patch the same
+way it reaches a Write and an Edit. Two things carry that: the hooks.json
+matcher the harness dispatches on, and the payload shape the gate reconstructs
+post-edit content from.
+"""
+
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from hooks_constants.pre_tool_use_dispatcher_constants import (
+    ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES,
+)
+
+from .run_all_validators import run_validators_entrypoint_subprocess
+
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
+HOOKS_JSON_PATH = Path(__file__).resolve().parents[1] / "hooks.json"
+VALIDATORS_RUNNER_COMMAND_MARKER = "validators.run_all_validators"
+MATCHER_TOOL_NAME_SEPARATOR = "|"
+DENY_DECISION_FRAGMENT = '"permissionDecision": "deny"'
+MAGIC_VALUE_VALIDATOR_NAME = "Magic Values"
+
+CLEAN_MODULE_SOURCE = (
+    "def clean_marker() -> int:\n    computed_value = 1\n    return computed_value\n"
+)
+CLEAN_SECOND_MODULE_SOURCE = (
+    "def second_marker() -> int:\n    counted_value = 1\n    return counted_value\n"
+)
+CLEAN_RETURN_LINE = "    return computed_value\n"
+MAGIC_VALUE_RETURN_LINE = "    return computed_value * 199\n"
+CLEAN_REWRITTEN_RETURN_LINE = "    return computed_value + 1\n"
+
+UPDATE_PATCH_TEMPLATE = (
+    "*** Begin Patch\n"
+    "*** Update File: {relative_path}\n"
+    "@@\n"
+    "-{removed_line}"
+    "+{added_line}"
+    "*** End Patch\n"
+)
+ADD_VIOLATING_FILE_PATCH_COMMAND = (
+    "*** Begin Patch\n"
+    "*** Add File: added_module.py\n"
+    "+def added_marker() -> int:\n"
+    "+    return 199\n"
+    "*** End Patch\n"
+)
+DELETE_FILE_PATCH_COMMAND = (
+    "*** Begin Patch\n*** Delete File: legacy_module.py\n*** End of File\n*** End Patch\n"
+)
+UNPARSEABLE_PATCH_COMMAND = "not a codex patch at all\n"
+TWO_FILE_PATCH_COMMAND = (
+    "*** Begin Patch\n"
+    "*** Update File: first_module.py\n"
+    "@@\n"
+    "-    return computed_value\n"
+    "+    return computed_value + 1\n"
+    "*** Update File: second_module.py\n"
+    "@@\n"
+    "-    return counted_value\n"
+    "+    return counted_value * 199\n"
+    "*** End Patch\n"
+)
+
+
+def run_gate(payload: dict[str, object]) -> "subprocess.CompletedProcess[str]":
+    """Drive the real --pre-tool-use entry point with one payload."""
+    return run_validators_entrypoint_subprocess(["--pre-tool-use"], stdin_text=json.dumps(payload))
+
+
+def update_patch_command(relative_path: str, added_line: str) -> str:
+    """Build an Update File patch rewriting the module's return line."""
+    return UPDATE_PATCH_TEMPLATE.format(
+        relative_path=relative_path,
+        removed_line=CLEAN_RETURN_LINE,
+        added_line=added_line,
+    )
+
+
+def write_clean_module(target_directory: Path, module_name: str) -> Path:
+    """Write the clean Python module the payloads target."""
+    target_file = target_directory / module_name
+    target_file.write_text(CLEAN_MODULE_SOURCE, encoding="utf-8")
+    return target_file
+
+
+class TestMutationToolRegistration:
+    def test_validators_gate_is_registered_on_every_mutation_tool(self) -> None:
+        hooks_document = json.loads(HOOKS_JSON_PATH.read_text(encoding="utf-8"))
+        all_matchers = [
+            each_group["matcher"]
+            for each_group in hooks_document["hooks"]["PreToolUse"]
+            for each_hook in each_group.get("hooks", [])
+            if VALIDATORS_RUNNER_COMMAND_MARKER in each_hook.get("command", "")
+        ]
+        assert len(all_matchers) == 1, all_matchers
+        assert (
+            set(all_matchers[0].split(MATCHER_TOOL_NAME_SEPARATOR))
+            == ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES
+        )
+
+
+class TestMultiEditPayloadLane:
+    def test_multi_edit_introducing_a_violation_denies(self, tmp_path: Path) -> None:
+        target_file = write_clean_module(tmp_path, "legacy_module.py")
+        completed = run_gate(
+            {
+                "tool_name": "MultiEdit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "edits": [
+                        {
+                            "old_string": CLEAN_RETURN_LINE,
+                            "new_string": MAGIC_VALUE_RETURN_LINE,
+                        }
+                    ],
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert DENY_DECISION_FRAGMENT in completed.stdout
+        assert MAGIC_VALUE_VALIDATOR_NAME in completed.stdout
+
+    def test_multi_edit_leaving_clean_content_allows(self, tmp_path: Path) -> None:
+        target_file = write_clean_module(tmp_path, "clean_module.py")
+        completed = run_gate(
+            {
+                "tool_name": "MultiEdit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "edits": [
+                        {
+                            "old_string": CLEAN_RETURN_LINE,
+                            "new_string": CLEAN_REWRITTEN_RETURN_LINE,
+                        }
+                    ],
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert DENY_DECISION_FRAGMENT not in completed.stdout
+
+
+class TestApplyPatchPayloadLane:
+    def test_apply_patch_introducing_a_violation_denies(self, tmp_path: Path) -> None:
+        write_clean_module(tmp_path, "legacy_module.py")
+        completed = run_gate(
+            {
+                "tool_name": "apply_patch",
+                "tool_input": {
+                    "command": update_patch_command("legacy_module.py", MAGIC_VALUE_RETURN_LINE)
+                },
+                "cwd": str(tmp_path),
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert DENY_DECISION_FRAGMENT in completed.stdout
+        assert MAGIC_VALUE_VALIDATOR_NAME in completed.stdout
+
+    def test_apply_patch_deny_reason_names_the_patched_file(self, tmp_path: Path) -> None:
+        target_file = write_clean_module(tmp_path, "legacy_module.py")
+        completed = run_gate(
+            {
+                "tool_name": "apply_patch",
+                "tool_input": {
+                    "command": update_patch_command("legacy_module.py", MAGIC_VALUE_RETURN_LINE)
+                },
+                "cwd": str(tmp_path),
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert target_file.name in completed.stdout
+
+    def test_apply_patch_leaving_clean_content_allows(self, tmp_path: Path) -> None:
+        write_clean_module(tmp_path, "clean_module.py")
+        completed = run_gate(
+            {
+                "tool_name": "apply_patch",
+                "tool_input": {
+                    "command": update_patch_command("clean_module.py", CLEAN_REWRITTEN_RETURN_LINE)
+                },
+                "cwd": str(tmp_path),
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert DENY_DECISION_FRAGMENT not in completed.stdout
+
+    def test_apply_patch_adding_a_violating_file_denies(self, tmp_path: Path) -> None:
+        completed = run_gate(
+            {
+                "tool_name": "apply_patch",
+                "tool_input": {"command": ADD_VIOLATING_FILE_PATCH_COMMAND},
+                "cwd": str(tmp_path),
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert DENY_DECISION_FRAGMENT in completed.stdout
+        assert MAGIC_VALUE_VALIDATOR_NAME in completed.stdout
+
+    def test_apply_patch_deleting_a_file_allows(self, tmp_path: Path) -> None:
+        write_clean_module(tmp_path, "legacy_module.py")
+        completed = run_gate(
+            {
+                "tool_name": "apply_patch",
+                "tool_input": {"command": DELETE_FILE_PATCH_COMMAND},
+                "cwd": str(tmp_path),
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert DENY_DECISION_FRAGMENT not in completed.stdout
+
+    def test_unparseable_apply_patch_command_allows(self, tmp_path: Path) -> None:
+        """A patch this lane cannot read is the enforcer's to deny, not this gate's.
+
+        ``code_rules_enforcer`` denies a payload whose patch markers it cannot
+        parse. Both hooks run on the same call and any denial wins, so this lane
+        allows rather than raising a second denial for one cause. Moving that
+        denial out of the enforcer leaves a malformed patch with no reader.
+        """
+        completed = run_gate(
+            {
+                "tool_name": "apply_patch",
+                "tool_input": {"command": UNPARSEABLE_PATCH_COMMAND},
+                "cwd": str(tmp_path),
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert DENY_DECISION_FRAGMENT not in completed.stdout
+
+    def test_apply_patch_denies_a_violation_in_its_second_file(self, tmp_path: Path) -> None:
+        write_clean_module(tmp_path, "first_module.py")
+        second_file = tmp_path / "second_module.py"
+        second_file.write_text(CLEAN_SECOND_MODULE_SOURCE, encoding="utf-8")
+        completed = run_gate(
+            {
+                "tool_name": "apply_patch",
+                "tool_input": {"command": TWO_FILE_PATCH_COMMAND},
+                "cwd": str(tmp_path),
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert DENY_DECISION_FRAGMENT in completed.stdout
+        assert second_file.name in completed.stdout

package/hooks/validators/test_run_all_validators_pretooluse.py

@@ -19,6 +19,7 @@ from .run_all_validators import (
     ValidatorResult,
     _escapes_temporary_root,
     _hooks_subprocess_working_directory_and_environment,
+    _scope_agnostic_message,
     _scope_new_and_preexisting,
     _temporary_path_preserving_directory_signal,
     _violation_line_number,
@@ -33,6 +34,9 @@ CONFIG_DIR_TARGET_PATH = (
 )
 PARENT_TRAVERSAL_TARGET_PATH = "../../escape_target.py"
 RELATIVE_CONFIG_TARGET_PATH = "config/x.py"
+PROJECT_ROOTED_PYTEST_SCRATCH_TARGET_PATH = (
+    "/srv/projects/demo/test_edit_introducing_new_viol0/legacy_module.py"
+)
 
 CLEAN_PYTHON_SOURCE = (
     "def add_two_numbers(first_number: int, second_number: int) -> int:\n"
@@ -228,6 +232,38 @@ class TestTemporaryPathPreservingDirectorySignal:
         )
         assert staged_path == staging_root / "legacy_module.py"
 
+    def test_pytest_scratch_segment_stages_flat_outside_every_temporary_root(
+        self, tmp_path: Path
+    ) -> None:
+        staging_root = tmp_path / "staging_root"
+        staging_root.mkdir()
+        staged_path = _temporary_path_preserving_directory_signal(
+            staging_root, PROJECT_ROOTED_PYTEST_SCRATCH_TARGET_PATH
+        )
+        assert staged_path == staging_root / "legacy_module.py"
+
+    def test_test_helpers_directory_keeps_its_exemption_under_a_temporary_root(
+        self, tmp_path: Path
+    ) -> None:
+        helpers_target = tmp_path / "pkg" / "test_helpers" / "worker.py"
+        staging_root = tmp_path / "staging_root"
+        staging_root.mkdir()
+        staged_path = _temporary_path_preserving_directory_signal(
+            staging_root, str(helpers_target)
+        )
+        assert staged_path == staging_root / "test_helpers" / "worker.py"
+
+    def test_scripts_directory_keeps_its_exemption_under_a_temporary_root(
+        self, tmp_path: Path
+    ) -> None:
+        scripts_target = tmp_path / "pkg" / "scripts" / "run_job.py"
+        staging_root = tmp_path / "staging_root"
+        staging_root.mkdir()
+        staged_path = _temporary_path_preserving_directory_signal(
+            staging_root, str(scripts_target)
+        )
+        assert staged_path == staging_root / "scripts" / "run_job.py"
+
     def test_relative_config_path_preserves_config_under_system_temp_cwd(
         self, monkeypatch: pytest.MonkeyPatch
     ) -> None:
@@ -430,6 +466,100 @@ class TestBaselineScopedGate:
         assert '"permissionDecision": "deny"' in completed.stdout
         assert "Magic Values" in completed.stdout
 
+    def test_renaming_a_function_keeps_its_violation_grandfathered(
+        self, tmp_path: Path
+    ) -> None:
+        target_file = tmp_path / "legacy_module.py"
+        target_file.write_text(
+            _over_long_function_source("over_long_function"), encoding="utf-8"
+        )
+        completed = run_gate(
+            {
+                "tool_name": "Edit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "old_string": "def over_long_function(",
+                    "new_string": "def accumulate_running_total(",
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert '"permissionDecision": "deny"' not in completed.stdout
+        assert "Code Quality" in completed.stderr
+
+    def test_renaming_a_function_denies_a_second_violation_of_the_same_shape(
+        self, tmp_path: Path
+    ) -> None:
+        target_file = tmp_path / "legacy_module.py"
+        target_file.write_text(
+            _over_long_function_source("over_long_function"), encoding="utf-8"
+        )
+        completed = run_gate(
+            {
+                "tool_name": "Edit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "old_string": "def over_long_function(",
+                    "new_string": (
+                        _over_long_function_source("second_over_long_function")
+                        + "\n\n"
+                        + "def accumulate_running_total("
+                    ),
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert '"permissionDecision": "deny"' in completed.stdout
+        assert "Code Quality" in completed.stdout
+
+    def test_renaming_a_function_denies_a_new_violation_of_another_validator(
+        self, tmp_path: Path
+    ) -> None:
+        target_file = tmp_path / "legacy_module.py"
+        target_file.write_text(
+            _over_long_function_source("over_long_function"), encoding="utf-8"
+        )
+        completed = run_gate(
+            {
+                "tool_name": "Edit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "old_string": "def over_long_function(",
+                    "new_string": "import os\n\n\ndef accumulate_running_total(",
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert '"permissionDecision": "deny"' in completed.stdout
+        assert "F401" in completed.stdout
+
+    def test_moving_a_violation_to_another_function_keeps_it_grandfathered(
+        self, tmp_path: Path
+    ) -> None:
+        target_file = tmp_path / "legacy_module.py"
+        target_file.write_text(RUFF_DIRTY_FUNCTION_SOURCE, encoding="utf-8")
+        completed = run_gate(
+            {
+                "tool_name": "Edit",
+                "tool_input": {
+                    "file_path": str(target_file),
+                    "old_string": RUFF_DIRTY_FUNCTION_SOURCE,
+                    "new_string": (
+                        "def compute_total() -> int:\n"
+                        "    return 1\n"
+                        "\n"
+                        "\n"
+                        "def compute_subtotal() -> int:\n"
+                        "    unused_intermediate = 1\n"
+                        "    return 1\n"
+                    ),
+                },
+            }
+        )
+        assert completed.returncode == 0, completed.stderr
+        assert '"permissionDecision": "deny"' not in completed.stdout
+        assert "F841" in completed.stderr
+
     def test_new_module_scope_ruff_violation_with_dirty_function_denies(
         self, tmp_path: Path
     ) -> None:
@@ -451,6 +581,37 @@ class TestBaselineScopedGate:
         assert "F841" not in completed.stdout
 
 
+class TestScopeAgnosticMessage:
+    def test_masks_the_enclosing_function_name_and_its_metrics(self) -> None:
+        masked_message = _scope_agnostic_message(
+            "over_long_function", "Function 'over_long_function' is 37 lines (max 30)"
+        )
+
+        assert masked_message == "Function '<name>' is <number> lines (max <number>)"
+
+    def test_keeps_the_numbers_of_a_message_that_never_names_its_function(self) -> None:
+        magic_value_message = "Magic number 199 - use named constant"
+
+        masked_message = _scope_agnostic_message("compute_total", magic_value_message)
+
+        assert masked_message == magic_value_message
+
+    def test_keeps_a_module_scope_message_unchanged(self) -> None:
+        ruff_message = "F401 `os` imported but unused"
+
+        masked_message = _scope_agnostic_message("", ruff_message)
+
+        assert masked_message == ruff_message
+
+    def test_masks_only_the_innermost_name_of_a_qualified_scope(self) -> None:
+        masked_message = _scope_agnostic_message(
+            "Ledger.record_entry",
+            "Parameter 'entry' in 'record_entry' missing type annotation",
+        )
+
+        assert masked_message == "Parameter 'entry' in '<name>' missing type annotation"
+
+
 class TestScopeNewAndPreexisting:
     def test_failed_result_without_located_lines_is_treated_as_new(self) -> None:
         summary_only_result = ValidatorResult(