claude-dev-env 2.36.0 → 4.0.0

package/scripts/tests/repository_policy_test_support.py

@@ -0,0 +1,89 @@
+"""Shared fixtures for repository-policy behavior tests."""
+
+from __future__ import annotations
+
+import io
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+UTF8_ENCODING = "utf-8"
+
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+import repository_policy
+
+
+def initialize_repository(repository_root: Path) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    run_git(repository_root, ("init", "--initial-branch=main"))
+
+
+def commit_tracked_files(repository_root: Path) -> None:
+    run_git(repository_root, ("add", "-A"))
+    run_git(repository_root, ("commit", "--quiet", "-m", "seed"))
+
+
+def write_text(file_path: Path, content: str) -> None:
+    file_path.parent.mkdir(parents=True, exist_ok=True)
+    file_path.write_text(content, encoding=UTF8_ENCODING)
+
+
+def patch_unreadable_named_file(
+    monkeypatch: pytest.MonkeyPatch, filename: str, error_text: str
+) -> None:
+    original_read_text = Path.read_text
+
+    def refuse_named_file(
+        file_path: Path,
+        encoding: str | None = None,
+        errors: str | None = None,
+    ) -> str:
+        if file_path.name == filename:
+            raise OSError(error_text)
+        return original_read_text(file_path, encoding=encoding, errors=errors)
+
+    monkeypatch.setattr(Path, "read_text", refuse_named_file)
+
+
+def seed_clean_repository(repository_root: Path) -> Path:
+    initialize_repository(repository_root)
+    write_text(repository_root / "README.md", "clean tree\n")
+    commit_tracked_files(repository_root)
+    return repository_root
+
+
+def run_policy(
+    repository_root: Path, all_arguments: list[str] | None = None
+) -> tuple[int, str, str]:
+    stdout = io.StringIO()
+    stderr = io.StringIO()
+    exit_code = repository_policy.main(
+        all_arguments or [],
+        repository_root=repository_root,
+        stdout=stdout,
+        stderr=stderr,
+    )
+    return exit_code, stdout.getvalue(), stderr.getvalue()
+
+
+def run_git(repository_root: Path, all_arguments: tuple[str, ...]) -> None:
+    subprocess.run(
+        (
+            "git",
+            "-c",
+            "user.email=ci@example.com",
+            "-c",
+            "user.name=CI",
+            "-c",
+            "core.hooksPath=",
+            *all_arguments,
+        ),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )

package/scripts/tests/test_cde_lint.py

@@ -304,7 +304,9 @@ def test_staged_clean_reports_keep_legacy_advisories_outside_renderer(
 
     assert json_exit_code == 0
     assert json_stderr == ""
-    assert json.loads(json_stdout)["diagnostics"] == []
+    json_report = json.loads(json_stdout)
+    assert json_report["diagnostics"] == []
+    assert "terminology-sweep" in json_report["executed_rules"]
     assert text_exit_code == 0
     assert text_stdout == ""
     assert text_stderr == ""
@@ -313,6 +315,28 @@ def test_staged_clean_reports_keep_legacy_advisories_outside_renderer(
     assert editor_stderr == ""
 
 
+def test_staged_git_failure_exits_three_with_valid_json(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _stage_oversized_test_file(tmp_path)
+    adapter_module = sys.modules["policy_lint.adapters"]
+    terminology_module = adapter_module._pr_loop_script_module("terminology_sweep")
+
+    def fail_git(
+        _repository_root: Path, _all_arguments: object
+    ) -> subprocess.CompletedProcess[str]:
+        raise RuntimeError("simulated Git failure")
+
+    monkeypatch.setattr(terminology_module, "_run_strict_git", fail_git)
+    exit_code, stdout_text, stderr_text = _run_staged_format("json", tmp_path)
+    parsed_report = json.loads(stdout_text)
+
+    assert exit_code == 3
+    assert stderr_text == ""
+    assert parsed_report["diagnostics"] == []
+    assert parsed_report["failed_rules"] == ["terminology-sweep"]
+
+
 def test_should_exit_one_when_diagnostics_exist(tmp_path: Path) -> None:
     exit_code, stdout_text, _stderr_text = _run_cli(
         ["--files", "src/app.py"],

package/scripts/tests/test_claude_md.py

@@ -0,0 +1,68 @@
+"""Behavior tests for committed CLAUDE.md references."""
+
+from __future__ import annotations
+
+import sys
+from collections.abc import Iterator
+from pathlib import Path
+
+import pytest
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    CHECK_ID_CLAUDE_MD_ORPHANS,
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+)
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    run_policy,
+    write_text,
+)
+
+
+def test_should_flag_a_broken_claude_md_file_reference(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "notes" / "CLAUDE.md",
+        "# notes\n\n"
+        "| File | Role |\n"
+        "|---|---|\n"
+        "| `absent_helper.py` | Missing helper |\n",
+    )
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_CLAUDE_MD_ORPHANS in stdout_text
+    assert "notes/CLAUDE.md" in stdout_text
+    assert "absent_helper.py" in stdout_text
+
+
+def test_should_fail_closed_when_claude_md_walk_fails_after_first_entry(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "notes" / "CLAUDE.md",
+        "# notes\n\n"
+        "| File | Role |\n"
+        "|---|---|\n"
+        "| `absent_helper.py` | Missing helper |\n",
+    )
+    commit_tracked_files(repository_root)
+
+    def fail_after_first_entry(_file_path: Path, _pattern: str = "*") -> Iterator[Path]:
+        yield repository_root / "notes" / "CLAUDE.md"
+        raise OSError("scan root unreadable")
+
+    monkeypatch.setattr(Path, "rglob", fail_after_first_entry)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_CLAUDE_MD_ORPHANS in stdout_text
+    assert "error: rule failed:" in stdout_text

package/scripts/tests/test_env_var_documentation.py

@@ -0,0 +1,133 @@
+"""Behavior tests for environment-variable documentation checks."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    CHECK_ID_ENV_VAR_DOCUMENTATION,
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+    SUCCESS_EXIT_CODE,
+)
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    patch_unreadable_named_file,
+    run_policy,
+    write_text,
+)
+
+
+def test_should_flag_environment_variable_documentation_drift(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "auth" / "google_auth.py", "def load() -> None:\n    return\n"
+    )
+    write_text(
+        repository_root / "docs" / "configuration.md",
+        "## Summary: Environment Variables\n\n"
+        "| Variable | Used By | Purpose |\n"
+        "|----------|---------|---------|\n"
+        "| `GOOGLE_APPLICATION_CREDENTIALS` | `auth/google_auth.py` | Path to JSON |\n",
+    )
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_ENV_VAR_DOCUMENTATION in stdout_text
+    assert "docs/configuration.md" in stdout_text
+    assert "GOOGLE_APPLICATION_CREDENTIALS -> auth/google_auth.py" in stdout_text
+
+
+def test_should_ignore_long_code_reference_inside_code_fence(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    long_code_reference = ("x" * 300) + ".py"
+    write_text(
+        repository_root / "docs" / "review.md",
+        f"# Review\n\n~~~diff\n+ `{long_code_reference}`\n~~~\n",
+    )
+    commit_tracked_files(repository_root)
+    original_is_file = Path.is_file
+
+    def reject_long_filename(candidate_path: Path) -> bool:
+        if len(candidate_path.name) > 255:
+            raise OSError(candidate_path)
+        return original_is_file(candidate_path)
+
+    monkeypatch.setattr(Path, "is_file", reject_long_filename)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == SUCCESS_EXIT_CODE
+    assert CHECK_ID_ENV_VAR_DOCUMENTATION not in stdout_text
+
+
+def test_should_fail_closed_when_an_env_var_code_file_cannot_be_read(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "packages" / "service" / "auth" / "google_auth.py",
+        "def load() -> None:\n    return\n",
+    )
+    write_text(
+        repository_root / "docs" / "configuration.md",
+        "## Summary: Environment Variables\n\n"
+        "| Variable | Used By | Purpose |\n"
+        "|----------|---------|---------|\n"
+        "| `GOOGLE_APPLICATION_CREDENTIALS` | `auth/google_auth.py` | Path to JSON |\n",
+    )
+    commit_tracked_files(repository_root)
+    patch_unreadable_named_file(monkeypatch, "google_auth.py", "code file unreadable")
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_ENV_VAR_DOCUMENTATION in stdout_text
+    assert "error: rule failed:" in stdout_text
+
+
+def test_should_fail_closed_before_reading_env_var_code_file_outside_repository(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    outside_path = tmp_path / "outside.py"
+    write_text(outside_path, "def load() -> None:\n    return\n")
+    write_text(
+        repository_root / "docs" / "configuration.md",
+        "## Summary: Environment Variables\n\n"
+        "| Variable | Used By | Purpose |\n"
+        "|----------|---------|---------|\n"
+        "| `EXTERNAL_TOKEN` | `../outside.py` | External consumer |\n",
+    )
+    commit_tracked_files(repository_root)
+    all_read_paths = record_read_paths(monkeypatch)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_ENV_VAR_DOCUMENTATION in stdout_text
+    assert outside_path not in all_read_paths
+
+
+def record_read_paths(monkeypatch: pytest.MonkeyPatch) -> list[Path]:
+    original_read_text = Path.read_text
+    all_read_paths: list[Path] = []
+
+    def record_read_path(
+        file_path: Path,
+        encoding: str | None = None,
+        errors: str | None = None,
+    ) -> str:
+        all_read_paths.append(file_path.resolve())
+        return original_read_text(file_path, encoding=encoding, errors=errors)
+
+    monkeypatch.setattr(Path, "read_text", record_read_path)
+    return all_read_paths

package/scripts/tests/test_hook_modules.py

@@ -0,0 +1,17 @@
+"""Behavior tests for repository-check hook module loading."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+from repository_checks.hook_modules import load_hooks_module
+
+
+def test_should_load_a_hooks_module_by_its_dotted_name() -> None:
+    loaded_module = load_hooks_module("hooks_constants.pii_prevention_constants")
+    assert loaded_module.__name__ == "hooks_constants.pii_prevention_constants"

package/scripts/tests/test_models.py

@@ -0,0 +1,26 @@
+"""Behavior tests for repository-check report models."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+    SUCCESS_EXIT_CODE,
+)
+from repository_checks.models import RepositoryCheckReport, RepositoryFinding
+
+
+def test_should_choose_exit_code_by_report_severity() -> None:
+    finding = RepositoryFinding("check", "file.py", "message")
+    assert RepositoryCheckReport((), ()).exit_code == SUCCESS_EXIT_CODE
+    assert RepositoryCheckReport((finding,), ()).exit_code == FINDINGS_EXIT_CODE
+    assert RepositoryCheckReport((finding,), ("check",)).exit_code == (
+        FAILED_CHECK_EXIT_CODE
+    )

package/scripts/tests/test_package_inventory.py

@@ -0,0 +1,96 @@
+"""Behavior tests for committed package inventories."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    CHECK_ID_PACKAGE_INVENTORY,
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+)
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    patch_unreadable_named_file,
+    run_policy,
+    write_text,
+)
+
+_SKILL_INVENTORY_MARKDOWN = (
+    "# Skill\n\n"
+    "| File | Role |\n"
+    "|---|---|\n"
+    "| `listed_alpha.py` | Alpha helper |\n"
+    "| `listed_beta.py` | Beta helper |\n"
+)
+
+
+def test_should_flag_a_stale_package_inventory(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    package_directory = repository_root / "pipeline"
+    _write_package_inventory(package_directory)
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_PACKAGE_INVENTORY in stdout_text
+    assert "pipeline/check_dialer_seam_cli.py" in stdout_text
+
+
+def test_should_check_active_skills_and_exclude_archived_skills(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _seed_skill_package(repository_root / ".agents" / "skills" / "live-skill")
+    _seed_skill_package(repository_root / ".agents" / "skills-archived" / "old-skill")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_PACKAGE_INVENTORY in stdout_text
+    assert ".agents/skills/live-skill/scripts/unlisted_gamma.py" in stdout_text
+    assert (
+        ".agents/skills-archived/old-skill/scripts/unlisted_gamma.py" not in stdout_text
+    )
+
+
+def test_should_fail_closed_when_a_package_inventory_document_cannot_be_read(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_package_inventory(repository_root / "pipeline")
+    commit_tracked_files(repository_root)
+    patch_unreadable_named_file(monkeypatch, "README.md", "inventory unreadable")
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_PACKAGE_INVENTORY in stdout_text
+    assert "error: rule failed:" in stdout_text
+
+
+def _write_package_inventory(package_directory: Path) -> None:
+    write_text(
+        package_directory / "README.md",
+        "# Pipeline\n\n"
+        "| Path | Role |\n"
+        "|---|---|\n"
+        "| `dialer_compose.py` | Composes a dialer strip. |\n"
+        "| `compose_dialer_cli.py` | CLI for the dialer strip. |\n",
+    )
+    write_text(package_directory / "dialer_compose.py", "x = 1\n")
+    write_text(package_directory / "compose_dialer_cli.py", "x = 1\n")
+    write_text(package_directory / "check_dialer_seam_cli.py", "x = 1\n")
+
+
+def _seed_skill_package(skill_root: Path) -> None:
+    write_text(skill_root / "SKILL.md", _SKILL_INVENTORY_MARKDOWN)
+    scripts_directory = skill_root / "scripts"
+    write_text(scripts_directory / "listed_alpha.py", "x = 1\n")
+    write_text(scripts_directory / "listed_beta.py", "x = 1\n")
+    write_text(scripts_directory / "unlisted_gamma.py", "x = 1\n")

package/scripts/tests/test_policy_lint_rules_registry.py

@@ -11,6 +11,7 @@ import pytest
 from policy_lint import adapters, registry
 from policy_lint.engine import lint
 from policy_lint.model import (
+    ChangeSetRule,
     Document,
     DocumentRule,
     DocumentSet,
@@ -41,6 +42,60 @@ def _ensure_git_repository(repository_root: Path) -> None:
     )
 
 
+def _commit_repository(repository_root: Path, message: str) -> None:
+    subprocess.run(
+        ("git", "config", "user.email", "test@example.com"),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+    subprocess.run(
+        ("git", "config", "user.name", "Test"),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+    subprocess.run(
+        ("git", "add", "-A"), cwd=repository_root, check=True, capture_output=True
+    )
+    subprocess.run(
+        ("git", "commit", "-m", message),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+
+
+def _stage_terminology_change(
+    repository_root: Path,
+    base_source: str,
+    current_source: str,
+    documentation_text: str,
+) -> None:
+    _ensure_git_repository(repository_root)
+    source_path = repository_root / "src" / "quota.py"
+    source_path.parent.mkdir()
+    source_path.write_text(base_source, encoding="utf-8")
+    _commit_repository(repository_root, "base")
+    source_path.write_text(current_source, encoding="utf-8")
+    documentation_path = repository_root / "docs" / "README.md"
+    documentation_path.parent.mkdir()
+    documentation_path.write_text(documentation_text, encoding="utf-8")
+    subprocess.run(
+        ("git", "add", "-A"), cwd=repository_root, check=True, capture_output=True
+    )
+
+
+def _terminology_rule() -> ChangeSetRule:
+    terminology_rule = next(
+        each_rule
+        for each_rule in registry.default_registry()
+        if each_rule.rule_id == "terminology-sweep"
+    )
+    assert isinstance(terminology_rule, ChangeSetRule)
+    return terminology_rule
+
+
 def test_hook_format_accepts_claude_settings() -> None:
     settings_document = Document.from_text(".claude/settings.json", "{}")
     hooks_document = Document.from_text("hooks/hooks.json", "{}")
@@ -233,6 +288,68 @@ def test_registry_registers_unique_python_validator_rule() -> None:
     assert not validator_rule.accepts(Document.from_text("module.ts", _FUNCTION_SOURCE))
 
 
+def test_registry_registers_terminology_change_set_rule() -> None:
+    terminology_rule = _terminology_rule()
+    assert terminology_rule.rule_sets == _CHANGED_RULE_SETS
+    assert terminology_rule.selections == frozenset({SelectionKind.STAGED})
+
+
+def test_registry_runs_test_pairing_for_staged_and_base_changes() -> None:
+    test_pairing_rule = next(
+        each_rule
+        for each_rule in registry.default_registry()
+        if each_rule.rule_id == "test-pairing"
+    )
+    assert isinstance(test_pairing_rule, ChangeSetRule)
+    assert test_pairing_rule.selections == frozenset(
+        {SelectionKind.STAGED, SelectionKind.BASE}
+    )
+
+
+def test_terminology_rule_reports_cross_surface_path_and_line(
+    tmp_path: Path,
+) -> None:
+    _stage_terminology_change(
+        tmp_path,
+        "baseline = 1\n",
+        "premium_request_interactions = 5\n",
+        "Quota fields use one name.\n"
+        "The premium-request-budget field gates the run.\n",
+    )
+    lint_report = lint(LintRequest.staged(tmp_path), all_registry=(_terminology_rule(),))
+
+    assert len(lint_report.diagnostics) == 1
+    diagnostic = lint_report.diagnostics[0]
+    assert diagnostic.rule_id == "terminology-sweep"
+    assert diagnostic.location is not None
+    assert diagnostic.location.path == PurePosixPath("docs/README.md")
+    assert diagnostic.location.start_line == 2
+
+
+def test_terminology_rule_suppresses_identifier_present_in_prior_tree(
+    tmp_path: Path,
+) -> None:
+    _stage_terminology_change(
+        tmp_path,
+        "premium_request_interactions = 5\n",
+        "premium_request_interactions = 5\n"
+        "premium_request_interactions = 6\n",
+        "The premium-request-budget field gates the run.\n",
+    )
+    lint_report = lint(LintRequest.staged(tmp_path), all_registry=(_terminology_rule(),))
+
+    assert lint_report.diagnostics == ()
+
+
+def test_terminology_rule_skips_file_selection(tmp_path: Path) -> None:
+    document_set = DocumentSet(
+        (Document.from_text("docs/README.md", "text\n"),),
+        SelectionKind.FILES,
+        tmp_path,
+    )
+    assert adapters.terminology_diagnostics(document_set) == ()
+
+
 def test_lint_keeps_skipped_rules_out_of_executed_rules(tmp_path: Path) -> None:
     skipped_rule = DocumentRule(
         "skipped",

package/scripts/tests/test_pytest_testpaths.py

@@ -0,0 +1,66 @@
+"""Behavior tests for committed pytest testpaths."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    CHECK_ID_PYTEST_TESTPATHS,
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+)
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    patch_unreadable_named_file,
+    run_policy,
+    write_text,
+)
+
+
+def test_should_flag_a_pytest_testpath_discovery_miss(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    package_root = repository_root / "shared_utils"
+    _write_pytest_configuration(package_root)
+    write_text(
+        package_root / "theme_assets" / "tests" / "test_palette.py",
+        "def test_palette() -> None:\n    assert True\n",
+    )
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_PYTEST_TESTPATHS in stdout_text
+    assert "shared_utils/theme_assets/tests/test_palette.py" in stdout_text
+
+
+def test_should_fail_closed_when_pytest_config_cannot_be_read(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_pytest_configuration(repository_root / "shared_utils")
+    commit_tracked_files(repository_root)
+    patch_unreadable_named_file(monkeypatch, "pyproject.toml", "pyproject unreadable")
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_PYTEST_TESTPATHS in stdout_text
+    assert "error: rule failed:" in stdout_text
+
+
+def _write_pytest_configuration(package_root: Path) -> None:
+    write_text(
+        package_root / "pyproject.toml",
+        '[tool.pytest.ini_options]\ntestpaths = ["tests"]\n',
+    )
+    write_text(
+        package_root / "tests" / "test_root_behavior.py",
+        "def test_ok() -> None:\n    assert True\n",
+    )