claude-dev-env 2.36.0 → 4.1.0

package/scripts/tests/test_package_inventory.py

@@ -0,0 +1,96 @@
+"""Behavior tests for committed package inventories."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    CHECK_ID_PACKAGE_INVENTORY,
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+)
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    patch_unreadable_named_file,
+    run_policy,
+    write_text,
+)
+
+_SKILL_INVENTORY_MARKDOWN = (
+    "# Skill\n\n"
+    "| File | Role |\n"
+    "|---|---|\n"
+    "| `listed_alpha.py` | Alpha helper |\n"
+    "| `listed_beta.py` | Beta helper |\n"
+)
+
+
+def test_should_flag_a_stale_package_inventory(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    package_directory = repository_root / "pipeline"
+    _write_package_inventory(package_directory)
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_PACKAGE_INVENTORY in stdout_text
+    assert "pipeline/check_dialer_seam_cli.py" in stdout_text
+
+
+def test_should_check_active_skills_and_exclude_archived_skills(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _seed_skill_package(repository_root / ".agents" / "skills" / "live-skill")
+    _seed_skill_package(repository_root / ".agents" / "skills-archived" / "old-skill")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_PACKAGE_INVENTORY in stdout_text
+    assert ".agents/skills/live-skill/scripts/unlisted_gamma.py" in stdout_text
+    assert (
+        ".agents/skills-archived/old-skill/scripts/unlisted_gamma.py" not in stdout_text
+    )
+
+
+def test_should_fail_closed_when_a_package_inventory_document_cannot_be_read(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_package_inventory(repository_root / "pipeline")
+    commit_tracked_files(repository_root)
+    patch_unreadable_named_file(monkeypatch, "README.md", "inventory unreadable")
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_PACKAGE_INVENTORY in stdout_text
+    assert "error: rule failed:" in stdout_text
+
+
+def _write_package_inventory(package_directory: Path) -> None:
+    write_text(
+        package_directory / "README.md",
+        "# Pipeline\n\n"
+        "| Path | Role |\n"
+        "|---|---|\n"
+        "| `dialer_compose.py` | Composes a dialer strip. |\n"
+        "| `compose_dialer_cli.py` | CLI for the dialer strip. |\n",
+    )
+    write_text(package_directory / "dialer_compose.py", "x = 1\n")
+    write_text(package_directory / "compose_dialer_cli.py", "x = 1\n")
+    write_text(package_directory / "check_dialer_seam_cli.py", "x = 1\n")
+
+
+def _seed_skill_package(skill_root: Path) -> None:
+    write_text(skill_root / "SKILL.md", _SKILL_INVENTORY_MARKDOWN)
+    scripts_directory = skill_root / "scripts"
+    write_text(scripts_directory / "listed_alpha.py", "x = 1\n")
+    write_text(scripts_directory / "listed_beta.py", "x = 1\n")
+    write_text(scripts_directory / "unlisted_gamma.py", "x = 1\n")

package/scripts/tests/test_policy_lint_rules_registry.py

@@ -11,6 +11,7 @@ import pytest
 from policy_lint import adapters, registry
 from policy_lint.engine import lint
 from policy_lint.model import (
+    ChangeSetRule,
     Document,
     DocumentRule,
     DocumentSet,
@@ -41,6 +42,60 @@ def _ensure_git_repository(repository_root: Path) -> None:
     )
 
 
+def _commit_repository(repository_root: Path, message: str) -> None:
+    subprocess.run(
+        ("git", "config", "user.email", "test@example.com"),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+    subprocess.run(
+        ("git", "config", "user.name", "Test"),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+    subprocess.run(
+        ("git", "add", "-A"), cwd=repository_root, check=True, capture_output=True
+    )
+    subprocess.run(
+        ("git", "commit", "-m", message),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+
+
+def _stage_terminology_change(
+    repository_root: Path,
+    base_source: str,
+    current_source: str,
+    documentation_text: str,
+) -> None:
+    _ensure_git_repository(repository_root)
+    source_path = repository_root / "src" / "quota.py"
+    source_path.parent.mkdir()
+    source_path.write_text(base_source, encoding="utf-8")
+    _commit_repository(repository_root, "base")
+    source_path.write_text(current_source, encoding="utf-8")
+    documentation_path = repository_root / "docs" / "README.md"
+    documentation_path.parent.mkdir()
+    documentation_path.write_text(documentation_text, encoding="utf-8")
+    subprocess.run(
+        ("git", "add", "-A"), cwd=repository_root, check=True, capture_output=True
+    )
+
+
+def _terminology_rule() -> ChangeSetRule:
+    terminology_rule = next(
+        each_rule
+        for each_rule in registry.default_registry()
+        if each_rule.rule_id == "terminology-sweep"
+    )
+    assert isinstance(terminology_rule, ChangeSetRule)
+    return terminology_rule
+
+
 def test_hook_format_accepts_claude_settings() -> None:
     settings_document = Document.from_text(".claude/settings.json", "{}")
     hooks_document = Document.from_text("hooks/hooks.json", "{}")
@@ -233,6 +288,68 @@ def test_registry_registers_unique_python_validator_rule() -> None:
     assert not validator_rule.accepts(Document.from_text("module.ts", _FUNCTION_SOURCE))
 
 
+def test_registry_registers_terminology_change_set_rule() -> None:
+    terminology_rule = _terminology_rule()
+    assert terminology_rule.rule_sets == _CHANGED_RULE_SETS
+    assert terminology_rule.selections == frozenset({SelectionKind.STAGED})
+
+
+def test_registry_runs_test_pairing_for_staged_and_base_changes() -> None:
+    test_pairing_rule = next(
+        each_rule
+        for each_rule in registry.default_registry()
+        if each_rule.rule_id == "test-pairing"
+    )
+    assert isinstance(test_pairing_rule, ChangeSetRule)
+    assert test_pairing_rule.selections == frozenset(
+        {SelectionKind.STAGED, SelectionKind.BASE}
+    )
+
+
+def test_terminology_rule_reports_cross_surface_path_and_line(
+    tmp_path: Path,
+) -> None:
+    _stage_terminology_change(
+        tmp_path,
+        "baseline = 1\n",
+        "premium_request_interactions = 5\n",
+        "Quota fields use one name.\n"
+        "The premium-request-budget field gates the run.\n",
+    )
+    lint_report = lint(LintRequest.staged(tmp_path), all_registry=(_terminology_rule(),))
+
+    assert len(lint_report.diagnostics) == 1
+    diagnostic = lint_report.diagnostics[0]
+    assert diagnostic.rule_id == "terminology-sweep"
+    assert diagnostic.location is not None
+    assert diagnostic.location.path == PurePosixPath("docs/README.md")
+    assert diagnostic.location.start_line == 2
+
+
+def test_terminology_rule_suppresses_identifier_present_in_prior_tree(
+    tmp_path: Path,
+) -> None:
+    _stage_terminology_change(
+        tmp_path,
+        "premium_request_interactions = 5\n",
+        "premium_request_interactions = 5\n"
+        "premium_request_interactions = 6\n",
+        "The premium-request-budget field gates the run.\n",
+    )
+    lint_report = lint(LintRequest.staged(tmp_path), all_registry=(_terminology_rule(),))
+
+    assert lint_report.diagnostics == ()
+
+
+def test_terminology_rule_skips_file_selection(tmp_path: Path) -> None:
+    document_set = DocumentSet(
+        (Document.from_text("docs/README.md", "text\n"),),
+        SelectionKind.FILES,
+        tmp_path,
+    )
+    assert adapters.terminology_diagnostics(document_set) == ()
+
+
 def test_lint_keeps_skipped_rules_out_of_executed_rules(tmp_path: Path) -> None:
     skipped_rule = DocumentRule(
         "skipped",

package/scripts/tests/test_pytest_testpaths.py

@@ -0,0 +1,66 @@
+"""Behavior tests for committed pytest testpaths."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    CHECK_ID_PYTEST_TESTPATHS,
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+)
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    patch_unreadable_named_file,
+    run_policy,
+    write_text,
+)
+
+
+def test_should_flag_a_pytest_testpath_discovery_miss(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    package_root = repository_root / "shared_utils"
+    _write_pytest_configuration(package_root)
+    write_text(
+        package_root / "theme_assets" / "tests" / "test_palette.py",
+        "def test_palette() -> None:\n    assert True\n",
+    )
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_PYTEST_TESTPATHS in stdout_text
+    assert "shared_utils/theme_assets/tests/test_palette.py" in stdout_text
+
+
+def test_should_fail_closed_when_pytest_config_cannot_be_read(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_pytest_configuration(repository_root / "shared_utils")
+    commit_tracked_files(repository_root)
+    patch_unreadable_named_file(monkeypatch, "pyproject.toml", "pyproject unreadable")
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert CHECK_ID_PYTEST_TESTPATHS in stdout_text
+    assert "error: rule failed:" in stdout_text
+
+
+def _write_pytest_configuration(package_root: Path) -> None:
+    write_text(
+        package_root / "pyproject.toml",
+        '[tool.pytest.ini_options]\ntestpaths = ["tests"]\n',
+    )
+    write_text(
+        package_root / "tests" / "test_root_behavior.py",
+        "def test_ok() -> None:\n    assert True\n",
+    )

package/scripts/tests/test_reporting.py

@@ -0,0 +1,54 @@
+"""Behavior tests for repository-check report rendering."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.models import RepositoryCheckReport, RepositoryFinding
+from repository_checks.reporting import render_report
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    run_policy,
+    write_text,
+)
+
+
+def test_should_render_findings_and_failed_checks_in_report_order() -> None:
+    report = RepositoryCheckReport(
+        (RepositoryFinding("check", "relative/file.py", "message"),),
+        ("failed-check",),
+    )
+    assert render_report(report) == (
+        "check: relative/file.py: message\nerror: rule failed: failed-check\n"
+    )
+
+
+def test_should_render_an_empty_clean_report() -> None:
+    assert render_report(RepositoryCheckReport((), ())) == ""
+
+
+def test_should_print_repository_relative_paths_only(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "notes" / "CLAUDE.md",
+        "# notes\n\n"
+        "| File | Role |\n"
+        "|---|---|\n"
+        "| `absent_helper.py` | Missing helper |\n",
+    )
+    commit_tracked_files(repository_root)
+    _exit_code, stdout_text, stderr_text = run_policy(repository_root)
+    absolute_root_text = str(repository_root.resolve())
+    assert absolute_root_text not in stdout_text
+    assert absolute_root_text not in stderr_text
+    assert "notes/CLAUDE.md" in stdout_text

package/scripts/tests/test_repository_policy.py

@@ -0,0 +1,71 @@
+"""Command behavior for the committed-tree repository checker."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+import repository_policy
+from repository_checks.config.constants import (
+    CHECK_ID_CLAUDE_MD_ORPHANS,
+    CHECK_ID_ENV_VAR_DOCUMENTATION,
+    CHECK_ID_PACKAGE_INVENTORY,
+    CHECK_ID_PYTEST_TESTPATHS,
+    CHECK_ID_TRACKED_PERSONAL_DATA,
+)
+from repository_policy_test_support import run_policy, seed_clean_repository
+
+_POLICY_SCRIPT_PATH = _SCRIPTS_DIRECTORY / "repository_policy.py"
+_CHECK_SCRIPT_PATH = _SCRIPTS_DIRECTORY / "check.ps1"
+_UTF8_ENCODING = "utf-8"
+
+
+def test_should_exit_zero_on_a_clean_tracked_tree(tmp_path: Path) -> None:
+    repository_root = seed_clean_repository(tmp_path / "repo")
+    exit_code, stdout_text, stderr_text = run_policy(repository_root)
+    assert exit_code == 0
+    assert stdout_text == ""
+    assert stderr_text == ""
+
+
+def test_should_keep_stable_check_identifiers() -> None:
+    assert repository_policy.ALL_CHECK_IDS == (
+        CHECK_ID_CLAUDE_MD_ORPHANS,
+        CHECK_ID_ENV_VAR_DOCUMENTATION,
+        CHECK_ID_PACKAGE_INVENTORY,
+        CHECK_ID_PYTEST_TESTPATHS,
+        CHECK_ID_TRACKED_PERSONAL_DATA,
+    )
+
+
+def test_should_invoke_the_checker_from_check_script() -> None:
+    script_text = _CHECK_SCRIPT_PATH.read_text(encoding=_UTF8_ENCODING)
+    assert "Invoke-Tool -Label 'repository-policy'" in script_text
+    assert "repository_policy.py" in script_text
+    assert "--repository-root" in script_text
+    assert "SkipRepositoryPolicy" in script_text
+
+
+def test_should_run_the_checker_as_a_subprocess(tmp_path: Path) -> None:
+    repository_root = seed_clean_repository(tmp_path / "repo")
+    completed = subprocess.run(
+        [
+            sys.executable,
+            str(_POLICY_SCRIPT_PATH),
+            "--repository-root",
+            str(repository_root),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed.returncode == 0
+    assert completed.stdout == ""

package/scripts/tests/test_runner.py

@@ -0,0 +1,59 @@
+"""Behavior tests for repository-check orchestration."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.config.constants import (
+    FAILED_CHECK_EXIT_CODE,
+    FINDINGS_EXIT_CODE,
+)
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    run_policy,
+    seed_clean_repository,
+    write_text,
+)
+
+
+def test_should_fail_closed_when_tracked_paths_cannot_be_read(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = seed_clean_repository(tmp_path / "repo")
+
+    def fail_tracked_paths(_repository_root: Path) -> tuple[str, ...]:
+        raise OSError("git ls-files failed")
+
+    monkeypatch.setattr(
+        "repository_checks.tracked_tree.tracked_relative_paths", fail_tracked_paths
+    )
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert "error: rule failed:" in stdout_text
+
+
+def test_should_emit_stable_sorted_findings(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "zeta" / "CLAUDE.md",
+        "# zeta\n\n| File | Role |\n|---|---|\n| `missing_zeta.py` | Missing |\n",
+    )
+    write_text(
+        repository_root / "alpha" / "CLAUDE.md",
+        "# alpha\n\n| File | Role |\n|---|---|\n| `missing_alpha.py` | Missing |\n",
+    )
+    commit_tracked_files(repository_root)
+    first_exit_code, first_stdout, _first_stderr = run_policy(repository_root)
+    _second_exit_code, second_stdout, _second_stderr = run_policy(repository_root)
+    assert first_exit_code == FINDINGS_EXIT_CODE
+    assert first_stdout == second_stdout
+    assert first_stdout.index("alpha/CLAUDE.md") < first_stdout.index("zeta/CLAUDE.md")

package/scripts/tests/test_tracked_secrets.py

@@ -0,0 +1,175 @@
+"""Behavior tests for tracked-secret checks."""
+
+from __future__ import annotations
+
+import hashlib
+import sys
+from pathlib import Path
+
+import pytest
+from repository_checks.config.constants import (
+    ALL_TRACKED_SECRET_EXACT_EXEMPTIONS,
+    CHECK_ID_TRACKED_PERSONAL_DATA,
+    FINDINGS_EXIT_CODE,
+)
+from repository_checks.hook_modules import load_hooks_module
+from repository_checks.tracked_secrets import collect_tracked_secret_findings
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    run_policy,
+    write_text,
+)
+
+_SYNTHETIC_GITHUB_TOKEN = "ghp_" + ("A" * 36)
+_UTF8_ENCODING = "utf-8"
+_REPOSITORY_ROOT = Path(__file__).resolve().parents[4]
+_EXEMPT_FIXTURE_EMAIL = "fixture-owner@company.io"
+_OTHER_FIXTURE_EMAIL = "other-owner@company.io"
+_OTHER_FIXTURE_HOME_PATH = "C:/Users/realname/notes.txt"
+_FIXTURE_NOTES_RELATIVE_PATH = "src/notes.py"
+_OTHER_NOTES_RELATIVE_PATH = "src/other_notes.py"
+_PII_PREVENTION_CONSTANTS = load_hooks_module(
+    "hooks_constants.pii_prevention_constants"
+)
+_PII_CATEGORY_EMAIL = _PII_PREVENTION_CONSTANTS.CATEGORY_EMAIL
+_PII_CATEGORY_HOME_PATH = _PII_PREVENTION_CONSTANTS.CATEGORY_HOME_PATH
+
+
+def test_should_flag_a_tracked_secret(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / "src" / "app.py", f"token = '{_SYNTHETIC_GITHUB_TOKEN}'\n"
+    )
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert CHECK_ID_TRACKED_PERSONAL_DATA in stdout_text
+    assert "src/app.py" in stdout_text
+    assert _SYNTHETIC_GITHUB_TOKEN not in stdout_text
+
+
+def test_should_fail_closed_before_reading_a_tracked_symlink_outside_repository(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    outside_path = tmp_path / "outside.py"
+    write_text(outside_path, f"token = '{_SYNTHETIC_GITHUB_TOKEN}'\n")
+    tracked_symlink = repository_root / "linked.py"
+    tracked_symlink.symlink_to(outside_path)
+    original_read_text = Path.read_text
+    all_read_paths: list[Path] = []
+
+    def record_read_path(
+        file_path: Path,
+        encoding: str | None = None,
+        errors: str | None = None,
+    ) -> str:
+        all_read_paths.append(file_path)
+        return original_read_text(file_path, encoding=encoding, errors=errors)
+
+    monkeypatch.setattr(Path, "read_text", record_read_path)
+    with pytest.raises(OSError):
+        collect_tracked_secret_findings(repository_root, ["linked.py"])
+    assert tracked_symlink not in all_read_paths
+
+
+def test_should_flag_a_different_email_in_the_same_exact_exempted_file(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_exact_exemption_fixture(repository_root)
+    commit_tracked_files(repository_root)
+    _install_exact_email_exemption(monkeypatch)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert _pii_categories_for_path(stdout_text, _FIXTURE_NOTES_RELATIVE_PATH) == [
+        _PII_CATEGORY_EMAIL,
+        _PII_CATEGORY_HOME_PATH,
+        _PII_PREVENTION_CONSTANTS.CATEGORY_SECRET,
+    ]
+    assert _EXEMPT_FIXTURE_EMAIL not in stdout_text
+    assert _SYNTHETIC_GITHUB_TOKEN not in stdout_text
+
+
+def test_should_flag_an_exact_exempt_value_at_a_different_path(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_exact_exemption_fixture(repository_root)
+    commit_tracked_files(repository_root)
+    _install_exact_email_exemption(monkeypatch)
+    _exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert _PII_CATEGORY_EMAIL in _pii_categories_for_path(
+        stdout_text, _OTHER_NOTES_RELATIVE_PATH
+    )
+
+
+def test_should_store_tracked_secret_exemptions_as_digests() -> None:
+    sha256_hex_digest_length = hashlib.sha256(b"").digest_size * 2
+    assert ALL_TRACKED_SECRET_EXACT_EXEMPTIONS
+    for _relative_path, _category, each_digest in ALL_TRACKED_SECRET_EXACT_EXEMPTIONS:
+        assert len(each_digest) == sha256_hex_digest_length
+        bytes.fromhex(each_digest)
+
+
+def test_should_keep_owned_checker_modules_free_of_tracked_secret_findings() -> None:
+    checker_directory = (
+        _REPOSITORY_ROOT
+        / "packages"
+        / "claude-dev-env"
+        / "scripts"
+        / "repository_checks"
+    )
+    all_relative_paths = [
+        each_path.relative_to(_REPOSITORY_ROOT).as_posix()
+        for each_path in checker_directory.rglob("*.py")
+        if each_path.is_file()
+    ]
+    assert collect_tracked_secret_findings(_REPOSITORY_ROOT, all_relative_paths) == []
+
+
+def _write_exact_exemption_fixture(repository_root: Path) -> None:
+    write_text(
+        repository_root / _FIXTURE_NOTES_RELATIVE_PATH,
+        f"contact = '{_EXEMPT_FIXTURE_EMAIL}'\nalt = '{_OTHER_FIXTURE_EMAIL}'\nhome = '{_OTHER_FIXTURE_HOME_PATH}'\ntoken = '{_SYNTHETIC_GITHUB_TOKEN}'\n",
+    )
+    write_text(
+        repository_root / _OTHER_NOTES_RELATIVE_PATH,
+        f"contact = '{_EXEMPT_FIXTURE_EMAIL}'\n",
+    )
+
+
+def _pii_categories_for_path(stdout_text: str, relative_path: str) -> list[str]:
+    finding_prefix = f"{CHECK_ID_TRACKED_PERSONAL_DATA}: {relative_path}:"
+    return sorted(
+        each_line.split("[", 1)[1].split("]", 1)[0]
+        for each_line in stdout_text.splitlines()
+        if each_line.startswith(finding_prefix)
+    )
+
+
+def _install_exact_email_exemption(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        "repository_checks.tracked_secrets.repository_constants.ALL_TRACKED_SECRET_EXACT_EXEMPTIONS",
+        frozenset(
+            {
+                (
+                    _FIXTURE_NOTES_RELATIVE_PATH,
+                    _PII_CATEGORY_EMAIL,
+                    hashlib.sha256(
+                        _EXEMPT_FIXTURE_EMAIL.encode(_UTF8_ENCODING)
+                    ).hexdigest(),
+                )
+            }
+        ),
+    )

package/scripts/tests/test_tracked_tree.py

@@ -0,0 +1,28 @@
+"""Behavior tests for tracked repository path discovery."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_checks.tracked_tree import tracked_relative_paths
+from repository_policy_test_support import run_policy, seed_clean_repository, write_text
+
+
+def test_should_list_only_committed_relative_paths(tmp_path: Path) -> None:
+    repository_root = seed_clean_repository(tmp_path / "repo")
+    write_text(repository_root / "untracked.txt", "not committed\n")
+    assert tracked_relative_paths(repository_root) == ("README.md",)
+
+
+def test_should_skip_a_tracked_path_absent_from_the_worktree(tmp_path: Path) -> None:
+    repository_root = seed_clean_repository(tmp_path / "repo")
+    (repository_root / "README.md").unlink()
+    exit_code, stdout_text, stderr_text = run_policy(repository_root)
+    assert exit_code == 0
+    assert stdout_text == ""
+    assert stderr_text == ""