claude-dev-env 2.4.0 → 2.7.0

package/hooks/blocking/config/test_code_review_enforcement_constants.py

@@ -9,6 +9,8 @@ import importlib.util
 import pathlib
 import re
 
+import pytest
+
 _CONFIG_DIR = pathlib.Path(__file__).parent
 
 SAMPLE_ROOT_KEY_HEX_LENGTH = 16
@@ -23,6 +25,10 @@ _constants_module = importlib.util.module_from_spec(_constants_spec)
 _constants_spec.loader.exec_module(_constants_module)
 
 effort_meets_threshold = _constants_module.effort_meets_threshold
+CODE_REVIEW_ENFORCEMENT_ENV_VAR = _constants_module.CODE_REVIEW_ENFORCEMENT_ENV_VAR
+code_review_enforcement_enabled_in_environment = (
+    _constants_module.code_review_enforcement_enabled_in_environment
+)
 PUSH_REQUIRED_EFFORT = _constants_module.PUSH_REQUIRED_EFFORT
 PR_CREATE_REQUIRED_EFFORT = _constants_module.PR_CREATE_REQUIRED_EFFORT
 GATED_PUSH_SUBCOMMANDS = _constants_module.GATED_PUSH_SUBCOMMANDS
@@ -106,3 +112,55 @@ def test_push_gate_message_names_the_push_action_and_low_effort() -> None:
 
 def test_guard_message_directs_users_to_the_sanctioned_minter_flag() -> None:
     assert SANCTIONED_STAMP_MINTER_FLAG in STAMP_DIRECTORY_GUARD_MESSAGE
+
+
+def test_enforcement_defaults_to_off(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, raising=False)
+    assert code_review_enforcement_enabled_in_environment() is False
+
+
+@pytest.mark.parametrize("enabling_value", ["1", "true", "TRUE", " yes ", "on"])
+def test_enforcement_turns_on_for_each_enabling_environment_value(
+    monkeypatch: pytest.MonkeyPatch, enabling_value: str
+) -> None:
+    monkeypatch.setenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, enabling_value)
+    assert code_review_enforcement_enabled_in_environment() is True
+
+
+@pytest.mark.parametrize("non_enabling_value", ["0", "false", "off", "", "maybe"])
+def test_enforcement_stays_off_for_a_non_enabling_environment_value(
+    monkeypatch: pytest.MonkeyPatch, non_enabling_value: str
+) -> None:
+    monkeypatch.setenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, non_enabling_value)
+    assert code_review_enforcement_enabled_in_environment() is False
+
+
+def _module_flag_after_a_fresh_import(
+    monkeypatch: pytest.MonkeyPatch, environment_value: str | None
+) -> bool:
+    if environment_value is None:
+        monkeypatch.delenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, raising=False)
+    else:
+        monkeypatch.setenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, environment_value)
+    fresh_spec = importlib.util.spec_from_file_location(
+        "code_review_enforcement_constants_fresh_import",
+        _CONFIG_DIR / "code_review_enforcement_constants.py",
+    )
+    assert fresh_spec is not None
+    assert fresh_spec.loader is not None
+    fresh_module = importlib.util.module_from_spec(fresh_spec)
+    fresh_spec.loader.exec_module(fresh_module)
+    flag_value: bool = fresh_module.CODE_REVIEW_ENFORCEMENT_ENABLED
+    return flag_value
+
+
+def test_module_flag_turns_on_when_the_environment_asks_for_enforcement(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    assert _module_flag_after_a_fresh_import(monkeypatch, "true") is True
+
+
+def test_module_flag_stays_off_when_the_environment_is_unset(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    assert _module_flag_after_a_fresh_import(monkeypatch, None) is False

package/hooks/blocking/config/verified_commit_constants.py

@@ -1,159 +1,160 @@
-"""Constants for the verified-commit gate hook family.
-
-Shared by ``verification_verdict_store.py``, ``verified_commit_gate.py``,
-and ``verifier_verdict_minter.py`` so every tunable lives in one place.
-"""
-
-from __future__ import annotations
-
-GIT_TIMEOUT_SECONDS = 30
-ROOT_KEY_HEX_LENGTH = 16
-VERDICT_JSON_INDENT = 2
-CLAUDE_HOME_DIRECTORY_NAME = ".claude"
-VERDICT_DIRECTORY_NAME = "verification"
-VERDICT_DIRECTORY_NAME_SEPARATOR_PATTERN = r"['\"\\/,\s]+"
-VERDICT_DIRECTORY_PATH_BOUNDARY_PATTERN = r"(?=['\"]*[\\/,])"
-RELATIVE_VERDICT_DIRECTORY_PATTERN = r"(?:^|(?<=[\s;&|(='\"]))verification[\\/]"
-VERDICT_PATH_GLUE_PATTERN = r"['\"+\\/\s]*[\\/]['\"+\\/\s]*"
-VERDICT_DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?verification[\\/]?['\"]?(?=[\s;&|]|$)"
-VERDICT_PATH_JOINED_VARIABLE_PATTERN = r"\$\{?(\w+)\}?[\\/]|[\\/]\$\{?(\w+)\}?"
-VERDICT_PATH_VARIABLE_ASSIGNMENT_PATTERN = r"(?:^|(?<=[\s;&|(]))%s=(\S+)"
-VERDICT_FILE_RELATIVE_REFERENCE_PATTERN = (
-    rf"(?:^|(?<=[\s;&|(='\"\\/]))verification[\\/][0-9a-f]{{{ROOT_KEY_HEX_LENGTH}}}\.json"
-)
-PATH_OBFUSCATION_PRIMITIVE_PATTERN = (
-    r"chr\s*\(|bytes\.fromhex\s*\(|b64decode\s*\(|codecs\.decode\s*\("
-    r"|(?:bytes|bytearray)\s*\(\s*\[|\[char\[?\]?\]"
-)
-ALL_VERDICT_PATH_SEGMENT_NAMES = (".claude", "verification")
-ALL_VERDICT_PATH_SEGMENT_BODIES = ("claude", "verification")
-HEX_TOKEN_PATTERN = r"(?<![0-9a-fx])([0-9a-f]{6,})(?![0-9a-f])"
-BASE64_TOKEN_PATTERN = r"[A-Za-z0-9+/]{8,}={0,2}"
-CHARACTER_CODE_SEQUENCE_PATTERN = r"\d{1,3}(?:\s*,\s*\d{1,3})+"
-CHR_CALL_CHAIN_PATTERN = r"chr\(\s*\d{1,3}\s*\)(?:\s*\+\s*chr\(\s*\d{1,3}\s*\))+"
-CHR_CALL_CODE_PATTERN = r"chr\(\s*(\d{1,3})\s*\)"
-HEX_DIGITS_PER_BYTE = 2
-FILE_WRITE_PRIMITIVE_PATTERN = (
-    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
-    r"|Out-File|Set-Content|Add-Content|\btee\b|>"
-)
-NON_REDIRECT_FILE_WRITE_PRIMITIVE_PATTERN = (
-    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
-    r"|Out-File|Set-Content|Add-Content|\btee\b"
-)
-WRITE_CALL_REGION_PATTERN = (
-    r"(?:\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
-    r"|Out-File|Set-Content|Add-Content|\btee\b)[^;&|\n]*"
-)
-VERDICT_KEY_ALL_PASS = "all_pass"
-VERDICT_KEY_MANIFEST_SHA256 = "manifest_sha256"
-VERDICT_KEY_FINDINGS = "findings"
-VERDICT_FINDING_CHECK_KEY = "check"
-LOGS_DIRECTORY_NAME = "logs"
-VERIFIER_VERDICTS_JSONL_FILENAME = "verifier-verdicts.jsonl"
-LEDGER_KEY_TIMESTAMP = "timestamp"
-LEDGER_KEY_REPO_ROOT = "repo_root"
-LEDGER_KEY_BRANCH = "branch"
-LEDGER_KEY_MANIFEST_HASH = "manifest_hash"
-LEDGER_KEY_ALL_PASS = "all_pass"
-LEDGER_KEY_FINDING_COUNT = "finding_count"
-LEDGER_KEY_FINDING_CHECK_NAMES = "finding_check_names"
-LEDGER_KEY_MINTED_FROM_AGENT_ID = "minted_from_agent_id"
-VERDICT_FILE_GLOB = "*.json"
-SUBAGENTS_DIRECTORY_NAME = "subagents"
-AGENT_TRANSCRIPT_GLOB = "agent-*.jsonl"
-AGENT_META_SIDECAR_SUFFIX = ".meta.json"
-AGENT_META_TYPE_KEY = "agentType"
-TRANSCRIPT_ENTRY_TYPE_KEY = "type"
-TRANSCRIPT_ASSISTANT_ENTRY_TYPE = "assistant"
-TRANSCRIPT_MESSAGE_KEY = "message"
-TRANSCRIPT_CONTENT_KEY = "content"
-TRANSCRIPT_CONTENT_TYPE_KEY = "type"
-TRANSCRIPT_TEXT_CONTENT_TYPE = "text"
-TRANSCRIPT_TEXT_KEY = "text"
-VERDICT_FENCE_PATTERN = r"```verdict\s*\n(.*?)```"
-MANIFEST_HASH_CLI_FLAG = "--manifest-hash"
-MANIFEST_HASH_FOR_BRANCH_CLI_FLAG = "--manifest-hash-for-branch"
-WORKTREE_LIST_PATH_PREFIX = "worktree "
-WORKTREE_LIST_BRANCH_PREFIX = "branch "
-BRANCH_REFERENCE_PREFIX = "refs/heads/"
-EMPTY_SURFACE_GUARD_MESSAGE = (
-    "ERROR: The work tree at {repo_root} has no changed or untracked files "
-    "versus origin/main (empty change surface). This work tree holds nothing "
-    "to verify — you are pointed at the wrong work tree. Run `git worktree list` "
-    "to see all checked-out work trees and target the one on the branch under review."
-)
-BRANCH_WORKTREE_ABSENT_MESSAGE = (
-    "ERROR: No work tree has branch '{branch}' checked out. "
-    "Check it out in a work tree first: "
-    "`git worktree add <path> <branch>` or `git checkout <branch>`."
-)
-DOCS_ONLY_EXTENSIONS = frozenset(
-    {".md", ".txt", ".rst", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".ico"}
-)
-PYTHON_EXTENSION = ".py"
-TEST_FILE_PREFIX = "test_"
-TEST_FILE_SUFFIX = "_test.py"
-CONFTEST_FILE_NAME = "conftest.py"
-MINIMUM_STATUS_FIELD_COUNT = 2
-ALL_FALLBACK_BASE_REFERENCES = ("origin/main", "origin/master")
-DETACHED_HEAD_LABEL = "HEAD"
-BRANCH_REMOTE_CONFIG_KEY_TEMPLATE = "branch.{branch_name}.remote"
-ALL_TOOLING_STATE_PREFIXES = (
-    ".claude/verification/",
-    ".claude/worktrees/",
-    ".claude/daemon/",
-    ".claude/teams/",
-    ".claude/sessions/",
-    ".cursor/worktrees/",
-)
-GATED_GIT_SUBCOMMANDS = frozenset({"commit", "push"})
-ALL_GIT_BINARY_NAMES = frozenset({"git", "git.exe"})
-VALUE_TAKING_GIT_OPTIONS = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace"})
-REPO_DIRECTORY_OPTION = "-C"
-WORK_TREE_OPTION = "--work-tree"
-DIRECTORY_CHANGE_VERBS = frozenset({"cd", "pushd", "set-location", "sl"})
-DIRECTORY_CHANGE_PATH_OPTIONS = frozenset({"-path", "-literalpath"})
-DIRECTORY_CHANGE_OPTION_TERMINATOR = "--"
-DIRECTORY_CHANGE_PATTERN_PREFIX = r"(?:^|(?<=[\s;&|(]))(?:"
-DIRECTORY_CHANGE_PATTERN_SUFFIX = r")(?=\s|$)"
-DIRECTORY_CHANGE_OPTION_PREFIX_PATTERN = r"(?:[ \t]+(?:%s)(?=\s|$))*"
-DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?\S*"
-CLAUDE_HOME_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
-VERDICT_DIRECTORY_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
-COMMAND_AFTER_DIRECTORY_CHANGE_PATTERN = r"[;&|\n][\s]*\S"
-OPTION_WITH_VALUE_STEP = 2
-ALL_GATED_TOOL_NAMES = ("Bash", "PowerShell")
-HASH_PREVIEW_LENGTH = 16
-VERIFICATION_BYPASS_MARKER = "# verify-skip"
-MINTING_AGENT_TYPE = "code-verifier"
-VERDICT_DIRECTORY_GUARD_MESSAGE = (
-    "BLOCKED: [VERDICT_DIRECTORY_GUARD] Shell access to the verification "
-    "verdict directory (~/.claude/verification/) is denied. Only the "
-    "verifier_verdict_minter.py SubagentStop hook writes verdict files; a "
-    "shell write here would forge a passing verdict and defeat the "
-    "verified-commit gate. Spawn the code-verifier agent to earn a verdict "
-    "instead of writing one."
-)
-CORRECTIVE_MESSAGE = (
-    "BLOCKED: [VERIFIED_COMMIT_GATE] This branch surface has no passing "
-    "verification verdict. Clear commit-committability gates first "
-    "(CODE_RULES on changed lines and merge conflicts vs base — the "
-    "code_verifier_spawn_preflight_gate enforces these on the spawn). If a "
-    "prior commit failed on CODE_RULES or staging, fix those before "
-    "re-verifying. Then spawn the code-verifier agent (Agent or Task tool, "
-    "subagent_type 'code-verifier') with the task texts, the diff scope, "
-    "and recorded baselines; when it finishes with a clean verdict the "
-    "SubagentStop hook mints the verdict and this command will pass. Any "
-    "file change after verification invalidates the verdict, so verify "
-    "last only after commit gates are green. The verdict binds to the exact "
-    "surface content (every changed and untracked file's bytes), not to a "
-    "work-tree path, so a commit from a different work tree passes only "
-    "when its surface is byte-identical; a work tree carrying any extra or "
-    "later edit has a surface no verdict covers. To land this change, run "
-    "this command from the work tree that holds the verified surface, or "
-    "verify this surface here. Exempt automatically: docs/image files, "
-    "pytest test files, and "
-    "Python files whose docstring- and comment-stripped AST is unchanged "
-    "(comment-only edits in non-Python files are not exempt)."
-)
+"""Constants for the verified-commit gate hook family.
+
+Shared by ``verification_verdict_store.py``, ``verified_commit_gate.py``,
+and ``verifier_verdict_minter.py`` so every tunable lives in one place.
+"""
+
+from __future__ import annotations
+
+GIT_TIMEOUT_SECONDS = 30
+ROOT_KEY_HEX_LENGTH = 16
+VERDICT_JSON_INDENT = 2
+CLAUDE_HOME_DIRECTORY_NAME = ".claude"
+VERDICT_DIRECTORY_NAME = "verification"
+VERDICT_DIRECTORY_NAME_SEPARATOR_PATTERN = r"['\"\\/,\s]+"
+VERDICT_DIRECTORY_PATH_BOUNDARY_PATTERN = r"(?=['\"]*[\\/,])"
+RELATIVE_VERDICT_DIRECTORY_PATTERN = r"(?:^|(?<=[\s;&|(='\"]))verification[\\/]"
+VERDICT_PATH_GLUE_PATTERN = r"['\"+\\/\s]*[\\/]['\"+\\/\s]*"
+VERDICT_DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?verification[\\/]?['\"]?(?=[\s;&|]|$)"
+VERDICT_PATH_JOINED_VARIABLE_PATTERN = r"\$\{?(\w+)\}?[\\/]|[\\/]\$\{?(\w+)\}?"
+VERDICT_PATH_VARIABLE_ASSIGNMENT_PATTERN = r"(?:^|(?<=[\s;&|(]))%s=(\S+)"
+VERDICT_FILE_RELATIVE_REFERENCE_PATTERN = (
+    rf"(?:^|(?<=[\s;&|(='\"\\/]))verification[\\/][0-9a-f]{{{ROOT_KEY_HEX_LENGTH}}}\.json"
+)
+PATH_OBFUSCATION_PRIMITIVE_PATTERN = (
+    r"chr\s*\(|bytes\.fromhex\s*\(|b64decode\s*\(|codecs\.decode\s*\("
+    r"|(?:bytes|bytearray)\s*\(\s*\[|\[char\[?\]?\]"
+)
+ALL_VERDICT_PATH_SEGMENT_NAMES = (".claude", "verification")
+ALL_VERDICT_PATH_SEGMENT_BODIES = ("claude", "verification")
+HEX_TOKEN_PATTERN = r"(?<![0-9a-fx])([0-9a-f]{6,})(?![0-9a-f])"
+BASE64_TOKEN_PATTERN = r"[A-Za-z0-9+/]{8,}={0,2}"
+CHARACTER_CODE_SEQUENCE_PATTERN = r"\d{1,3}(?:\s*,\s*\d{1,3})+"
+CHR_CALL_CHAIN_PATTERN = r"chr\(\s*\d{1,3}\s*\)(?:\s*\+\s*chr\(\s*\d{1,3}\s*\))+"
+CHR_CALL_CODE_PATTERN = r"chr\(\s*(\d{1,3})\s*\)"
+HEX_DIGITS_PER_BYTE = 2
+FILE_WRITE_PRIMITIVE_PATTERN = (
+    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
+    r"|Out-File|Set-Content|Add-Content|\btee\b|>"
+)
+NON_REDIRECT_FILE_WRITE_PRIMITIVE_PATTERN = (
+    r"\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
+    r"|Out-File|Set-Content|Add-Content|\btee\b"
+)
+WRITE_CALL_REGION_PATTERN = (
+    r"(?:\bopen\s*\(|\.write_text\s*\(|\.write_bytes\s*\("
+    r"|Out-File|Set-Content|Add-Content|\btee\b)[^;&|\n]*"
+)
+VERDICT_KEY_ALL_PASS = "all_pass"
+VERDICT_KEY_MANIFEST_SHA256 = "manifest_sha256"
+VERDICT_KEY_FINDINGS = "findings"
+VERDICT_FINDING_CHECK_KEY = "check"
+LOGS_DIRECTORY_NAME = "logs"
+VERIFIER_VERDICTS_JSONL_FILENAME = "verifier-verdicts.jsonl"
+LEDGER_KEY_TIMESTAMP = "timestamp"
+LEDGER_KEY_REPO_ROOT = "repo_root"
+LEDGER_KEY_BRANCH = "branch"
+LEDGER_KEY_MANIFEST_HASH = "manifest_hash"
+LEDGER_KEY_ALL_PASS = "all_pass"
+LEDGER_KEY_FINDING_COUNT = "finding_count"
+LEDGER_KEY_FINDING_CHECK_NAMES = "finding_check_names"
+LEDGER_KEY_MINTED_FROM_AGENT_ID = "minted_from_agent_id"
+VERDICT_FILE_GLOB = "*.json"
+SUBAGENTS_DIRECTORY_NAME = "subagents"
+AGENT_TRANSCRIPT_GLOB = "agent-*.jsonl"
+AGENT_META_SIDECAR_SUFFIX = ".meta.json"
+AGENT_META_TYPE_KEY = "agentType"
+TRANSCRIPT_ENTRY_TYPE_KEY = "type"
+TRANSCRIPT_ASSISTANT_ENTRY_TYPE = "assistant"
+TRANSCRIPT_MESSAGE_KEY = "message"
+TRANSCRIPT_CONTENT_KEY = "content"
+TRANSCRIPT_CONTENT_TYPE_KEY = "type"
+TRANSCRIPT_TEXT_CONTENT_TYPE = "text"
+TRANSCRIPT_TEXT_KEY = "text"
+VERDICT_FENCE_PATTERN = r"```verdict\s*\n(.*?)```"
+MANIFEST_HASH_CLI_FLAG = "--manifest-hash"
+MANIFEST_HASH_FOR_BRANCH_CLI_FLAG = "--manifest-hash-for-branch"
+WORKTREE_LIST_PATH_PREFIX = "worktree "
+WORKTREE_LIST_BRANCH_PREFIX = "branch "
+BRANCH_REFERENCE_PREFIX = "refs/heads/"
+EMPTY_SURFACE_GUARD_MESSAGE = (
+    "ERROR: The work tree at {repo_root} has no changed or untracked files "
+    "versus origin/main (empty change surface). This work tree holds nothing "
+    "to verify — you are pointed at the wrong work tree. Run `git worktree list` "
+    "to see all checked-out work trees and target the one on the branch under review."
+)
+BRANCH_WORKTREE_ABSENT_MESSAGE = (
+    "ERROR: No work tree has branch '{branch}' checked out. "
+    "Check it out in a work tree first: "
+    "`git worktree add <path> <branch>` or `git checkout <branch>`."
+)
+DOCS_ONLY_EXTENSIONS = frozenset(
+    {".md", ".txt", ".rst", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".ico"}
+)
+PYTHON_EXTENSION = ".py"
+TEST_FILE_PREFIX = "test_"
+TEST_FILE_SUFFIX = "_test.py"
+CONFTEST_FILE_NAME = "conftest.py"
+MINIMUM_STATUS_FIELD_COUNT = 2
+ALL_FALLBACK_BASE_REFERENCES = ("origin/main", "origin/master")
+DETACHED_HEAD_LABEL = "HEAD"
+BRANCH_REMOTE_CONFIG_KEY_TEMPLATE = "branch.{branch_name}.remote"
+ALL_TOOLING_STATE_PREFIXES = (
+    ".claude/verification/",
+    ".claude/worktrees/",
+    ".claude/daemon/",
+    ".claude/teams/",
+    ".claude/sessions/",
+    ".cursor/worktrees/",
+    ".claude-plugin-data/",
+)
+GATED_GIT_SUBCOMMANDS = frozenset({"commit", "push"})
+ALL_GIT_BINARY_NAMES = frozenset({"git", "git.exe"})
+VALUE_TAKING_GIT_OPTIONS = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace"})
+REPO_DIRECTORY_OPTION = "-C"
+WORK_TREE_OPTION = "--work-tree"
+DIRECTORY_CHANGE_VERBS = frozenset({"cd", "pushd", "set-location", "sl"})
+DIRECTORY_CHANGE_PATH_OPTIONS = frozenset({"-path", "-literalpath"})
+DIRECTORY_CHANGE_OPTION_TERMINATOR = "--"
+DIRECTORY_CHANGE_PATTERN_PREFIX = r"(?:^|(?<=[\s;&|(]))(?:"
+DIRECTORY_CHANGE_PATTERN_SUFFIX = r")(?=\s|$)"
+DIRECTORY_CHANGE_OPTION_PREFIX_PATTERN = r"(?:[ \t]+(?:%s)(?=\s|$))*"
+DIRECTORY_CHANGE_TARGET_PATTERN = r"[ \t]+['\"]?\S*"
+CLAUDE_HOME_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
+VERDICT_DIRECTORY_TARGET_BOUNDARY_PATTERN = r"[\\/]?['\"]?(?=[\s;&|]|$)"
+COMMAND_AFTER_DIRECTORY_CHANGE_PATTERN = r"[;&|\n][\s]*\S"
+OPTION_WITH_VALUE_STEP = 2
+ALL_GATED_TOOL_NAMES = ("Bash", "PowerShell")
+HASH_PREVIEW_LENGTH = 16
+VERIFICATION_BYPASS_MARKER = "# verify-skip"
+MINTING_AGENT_TYPE = "code-verifier"
+VERDICT_DIRECTORY_GUARD_MESSAGE = (
+    "BLOCKED: [VERDICT_DIRECTORY_GUARD] Shell access to the verification "
+    "verdict directory (~/.claude/verification/) is denied. Only the "
+    "verifier_verdict_minter.py SubagentStop hook writes verdict files; a "
+    "shell write here would forge a passing verdict and defeat the "
+    "verified-commit gate. Spawn the code-verifier agent to earn a verdict "
+    "instead of writing one."
+)
+CORRECTIVE_MESSAGE = (
+    "BLOCKED: [VERIFIED_COMMIT_GATE] This branch surface has no passing "
+    "verification verdict. Clear commit-committability gates first "
+    "(CODE_RULES on changed lines and merge conflicts vs base — the "
+    "code_verifier_spawn_preflight_gate enforces these on the spawn). If a "
+    "prior commit failed on CODE_RULES or staging, fix those before "
+    "re-verifying. Then spawn the code-verifier agent (Agent or Task tool, "
+    "subagent_type 'code-verifier') with the task texts, the diff scope, "
+    "and recorded baselines; when it finishes with a clean verdict the "
+    "SubagentStop hook mints the verdict and this command will pass. Any "
+    "file change after verification invalidates the verdict, so verify "
+    "last only after commit gates are green. The verdict binds to the exact "
+    "surface content (every changed and untracked file's bytes), not to a "
+    "work-tree path, so a commit from a different work tree passes only "
+    "when its surface is byte-identical; a work tree carrying any extra or "
+    "later edit has a surface no verdict covers. To land this change, run "
+    "this command from the work tree that holds the verified surface, or "
+    "verify this surface here. Exempt automatically: docs/image files, "
+    "pytest test files, and "
+    "Python files whose docstring- and comment-stripped AST is unchanged "
+    "(comment-only edits in non-Python files are not exempt)."
+)