claude-dev-env 2.5.0 → 2.7.0

package/codex-capability-map.json

@@ -0,0 +1,13 @@
+{
+  "schema_version": 1,
+  "capabilities": [
+    {"source": "TaskList", "aliases": ["task_list", "tasks", "Task.list"], "target": "update_plan", "transformation": "snapshot", "status": "fallback", "confidence": "medium", "manual_review": true, "required_fields": {"plan": "plan"}},
+    {"source": "TaskCreate", "aliases": ["task_create", "tasks.create", "create_task"], "target": "update_plan", "transformation": "append/replace-plan-item", "status": "mapped", "confidence": "high", "manual_review": false, "required_fields": {"name": "string", "status": "status"}},
+    {"source": "TaskUpdate", "aliases": ["task_update", "tasks.update", "update_task"], "target": "update_plan", "transformation": "status mutation", "status": "mapped", "confidence": "high", "manual_review": false, "required_fields": {"name": "string", "status": "status"}},
+    {"source": "Task", "aliases": ["Agent", "task", "agent", "spawn_agent", "spawn", "spawnAgent"], "target": "multi_agent_v1__spawn_agent", "transformation": "spawn request", "status": "mapped", "confidence": "medium", "manual_review": true, "required_fields": {"prompt": "string"}},
+    {"source": "SendMessage", "aliases": ["send_message", "agent.send", "send_input", "message", "sendMessage"], "target": "multi_agent_v1__send_input", "transformation": "agent input", "status": "mapped", "confidence": "high", "manual_review": false, "required_fields": {"message": "string"}},
+    {"source": "TaskOutput", "aliases": ["task_output", "wait", "TaskWait"], "target": "multi_agent_v1__wait_agent", "transformation": "wait request", "status": "mapped", "confidence": "high", "manual_review": false, "required_fields": {"task_id": "string"}},
+    {"source": "TaskStop", "aliases": ["task_stop", "stop_task", "close_agent", "stop", "stopAgent"], "target": "multi_agent_v1__close_agent", "transformation": "close request", "status": "mapped", "confidence": "high", "manual_review": false, "required_fields": {"task_id": "string"}},
+    {"source": "ScheduleWakeup", "aliases": ["schedule_wakeup", "wake_up", "cron_wakeup"], "target": null, "transformation": "explicit unsupported result; future automation surface requires confirmation", "status": "unsupported", "confidence": "high", "manual_review": true}
+  ]
+}

package/docs/CODE_RULES.md

@@ -60,6 +60,8 @@ Advisory only, never blocking: soft advisory at >= 400 lines, strong nudge at >=
 Never: ABC for single impl, DI frameworks, factory for single type. Always: functions when no state, concrete classes, simple imports.
 Parameters follow YAGNI: add an optional parameter when a caller varies the value; when every call site passes the same value, make it required or inline the constant. Remove parameters no caller passes and no body reads.
 
+**Complexity budget — state it BEFORE implementation:** files (target 1-2, max 3), lines (~50-300). Checkpoints: Is this the MINIMUM? Can it be fewer files? Functions instead of classes?
+
 ## 7.5 SOLID PRINCIPLES
 
 **SRP always applies** — one reason to change per function/class/module. **OCP, LSP, ISP, DIP apply only where two or more concrete implementations already share a contract**; with a single concretion §7 wins (concrete classes, direct imports, YAGNI — introduce the abstraction at the commit that adds the second concretion). Misapplication signals: interface/ABC with exactly one implementation, SRP-splitting a cohesive class by size alone, abstract factories for one product, DI containers where every injected type has one concretion.

package/docs/codex-compatibility.md

@@ -0,0 +1,25 @@
+# Codex compatibility entry point
+
+`codex-compat` is an optional, explicit bridge from this package's Claude-oriented source tree to Codex-compatible records. The existing `claude-dev-env` installer is unchanged and does not invoke it.
+
+## Materialization
+
+Run `codex-compat materialize --source-root <claude-root> --target-root <codex-root>`. The command defaults to a dry run; add `--apply` to publish files. Use `--python <command>` or `CODEX_COMPAT_PYTHON` to select Python. If no usable interpreter is found, the command reports that condition. The launcher passes an argv array, never a shell command.
+
+The Python materializer maps Claude `_shared/`, `agents/`, `hooks/`, `rules/`, and `scripts/` into the target according to the package's compatibility materialization rules. Claude agent frontmatter is converted to Codex TOML metadata. Unsupported Claude metadata is reported, rather than silently treated as equivalent.
+
+Rules, hooks, and scripts that have no safe Codex runtime equivalent remain inert or source-only. They are preserved for inspection and are not executed as translated target tools. The capability bridge likewise emits declarative records only; it never invokes the translated surface.
+
+Materialization uses a compatibility manifest to identify generated files. Dry runs report the plan without writing. Apply mode uses safe link/copy fallback where linking is unavailable, writes atomically, removes only stale managed files, and rolls back managed changes on failure. A failed rollback reports that reconciliation is required.
+
+The manifest hash decides who owns a target file. A file whose hash still matches the manifest is one the tool wrote, so a later run refreshes it in place. A file whose hash differs is one you edited, so the run preserves it and reports a conflict. A file the manifest does not record at all is adopted only when its bytes already match the plan, which is what an interrupted run leaves behind; any other unrecorded file is preserved, and the error names the file to move or delete.
+
+A missing or unreadable source root is an error, and the run changes nothing. An existing source root holding no agents makes every managed file stale, so the run refuses to delete them and exits non-zero; add `--allow-prune-all` to remove them on purpose.
+
+## Capability bridge
+
+Run `codex-compat bridge --surface <name> --payload '<json-object>'`. The bridge exposes the Python translation logic directly. `TaskCreate` and `TaskUpdate` map to `update_plan`; spawn, message, wait, and stop map to multi-agent surfaces. `ScheduleWakeup` is explicitly unsupported and requires manual review.
+
+## Roots and safety
+
+Both roots are caller-supplied. The tool never writes to `.agents` or `CODEX_HOME` automatically; pass those locations explicitly when desired. No personal paths or secrets are embedded in the package.

package/docs/nas-ssh-invocation.md

@@ -1,23 +1,107 @@
-# NAS SSH Invocation Policy
+# Running Commands on the NAS
 
-Full detail behind the always-on `rules/nas-ssh-invocation.md` kernel. It applies to any `ssh`, `scp`, or `sftp` command against the NAS.
+Full detail behind the always-on `rules/nas-ssh-invocation.md` kernel.
 
-## Why the Windows OpenSSH binary
+This file covers how to run a command there at all. What the NAS runs, where the automations are
+deployed, and how to verify a change against them belong with the project that owns those
+automations, not here.
 
-Git Bash's MSYS `ssh` reads `~/.ssh/id_ed25519` as world-readable through its ACL mapping, rejects the key as bad permissions, offers no key, and falls back to an interactive password prompt. In an unattended session no one answers that prompt, so the session hangs. The `System32/OpenSSH` binary authenticates the same key without a prompt.
-
-## The form to use
+## The call
 
 ```
-"/c/Windows/System32/OpenSSH/ssh.exe" -o BatchMode=yes -o ConnectTimeout=10 -p 22 operator@nas.example.local "<cmd>"
+python <runner-path> <command-script.sh> <private-key-path>
 ```
 
-`scp` and `sftp` take the matching `System32/OpenSSH` binary, `-o BatchMode=yes`, and the same port (`-P` for `scp`).
+Two arguments, both paths. The first is a file holding a bash script; the second is the private key.
+
+The runner is `nas_ssh_key.py`. It ships with the automation project it serves, so read its path from
+that project's own reference rather than assuming a location.
+
+The host, ssh port and ssh user are constants inside the runner, so no command you write names them.
+The same three values are recorded under the `nas` key in `~/.claude/local-identity.json`. Read them
+from there when something needs them, and keep them out of anything committed or posted.
+
+Write the script file with the Write tool. Keeping the commands in a file has a second benefit: a
+destructive word such as `rm -rf` inside the file never appears in a Bash tool command string, so the
+`destructive_command_blocker` hook stays out of the way.
+
+The script runs through `bash -s` in a single shell. Variables, `cd`, and `source` all carry from one
+line to the next. Standard output, standard error and the exit code all come back.
+
+## Why not ssh, scp or sftp
+
+The runner loads the key with paramiko and signs inside the Python process. The command-line clients
+check the key file's permissions first and refuse to load a key whose permissions they do not like.
+Git Bash's `ssh` then falls back to an interactive password prompt, which hangs a run with nobody to
+answer it.
+
+To move a file onto the NAS, write it from inside the script:
+
+```bash
+cat > /tmp/thing.conf <<'EOF'
+contents here
+EOF
+```
+
+The quoted `'EOF'` stops the shell expanding anything in the body.
+
+## The key
+
+Use the ops key under `~/.claude/keys`. It is readable as-is and the NAS accepts it.
 
-The host, ssh user, and port come from the `CLAUDE_NAS_*` environment variables or `~/.claude/local-identity.json`; the committed examples show placeholders (`nas.example.local`, `operator`, `22`).
+Keys under `~/.ssh` are for other jobs and none of them works here. The default one carries a
+passphrase, so paramiko cannot load it unattended; the rest are for other hosts.
 
-`-o BatchMode=yes` is required, not optional: it turns a key-authentication failure into a loud non-zero exit rather than a silent password prompt, so an auth regression surfaces as an error you can read.
+## Writing a script that touches the automations
+
+Do not reach for the system interpreter. It carries neither pytest nor the libraries the automations
+import, so anything checked against it proves nothing.
+
+Each automation project records its own runtime — the interpreter, the virtual environment, the
+import root, and the deploy path. Read that project's reference and activate what it names before
+running anything.
+
+## Verifying a change before it ships
+
+The NAS is a Linux box and this machine is Windows, so two classes of difference show up only there:
+syntax newer than the NAS interpreter accepts, and tests that assert Windows paths.
+
+**Always separate a real break from a platform-only one.** Run the same test file at the branch head
+and at the commit the work started from. Identical failures at both mean the environment, not the
+change. Report both numbers rather than the head alone.
+
+## The /tmp limit
+
+`/tmp` is a small tmpfs. A full clone of a repository that carries binary assets fills it, the clone
+dies partway through, and the disk stays full for whatever runs next.
+
+Fetch shallow and sparse instead:
+
+```bash
+d=$(mktemp -d /tmp/work.XXXXXX)
+cd "$d"
+git init --quiet
+git remote add origin <repository-url>
+git sparse-checkout init --cone
+git sparse-checkout set <subdirectory>
+git fetch --quiet --depth 1 origin <sha>
+git checkout --quiet FETCH_HEAD
+```
+
+One subdirectory at one commit lands tens of megabytes rather than the whole history. Clean up at the
+end and print `df -h /tmp` so the next run knows the state:
+
+```bash
+find /tmp -maxdepth 1 -name 'work.*' -prune -exec rm -rf {} +
+```
 
-## Enforcement
+## When something fails
 
-`nas_ssh_binary_enforcer.py` (PreToolUse on Bash) denies a bare `ssh`/`scp`/`sftp` command word aimed at the NAS host and points at the full-binary form. It also denies the full `System32/OpenSSH` binary to that host when the command omits `-o BatchMode=yes`. Commands to any other host, and commands that mention the address without an ssh-family command word, pass.
+| What you see | What it means |
+|---|---|
+| `PermissionError: [Errno 13]` on the key | The key file is not readable by this account. |
+| `PasswordRequiredException: Private key file is encrypted` | That key has a passphrase and cannot be used unattended. |
+| `Authentication (publickey) failed` | The transport works and the NAS does not accept that key. |
+| `Load key ...: Permission denied` from `ssh.exe` | A command-line client is being used. Use the runner. |
+| `No space left on device` | `/tmp` is full. Clean it, then fetch shallow and sparse. |
+| `No module named pytest` | The system interpreter is being used. Activate the project's environment first. |

package/docs/references/code-review-enforcement.md

@@ -11,14 +11,35 @@ The gates follow the same shape as the `verified_commit` gate family.
 
 ## Opt-in (default off)
 
-Enforcement is **off by default**. The master flag is
-`CODE_REVIEW_ENFORCEMENT_ENABLED` in
-`hooks/blocking/config/code_review_enforcement_constants.py`. Set it to
-`True` to enable the push gate, the PR-create gate, the native pre-push
-backstop (via the shared deny decision), and the stamp-directory write
-blocker. When the flag is `False`, every gate allows the action and the
+Enforcement is **off by default**. Turn it on by setting the environment
+variable `CLAUDE_CODE_REVIEW_ENFORCEMENT` to `1`, `true`, `yes`, or `on`
+(case and surrounding spaces are ignored). Any other value, and an unset
+variable, leave enforcement off.
+
+Set the variable in the machine's own user environment so every gate reads it,
+including the native git pre-push backstop, which git runs in the shell's
+environment. An `env` block in `settings.json` reaches the three Claude Code
+hook gates alone. Each gate process reads the variable as it starts, so a
+Claude Code session already running keeps its current setting until it
+restarts, while the git pre-push backstop picks up the current shell
+environment on each push.
+
+A user-environment setting arms the gates machine-wide. The backstop installs
+through the shared `core.hooksPath`, so it runs for every repository on the
+machine, and the gates carry no per-repository allowlist. Each repository then
+needs its own clean stamp before a push lands there.
+
+The variable feeds the master flag `CODE_REVIEW_ENFORCEMENT_ENABLED` in
+`hooks/blocking/config/code_review_enforcement_constants.py`, which every gate
+reads at start-up. When it is on, the push gate, the PR-create gate, the native
+pre-push backstop (via the shared deny decision), and the stamp-directory write
+blocker all enforce. When it is off, every gate allows the action and the
 write-blocker allows stamp-directory access.
 
+`npx claude-dev-env` copies the shipped `hooks/` tree over `~/.claude/` on each
+install, so the environment setting survives an install and an edit to the
+constant does not.
+
 ## How a stamp works
 
 A stamp is a small JSON file that records one fact: a clean `/code-review` pass
@@ -88,6 +109,10 @@ anchor a forgery-proof mint. The stamp reaches the same posture the
   create-PR gate.
 - **`git push --no-verify`.** This flag tells git to skip the native pre-push
   hook, so the native backstop does not run.
+- **A push that clears the enable variable.** The backstop reads
+  `CLAUDE_CODE_REVIEW_ENFORCEMENT` from the shell that runs the push, so
+  `CLAUDE_CODE_REVIEW_ENFORCEMENT=0 git push` reads as enforcement off and the
+  backstop allows the push with no flag and no bypass marker.
 - **A rebuilt store.** A script that re-implements the stamp store in memory
   and writes a matching file can mint a stamp the gates accept.
 

package/hooks/blocking/CLAUDE.md

@@ -82,6 +82,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `destructive_command_blocker.py` | PreToolUse (Bash/PowerShell) | Shell commands with destructive literals (`rm -rf`, `git reset --hard`, etc.) |
 | `docstring_rule_gate_count_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | A stale spelled-out gate-validator count in `docstring-prose-matches-implementation.md` — the "N more gate validators" / "M gated slices" count drifting from the `check_docstring_*` validators the prose names |
 | `duplicate_rmtree_helper_blocker.py` | PreToolUse (Write/Edit) | A local re-definition of the Windows-safe rmtree helper trio (`_strip_read_only_and_retry`, `_force_remove_tree` / `force_rmtree`) in place of importing a shared helper |
+| `eli11_reply_enforcer.py` | Stop | Final replies breaking the `eli11-replies` shape — more than 120 reader-visible words, more than 6 bullet lines, more than 2 lines carrying over 20 words each, or instruction lines telling the user to act with no numbered step among the lead lines. Code fences, inline code, blockquotes, table rows, and link targets come off before the reply is judged, replies under 60 words always pass, and a reply opening with `Long form:` opts out entirely |
 | `env_var_table_code_drift_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | A markdown env-var summary table row attributing an environment variable to a code file whose source never references that variable name |
 | `es_exe_path_rewriter.py` | PreToolUse | Rewrites paths referencing `.exe` under the Everything search path |
 | `gh_body_arg_blocker.py` | PreToolUse (Bash) | `gh` commands passing `--body`/`-b` directly (requires `--body-file` instead) |
@@ -108,10 +109,12 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `sensitive_file_protector.py` | PreToolUse (Write/Edit) | Writes to sensitive credential or config files |
 | `session_edit_stage_gate.py` | PreToolUse (Bash) | A `git commit` that would drop files edited this session because they are tracked but left unstaged |
 | `session_handoff_blocker.py` | Stop | Responses suggesting a new session mid-task |
+| `shell_substitution_blocker.py` | PreToolUse (Bash) | A command carrying `$(...)`, a live backtick, or `<(...)`/`>(...)` process substitution, which the allowlist matcher cannot descend into |
 | `stale_comment_reference_blocker.py` | PreToolUse (Edit) | An Edit that rewrites a Python code line while keeping the standalone comment directly above it, when that comment names an identifier the rewrite removes from the line |
 | `state_description_blocker.py` | PreToolUse (Write/Edit) | Historical/comparative language in documentation |
 | `subprocess_budget_completeness.py` | PreToolUse | Subprocess calls missing required budget arguments |
 | `tdd_enforcer.py` | PreToolUse (Write/Edit) | Production code written without a matching failing test |
+| `unscoped_search_blocker.py` | PreToolUse (Bash/PowerShell) | A `find` or recursive listing that walks from the filesystem root, a drive root, bare home, or a network share root |
 | `verdict_directory_write_blocker.py` | PreToolUse (Bash/PowerShell) | Shell writes into `~/.claude/verification/` |
 | `verified_commit_gate.py` | PreToolUse (Bash/PowerShell) | `git commit`/`git push` without a passing verifier verdict |
 | `verified_commit_message_accuracy_blocker.py` | PreToolUse | Commit messages that misstate what the diff has |

package/hooks/blocking/config/code_review_enforcement_constants.py

@@ -1,19 +1,49 @@
 """Single source of truth for the code-review enforcement gate family.
 
-Holds the stamp directory name, the ordered effort tokens (``low`` under
-``medium`` under ``high`` under ``xhigh`` under ``max``, with ``ultra`` kept
-out because it needs an interactive terminal), the effort a push and a
-pull-request creation each require, the stamp record keys, the gate and
-write-blocker messages, the store-forge shell patterns, the MCP create-PR
-tool name, and the effort comparison every gate and the stamp store share so
-the thresholds never drift between them, and the master enable flag
-(``CODE_REVIEW_ENFORCEMENT_ENABLED``, default off) that every gate and
-the stamp-directory write-blocker read before they enforce anything.
+::
+
+    CLAUDE_CODE_REVIEW_ENFORCEMENT=1  ->  CODE_REVIEW_ENFORCEMENT_ENABLED True
+    (unset)                           ->  CODE_REVIEW_ENFORCEMENT_ENABLED False
+    effort_meets_threshold("xhigh", PUSH_REQUIRED_EFFORT)       -> True
+    effort_meets_threshold("high", PR_CREATE_REQUIRED_EFFORT)   -> False
+
+Every gate reads its thresholds and messages from here, so the effort a push
+needs and the effort a pull request needs never drift apart. The master flag
+tracks the environment, so a machine opts in through its own environment and
+the choice outlives a reinstall that rewrites this shipped file.
 """
 
 from __future__ import annotations
 
-CODE_REVIEW_ENFORCEMENT_ENABLED = False
+import os
+
+CODE_REVIEW_ENFORCEMENT_ENV_VAR = "CLAUDE_CODE_REVIEW_ENFORCEMENT"
+ALL_ENFORCEMENT_ENABLED_ENV_VALUES = frozenset({"1", "true", "yes", "on"})
+
+
+def code_review_enforcement_enabled_in_environment() -> bool:
+    """Read whether this machine turns the code-review gates on.
+
+    ::
+
+        CLAUDE_CODE_REVIEW_ENFORCEMENT=1      -> True
+        CLAUDE_CODE_REVIEW_ENFORCEMENT=" On " -> True
+        CLAUDE_CODE_REVIEW_ENFORCEMENT=0      -> False
+        (variable unset)                      -> False
+
+    A machine opts in through its own environment, so an install that rewrites
+    this shipped file leaves the choice standing. Any value outside the enabled
+    set, and an unset variable, read as off, so the gate family stays quiet
+    until someone asks for it.
+
+    Returns:
+        True when the variable holds an enabled value, False otherwise.
+    """
+    raw_environment_setting = os.environ.get(CODE_REVIEW_ENFORCEMENT_ENV_VAR, "")
+    return raw_environment_setting.strip().lower() in ALL_ENFORCEMENT_ENABLED_ENV_VALUES
+
+
+CODE_REVIEW_ENFORCEMENT_ENABLED = code_review_enforcement_enabled_in_environment()
 STAMP_DIRECTORY_NAME = "code-review-stamps"
 ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER = ("low", "medium", "high", "xhigh", "max")
 PUSH_REQUIRED_EFFORT = "low"

package/hooks/blocking/config/test_code_review_enforcement_constants.py

@@ -9,6 +9,8 @@ import importlib.util
 import pathlib
 import re
 
+import pytest
+
 _CONFIG_DIR = pathlib.Path(__file__).parent
 
 SAMPLE_ROOT_KEY_HEX_LENGTH = 16
@@ -23,7 +25,10 @@ _constants_module = importlib.util.module_from_spec(_constants_spec)
 _constants_spec.loader.exec_module(_constants_module)
 
 effort_meets_threshold = _constants_module.effort_meets_threshold
-CODE_REVIEW_ENFORCEMENT_ENABLED = _constants_module.CODE_REVIEW_ENFORCEMENT_ENABLED
+CODE_REVIEW_ENFORCEMENT_ENV_VAR = _constants_module.CODE_REVIEW_ENFORCEMENT_ENV_VAR
+code_review_enforcement_enabled_in_environment = (
+    _constants_module.code_review_enforcement_enabled_in_environment
+)
 PUSH_REQUIRED_EFFORT = _constants_module.PUSH_REQUIRED_EFFORT
 PR_CREATE_REQUIRED_EFFORT = _constants_module.PR_CREATE_REQUIRED_EFFORT
 GATED_PUSH_SUBCOMMANDS = _constants_module.GATED_PUSH_SUBCOMMANDS
@@ -109,5 +114,53 @@ def test_guard_message_directs_users_to_the_sanctioned_minter_flag() -> None:
     assert SANCTIONED_STAMP_MINTER_FLAG in STAMP_DIRECTORY_GUARD_MESSAGE
 
 
-def test_enforcement_defaults_to_off() -> None:
-    assert CODE_REVIEW_ENFORCEMENT_ENABLED is False
+def test_enforcement_defaults_to_off(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, raising=False)
+    assert code_review_enforcement_enabled_in_environment() is False
+
+
+@pytest.mark.parametrize("enabling_value", ["1", "true", "TRUE", " yes ", "on"])
+def test_enforcement_turns_on_for_each_enabling_environment_value(
+    monkeypatch: pytest.MonkeyPatch, enabling_value: str
+) -> None:
+    monkeypatch.setenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, enabling_value)
+    assert code_review_enforcement_enabled_in_environment() is True
+
+
+@pytest.mark.parametrize("non_enabling_value", ["0", "false", "off", "", "maybe"])
+def test_enforcement_stays_off_for_a_non_enabling_environment_value(
+    monkeypatch: pytest.MonkeyPatch, non_enabling_value: str
+) -> None:
+    monkeypatch.setenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, non_enabling_value)
+    assert code_review_enforcement_enabled_in_environment() is False
+
+
+def _module_flag_after_a_fresh_import(
+    monkeypatch: pytest.MonkeyPatch, environment_value: str | None
+) -> bool:
+    if environment_value is None:
+        monkeypatch.delenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, raising=False)
+    else:
+        monkeypatch.setenv(CODE_REVIEW_ENFORCEMENT_ENV_VAR, environment_value)
+    fresh_spec = importlib.util.spec_from_file_location(
+        "code_review_enforcement_constants_fresh_import",
+        _CONFIG_DIR / "code_review_enforcement_constants.py",
+    )
+    assert fresh_spec is not None
+    assert fresh_spec.loader is not None
+    fresh_module = importlib.util.module_from_spec(fresh_spec)
+    fresh_spec.loader.exec_module(fresh_module)
+    flag_value: bool = fresh_module.CODE_REVIEW_ENFORCEMENT_ENABLED
+    return flag_value
+
+
+def test_module_flag_turns_on_when_the_environment_asks_for_enforcement(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    assert _module_flag_after_a_fresh_import(monkeypatch, "true") is True
+
+
+def test_module_flag_stays_off_when_the_environment_is_unset(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    assert _module_flag_after_a_fresh_import(monkeypatch, None) is False