claude-dev-env 4.2.0 → 7.0.0

package/scripts/ci/installer-lifecycle.test.mjs

@@ -0,0 +1,26 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const CI_DIRECTORY = dirname(fileURLToPath(import.meta.url));
+const DRIVER_PATH = join(CI_DIRECTORY, 'installer-lifecycle.mjs');
+const DRIVER_TIMEOUT_MILLISECONDS = 60_000;
+
+ test('the installer lifecycle driver completes in an isolated home', () => {
+    const lifecycleProcess = spawnSync(process.execPath, [DRIVER_PATH], {
+        encoding: 'utf8',
+        timeout: DRIVER_TIMEOUT_MILLISECONDS,
+    });
+    assert.equal(lifecycleProcess.status, 0, `${lifecycleProcess.stdout}\n${lifecycleProcess.stderr}`);
+    assert.match(lifecycleProcess.stdout, /ALL CHECKS PASSED/);
+    assert.match(lifecycleProcess.stdout, /Sandbox removed:/);
+});
+
+test('the Windows adapter invokes the CI-owned lifecycle driver', () => {
+    const adapterSource = readFileSync(join(CI_DIRECTORY, 'windows-installer-lifecycle.ps1'), 'utf8');
+    assert.match(adapterSource, /\$driverPath = Join-Path \$PSScriptRoot 'installer-lifecycle\.mjs'/);
+    assert.doesNotMatch(adapterSource, /skills\\run-claude-dev-env/);
+});

package/scripts/ci/windows-installer-lifecycle.ps1

@@ -1,13 +1,3 @@
-# Windows CI adapter for the Node installer lifecycle driver.
-#
-# The driver already redirects HOME, USERPROFILE, and GIT_CONFIG_GLOBAL into a
-# throwaway sandbox. This adapter records that isolation contract, runs the
-# 16-check driver, and writes bounded evidence under -EvidenceRoot so a failed
-# Windows runner leaves an actionable artifact.
-#
-# Usage (from packages/claude-dev-env):
-#   pwsh -NoProfile -File scripts/ci/windows-installer-lifecycle.ps1 -EvidenceRoot <dir>
-
 [CmdletBinding()]
 param(
     [Parameter(Mandatory = $true)]
@@ -17,7 +7,7 @@ param(
 $ErrorActionPreference = 'Stop'
 
 $packageRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
-$driverPath = Join-Path $packageRoot '.claude\skills\run-claude-dev-env\driver.mjs'
+$driverPath = Join-Path $PSScriptRoot 'installer-lifecycle.mjs'
 $allIsolationEnvNames = @(
     'HOME',
     'USERPROFILE',

package/scripts/dev_env_scripts_constants/shared_tree_constants.py

@@ -1,8 +1,4 @@
-"""Constants for resolving directories inside the installed shared tree.
-
-These name the shape of the installed tree itself, not any one worker or
-skill that reads it, so every caller of shared_tree_paths shares them.
-"""
+"""Directory names for the installed shared tree."""
 
 from __future__ import annotations
 
@@ -15,3 +11,6 @@ SCRIPTS_DIRECTORY_NAME: str = "scripts"
 PROCESS_TREE_DIRECTORY_NAME: str = "process-tree"
 
 PROCESS_TREE_KILL_MODULE_FILENAME: str = "process_tree_kill.py"
+
+AGENTS_DIRECTORY_SUFFIX: str = ".agents"
+DEFAULT_MANAGED_ROOT_NAME: str = ".claude"

package/scripts/durable_post_lint.py

@@ -0,0 +1,206 @@
+"""Validate durable GitHub post inputs before publication."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from collections.abc import Sequence
+from dataclasses import dataclass
+from pathlib import Path
+
+from durable_post_lint_config.config.constants import (
+    ACTION_PR_CREATE,
+    ACTION_PR_EDIT,
+    ALL_BARE_VOLATILE_PATH_MARKERS,
+    ALL_BODY_REQUIRED_ACTIONS,
+    ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS,
+    ALL_POST_ACTIONS,
+    ALL_PR_DESCRIPTION_ACTIONS,
+    ALL_REQUIRED_PR_DESCRIPTION_HEADINGS,
+    ALL_TITLE_ACTIONS,
+    BODY_FILE_ENCODING,
+    BODY_FILE_UNREADABLE_MESSAGE,
+    BODY_MUST_NOT_BE_EMPTY_MESSAGE,
+    BODY_REQUIRED_MESSAGE,
+    CLEAN_EXIT_CODE,
+    CONTENT_FINDING_EXIT_CODE,
+    CONVENTIONAL_TITLE_PATTERN,
+    EDIT_INPUT_REQUIRED_MESSAGE,
+    EMPTY_BODY_CODE,
+    INPUT_ERROR_EXIT_CODE,
+    INVALID_ACTION_MESSAGE,
+    INVALID_TITLE_CODE,
+    INVALID_TITLE_MESSAGE,
+    MISSING_HEADING_CODE,
+    MISSING_HEADING_MESSAGE_TEMPLATE,
+    PATH_ANCHOR_CHARACTER,
+    PATH_SEGMENT_START_CHARACTERS,
+    TITLE_NOT_ALLOWED_MESSAGE,
+    TITLE_REQUIRED_MESSAGE,
+    VOLATILE_PATH_CODE,
+    VOLATILE_PATH_MESSAGE,
+)
+
+
+class DurablePostUsageError(ValueError):
+    """Report an invalid GitHub post request shape."""
+
+
+class DurablePostInputError(OSError):
+    """Report an unreadable GitHub post input file."""
+
+
+@dataclass(frozen=True)
+class DurablePostFinding:
+    """One GitHub post content finding."""
+
+    code: str
+    message: str
+
+
+def _character_starts_path_segment(character: str) -> bool:
+    return bool(character) and (
+        character.isalnum() or character in PATH_SEGMENT_START_CHARACTERS
+    )
+
+
+def _text_has_anchored_marker(normalized_text: str, marker: str) -> bool:
+    search_start = 0
+    while True:
+        found_index = normalized_text.find(marker, search_start)
+        if found_index < 0:
+            return False
+        preceding_character = normalized_text[found_index - 1 : found_index]
+        following_index = found_index + len(marker)
+        following_character = normalized_text[following_index : following_index + 1]
+        if (
+            preceding_character == PATH_ANCHOR_CHARACTER
+            or _character_starts_path_segment(following_character)
+        ):
+            return True
+        search_start = found_index + 1
+
+
+def find_volatile_path_marker(body_text: str) -> str | None:
+    """Return the first volatile path marker in a GitHub post body."""
+    normalized_text = body_text.replace("\\", PATH_ANCHOR_CHARACTER).lower()
+    for each_marker in ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS:
+        if _text_has_anchored_marker(normalized_text, each_marker):
+            return each_marker
+    for each_marker in ALL_BARE_VOLATILE_PATH_MARKERS:
+        if each_marker in normalized_text:
+            return each_marker
+    return None
+
+
+def read_body_file(body_file: Path) -> str:
+    """Read one UTF-8 body file without exposing its contents on failure."""
+    try:
+        return body_file.read_text(encoding=BODY_FILE_ENCODING)
+    except (OSError, UnicodeError) as error:
+        raise DurablePostInputError(BODY_FILE_UNREADABLE_MESSAGE) from error
+
+
+def _validate_request_shape(
+    action: str,
+    title: str | None,
+    body_text: str | None,
+) -> None:
+    if action not in ALL_POST_ACTIONS:
+        raise DurablePostUsageError(INVALID_ACTION_MESSAGE)
+    if action in ALL_BODY_REQUIRED_ACTIONS and body_text is None:
+        raise DurablePostUsageError(BODY_REQUIRED_MESSAGE)
+    if action == ACTION_PR_CREATE and not title:
+        raise DurablePostUsageError(TITLE_REQUIRED_MESSAGE)
+    if action == ACTION_PR_EDIT and title is None and body_text is None:
+        raise DurablePostUsageError(EDIT_INPUT_REQUIRED_MESSAGE)
+    if title is not None and action not in ALL_TITLE_ACTIONS:
+        raise DurablePostUsageError(TITLE_NOT_ALLOWED_MESSAGE)
+
+
+def _description_heading_findings(body_text: str) -> list[DurablePostFinding]:
+    all_body_lines = {each_line.strip() for each_line in body_text.splitlines()}
+    return [
+        DurablePostFinding(
+            code=MISSING_HEADING_CODE,
+            message=MISSING_HEADING_MESSAGE_TEMPLATE.format(heading=each_heading),
+        )
+        for each_heading in ALL_REQUIRED_PR_DESCRIPTION_HEADINGS
+        if f"## {each_heading}" not in all_body_lines
+    ]
+
+
+def _title_findings(title: str | None) -> list[DurablePostFinding]:
+    if title is None or CONVENTIONAL_TITLE_PATTERN.fullmatch(title) is not None:
+        return []
+    return [DurablePostFinding(code=INVALID_TITLE_CODE, message=INVALID_TITLE_MESSAGE)]
+
+
+def _body_findings(
+    action: str,
+    body_text: str | None,
+) -> list[DurablePostFinding]:
+    if body_text is None:
+        return []
+    all_findings: list[DurablePostFinding] = []
+    if not body_text.strip():
+        all_findings.append(
+            DurablePostFinding(
+                code=EMPTY_BODY_CODE,
+                message=BODY_MUST_NOT_BE_EMPTY_MESSAGE,
+            )
+        )
+    if action in ALL_PR_DESCRIPTION_ACTIONS:
+        all_findings.extend(_description_heading_findings(body_text))
+    if find_volatile_path_marker(body_text) is not None:
+        all_findings.append(
+            DurablePostFinding(
+                code=VOLATILE_PATH_CODE,
+                message=VOLATILE_PATH_MESSAGE,
+            )
+        )
+    return all_findings
+
+
+def lint_durable_post(
+    action: str,
+    title: str | None,
+    body_text: str | None,
+) -> tuple[DurablePostFinding, ...]:
+    """Return content findings for one locally valid GitHub post request."""
+    _validate_request_shape(action, title, body_text)
+    return (*_title_findings(title), *_body_findings(action, body_text))
+
+
+def _parse_arguments(all_arguments: Sequence[str]) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    parser.add_argument("--action", required=True)
+    parser.add_argument("--title")
+    parser.add_argument("--body-file", type=Path)
+    return parser.parse_args(list(all_arguments))
+
+
+def main(all_arguments: Sequence[str]) -> int:
+    """Validate one GitHub post and return its result status."""
+    arguments = _parse_arguments(all_arguments)
+    try:
+        body_text = (
+            read_body_file(arguments.body_file)
+            if arguments.body_file is not None
+            else None
+        )
+        all_findings = lint_durable_post(
+            action=arguments.action,
+            title=arguments.title,
+            body_text=body_text,
+        )
+    except (DurablePostInputError, DurablePostUsageError) as error:
+        sys.stderr.write(f"{error}\n")
+        return INPUT_ERROR_EXIT_CODE
+    for each_finding in all_findings:
+        sys.stderr.write(f"{each_finding.message}\n")
+    return CONTENT_FINDING_EXIT_CODE if all_findings else CLEAN_EXIT_CODE
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

package/scripts/durable_post_lint_config/config/constants.py

@@ -0,0 +1,96 @@
+"""Configuration constants for durable GitHub post validation."""
+
+import re
+
+ACTION_GITHUB_MCP_POST = "github-mcp-post"
+ACTION_ISSUE_COMMENT = "issue-comment"
+ACTION_ISSUE_CREATE = "issue-create"
+ACTION_ISSUE_EDIT = "issue-edit"
+ACTION_PR_COMMENT = "pr-comment"
+ACTION_PR_CREATE = "pr-create"
+ACTION_PR_EDIT = "pr-edit"
+ACTION_PR_REVIEW = "pr-review"
+
+ALL_POST_ACTIONS: frozenset[str] = frozenset(
+    {
+        ACTION_GITHUB_MCP_POST,
+        ACTION_ISSUE_COMMENT,
+        ACTION_ISSUE_CREATE,
+        ACTION_ISSUE_EDIT,
+        ACTION_PR_COMMENT,
+        ACTION_PR_CREATE,
+        ACTION_PR_EDIT,
+        ACTION_PR_REVIEW,
+    }
+)
+ALL_BODY_REQUIRED_ACTIONS: frozenset[str] = frozenset(
+    {
+        ACTION_GITHUB_MCP_POST,
+        ACTION_ISSUE_COMMENT,
+        ACTION_ISSUE_CREATE,
+        ACTION_ISSUE_EDIT,
+        ACTION_PR_COMMENT,
+        ACTION_PR_CREATE,
+        ACTION_PR_REVIEW,
+    }
+)
+ALL_PR_DESCRIPTION_ACTIONS: frozenset[str] = frozenset(
+    {ACTION_PR_CREATE, ACTION_PR_EDIT}
+)
+ALL_TITLE_ACTIONS: frozenset[str] = frozenset({ACTION_PR_CREATE, ACTION_PR_EDIT})
+ALL_CONVENTIONAL_TITLE_TYPES: tuple[str, ...] = (
+    "build",
+    "chore",
+    "ci",
+    "docs",
+    "feat",
+    "fix",
+    "perf",
+    "refactor",
+    "revert",
+    "style",
+    "test",
+)
+CONVENTIONAL_TITLE_PATTERN: re.Pattern[str] = re.compile(
+    rf"^(?:{'|'.join(ALL_CONVENTIONAL_TITLE_TYPES)})(?:\([^)\r\n]+\))?!?: [^\s].*$"
+)
+ALL_REQUIRED_PR_DESCRIPTION_HEADINGS: tuple[str, ...] = (
+    "Summary",
+    "Description",
+    "Why",
+    "How",
+    "Verification",
+)
+ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS: tuple[str, ...] = (
+    ".claude-profile-a/jobs/",
+    ".claude/worktrees/",
+)
+ALL_BARE_VOLATILE_PATH_MARKERS: tuple[str, ...] = (
+    "appdata/local/temp",
+    "/tmp/",
+    "%temp%",
+    "$env:temp",
+    "$claude_job_dir",
+)
+BODY_FILE_ENCODING = "utf-8"
+CLEAN_EXIT_CODE = 0
+CONTENT_FINDING_EXIT_CODE = 1
+EMPTY_BODY_CODE = "empty-body"
+INPUT_ERROR_EXIT_CODE = 2
+PATH_ANCHOR_CHARACTER = "/"
+PATH_SEGMENT_START_CHARACTERS = "_-"
+BODY_FILE_UNREADABLE_MESSAGE = "body file is not readable UTF-8 text"
+BODY_REQUIRED_MESSAGE = "this action requires a body file"
+BODY_MUST_NOT_BE_EMPTY_MESSAGE = "body file must contain text"
+EDIT_INPUT_REQUIRED_MESSAGE = "pr-edit requires a title or body file"
+INVALID_ACTION_MESSAGE = "unsupported durable post action"
+INVALID_TITLE_CODE = "invalid-pr-title"
+INVALID_TITLE_MESSAGE = (
+    "pull request title does not use the repository Conventional Commit form"
+)
+MISSING_HEADING_CODE = "missing-pr-description-heading"
+MISSING_HEADING_MESSAGE_TEMPLATE = "body is missing required heading: {heading}"
+TITLE_NOT_ALLOWED_MESSAGE = "this action does not accept a title"
+TITLE_REQUIRED_MESSAGE = "pr-create requires a title"
+VOLATILE_PATH_CODE = "volatile-local-path"
+VOLATILE_PATH_MESSAGE = "body contains a volatile local artifact path"

package/scripts/durable_post_lint_config/config/test_constants.py

@@ -0,0 +1,25 @@
+"""Tests for durable GitHub post linter constants."""
+
+from durable_post_lint_config.config.constants import (
+    ALL_CONVENTIONAL_TITLE_TYPES,
+    ALL_POST_ACTIONS,
+    CONVENTIONAL_TITLE_PATTERN,
+)
+
+
+def test_action_inventory_covers_pull_request_issue_and_tool_posts() -> None:
+    assert ALL_POST_ACTIONS == {
+        "github-mcp-post",
+        "issue-comment",
+        "issue-create",
+        "issue-edit",
+        "pr-comment",
+        "pr-create",
+        "pr-edit",
+        "pr-review",
+    }
+
+
+def test_title_pattern_uses_every_configured_type() -> None:
+    for each_title_type in ALL_CONVENTIONAL_TITLE_TYPES:
+        assert CONVENTIONAL_TITLE_PATTERN.fullmatch(f"{each_title_type}: one change")

package/scripts/policy_lint/adapter_configuration.py

@@ -23,30 +23,69 @@ def hook_configuration_diagnostics(
     adapter_support._document_path(repository_root, document)
     if document.path.name != "hooks.json":
         return ()
-    all_messages = _hook_configuration_messages(document.text)
+    all_messages = _hook_configuration_messages(document.text, document.prior_text)
     return adapter_support._diagnostics_for_messages(
         document, "hook-configuration", all_messages
     )
 
 
-def _hook_configuration_messages(configuration_text: str) -> tuple[str, ...]:
+def _parsed_configuration(
+    configuration_text: str,
+    invalid_json_message: str,
+    invalid_object_message: str,
+) -> dict[object, object]:
     try:
         parsed_configuration = json.loads(configuration_text)
-    except json.JSONDecodeError:
-        return ("Hook configuration is not valid JSON",)
+    except json.JSONDecodeError as error:
+        raise ValueError(invalid_json_message) from error
     if not isinstance(parsed_configuration, dict):
-        return ("Hook configuration must be an object",)
-    all_registered_strings = _registered_hook_strings(parsed_configuration)
-    if any(
-        _contains_action_boundary_marker(each_string)
-        for each_string in all_registered_strings
-    ):
+        raise TypeError(invalid_object_message)
+    return parsed_configuration
+
+
+def _action_boundary_strings(
+    all_configuration_entries: dict[object, object],
+) -> frozenset[str]:
+    return frozenset(
+        each_string
+        for each_string in _registered_hook_strings(all_configuration_entries)
+        if _contains_action_boundary_marker(each_string)
+    )
+
+
+def _hook_configuration_messages(
+    configuration_text: str,
+    prior_configuration_text: str | None,
+) -> tuple[str, ...]:
+    try:
+        current_configuration = _parsed_configuration(
+            configuration_text,
+            "Hook configuration is not valid JSON",
+            "Hook configuration must be an object",
+        )
+        all_current_action_boundary_strings = _action_boundary_strings(
+            current_configuration
+        )
+        if prior_configuration_text is None:
+            all_prior_action_boundary_strings: frozenset[str] = frozenset()
+        else:
+            prior_configuration = _parsed_configuration(
+                prior_configuration_text,
+                "Prior hook configuration is not valid JSON",
+                "Prior hook configuration must be an object",
+            )
+            all_prior_action_boundary_strings = _action_boundary_strings(
+                prior_configuration
+            )
+    except (TypeError, ValueError) as error:
+        return (str(error),)
+    if all_current_action_boundary_strings - all_prior_action_boundary_strings:
         return ("Hook configuration registers a deny, block, or ask policy path",)
     return ()
 
 
 def _registered_hook_strings(
-    all_configuration_entries: dict[object, object]
+    all_configuration_entries: dict[object, object],
 ) -> tuple[str, ...]:
     all_registered_strings: list[str] = []
     for each_key, each_entry in all_configuration_entries.items():
@@ -62,7 +101,9 @@ def _registered_strings_for_entry(
     all_registered_strings: list[str] = []
     if each_key in constants.ALL_HOOK_REGISTRATION_KEYS and isinstance(each_entry, str):
         all_registered_strings.append(each_entry)
-    if each_key in constants.ALL_DECISION_REGISTRATION_KEYS and isinstance(each_entry, str):
+    if each_key in constants.ALL_DECISION_REGISTRATION_KEYS and isinstance(
+        each_entry, str
+    ):
         all_registered_strings.append(each_entry)
     all_registered_strings.extend(_registered_nested_strings(each_entry))
     return tuple(all_registered_strings)

package/scripts/policy_lint/adapter_detectors.py

@@ -29,24 +29,31 @@ def terminology_diagnostics(
     document_set: DocumentSet,
     load_module: adapter_support.HookModuleLoader,
 ) -> tuple[Diagnostic, ...]:
-    """Report staged prose that near-misses a newly introduced identifier.
+    """Report prose that near-misses a newly introduced identifier.
 
     Args:
-        document_set: Candidate staged documents and repository root.
+        document_set: Staged or base change selection and repository root.
         load_module: Shared script module loader.
 
     Returns:
         Diagnostics that name the prose file and line.
     """
-    if document_set.selection is not SelectionKind.STAGED:
+    all_arguments: tuple[Path | str, ...]
+    if document_set.selection is SelectionKind.BASE:
+        if document_set.base_revision is None:
+            raise ValueError("Base selection is missing its comparison revision")
+        checker_name = "strict_base_terminology_findings"
+        all_arguments = (document_set.repository_root, document_set.base_revision)
+    elif document_set.selection is SelectionKind.STAGED:
+        checker_name = "strict_staged_terminology_findings"
+        all_arguments = (document_set.repository_root,)
+    else:
         return ()
     terminology_module = load_module(constants.TERMINOLOGY_SWEEP_MODULE_NAME)
     helper_stdout = StringIO()
     helper_stderr = StringIO()
     with redirect_stdout(helper_stdout), redirect_stderr(helper_stderr):
-        all_findings = terminology_module.strict_staged_terminology_findings(
-            document_set.repository_root
-        )
+        all_findings = getattr(terminology_module, checker_name)(*all_arguments)
     return tuple(_terminology_diagnostic(each_finding) for each_finding in all_findings)
 
 

package/scripts/policy_lint/adapters.py

@@ -1,10 +1,13 @@
 from __future__ import annotations
 
 import importlib
+import os
 import sys
 from pathlib import Path
 from types import ModuleType
 
+from shared_tree_paths import resolve_shared_scripts_directory
+
 from . import adapter_configuration, adapter_detectors, adapter_pairing, adapter_support
 from .config import constants
 from .model import Diagnostic, Document, DocumentSet
@@ -24,10 +27,10 @@ def _hooks_module(module_name: str) -> ModuleType:
 
 
 def _pr_loop_script_module(module_name: str) -> ModuleType:
-    package_directory = Path(__file__).resolve().parent.parent.parent
-    scripts_directory = str(
-        package_directory.joinpath(*constants.ALL_PR_LOOP_SCRIPTS_PATH_SEGMENTS)
-    )
+    scripts_directory = str(resolve_shared_scripts_directory(
+        __file__, os.environ, constants.PR_LOOP_DIRECTORY_NAME,
+        f"{module_name}{constants.PYTHON_SUFFIX}", constants.SHARED_ROOT_PARENT_INDEX
+    ))
     if scripts_directory not in sys.path:
         sys.path.insert(0, scripts_directory)
     return importlib.import_module(module_name)

package/scripts/policy_lint/config/constants.py

@@ -5,6 +5,7 @@ INVALID_INPUT_EXIT_CODE = 2
 GIT_EXECUTABLE = "git"
 UTF8_ENCODING = "utf-8"
 PATH_SEPARATOR = "/"
+ARCHIVED_SKILLS_DIRECTORY_NAME = "skill-archive"
 NUL_BYTE = b"\0"
 ALL_GIT_ROOT_ARGUMENTS = ("rev-parse", "--show-toplevel")
 ALL_GIT_HEAD_ARGUMENTS = ("rev-parse", "--verify", "HEAD")
@@ -13,6 +14,7 @@ GIT_MERGE_BASE_ARGUMENT = "merge-base"
 GIT_HEAD_REFERENCE = "HEAD"
 GIT_INDEX_REFERENCE_PREFIX = ""
 GIT_ENVIRONMENT_VARIABLE_PREFIX = "GIT_"
+GIT_INDEX_ENVIRONMENT_VARIABLE = "GIT_INDEX_FILE"
 ALL_GIT_BLOB_ARGUMENTS = ("cat-file", "blob")
 ALL_MISSING_BLOB_ERROR_FRAGMENTS = (
     "does not exist in",
@@ -75,3 +77,6 @@ TERMINOLOGY_FINDING_PATTERN = re.compile(
 TERMINOLOGY_PATH_GROUP = "path"
 TERMINOLOGY_LINE_NUMBER_GROUP = "line_number"
 TERMINOLOGY_MESSAGE_GROUP = "message"
+
+PR_LOOP_DIRECTORY_NAME = "pr-loop"
+SHARED_ROOT_PARENT_INDEX = 2

package/scripts/policy_lint/engine.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 
 from collections.abc import Iterable, Sequence
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 
+from .config.constants import ARCHIVED_SKILLS_DIRECTORY_NAME
 from .model import (
     ChangeSetRule,
     Diagnostic,
@@ -25,6 +26,9 @@ def lint(
 ) -> LintReport:
     """Run the selected rules on one source selection.
 
+    Repository and diff selections check active code. File and editor
+    selections include archived skills.
+
     Args:
         request: Repository root, source, and rule sets.
         all_registry: Optional registry replacement.
@@ -32,10 +36,14 @@ def lint(
     Returns:
         A report of diagnostics and rule execution state.
     """
-    document_set = select_documents(request)
-    candidate_rules = tuple(all_registry) if all_registry is not None else default_registry()
+    document_set = _runtime_document_set(select_documents(request))
+    candidate_rules = (
+        tuple(all_registry) if all_registry is not None else default_registry()
+    )
     selected = selected_rules(candidate_rules, request.rule_sets)
-    all_diagnostics, executed, failed, skipped = _run_selected_rules(selected, document_set)
+    all_diagnostics, executed, failed, skipped = _run_selected_rules(
+        selected, document_set
+    )
     return LintReport(
         1,
         tuple(sorted(all_diagnostics, key=_diagnostic_sort_key)),
@@ -46,6 +54,42 @@ def lint(
     )
 
 
+def _is_runtime_path(path: PurePosixPath) -> bool:
+    return path.parts[0] != ARCHIVED_SKILLS_DIRECTORY_NAME
+
+
+def _runtime_document_set(document_set: DocumentSet) -> DocumentSet:
+    if document_set.selection in {SelectionKind.FILES, SelectionKind.TEXT}:
+        return document_set
+    all_documents = tuple(
+        each_document
+        for each_document in document_set.documents
+        if _is_runtime_path(each_document.path)
+    )
+    all_deleted_paths = tuple(
+        each_path
+        for each_path in document_set.deleted_paths
+        if _is_runtime_path(each_path)
+    ) + tuple(
+        old_path
+        for old_path, new_path in document_set.renamed_paths
+        if _is_runtime_path(old_path) and not _is_runtime_path(new_path)
+    )
+    all_renamed_paths = tuple(
+        each_pair
+        for each_pair in document_set.renamed_paths
+        if _is_runtime_path(each_pair[1])
+    )
+    return DocumentSet(
+        all_documents,
+        document_set.selection,
+        document_set.repository_root,
+        all_deleted_paths,
+        all_renamed_paths,
+        document_set.base_revision,
+    )
+
+
 def _run_selected_rules(
     all_rules: tuple[Rule, ...], document_set: DocumentSet
 ) -> tuple[list[Diagnostic], tuple[str, ...], tuple[str, ...], tuple[str, ...]]:

package/scripts/policy_lint/model.py

@@ -106,6 +106,7 @@ class DocumentSet:
     repository_root: Path
     deleted_paths: tuple[PurePosixPath, ...] = ()
     renamed_paths: tuple[tuple[PurePosixPath, PurePosixPath], ...] = ()
+    base_revision: str | None = None
 
 
 @dataclass(frozen=True)

package/scripts/policy_lint/registry.py

@@ -141,7 +141,7 @@ def default_registry() -> tuple[model.Rule, ...]:
         model.ChangeSetRule(
             "terminology-sweep",
             frozenset({"changed"}),
-            frozenset({model.SelectionKind.STAGED}),
+            frozenset({model.SelectionKind.STAGED, model.SelectionKind.BASE}),
             adapters.terminology_diagnostics,
         ),
         model.RepositoryRule(