claude-dev-env 4.3.0 → 7.0.0

package/hooks/hooks_constants/pre_tool_use_dispatcher_constants.py

@@ -1,8 +1,9 @@
 """Constants for the PreToolUse dispatcher that hosts Write/Edit/MultiEdit hooks.
 
-Holds the ordered hosted-hook list with per-hook applicable-tool sets, the
-special exit codes, the deny decision string, and the hook-event name. The
-dispatcher imports each of these by name.
+The roster keeps action-boundary checks, repository checks, and checks without
+a proven local replacement. File-policy rules with a staged replacement run
+through cde lint in native pre-commit. Their detectors stay importable for that
+linter. Bash cleanup protection uses its own roster.
 """
 
 from __future__ import annotations
@@ -55,14 +56,10 @@ ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES: frozenset[str] = frozenset(
     ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES | {APPLY_PATCH_TOOL_NAME}
 )
 
-# apply_patch reaches this narrower roster: the gates whose miss causes immediate
-# harm, plus the TDD gate and the edit tracker. It stays off the full lint surface.
 ALL_IMMEDIATE_HARM_SCRIPT_PATHS: tuple[str, ...] = (
     "blocking/pii_prevention_blocker.py",
     "blocking/sensitive_file_protector.py",
     "blocking/write_existing_file_blocker.py",
-    "blocking/code_rules_enforcer.py",
-    "blocking/tdd_enforcer.py",
 )
 
 
@@ -71,19 +68,18 @@ STATE_DESCRIPTION_BLOCKER_MODULE_NAME = "state_description_blocker"
 
 @dataclass(frozen=True)
 class HostedHookEntry:
-    """A single hosted hook with its applicable-tools constraint and blocking flag.
+    """One hosted hook, the tools it applies to, and whether a crash blocks.
 
     Attributes:
         script_relative_path: Hook path relative to the hooks/ directory.
         applicable_tool_names: Tool names this hook applies to. The dispatcher
             skips the hook when the payload's tool is not in this set.
-        is_blocking: True when a crash surfaces a blocking signal; False when the
+        is_blocking: True when a crash is a blocking signal. False when the
             hook is advisory and a crash stays silent.
-        native_module_name: The importable module name whose evaluate function
-            the dispatcher calls in-process for this hook, or None when the hook
-            runs via runpy under __main__. The named module exposes a function
-            named `evaluate` taking the payload dict and returning a deny-reason
-            string or None.
+        native_module_name: Importable module whose evaluate function the
+            dispatcher calls in-process, or None when the hook runs via runpy
+            under __main__. evaluate takes the payload dict and returns a
+            deny-reason string or None.
     """
 
     script_relative_path: str
@@ -109,39 +105,10 @@ ALL_HOSTED_HOOK_ENTRIES: tuple[HostedHookEntry, ...] = (
         script_relative_path="validation/hook_format_validator.py",
         applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
     ),
-    HostedHookEntry(
-        script_relative_path="blocking/code_rules_enforcer.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/tdd_enforcer.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/windows_rmtree_blocker.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-    ),
     HostedHookEntry(
         script_relative_path="blocking/duplicate_rmtree_helper_blocker.py",
         applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
     ),
-    HostedHookEntry(
-        script_relative_path="blocking/state_description_blocker.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-        native_module_name=STATE_DESCRIPTION_BLOCKER_MODULE_NAME,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/subprocess_budget_completeness.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/hook_prose_detector_consistency.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-    ),
-    HostedHookEntry(
-        script_relative_path="blocking/workflow_substitution_slot_blocker.py",
-        applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-    ),
     HostedHookEntry(
         script_relative_path="blocking/claude_md_orphan_file_blocker.py",
         applicable_tool_names=ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,

package/hooks/hooks_constants/test_bash_post_call_dispatcher_constants.py

@@ -1,16 +1,33 @@
 """Behavioral tests for the Bash PostToolUse dispatcher's hosted-hook roster."""
 
+from hooks_constants import bash_post_call_dispatcher_constants as constants
 from hooks_constants.bash_post_call_dispatcher_constants import (
     ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES,
 )
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import BASH_TOOL_NAME
 
 
-def test_roster_names_the_test_failure_recorder_hook() -> None:
+def test_roster_runs_the_recorder_then_the_pr_done_reminder() -> None:
     all_script_paths = [
         each_entry.script_relative_path for each_entry in ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES
     ]
-    assert "observability/test_failure_recorder.py" in all_script_paths
+    assert all_script_paths == [
+        "observability/test_failure_recorder.py",
+        "advisory/pr_done_reminder.py",
+    ]
+
+
+def test_pr_done_reminder_also_serves_the_powershell_tool() -> None:
+    reminder_entry = ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES[-1]
+    assert reminder_entry.script_relative_path == "advisory/pr_done_reminder.py"
+    assert "PowerShell" in reminder_entry.applicable_tool_names
+
+
+def test_context_forwarding_keys_match_the_hook_output_contract() -> None:
+    assert constants.POST_TOOL_USE_HOOK_EVENT_NAME == "PostToolUse"
+    assert constants.HOOK_SPECIFIC_OUTPUT_KEY == "hookSpecificOutput"
+    assert constants.ADDITIONAL_CONTEXT_KEY == "additionalContext"
+    assert constants.ADDITIONAL_CONTEXT_JOIN_SEPARATOR == "\n\n"
 
 
 def test_every_roster_entry_applies_to_bash() -> None:

package/hooks/hooks_constants/test_pr_done_reminder_constants.py

@@ -0,0 +1,40 @@
+"""Pin the PR done reminder's command shape and checklist wording."""
+
+from __future__ import annotations
+
+from hooks_constants import pr_done_reminder_constants as constants
+
+
+def test_gh_probe_asks_for_every_field_the_checklist_reads() -> None:
+    assert constants.ALL_GH_PR_VIEW_ARGUMENTS[:3] == ("gh", "pr", "view")
+    all_requested_fields = constants.ALL_GH_PR_VIEW_ARGUMENTS[-1].split(",")
+    for each_field in ("number", "url", "isDraft", "mergeable", "statusCheckRollup", "labels"):
+        assert each_field in all_requested_fields
+
+
+def test_git_global_options_that_take_a_value_are_named() -> None:
+    assert constants.ALL_GIT_OPTIONS_WITH_VALUE == frozenset({"-C", "-c"})
+
+
+def test_powershell_wrappers_and_their_command_flags_are_named() -> None:
+    assert "pwsh" in constants.ALL_POWERSHELL_PROGRAM_NAMES
+    assert "powershell" in constants.ALL_POWERSHELL_PROGRAM_NAMES
+    assert "-command" in constants.ALL_POWERSHELL_COMMAND_FLAGS
+    assert "-c" in constants.ALL_POWERSHELL_COMMAND_FLAGS
+
+
+def test_checklist_lines_join_on_a_single_newline() -> None:
+    assert constants.REMINDER_LINE_SEPARATOR == "\n"
+
+
+def test_every_mergeable_value_has_a_hint() -> None:
+    assert set(constants.ALL_REMINDER_HINTS_BY_MERGEABLE) == {
+        constants.MERGEABLE_CLEAN_VALUE,
+        constants.MERGEABLE_CONFLICTING_VALUE,
+        constants.MERGEABLE_UNKNOWN_VALUE,
+    }
+
+
+def test_header_says_it_never_blocks() -> None:
+    assert "never a block" in constants.REMINDER_HEADER
+    assert "never a block" in constants.NO_PULL_REQUEST_REMINDER

package/hooks/hooks_constants/test_pre_tool_use_dispatcher_constants.py

@@ -13,6 +13,9 @@ try:
     if str(_BLOCKING_DIR) not in sys.path:
         sys.path.insert(0, str(_BLOCKING_DIR))
 
+    from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
+        ALL_BASH_HOSTED_HOOK_ENTRIES,
+    )
     from hooks_constants.pre_tool_use_dispatcher_constants import (
         ALL_HOSTED_HOOK_ENTRIES,
         ALL_IMMEDIATE_HARM_SCRIPT_PATHS,
@@ -74,10 +77,12 @@ def test_duplicate_rmtree_helper_blocker_runs_via_runpy() -> None:
     assert entry.native_module_name is None
 
 
-def test_windows_rmtree_blocker_still_registered() -> None:
-    entry = _entry_for("blocking/windows_rmtree_blocker.py")
-    assert entry is not None
-    assert entry.applicable_tool_names == ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES
+def test_windows_rmtree_write_check_is_retired_but_bash_check_remains() -> None:
+    assert _entry_for("blocking/windows_rmtree_blocker.py") is None
+    all_bash_paths = {
+        each_entry.script_relative_path for each_entry in ALL_BASH_HOSTED_HOOK_ENTRIES
+    }
+    assert "blocking/windows_rmtree_blocker.py" in all_bash_paths
 
 
 def test_blocking_hook_crash_deny_reason_surfaces_the_constant() -> None:
@@ -119,22 +124,11 @@ def test_every_hosted_script_path_exists_under_the_hooks_root() -> None:
         )
 
 
-def test_every_native_module_exposes_a_callable_evaluate() -> None:
-    nativized_entries = [
-        each_entry
-        for each_entry in ALL_HOSTED_HOOK_ENTRIES
-        if each_entry.native_module_name is not None
-    ]
-    assert nativized_entries, (
-        "the roster must carry at least one nativized hook for this test to lock the contract"
-    )
-    for each_entry in nativized_entries:
-        native_module = importlib.import_module(each_entry.native_module_name)
-        evaluate_function = getattr(native_module, "evaluate", None)
-        assert callable(evaluate_function), (
-            f"{each_entry.native_module_name} must expose a callable named evaluate, "
-            "matching the native_module_name docstring contract"
-        )
+def test_retired_native_detector_keeps_its_callable_linter_interface() -> None:
+    native_module = importlib.import_module("state_description_blocker")
+    assert native_module.find_violations("The API uses port 8080.", "guide.md") == []
+    assert native_module.find_violations("Previously set via env var.", "guide.md")
+    assert all(each_entry.native_module_name is None for each_entry in ALL_HOSTED_HOOK_ENTRIES)
 
 
 def test_four_way_set_covers_every_mutation_tool_name() -> None:
@@ -144,7 +138,7 @@ def test_four_way_set_covers_every_mutation_tool_name() -> None:
 
 
 def test_immediate_harm_hooks_reach_apply_patch() -> None:
-    """PII, sensitive-path, existing-file, CODE_RULES, and TDD gates all see apply_patch."""
+    """PII, sensitive-path, and existing-file checks retain apply_patch coverage."""
     for each_script_path in ALL_IMMEDIATE_HARM_SCRIPT_PATHS:
         entry = _entry_for(each_script_path)
         assert entry is not None, f"{each_script_path} must stay on the hosted roster"
@@ -154,8 +148,6 @@ def test_immediate_harm_hooks_reach_apply_patch() -> None:
 
 
 _ALL_DEFERRED_LINT_SCRIPT_PATHS = (
-    "blocking/state_description_blocker.py",
-    "blocking/workflow_substitution_slot_blocker.py",
     "blocking/claude_md_orphan_file_blocker.py",
     "blocking/package_inventory_stale_blocker.py",
     "blocking/env_var_table_code_drift_blocker.py",
@@ -164,9 +156,6 @@ _ALL_DEFERRED_LINT_SCRIPT_PATHS = (
     "blocking/docstring_rule_gate_count_blocker.py",
     "blocking/duplicate_rmtree_helper_blocker.py",
     "validation/hook_format_validator.py",
-    "blocking/hook_prose_detector_consistency.py",
-    "blocking/subprocess_budget_completeness.py",
-    "blocking/windows_rmtree_blocker.py",
     "advisory/refactor_guard.py",
     "advisory/migration_safety_advisor.py",
 )
@@ -177,7 +166,7 @@ def test_lint_and_advisory_hooks_stay_off_the_apply_patch_roster() -> None:
 
     apply_patch reaches only a gate whose violation is already real and
     unrecoverable the moment the call returns: a leaked secret, an exposed
-    sensitive path, a blind overwrite, or an untested change landing. Every
+    sensitive path, or a blind overwrite. Every
     hook named here instead judges the quality of the authored content for a
     consequence the write itself does not cause right now: doc-inventory
     drift, prose or naming style, a future-runtime correctness pattern (an
@@ -225,13 +214,12 @@ def test_edit_and_multi_edit_applicable_sets_are_equal() -> None:
     )
 
 
-def test_multi_edit_widened_hooks_reach_multi_edit() -> None:
+def test_retained_boundary_hooks_reach_multi_edit() -> None:
     all_multi_edit_widened_script_paths = (
         "blocking/write_existing_file_blocker.py",
-        "blocking/code_rules_enforcer.py",
-        "blocking/tdd_enforcer.py",
-        "blocking/state_description_blocker.py",
-    )
+        "blocking/sensitive_file_protector.py",
+        "blocking/pii_prevention_blocker.py",
+        )
     for each_script_path in all_multi_edit_widened_script_paths:
         entry = _entry_for(each_script_path)
         assert entry is not None, f"{each_script_path} must stay on the hosted roster"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "4.3.0",
+    "version": "7.0.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {
@@ -9,7 +9,7 @@
         "cde": "bin/cde.mjs"
     },
     "scripts": {
-        "test": "node --test \"bin/*.test.mjs\" \".agents/skills/**/*.test.mjs\" \"tests/fresh-session/**/*.test.mjs\""
+        "test": "node --test \"bin/*.test.mjs\" \".agents/skills/**/*.test.mjs\" \"tests/fresh-session/**/*.test.mjs\" \"scripts/ci/*.test.mjs\""
     },
     "files": [
         "bin/",

package/rules/durable-post-artifacts.md

@@ -40,7 +40,8 @@ name does not form a path.
 
 ## Validation
 
-Run `.agents/skills/_shared/pr-loop/scripts/durable_post_lint.py` before the
+Resolve the active managed root (`CLAUDE_CONFIG_DIR` when set, `~/.claude`
+otherwise), then run `<managed-root>/scripts/durable_post_lint.py` before the
 server write. Pass the matching action and body file. Use `pr-create`,
 `pr-edit`, `pr-comment`, `pr-review`, `issue-create`, `issue-edit`,
 `issue-comment`, or `github-mcp-post`.

package/rules/git-workflow.md

@@ -19,13 +19,13 @@ User-level rule: applies to **every** git repo that uses GitHub with `gh`. Small
 
 Use the `pr-description-writer` agent before creating a pull request or
 rewriting its full description. Publish its title and body file through
-`.agents/skills/pull-request/scripts/pull_request.py`. The
-`pr-title-description` skill may review the writer's output but cannot replace
-the required writer.
+`.agents/skills/pull-request/scripts/pull_request.py`.
 
-Run `_shared/pr-loop/scripts/durable_post_lint.py` before any pull request,
-issue, or GitHub MCP post. The linter checks the action-specific title, body,
-and volatile-path rules before credential lookup or network access.
+Resolve the active managed root (`CLAUDE_CONFIG_DIR` when set, `~/.claude`
+otherwise), then run `<managed-root>/scripts/durable_post_lint.py` before any
+pull request, issue, or GitHub MCP post. The linter checks the action-specific
+title, body, and volatile-path rules before credential lookup or network
+access.
 
 Use `.agents/skills/pull-request/scripts/recover_legacy_author.py
 <exact-state-file> --confirm-inactive` only for one explicitly selected legacy

package/scripts/check.ps1

@@ -152,7 +152,6 @@ if (-not $SkipMypy) {
                 copilot_quota.py `
                 fix_hookspath.py `
                 grant_project_claude_permissions.py `
-                post_audit_thread.py `
                 preflight_self_heal.py `
                 preflight.py `
                 reviewer_availability.py `

package/{.agents/skills/run-claude-dev-env/driver.mjs → scripts/ci/installer-lifecycle.mjs}

@@ -1,29 +1,4 @@
 #!/usr/bin/env node
-/**
- * Smoke driver for the claude-dev-env installer.
- *
- * The installer (bin/install.mjs) writes into os.homedir()/.claude and
- * os.homedir()/.agents and has
- * three global side effects: it copies files under ~/.claude/ and ~/.agents/, sets
- * `git config --global core.hooksPath`, and writes ~/.mypy.ini. There is no
- * flag to redirect the target, so this driver isolates every side effect by
- * spawning the installer with HOME, USERPROFILE, and GIT_CONFIG_GLOBAL all
- * pointed at a throwaway sandbox directory. Node's os.homedir() follows
- * USERPROFILE on Windows and HOME on POSIX, so setting both redirects the
- * install target on either platform without touching the real ~/.claude/.
- *
- * The isolated GIT_CONFIG_GLOBAL is seeded with `safe.directory = *` so the
- * installer's `git status` source-conflict guard runs even when the checkout
- * lives somewhere git flags as dubious ownership (for example a UNC network
- * share), while the installer's `git config --global core.hooksPath` write
- * still lands only in the sandbox config.
- *
- * It runs the three lifecycle commands an agent cares about — `--help`, a full
- * install, and `--uninstall` — and asserts the observable result of each
- * against the sandbox tree. Exit code 0 means every assertion held.
- *
- * Usage: node .claude/skills/run-claude-dev-env/driver.mjs
- */
 
 import { spawnSync } from 'node:child_process';
 import {
@@ -41,7 +16,7 @@ import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 
 const DRIVER_DIRECTORY = dirname(fileURLToPath(import.meta.url));
-const PACKAGE_ROOT = resolve(DRIVER_DIRECTORY, '..', '..', '..');
+const PACKAGE_ROOT = resolve(DRIVER_DIRECTORY, '..', '..');
 const INSTALL_ENTRY = join(PACKAGE_ROOT, 'bin', 'install.mjs');
 
 const checks = [];
@@ -68,7 +43,7 @@ function collectFilesRecursive(directory) {
 
 function runInstaller(sandboxHome, installerArguments) {
     const gitConfigGlobal = join(sandboxHome, '.gitconfig-sandbox');
-    const result = spawnSync(process.execPath, [INSTALL_ENTRY, ...installerArguments], {
+    const installerProcess = spawnSync(process.execPath, [INSTALL_ENTRY, ...installerArguments], {
         cwd: PACKAGE_ROOT,
         encoding: 'utf8',
         env: {
@@ -78,7 +53,7 @@ function runInstaller(sandboxHome, installerArguments) {
             GIT_CONFIG_GLOBAL: gitConfigGlobal,
         },
     });
-    return result;
+    return installerProcess;
 }
 
 function main() {

package/scripts/ci/installer-lifecycle.test.mjs

@@ -0,0 +1,26 @@
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const CI_DIRECTORY = dirname(fileURLToPath(import.meta.url));
+const DRIVER_PATH = join(CI_DIRECTORY, 'installer-lifecycle.mjs');
+const DRIVER_TIMEOUT_MILLISECONDS = 60_000;
+
+ test('the installer lifecycle driver completes in an isolated home', () => {
+    const lifecycleProcess = spawnSync(process.execPath, [DRIVER_PATH], {
+        encoding: 'utf8',
+        timeout: DRIVER_TIMEOUT_MILLISECONDS,
+    });
+    assert.equal(lifecycleProcess.status, 0, `${lifecycleProcess.stdout}\n${lifecycleProcess.stderr}`);
+    assert.match(lifecycleProcess.stdout, /ALL CHECKS PASSED/);
+    assert.match(lifecycleProcess.stdout, /Sandbox removed:/);
+});
+
+test('the Windows adapter invokes the CI-owned lifecycle driver', () => {
+    const adapterSource = readFileSync(join(CI_DIRECTORY, 'windows-installer-lifecycle.ps1'), 'utf8');
+    assert.match(adapterSource, /\$driverPath = Join-Path \$PSScriptRoot 'installer-lifecycle\.mjs'/);
+    assert.doesNotMatch(adapterSource, /skills\\run-claude-dev-env/);
+});

package/scripts/ci/windows-installer-lifecycle.ps1

@@ -1,13 +1,3 @@
-# Windows CI adapter for the Node installer lifecycle driver.
-#
-# The driver already redirects HOME, USERPROFILE, and GIT_CONFIG_GLOBAL into a
-# throwaway sandbox. This adapter records that isolation contract, runs the
-# 16-check driver, and writes bounded evidence under -EvidenceRoot so a failed
-# Windows runner leaves an actionable artifact.
-#
-# Usage (from packages/claude-dev-env):
-#   pwsh -NoProfile -File scripts/ci/windows-installer-lifecycle.ps1 -EvidenceRoot <dir>
-
 [CmdletBinding()]
 param(
     [Parameter(Mandatory = $true)]
@@ -17,7 +7,7 @@ param(
 $ErrorActionPreference = 'Stop'
 
 $packageRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
-$driverPath = Join-Path $packageRoot '.claude\skills\run-claude-dev-env\driver.mjs'
+$driverPath = Join-Path $PSScriptRoot 'installer-lifecycle.mjs'
 $allIsolationEnvNames = @(
     'HOME',
     'USERPROFILE',

package/scripts/dev_env_scripts_constants/shared_tree_constants.py

@@ -1,8 +1,4 @@
-"""Constants for resolving directories inside the installed shared tree.
-
-These name the shape of the installed tree itself, not any one worker or
-skill that reads it, so every caller of shared_tree_paths shares them.
-"""
+"""Directory names for the installed shared tree."""
 
 from __future__ import annotations
 
@@ -15,3 +11,6 @@ SCRIPTS_DIRECTORY_NAME: str = "scripts"
 PROCESS_TREE_DIRECTORY_NAME: str = "process-tree"
 
 PROCESS_TREE_KILL_MODULE_FILENAME: str = "process_tree_kill.py"
+
+AGENTS_DIRECTORY_SUFFIX: str = ".agents"
+DEFAULT_MANAGED_ROOT_NAME: str = ".claude"

package/{.agents/skills/_shared/pr-loop/scripts → scripts}/durable_post_lint.py

@@ -8,7 +8,7 @@ from collections.abc import Sequence
 from dataclasses import dataclass
 from pathlib import Path
 
-from skills_pr_loop_constants.durable_post_lint_constants import (
+from durable_post_lint_config.config.constants import (
     ACTION_PR_CREATE,
     ACTION_PR_EDIT,
     ALL_BARE_VOLATILE_PATH_MARKERS,
@@ -82,14 +82,7 @@ def _text_has_anchored_marker(normalized_text: str, marker: str) -> bool:
 
 
 def find_volatile_path_marker(body_text: str) -> str | None:
-    """Return the first volatile path marker in a GitHub post body.
-
-    Args:
-        body_text: Post body text to scan.
-
-    Returns:
-        The matched marker, or None when the body names no volatile path.
-    """
+    """Return the first volatile path marker in a GitHub post body."""
     normalized_text = body_text.replace("\\", PATH_ANCHOR_CHARACTER).lower()
     for each_marker in ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS:
         if _text_has_anchored_marker(normalized_text, each_marker):
@@ -101,17 +94,7 @@ def find_volatile_path_marker(body_text: str) -> str | None:
 
 
 def read_body_file(body_file: Path) -> str:
-    """Read one UTF-8 body file without exposing its contents on failure.
-
-    Args:
-        body_file: Local post body file.
-
-    Returns:
-        Decoded body text.
-
-    Raises:
-        DurablePostInputError: The file is missing, unreadable, or invalid UTF-8.
-    """
+    """Read one UTF-8 body file without exposing its contents on failure."""
     try:
         return body_file.read_text(encoding=BODY_FILE_ENCODING)
     except (OSError, UnicodeError) as error:
@@ -184,19 +167,7 @@ def lint_durable_post(
     title: str | None,
     body_text: str | None,
 ) -> tuple[DurablePostFinding, ...]:
-    """Return content findings for one locally valid GitHub post request.
-
-    Args:
-        action: GitHub post action name.
-        title: Pull request title when the action accepts one.
-        body_text: Decoded body text when the action accepts a body.
-
-    Returns:
-        Content findings in stable rule order.
-
-    Raises:
-        DurablePostUsageError: The action and supplied fields are not a valid request.
-    """
+    """Return content findings for one locally valid GitHub post request."""
     _validate_request_shape(action, title, body_text)
     return (*_title_findings(title), *_body_findings(action, body_text))
 
@@ -210,14 +181,7 @@ def _parse_arguments(all_arguments: Sequence[str]) -> argparse.Namespace:
 
 
 def main(all_arguments: Sequence[str]) -> int:
-    """Validate one GitHub post and return its result status.
-
-    Args:
-        all_arguments: Command arguments after the script name.
-
-    Returns:
-        Zero when clean, one for content findings, or two for invalid input.
-    """
+    """Validate one GitHub post and return its result status."""
     arguments = _parse_arguments(all_arguments)
     try:
         body_text = (

package/{.agents/skills/_shared/pr-loop/scripts/skills_pr_loop_constants/durable_post_lint_constants.py → scripts/durable_post_lint_config/config/constants.py}

@@ -23,7 +23,6 @@ ALL_POST_ACTIONS: frozenset[str] = frozenset(
         ACTION_PR_REVIEW,
     }
 )
-
 ALL_BODY_REQUIRED_ACTIONS: frozenset[str] = frozenset(
     {
         ACTION_GITHUB_MCP_POST,
@@ -35,13 +34,10 @@ ALL_BODY_REQUIRED_ACTIONS: frozenset[str] = frozenset(
         ACTION_PR_REVIEW,
     }
 )
-
 ALL_PR_DESCRIPTION_ACTIONS: frozenset[str] = frozenset(
     {ACTION_PR_CREATE, ACTION_PR_EDIT}
 )
-
 ALL_TITLE_ACTIONS: frozenset[str] = frozenset({ACTION_PR_CREATE, ACTION_PR_EDIT})
-
 ALL_CONVENTIONAL_TITLE_TYPES: tuple[str, ...] = (
     "build",
     "chore",
@@ -55,11 +51,9 @@ ALL_CONVENTIONAL_TITLE_TYPES: tuple[str, ...] = (
     "style",
     "test",
 )
-
 CONVENTIONAL_TITLE_PATTERN: re.Pattern[str] = re.compile(
     rf"^(?:{'|'.join(ALL_CONVENTIONAL_TITLE_TYPES)})(?:\([^)\r\n]+\))?!?: [^\s].*$"
 )
-
 ALL_REQUIRED_PR_DESCRIPTION_HEADINGS: tuple[str, ...] = (
     "Summary",
     "Description",
@@ -67,12 +61,10 @@ ALL_REQUIRED_PR_DESCRIPTION_HEADINGS: tuple[str, ...] = (
     "How",
     "Verification",
 )
-
 ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS: tuple[str, ...] = (
     ".claude-profile-a/jobs/",
     ".claude/worktrees/",
 )
-
 ALL_BARE_VOLATILE_PATH_MARKERS: tuple[str, ...] = (
     "appdata/local/temp",
     "/tmp/",
@@ -80,7 +72,6 @@ ALL_BARE_VOLATILE_PATH_MARKERS: tuple[str, ...] = (
     "$env:temp",
     "$claude_job_dir",
 )
-
 BODY_FILE_ENCODING = "utf-8"
 CLEAN_EXIT_CODE = 0
 CONTENT_FINDING_EXIT_CODE = 1
@@ -88,7 +79,6 @@ EMPTY_BODY_CODE = "empty-body"
 INPUT_ERROR_EXIT_CODE = 2
 PATH_ANCHOR_CHARACTER = "/"
 PATH_SEGMENT_START_CHARACTERS = "_-"
-
 BODY_FILE_UNREADABLE_MESSAGE = "body file is not readable UTF-8 text"
 BODY_REQUIRED_MESSAGE = "this action requires a body file"
 BODY_MUST_NOT_BE_EMPTY_MESSAGE = "body file must contain text"

package/{.agents/skills/_shared/pr-loop/scripts/test_durable_post_lint_constants.py → scripts/durable_post_lint_config/config/test_constants.py}

@@ -1,6 +1,6 @@
 """Tests for durable GitHub post linter constants."""
 
-from skills_pr_loop_constants.durable_post_lint_constants import (
+from durable_post_lint_config.config.constants import (
     ALL_CONVENTIONAL_TITLE_TYPES,
     ALL_POST_ACTIONS,
     CONVENTIONAL_TITLE_PATTERN,

package/scripts/policy_lint/adapter_detectors.py

@@ -29,24 +29,31 @@ def terminology_diagnostics(
     document_set: DocumentSet,
     load_module: adapter_support.HookModuleLoader,
 ) -> tuple[Diagnostic, ...]:
-    """Report staged prose that near-misses a newly introduced identifier.
+    """Report prose that near-misses a newly introduced identifier.
 
     Args:
-        document_set: Candidate staged documents and repository root.
+        document_set: Staged or base change selection and repository root.
         load_module: Shared script module loader.
 
     Returns:
         Diagnostics that name the prose file and line.
     """
-    if document_set.selection is not SelectionKind.STAGED:
+    all_arguments: tuple[Path | str, ...]
+    if document_set.selection is SelectionKind.BASE:
+        if document_set.base_revision is None:
+            raise ValueError("Base selection is missing its comparison revision")
+        checker_name = "strict_base_terminology_findings"
+        all_arguments = (document_set.repository_root, document_set.base_revision)
+    elif document_set.selection is SelectionKind.STAGED:
+        checker_name = "strict_staged_terminology_findings"
+        all_arguments = (document_set.repository_root,)
+    else:
         return ()
     terminology_module = load_module(constants.TERMINOLOGY_SWEEP_MODULE_NAME)
     helper_stdout = StringIO()
     helper_stderr = StringIO()
     with redirect_stdout(helper_stdout), redirect_stderr(helper_stderr):
-        all_findings = terminology_module.strict_staged_terminology_findings(
-            document_set.repository_root
-        )
+        all_findings = getattr(terminology_module, checker_name)(*all_arguments)
     return tuple(_terminology_diagnostic(each_finding) for each_finding in all_findings)