claude-dev-env 7.4.1 → 7.6.0

package/scripts/repository_checks/policy_document.py

@@ -0,0 +1,120 @@
+"""Read and validate the repository policy document."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from repository_checks.config.policy_document import (
+    ALL_DOCUMENT_FIELDS,
+    ALL_ENTRY_FIELDS,
+    ALL_EXEMPTION_FIELDS,
+    ALL_FORBIDDEN_PATH_SEGMENTS,
+    CONFIG_RELATIVE_PATH,
+    DIGEST_PATTERN,
+    FIRST_PRINTABLE_CODEPOINT,
+    FORBIDDEN_PATH_CHARACTERS,
+    SUPPORTED_DOCUMENT_VERSION,
+    VERSION_FIELD,
+)
+
+
+class PolicyConfigurationRunFatal(ValueError):
+    """Reject the entire policy run when exception configuration is invalid."""
+
+
+def read_policy_entries(repository_root: Path, field_name: str) -> list[object]:
+    """Read one exception list from the validated policy document.
+
+    Args:
+        repository_root: Repository containing the optional policy configuration.
+        field_name: Top-level document field holding the exception list.
+
+    Returns:
+        Raw entries recorded under the requested field.
+
+    Raises:
+        ValueError: Configuration contains invalid JSON or schema fields.
+        OSError: Configuration cannot be read.
+    """
+    config_path = repository_root / CONFIG_RELATIVE_PATH
+    if not config_path.exists() and not config_path.is_symlink():
+        return []
+    if not config_path.resolve().is_relative_to(repository_root.resolve()):
+        raise ValueError(
+            "Repository policy configuration must remain inside the repository"
+        )
+    document = json.loads(
+        config_path.read_text(encoding="utf-8"), object_pairs_hook=_unique_fields
+    )
+    _require_valid_document(document)
+    return document.get(field_name, [])
+
+
+def entry_path_and_digest(entry: object, subject: str) -> tuple[str, str]:
+    """Return the validated path and digest of one exception entry.
+
+    Args:
+        entry: Raw entry read from the policy document.
+        subject: Exception family named in each rejection message.
+
+    Returns:
+        Repository-relative path and its recorded sha256 digest.
+
+    Raises:
+        ValueError: The entry omits a field or carries an invalid value.
+    """
+    if not isinstance(entry, dict) or set(entry) != ALL_ENTRY_FIELDS:
+        raise ValueError(f"{subject}s require path, sha256, and reason")
+    relative_path, digest, reason = entry["path"], entry["sha256"], entry["reason"]
+    if not isinstance(relative_path, str) or not relative_path:
+        raise ValueError(f"{subject} path must name one repository file")
+    if _is_nonliteral_relative_path(relative_path):
+        raise ValueError(f"{subject} path must be a literal relative file path")
+    if not isinstance(digest, str) or DIGEST_PATTERN.fullmatch(digest) is None:
+        raise ValueError(f"{subject} sha256 must contain 64 lowercase hex digits")
+    if not isinstance(reason, str) or not reason.strip():
+        raise ValueError(f"{subject} reason must explain why the exception is owned")
+    return relative_path, digest
+
+
+def _require_valid_document(document: object) -> None:
+    if (
+        not isinstance(document, dict)
+        or not set(document) <= ALL_DOCUMENT_FIELDS
+        or VERSION_FIELD not in document
+        or type(document[VERSION_FIELD]) is not int
+        or document[VERSION_FIELD] != SUPPORTED_DOCUMENT_VERSION
+        or not _has_only_list_exemption_fields(document)
+    ):
+        raise ValueError("Invalid repository policy configuration schema")
+
+
+def _has_only_list_exemption_fields(all_document_fields: dict[str, object]) -> bool:
+    return all(
+        isinstance(all_document_fields[each_field], list)
+        for each_field in ALL_EXEMPTION_FIELDS
+        if each_field in all_document_fields
+    )
+
+
+def _is_nonliteral_relative_path(relative_path: str) -> bool:
+    return (
+        any(character in FORBIDDEN_PATH_CHARACTERS for character in relative_path)
+        or any(
+            segment in ALL_FORBIDDEN_PATH_SEGMENTS
+            for segment in relative_path.split("/")
+        )
+        or any(
+            ord(character) < FIRST_PRINTABLE_CODEPOINT for character in relative_path
+        )
+    )
+
+
+def _unique_fields(all_pairs: list[tuple[str, object]]) -> dict[str, object]:
+    fields: dict[str, object] = {}
+    for each_key, each_content in all_pairs:
+        if each_key in fields:
+            raise PolicyConfigurationRunFatal("Duplicate repository policy field")
+        fields[each_key] = each_content
+    return fields

package/scripts/repository_checks/tracked_secrets.py

@@ -13,6 +13,7 @@ from repository_checks.config import constants as repository_constants
 from repository_checks.email_exemptions import load_email_exemptions
 from repository_checks.hook_modules import load_hooks_module
 from repository_checks.models import RepositoryFinding
+from repository_checks.path_exemptions import load_path_exemptions
 
 
 def collect_tracked_secret_findings(
@@ -32,6 +33,7 @@ def collect_tracked_secret_findings(
     all_allowlisted_literals = exemption.repository_allowlisted_values(repository_root)
     all_exact_exemptions = load_email_exemptions(repository_root)
     all_exact_exemptions |= repository_constants.ALL_TRACKED_SECRET_EXACT_EXEMPTIONS
+    all_path_exemptions = load_path_exemptions(repository_root)
     all_findings: list[RepositoryFinding] = []
     for each_relative_path in all_tracked_paths:
         all_findings.extend(
@@ -41,6 +43,7 @@ def collect_tracked_secret_findings(
                 scanner,
                 all_allowlisted_literals,
                 all_exact_exemptions,
+                all_path_exemptions,
             )
         )
     return all_findings
@@ -52,6 +55,7 @@ def _find_secrets_for_path(
     scanner: ModuleType,
     all_allowlisted_literals: frozenset[str],
     all_exact_exemptions: frozenset[tuple[str, str, str]],
+    all_path_exemptions: frozenset[tuple[str, str]],
 ) -> list[RepositoryFinding]:
     posix_relative_path = relative_path.replace(
         repository_constants.WINDOWS_PATH_SEPARATOR,
@@ -59,12 +63,12 @@ def _find_secrets_for_path(
     )
     if scanner.is_path_exempt_from_pii_scan(posix_relative_path):
         return []
-    maybe_content = _read_utf8_text(
-        repository_root,
-        repository_root / relative_path,
-    )
+    absolute_path = repository_root / relative_path
+    maybe_content = _read_utf8_text(repository_root, absolute_path)
     if maybe_content is None:
         return []
+    if _is_frozen_file_exempt(absolute_path, posix_relative_path, all_path_exemptions):
+        return []
     return _find_secret_matches(
         posix_relative_path,
         maybe_content,
@@ -147,6 +151,25 @@ def _should_report_match(
     return matched_text not in all_allowlisted_literals
 
 
+def _is_frozen_file_exempt(
+    absolute_path: Path,
+    posix_relative_path: str,
+    all_path_exemptions: frozenset[tuple[str, str]],
+) -> bool:
+    all_recorded_digests = {
+        each_digest
+        for each_exempt_path, each_digest in all_path_exemptions
+        if each_exempt_path == posix_relative_path
+    }
+    if not all_recorded_digests:
+        return False
+    return _file_digest(absolute_path) in all_recorded_digests
+
+
+def _file_digest(absolute_path: Path) -> str:
+    return hashlib.sha256(absolute_path.read_bytes()).hexdigest()
+
+
 def _secret_digest(matched_text: str) -> str:
     return hashlib.sha256(
         matched_text.encode(policy_constants.UTF8_ENCODING)

package/scripts/setup_project_paths.py

@@ -38,6 +38,8 @@ from hooks_constants.setup_project_paths_constants import (  # noqa: E402
     WROTE_ENTRIES_STATUS_TEMPLATE,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 class SchemaMismatchError(Exception):
     """Raised when the on-disk config declares a schema newer than this script supports."""
@@ -238,6 +240,7 @@ def _run_es_exe_folders_query() -> list[str]:
         text=True,
         encoding=UTF8_ENCODING,
         check=False,
+        creationflags=hidden_window_creation_flags(),
     )
     if completion.returncode != 0:
         truncated_stderr = completion.stderr[:STDERR_TRUNCATION_LENGTH].strip()

package/scripts/spawn_grok_batch.py

@@ -117,6 +117,8 @@ from dev_env_scripts_constants.timing import WORKER_STAGGER_SECONDS
 from grok_headless_runner import GrokRunnerOutcome, run_headless_worker
 from grok_worker_preflight import PreflightOutcome, run_preflight
 
+from subprocess_window_access import hidden_window_creation_flags
+
 class AdvisorFailureError(ValueError):
     """Raised when an advisor bind, resume, or launcher call fails closed."""
 
@@ -263,6 +265,7 @@ def invoke_advisor_launcher(
             encoding=UTF8_ENCODING,
             check=False,
             timeout=MAXIMUM_ADVISOR_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except FileNotFoundError as missing_launcher:
         raise AdvisorFailureError(

package/scripts/subprocess_window_access.py

@@ -0,0 +1,41 @@
+"""Reach the hidden-window helpers from the scripts this directory deploys.
+
+The installer copies this directory into a profile that holds no installed
+Python distribution, and this repository's own tests run the deployed scripts
+under ``python -S -E``, which hides every installed package from the child
+process. On both routes ``hooks_constants`` is reachable only through the
+deployed ``hooks`` directory, so this module puts that directory on
+``sys.path`` and re-exports the helpers a caller asks for::
+
+    from subprocess_window_access import hidden_window_creation_flags
+
+The directory goes on the end of ``sys.path``. ``PathFinder`` runs ahead of
+every editable-install finder, so a trailing entry still selects the deployed
+copy, and the head of ``sys.path`` stays exactly as the caller left it. A
+caller that prepended its own roots keeps them first.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_subprocess_window_hooks_directory = str(
+    Path(__file__).resolve().parents[1] / "hooks"
+)
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import (
+    HiddenWindowStartupInfo,
+    detached_hidden_window_creation_flags,
+    hidden_window_creation_flags,
+    inherited_stream_startup_info,
+)
+
+__all__ = [
+    "HiddenWindowStartupInfo",
+    "detached_hidden_window_creation_flags",
+    "hidden_window_creation_flags",
+    "inherited_stream_startup_info",
+]

package/scripts/test_dispatcher_profile_import.py

@@ -28,6 +28,10 @@ def _stage_profile_tree(
             target_profile_directory / "_shared" / each_shared_name
         )
         shutil.copytree(source_shared_directory, target_shared_directory)
+    shutil.copytree(
+        source_package_directory / "hooks" / "hooks_constants",
+        target_profile_directory / "hooks" / "hooks_constants",
+    )
     return target_scripts_directory
 
 

package/scripts/test_durable_post_lint.py

@@ -15,21 +15,29 @@ if str(_SCRIPTS_DIRECTORY) not in sys.path:
 import durable_post_lint
 
 SCRIPT_PATH = _SCRIPTS_DIRECTORY / "durable_post_lint.py"
-VALID_PR_BODY = """## Summary
+VALID_PR_BODY = """## Why
 
-Summary text.
+Why text.
 
-## Description
+## Scope
 
-Description text.
+Scope text.
 
-## Why
+## Tradeoffs
 
-Why text.
+Tradeoffs text.
+
+## Blast Radius
+
+Blast radius text.
+
+## Verification
 
-## How
+Verification text.
+"""
+MINIMAL_PR_BODY = """## Why
 
-How text.
+Why text.
 
 ## Verification
 
@@ -156,7 +164,7 @@ def test_pr_titles_reject_nonconventional_forms(title: str) -> None:
 
 @pytest.mark.parametrize(
     "missing_heading",
-    ["Summary", "Description", "Why", "How", "Verification"],
+    durable_post_lint.ALL_REQUIRED_PR_DESCRIPTION_HEADINGS,
 )
 def test_pr_body_reports_each_missing_heading(missing_heading: str) -> None:
     body_text = VALID_PR_BODY.replace(f"## {missing_heading}\n", "")
@@ -170,6 +178,31 @@ def test_pr_body_reports_each_missing_heading(missing_heading: str) -> None:
     ]
 
 
+@pytest.mark.parametrize("action", ["pr-create", "pr-edit"])
+def should_accept_a_body_carrying_only_the_two_required_headings(action: str) -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action=action,
+        title="fix(cli): tighten input handling",
+        body_text=MINIMAL_PR_BODY,
+    )
+    assert all_findings == ()
+
+
+def should_still_accept_a_body_published_under_the_superseded_heading_set() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-edit",
+        title=None,
+        body_text=(
+            "## Summary\n\nSummary text.\n\n"
+            "## Description\n\nDescription text.\n\n"
+            "## Why\n\nWhy text.\n\n"
+            "## How\n\nHow text.\n\n"
+            "## Verification\n\nVerification text.\n"
+        ),
+    )
+    assert all_findings == ()
+
+
 def test_non_pr_body_needs_no_pr_headings() -> None:
     all_findings = durable_post_lint.lint_durable_post(
         action="issue-comment",

package/scripts/tests/test_adapter_configuration.py

@@ -42,6 +42,14 @@ def test_incremental_blocker_removal_is_clean(tmp_path: Path) -> None:
     assert adapters.hook_configuration_diagnostics(current_document, tmp_path) == ()
 
 
+def test_new_bash_pre_tool_use_dispatcher_registration_is_clean(tmp_path: Path) -> None:
+    current_document = _hook_document(
+        ["hooks/blocking/bash_pre_tool_use_dispatcher.py"],
+        '{"hooks": {}}',
+    )
+    assert adapters.hook_configuration_diagnostics(current_document, tmp_path) == ()
+
+
 def test_new_blocker_in_staged_change_is_rejected(tmp_path: Path) -> None:
     current_document = _hook_document(
         ["hooks/blocking/new.py"],

package/scripts/tests/test_automatic_advisory_window_flags.py

@@ -15,7 +15,13 @@ if str(TESTS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(TESTS_DIRECTORY))
 
 import test_automatic_advisory as support
-from automatic_advisory import checkout, cli, execution, git, window_flags
+from automatic_advisory import checkout, cli, execution, git
+
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[3] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants import subprocess_window
 
 WINDOWS_ONLY = pytest.mark.skipif(
     sys.platform != "win32", reason="Windows console flags"
@@ -41,19 +47,19 @@ Path(sys.argv[1]).write_text(completed.stdout, encoding="utf-8")
 
 
 def test_flags_are_zero_off_windows(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(window_flags.sys, "platform", "linux")
-    assert window_flags.hidden_window_creation_flags() == 0
-    assert window_flags.detached_poller_creation_flags() == 0
+    monkeypatch.setattr(subprocess_window.sys, "platform", "linux")
+    assert subprocess_window.hidden_window_creation_flags() == 0
+    assert subprocess_window.detached_hidden_window_creation_flags() == 0
 
 
 @WINDOWS_ONLY
 def test_hidden_window_creation_flags_is_create_no_window() -> None:
-    assert window_flags.hidden_window_creation_flags() == subprocess.CREATE_NO_WINDOW
+    assert subprocess_window.hidden_window_creation_flags() == subprocess.CREATE_NO_WINDOW
 
 
 @WINDOWS_ONLY
 def test_poller_flags_keep_a_hidden_console_instead_of_none() -> None:
-    poller_flags = window_flags.detached_poller_creation_flags()
+    poller_flags = subprocess_window.detached_hidden_window_creation_flags()
     assert poller_flags & subprocess.DETACHED_PROCESS == 0
     assert poller_flags & subprocess.CREATE_NO_WINDOW
     assert poller_flags & subprocess.CREATE_NEW_PROCESS_GROUP
@@ -71,7 +77,7 @@ def test_poller_grandchild_gets_no_visible_console(tmp_path: Path) -> None:
         stdin=subprocess.DEVNULL,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,
-        creationflags=window_flags.detached_poller_creation_flags(),
+        creationflags=subprocess_window.detached_hidden_window_creation_flags(),
     )
     assert _read_probe_report(report_path) == {"visible": False}
 
@@ -102,7 +108,7 @@ def test_git_fetch_hides_its_window(
 
     assert git._fetch_base(registration, candidate) is True
     assert (
-        captured_options["creationflags"] == window_flags.hidden_window_creation_flags()
+        captured_options["creationflags"] == subprocess_window.hidden_window_creation_flags()
     )
 
 
@@ -122,7 +128,7 @@ def test_checkout_inspection_hides_its_window(
     local_checkout = checkout.read_local_checkout(tmp_path)
 
     assert local_checkout.head_sha == "abc123"
-    assert all_captured_flags == [window_flags.hidden_window_creation_flags()] * 2
+    assert all_captured_flags == [subprocess_window.hidden_window_creation_flags()] * 2
 
 
 def test_windows_process_host_spawn_hides_its_window(
@@ -139,7 +145,7 @@ def test_windows_process_host_spawn_hides_its_window(
 
     execution._spawn_windows_process_host(("python", "-c", "pass"), registration, {})
 
-    expected_flags = window_flags.hidden_window_creation_flags() | getattr(
+    expected_flags = subprocess_window.hidden_window_creation_flags() | getattr(
         subprocess, "BELOW_NORMAL_PRIORITY_CLASS", 0
     )
     assert captured_options["creationflags"] == expected_flags
@@ -159,5 +165,5 @@ def test_start_polling_launches_with_the_poller_flags(
     assert cli.start_polling(tmp_path / "settings.json") == 0
     assert (
         captured_options["creationflags"]
-        == window_flags.detached_poller_creation_flags()
+        == subprocess_window.detached_hidden_window_creation_flags()
     )

package/scripts/tests/test_email_exemptions.py

@@ -119,3 +119,40 @@ def test_malformed_config_stops_scanning(tmp_path: Path, content: str) -> None:
 
 def test_missing_config_has_no_exemptions(tmp_path: Path) -> None:
     assert load_email_exemptions(tmp_path) == frozenset()
+
+
+@pytest.mark.parametrize(
+    "document",
+    [
+        {"version": 1},
+        {
+            "version": 1,
+            "path_exemptions": [
+                {
+                    "path": "evidence/manifest.json",
+                    "sha256": DIGEST,
+                    "reason": "Frozen evidence file pinned by its consumers",
+                }
+            ],
+        },
+    ],
+)
+def test_document_without_the_email_list_loads_no_email_exemptions(
+    tmp_path: Path, document: dict[str, object]
+) -> None:
+    """A document may carry the other family, or no exception list at all."""
+    (tmp_path / "config").mkdir()
+    (tmp_path / "config" / "repository-policy.json").write_text(
+        json.dumps(document), encoding="utf-8"
+    )
+    assert load_email_exemptions(tmp_path) == frozenset()
+
+
+def test_reason_rejection_names_the_ownership_requirement(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry(reason=" ")])
+    with pytest.raises(ValueError) as rejection:
+        load_email_exemptions(tmp_path)
+    assert (
+        str(rejection.value)
+        == "Email exemption reason must explain why the exception is owned"
+    )

package/scripts/tests/test_path_exemptions.py

@@ -0,0 +1,164 @@
+"""Frozen-file path exceptions preserve every other scanner finding."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+
+import pytest
+from repository_checks.path_exemptions import load_path_exemptions
+from repository_checks.tracked_secrets import collect_tracked_secret_findings
+
+FROZEN_RELATIVE_PATH = "evidence/manifest.json"
+OTHER_RELATIVE_PATH = "evidence/other.json"
+HOME_PATH = "C:/Users/fixture-owner/source-document.md"
+FROZEN_CONTENT = f'{{"source": "{HOME_PATH}"}}\n'
+STALE_DIGEST = hashlib.sha256(b"different bytes").hexdigest()
+
+
+def _write_config(root: Path, document: dict[str, object]) -> None:
+    directory = root / "config"
+    directory.mkdir(exist_ok=True)
+    (directory / "repository-policy.json").write_text(
+        json.dumps(document), encoding="utf-8"
+    )
+
+
+def _write_frozen_file(root: Path, relative_path: str) -> str:
+    file_path = root / relative_path
+    file_path.parent.mkdir(parents=True, exist_ok=True)
+    file_path.write_text(FROZEN_CONTENT, encoding="utf-8")
+    return hashlib.sha256(file_path.read_bytes()).hexdigest()
+
+
+def _entry(**changes: object) -> dict[str, object]:
+    return {
+        "path": FROZEN_RELATIVE_PATH,
+        "sha256": STALE_DIGEST,
+        "reason": "Frozen evidence file pinned by its consumers",
+        **changes,
+    }
+
+
+def test_matching_digest_removes_every_finding(tmp_path: Path) -> None:
+    digest = _write_frozen_file(tmp_path, FROZEN_RELATIVE_PATH)
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry(sha256=digest)]})
+    assert collect_tracked_secret_findings(tmp_path, [FROZEN_RELATIVE_PATH]) == []
+
+
+def test_stale_digest_keeps_reporting_the_path(tmp_path: Path) -> None:
+    _write_frozen_file(tmp_path, FROZEN_RELATIVE_PATH)
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry()]})
+    findings = collect_tracked_secret_findings(tmp_path, [FROZEN_RELATIVE_PATH])
+    assert [finding.relative_path for finding in findings] == [FROZEN_RELATIVE_PATH]
+    assert all(finding.message.startswith("[home-path]") for finding in findings)
+
+
+def test_unlisted_path_keeps_reporting(tmp_path: Path) -> None:
+    digest = _write_frozen_file(tmp_path, FROZEN_RELATIVE_PATH)
+    _write_frozen_file(tmp_path, OTHER_RELATIVE_PATH)
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry(sha256=digest)]})
+    findings = collect_tracked_secret_findings(
+        tmp_path, [FROZEN_RELATIVE_PATH, OTHER_RELATIVE_PATH]
+    )
+    assert [finding.relative_path for finding in findings] == [OTHER_RELATIVE_PATH]
+
+
+def test_exempt_path_stays_out_of_the_email_exemption_identities(
+    tmp_path: Path,
+) -> None:
+    digest = _write_frozen_file(tmp_path, FROZEN_RELATIVE_PATH)
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry(sha256=digest)]})
+    assert load_path_exemptions(tmp_path) == frozenset({(FROZEN_RELATIVE_PATH, digest)})
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/manifest.json",
+        "C:/manifest.json",
+        "../manifest.json",
+        "evidence/../manifest.json",
+        "*.json",
+        "evidence/?.json",
+        "evidence/[a].json",
+        "evidence\\manifest.json",
+        "evidence//manifest.json",
+        "./manifest.json",
+        "",
+    ],
+)
+def test_rejects_nonliteral_or_nonrelative_paths(tmp_path: Path, path: str) -> None:
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry(path=path)]})
+    with pytest.raises(ValueError):
+        load_path_exemptions(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "entry",
+    [
+        None,
+        {},
+        _entry(reason=" "),
+        _entry(sha256="f" * 63),
+        _entry(sha256="z" * 64),
+        _entry(category="secret"),
+    ],
+)
+def test_rejects_invalid_entries(tmp_path: Path, entry: object) -> None:
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [entry]})
+    with pytest.raises(ValueError):
+        load_path_exemptions(tmp_path)
+
+
+def test_rejects_duplicate_entries(tmp_path: Path) -> None:
+    _write_config(
+        tmp_path,
+        {
+            "version": 1,
+            "path_exemptions": [_entry(), _entry(reason="Another explanation")],
+        },
+    )
+    with pytest.raises(ValueError):
+        load_path_exemptions(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "content",
+    [
+        "{",
+        "[]",
+        '{"version":true,"path_exemptions":[]}',
+        '{"version":1,"path_exemptions":{}}',
+        '{"version":1,"path_exemptions":[],"extra":0}',
+        '{"version":1,"path_exemptions":[],"path_exemptions":[]}',
+    ],
+)
+def test_malformed_config_stops_scanning(tmp_path: Path, content: str) -> None:
+    (tmp_path / "config").mkdir()
+    (tmp_path / "config" / "repository-policy.json").write_text(
+        content, encoding="utf-8"
+    )
+    with pytest.raises(ValueError):
+        collect_tracked_secret_findings(tmp_path, [])
+
+
+@pytest.mark.parametrize(
+    "document",
+    [
+        {"version": 1},
+        {"version": 1, "email_exemptions": []},
+        {"version": 1, "path_exemptions": []},
+        {"version": 1, "email_exemptions": [], "path_exemptions": []},
+    ],
+)
+def test_documents_missing_one_list_still_load(
+    tmp_path: Path, document: dict[str, object]
+) -> None:
+    _write_config(tmp_path, document)
+    assert load_path_exemptions(tmp_path) == frozenset()
+
+
+def test_missing_config_has_no_exemptions(tmp_path: Path) -> None:
+    assert load_path_exemptions(tmp_path) == frozenset()