claude-dev-env 7.4.1 → 7.6.0

package/scripts/policy_lint/adapters.py

@@ -8,7 +8,13 @@ from types import ModuleType
 
 from shared_tree_paths import resolve_shared_scripts_directory
 
-from . import adapter_configuration, adapter_detectors, adapter_pairing, adapter_support
+from . import (
+    adapter_configuration,
+    adapter_detectors,
+    adapter_pairing,
+    adapter_retired_hook_prose,
+    adapter_support,
+)
 from .config import constants
 from .model import Diagnostic, Document, DocumentSet
 
@@ -27,9 +33,13 @@ def _hooks_module(module_name: str) -> ModuleType:
 
 
 def _pr_loop_script_module(module_name: str) -> ModuleType:
+    marker_relative_path = (
+        module_name.replace(".", constants.POSIX_PATH_SEPARATOR)
+        + constants.PYTHON_SUFFIX
+    )
     scripts_directory = str(resolve_shared_scripts_directory(
         __file__, os.environ, constants.PR_LOOP_DIRECTORY_NAME,
-        f"{module_name}{constants.PYTHON_SUFFIX}", constants.SHARED_ROOT_PARENT_INDEX
+        marker_relative_path, constants.SHARED_ROOT_PARENT_INDEX
     ))
     if scripts_directory not in sys.path:
         sys.path.insert(0, scripts_directory)
@@ -66,7 +76,7 @@ def code_rule_diagnostics(
         Diagnostics from the code-rule engine.
     """
     return adapter_detectors.code_rule_diagnostics(
-        document, repository_root, _hooks_module
+        document, repository_root, _hooks_module, _pr_loop_script_module
     )
 
 
@@ -270,6 +280,25 @@ def accepts_python(document: Document) -> bool:
     return document.path.suffix.lower() == constants.PYTHON_SUFFIX
 
 
+def accepts_production_python(document: Document) -> bool:
+    """Return whether the document is Python outside the test tree.
+
+    The hook lane exempts a test module so a test can stage an undercounting
+    fixture freely. This gate reuses the hook lane's own ``is_test_file``
+    predicate, so the two lanes cannot drift on what counts as a test file.
+
+    Args:
+        document: Candidate document.
+
+    Returns:
+        True for a Python document whose path is not a test path.
+    """
+    if not accepts_python(document):
+        return False
+    shared_module = _hooks_module("blocking.code_rules_shared")
+    return not shared_module.is_test_file(f"/{document.path.as_posix()}")
+
+
 def accepts_code(document: Document) -> bool:
     """Return whether the document contains supported source code.
 
@@ -286,6 +315,21 @@ def accepts_markdown(document: Document) -> bool:
     return document.path.suffix.lower() in constants.ALL_MARKDOWN_SUFFIXES
 
 
+def _is_generated_document(document: Document) -> bool:
+    """Return whether a release tool writes the document from commit history.
+
+    A changelog is rebuilt from merged commit subjects, so its wording belongs
+    to the commits rather than to an author. Prose rules skip it.
+
+    Args:
+        document: Candidate document.
+
+    Returns:
+        True for a generated document name.
+    """
+    return document.path.name.lower() in constants.ALL_GENERATED_DOCUMENT_NAMES
+
+
 def accepts_source_or_markdown(document: Document) -> bool:
     """Return whether a state-description rule can inspect the document.
 
@@ -293,8 +337,10 @@ def accepts_source_or_markdown(document: Document) -> bool:
         document: Candidate document.
 
     Returns:
-        True for supported source or Markdown.
+        True for authored source or Markdown, and False for a generated document.
     """
+    if _is_generated_document(document):
+        return False
     return accepts_code(document) or accepts_markdown(document)
 
 
@@ -305,8 +351,10 @@ def accepts_stored_prompt(document: Document) -> bool:
         document: Candidate document.
 
     Returns:
-        True for Markdown in an instruction directory.
+        True for authored Markdown in an instruction directory.
     """
+    if _is_generated_document(document):
+        return False
     normalized_path = f"/{document.path.as_posix().lower()}"
     return accepts_markdown(document) and any(
         each_segment in normalized_path
@@ -377,3 +425,32 @@ def accepts_plans(document: Document) -> bool:
             )
         )
     )
+
+
+def accepts_rules_markdown(document: Document) -> bool:
+    """Return whether the document is Markdown in a rules directory.
+
+    Args:
+        document: Candidate document.
+
+    Returns:
+        True for a Markdown file directly under a ``rules`` directory.
+    """
+    return adapter_retired_hook_prose.accepts_rules_markdown(document)
+
+
+def retired_hook_prose_diagnostics(
+    document: Document, repository_root: Path
+) -> tuple[Diagnostic, ...]:
+    """Report rules prose that credits an unregistered hook with a live action.
+
+    Args:
+        document: Current rules Markdown text and path.
+        repository_root: Request repository root for package resolution.
+
+    Returns:
+        Retired-hook prose diagnostics.
+    """
+    return adapter_retired_hook_prose.retired_hook_prose_diagnostics(
+        document, repository_root
+    )

package/scripts/policy_lint/config/approved_test_pairs.py

@@ -5,6 +5,31 @@ from pathlib import PurePosixPath
 APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
     PurePosixPath, frozenset[PurePosixPath]
 ] = {
+    PurePosixPath("packages/claude-dev-env/bin/install-constants.mjs"): frozenset(
+        {
+            PurePosixPath("packages/claude-dev-env/bin/install.cursor-rules.test.mjs"),
+        }
+    ),
+    PurePosixPath("packages/claude-dev-env/bin/install.mjs"): frozenset(
+        {
+            PurePosixPath("packages/claude-dev-env/bin/install.cursor-rules.test.mjs"),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/blocking/code_rules_comments.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_comment_string_awareness.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_exempt_marker_chained.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_javascript_comments.py"
+            ),
+        }
+    ),
     PurePosixPath(
         "packages/claude-dev-env/hooks/git-hooks/verification_notice_context.py"
     ): frozenset(
@@ -152,15 +177,6 @@ APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
             ),
         }
     ),
-    PurePosixPath(
-        "packages/claude-dev-env/scripts/automatic_advisory/window_flags.py"
-    ): frozenset(
-        {
-            PurePosixPath(
-                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
-            ),
-        }
-    ),
     PurePosixPath(
         "packages/claude-dev-env/scripts/automatic_advisory/windows_job.py"
     ): frozenset(

package/scripts/policy_lint/config/constants.py

@@ -34,6 +34,7 @@ RENAME_PATH_COUNT = 2
 PYTHON_SUFFIX = ".py"
 ALL_CODE_SUFFIXES = frozenset({".py", ".js", ".jsx", ".ts", ".tsx", ".mjs"})
 ALL_MARKDOWN_SUFFIXES = frozenset({".md", ".mdx"})
+ALL_GENERATED_DOCUMENT_NAMES = frozenset({"changelog.md"})
 ALL_STORED_PROMPT_SEGMENTS = (
     "/.agents/",
     "/commands/",
@@ -57,6 +58,9 @@ ALL_ACTION_BOUNDARY_SEGMENTS = frozenset(
     }
 )
 ALL_ACTION_BOUNDARY_PREFIXES = ("deny_", "block_", "ask_")
+ALL_ACTION_BOUNDARY_EXEMPT_REGISTRATION_PATHS = (
+    "blocking/bash_pre_tool_use_dispatcher.py",
+)
 ALL_TEST_DIRECTORY_NAMES = frozenset({"tests"})
 ALL_TEST_FILE_PREFIXES = ("test_",)
 ALL_TEST_FILE_SUFFIXES = ("_test.py",)
@@ -80,3 +84,76 @@ TERMINOLOGY_MESSAGE_GROUP = "message"
 
 PR_LOOP_DIRECTORY_NAME = "pr-loop"
 SHARED_ROOT_PARENT_INDEX = 2
+POSIX_PATH_SEPARATOR = "/"
+VIOLATION_SCOPING_MODULE_NAME = "code_rules_gate_parts.violation_scoping"
+
+RETIRED_HOOK_PROSE_RULE_ID = "retired-hook-prose"
+RULES_DIRECTORY_NAME = "rules"
+HOOKS_DIRECTORY_NAME = "hooks"
+HOOKS_CONFIGURATION_FILE_NAME = "hooks.json"
+HOOK_CONSTANTS_DIRECTORY_NAME = "hooks_constants"
+DISPATCHER_CONSTANTS_GLOB = "*dispatcher_constants.py"
+ALL_INSTALLER_PATH_SEGMENTS = ("bin", "install.mjs")
+PYTHON_GLOB = "*.py"
+REPLACEMENT_CHARACTER_ERRORS = "replace"
+ALL_HOOK_MODULE_NAME_SUFFIXES = (
+    "_advisor",
+    "_blocker",
+    "_dispatcher",
+    "_enforcer",
+    "_gate",
+    "_guard",
+    "_recorder",
+    "_rewriter",
+    "_tracker",
+    "_validator",
+)
+ALL_LIVE_CLAIM_VERBS = frozenset(
+    {
+        "allows",
+        "applies",
+        "blocks",
+        "catches",
+        "checks",
+        "denies",
+        "enforces",
+        "fires",
+        "flags",
+        "gates",
+        "hosts",
+        "matches",
+        "prevents",
+        "reads",
+        "records",
+        "refuses",
+        "rejects",
+        "reports",
+        "requires",
+        "runs",
+        "scans",
+        "stops",
+        "watches",
+    }
+)
+ALL_REPLACEMENT_DELIVERY_PHRASES = (
+    "staged policy lint",
+    "policy lint",
+    "cde_lint",
+    "repository_checks/",
+    "repository_policy.py",
+    "repository check",
+)
+INLINE_CODE_PATTERN = r"`([^`\n]+)`"
+HOOK_MODULE_NAME_PATTERN = r"[a-z_][a-z0-9_]*"
+PROSE_WORD_PATTERN = r"[a-z]+"
+RETIRED_ROSTER_PATTERN = (
+    r"(?s)RETIRED_HOOK_REGISTRATION_RELATIVE_PATHS\s*=\s*new Set\(\[(.*?)\]\)"
+)
+QUOTED_HOOK_PATH_PATTERN = r"['\"]([a-z_]+/[a-z_0-9]+\.py)['\"]"
+HOOKS_JSON_PATH_PATTERN = r"hooks/[a-z_]+/([a-z_0-9]+)\.py"
+SENTENCE_BOUNDARY_PATTERN = r"[.!?](?:\s|$)"
+RETIRED_HOOK_PROSE_MESSAGE = (
+    "{hook_name} is named by no hooks.json entry and no dispatcher roster, so it "
+    "reaches no tool call. Say what the reader faces now, or drop the "
+    "present-tense action."
+)

package/scripts/policy_lint/registry.py

@@ -73,7 +73,7 @@ def _python_document_rules() -> tuple[model.Rule, ...]:
         ),
         build_document_rule(
             "subprocess-budget",
-            adapters.accepts_python,
+            adapters.accepts_production_python,
             adapters.subprocess_budget_diagnostics,
         ),
         build_document_rule(
@@ -104,6 +104,11 @@ def _text_document_rules() -> tuple[model.Rule, ...]:
             adapters.accepts_workflow,
             adapters.workflow_substitution_diagnostics,
         ),
+        build_document_rule(
+            "retired-hook-prose",
+            adapters.accepts_rules_markdown,
+            adapters.retired_hook_prose_diagnostics,
+        ),
     )
 
 

package/scripts/policy_lint/selection.py

@@ -18,6 +18,7 @@ from .model import (
     TextDocument,
 )
 from .selection_git import (
+    GitBlobItemBlocked,
     GitSelectionError,
     git_bytes_for,
     head_revision,
@@ -30,6 +31,10 @@ class SelectionRunFatal(ValueError):
     """Raised when a source selection cannot be resolved safely."""
 
 
+class SelectionItemBlocked(ValueError):
+    """Raised when one file holds bytes that are not a policy document."""
+
+
 SelectionError = SelectionRunFatal
 
 
@@ -54,9 +59,7 @@ def select_documents(request: LintRequest) -> DocumentSet:
 
 def _select_source(repository_root: Path, source: object) -> DocumentSet:
     if isinstance(source, ExplicitFiles):
-        all_documents = tuple(
-            _worktree_document(repository_root, each_path) for each_path in source.paths
-        )
+        all_documents = _explicit_documents(repository_root, source.paths)
         return DocumentSet(all_documents, SelectionKind.FILES, repository_root)
     if isinstance(source, StagedChanges):
         return _select_changes(repository_root, True, None)
@@ -89,13 +92,28 @@ def _validated_repository_root(repository_root: Path) -> Path:
     return resolved_root
 
 
+def _explicit_documents(
+    repository_root: Path, all_paths: tuple[Path, ...]
+) -> tuple[Document, ...]:
+    all_documents: list[Document] = []
+    for each_path in all_paths:
+        try:
+            all_documents.append(_worktree_document(repository_root, each_path))
+        except SelectionItemBlocked:
+            continue
+    return tuple(all_documents)
+
+
 def _select_repository_tree(repository_root: Path) -> DocumentSet:
-    all_documents = tuple(
-        _tracked_worktree_document(repository_root, each_path)
-        for each_path in _tracked_paths(repository_root)
-        if (repository_root / each_path).is_file()
-    )
-    return DocumentSet(all_documents, SelectionKind.REPOSITORY, repository_root)
+    all_documents: list[Document] = []
+    for each_path in _tracked_paths(repository_root):
+        if not (repository_root / each_path).is_file():
+            continue
+        try:
+            all_documents.append(_tracked_worktree_document(repository_root, each_path))
+        except SelectionItemBlocked:
+            continue
+    return DocumentSet(tuple(all_documents), SelectionKind.REPOSITORY, repository_root)
 
 
 def _tracked_worktree_document(repository_root: Path, raw_path: str) -> Document:
@@ -189,13 +207,16 @@ def _append_change(
     old_path, new_path = all_paths if status[:1] in {"R", "C"} else (all_paths[0], all_paths[0])
     normalized_old_path = _normalize_path(repository_root, old_path)
     normalized_new_path = _normalize_path(repository_root, new_path)
-    document = _change_document(
-        repository_root, old_path, new_path, normalized_old_path,
-        normalized_new_path, is_staged, base_revision, status,
-    )
-    if document is None:
+    if status == "D":
         all_deleted_paths.append(normalized_old_path)
         return
+    try:
+        document = _change_document(
+            repository_root, old_path, new_path, normalized_old_path,
+            normalized_new_path, is_staged, base_revision, status,
+        )
+    except (SelectionItemBlocked, GitBlobItemBlocked):
+        return
     all_documents.append(document)
     if document.prior_path is not None:
         all_renamed_paths.append((normalized_old_path, normalized_new_path))
@@ -210,9 +231,7 @@ def _change_document(
     is_staged: bool,
     base_revision: str | None,
     status: str,
-) -> Document | None:
-    if status == "D":
-        return None
+) -> Document:
     is_copy = status[:1] == "C"
     is_rename = status[:1] == "R"
     prior_text = _change_prior_text(
@@ -274,7 +293,7 @@ def _read_worktree_text(file_path: Path) -> str:
     try:
         return file_path.read_bytes().decode(constants.UTF8_ENCODING)
     except UnicodeDecodeError as error:
-        raise SelectionRunFatal(f"File is not UTF-8: {file_path}") from error
+        raise SelectionItemBlocked(f"File is not UTF-8: {file_path}") from error
     except OSError as error:
         raise SelectionRunFatal(f"File cannot be read: {file_path}") from error
 

package/scripts/policy_lint/selection_git.py

@@ -16,11 +16,23 @@ from .config.constants import (
     UTF8_ENCODING,
 )
 
+import sys
+
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 class GitSelectionError(ValueError):
     """Raised when Git cannot provide the requested source bytes."""
 
 
+class GitBlobItemBlocked(GitSelectionError):
+    """Raised when one Git blob holds bytes that are not UTF-8 text."""
+
+
 def git_bytes_for(repository_root: Path, all_arguments: tuple[str, ...]) -> bytes:
     """Run a fixed Git argument vector and return raw stdout bytes.
 
@@ -40,6 +52,7 @@ def git_bytes_for(repository_root: Path, all_arguments: tuple[str, ...]) -> byte
         capture_output=True,
         check=False,
         env=_git_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     if completed.returncode != 0:
         error_text = completed.stderr.decode(UTF8_ENCODING, errors="replace").strip()
@@ -65,6 +78,7 @@ def head_revision(repository_root: Path) -> str | None:
         capture_output=True,
         check=False,
         env=_git_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     if completed.returncode != 0:
         error_text = completed.stderr.decode(UTF8_ENCODING, errors="replace").strip()
@@ -89,7 +103,7 @@ def read_blob(repository_root: Path, revision: str, relative_path: str) -> str |
         Decoded blob text, or None when the blob is absent.
 
     Raises:
-        GitSelectionError: If the blob is not UTF-8.
+        GitBlobItemBlocked: If the blob is not UTF-8.
     """
     blob_bytes = _read_blob_bytes(repository_root, revision, relative_path)
     if blob_bytes is None:
@@ -97,7 +111,7 @@ def read_blob(repository_root: Path, revision: str, relative_path: str) -> str |
     try:
         return blob_bytes.decode(UTF8_ENCODING)
     except UnicodeDecodeError as error:
-        raise GitSelectionError(f"Git blob is not UTF-8: {relative_path}") from error
+        raise GitBlobItemBlocked(f"Git blob is not UTF-8: {relative_path}") from error
 
 
 def _git_subprocess_environment() -> dict[str, str]:
@@ -121,6 +135,7 @@ def _read_blob_bytes(repository_root: Path, revision: str, relative_path: str) -
         capture_output=True,
         check=False,
         env=_git_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     if completed.returncode == 0:
         return completed.stdout

package/scripts/repository_checks/config/constants.py

@@ -131,5 +131,10 @@ ALL_TRACKED_SECRET_EXACT_EXEMPTIONS: frozenset[tuple[str, str, str]] = frozenset
             "home-path",
             "5d956228802fbd4a65af8fa7fb4183f5a9f8793dbe218877aefe887b905f726d",
         ),
+        (
+            "shared_utils/theme_assets/contracts/evidence/theme_editor_asset_resolution_master.oneui9.v1.json",
+            "home-path",
+            "ec69fe88e2f9d3f1ed3504532c7484120591cbec7ae6fda017b0f9ca57a3fc25",
+        ),
     )
 )

package/scripts/repository_checks/config/policy_document.py

@@ -0,0 +1,19 @@
+"""Repository policy document and exception-entry schema."""
+
+import re
+
+CONFIG_RELATIVE_PATH = "config/repository-policy.json"
+DIGEST_PATTERN = re.compile(r"[0-9a-f]{64}")
+FORBIDDEN_PATH_CHARACTERS = frozenset("\\:*?[]")
+ALL_ENTRY_FIELDS = frozenset({"path", "sha256", "reason"})
+ALL_FORBIDDEN_PATH_SEGMENTS = frozenset({"", ".", ".."})
+FIRST_PRINTABLE_CODEPOINT = 32
+VERSION_FIELD = "version"
+SUPPORTED_DOCUMENT_VERSION = 1
+EMAIL_EXEMPTIONS_FIELD = "email_exemptions"
+PATH_EXEMPTIONS_FIELD = "path_exemptions"
+ALL_EXEMPTION_FIELDS = frozenset({EMAIL_EXEMPTIONS_FIELD, PATH_EXEMPTIONS_FIELD})
+ALL_DOCUMENT_FIELDS = ALL_EXEMPTION_FIELDS | {VERSION_FIELD}
+EMAIL_EXEMPTION_SUBJECT = "Email exemption"
+PATH_EXEMPTION_SUBJECT = "Path exemption"
+EMAIL_CATEGORY = "email"

package/scripts/repository_checks/email_exemptions.py

@@ -2,21 +2,18 @@
 
 from __future__ import annotations
 
-import json
 from pathlib import Path
 
-from repository_checks.config.email_exemptions import (
-    ALL_ENTRY_FIELDS,
-    ALL_FORBIDDEN_PATH_SEGMENTS,
-    CONFIG_RELATIVE_PATH,
-    DIGEST_PATTERN,
-    FIRST_PRINTABLE_CODEPOINT,
-    FORBIDDEN_PATH_CHARACTERS,
+from repository_checks.config.policy_document import (
+    EMAIL_CATEGORY,
+    EMAIL_EXEMPTION_SUBJECT,
+    EMAIL_EXEMPTIONS_FIELD,
+)
+from repository_checks.policy_document import (
+    PolicyConfigurationRunFatal,
+    entry_path_and_digest,
+    read_policy_entries,
 )
-
-
-class PolicyConfigurationRunFatal(ValueError):
-    """Reject the entire policy run when exception configuration is invalid."""
 
 
 def load_email_exemptions(repository_root: Path) -> frozenset[tuple[str, str, str]]:
@@ -31,66 +28,12 @@ def load_email_exemptions(repository_root: Path) -> frozenset[tuple[str, str, st
         OSError: Configuration cannot be read.
     """
     exemptions: set[tuple[str, str, str]] = set()
-    for each_entry in _read_entries(repository_root):
-        identity = _entry_identity(each_entry)
+    for each_entry in read_policy_entries(repository_root, EMAIL_EXEMPTIONS_FIELD):
+        relative_path, digest = entry_path_and_digest(
+            each_entry, EMAIL_EXEMPTION_SUBJECT
+        )
+        identity = (relative_path, EMAIL_CATEGORY, digest)
         if identity in exemptions:
             raise PolicyConfigurationRunFatal("Duplicate repository email exemption")
         exemptions.add(identity)
     return frozenset(exemptions)
-
-
-def _read_entries(repository_root: Path) -> list[object]:
-    config_path = repository_root / CONFIG_RELATIVE_PATH
-    if not config_path.exists() and not config_path.is_symlink():
-        return []
-    if not config_path.resolve().is_relative_to(repository_root.resolve()):
-        raise ValueError(
-            "Repository policy configuration must remain inside the repository"
-        )
-    document = json.loads(
-        config_path.read_text(encoding="utf-8"), object_pairs_hook=_unique_fields
-    )
-    if (
-        not isinstance(document, dict)
-        or set(document) != {"version", "email_exemptions"}
-        or type(document["version"]) is not int
-        or document["version"] != 1
-        or not isinstance(document["email_exemptions"], list)
-    ):
-        raise ValueError("Invalid repository policy configuration schema")
-    return document["email_exemptions"]
-
-
-def _unique_fields(all_pairs: list[tuple[str, object]]) -> dict[str, object]:
-    fields: dict[str, object] = {}
-    for each_key, each_content in all_pairs:
-        if each_key in fields:
-            raise PolicyConfigurationRunFatal("Duplicate repository policy field")
-        fields[each_key] = each_content
-    return fields
-
-
-def _entry_identity(entry: object) -> tuple[str, str, str]:
-    if not isinstance(entry, dict) or set(entry) != ALL_ENTRY_FIELDS:
-        raise ValueError("Email exemptions require path, sha256, and reason")
-    relative_path, digest, reason = entry["path"], entry["sha256"], entry["reason"]
-    if not isinstance(relative_path, str) or not relative_path:
-        raise ValueError("Email exemption path must name one repository file")
-    if (
-        any(character in FORBIDDEN_PATH_CHARACTERS for character in relative_path)
-        or any(
-            segment in ALL_FORBIDDEN_PATH_SEGMENTS
-            for segment in relative_path.split("/")
-        )
-        or any(
-            ord(character) < FIRST_PRINTABLE_CODEPOINT for character in relative_path
-        )
-    ):
-        raise ValueError("Email exemption path must be a literal relative file path")
-    if not isinstance(digest, str) or DIGEST_PATTERN.fullmatch(digest) is None:
-        raise ValueError("Email exemption sha256 must contain 64 lowercase hex digits")
-    if not isinstance(reason, str) or not reason.strip():
-        raise ValueError(
-            "Email exemption reason must explain its public contact purpose"
-        )
-    return relative_path, "email", digest

package/scripts/repository_checks/path_exemptions.py

@@ -0,0 +1,35 @@
+"""Load frozen-file path exceptions owned by a repository."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from repository_checks.config.policy_document import (
+    PATH_EXEMPTION_SUBJECT,
+    PATH_EXEMPTIONS_FIELD,
+)
+from repository_checks.policy_document import (
+    PolicyConfigurationRunFatal,
+    entry_path_and_digest,
+    read_policy_entries,
+)
+
+
+def load_path_exemptions(repository_root: Path) -> frozenset[tuple[str, str]]:
+    """Read validated frozen-file path exceptions.
+
+    Args:
+        repository_root: Repository containing the optional policy configuration.
+    Returns:
+        Exact path and recorded file-content digest identities.
+    Raises:
+        ValueError: Configuration contains invalid JSON or schema fields.
+        OSError: Configuration cannot be read.
+    """
+    exemptions: set[tuple[str, str]] = set()
+    for each_entry in read_policy_entries(repository_root, PATH_EXEMPTIONS_FIELD):
+        identity = entry_path_and_digest(each_entry, PATH_EXEMPTION_SUBJECT)
+        if identity in exemptions:
+            raise PolicyConfigurationRunFatal("Duplicate repository path exemption")
+        exemptions.add(identity)
+    return frozenset(exemptions)