claude-dev-env 7.7.0 → 8.0.0

package/hooks/validators/code_quality_checks.py

@@ -1,9 +1,15 @@
 """Code quality checks validator.
 
 Implements:
-- Check 30: Function too long (max 30 lines)
+- Check 30: Function too long (max 30 lines), production files only
 - Check 31: Nesting too deep (max 2 levels)
-- Check 32: File too long (max 400 lines)
+- Check 32: File too long (max 400 lines), production files only
+
+The two length caps read production files only. A test module grows with the
+surface it covers, and a linear list of assertions is what a reader wants there,
+so capping its length pushes a contributor to split a suite for the counter
+rather than for the reader. ``magic_value_checks`` short-circuits on the same
+category through the same helper.
 """
 
 import ast
@@ -11,6 +17,7 @@ import sys
 from pathlib import Path
 from typing import List
 
+from .exempt_paths import is_test_file
 from .validator_base import Violation, source_text, syntax_tree
 
 
@@ -22,6 +29,9 @@ MAX_FILE_LINES = 400
 def check_function_length(tree: ast.AST, filename: str) -> List[Violation]:
     violations: List[Violation] = []
 
+    if is_test_file(filename):
+        return violations
+
     for node in ast.walk(tree):
         if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
             if node.end_lineno and node.lineno:
@@ -74,6 +84,9 @@ def check_file_length(file_path: Path) -> List[Violation]:
     violations: List[Violation] = []
     filename = str(file_path)
 
+    if is_test_file(filename):
+        return violations
+
     try:
         lines = source_text(file_path).splitlines()
     except Exception as error:

package/hooks/validators/test_code_quality_checks.py

@@ -127,3 +127,25 @@ class TestFileLength:
             assert "400" in violations[0].message or "lines" in violations[0].message.lower()
         finally:
             temp_path.unlink()
+
+
+class TestTestFileExemption:
+    def test_long_function_in_a_test_file_passes(self) -> None:
+        tree = ast.parse(BAD_LONG_FUNCTION)
+        violations = check_function_length(tree, "packages/app/test_widget.py")
+        assert violations == []
+
+    def test_long_function_outside_a_test_file_still_fails(self) -> None:
+        tree = ast.parse(BAD_LONG_FUNCTION)
+        violations = check_function_length(tree, "packages/app/widget.py")
+        assert len(violations) == 1
+
+    def test_long_test_file_passes(self, tmp_path: Path) -> None:
+        temp_path = tmp_path / "test_widget.py"
+        temp_path.write_text("x = 1\n" * 450, encoding="utf-8")
+        assert check_file_length(temp_path) == []
+
+    def test_long_conftest_passes(self, tmp_path: Path) -> None:
+        temp_path = tmp_path / "conftest.py"
+        temp_path.write_text("x = 1\n" * 450, encoding="utf-8")
+        assert check_file_length(temp_path) == []

package/package.json

@@ -1,11 +1,10 @@
 {
     "name": "claude-dev-env",
-    "version": "7.7.0",
+    "version": "8.0.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {
         "claude-dev-env": "bin/install.mjs",
-        "cde-pstack": "bin/pstack.mjs",
         "codex-compat": "bin/codex-compat.mjs",
         "cde": "bin/cde.mjs"
     },

package/rules/ci-owns-the-gate.md

@@ -0,0 +1,58 @@
+# CI Owns the Gate
+
+**When this applies:** Before pushing a branch, and any time a repository's full
+check suite or policy gate is about to run on your own machine.
+
+## Rule
+
+The gate runs once, and it runs on CI. Push the branch, read the verdict, act on
+what it says.
+
+The inner development loop stays yours. Run the single test you are writing, as
+often as it helps. That is how the change gets built. This rule governs the
+second full pass, the one whose only product is a prediction of CI's answer.
+Push instead, and spend the wait on the next piece of work.
+
+## Why
+
+**A pinned gate answers only from its pinned revision.** The workflow names an
+exact revision of the policy package, and that revision decides which rules run.
+The copy under your home directory is a separate artifact at its own revision. A
+run against the home copy reports on those rules, which are a different question
+from the one CI asks. Treat its exit code as information about the home copy
+alone.
+
+**Self-hosted runners often share your machine.** Where the runners execute on
+the same host as your shell, a local suite run draws its processor time from the
+runners, and it does so while they work on the branch you just pushed. Read
+where the runners live, and count a local run against the same budget.
+
+**One authoritative answer beats two.** Where both runs agree, the second one
+restated the first. Where they differ, the environments differ, and CI is the
+environment that decides.
+
+## Running a gate locally
+
+Clone the revision the workflow pins, then point the gate at that clone. That
+run asks CI's question and its answer carries. Report a local result by naming
+the revision it used, so a reader can tell which question it answered.
+
+## The verdict belongs to CI
+
+CI decides whether a change passed, from evidence CI gathered. Keep that loop
+closed. A flag, trailer, receipt, or environment variable through which the
+change under test announces its own result hands the verdict to the subject.
+Where the runner and the agent share one host, a signature names the same party
+twice, so it carries the claim no further.
+
+A cache stays available on one condition. CI derives the key itself from the
+tree it is about to test, looks for a previous run under that key, and
+republishes that result. CI computes, CI verifies, CI decides.
+
+## Sibling rules
+
+| Rule | Role |
+|---|---|
+| [`git-workflow.md`](git-workflow.md) | Confirm each required context fired after the push |
+| [`verify-runtime-state.md`](verify-runtime-state.md) | A status field is a report; read the thing the work was meant to make |
+| [`falsify-before-green.md`](falsify-before-green.md) | A green counts as evidence once the check has run red on a deliberate break |

package/rules/code-standards.md

@@ -2,7 +2,7 @@
 
 > **Canonical review contract:** [`CODE_RULES.md`](../docs/CODE_RULES.md) — the human and AI review contract for code quality, loaded on demand.
 > **Checked-in pointer:** [`.cursor/BUGBOT.md`](../../../.cursor/BUGBOT.md) — the file Cursor BugBot reads; it points at `CODE_RULES.md`.
-> **Production enforcement.** The staged policy lint runs `hooks/blocking/code_rules_enforcer.py` over each changed file. No write-time hook runs it. Use `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit, and CI runs the same lint against the merge base. Each mechanical rule carries a synchronization test.
+> **Production enforcement.** The staged policy lint runs `hooks/blocking/code_rules_enforcer.py` over each changed file. No write-time hook runs it. CI runs that lint against the merge base. Each mechanical rule carries a synchronization test.
 
 ## Policy surface map
 
@@ -27,7 +27,6 @@ BDD is the outer process and TDD is the inner loop: [`bdd.md`](bdd.md) discovers
 
 | Concern | Rule file |
 |---|---|
-| Question routing | [`ask-user-question-required.md`](ask-user-question-required.md) |
 | Task tracking / worker completion | [`workers-done-before-complete.md`](workers-done-before-complete.md) |
 | Multi-step task list | skill `task-build` (see agents catalog) |
 

package/rules/docstring-prose-matches-implementation.md

@@ -28,13 +28,13 @@ Read the body and the docstring side by side. Apply each check that matches the
 - **Gate-outcome status flags** — an outcome routed to a blocker (`blocker = ...; break`) reads as blocked everywhere, never as a bypass.
 - **Returns / Raises / Note claims** — each free-form claim matches the body.
 
-Many deterministic shapes of this drift are checked in `code_rules_docstrings.py` (and the JS and `.mjs` slices in `code_rules_imports_logging.py`). The staged policy lint reaches both through `code_rules_enforcer.py`, and no write-time hook runs them. Run `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit. Free-form rest is judgment.
+Many deterministic shapes of this drift are checked in `code_rules_docstrings.py` (and the JS and `.mjs` slices in `code_rules_imports_logging.py`). The staged policy lint reaches both through `code_rules_enforcer.py`, and CI runs it against the merge base. Free-form rest is judgment.
 
 ## Hook prose matches its detector
 
 A hook module is the sharpest case of the same rule: its docstring lead narrative and its `CORRECTIVE_MESSAGE` describe exactly the shapes the detector flags, and claim no broader trigger surface than the regex enforces.
 
-The staged policy lint carries this as its `hook-prose-consistency` rule, covering hook modules and their `*_constants.py` companions. It reports prose that claims a trigger the detector never fires on, and names the fix. No write-time hook runs it, so run `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit.
+The staged policy lint carries this as its `hook-prose-consistency` rule, covering hook modules and their `*_constants.py` companions. It reports prose that claims a trigger the detector never fires on, and names the fix. No write-time hook runs it, so CI is where it reports.
 
 After writing a hook, ask: would a token matching every word of this message actually trip the detector? When the message names a shape the regex skips, rewrite the message to name only what the regex catches. The path-shape case is the common overstatement — a detector that keys off a path separator must not claim it blocks an "output-key segment". The corrective message spells the rewrite.
 

package/rules/failure-blast-radius.md

@@ -64,7 +64,7 @@ The report then presents each candidate to the owner for a durable-fix decision,
 
 ## Enforcement
 
-`code_rules_blast_radius.py` runs inside `code_rules_enforcer.py`, which the staged policy lint applies to each changed file under its `code-rules` rule. No write-time hook runs it, so run `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit. CI runs the same lint against the merge base.
+`code_rules_blast_radius.py` runs inside `code_rules_enforcer.py`, which the staged policy lint applies to each changed file under its `code-rules` rule. No write-time hook runs it, so CI is where it reports. CI runs the same lint against the merge base.
 
 The check requires each raised type written directly inside a loop body to end in `RunFatal` or `ItemBlocked`. The lexical check covers raises written directly in loop bodies. Shared helpers carry multiple caller contexts, so their callers classify the boundary.
 

package/rules/git-workflow.md

@@ -29,9 +29,10 @@ opens with the bot's own marker line. The description rules in this file, the
 failure signature in the release job log reads
 `could not parse pull request body as a release PR`.
 
-Use the `pr-description-writer` agent before creating a pull request or
-rewriting its full description. Publish its title and body file through
-`.agents/skills/pull-request/scripts/pull_request.py`.
+The `pr-description-writer` agent writes a title and body from the diff when
+you want one. Publish the title and body file through
+`~/.agents/skills/pull-request/scripts/pull_request.py`. That path is under the
+agents home, not the repository. A worktree holds no `.agents/` copy.
 
 Resolve the active managed root (`CLAUDE_CONFIG_DIR` when set, `~/.claude`
 otherwise), then run `<managed-root>/scripts/durable_post_lint.py` before any
@@ -50,14 +51,25 @@ untouched.
    - Before push: `gh pr ready --undo`
    - After review approved: `gh pr ready`
 
-## Run the required checks locally before the first push
+## Confirm the required checks fired, and let CI run them
 
-Read the branch ruleset for the required check contexts before you push a branch,
-or any level of a stack: `gh api repos/<owner>/<repo>/rules/branches/<trunk>`.
-Then run that exact gate command locally against that level's own base, on every
-level. A required check that never fired is invisible debt at every level, and it
-surfaces only after the whole stack is pushed, when the repair costs a second pass
-over every branch.
+The gate runs once, and it runs on CI. Push the branch and read its verdict.
+[`ci-owns-the-gate.md`](ci-owns-the-gate.md) holds the reasoning and the shape
+a local run takes when one is warranted.
+
+Read the branch ruleset for the required check contexts before you push a
+branch, or any level of a stack: `gh api repos/<owner>/<repo>/rules/branches/<trunk>`.
+Read it to learn which checks must report. After the push, confirm each of those
+contexts appears on that level's head. A required check that never fired is
+invisible debt at every level, and it surfaces only after the whole stack is
+pushed, when the repair costs a second pass over every branch.
+
+A red required check blocks the branch, whoever owns the failing line. The gate
+charges a change for the whole file it touches, so "pre-existing on main" is a
+blame note, not a pass. Fix the line in the next push or report the branch
+blocked. Read the gate's own report rather than a narrower substitute. A
+single-file mypy call cannot see sibling modules and reports false import
+errors, so it neither clears nor convicts a change.
 
 A checks listing that reports nothing on the branch is a finding, not a neutral
 state. Find out whether the workflow's event filters exclude the branch, or whether
@@ -82,7 +94,7 @@ what it calls.
 Force-with-lease protects the ref. It protects nobody's understanding of what the
 branch now holds. When a rewrite moves content between levels of a stack, or
 otherwise changes what a branch contains, refresh that pull request's description
-through the `pr-description-writer` agent before you ask anyone to read or merge it.
+before you ask anyone to read or merge it.
 
 ## Never commit working documents or images
 

package/rules/orphan-css-class.md

@@ -15,7 +15,7 @@ When you add a `class="..."` attribute, add its `.<class>` selector to the `<sty
 
 ## What the check covers
 
-The `check_orphan_css_classes` check in `code_rules_orphan_css_class.py` reaches production Python through the staged policy lint, whose `code-rules` rule loads `code_rules_enforcer.py` and applies it to each changed file. Run `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit. CI runs the same lint against the merge base. It:
+The `check_orphan_css_classes` check in `code_rules_orphan_css_class.py` reaches production Python through the staged policy lint, whose `code-rules` rule loads `code_rules_enforcer.py` and applies it to each changed file. CI runs that lint against the merge base. It:
 
 1. Collects each class name referenced in a `class="..."` attribute across the file's string literals.
 2. Collects each class selector defined in a `<style>` block — both in the file under edit and in every Python module beside it (its own directory and immediate child directories), since a markup module commonly imports its style constant from a companion package directory.

package/rules/paired-test-coverage.md

@@ -18,7 +18,7 @@ When you add a public function to a module whose test suite already exercises th
 
 ## What the check covers
 
-Two complementary checks in `code_rules_paired_test.py` reach changed files through `code_rules_enforcer.py`, which the staged policy lint runs under its `code-rules` rule. No write-time hook runs them, so run `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit. CI runs the same lint against the merge base. The two checks cover the two write orders.
+Two complementary checks in `code_rules_paired_test.py` reach changed files through `code_rules_enforcer.py`, which the staged policy lint runs under its `code-rules` rule. No write-time hook runs them, so CI is where they report, against the merge base. The two checks cover the two write orders.
 
 `check_public_function_missing_paired_test` runs on a production Python write or edit and flags a public function when all of these hold:
 

package/rules/retired-hook-prose.md

@@ -7,7 +7,7 @@ paths:
 
 A hook module runs when `hooks/hooks.json` registers it or a dispatcher roster hosts it. A module can survive on disk while appearing in neither place, and it then reaches no tool call. Prose that gives such a module a present-tense action describes a gate the reader never faces, and a reader who trusts it skips the check they were meant to run by hand.
 
-The staged policy lint carries this check as its `retired-hook-prose` rule. It reads each Markdown file under a `rules/` directory, takes every backticked hook module name, and reports the ones that are registered nowhere and that carry a present-tense action verb in the rest of the sentence. Run `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit. CI runs the same lint against the merge base.
+The staged policy lint carries this check as its `retired-hook-prose` rule. It reads each Markdown file under a `rules/` directory, takes every backticked hook module name, and reports the ones that are registered nowhere and that carry a present-tense action verb in the rest of the sentence. CI runs that lint against the merge base.
 
 A module name counts as a hook when it ends in one of the hook families, such as `_blocker`, `_enforcer`, `_gate`, `_tracker`, or `_dispatcher`, and when it either sits under `hooks/` or appears in `RETIRED_HOOK_REGISTRATION_RELATIVE_PATHS` in `bin/install.mjs`. A support module inside the hooks tree carries no such family suffix, so it stays out of the check. A hook deleted from disk without an entry in that roster resolves nowhere, so add the roster entry when you retire a hook.
 

package/rules/subagent-model-policy.json

@@ -53,7 +53,6 @@
     {"model": "luna", "effort": "high"},
     {"model": "luna", "effort": "xhigh"},
     {"model": "luna", "effort": "max"},
-    {"model": "sol", "effort": "medium"},
     {"model": "astra", "effort": "low"},
     {"model": "astra", "effort": "medium"},
     {"model": "astra", "effort": "high", "roles": ["advisor"]}
@@ -66,6 +65,7 @@
     {"requested": {"model": "luna", "effort": "low"}, "selected": {"model": "luna", "effort": "high"}},
     {"requested": {"model": "luna", "effort": "medium"}, "selected": {"model": "luna", "effort": "high"}},
     {"requested": {"model": "sol", "effort": "low"}, "selected": {"model": "luna", "effort": "xhigh"}},
+    {"requested": {"model": "sol", "effort": "medium"}, "selected": {"model": "luna", "effort": "max"}},
     {"requested": {"model": "terra", "effort": "low"}, "selected": {"model": "luna", "effort": "xhigh"}},
     {"requested": {"model": "terra", "effort": "medium"}, "selected": {"model": "luna", "effort": "xhigh"}},
     {"requested": {"model": "terra", "effort": "high"}, "selected": {"model": "luna", "effort": "xhigh"}},

package/rules/verify-before-asking.md

@@ -27,7 +27,7 @@ Only after confirming the answer cannot be obtained through any available tool,
 A path, port, branch name, or config value you recall from an earlier session counts as unanswered until a tool re-checks it this session. Memory records what was true when it was written; the file may have moved, the port may be down, the branch may have merged. Treat every recalled fact as a claim to re-ground, not an answer to reuse.
 
 - When a tool can settle it, re-check in silence and act on the fresh result — no question to the user.
-- When no tool can settle it and the user has a stake in the answer, ask through `AskUserQuestion` (see [`confirm-implementation-forks`](confirm-implementation-forks.md)).
+- When no tool can settle it and the user has a stake in the answer, ask through `AskUserQuestion`.
 
 ## Questions That Belong to the User
 

package/rules/windows-filesystem-safe.md

@@ -12,6 +12,6 @@ Never call `shutil.rmtree` with `ignore_errors=True` — Windows `ReadOnly` file
 
 In Node, call `mkdirSync(targetPath, { recursive: true })` on possibly-existing paths — `ReadOnly` directories break the non-recursive form. When the call must be non-recursive, strip the attribute first (`(Get-Item $path -Force).Attributes = "Directory"` / `os.chmod(path, stat.S_IWRITE)`).
 
-The staged policy lint carries this check as its `rmtree-safety` rule. It reports the unsafe rmtree pattern and returns the full `force_rmtree` safe-pattern code. Run `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit. CI runs the same lint against the merge base.
+The staged policy lint carries this check as its `rmtree-safety` rule. It reports the unsafe rmtree pattern and returns the full `force_rmtree` safe-pattern code. CI runs that lint against the merge base.
 
 Define the safe handler trio (`_strip_read_only_and_retry`, `_force_remove_tree` / `force_rmtree`, and the `inspect.signature` onexc/onerror guard) once in a shared Windows-filesystem utility module, and import it from every call site. A second local copy drifts from the first, so a fix lands in one and the other keeps the bug (CODE_RULES.md, CORE PRINCIPLES, "Reuse before create"). The same `rmtree-safety` lint rule reports a local re-definition of any trio member outside the shared home and points the writer at the import. This complements the same-directory `check_duplicate_function_body_across_files` check, which a copy between two distant packages slips past.

package/rules/workflow-substitution-slots.md

@@ -9,4 +9,4 @@ In a `.workflow.js` agent-prompt template, every per-call or per-iteration value
 
 When a loop builds a per-iteration path or output key, write the index as a slot — `cand_<i>` — or spell out `replace <i> with the iteration index 0, 1, 2` in the step text. Every per-call value in a `.workflow.js` template carries angle brackets so an agent fills in a fresh value per call.
 
-The staged policy lint carries this check as its `workflow-substitution` rule. It reports a `.workflow.js` file whose looped content holds a bare `<word>_<i|j|k>` token as a per-iteration path segment. Run `python packages/claude-dev-env/scripts/cde_lint.py --staged` before you commit. CI runs the same lint against the merge base. No write-time hook reports this, so a bare token stays on disk until the lint runs.
+The staged policy lint carries this check as its `workflow-substitution` rule. It reports a `.workflow.js` file whose looped content holds a bare `<word>_<i|j|k>` token as a per-iteration path segment. CI runs that lint against the merge base. No write-time hook reports this, so a bare token stays on disk until the lint runs.

package/scripts/Sync-RepoMain.ps1

@@ -11,7 +11,10 @@
   - Only runs when the checked-out branch is the named branch
   - Only runs when there are no tracked changes (untracked files are fine),
     unless -StashDirty is passed
-  - Uses merge --ff-only only (never force, never hard reset, never clean)
+  - Uses merge --ff-only (never force, never hard reset, never clean)
+  - When the fast-forward fails because the files were already copied in,
+    moves HEAD with a mixed reset, which writes no files. It keeps that move
+    only when every file the remote changed now matches the remote
   - Logs and exits non-zero on skip, diverge, or failure so a Task Scheduler
     history row can surface a problem instead of a silent no-op
 
@@ -128,6 +131,64 @@ function Invoke-GitOrExit {
     return $result.Output
 }
 
+function Get-NulSeparatedPaths {
+    param(
+        [Parameter(Mandatory)]
+        [AllowEmptyString()]
+        [string]$Output
+    )
+    return @($Output -split "`0" | Where-Object { $_ })
+}
+
+function Invoke-AdoptCopiedTree {
+    <#
+      Handles a mirror whose files are refreshed by copy while its HEAD stays
+      behind. The fast-forward then refuses to overwrite the copied files,
+      even though they already hold the remote content.
+
+      A mixed reset moves HEAD and the index to the remote tip and writes no
+      files. If any file the remote changed still differs afterwards, the
+      reset goes back to the old tip, so the tree ends as it started.
+    #>
+    param(
+        [Parameter(Mandatory)]
+        [string]$LocalTip,
+        [Parameter(Mandatory)]
+        [string]$RemoteRef
+    )
+    $stagedResult = Invoke-Git -Arguments @('diff', '--cached', '--quiet')
+    if ($stagedResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'ERROR' -Message 'adopt skipped: the index holds staged changes'
+        return $false
+    }
+    $changedResult = Invoke-Git -Arguments @('diff', '--name-only', '--no-renames', '-z', $LocalTip, $RemoteRef)
+    if ($changedResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'ERROR' -Message "adopt skipped: cannot list remote changes: $($changedResult.Output)"
+        return $false
+    }
+    $allRemoteChangedPaths = [System.Collections.Generic.HashSet[string]]::new([string[]](Get-NulSeparatedPaths -Output $changedResult.Output))
+
+    $resetResult = Invoke-Git -Arguments @('reset', '-q', $RemoteRef)
+    if ($resetResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'ERROR' -Message "adopt skipped: mixed reset failed: $($resetResult.Output)"
+        return $false
+    }
+    $differResult = Invoke-Git -Arguments @('diff', '--name-only', '--no-renames', '-z')
+    $allMismatchedPaths = @(Get-NulSeparatedPaths -Output $differResult.Output | Where-Object { $allRemoteChangedPaths.Contains($_) })
+    if ($differResult.ExitCode -eq 0 -and $allMismatchedPaths.Count -eq 0) {
+        return $true
+    }
+
+    $revertResult = Invoke-Git -Arguments @('reset', '-q', $LocalTip)
+    if ($revertResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'ERROR' -Message "adopt revert to $LocalTip failed; HEAD is at $RemoteRef with no file changed: $($revertResult.Output)"
+        return $false
+    }
+    $shownPaths = ($allMismatchedPaths | Select-Object -First 20) -join '; '
+    Write-SyncLog -Level 'ERROR' -Message "adopt refused: $($allMismatchedPaths.Count) file(s) the remote changed differ from it; HEAD kept at ${LocalTip}: $shownPaths"
+    return $false
+}
+
 try {
     if (-not (Test-Path -LiteralPath $RepoPath)) {
         Write-SyncLog -Level 'ERROR' -Message "repo path missing: $RepoPath"
@@ -194,14 +255,18 @@ try {
         Write-SyncLog -Level 'ERROR' -Message "merge --ff-only failed: $($mergeResult.Output)"
         if ($didStash) {
             $popResult = Invoke-Git -Arguments @('stash', 'pop')
-            if ($popResult.ExitCode -eq 0) {
-                Write-SyncLog -Level 'OK' -Message "restored the stashed edits to the working tree after the failed fast-forward"
-            }
-            else {
+            if ($popResult.ExitCode -ne 0) {
                 Write-SyncLog -Level 'ERROR' -Message ("stash pop failed after the failed fast-forward; the edits are still stashed as '" + $stashMessage + "' — recover them with git stash list and git stash pop: " + $popResult.Output)
+                exit 1
             }
+            Write-SyncLog -Level 'OK' -Message "restored the stashed edits to the working tree after the failed fast-forward"
         }
-        exit 1
+        if (-not (Invoke-AdoptCopiedTree -LocalTip $localTip -RemoteRef "$Remote/$Branch")) {
+            exit 1
+        }
+        $subject = Get-GitDecoration -Arguments @('log', '-1', '--format=%h %s') -Placeholder '<subject unavailable>'
+        Write-SyncLog -Level 'OK' -Message "$Branch $localTip -> $remoteTip adopted (files already matched) | $subject"
+        exit 0
     }
 
     $subject = Get-GitDecoration -Arguments @('log', '-1', '--format=%h %s') -Placeholder '<subject unavailable>'

package/scripts/policy_lint/adapter_detectors.py

@@ -91,31 +91,137 @@ def _messages_for_validator_outcomes(
     )
 
 
+def _validator_messages_for_text(
+    document: Document,
+    absolute_path: Path,
+    text: str,
+    validator_module: ModuleType,
+) -> tuple[str, ...]:
+    all_validator_outcomes = validator_module.validate_proposed_file(
+        absolute_path.as_posix(),
+        text,
+        config_source_path=absolute_path,
+        include_ruff=False,
+        excluded_validator_names=constants.ALL_OVERLAPPING_VALIDATOR_NAMES,
+    )
+    return _messages_for_validator_outcomes(document, all_validator_outcomes)
+
+
+def _message_body(message: str) -> str:
+    _head, separator, body = message.partition(
+        constants.VALIDATOR_MESSAGE_PREFIX_SEPARATOR
+    )
+    return body if separator and body else message
+
+
+def _message_identity(message: str) -> str:
+    return constants.VALIDATOR_MESSAGE_DIGIT_PATTERN.sub(
+        constants.VALIDATOR_MESSAGE_DIGIT_PLACEHOLDER, _message_body(message)
+    )
+
+
+def _all_measured_sizes(message: str) -> tuple[int, ...]:
+    return tuple(
+        int(each_digit_run)
+        for each_digit_run in constants.VALIDATOR_MESSAGE_DIGIT_PATTERN.findall(
+            _message_body(message)
+        )
+    )
+
+
+def _has_grown_since(message: str, prior_message: str) -> bool:
+    return any(
+        each_size > each_prior_size
+        for each_size, each_prior_size in zip(
+            _all_measured_sizes(message), _all_measured_sizes(prior_message)
+        )
+    )
+
+
+def _prior_messages_by_identity(
+    all_prior_messages: tuple[str, ...],
+) -> dict[str, list[str]]:
+    all_prior_by_identity: dict[str, list[str]] = {}
+    for each_prior_message in all_prior_messages:
+        all_prior_by_identity.setdefault(
+            _message_identity(each_prior_message), []
+        ).append(each_prior_message)
+    return all_prior_by_identity
+
+
+def _is_introduced_message(
+    message: str, all_prior_by_identity: dict[str, list[str]]
+) -> bool:
+    all_matches = all_prior_by_identity.get(_message_identity(message))
+    if not all_matches:
+        return True
+    return _has_grown_since(message, all_matches.pop())
+
+
+def _messages_introduced_by_the_change(
+    all_candidate_messages: tuple[str, ...],
+    all_prior_messages: tuple[str, ...],
+) -> tuple[str, ...]:
+    """Keep the messages the prior text did not already carry.
+
+    ::
+
+        prior: Function 'main' is 47 lines (max 30)
+        now:   Function 'main' is 47 lines (max 30)   -> dropped, untouched debt
+        now:   Function 'main' is 61 lines (max 30)   -> kept, the change grew it
+        now:   Function 'added' is 47 lines (max 30)  -> kept, a new breach
+
+    A message keeps its identity when it moves down the file or its measured
+    size falls, so only a new breach or a worse one survives. Each prior message
+    covers one candidate.
+
+    Args:
+        all_candidate_messages: Messages the post-edit text produced.
+        all_prior_messages: Messages the prior text produced.
+
+    Returns:
+        The messages this change is answerable for.
+    """
+    all_prior_by_identity = _prior_messages_by_identity(all_prior_messages)
+    return tuple(
+        each_message
+        for each_message in all_candidate_messages
+        if _is_introduced_message(each_message, all_prior_by_identity)
+    )
+
+
 def validator_diagnostics(
     document: Document,
     repository_root: Path,
     load_module: adapter_support.HookModuleLoader,
 ) -> tuple[Diagnostic, ...]:
-    """Run the fast validator set on one document.
+    """Run the fast validator set on one document, scoped to the change.
+
+    A module already over the file-length cap reported that breach on every edit
+    it received, so a one-line change failed on debt it did not create. Grading
+    the prior text the same way and subtracting leaves the breaches this change
+    introduced or made worse.
 
     Args:
-        document: Current source text and path.
+        document: Current source text, prior text, and path.
         repository_root: Request repository root for configuration resolution.
         load_module: Hook module loader.
 
     Returns:
-        Path-normalized diagnostics for failed validators.
+        Path-normalized diagnostics for the failures this change is answerable for.
     """
     absolute_path = adapter_support._document_path(repository_root, document)
     validator_module = load_module("validators.run_all_validators")
-    all_validator_outcomes = validator_module.validate_proposed_file(
-        absolute_path.as_posix(),
-        document.text,
-        config_source_path=absolute_path,
-        include_ruff=False,
-        excluded_validator_names=constants.ALL_OVERLAPPING_VALIDATOR_NAMES,
+    all_messages = _validator_messages_for_text(
+        document, absolute_path, document.text, validator_module
     )
-    all_messages = _messages_for_validator_outcomes(document, all_validator_outcomes)
+    if document.prior_text is not None:
+        all_prior_messages = _validator_messages_for_text(
+            document, absolute_path, document.prior_text, validator_module
+        )
+        all_messages = _messages_introduced_by_the_change(
+            all_messages, all_prior_messages
+        )
     return adapter_support._diagnostics_for_messages(document, "validators", all_messages)
 
 

package/scripts/policy_lint/config/approved_test_pairs.py

@@ -30,6 +30,18 @@ APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
             ),
         }
     ),
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/blocking/code_rules_enforcer.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_dispatch_wiring.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_cap_meta.py"
+            ),
+        }
+    ),
     PurePosixPath(
         "packages/claude-dev-env/hooks/git-hooks/verification_notice_context.py"
     ): frozenset(

package/scripts/policy_lint/config/constants.py

@@ -72,6 +72,9 @@ FAST_SAVE_VALIDATORS_STEM = "fast_save_validators"
 ALL_OVERLAPPING_VALIDATOR_NAMES = frozenset(
     {"Python Style", "Magic Values", "Type Safety", "Test Safety", "React"}
 )
+VALIDATOR_MESSAGE_PREFIX_SEPARATOR = ": "
+VALIDATOR_MESSAGE_DIGIT_PATTERN = re.compile(r"\d+")
+VALIDATOR_MESSAGE_DIGIT_PLACEHOLDER = "#"
 ALL_PR_LOOP_SCRIPTS_PATH_SEGMENTS = ("_shared", "pr-loop", "scripts")
 TERMINOLOGY_SWEEP_MODULE_NAME = "terminology_sweep"
 TERMINOLOGY_SWEEP_RULE_ID = "terminology-sweep"