claude-dev-env 8.10.0 → 8.11.1

package/pstack-codex-models.md

@@ -0,0 +1,37 @@
+# pstack model configuration
+
+feature, refactoring: gpt-6-sol
+bug-fix: gpt-6-astra
+perf-issue: gpt-6-sol
+hillclimb: gpt-6-sol
+judgment and prose: gpt-6-astra
+strongest judgment: gpt-6-astra
+how explorer: gpt-6-luna
+how explainer: gpt-6-luna
+why investigators: gpt-6-luna
+why synthesizer: gpt-6-luna
+reflect tooling: gpt-6-sol
+reflect judgment, divergent, synthesizer: gpt-6-astra
+arena runners: gpt-6-astra, gpt-6-sol, gpt-6-luna
+arena cross-judge pool: gpt-6-astra, gpt-6-sol, gpt-6-luna
+swarm workers: gpt-6-luna
+architect runners: gpt-6-astra, gpt-6-sol, gpt-6-luna
+interrogate reviewers: gpt-6-astra, gpt-6-sol, gpt-6-luna
+
+## Reasoning effort
+
+Single-model Luna roles use max. Astra roles use low. Sol roles use medium.
+Panel entries use low, max, xhigh in the listed order.
+Keep duplicate panel entries. Each entry specifies one candidate.
+The cross-judge pool retains the effort paired with each entry.
+
+Apply these substitutions once to incoming model requests:
+- Sol medium through Luna max requests use gpt-6-luna with max effort.
+- Sol high or higher requests use gpt-6-astra with low effort.
+- Terra requests use gpt-6-luna with xhigh effort.
+- Existing Luna requests use gpt-6-luna with high effort.
+
+Explicit role and panel settings above take precedence over substitutions.
+Do not apply substitutions again to their output.
+
+session hook: on

package/rules/bdd.md

@@ -13,7 +13,7 @@
 1. **Deliberate Discovery** — Reduce uncertainty before code; surface what you do not know (Smart & Molak §5.4).
 2. **Illustrate** — Explore goals, constraints, and concrete examples in chat; "given … when … then …" style outcomes.
 3. **Formulate** — Express behavior as narrow **"should …"** specifications the user can approve.
-4. **Automate** — Build each formulated behavior through the TDD inner loop: CODE_RULES §8, red-green-refactor, canonical as stated in [`code-standards.md`](code-standards.md).
+4. **Automate** — Build each formulated behavior with tests. Red-green-refactor is the default loop, and the TDD skill (`pstack:tdd`) carries it: CODE_RULES §8, as stated in [`code-standards.md`](code-standards.md). A prototype may run ahead of its tests and adds them before the pull request goes ready.
 
 Conversation is the essential practice: if discovery is skipped, structured formats do not rescue the workflow (Minimal BDD).
 

package/rules/build-needs-a-user.md

@@ -0,0 +1,53 @@
+# Build Needs a User
+
+**When this applies:** Before you build a new tool, script, hook, gate, skill,
+command, or workflow step. That includes a hook or check built to answer a
+correction.
+
+## Rule
+
+Answer three questions before the first line of the build:
+
+1. **Who calls it?** Name the hook entry, workflow step, skill, command, or
+   module that will run it in this same change.
+2. **When does it first run?** Name the date or the event of first use.
+3. **When was this job last done by hand?** Name the last time, and how often it
+   comes up.
+
+Build when all three have a concrete answer. When the only answer is "it might
+help" or "we could use it later", stop and send the owner one line: what the
+build is for and which question has no answer. Keep the rest of the task moving
+while that line waits.
+
+Search first, per [`prefer-existing-tools.md`](prefer-existing-tools.md). A
+tool that already exists answers the need, and the build is the glue.
+
+## Size the first build to the first use
+
+Build the smallest version that serves the first caller. A correction starts
+as a row in a rule file. It becomes a hook or a lint only when the same
+correction arrives a second time, per
+[`correction-lens.md`](correction-lens.md).
+
+## Where it is enforced
+
+The staged policy lint's `uncalled-new-file` rule reads each code file a change
+adds under `scripts/`, `hooks/`, `bin/`, `ci/`, or `tools/`. It reports the file when its name
+appears only in its own tests, `CHANGELOG.md`, `README.md`, and
+`bin/ever-shipped-skills.mjs`. CI runs that lint against the merge base, so a
+file with no caller turns the pull request red.
+
+## Why
+
+The history of this package holds files that lived weeks and ran never. The
+Codex compatibility watcher shipped 502 lines and 599 lines of tests in July,
+and PR 1488 deleted it in September. Its own test was the only file that named
+it.
+
+## Sibling rules
+
+| Rule | Role |
+|---|---|
+| [`prefer-existing-tools.md`](prefer-existing-tools.md) | Search before you build |
+| [`correction-lens.md`](correction-lens.md) | A repeated correction moves up a layer |
+| [`archiving-agent-config.md`](archiving-agent-config.md) | How an unused capability leaves service |

package/rules/code-standards.md

@@ -18,7 +18,7 @@ Load `CODE_RULES.md` when reviewing a PR, resolving a policy conflict, or genera
 
 Two standards live in `CODE_RULES.md` in full:
 
-- **TDD** — CODE_RULES §8 / AGENTS Tests: red, green, refactor; no production code before a failing test.
+- **TDD** — CODE_RULES §8: red, green, refactor is the default loop for a bug fix and for new behavior, and the TDD skill (`pstack:tdd`) carries the procedure. A prototype may run ahead of its tests and adds them before the pull request goes ready. A bug fix ships with a test that reproduces the bug.
 - **Right-sized engineering** — CODE_RULES §7 / AGENTS Design: functions over classes; concrete over abstract; add an abstraction at the commit that introduces its second concrete implementation. That count is a house call, one occurrence earlier than the rule of three Fowler credits to Don Roberts. The direction comes from the literature; the number does not, so read it as this package's setting rather than as a cited standard.
 
 BDD is the outer process and TDD is the inner loop: [`bdd.md`](bdd.md) discovers and formulates the behavior a feature needs, then each formulated behavior is built through the TDD cycle.

package/rules/flag-non-breaking-findings.md

@@ -108,6 +108,13 @@ naming a file that does not exist, an env-var row naming a file that never
 reads the variable, a test outside the testpaths allowlist, and a tracked
 secret.
 
+`scripts/cde_lint.py` splits the policy-lint findings the same way.
+`SEVERITY_BY_CHECK_ID` in `scripts/policy_lint/config/check_catalog_constants.py`
+carries one row per smell, and a check id with no row reads as breaking. Three
+checks are smells there: `test-pairing` and the two paired-test coverage
+checks. The lint prints each as a warning, records it in the ledger, and exits
+zero when no error remains.
+
 ## Sibling rules
 
 | Rule | Role |

package/rules/paired-test-coverage.md

@@ -20,6 +20,8 @@ When you add a public function to a module whose test suite already exercises th
 
 Two complementary checks in `code_rules_paired_test.py` reach changed files through `code_rules_enforcer.py`, which the staged policy lint runs under its `code-rules` rule. No write-time hook runs them, so CI is where they report, against the merge base. The two checks cover the two write orders.
 
+Both checks record smells, per [`flag-non-breaking-findings.md`](flag-non-breaking-findings.md). `SEVERITY_BY_CHECK_ID` in `scripts/policy_lint/config/check_catalog_constants.py` declares `code-rules/paired-test-missing-function` and `code-rules/paired-test-omitted-function` as smells. The lint prints each finding as a warning, records it in `.claude/followups/smells.jsonl`, and exits zero when every finding is a warning. A later pull request adds the missing tests.
+
 `check_public_function_missing_paired_test` runs on a production Python write or edit and flags a public function when all of these hold:
 
 1. The target is production code — not a test module, hook infrastructure, config module, migration, workflow registry, or `__init__.py`.
@@ -33,8 +35,8 @@ A public function counts as covered when its name appears — imported, called,
 
 ## Relationship to the file-level TDD order
 
-`tdd_enforcer.py` once required a fresh test file to exist before a production module was written, judging coverage one file at a time. Nothing runs it now, and the staged policy lint carries no replacement, so the test-first order is yours to hold. This check judges coverage one function at a time for a module that already carries such a test file. Write the test file first, and the lint then reports any public function that file leaves uncovered.
+No hook or lint checks the order in which a test and its module are written. Red-green-refactor is the default loop, and the TDD skill (`pstack:tdd`) carries it; a prototype may run ahead of its tests and adds them before the pull request goes ready. This check judges coverage one function at a time for a module that already carries a stem-matched test file, and reports any public function that file leaves uncovered.
 
 ## Why this check is mechanical
 
-A public function with no test reads as covered when the module's test file sits right beside it and exercises its siblings. The gap survives review because the suite looks complete. Running the lint on every staged change keeps the module's public surface and its test suite in step.
+A public function with no test reads as covered when the module's test file sits right beside it and exercises its siblings. The gap survives review because the suite looks complete. Running the lint on every staged change records each gap in the follow-up ledger, where `cde followup list` names it until a pull request closes it.

package/rules/testing.md

@@ -25,4 +25,8 @@ Tests exercise production behavior, production data, and production code paths.
 
 ## No Gate Holds the Test-First Order
 
-`tdd_enforcer.py` once required a fresh, failing test before a production module was written. Nothing runs it now, and the staged policy lint carries no replacement. Hold the red-green-refactor order yourself, and let review check it on the diff.
+Red, green, refactor is the default loop for a bug fix and for new behavior. The TDD skill (`pstack:tdd`) carries the procedure, and no hook or lint checks the order. A prototype may run ahead of its tests and adds them before the pull request goes ready. A bug fix ships with a test that reproduces the bug. Review reads the tests on the diff.
+
+## A Fix Carries Its Proof Test
+
+The `Fix test proof` job in `.github/workflows/pr-check.yml` runs `_shared/pr-loop/scripts/fix_pr_test_proof.py` on every pull request whose title starts with `fix`. A fix that changes production code must change at least one Python or Node test that fails on the base and passes on the head. Node tests are files ending in `.test.mjs`, `.test.js`, or `.test.cjs`, and the job runs them with `node --test`. A fix that changes only docs or CI config passes. A fix proven by a PowerShell test needs a Python or Node test beside it.

package/scripts/cde_lint.py

@@ -11,11 +11,24 @@ from typing import Never, TextIO
 
 from policy_lint.config.constants import INVALID_INPUT_EXIT_CODE
 from policy_lint.engine import lint
-from policy_lint.model import LintReport, LintRequest, SelectionKind, TextDocument
+from policy_lint.model import (
+    LintReport,
+    LintRequest,
+    SelectionKind,
+    Severity,
+    TextDocument,
+)
 from policy_lint.render import ReportFormat, render
 from policy_lint.selection import SelectionRunFatal
 from policy_lint.selection_git import GitSelectionError, git_bytes_for
 
+_hooks_directory = str(Path(__file__).resolve().parents[1] / "hooks")
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from followup_ledger import FollowupFinding, head_commit, record_followup_finding
+from hooks_constants.followup_ledger_constants import SEVERITY_SMELL
+
 
 class _LintUsageError(ValueError):
     """Raised when command arguments cannot form a source selection."""
@@ -201,6 +214,38 @@ def _write_invalid_input(error: Exception, stderr: TextIO) -> int:
     return INVALID_INPUT_EXIT_CODE
 
 
+def _record_warning_followups(report: LintReport, repository_root: Path) -> None:
+    """Append each warning in the report to the repository's follow-up ledger.
+
+    Args:
+        report: The findings this run produced.
+        repository_root: The repository whose ledger receives the warnings.
+    """
+    all_warnings = [
+        each_diagnostic
+        for each_diagnostic in report.diagnostics
+        if each_diagnostic.severity is Severity.WARNING
+    ]
+    if not all_warnings:
+        return
+    origin_commit = head_commit(repository_root)
+    for each_warning in all_warnings:
+        file_path = (
+            "" if each_warning.location is None else each_warning.location.path.as_posix()
+        )
+        record_followup_finding(
+            repository_root,
+            FollowupFinding(
+                each_warning.rule_id,
+                file_path,
+                each_warning.message,
+                each_warning.check_id or each_warning.rule_id,
+                SEVERITY_SMELL,
+                origin_commit,
+            ),
+        )
+
+
 def _render_lint(
     all_arguments: Sequence[str],
     repository_root: Path,
@@ -212,6 +257,7 @@ def _render_lint(
         all_arguments, stdin, repository_root, lint_runner
     )
     stdout.write(render(report, report_format))
+    _record_warning_followups(report, repository_root)
     return report.exit_code
 
 

package/scripts/policy_lint/adapter_callers.py

@@ -0,0 +1,124 @@
+"""Report a new code file that nothing outside its own tests calls.
+
+A script, hook or skill script earns its place when something runs it: a
+``hooks.json`` entry, a workflow step, a skill or command, or an import from
+live code. A file whose only mention is its own test ships work nobody uses.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path, PurePosixPath
+
+from .config import constants
+from .model import Diagnostic, Document, DocumentSet, Location, SelectionKind, Severity
+
+
+def _is_test_path(path: PurePosixPath) -> bool:
+    return (
+        path.name.startswith("test_")
+        or path.stem.endswith("_test")
+        or ".test." in path.name
+        or "tests" in path.parts
+        or "test" in path.parts
+    )
+
+
+def _is_new_code_file(document: Document) -> bool:
+    if document.prior_text is not None or document.prior_path is not None:
+        return False
+    path = document.path
+    if path.suffix.lower() not in constants.ALL_CALLED_CODE_SUFFIXES:
+        return False
+    if path.name in constants.ALL_UNCALLED_EXEMPT_FILE_NAMES or _is_test_path(path):
+        return False
+    normalized_path = f"/{path.as_posix()}"
+    return any(
+        each_segment in normalized_path
+        for each_segment in constants.ALL_CALLED_CODE_SEGMENTS
+    )
+
+
+def _is_caller_source(
+    relative_path: PurePosixPath, all_candidate_paths: frozenset[PurePosixPath]
+) -> bool:
+    if constants.ALL_CALLER_SEARCH_SKIPPED_DIRECTORIES.intersection(
+        relative_path.parts
+    ):
+        return False
+    if relative_path.name in constants.ALL_INVENTORY_FILE_NAMES:
+        return False
+    return relative_path not in all_candidate_paths and not _is_test_path(
+        relative_path
+    )
+
+
+def _read_caller_text(file_path: Path) -> str:
+    try:
+        return file_path.read_text("utf-8")
+    except (OSError, UnicodeDecodeError):
+        return ""
+
+
+def _caller_texts(
+    repository_root: Path, all_candidate_paths: frozenset[PurePosixPath]
+) -> tuple[str, ...]:
+    return tuple(
+        _read_caller_text(each_path)
+        for each_path in repository_root.rglob("*")
+        if each_path.is_file()
+        and _is_caller_source(
+            PurePosixPath(each_path.relative_to(repository_root).as_posix()),
+            all_candidate_paths,
+        )
+    )
+
+
+def _has_caller(document: Document, all_caller_texts: tuple[str, ...]) -> bool:
+    name_pattern = re.compile(
+        constants.CALLER_NAME_PATTERN_TEMPLATE.format(
+            name=re.escape(document.path.stem)
+        )
+    )
+    return any(name_pattern.search(each_text) for each_text in all_caller_texts)
+
+
+def _uncalled_diagnostic(document: Document) -> Diagnostic:
+    return Diagnostic(
+        constants.UNCALLED_NEW_FILE_RULE_ID,
+        Severity.ERROR,
+        constants.UNCALLED_NEW_FILE_MESSAGE.format(file_name=document.path.name),
+        Location(document.path, 1, 1),
+    )
+
+
+def uncalled_new_file_diagnostics(
+    document_set: DocumentSet,
+) -> tuple[Diagnostic, ...]:
+    """Report each new code file with no caller outside its tests.
+
+    Args:
+        document_set: Staged or base change selection.
+
+    Returns:
+        One diagnostic for each added script, hook or skill script whose name
+        appears only in tests and inventory files.
+    """
+    if document_set.selection not in {SelectionKind.STAGED, SelectionKind.BASE}:
+        return ()
+    all_new_documents = tuple(
+        each_document
+        for each_document in document_set.documents
+        if _is_new_code_file(each_document)
+    )
+    if not all_new_documents:
+        return ()
+    all_caller_texts = _caller_texts(
+        document_set.repository_root,
+        frozenset(each_document.path for each_document in all_new_documents),
+    )
+    return tuple(
+        _uncalled_diagnostic(each_document)
+        for each_document in all_new_documents
+        if not _has_caller(each_document, all_caller_texts)
+    )

package/scripts/policy_lint/adapter_pairing.py

@@ -5,9 +5,10 @@ from collections import Counter
 from pathlib import PurePosixPath
 
 from . import adapter_support
+from .check_catalog import severity_for_check_id
 from .config import constants
 from .config.approved_test_pairs import APPROVED_TEST_PATHS_BY_PRODUCTION_PATH
-from .model import Diagnostic, Document, DocumentSet, Location, SelectionKind, Severity
+from .model import Diagnostic, Document, DocumentSet, Location, SelectionKind
 
 
 def _is_test_path(path: PurePosixPath) -> bool:
@@ -319,9 +320,10 @@ def _changed_test_paths(document_set: DocumentSet) -> frozenset[PurePosixPath]:
 def _pairing_diagnostic(document: Document) -> Diagnostic:
     return Diagnostic(
         "test-pairing",
-        Severity.ERROR,
+        severity_for_check_id("test-pairing"),
         "Changed production file has no changed matching test",
         Location(document.path, 1, 1),
+        "test-pairing",
     )
 
 

package/scripts/policy_lint/adapter_support.py

@@ -4,7 +4,7 @@ from collections.abc import Callable, Iterable
 from pathlib import Path
 from types import ModuleType
 
-from .check_catalog import check_id_for_message
+from .check_catalog import check_id_for_message, severity_for_check_id
 from .model import Diagnostic, Document, Location, Severity
 
 HookModuleLoader = Callable[[str], ModuleType]
@@ -69,13 +69,14 @@ def _diagnostics_for_messages(
         location = (
             None if maybe_line is None else Location(document.path, maybe_line, 1)
         )
+        check_id = check_id_for_message(rule_id, each_message)
         all_diagnostics.append(
             Diagnostic(
                 rule_id,
-                Severity.ERROR,
+                severity_for_check_id(check_id),
                 each_message,
                 location,
-                check_id_for_message(rule_id, each_message),
+                check_id,
             )
         )
     return tuple(all_diagnostics)

package/scripts/policy_lint/adapters.py

@@ -9,6 +9,7 @@ from types import ModuleType
 from shared_tree_paths import resolve_shared_scripts_directory
 
 from . import (
+    adapter_callers,
     adapter_configuration,
     adapter_contrast_framing,
     adapter_detectors,
@@ -245,6 +246,20 @@ def test_pairing_diagnostics(document_set: DocumentSet) -> tuple[Diagnostic, ...
     return adapter_pairing.test_pairing_diagnostics(document_set, _hooks_module)
 
 
+def uncalled_new_file_diagnostics(
+    document_set: DocumentSet,
+) -> tuple[Diagnostic, ...]:
+    """Report new code files that nothing outside their tests calls.
+
+    Args:
+        document_set: Staged or base change selection.
+
+    Returns:
+        One diagnostic for each uncalled new file.
+    """
+    return adapter_callers.uncalled_new_file_diagnostics(document_set)
+
+
 def terminology_diagnostics(document_set: DocumentSet) -> tuple[Diagnostic, ...]:
     """Report staged prose that near-misses a newly introduced identifier.
 

package/scripts/policy_lint/check_catalog.py

@@ -21,8 +21,12 @@ from .config.check_catalog_constants import (
     ALL_BUNDLING_RULE_IDS,
     ALL_CHECK_CATALOG_ENTRIES,
     CHECK_ID_SEPARATOR,
+    SEVERITY_BREAKING,
+    SEVERITY_BY_CHECK_ID,
+    SEVERITY_SMELL,
     UNCLASSIFIED_CHECK_NAME,
 )
+from .model import Severity
 
 
 def check_id_for_message(rule_id: str, message: str) -> str:
@@ -42,3 +46,23 @@ def check_id_for_message(rule_id: str, message: str) -> str:
         if each_entry.message_marker in message:
             return rule_id + CHECK_ID_SEPARATOR + each_entry.check_name
     return rule_id + CHECK_ID_SEPARATOR + UNCLASSIFIED_CHECK_NAME
+
+
+def severity_for_check_id(check_id: str) -> Severity:
+    """Return the severity ``SEVERITY_BY_CHECK_ID`` declares for one check.
+
+    ::
+
+        "code-rules/paired-test-missing-function" -> Severity.WARNING
+        "code-rules/unclassified"                 -> Severity.ERROR
+
+    Args:
+        check_id: The identifier ``check_id_for_message`` returned.
+
+    Returns:
+        ``Severity.WARNING`` for a smell, which the lint records and passes,
+        and ``Severity.ERROR`` for every other check.
+    """
+    if SEVERITY_BY_CHECK_ID.get(check_id, SEVERITY_BREAKING) == SEVERITY_SMELL:
+        return Severity.WARNING
+    return Severity.ERROR

package/scripts/policy_lint/config/approved_test_pairs.py

@@ -6,11 +6,11 @@ APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
     PurePosixPath, frozenset[PurePosixPath]
 ] = {
     PurePosixPath(
-        ".cursor/skills/verify-claude-dev-env/scripts/verify_installer_constants/constants.mjs"
+        ".agents/skills/verify/scripts/verify_installer_constants/constants.mjs"
     ): frozenset(
         {
             PurePosixPath(
-                ".cursor/skills/verify-claude-dev-env/scripts/verify-installer.test.mjs"
+                ".agents/skills/verify/scripts/verify-installer.test.mjs"
             ),
         }
     ),
@@ -21,6 +21,7 @@ APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
     ),
     PurePosixPath("packages/claude-dev-env/bin/install.mjs"): frozenset(
         {
+            PurePosixPath("packages/claude-dev-env/bin/install.agents-home.test.mjs"),
             PurePosixPath("packages/claude-dev-env/bin/install.cursor-rules.test.mjs"),
         }
     ),

package/scripts/policy_lint/config/check_catalog_constants.py

@@ -56,4 +56,17 @@ ALL_CHECK_CATALOG_ENTRIES: tuple[CheckCatalogEntry, ...] = (
         "missing type annotation (CODE_RULES §6)", "missing-type-annotation"
     ),
     CheckCatalogEntry("Single-letter variable", "single-letter-variable"),
+    CheckCatalogEntry(
+        "is exercised by no test in the module's paired test suite",
+        "paired-test-missing-function",
+    ),
+    CheckCatalogEntry("but exercises nowhere", "paired-test-omitted-function"),
 )
+
+SEVERITY_BREAKING: str = "breaking"
+SEVERITY_SMELL: str = "smell"
+SEVERITY_BY_CHECK_ID: dict[str, str] = {
+    "code-rules/paired-test-missing-function": SEVERITY_SMELL,
+    "code-rules/paired-test-omitted-function": SEVERITY_SMELL,
+    "test-pairing": SEVERITY_SMELL,
+}

package/scripts/policy_lint/config/constants.py

@@ -6,6 +6,7 @@ GIT_EXECUTABLE = "git"
 UTF8_ENCODING = "utf-8"
 PATH_SEPARATOR = "/"
 ARCHIVED_SKILLS_DIRECTORY_NAME = "skill-archive"
+ARCHIVED_HOOKS_DIRECTORY_NAME = "hooks-archived"
 NUL_BYTE = b"\0"
 ALL_GIT_ROOT_ARGUMENTS = ("rev-parse", "--show-toplevel")
 ALL_GIT_HEAD_ARGUMENTS = ("rev-parse", "--verify", "HEAD")
@@ -20,6 +21,7 @@ ALL_MISSING_BLOB_ERROR_FRAGMENTS = (
     "does not exist in",
     "does not exist (at stage",
     "exists on disk, but not in",
+    ": bad file",
 )
 GIT_DIFF_ARGUMENT = "diff"
 GIT_CACHED_FLAG = "--cached"
@@ -170,3 +172,19 @@ RETIRED_HOOK_PROSE_MESSAGE = (
 )
 
 CONTRAST_FRAMING_RULE_ID = "contrast-framing"
+
+UNCALLED_NEW_FILE_RULE_ID = "uncalled-new-file"
+UNCALLED_NEW_FILE_MESSAGE = (
+    "New file {file_name} has no caller outside its tests. Wire it into a hook,"
+    " workflow, skill, command or import in this change, or drop it."
+)
+ALL_CALLED_CODE_SUFFIXES = frozenset({".py", ".mjs", ".js", ".sh", ".ps1"})
+ALL_CALLED_CODE_SEGMENTS = ("/scripts/", "/hooks/", "/bin/", "/ci/", "/tools/")
+ALL_CALLER_SEARCH_SKIPPED_DIRECTORIES = frozenset(
+    {".git", "node_modules", "__pycache__", ".venv"}
+)
+ALL_INVENTORY_FILE_NAMES = frozenset(
+    {"CHANGELOG.md", "README.md", "ever-shipped-skills.mjs"}
+)
+ALL_UNCALLED_EXEMPT_FILE_NAMES = frozenset({"__init__.py", "conftest.py"})
+CALLER_NAME_PATTERN_TEMPLATE = r"(?<![\w-]){name}(?![\w-])"

package/scripts/policy_lint/engine.py

@@ -3,7 +3,10 @@ from __future__ import annotations
 from collections.abc import Iterable, Sequence
 from pathlib import Path, PurePosixPath
 
-from .config.constants import ARCHIVED_SKILLS_DIRECTORY_NAME
+from .config.constants import (
+    ARCHIVED_HOOKS_DIRECTORY_NAME,
+    ARCHIVED_SKILLS_DIRECTORY_NAME,
+)
 from .model import (
     ChangeSetRule,
     Diagnostic,
@@ -27,7 +30,7 @@ def lint(
     """Run the selected rules on one source selection.
 
     Repository and diff selections check active code. File and editor
-    selections include archived skills.
+    selections include archived skills and archived hooks.
 
     Args:
         request: Repository root, source, and rule sets.
@@ -55,7 +58,10 @@ def lint(
 
 
 def _is_runtime_path(path: PurePosixPath) -> bool:
-    return path.parts[0] != ARCHIVED_SKILLS_DIRECTORY_NAME
+    return (
+        path.parts[0] != ARCHIVED_SKILLS_DIRECTORY_NAME
+        and ARCHIVED_HOOKS_DIRECTORY_NAME not in path.parts
+    )
 
 
 def _runtime_document_set(document_set: DocumentSet) -> DocumentSet:

package/scripts/policy_lint/model.py

@@ -341,11 +341,15 @@ class LintReport:
         """Return the process exit code for this report.
 
         Returns:
-            Zero for clean output, one for findings, or three for rule failure.
+            Zero for clean output or warnings only, one for an error finding,
+            or three for rule failure.
         """
         if self.failed_rules:
             return INCOMPLETE_EXIT_CODE
-        if self.diagnostics:
+        if any(
+            each_diagnostic.severity is Severity.ERROR
+            for each_diagnostic in self.diagnostics
+        ):
             return 1
         return 0
 

package/scripts/policy_lint/registry.py

@@ -154,6 +154,12 @@ def default_registry() -> tuple[model.Rule, ...]:
             frozenset({model.SelectionKind.STAGED, model.SelectionKind.BASE}),
             adapters.terminology_diagnostics,
         ),
+        model.ChangeSetRule(
+            "uncalled-new-file",
+            frozenset({"changed"}),
+            frozenset({model.SelectionKind.STAGED, model.SelectionKind.BASE}),
+            adapters.uncalled_new_file_diagnostics,
+        ),
         model.RepositoryRule(
             "repository-path-collision",
             frozenset({"repository"}),

package/scripts/policy_lint/selection.py

@@ -205,6 +205,8 @@ def _append_change(
     all_renamed_paths: list[tuple[PurePosixPath, PurePosixPath]],
 ) -> None:
     old_path, new_path = all_paths if status[:1] in {"R", "C"} else (all_paths[0], all_paths[0])
+    if status != "D" and (repository_root / new_path).is_symlink():
+        return
     normalized_old_path = _normalize_path(repository_root, old_path)
     normalized_new_path = _normalize_path(repository_root, new_path)
     if status == "D":