claude-dev-env 8.25.0 → 8.26.0

package/docs/CODE_RULES.md

@@ -13,7 +13,7 @@ Do not add code comments. Preserve existing comments. Docstrings remain allowed.
 When a change touches code that an existing comment describes or is attached to, remove that comment in the same change and carry its meaning through clear names and structure. Leave comments tied to untouched code unchanged. Keep comment cleanup inside the requested task.
 Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX, and type-ignore comments are removed rather than added or justified.
 
-A keep marker is the one comment that may be added and kept: a comment that opens with `STEALTH: Keep`, or with a prefix the repository lists under `comment_keep_markers` in `.claude/policy-lint.json`.
+A keep marker is the one comment that may be added and kept: a comment that opens with a prefix the repository lists under `comment_keep_markers` in `.claude/policy-lint.json`.
 
 ---
 
@@ -31,7 +31,7 @@ A keep marker is the one comment that may be added and kept: a comment that open
 
 The staged policy lint reports each of these through `code_rules_enforcer.py` and names the specific breach; exact patterns and exemption lists live in that module:
 
-no new comments · imports at top · logging format args (`log_*("...", arg)`) · no `%s`/`%d` printf tokens in a `str.format`-logger message (`log_*` imported from `automation_logging`; `str.format` drops the args — use `{}`) · no magic values in production bodies (0, 1, -1 exempt) · UPPER_SNAKE constants only in `config/` (exempt: `config/*`; `/migrations/`; Workflow registries: path contains any of these substrings — `/workflow/`, `_tab.py`, `/states.py`, or `/modules.py`, each matching independently as a substring, so `pkg/states.py` qualifies while a top-level `states.py` follows the standard `config/` rule; test files — path or filename matches `test_`, `_test.`, `.spec.`, `conftest`, or `/tests/`) · no hardcoded user home paths · guarded `sys.path.insert` · banned identifiers (`ctx`, `cfg`, `msg`, `btn`, `idx`, `cnt`, `tmp`, `elem`, `val`) · banned function prefixes (`handle_`, `process_`, `manage_`, `do_`) · no type escape hatches (`Any` import, `cast()`, inline `Any`, a parameter typed bare `object` whose body reads `param.attribute`) outside boundary files · no bare/broad `except` · no `Any` in signatures or class attributes · no stub bodies (`pass`/`...`/`raise NotImplementedError`) outside abstract/Protocol · TypedDict `_encode_*`/`_decode_*` companions in the same module · no test-mode branching in production (use dependency injection) · no thin wrapper modules · Google-style docstrings on public functions with `Args:` matching the signature · boolean names prefixed `is_`/`has_`/`should_`/`can_`/`was_`/`did_` (assignments AND bool-typed parameters) · must-check returns (`find_and_click`, `write_outcome`) assigned and checked · known pytest fixture parameters in test files annotated with their single documented type (`tmp_path: Path`, `monkeypatch: pytest.MonkeyPatch`, `capsys`, `caplog`, `request`, …) · known pytest fixture parameters a test function declares but never references (drop the unused parameter — pytest still pays its setup cost) · JavaScript/TypeScript boolean declarations (`const`/`let`/`var` bound to a boolean literal or negation) and `@param {boolean}` JSDoc names prefixed `is`/`has`/`should`/`can`/`was`/`did` (camelCase forms) · banned identifiers as `.mjs`/`.js` declaration names (`result`, `data`, `ctx`, `msg`, …), scoped to changed lines · in test files, banned identifiers fire on changed lines, and pytest-collectable `test_*` functions need a return annotation · unused module-level imports and unsorted import blocks are ruff's job (F401, isort I001), not this hook's · a `hooks/blocking/` command classifier anchors its multi-word command regex to the command start (`^`/`\A`) or tokenizes the first word (`shlex.split`), never matching a command as a bare substring
+no new comments · imports at top · logging format args (`log_*("...", arg)`) · no magic values in production bodies (0, 1, -1 exempt) · UPPER_SNAKE constants only in `config/` (exempt: `config/*`; `/migrations/`; Workflow registries: path contains any of these substrings — `/workflow/`, `_tab.py`, `/states.py`, or `/modules.py`, each matching independently as a substring, so `pkg/states.py` qualifies while a top-level `states.py` follows the standard `config/` rule; test files — path or filename matches `test_`, `_test.`, `.spec.`, `conftest`, or `/tests/`) · no hardcoded user home paths · guarded `sys.path.insert` · banned identifiers (`ctx`, `cfg`, `msg`, `btn`, `idx`, `cnt`, `tmp`, `elem`, `val`) · banned function prefixes (`handle_`, `process_`, `manage_`, `do_`) · no type escape hatches (`Any` import, `cast()`, inline `Any`, a parameter typed bare `object` whose body reads `param.attribute`) outside boundary files · no bare/broad `except` · no `Any` in signatures or class attributes · no stub bodies (`pass`/`...`/`raise NotImplementedError`) outside abstract/Protocol · TypedDict `_encode_*`/`_decode_*` companions in the same module · no test-mode branching in production (use dependency injection) · no thin wrapper modules · Google-style docstrings on public functions with `Args:` matching the signature · boolean names prefixed `is_`/`has_`/`should_`/`can_`/`was_`/`did_` (assignments AND bool-typed parameters) · known pytest fixture parameters in test files annotated with their single documented type (`tmp_path: Path`, `monkeypatch: pytest.MonkeyPatch`, `capsys`, `caplog`, `request`, …) · known pytest fixture parameters a test function declares but never references (drop the unused parameter — pytest still pays its setup cost) · JavaScript/TypeScript boolean declarations (`const`/`let`/`var` bound to a boolean literal or negation) and `@param {boolean}` JSDoc names prefixed `is`/`has`/`should`/`can`/`was`/`did` (camelCase forms) · banned identifiers as `.mjs`/`.js` declaration names (`result`, `data`, `ctx`, `msg`, …), scoped to changed lines · in test files, banned identifiers fire on changed lines, and pytest-collectable `test_*` functions need a return annotation · unused module-level imports and unsorted import blocks belong to ruff (F401, isort I001) · a `hooks/blocking/` command classifier anchors its multi-word command regex to the command start (`^`/`\A`) or tokenizes the first word (`shlex.split`), never matching a command as a bare substring
 
 Test files follow the comment policy above; other test-specific exemptions are listed here. The one annotation the test-file exemption does NOT cover is a known pytest builtin fixture parameter: `tmp_path`, `monkeypatch`, `capsys`, `capfd`, `caplog`, `request`, and `tmp_path_factory` each have a single documented injected type, so the gate requires that annotation (`tmp_path: Path`) even inside a test file. The same set of fixtures is also subject to a use check: a pytest-collected test function that declares one of these parameters and never references it in its body fails the gate, because pytest materializes the fixture's setup (the temp directory, the monkeypatch context, the output capture) on every run whether or not the body reads the value — drop the unused parameter. A parameter counts as referenced when its name is read, augmented-assigned, or deleted anywhere in the body, including inside a nested function or comprehension. Only pytest-collectable functions are inspected — those at module top level or defined directly in a class body; a function nested inside another function's body is a local helper pytest never collects, so its fixture-named parameter is exempt. A `@pytest.fixture`-decorated function is exempt from the use check, since injecting one fixture into another purely to order its setup is intentional. Ordinary test parameters stay exempt from both checks.
 

package/hooks/blocking/code_rules_boolean_mustcheck.py

@@ -1,4 +1,4 @@
-"""Boolean naming-prefix and ignored must-check-return checks."""
+"""Boolean naming-prefix checks."""
 
 import ast
 import sys
@@ -21,12 +21,8 @@ from code_rules_shared import (  # noqa: E402
     is_workflow_registry_file,
 )
 
-from hooks_constants.blocking_check_limits import (  # noqa: E402
-    MAX_IGNORED_MUST_CHECK_RETURN_ISSUES,
-)
 from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     ALL_BOOLEAN_NAME_PREFIXES,
-    ALL_MUST_CHECK_RETURN_FUNCTION_NAMES,
     ALL_SELF_AND_CLS_PARAMETER_NAMES,
     UPPER_SNAKE_CONSTANT_PATTERN,
 )
@@ -271,80 +267,3 @@ def _called_terminal_name(call_node: ast.Call) -> str | None:
     if isinstance(callee, ast.Attribute):
         return callee.attr
     return None
-
-
-def check_ignored_must_check_return(
-    content: str,
-    file_path: str,
-    all_changed_lines: set[int] | None = None,
-    defer_scope_to_caller: bool = False,
-) -> list[str]:
-    """Flag bare-expression calls whose discarded return is the only failure signal.
-
-    Functions in ``ALL_MUST_CHECK_RETURN_FUNCTION_NAMES`` report success or failure
-    solely through their return value. A bare-statement call discards that value,
-    so the caller silently proceeds on failure. Bare ``ast.Expr`` calls are flagged,
-    including a bare ``await``-wrapped call (``await find_and_click(...)`` as a
-    statement); an assigned or branched-on call is exempt.
-
-    The caller passes the reconstructed full file as *content* so ``ast.parse``
-    sees a complete module rather than an Edit's ``new_string`` fragment, which is
-    rarely valid standalone Python (a bare ``await find_and_click(...)`` line is a
-    SyntaxError on its own). Findings are then scoped to *all_changed_lines* so an
-    Edit blocks on the discarded return it just introduced while a pre-existing
-    violation on an untouched line does not block the edit.
-
-    Args:
-        content: The source text to inspect — the reconstructed full file on an
-            Edit so the parse succeeds.
-        file_path: The path the source will be written to, used for exemptions.
-        all_changed_lines: Post-edit line numbers the current edit touched, or
-            None to treat the whole file as in scope. When provided, a violation
-            blocks only when the bare call's line intersects the changed lines.
-        defer_scope_to_caller: When True, return every violation so the
-            commit/push gate's ``split_violations_by_scope`` can scope by added
-            line.
-
-    Returns:
-        One issue per discarded must-check return, scoped to the changed lines
-        unless *defer_scope_to_caller* is True or *all_changed_lines* is None. When
-        *defer_scope_to_caller* is True every violation is returned uncapped so the
-        gate can scope by added line and apply its own ceiling; otherwise the
-        terminal result is capped at the module limit.
-    """
-    if is_test_file(file_path):
-        return []
-    try:
-        tree = ast.parse(content)
-    except SyntaxError:
-        return []
-    all_violations_in_walk_order: list[tuple[range, str]] = []
-    for each_node in ast.walk(tree):
-        if not isinstance(each_node, ast.Expr):
-            continue
-        expression_value = each_node.value
-        call_node = (
-            expression_value.value
-            if isinstance(expression_value, ast.Await)
-            else expression_value
-        )
-        if not isinstance(call_node, ast.Call):
-            continue
-        called_name = _called_terminal_name(call_node)
-        if called_name is None or called_name not in ALL_MUST_CHECK_RETURN_FUNCTION_NAMES:
-            continue
-        end_line_number = each_node.end_lineno or each_node.lineno
-        line_span = range(each_node.lineno, end_line_number + 1)
-        message = (
-            f"Line {each_node.lineno}: return value of {called_name}() is discarded - "
-            "assign and check it (the boolean/outcome is the only failure signal)"
-        )
-        all_violations_in_walk_order.append((line_span, message))
-    scoped_issues = _scope_violations_to_changed_lines(
-        all_violations_in_walk_order,
-        all_changed_lines,
-        defer_scope_to_caller,
-    )
-    if defer_scope_to_caller:
-        return scoped_issues
-    return scoped_issues[:MAX_IGNORED_MUST_CHECK_RETURN_ISSUES]

package/hooks/blocking/code_rules_comments.py

@@ -36,7 +36,6 @@ from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     REPOSITORY_LINT_SETTINGS_RELATIVE_PATH,
     REPOSITORY_ROOT_MARKER_NAME,
     SETTINGS_TEXT_ENCODING,
-    STEALTH_KEEP_COMMENT_MARKER,
 )
 _javascript_comment_scanner = importlib.import_module("javascript_comment_scanner")
 extract_javascript_comment_occurrences = (
@@ -180,26 +179,22 @@ def comment_keep_markers(file_path: str) -> tuple[str, ...]:
     ::
 
         repo/.claude/policy-lint.json  {"comment_keep_markers": ["VENDOR: Keep"]}
-        repo/app/main.py               ("STEALTH: Keep", "VENDOR: Keep")
-        no settings file               ("STEALTH: Keep",)
+        repo/app/main.py               ("VENDOR: Keep",)
+        no settings file               ()
 
     The repository that holds the file names its own markers. A missing or
-    unreadable settings file adds none.
+    unreadable settings file names none.
 
     Args:
         file_path: The path of the file under check.
 
     Returns:
-        The package's built-in marker, then the markers the file's repository
-        adds.
+        The markers the file's repository names.
     """
     for each_directory in Path(file_path).resolve().parents:
         if (each_directory / REPOSITORY_ROOT_MARKER_NAME).exists():
-            return (
-                STEALTH_KEEP_COMMENT_MARKER,
-                *_repository_keep_markers(each_directory),
-            )
-    return (STEALTH_KEEP_COMMENT_MARKER,)
+            return _repository_keep_markers(each_directory)
+    return ()
 
 
 def _is_keep_occurrence(comment_text: str, all_keep_markers: tuple[str, ...]) -> bool:
@@ -230,10 +225,9 @@ def check_comment_changes(old_content: str, new_content: str, file_path: str) ->
     """Check for comment additions or removals between old and new content.
 
     Inline and standalone comments are blocking findings when added, except
-    keep-marker occurrences (``STEALTH: Keep`` and any marker the file's
-    repository names in ``.claude/policy-lint.json``), which are excluded
-    entirely so the marker can be added and can persist across edits to its
-    line.
+    keep-marker occurrences (a marker the file's repository names in
+    ``.claude/policy-lint.json``), which are excluded entirely so the marker
+    can be added and can persist across edits to its line.
     Existing comments can be removed when the touched code no longer needs them.
 
     When the file is Python and either *old_content* or *new_content* cannot
@@ -431,14 +425,11 @@ def _is_exempt_python_comment(comment_token: tokenize.TokenInfo) -> bool:
     token-anchored directive body never legitimately carries a ``#``
     (noqa codes, pylint symbols, and pragma directives contain none), so
     any inner ``#`` reliably marks chained prose. Free-form markers
-    (``type:``, ``TODO``, ``FIXME``, ``HACK``, ``XXX``, ``STEALTH: Keep``)
-    accept any trailing prose:
-    ``# type:`` participates in the documented justification
-    convention enforced by ``check_type_escape_hatches`` (which
-    requires a trailing reason), the TODO-family markers carry
-    annotation text by convention, and ``STEALTH: Keep`` is the
-    acknowledged-bypass marker the CDP runtime-usage scanner reads
-    from the flagged line together with its reason.
+    (``type:``, ``TODO``, ``FIXME``, ``HACK``, ``XXX``) accept any
+    trailing prose: ``# type:`` participates in the documented
+    justification convention enforced by ``check_type_escape_hatches``
+    (which requires a trailing reason), and the TODO-family markers carry
+    annotation text by convention.
     """
     comment_string = comment_token.string
     if comment_string.startswith("#!") and comment_token.start == (1, 0):

package/hooks/blocking/code_rules_enforcer.py

@@ -46,7 +46,6 @@ from code_rules_blast_radius import (  # noqa: E402
 )
 from code_rules_boolean_mustcheck import (  # noqa: E402
     check_boolean_naming,
-    check_ignored_must_check_return,
 )
 from code_rules_command_dispatch import (  # noqa: E402
     check_unanchored_command_dispatch,
@@ -86,7 +85,6 @@ from code_rules_imports_logging import (  # noqa: E402
     check_library_print,
     check_logging_adjacent_string_literals,
     check_logging_fstrings,
-    check_logging_printf_tokens,
     check_naive_datetime_construction,
     check_windows_api_none,
 )
@@ -329,7 +327,6 @@ def _python_comment_and_logging_issues(context: _ValidationContext) -> list[str]
         all_issues.extend(check_comment_changes(old_content, content, file_path))
     all_issues.extend(check_imports_at_top(content))
     all_issues.extend(check_logging_fstrings(content))
-    all_issues.extend(check_logging_printf_tokens(content, file_path))
     all_issues.extend(check_logging_adjacent_string_literals(content, file_path))
     all_issues.extend(check_windows_api_none(content))
     all_issues.extend(check_naive_datetime_construction(content, file_path))
@@ -450,9 +447,6 @@ def _python_boolean_and_test_assertion_issues(context: _ValidationContext) -> li
     )
     changed, defer = context.all_changed_lines, context.defer_scope_to_caller
     all_issues = check_boolean_naming(effective_content, file_path, changed, defer)
-    all_issues.extend(
-        check_ignored_must_check_return(effective_content, file_path, changed, defer)
-    )
     all_issues.extend(check_skip_decorators_in_tests(content, file_path))
     all_issues.extend(
         check_tests_use_isolated_filesystem_paths(

package/hooks/blocking/code_rules_imports_logging.py

@@ -1,4 +1,4 @@
-"""Import and logging convention checks: check_imports_at_top, check_logging_fstrings, check_logging_printf_tokens, check_logging_adjacent_string_literals, check_windows_api_none, check_naive_datetime_construction, check_e2e_test_naming, check_js_resume_task_enumeration_coverage, check_js_returns_object_schemaless_branch, check_js_sibling_return_object_key_drift, check_js_bare_flag_return_directive, and check_library_print."""
+"""Import and logging convention checks: check_imports_at_top, check_logging_fstrings, check_logging_adjacent_string_literals, check_windows_api_none, check_naive_datetime_construction, check_e2e_test_naming, check_js_resume_task_enumeration_coverage, check_js_returns_object_schemaless_branch, check_js_sibling_return_object_key_drift, check_js_bare_flag_return_directive, and check_library_print."""
 
 import ast
 import re
@@ -25,7 +25,6 @@ from code_rules_shared import (  # noqa: E402
 
 from hooks_constants.blocking_check_limits import (  # noqa: E402
     ALL_ALWAYS_NAIVE_DATETIME_CONSTRUCTORS,
-    ALL_FORMAT_LOGGER_FUNCTION_NAMES,
     DATETIME_CLASS_ATTRIBUTE_NAME,
     FROMTIMESTAMP_POSITIONAL_TIMEZONE_ARGUMENT_COUNT,
     MAX_E2E_TEST_NAMING_ISSUES,
@@ -35,7 +34,6 @@ from hooks_constants.blocking_check_limits import (  # noqa: E402
     MAX_JS_SIBLING_RETURN_OBJECT_KEY_DRIFT_ISSUES,
     MAX_LOGGING_ADJACENT_LITERAL_ISSUES,
     MAX_LOGGING_FSTRING_ISSUES,
-    MAX_LOGGING_PRINTF_TOKEN_ISSUES,
     MAX_NAIVE_DATETIME_ISSUES,
     MAX_WINDOWS_API_NONE_ISSUES,
     MINIMUM_RESUME_TASK_ENUMERATION_ITEMS,
@@ -87,9 +85,7 @@ from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     JSDOC_RETURNS_STRUCTURED_OBJECT_PROMISE_PATTERN,
     LOGGING_FSTRING_PATTERN,
     LOGGING_HELPER_FUNCTION_NAME_PATTERN,
-    LOGGING_PRINTF_TOKEN_PATTERN,
     LOGGING_RECEIVER_NAME_PATTERN,
-    MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT,
     NOT_INSIDE_TYPE_CHECKING_BLOCK,
     RESUME_TASK_ENUMERATION_PATTERN,
     RETURN_CALL_OPENING_PARENTHESIS_PATTERN,
@@ -280,121 +276,6 @@ def check_logging_fstrings(content: str) -> list[str]:
     return issues
 
 
-def _format_logger_names_imported(tree: ast.Module) -> set[str]:
-    """Return the local names bound to automation_logging log helpers.
-
-    Scans every ``from ... import ...`` statement for an import whose module
-    path contains ``automation_logging`` and collects the local binding of each
-    imported ``log_*`` helper (the alias when ``as`` is present, otherwise the
-    imported name). Only these names identify a str.format-logger call; a
-    ``log_*`` helper from any other module is not collected, because a
-    ``%``-style logger formats its tokens correctly.
-
-    Args:
-        tree: The parsed module to scan for logger imports.
-
-    Returns:
-        The set of local names bound to automation_logging log helpers.
-    """
-    bound_names: set[str] = set()
-    for each_node in ast.walk(tree):
-        if not isinstance(each_node, ast.ImportFrom):
-            continue
-        if each_node.module is None or "automation_logging" not in each_node.module:
-            continue
-        for each_alias in each_node.names:
-            if each_alias.name in ALL_FORMAT_LOGGER_FUNCTION_NAMES:
-                bound_names.add(each_alias.asname or each_alias.name)
-    return bound_names
-
-
-def _printf_token_log_call_line(
-    node: ast.AST, all_format_logger_names: set[str]
-) -> int | None:
-    """Return the line of a format-logger call carrying a printf token, else None.
-
-    Args:
-        node: The AST node to inspect.
-        all_format_logger_names: Local names bound to automation_logging log
-            helpers.
-
-    Returns:
-        The 1-based line number when ``node`` is a bare-name call to a format
-        logger that has at least one format argument after the message and
-        whose first string-literal argument carries a printf token; otherwise
-        None. A call with only the message and no format arguments never runs
-        ``.format(*args)``, so its token prints intact and is not flagged.
-    """
-    if not isinstance(node, ast.Call):
-        return None
-    function_reference = node.func
-    if (
-        not isinstance(function_reference, ast.Name)
-        or function_reference.id not in all_format_logger_names
-    ):
-        return None
-    if len(node.args) < MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT:
-        return None
-    message_argument = node.args[0]
-    if not isinstance(message_argument, ast.Constant) or not isinstance(
-        message_argument.value, str
-    ):
-        return None
-    if not LOGGING_PRINTF_TOKEN_PATTERN.search(message_argument.value):
-        return None
-    return node.lineno
-
-
-def check_logging_printf_tokens(content: str, file_path: str) -> list[str]:
-    """Flag printf tokens in a str.format-logger (automation_logging) message.
-
-    The ``shared_utils.automation_logging`` helpers (``log_info``, ``log_error``,
-    ...) format with ``str.format`` (``{}`` placeholders) only when format
-    arguments follow the message (``message.format(*args) if args else
-    message``), so a printf-style token such as ``%s`` in the message literal is
-    never substituted: the format arguments are dropped and the literal token
-    prints. The check fires only in a file that imports one of those helpers
-    from an ``automation_logging`` module, and only for a bare-name call to such
-    a helper that passes at least one format argument after the message and
-    whose first argument is a string literal carrying a token. A call with only
-    the message and no format arguments never runs ``.format``, so its token
-    prints intact and is left alone. An attribute call (``logger.info``) or a
-    ``log_*`` helper from any other module formats ``%``-tokens correctly and is
-    left alone. Test files are exempt so a test may exercise the malformed shape.
-
-    Args:
-        content: The Python source under validation.
-        file_path: The destination path, used to skip test files and non-Python.
-
-    Returns:
-        One issue line per offending call, capped at the configured maximum.
-    """
-    if is_test_file(file_path):
-        return []
-    if get_file_extension(file_path) not in ALL_PYTHON_EXTENSIONS:
-        return []
-    try:
-        tree = ast.parse(content)
-    except SyntaxError:
-        return []
-    all_format_logger_names = _format_logger_names_imported(tree)
-    if not all_format_logger_names:
-        return []
-    issues: list[str] = []
-    for each_node in ast.walk(tree):
-        offending_line = _printf_token_log_call_line(each_node, all_format_logger_names)
-        if offending_line is None:
-            continue
-        issues.append(
-            f"Line {offending_line}: printf token in a str.format logger "
-            "message - the automation_logging helpers format with str.format; "
-            "use {} placeholders (the %-arguments are silently dropped)"
-        )
-        if len(issues) >= MAX_LOGGING_PRINTF_TOKEN_ISSUES:
-            break
-    return issues
-
-
 def _logging_call_receiver_name(receiver_node: ast.expr) -> str | None:
     """Return the trailing identifier of a logging-call receiver expression, else None.
 

package/hooks/blocking/test_code_rules_enforcer_comment_string_awareness.py

@@ -134,18 +134,15 @@ def test_check_comment_changes_allows_comment_removal_without_advisory(
     assert captured.err == ""
 
 
-def test_check_comment_changes_does_not_flag_added_stealth_keep_marker() -> None:
-    old_content = "x = 1\n"
-    new_content = "x = 1  # STEALTH: Keep -- reason\n"
-    issues = code_rules_enforcer.check_comment_changes(old_content, new_content, "foo.py")
-    assert issues == []
-
-
-def test_check_comment_changes_does_not_flag_stealth_keep_retained_on_touched_line() -> None:
-    old_content = "x = 1  # STEALTH: Keep -- reason\n"
-    new_content = "x = 2  # STEALTH: Keep -- reason\n"
-    issues = code_rules_enforcer.check_comment_changes(old_content, new_content, "foo.py")
-    assert issues == []
+def test_check_comment_changes_flags_stealth_keep_in_a_repository_that_names_no_marker(
+    tmp_path: Path,
+) -> None:
+    file_path = _repository_file(tmp_path, None)
+    issues = code_rules_enforcer.check_comment_changes(
+        "x = 1\n", "x = 1  # STEALTH: Keep -- reason\n", file_path
+    )
+    assert len(issues) == 1
+    assert "comment added" in issues[0]
 
 
 @pytest.mark.parametrize(

package/hooks/blocking/test_code_rules_enforcer_exempt_marker_chained.py

@@ -156,16 +156,6 @@ def test_should_exempt_fixme_with_trailing_prose() -> None:
     assert _is_exempt_python_comment(token) is True
 
 
-def test_should_exempt_stealth_keep_with_trailing_reason() -> None:
-    token = _build_comment_token("# STEALTH: Keep bypass reviewed in incident 4021")
-    assert _is_exempt_python_comment(token) is True
-
-
-def test_should_flag_stealth_marker_missing_required_space_after_colon() -> None:
-    token = _build_comment_token("# STEALTH:Keep bypass reviewed in incident 4021")
-    assert _is_exempt_python_comment(token) is False
-
-
 def test_should_exempt_shebang_at_line_one_column_zero() -> None:
     token = tokenize.TokenInfo(
         type=tokenize.COMMENT,

package/hooks/blocking/test_code_rules_enforcer_narrow_edit.py

@@ -49,7 +49,6 @@ ALL_SCOPE_AWARE_RULE_NAMES = frozenset(
         "check_docstring_runon_sentence",
         "check_docstring_prose_wall_without_illustration",
         "check_boolean_naming",
-        "check_ignored_must_check_return",
         "check_tests_use_isolated_filesystem_paths",
         "check_return_annotations",
         "check_function_length",
@@ -70,7 +69,6 @@ NARROW_EDIT_ACCEPTED_RULE_NAMES = frozenset(
         "check_join_separator_string_magic",
         "check_banned_noun_word_boundary",
         "check_boolean_naming",
-        "check_ignored_must_check_return",
     }
 )
 
@@ -80,7 +78,6 @@ EXPECTED_RULE_TEXT_BY_NAME = {
     "check_join_separator_string_magic": "string separator",
     "check_banned_noun_word_boundary": "Identifier",
     "check_boolean_naming": "Boolean",
-    "check_ignored_must_check_return": "return value",
 }
 
 
@@ -139,19 +136,6 @@ ALL_REQUIRED_RULE_FIXTURES = (
         expected_marker="ready",
         rule_name="check_boolean_naming",
     ),
-    NarrowEditFixture(
-        old_fragment=(
-            "def submit_form() -> None:\n"
-            "    if find_and_click('#submit'):\n"
-            "        return\n"
-        ),
-        new_fragment=(
-            "def submit_form() -> None:\n"
-            "    find_and_click('#submit')\n"
-        ),
-        expected_marker="find_and_click",
-        rule_name="check_ignored_must_check_return",
-    ),
 )
 
 

package/hooks/hooks.json

@@ -72,6 +72,16 @@
           }
         ]
       },
+      {
+        "matcher": "mcp__hearthbot__start_thread_session",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/routing/thread_spawn_pace_hook.py",
+            "timeout": 30
+          }
+        ]
+      },
       {
         "matcher": "*",
         "hooks": [

package/hooks/hooks_constants/blocking_check_limits.py

@@ -22,12 +22,10 @@ MAX_DOCSTRING_FORMAT_ISSUES: int = 5
 MAX_DOCSTRING_ARGS_SIGNATURE_ISSUES: int = 5
 MAX_CLASS_DOCSTRING_PUBLIC_METHOD_ISSUES: int = 5
 MINIMUM_PUBLIC_METHODS_FOR_CLASS_DOCSTRING_BREADTH: int = 2
-MAX_IGNORED_MUST_CHECK_RETURN_ISSUES: int = 5
 MAX_TYPE_ESCAPE_HATCH_ISSUES: int = 5
 MAX_THIN_WRAPPER_ISSUES: int = 1
 MAX_ZERO_PAYLOAD_ALIAS_ISSUES: int = 3
 MAX_LOGGING_FSTRING_ISSUES: int = 3
-MAX_LOGGING_PRINTF_TOKEN_ISSUES: int = 3
 MAX_LOGGING_ADJACENT_LITERAL_ISSUES: int = 3
 MAX_CONFIG_DUPLICATE_PATH_ANCHOR_ISSUES: int = 3
 MAX_WINDOWS_API_NONE_ISSUES: int = 3
@@ -204,17 +202,6 @@ DOCSTRING_REFERENCE_MARKER_WINDOW: int = 2
 ALL_GENERIC_CHECK_NAME_TOKENS: frozenset[str] = frozenset(
     {"check", "checks", "test", "tests", "in", "for", "and", "the"}
 )
-ALL_FORMAT_LOGGER_FUNCTION_NAMES: frozenset[str] = frozenset(
-    {
-        "log_debug",
-        "log_info",
-        "log_ok",
-        "log_error",
-        "log_warning",
-        "log_batch",
-        "log_background",
-    }
-)
 DOCSTRING_RUNON_SENTENCE_WORD_LIMIT: int = 30
 MAX_DOCSTRING_RUNON_SENTENCE_ISSUES: int = 5
 ALL_DOCSTRING_RUNON_JOINER_MARKERS: tuple[str, ...] = ("—", " -- ", ";")

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -72,8 +72,6 @@ ALL_POLARITY_ANTONYM_TOKEN_PAIRS: tuple[tuple[str, str], ...] = (
 )
 POLARITY_TOKEN_BOUNDARY_PATTERN: str = r"(?:^|_)%s(?:_|$)"
 
-ALL_MUST_CHECK_RETURN_FUNCTION_NAMES: frozenset[str] = frozenset({"find_and_click", "write_outcome"})
-
 DOCSTRING_ARG_ENTRY_PATTERN: re.Pattern[str] = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)\s*[:(]")
 DOCSTRING_PLURAL_FAMILY_STOP_PATTERN: re.Pattern[str] = re.compile(
     r"\bthe\s+([a-z][a-z]+)\s+stops\b"
@@ -135,7 +133,6 @@ ALL_TOKEN_ANCHORED_EXEMPT_COMMENT_BODIES: tuple[str, ...] = (
     "pragma:",
 )
 ALL_TOKEN_ANCHORED_DIRECTIVE_BOUNDARY_CHARACTERS: frozenset[str] = frozenset({":"})
-STEALTH_KEEP_COMMENT_MARKER: str = "STEALTH: Keep"
 REPOSITORY_LINT_SETTINGS_RELATIVE_PATH: str = ".claude/policy-lint.json"
 COMMENT_KEEP_MARKERS_KEY: str = "comment_keep_markers"
 REPOSITORY_ROOT_MARKER_NAME: str = ".git"
@@ -146,7 +143,6 @@ ALL_FREE_FORM_EXEMPT_COMMENT_BODIES: tuple[str, ...] = (
     "FIXME",
     "HACK",
     "XXX",
-    STEALTH_KEEP_COMMENT_MARKER,
 )
 CHAINED_INLINE_COMMENT_PATTERN = re.compile(r"#")
 ALL_JAVASCRIPT_EXEMPT_COMMENT_PREFIXES: tuple[str, ...] = (
@@ -211,14 +207,10 @@ LOGGING_FSTRING_PATTERN = re.compile(
     r'|(?:logger|logging|log)\.(?:debug|info|warning|error|critical|exception))'
     r'\s*\(\s*(?:[rR][fF]|[fF][rR]?)["\']'
 )
-LOGGING_PRINTF_TOKEN_PATTERN: re.Pattern[str] = re.compile(
-    r"(?<!%)%[#0\- +]?[0-9.*]*[sdrixfgeEcoX](?![a-zA-Z])"
-)
 ADJACENT_STRING_LITERAL_PATTERN: re.Pattern[str] = re.compile(
     r'(?<!["\'])[rRbBfFuU]{0,2}(?:"(?:[^"\\\n]|\\.)*"|\'(?:[^\'\\\n]|\\.)*\')'
     r'\s*[rRbBfFuU]{0,2}(?:"(?:[^"\\\n]|\\.)*"|\'(?:[^\'\\\n]|\\.)*\')(?!["\'])'
 )
-MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT = 2
 ALL_LOGGING_CALL_METHOD_NAMES: frozenset[str] = frozenset(
     {"debug", "info", "warning", "error", "critical", "exception"}
 )