claude-dev-env 8.6.1 → 8.7.0

package/scripts/dev_env_scripts_constants/test_contrast_framing_constants.py

@@ -0,0 +1,60 @@
+"""The contrast-framing form list stays usable by both linters."""
+
+from __future__ import annotations
+
+from dev_env_scripts_constants.contrast_framing_constants import (
+    ALL_CONTRAST_FRAMING_FORMS,
+    CONTRAST_FRAMING_MESSAGE_TEMPLATE,
+)
+
+
+def test_every_form_carries_a_distinct_name() -> None:
+    all_names = [each_form.name for each_form in ALL_CONTRAST_FRAMING_FORMS]
+
+    assert len(set(all_names)) == len(all_names)
+
+
+def test_no_form_matches_prose_that_states_what_is() -> None:
+    all_clean_lines = (
+        "The function runs more than 30 lines.",
+        "The reader reads more than 30 lines a minute.",
+        "The check names the failing line and the fix.",
+        "Push the branch and read the verdict.",
+        "Three attempts, then park the member.",
+    )
+    for each_form in ALL_CONTRAST_FRAMING_FORMS:
+        for each_line in all_clean_lines:
+            assert each_form.pattern.search(each_line) is None
+
+
+def test_every_pattern_reports_the_words_that_carry_the_contrast() -> None:
+    all_expected_matches = {
+        "trailing-comma-not": (", not s", "a diff regression, not shared code"),
+        "corrective-it-is-not": (
+            "it is not a flake, it is",
+            "it is not a flake, it is a bug",
+        ),
+        "substitution-rather-than": ("rather than", "park it rather than fix it"),
+        "additive-not-just": ("not just", "not just for today"),
+        "comparative-ranking": (
+            "matters more than",
+            "precision matters more than coverage",
+        ),
+        "substitution-as-opposed-to": (
+            "as opposed to",
+            "a warning as opposed to a failure",
+        ),
+    }
+    for each_form in ALL_CONTRAST_FRAMING_FORMS:
+        expected_text, example_line = all_expected_matches[each_form.name]
+        assert each_form.pattern.search(example_line).group(0) == expected_text
+
+
+def test_the_message_template_carries_the_three_parts() -> None:
+    message = CONTRAST_FRAMING_MESSAGE_TEMPLATE.format(
+        name="trailing-comma-not", text="a fix, not a workaround", guidance="State it."
+    )
+
+    assert "trailing-comma-not" in message
+    assert "a fix, not a workaround" in message
+    assert message.endswith("State it.")

package/scripts/durable_post_lint.py

@@ -8,6 +8,10 @@ from collections.abc import Sequence
 from dataclasses import dataclass
 from pathlib import Path
 
+from contrast_framing import describe_contrast_framing, find_contrast_framing
+from dev_env_scripts_constants.contrast_framing_constants import (
+    CONTRAST_FRAMING_FINDING_CODE,
+)
 from durable_post_lint_config.config.constants import (
     ACTION_PR_CREATE,
     ACTION_PR_EDIT,
@@ -134,10 +138,30 @@ def _description_heading_findings(body_text: str) -> list[DurablePostFinding]:
     ]
 
 
+def _contrast_framing_findings(text: str) -> list[DurablePostFinding]:
+    all_lines = text.splitlines()
+    return [
+        DurablePostFinding(
+            code=CONTRAST_FRAMING_FINDING_CODE,
+            message=describe_contrast_framing(
+                all_lines[each_line_number - 1], each_form_name
+            ),
+        )
+        for each_line_number, _each_column, each_form_name in find_contrast_framing(
+            text
+        )
+    ]
+
+
 def _title_findings(title: str | None) -> list[DurablePostFinding]:
-    if title is None or CONVENTIONAL_TITLE_PATTERN.fullmatch(title) is not None:
+    if title is None:
         return []
-    return [DurablePostFinding(code=INVALID_TITLE_CODE, message=INVALID_TITLE_MESSAGE)]
+    all_findings = _contrast_framing_findings(title)
+    if CONVENTIONAL_TITLE_PATTERN.fullmatch(title) is None:
+        all_findings.append(
+            DurablePostFinding(code=INVALID_TITLE_CODE, message=INVALID_TITLE_MESSAGE)
+        )
+    return all_findings
 
 
 def _is_release_automation_branch(head_branch: str | None) -> bool:
@@ -172,8 +196,10 @@ def _body_findings(
         )
     if _is_release_automation_branch(head_branch):
         all_findings.extend(_release_body_findings(body_text))
-    elif action in ALL_PR_DESCRIPTION_ACTIONS:
-        all_findings.extend(_description_heading_findings(body_text))
+    else:
+        if action in ALL_PR_DESCRIPTION_ACTIONS:
+            all_findings.extend(_description_heading_findings(body_text))
+        all_findings.extend(_contrast_framing_findings(body_text))
     if find_volatile_path_marker(body_text) is not None:
         all_findings.append(
             DurablePostFinding(

package/scripts/followup_cli.py

@@ -281,21 +281,17 @@ def _run_count(repository_root: Path, stdout: TextIO) -> int:
         and BACKLOG_EXCEEDED_EXIT_CODE once it passes it.
     """
     finding_count = len(all_recorded_findings(repository_root))
-    if finding_count <= FOLLOWUP_BACKLOG_THRESHOLD:
-        stdout.write(
-            BACKLOG_WITHIN_TEMPLATE.format(
-                finding_count=finding_count, threshold=FOLLOWUP_BACKLOG_THRESHOLD
-            )
-            + LINE_SEPARATOR
-        )
-        return SUCCESS_EXIT_CODE
+    within_threshold = finding_count <= FOLLOWUP_BACKLOG_THRESHOLD
+    finding_template = (
+        BACKLOG_WITHIN_TEMPLATE if within_threshold else BACKLOG_EXCEEDED_TEMPLATE
+    )
     stdout.write(
-        BACKLOG_EXCEEDED_TEMPLATE.format(
+        finding_template.format(
             finding_count=finding_count, threshold=FOLLOWUP_BACKLOG_THRESHOLD
         )
         + LINE_SEPARATOR
     )
-    return BACKLOG_EXCEEDED_EXIT_CODE
+    return SUCCESS_EXIT_CODE if within_threshold else BACKLOG_EXCEEDED_EXIT_CODE
 
 
 def _run_clear(repository_root: Path) -> int:

package/scripts/merge_gate_checks.py

@@ -0,0 +1,236 @@
+#!/usr/bin/env python3
+"""Hold a merge policy document to the branch ruleset it describes.
+
+A policy document names the checks a pull request passes before it merges.
+Those names go stale the moment the branch ruleset stops requiring one of
+them, and the document then promises a gate that never runs.
+
+The document carries one fenced block whose info string is
+``required-status-checks``. Each line inside it is one check context, spelled
+the way the ruleset spells it.
+
+::
+
+    ```required-status-checks
+    instruction-pairs / instruction-pairs
+    ```
+    ok:   the ruleset requires that context      -> exit 0
+    flag: the ruleset dropped that context       -> exit 1, one line naming it
+
+The ruleset arrives two ways. A checked-in snapshot keeps the comparison
+offline, which is what the paired test suite reads. ``--live`` reads the
+ruleset from the GitHub API, and ``--refresh`` writes the live answer back to
+the snapshot file.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import urllib.request
+from collections.abc import Iterator, Sequence
+from pathlib import Path
+from typing import TextIO
+
+from dev_env_scripts_constants.merge_gate_check_constants import (
+    ALL_GITHUB_TOKEN_VARIABLES,
+    FENCE_MARKER,
+    JSON_INDENT_WIDTH,
+    MERGE_GATE_CLEAN_EXIT_CODE,
+    MERGE_GATE_MISSING_CHECK_EXIT_CODE,
+    REQUIRED_CHECK_BLOCK_INFO_STRING,
+    REQUIRED_STATUS_CHECKS_RULE_TYPE,
+    RULE_CONTEXT_KEY,
+    RULE_PARAMETERS_KEY,
+    RULE_TYPE_KEY,
+    RULESET_API_ACCEPT_HEADER,
+    RULESET_API_TEMPLATE,
+    RULESET_REQUEST_TIMEOUT_SECONDS,
+    UTF8_ENCODING,
+)
+
+
+def parse_declared_contexts(document_text: str) -> list[str]:
+    """Read the check contexts a policy document declares, in document order.
+
+    ::
+
+        parse_declared_contexts("```required-status-checks\\nRuff\\n```\\n")
+        ok: ["Ruff"]
+
+    A document with no such block declares nothing.
+
+    Args:
+        document_text: The whole policy document.
+
+    Returns:
+        The contexts inside the ``required-status-checks`` block, in the order
+        the document lists them, and an empty list when the block is absent.
+    """
+    all_stripped_lines = [each_line.strip() for each_line in document_text.splitlines()]
+    opening_fence = FENCE_MARKER + REQUIRED_CHECK_BLOCK_INFO_STRING
+    if opening_fence not in all_stripped_lines:
+        return []
+    block_body_index = all_stripped_lines.index(opening_fence) + 1
+    all_declared_contexts: list[str] = []
+    for each_line in all_stripped_lines[block_body_index:]:
+        if each_line == FENCE_MARKER:
+            break
+        if each_line:
+            all_declared_contexts.append(each_line)
+    return all_declared_contexts
+
+
+def ruleset_contexts(ruleset_payload: object) -> set[str]:
+    """Read every status-check context a branch ruleset requires.
+
+    A rule of another type carries no context and is passed over.
+
+    Args:
+        ruleset_payload: The list of rules the branch-rules endpoint returns.
+
+    Returns:
+        Every context named by a ``required_status_checks`` rule.
+    """
+    all_required_contexts: set[str] = set()
+    for each_rule in _required_status_check_rules(ruleset_payload):
+        all_required_contexts.update(_rule_contexts(each_rule))
+    return all_required_contexts
+
+
+def missing_contexts(document_text: str, ruleset_payload: object) -> list[str]:
+    """Name the declared contexts the ruleset stopped requiring.
+
+    An empty list means the ruleset requires every check the document names,
+    so the document's promise holds.
+
+    Args:
+        document_text: The whole policy document.
+        ruleset_payload: The list of rules the branch-rules endpoint returns.
+
+    Returns:
+        The declared contexts the ruleset leaves out, in document order.
+    """
+    all_required_contexts = ruleset_contexts(ruleset_payload)
+    return [
+        each_context
+        for each_context in parse_declared_contexts(document_text)
+        if each_context not in all_required_contexts
+    ]
+
+
+def main(all_arguments: Sequence[str]) -> int:
+    """Compare the document against the snapshot, or against the live ruleset.
+
+    Args:
+        all_arguments: The command-line arguments after the program name.
+
+    Returns:
+        ``0`` when the ruleset requires every declared context, and ``1`` with
+        one line per context the ruleset leaves out.
+    """
+    parser = _build_parser()
+    parsed_arguments = parser.parse_args(all_arguments)
+    wants_live_ruleset = parsed_arguments.live or parsed_arguments.refresh
+    if wants_live_ruleset and not parsed_arguments.repository:
+        parser.error("--live and --refresh need --repository")
+    ruleset_payload = _resolve_ruleset(parsed_arguments)
+    document_text = parsed_arguments.document.read_text(encoding=UTF8_ENCODING)
+    return _report_missing(
+        parsed_arguments.document,
+        missing_contexts(document_text, ruleset_payload),
+        sys.stdout,
+    )
+
+
+def _required_status_check_rules(
+    ruleset_payload: object,
+) -> Iterator[dict[str, object]]:
+    if not isinstance(ruleset_payload, list):
+        return
+    for each_rule in ruleset_payload:
+        if isinstance(each_rule, dict) and (
+            each_rule.get(RULE_TYPE_KEY) == REQUIRED_STATUS_CHECKS_RULE_TYPE
+        ):
+            yield each_rule
+
+
+def _rule_contexts(all_rule_fields: dict[str, object]) -> set[str]:
+    parameters = all_rule_fields.get(RULE_PARAMETERS_KEY)
+    if not isinstance(parameters, dict):
+        return set()
+    all_declared_checks = parameters.get(REQUIRED_STATUS_CHECKS_RULE_TYPE)
+    if not isinstance(all_declared_checks, list):
+        return set()
+    return {
+        each_check[RULE_CONTEXT_KEY]
+        for each_check in all_declared_checks
+        if isinstance(each_check, dict)
+        and isinstance(each_check.get(RULE_CONTEXT_KEY), str)
+    }
+
+
+def _read_github_token() -> str | None:
+    for each_variable_name in ALL_GITHUB_TOKEN_VARIABLES:
+        token = os.environ.get(each_variable_name)
+        if token:
+            return token
+    return None
+
+
+def _fetch_ruleset(repository: str, branch: str) -> object:
+    request = urllib.request.Request(
+        RULESET_API_TEMPLATE.format(repository=repository, branch=branch),
+        headers={"Accept": RULESET_API_ACCEPT_HEADER},
+    )
+    token = _read_github_token()
+    if token:
+        request.add_header("Authorization", f"Bearer {token}")
+    with urllib.request.urlopen(
+        request, timeout=RULESET_REQUEST_TIMEOUT_SECONDS
+    ) as api_reply:
+        return json.loads(api_reply.read().decode(UTF8_ENCODING))
+
+
+def _resolve_ruleset(parsed_arguments: argparse.Namespace) -> object:
+    if not (parsed_arguments.live or parsed_arguments.refresh):
+        return json.loads(parsed_arguments.ruleset.read_text(encoding=UTF8_ENCODING))
+    ruleset_payload = _fetch_ruleset(
+        parsed_arguments.repository, parsed_arguments.branch
+    )
+    if parsed_arguments.refresh:
+        parsed_arguments.ruleset.write_text(
+            json.dumps(ruleset_payload, indent=JSON_INDENT_WIDTH) + "\n",
+            encoding=UTF8_ENCODING,
+        )
+    return ruleset_payload
+
+
+def _report_missing(
+    document_path: Path, all_absent_contexts: Sequence[str], stream: TextIO
+) -> int:
+    if not all_absent_contexts:
+        stream.write(f"{document_path}: the ruleset requires every named check\n")
+        return MERGE_GATE_CLEAN_EXIT_CODE
+    stream.writelines(
+        f"{document_path}: the branch ruleset does not require {each_context!r}\n"
+        for each_context in all_absent_contexts
+    )
+    return MERGE_GATE_MISSING_CHECK_EXIT_CODE
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="Check a merge policy document.")
+    parser.add_argument("--document", required=True, type=Path)
+    parser.add_argument("--ruleset", required=True, type=Path)
+    parser.add_argument("--repository")
+    parser.add_argument("--branch", default="main")
+    parser.add_argument("--live", action="store_true")
+    parser.add_argument("--refresh", action="store_true")
+    return parser
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

package/scripts/policy_lint/adapter_contrast_framing.py

@@ -0,0 +1,59 @@
+"""Report authored prose that defines its subject against a rejected reading.
+
+A contrast leaves the reader holding two readings where one would do. The
+detector lives in ``scripts/contrast_framing.py`` and reads its pattern list
+from ``scripts/dev_env_scripts_constants/contrast_framing_constants.py``, the
+same list the durable post linter reads.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from contrast_framing import describe_contrast_framing, find_contrast_framing
+
+from .config import constants
+from .model import Diagnostic, Document, Location, Severity
+
+
+def accepts_authored_markdown(document: Document) -> bool:
+    """Return whether the document is Markdown an author wrote.
+
+    Args:
+        document: Candidate document.
+
+    Returns:
+        True for Markdown outside the generated documents.
+    """
+    if document.path.suffix.lower() not in constants.ALL_MARKDOWN_SUFFIXES:
+        return False
+    return document.path.name.lower() not in constants.ALL_GENERATED_DOCUMENT_NAMES
+
+
+def contrast_framing_diagnostics(
+    document: Document, repository_root: Path
+) -> tuple[Diagnostic, ...]:
+    """Report each contrast-framing occurrence in one document.
+
+    Args:
+        document: Current document text and path.
+        repository_root: Request repository root, unused by this detector.
+
+    Returns:
+        Contrast-framing diagnostics in document order.
+    """
+    del repository_root
+    all_lines = document.text.splitlines()
+    return tuple(
+        Diagnostic(
+            constants.CONTRAST_FRAMING_RULE_ID,
+            Severity.ERROR,
+            describe_contrast_framing(
+                all_lines[each_line_number - 1], each_form_name
+            ),
+            Location(document.path, each_line_number, each_column),
+        )
+        for each_line_number, each_column, each_form_name in find_contrast_framing(
+            document.text
+        )
+    )

package/scripts/policy_lint/adapters.py

@@ -10,6 +10,7 @@ from shared_tree_paths import resolve_shared_scripts_directory
 
 from . import (
     adapter_configuration,
+    adapter_contrast_framing,
     adapter_detectors,
     adapter_pairing,
     adapter_retired_hook_prose,
@@ -438,6 +439,35 @@ def accepts_instruction_markdown(document: Document) -> bool:
     return adapter_retired_hook_prose.accepts_instruction_markdown(document)
 
 
+def accepts_authored_markdown(document: Document) -> bool:
+    """Return whether the document is Markdown an author wrote.
+
+    Args:
+        document: Candidate document.
+
+    Returns:
+        True for Markdown outside the generated documents.
+    """
+    return adapter_contrast_framing.accepts_authored_markdown(document)
+
+
+def contrast_framing_diagnostics(
+    document: Document, repository_root: Path
+) -> tuple[Diagnostic, ...]:
+    """Report prose that defines its subject against a rejected reading.
+
+    Args:
+        document: Current Markdown text and path.
+        repository_root: Request repository root.
+
+    Returns:
+        Contrast-framing diagnostics.
+    """
+    return adapter_contrast_framing.contrast_framing_diagnostics(
+        document, repository_root
+    )
+
+
 def retired_hook_prose_diagnostics(
     document: Document, repository_root: Path
 ) -> tuple[Diagnostic, ...]:

package/scripts/policy_lint/config/constants.py

@@ -168,3 +168,5 @@ RETIRED_HOOK_PROSE_MESSAGE = (
     "reaches no tool call. Say what the reader faces now, or drop the "
     "present-tense action."
 )
+
+CONTRAST_FRAMING_RULE_ID = "contrast-framing"

package/scripts/policy_lint/registry.py

@@ -104,6 +104,11 @@ def _text_document_rules() -> tuple[model.Rule, ...]:
             adapters.accepts_workflow,
             adapters.workflow_substitution_diagnostics,
         ),
+        build_document_rule(
+            "contrast-framing",
+            adapters.accepts_authored_markdown,
+            adapters.contrast_framing_diagnostics,
+        ),
         build_document_rule(
             "retired-hook-prose",
             adapters.accepts_instruction_markdown,

package/scripts/repository_checks/config/constants.py

@@ -21,6 +21,16 @@ ALL_CHECK_IDS = (
     CHECK_ID_TRACKED_PERSONAL_DATA,
 )
 
+SEVERITY_BREAKING = "breaking"
+SEVERITY_SMELL = "smell"
+SEVERITY_BY_CHECK_ID: dict[str, str] = {
+    CHECK_ID_CLAUDE_MD_ORPHANS: SEVERITY_BREAKING,
+    CHECK_ID_ENV_VAR_DOCUMENTATION: SEVERITY_BREAKING,
+    CHECK_ID_PACKAGE_INVENTORY: SEVERITY_SMELL,
+    CHECK_ID_PYTEST_TESTPATHS: SEVERITY_BREAKING,
+    CHECK_ID_TRACKED_PERSONAL_DATA: SEVERITY_BREAKING,
+}
+
 SUCCESS_EXIT_CODE = 0
 FINDINGS_EXIT_CODE = 1
 FAILED_CHECK_EXIT_CODE = INCOMPLETE_EXIT_CODE
@@ -28,6 +38,7 @@ USAGE_EXIT_CODE = INVALID_INPUT_EXIT_CODE
 
 REPOSITORY_ROOT_FLAG = "--repository-root"
 FINDING_LINE_TEMPLATE = "{check_id}: {relative_path}: {message}"
+ADVISORY_FINDING_LINE_TEMPLATE = "advisory: {check_id}: {relative_path}: {message}"
 RULE_FAILED_LINE_TEMPLATE = "error: rule failed: {check_id}"
 REPORT_LINE_SEPARATOR = "\n"
 EMPTY_REPORT_TEXT = ""
@@ -57,6 +68,7 @@ PACKAGE_INVENTORY_CONSTANTS_MODULE_NAME = (
 )
 PYTEST_TESTPATHS_MODULE_NAME = "blocking.pytest_testpaths_orphan_blocker"
 PII_SCANNER_MODULE_NAME = "blocking.pii_scanner"
+FOLLOWUP_LEDGER_MODULE_NAME = "followup_ledger"
 REPOSITORY_EXEMPTION_MODULE_NAME = (
     "blocking.pii_prevention_blocker_parts.repository_exemption"
 )

package/scripts/repository_checks/config/policy_document.py

@@ -1,6 +1,7 @@
 """Repository policy document and exception-entry schema."""
 
 import re
+from typing import NamedTuple
 
 CONFIG_RELATIVE_PATH = "config/repository-policy.json"
 DIGEST_PATTERN = re.compile(r"[0-9a-f]{64}")
@@ -11,9 +12,34 @@ FIRST_PRINTABLE_CODEPOINT = 32
 VERSION_FIELD = "version"
 SUPPORTED_DOCUMENT_VERSION = 1
 EMAIL_EXEMPTIONS_FIELD = "email_exemptions"
+PRIVATE_IP_EXEMPTIONS_FIELD = "private_ip_exemptions"
 PATH_EXEMPTIONS_FIELD = "path_exemptions"
-ALL_EXEMPTION_FIELDS = frozenset({EMAIL_EXEMPTIONS_FIELD, PATH_EXEMPTIONS_FIELD})
-ALL_DOCUMENT_FIELDS = ALL_EXEMPTION_FIELDS | {VERSION_FIELD}
 EMAIL_EXEMPTION_SUBJECT = "Email exemption"
+PRIVATE_IP_EXEMPTION_SUBJECT = "Private IP exemption"
 PATH_EXEMPTION_SUBJECT = "Path exemption"
 EMAIL_CATEGORY = "email"
+PRIVATE_IP_CATEGORY = "private-ip"
+
+
+class MatchExemptionFamily(NamedTuple):
+    """One scanner category cleared by a committed path and match digest."""
+
+    field_name: str
+    category: str
+    subject: str
+
+
+EMAIL_EXEMPTION_FAMILY = MatchExemptionFamily(
+    EMAIL_EXEMPTIONS_FIELD, EMAIL_CATEGORY, EMAIL_EXEMPTION_SUBJECT
+)
+PRIVATE_IP_EXEMPTION_FAMILY = MatchExemptionFamily(
+    PRIVATE_IP_EXEMPTIONS_FIELD, PRIVATE_IP_CATEGORY, PRIVATE_IP_EXEMPTION_SUBJECT
+)
+ALL_MATCH_EXEMPTION_FAMILIES = (
+    EMAIL_EXEMPTION_FAMILY,
+    PRIVATE_IP_EXEMPTION_FAMILY,
+)
+ALL_EXEMPTION_FIELDS = frozenset(
+    each_family.field_name for each_family in ALL_MATCH_EXEMPTION_FAMILIES
+) | {PATH_EXEMPTIONS_FIELD}
+ALL_DOCUMENT_FIELDS = ALL_EXEMPTION_FIELDS | {VERSION_FIELD}

package/scripts/repository_checks/followups.py

@@ -0,0 +1,54 @@
+"""Record advisory committed-tree findings in the follow-up ledger."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from types import ModuleType
+
+from repository_checks.config.constants import (
+    ALL_FAIL_CLOSED_EXCEPTION_TYPES,
+    FOLLOWUP_LEDGER_MODULE_NAME,
+    SEVERITY_SMELL,
+)
+from repository_checks.hook_modules import load_hooks_module
+from repository_checks.models import RepositoryCheckReport, RepositoryFinding
+
+
+def record_smell_findings(repository_root: Path, report: RepositoryCheckReport) -> None:
+    """Append every advisory finding to the repository's follow-up ledger.
+
+    The ledger keeps the gate's decision unchanged, so a ledger that cannot be
+    loaded or written leaves the report's exit code as it stands.
+
+    Args:
+        repository_root: The repository whose ledger receives the findings.
+        report: The findings this run produced.
+    """
+    if not report.all_smell_findings:
+        return
+    try:
+        ledger = load_hooks_module(FOLLOWUP_LEDGER_MODULE_NAME)
+        origin_commit = ledger.head_commit(repository_root)
+        for each_finding in report.all_smell_findings:
+            _append_finding(ledger, repository_root, each_finding, origin_commit)
+    except ALL_FAIL_CLOSED_EXCEPTION_TYPES:
+        return
+
+
+def _append_finding(
+    ledger: ModuleType,
+    repository_root: Path,
+    finding: RepositoryFinding,
+    origin_commit: str,
+) -> None:
+    ledger.record_followup_finding(
+        repository_root,
+        ledger.FollowupFinding(
+            finding.check_id,
+            finding.relative_path,
+            finding.message,
+            finding.check_id,
+            SEVERITY_SMELL,
+            origin_commit,
+        ),
+    )