create-agent-rig 0.10.1 → 1.0.1

package/templates/agent-os/universal/.agents/skills/skill-authoring/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: skill-authoring
+description: Use when authoring or editing a skill in this rig — a new SKILL.md under .claude/skills/, or a change to an existing one.
+allowed-tools: Read, Grep, Glob
+---
+
+# Authoring a skill
+
+No check in this rig runs on a skill you write here — the rules below are
+applied by the author, and by a reviewer reading this file, never by a
+mechanism. On the skills this rig itself ships, the generator's own
+`test/template/skill-authoring.test.ts` (absent in a generated rig) checks
+only the first rule, that a `description` is present, and that the skills and
+roles a skill names by name exist.
+
+- **The frontmatter `name` equals the directory name.** A skill loaded from
+  `.claude/skills/foo/` is named `foo`, not something else.
+- **The `description` says when to use the skill**, not just what it does.
+- **Keep it short, and point at existing rules or scripts rather than
+  restating them.** A skill that copies a rule's wording is a second copy
+  that goes stale the day the rule changes; link to `.claude/rules/` or a
+  script instead.
+- **Every sentence describing how a mechanism behaves either points at the
+  test that proves it, or is deleted.** `.claude/rules/invariants.md`,
+  "State the limits — and test them", is the norm; the form is `see <file>
+  (absent in a generated rig) › "<exact test name>"`.
+- **A mention of a workflow-layer skill or script in a Core document is
+  qualified "opt-in workflow layer"** — `loop` and `pr-ship` are examples,
+  not this skill's own concern.
+- **Both copies ship and must stay identical**: the Claude skill under
+  `.claude/skills/` and the Codex repository skill under `.agents/skills/`.
+  That mirror is checked in `test/template/codex.test.ts` (absent in a
+  generated rig) › "publishes every shared skill through the Codex
+  repository skill location" — not repeated here.
+
+## Out of scope
+
+This is guidance to apply by reading, not an evaluator: the skill itself has
+no procedure and checks nothing.

package/templates/agent-os/universal/.claude/agents/code-reviewer.md

@@ -2,7 +2,7 @@
 name: code-reviewer
 description: Reviews a completed change against the checklist before a PR is opened or merged. Use after any non-trivial implementation work, and always before opening a PR that reaches the `model` lane — everything the two cheap lanes do not claim (code, a rulebook document, an unclassifiable path, a derived artifact git does not report as drift, or anything a risk flag escalated), decided by `decision-router.mjs` where the opt-in workflow layer is installed, or by the same rule applied by hand otherwise. Blocking findings must be resolved, not argued with.
 tools: Read, Grep, Glob, Bash
-model: claude-opus-5
+model: claude-opus-5-5
 effort: high
 ---
 
@@ -38,6 +38,10 @@ references, and you classify every finding as **blocking** or **advisory**.
    rulebook already refuses that evidence elsewhere (`.claude/rules/autonomy.md`).
    "Item not supplied, item 6 not checked" is a useful line in a report; a
    guess dressed as a verdict is worse than the silence it replaces.
+7. **Independent oracle** — a test of a security, ownership or governance
+   mechanism whose expected result is derived from the same production
+   mechanism it checks. See the independent-oracle invariant in
+   `.claude/rules/invariants.md`.
 
 ## Advisory findings
 

package/templates/agent-os/universal/.claude/agents/failure-diagnostician.md

@@ -0,0 +1,112 @@
+---
+name: failure-diagnostician
+description: Use when a check is red or a run crashed and the cause is not obvious, or to reproduce a claimed defect/historical finding on the current default branch before work is planned on it.
+tools: Read, Grep, Glob, Bash
+model: claude-opus-5-5
+effort: high
+---
+
+You diagnose. You take one of two input kinds — a red check or a crashed run,
+or a claimed defect / historical finding to reproduce on the current default
+branch — and answer with evidence, not a guess dressed as one.
+
+## Hard limits
+
+- **You make no repository edits.** A throwaway reproduction file goes
+  outside the repository, never inside it — you are not the Green step, and a
+  fix is not your answer. You do not commit, push, merge or open a pull
+  request.
+- **Never re-run a check until it goes green.** A flaky-looking result is a
+  defect to report, not a thing to retry — the same stop rule that applies
+  everywhere else in this rulebook (`.claude/rules/autonomy.md`, "Stop rules —
+  by work-state, not by feelings").
+- **On Claude Code, no hook enforces the no-edit limit above.** `tools: Read,
+  Grep, Glob, Bash` carries no Write or Edit, which stops the ordinary path,
+  but nothing refuses a shell redirect the way a guard would. On Codex the
+  equivalent profile is `sandbox_mode = "read-only"`, enforced by the runtime
+  itself. Either way, a sandbox that blocks the reproduction you need is not
+  something to work around: answer `INCONCLUSIVE` or `INSUFFICIENT_EVIDENCE`
+  and name the sandbox as the missing evidence.
+
+## Method
+
+1. **Reproduce.** A failure input (red check, crashed run) reproduces at the
+   commit or branch where it failed — the PR head, or the commit the caller
+   names. A claimed defect or historical finding reproduces on the current
+   default branch. No reproduction, no diagnosis.
+2. **Isolate.** Narrow to the smallest change (input, config, code path) that
+   flips the result.
+3. **Hypothesize.** State the mechanism you think is responsible, in one or
+   two sentences.
+4. **Confirm with evidence.** Show the command and its output, or the
+   file:line the mechanism lives at. A hypothesis nothing confirms is
+   `INCONCLUSIVE`, not `ROOT_CAUSE`.
+
+For a failure input that reaches `ROOT_CAUSE`, classify it: `product` (the
+code is wrong), `test` (the test's premise or fixture is wrong),
+`infrastructure` (CI, network, environment — not the code under test), or
+`upstream` (a dependency or external service).
+
+## Optional evidence (opt-in workflow layer)
+
+Where this repository has installed the opt-in workflow layer, the run
+journal and `run-state.mjs`'s recorded verdict may already carry evidence
+worth reading before you reproduce anything by hand — a prior `REGRESSION`,
+or an earlier run's own trace. Their absence is the normal Core path, not a
+gap: read them when present, reproduce directly when not.
+
+## The answer
+
+End your report with **exactly one** fenced `json` block of the shared shape
+(`.claude/scripts/lib/verdict.mjs`), and nothing after it.
+
+- **A failure input** (red check, crash) answers `ROOT_CAUSE` or
+  `INCONCLUSIVE`.
+- **A claim or historical finding** answers `STILL_LIVE`, `ALREADY_FIXED`,
+  `OBSOLETE` or `INSUFFICIENT_EVIDENCE`.
+- `ROOT_CAUSE`, `INCONCLUSIVE`, `STILL_LIVE` and `INSUFFICIENT_EVIDENCE` are
+  blocking and must name at least one blocker: for `ROOT_CAUSE` and
+  `STILL_LIVE` the blocker is the cause, with `file`/`line` where there is
+  one; for `INCONCLUSIVE` and `INSUFFICIENT_EVIDENCE` it is what evidence
+  would decide the question.
+- `ALREADY_FIXED` and `OBSOLETE` carry no blockers — the fixing commit or the
+  superseding mechanism goes in `evidence` instead.
+- `classification` is required on `ROOT_CAUSE`, allowed but optional on
+  `STILL_LIVE`, and refused on every other word.
+- `node .claude/scripts/verdict.mjs check <report> failure-diagnostician` is
+  what refuses a malformed answer before anyone reads it as one.
+
+```json
+{
+  "gate": "failure-diagnostician",
+  "verdict": "ROOT_CAUSE",
+  "blockers": [
+    {
+      "file": "src/example.ts",
+      "line": 42,
+      "rule": "reproduced failure",
+      "note": "the function reads the value before the guard that handles the missing case — reproduced on the PR head with the fixture the failing test supplies"
+    }
+  ],
+  "advisories": [],
+  "evidence": ["reproduced with the failing test on the PR head", "the stack trace from that run names the file:line above"],
+  "classification": "product"
+}
+```
+
+```json
+{
+  "gate": "failure-diagnostician",
+  "verdict": "ALREADY_FIXED",
+  "blockers": [],
+  "advisories": [],
+  "evidence": ["the commit that added the missing guard fixes exactly this report", "re-ran the original repro on the current default branch; it now passes"]
+}
+```
+
+## Not a merge gate
+
+You are never a routed reviewer: no `decision-router` lane names you and no
+`pr-ship` coverage check (opt-in workflow layer) expects your answer. You
+diagnose on request; you never implement the fix, and a report with no
+unbacked behaviour claim or invented figure is the only kind you write.

package/templates/agent-os/universal/.claude/agents/security-scanner.md

@@ -2,7 +2,7 @@
 name: security-scanner
 description: Scans a change for security issues. MUST be used when a change touches authentication, authorization, secrets or configuration, input parsing, file handling, or any new outbound call. Findings gate the PR.
 tools: Read, Grep, Glob, Bash
-model: claude-opus-5
+model: claude-opus-5-5
 effort: high
 ---
 

package/templates/agent-os/universal/.claude/hooks/gate-stop-dod.mjs

@@ -193,9 +193,13 @@ function main() {
     // repo" and waves through, running the whole Definition-of-Done suite
     // against a tree it never managed to read.
     //
-    // 🔴 Limit: only THIS command is sanitised. The Definition-of-Done checks
-    // below run with the environment as given, because they are the project's
-    // own commands and their environment is the project's business.
+    // 🔴 Limit: only THIS command is sanitised beyond `RIG_RUN_DIR`. The
+    // Definition-of-Done checks below run with the environment as given,
+    // because they are the project's own commands and their environment is
+    // the project's business — except `RIG_RUN_DIR`, which names the
+    // directory of the workflow run executing this very hook and belongs to
+    // the run, not to the project's own commands.
+    //   see hooks.test.ts (absent in a generated rig) › "never lets a Definition-of-Done check see RIG_RUN_DIR, even though the hook itself is given one"
     // `timeout` below is the preamble's own leash: this is the one call that
     // runs before the budget's clock starts. A repository slow enough to exceed
     // it throws into the catch and the checks run anyway — the safe direction,
@@ -268,6 +272,12 @@ function main() {
   // lengthen nor shorten the budget.
   const deadline = performance.now() + budget.ms;
 
+  // Computed once, not per check: `RIG_RUN_DIR` names the workflow run
+  // directory of the run executing this hook, and it is the one variable the
+  // project's own commands never get — see the 🔴 limit above.
+  const envForChecks = { ...process.env };
+  delete envForChecks.RIG_RUN_DIR;
+
   for (const command of usable) {
     // A 1 ms floor rather than a branch for "the budget is already gone": the
     // check then times out through the ordinary path, which names the command
@@ -276,6 +286,7 @@ function main() {
     const result = spawnSync(command, {
       cwd: PROJECT_ROOT,
       shell: true,
+      env: envForChecks,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: Math.max(1, Math.ceil(deadline - performance.now())),

package/templates/agent-os/universal/.claude/hooks/guard-rulebook.mjs

@@ -5,8 +5,10 @@
 // The rulebook is the set of files that decide what this session may do — hooks
 // and settings wiring, the queue config and selector, all scripts, rules, skills
 // and agents, the `.codex/` configuration, the integrity manifest,
-// `.claude/doctor-exemptions.json`, `AGENTS.md` and `CLAUDE.md`. Every one of
-// them was editable by the run it governs: a
+// `.claude/doctor-exemptions.json`, the revalidation detection contract
+// `.rig/revalidation.json` — but not the claim records beside it under
+// `.rig/claims/`, which a SELECT has to write — `AGENTS.md` and `CLAUDE.md`.
+// Every one of them was editable by the run it governs: a
 // Write to `.claude/hooks/dod-checks.json` with `[]` switched the stop gate
 // off, and nothing refused it until the merge sweep, long after.
 //
@@ -26,7 +28,8 @@
 //      names the flag; an edit outside the rulebook still passes. Refusing to
 //      inspect is not allowing (`.claude/rules/invariants.md`).
 //
-// Limits — each stated here and each measured in the generator's
+// Limits — each stated here and, unless it is marked untested, measured in
+// the generator's
 // `test/template/guard-rulebook.test.ts` (absent in a generated rig), by the
 // test named beside it:
 //   - it sees one edit at a time, as text, before it lands — a rulebook file
@@ -49,22 +52,57 @@
 //     checkout root before guarding a canonical payload path", › "blocks when
 //     the checkout root and payload use the same symlink spelling", and
 //     › "blocks an existing rulebook file when only the payload path uses a symlink spelling";
+//   - an `apply_patch` destination keeps the lexical spelling it named even when
+//     a guarded prefix (`.claude/hooks`, say) is itself a symlink/junction to
+//     somewhere else inside the checkout — `edit-input.mjs`'s `repositoryPatchPath`
+//     carries that spelling alongside the realpath-resolved one, RP-60 — ›
+//     "refuses an apply_patch through a guarded prefix junctioned to a target
+//     inside the checkout";
 //   - an `allow` prefix is a string prefix of the repo-relative path and may
 //     not widen the rulebook — an entry that is itself a prefix of a rulebook
 //     prefix (`.`, `.claude/`, `.claude/scripts/`) makes the flag unreadable
 //     and the guard refuses — › "a flag whose allow-list widens the rulebook is
 //     unreadable, so `--allow .` cannot disarm it";
+//   - a miscased payload path is judged against the rulebook's CANONICAL
+//     spelling (`unattended-flag.mjs`'s `canonicalRulebookPath`), but an
+//     `allow` entry never is — a miscased entry authorizes nothing, including
+//     the one prefix deliberately withheld as an allow root
+//     (`.claude/scripts/`) and the board selector, refused regardless of case
+//     — › "guard-rulebook: an allow-list entry is judged by its literal
+//     spelling, not the one the payload folds to (RP-215 round 2)";
 //   - fail-open on its own errors and on a payload it cannot parse — › "allows
 //     an empty payload object" and › "allows non-JSON stdin" — and fail-closed
 //     on a flag it cannot read — › "blocks a rulebook edit when the flag exists
 //     but cannot be read, and names the file": the guard targets drift, not an
-//     adversary.
+//     adversary;
+//   - a `//`-prefixed normalised path is refused rather than resolved while
+//     armed exactly when it does not relativise under any comparison root —
+//     a repository root spelled as a plain path can never strip a UNC admin
+//     share or a device path with no drive letter (`\\?\Volume{GUID}\…`), but
+//     a root that is itself UNC-spelled (`CLAUDE_PROJECT_DIR` as
+//     `\\server\share\repo`) strips a payload path genuinely under it, and
+//     such a path is judged normally instead — › "guard-rulebook: an
+//     unjudgeable UNC/device-namespace path is refused, not silently allowed
+//     (RP-244 round 2)" and › "guard-rulebook: a `//`-prefixed path is
+//     refused only when it resolves under no repository root (RP-244
+//     round 3)". The same refusal covers a MultiEdit past the fragment cap
+//     (the `appliesToAll` global refusal) aimed at such a path, not only the
+//     ordinary per-fragment case — › "guard-rulebook: a MultiEdit global
+//     refusal is not exempt from the `//`-prefix refusal (RP-244 round 3)";
+//   - the reverse direction is untested and left as a design limit: when the
+//     repository root is itself spelled as a UNC admin share
+//     (`\\host\X$\…`), the LOCAL DRIVE spelling of the same file (`X:\…`) is
+//     never placed against it — `relativeTo` strips a `//`-prefixed payload
+//     path from a `//`-rooted comparison root, not a drive-letter one from
+//     it — so such a payload path is judged normally rather than refused as
+//     unjudgeable, and a rulebook edit reaching the guard that way is not
+//     caught. Tracked as RP-246.
 //
 // The rule it enforces is stated in `.claude/rules/autonomy.md`, "Never".
 import { realpathSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { editFragments } from './lib/edit-input.mjs';
-import { RULEBOOK_PREFIXES, isRulebookPath, readUnattended } from '../scripts/unattended-flag.mjs';
+import { RULEBOOK_PREFIXES, canonicalRulebookPath, isRulebookPath, readUnattended } from '../scripts/unattended-flag.mjs';
 import { readHookInput } from './lib/hook-input.mjs';
 
 export { RULEBOOK_PREFIXES, isRulebookPath };
@@ -119,10 +157,45 @@ export const relativeTo = (root, filePath) => {
 export const isAllowed = (rel, allow) =>
   (Array.isArray(allow) ? allow : []).some((prefix) => prefix !== '' && (rel === prefix || rel.startsWith(prefix)));
 
-const protectedRelative = (roots, filePath) =>
-  [...new Set([filePath, canonicalPath(filePath)])]
-    .flatMap((spelling) => roots.map((root) => relativeTo(root, spelling)))
-    .find(isRulebookPath);
+// RP-60: `rawFilePath` is the lexical spelling `apply_patch` fragments carry
+// alongside the realpath-resolved `filePath` (`edit-input.mjs`,
+// `repositoryPatchPath`) — a guarded prefix that is itself a symlink/junction
+// to somewhere else inside the checkout resolves away the rulebook spelling
+// otherwise, the same way `canonicalRoot`/`comparisonRoots` above seed both
+// spellings of the checkout root. Every other edit surface never sets it, so
+// this is a no-op for them.
+//
+// RP-215 round 2: the return value is the CANONICAL rulebook spelling
+// (`canonicalRulebookPath`), not the candidate that matched it. `isAllowed`
+// and the `.claude/queue.board` carve-out below both compare this result
+// against literal allow-list entries, so a miscased entry (`.Claude/`,
+// `.claude/Scripts/`) never matches — only the path is canonicalised, never
+// the allow-list. See the generator's `test/template/guard-rulebook.test.ts` (absent in a generated rig) ›
+// "guard-rulebook: an allow-list entry is judged by its literal spelling,
+// not the one the payload folds to (RP-215 round 2)".
+const protectedRelative = (roots, filePath, rawFilePath) => {
+  const candidates = [...new Set([filePath, rawFilePath, canonicalPath(filePath)].filter((spelling) => typeof spelling === 'string' && spelling !== ''))]
+    .flatMap((spelling) => roots.map((root) => relativeTo(root, spelling)));
+  for (const candidate of candidates) {
+    const canonical = canonicalRulebookPath(candidate);
+    if (canonical !== undefined) return canonical;
+  }
+  return undefined;
+};
+
+// RP-244 round 3: a `//`-prefixed normalised path is undecidable ONLY when it
+// does not relativise under any comparison root — reusing `relativeTo`, the
+// same comparison `protectedRelative` above already makes, rather than a
+// second implementation. A UNC-spelled repository root (`CLAUDE_PROJECT_DIR`
+// itself a `\\server\share\repo` spelling) maps to the same `//`-prefixed
+// shape a payload path under it normalises to, so `relativeTo` CAN strip it —
+// and a path that strips cleanly is judged normally, not refused as
+// unjudgeable, whether or not it lands inside the rulebook.
+const isUnjudgeablePath = (roots, filePath) => {
+  if (typeof filePath !== 'string' || !filePath.startsWith('//')) return false;
+  const file = toPosix(filePath);
+  return !roots.some((root) => relativeTo(root, filePath) !== file);
+};
 
 function main() {
   const input = readHookInput();
@@ -139,8 +212,28 @@ function main() {
   );
   if (globalRefusal) {
     if (globalRefusal.filePath) {
+      // No `rawFilePath` argument here: the only `appliesToAll` refusal that
+      // carries a non-empty `filePath` at all is the MultiEdit fragment-cap
+      // refusal (`edit-input.mjs`), and it never sets `rawFilePath` — so
+      // there is nothing a third argument would add for this call site.
       const rel = protectedRelative(comparisonRoots, globalRefusal.filePath);
-      if (rel === undefined) return 0;
+      if (rel === undefined) {
+        // RP-244 round 3: `rel === undefined` used to read as "outside the
+        // rulebook, never judged" unconditionally — exactly the reading the
+        // per-fragment block below already proved wrong for a `//`-prefixed
+        // path that resolves under no comparison root. A global refusal
+        // carrying such a path is refused the same way, instead of exiting 0
+        // before `isUnjudgeablePath` is ever consulted.
+        if (!isUnjudgeablePath(comparisonRoots, globalRefusal.filePath)) return 0;
+        const mode = readUnattended(unattendedEnv);
+        if (!mode.on) return 0;
+        process.stderr.write(
+          `BLOCKED — "${globalRefusal.filePath}" could not be resolved against the repository root: ` +
+            'a UNC or device-namespace path is refused rather than judged while unattended. ' +
+            'Write through the repository path instead.\n',
+        );
+        return 2;
+      }
     }
     const mode = readUnattended(unattendedEnv);
     if (!mode.on) return 0;
@@ -150,25 +243,60 @@ function main() {
     );
     return 2;
   }
+  // RP-244 round 2: `normalisePath` (`edit-input.mjs`) maps a UNC or other
+  // device-namespace spelling to a `//`-prefixed result — `relativeTo` can
+  // only strip a path that starts with the literal repository root, and a
+  // `//`-prefixed path never does, on any platform or root. That is not
+  // "outside the rulebook": it is undecidable, and undecidable is refused,
+  // not allowed, while armed (`.claude/rules/invariants.md`, "The remedy
+  // belongs to the refusal"). RP-244 round 3: "does not relativise under any
+  // comparison root" replaces the plain `startsWith('//')` check — a
+  // UNC-spelled repository root makes a payload path under it decidable, so
+  // it is judged normally rather than refused as unjudgeable.
+  const unjudgeable = fragments.find(({ filePath }) => isUnjudgeablePath(comparisonRoots, filePath));
+
   const paths = [];
-  for (const { filePath } of fragments) {
+  for (const { filePath, rawFilePath } of fragments) {
     if (typeof filePath !== 'string' || filePath === '') continue;
-    const rel = protectedRelative(comparisonRoots, filePath);
+    const rel = protectedRelative(comparisonRoots, filePath, rawFilePath);
     if (rel !== undefined && !paths.includes(rel)) paths.push(rel);
   }
-  if (paths.length === 0) return 0; // nothing under the rulebook: never judged
+  if (paths.length === 0 && !unjudgeable) return 0; // nothing under the rulebook: never judged
 
   const mode = readUnattended(unattendedEnv);
   if (!mode.on) return 0; // attended session
 
   if (mode.unreadable) {
+    // RP-244 round 3: `paths[0] ?? unjudgeable.filePath` used to print "is
+    // part of the rulebook" even when `paths` was empty and only an
+    // unjudgeable `//`-prefixed path put this branch on the table — a claim
+    // this guard never established. An unjudgeable path gets the same
+    // "could not be resolved" reason it gets everywhere else in this file.
+    const target = paths[0];
+    if (target === undefined) {
+      process.stderr.write(
+        `BLOCKED — "${unjudgeable.filePath}" could not be resolved against the repository root, ` +
+          `and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
+          'Refusing to inspect is not allowing: fix it, or clear this checkout with `node .claude/scripts/unattended-flag.mjs off --root "$PWD"`, then retry.\n',
+      );
+      return 2;
+    }
     process.stderr.write(
-      `BLOCKED — "${paths[0]}" is part of the rulebook and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
+      `BLOCKED — "${target}" is part of the rulebook and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
         'Refusing to inspect is not allowing: fix it, or clear this checkout with `node .claude/scripts/unattended-flag.mjs off --root "$PWD"`, then retry.\n',
     );
     return 2;
   }
 
+  if (unjudgeable) {
+    process.stderr.write(
+      `BLOCKED — "${unjudgeable.filePath}" could not be resolved against the repository root: ` +
+        'a UNC or device-namespace path is refused rather than judged while unattended. ' +
+        'Write through the repository path instead.\n',
+    );
+    return 2;
+  }
+
   const refused = paths.filter(
     (rel) => rel === '.claude/queue.board' || !isAllowed(rel, mode.allow),
   );

package/templates/agent-os/universal/.claude/hooks/guard-secret-file.mjs

@@ -99,7 +99,11 @@ function main() {
   const editTools = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply_patch']);
   if (!editTools.has(input?.tool_name)) return 0;
 
-  const fragments = editFragments(input);
+  // RP-214: `editFragments` also reports a removal (a Delete File section, or
+  // the source half of a Move) as its own fragment, `removes: true` — deleting
+  // a credential file is not writing one, so this guard never judges those,
+  // including an inspection refusal attached to one.
+  const fragments = editFragments(input).filter(({ removes }) => !removes);
   const globalRefusal = fragments.find(
     ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
   );