pinky-core 0.1.0.dev4__tar.gz → 0.1.0.dev5__tar.gz

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev5}/.github/workflows/ci.yml

@@ -3,10 +3,8 @@ name: CI
 on:
   push:
     branches: [main, develop]
-    paths: ['src/**', 'tests/**', 'pyproject.toml', 'scripts/**', '.pre-commit-config.yaml', '.github/workflows/ci.yml']
   pull_request:
     branches: [main, develop]
-    paths: ['src/**', 'tests/**', 'pyproject.toml', 'scripts/**', '.pre-commit-config.yaml', '.github/workflows/ci.yml']
 
 jobs:
   ci:
@@ -33,10 +31,10 @@ jobs:
         uses: j178/prek-action@v2
 
       - name: Install dependencies
-        # All optional extras, not just validate/address/dev — omitting xml/schedule/lint
-        # silently skips their test files at collection time (pytest.importorskip on the
-        # missing package), deflating the coverage number without ever failing CI.
-        run: pip install -e ".[validate,address,schedule,xml,lint,dev]"
+        # --group dev, pas ".[dev]" : les deps de dev sont un dependency-group PEP 735 depuis
+        # 2026-07-22 (voir le commentaire dans pyproject.toml — `uv run` désinstallait les extras).
+        # Requiert pip >= 25.1 ; ensurepip en livre 26.1.2 avec Python 3.12, donc rien à épingler.
+        run: pip install -e ".[validate,address,schedule,xml,lint]" --group dev
 
       - name: Tests
         run: pytest

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev5}/.gitignore

@@ -12,7 +12,10 @@ build/
 
 # ── Environments ─────────────────────────────────────────────────────────────
 .env
-.venv/
+# No trailing slash: with `centralized-project-envs`, uv puts the env in ~/.cache/uv and drops a
+# SYMLINK named .venv here. `.venv/` matches directories only, so the link stayed untracked-visible
+# and committable — a machine-absolute path, useless on any other machine.
+.venv
 venv/
 .conda/
 

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev5}/.pre-commit-config.yaml

@@ -15,6 +15,15 @@ default_install_hook_types: [pre-commit, commit-msg]
 # Pin explicite : sans ça, les hooks `language: python` (mdformat, mypy, interrogate, darglint…)
 # créent leur venv avec le python3 ambiant du PATH au moment de l'install, pas une version garantie
 # par le repo — non-déterministe en local (CI est protégée par actions/setup-python en amont).
+#
+# Règle (2026-07-22) : tout hook `repo: local` dont l'`entry` commence par `python` DOIT être
+# `language: python`, jamais `language: system`. `system` exécute la commande telle quelle dans le
+# shell, et `python` nu n'existe ni sur macOS hors conda (homebrew ne pose que `python3`) ni sur une
+# machine Windows vanilla — ça ne marchait que par l'auto-activation de conda base. Avec
+# `language: python`, prek provisionne l'interpréteur (et le télécharge s'il manque) et met le bin/
+# de son venv en tête du PATH : `python` y est garanti sur les trois OS. Les scripts de
+# scripts/hooks/ étant 100 % stdlib, ils partagent tous un seul venv (dédupliqué par langage +
+# version + additional_dependencies) — coût quasi nul.
 default_language_version:
   python: python3.12
 
@@ -80,7 +89,7 @@ repos:
       - id: check-zws
         name: "[ZWS] Invisible characters (zero-width)"
         entry: python scripts/hooks/check_zws.py
-        language: system
+        language: python
         pass_filenames: true
 
   # ── Employer reference guard ──────────────────────────────────────────────
@@ -89,7 +98,7 @@ repos:
       - id: check-forbidden-keywords
         name: "[FORBIDDEN] Employer references"
         entry: python scripts/hooks/check_forbidden_keywords.py
-        language: system
+        language: python
         pass_filenames: true
 
   # ── Commit message format ─────────────────────────────────────────────────
@@ -171,10 +180,22 @@ repos:
       - id: check-typed-api
         name: "[TYPED-API] No raw dict/tuple/set in public annotations"
         entry: python scripts/hooks/check_typed_api.py
-        language: system
+        language: python
         types: [python]
         files: ^src/
 
+  # Weak-assertion ratchet — first hook to target tests/, not src/ (tests.md § generator oracle).
+  # Blocks a fragment `assert "x" in <generator(...)>` that has no whole-output equality oracle in
+  # the same file. Narrow by design (name-matched generators only) so it stays at ~0 flags.
+  - repo: local
+    hooks:
+      - id: check-weak-assertions
+        name: "[WEAK-ASSERT] Generated-output assertion needs an equality oracle"
+        entry: python scripts/hooks/check_weak_assertions.py
+        language: python
+        types: [python]
+        files: ^tests/
+
   # ── EXTRA snowflake — Snowpark / Core API repos ───────────────────────────
   # Snowpark / Core API conventions (no session.sql(), canonical method names)
   - repo: local
@@ -182,6 +203,6 @@ repos:
       - id: check-snowpark-api
         name: "[SNOWPARK-API] No session.sql(), canonical method names"
         entry: python scripts/hooks/check_snowpark_api.py
-        language: system
+        language: python
         types: [python]
         files: ^src/

pinky_core-0.1.0.dev5/.python-version

@@ -0,0 +1 @@
+3.12

pinky_core-0.1.0.dev5/.vscode/settings.json

@@ -0,0 +1,8 @@
+{
+  // uv keeps this repo's environment in its own cache, OUT of the synced iCloud drive (ADR-0023),
+  // and the `.venv` here is a SYMLINK to it. VSCode's environment auto-discovery does NOT follow that
+  // symlink, so the interpreter is declared explicitly rather than picked by hand each time.
+  // ${workspaceFolder} is THIS repo when the multi-root `pinky.code-workspace` is open.
+  // Env missing? `uv sync --all-extras` recreates it.
+  "python.defaultInterpreterPath": "${workspaceFolder}/.venv/bin/python"
+}

pinky_core-0.1.0.dev5/CONTEXT.md

@@ -0,0 +1,24 @@
+# CONTEXT.md — pinky-core
+*Update date : 2026-07-12 13:12*
+
+Single source of truth for naming in this repo. Variables, functions, modules, and prose follow it.
+**Agent rule: read this before naming anything.**
+
+| Term (preferred) | Avoid | Definition |
+|---|---|---|
+| `validate_*` (`validate_siret`, `validate_identifier`, …) | check, verify, sanitize | Reject-only — returns the input unchanged if valid, raises/returns invalid otherwise. Never transforms. |
+| `standardize_*` (`standardize_email`, `standardize_phone`) | normalize, format | Validates **and** normalizes to a canonical form (e.g. phone → E.164). |
+| `safe_*` (`safe_filepath`) | sanitize, escape | Same contract as `validate_*` — reject-only. Named `safe_` (not `sanitize_`) because the caller's safety comes from the *rejection*, not from any escaping/transform; a docstring once claimed it escaped quotes, it never did (coco review, 2026-07-12) — don't reintroduce that confusion. |
+| `ref` / `refs` (`extract_table_refs`, `resolve_query`'s `refs` param) | reference(s) | A table reference string — see `FQN`. |
+| `FQN` | fully-qualified name, qualified identifier | `DATABASE.SCHEMA.TABLE` (or `SCHEMA.TABLE`) — pinky-provider's identifier convention. A bare, unqualified name is never a legitimate FQN in this codebase (see `extract_table_refs`). |
+| `predicate` (schedule.py's `is_business_day`, `is_eve_of_holiday`, …) | check, rule, condition | A pure `bool`-returning function taking a `date`, callable as a DAG root-task SKIP gate (ADR-0013 in pinky-provider). |
+| `*Result` (`EmailResult`, `FecParseResult`, …) | `*Response`, `*Output` | A model wrapping the outcome of one validate/parse call — success or failure both representable, never raised. |
+| `*Error` (`FecRowError`, `FecBalanceError`) | `*Failure`, `*Issue` | A record of one specific failure collected *during* processing (e.g. one bad row) — distinct from `*Result`, which wraps the whole call's outcome. |
+| `lazy import` (`from unidecode import unidecode` inside a function body) | optional import, deferred import | The pattern every optional-dependency function uses so importing the *module* never requires the extra — only calling that specific function does. |
+
+## Flagged ambiguities
+
+- **`slugify` breaks the `to_*` prefix convention** (`to_upper_snake_case`, `to_camel_case`) — kept
+  bare because "slugify" is an established cross-language term (same name in Django, JS `slugify`
+  packages, etc.); renaming it `to_slug` would be more consistent internally but less recognizable.
+  Not revisited unless a second bare-verb name is added and the inconsistency compounds.

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pinky-core
-Version: 0.1.0.dev4
+Version: 0.1.0.dev5
 Summary: Shared Python utilities for Snowflake development
 Project-URL: Homepage, https://github.com/pinky-and-co/pinky-core
 Project-URL: Repository, https://github.com/pinky-and-co/pinky-core
@@ -40,19 +40,6 @@ Requires-Dist: sqlglot
 Requires-Dist: unidecode
 Provides-Extra: address
 Requires-Dist: usaddress; extra == 'address'
-Provides-Extra: dev
-Requires-Dist: bandit; extra == 'dev'
-Requires-Dist: darglint; extra == 'dev'
-Requires-Dist: genbadge[coverage]; extra == 'dev'
-Requires-Dist: interrogate; extra == 'dev'
-Requires-Dist: mkdocs-awesome-pages-plugin>=2.0; extra == 'dev'
-Requires-Dist: mkdocs-material>=9.0; extra == 'dev'
-Requires-Dist: mkdocstrings[python]>=0.25; extra == 'dev'
-Requires-Dist: mypy; extra == 'dev'
-Requires-Dist: pre-commit; extra == 'dev'
-Requires-Dist: pytest; extra == 'dev'
-Requires-Dist: pytest-cov; extra == 'dev'
-Requires-Dist: ruff; extra == 'dev'
 Provides-Extra: fec
 Requires-Dist: unidecode; extra == 'fec'
 Provides-Extra: lint
@@ -158,12 +145,15 @@ pinky-core/
 │       ├── ci.yml
 │       ├── publish.yml
 │       └── release.yml
+├── .vscode/
+│   └── settings.json
 ├── scripts/
 │   ├── hooks/
 │   │   ├── badges.toml
 │   │   ├── check_forbidden_keywords.py
 │   │   ├── check_snowpark_api.py
 │   │   ├── check_typed_api.py
+│   │   ├── check_weak_assertions.py
 │   │   ├── check_zws.py
 │   │   ├── commit-msg
 │   │   ├── docs_identity.json
@@ -191,6 +181,13 @@ pinky-core/
 │       └── xml.py
 ├── tests/
 │   ├── fixtures/
+│   │   ├── golden/
+│   │   │   ├── dl_card_basic.html
+│   │   │   ├── dl_card_expiry.html
+│   │   │   ├── generate_html_basic.html
+│   │   │   ├── task_table_error.html
+│   │   │   ├── task_table_no_snowsight.html
+│   │   │   └── task_table_snowsight.html
 │   │   └── cats_domination.xml
 │   ├── __init__.py
 │   ├── test_fec.py
@@ -208,10 +205,13 @@ pinky-core/
 ├── .gitignore
 ├── .gitleaks.toml
 ├── .pre-commit-config.yaml
+├── .python-version
 ├── .secrets.baseline
+├── CONTEXT.md
 ├── LICENSE
 ├── pyproject.toml
-└── README.md
+├── README.md
+└── uv.lock
 ```
 
 </details>

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev5}/README.md

@@ -85,12 +85,15 @@ pinky-core/
 │       ├── ci.yml
 │       ├── publish.yml
 │       └── release.yml
+├── .vscode/
+│   └── settings.json
 ├── scripts/
 │   ├── hooks/
 │   │   ├── badges.toml
 │   │   ├── check_forbidden_keywords.py
 │   │   ├── check_snowpark_api.py
 │   │   ├── check_typed_api.py
+│   │   ├── check_weak_assertions.py
 │   │   ├── check_zws.py
 │   │   ├── commit-msg
 │   │   ├── docs_identity.json
@@ -118,6 +121,13 @@ pinky-core/
 │       └── xml.py
 ├── tests/
 │   ├── fixtures/
+│   │   ├── golden/
+│   │   │   ├── dl_card_basic.html
+│   │   │   ├── dl_card_expiry.html
+│   │   │   ├── generate_html_basic.html
+│   │   │   ├── task_table_error.html
+│   │   │   ├── task_table_no_snowsight.html
+│   │   │   └── task_table_snowsight.html
 │   │   └── cats_domination.xml
 │   ├── __init__.py
 │   ├── test_fec.py
@@ -135,10 +145,13 @@ pinky-core/
 ├── .gitignore
 ├── .gitleaks.toml
 ├── .pre-commit-config.yaml
+├── .python-version
 ├── .secrets.baseline
+├── CONTEXT.md
 ├── LICENSE
 ├── pyproject.toml
-└── README.md
+├── README.md
+└── uv.lock
 ```
 
 </details>

pinky_core-0.1.0.dev5/docs/adr/0001-zero-dependency-static-html.md

@@ -0,0 +1,26 @@
+---
+title: "0001"
+---
+# ADR-0001 — Zero Snowflake dependency at import time
+Status: accepted
+Date: 2026-05-31
+
+## Contexte
+
+`pinky-core` doit être importable dans tous les contextes où Python s'exécute : pipelines CI,
+scripts de développement local, gestionnaires UDF à l'intérieur de Snowflake, et Streamlit dans les applications Snowflake.
+L'importation inconditionnelle de Snowpark lève une erreur ou ajoute un coût de démarrage dans les contextes
+qui n'ont pas de session active.
+
+## Décision
+
+Aucun module dans `pinky-core` n'importe Snowflake ou Snowpark au niveau du module.
+Les dépendances optionnelles (`email-validator`, `phonenumbers`, `python-stdnum`, `croniter`) sont
+importées paresseusement dans les fonctions. Les importations réservées au type vérification utilisent la garde `TYPE_CHECKING`.
+
+## Conséquences
+
+- `pinky-core` est installable dans n'importe quel environnement Python 3.11+ sans client
+  Snowflake — `pip install pinky-core` fonctionne en CI pur.
+- Tout module qui a besoin d'une session active appartient à `pinky-snowpark`, pas ici.
+- Les erreurs d'exécution dues aux dépendances optionnelles manquantes apparaissent au moment de l'appel, non à l'importation.

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev5}/docs/explanation/2-features.md

@@ -2,7 +2,7 @@
 title: Features
 ---
 # Features — pinky-core
-*Update date : 2026-07-12 10:37*
+*Update date : 2026-07-25 09:25*
 
 Feature list ordered by priority. `stable` = in production. `planned` = not yet built, order = priority.
 
@@ -18,7 +18,7 @@ Feature list ordered by priority. `stable` = in production. `planned` = not yet
 | `sql.py` | SQL parsing helpers powered by sqlglot: statement kind, table-ref extraction, query resolution, statement splitting | stable |
 | `html.py` | HTML templating engine — emails, reports, mini-sites, Outlook-safe | stable |
 | `xml.py` | XPath helpers, namespace-aware parsing, safe attribute extraction | stable |
-| `files.py` | S3/MFT filename pattern normalisation — `detect_file_pattern`, `FileDetection` | stable |
+| `files.py` | S3/MFT filename pattern normalisation — `detect_file_pattern`, `FileDetection`; replaces dates, timestamps, UUIDs, ISO country codes, structured business identifiers (SIRET/SIREN/IBAN/VAT_FR), and numeric IDs with placeholders | stable |
 | `schedule.py` | French public holidays, business-day helpers, cron human-readable formatting, Airflow-timetable predicates (month/week/fiscal-quarter, eve-of-holiday) | stable |
 | `lint.py` | Optional lint/format delegation (sqlfluff/ruff/yamllint/detect-secrets) — consumed by pinky-provider for the secret-scan deploy gate and SQL pre-flight | stable |
 | `warnings.py` | `PinkyDeprecationWarning` — deprecated pinky APIs and UDFs. No consumer wired yet (destined for pinky-provider's registry `status: deprecated`) | stable |

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev5}/docs/reference/generated/hooks_badge.svg

@@ -1,12 +1,12 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="81" height="20">
-  <title>generate-docs · mdformat · check-zws · check-forbidden-keywords · commit-msg-format · mypy · interrogate · darglint · check-typed-api · check-snowpark-api</title>
+  <title>generate-docs · mdformat · check-zws · check-forbidden-keywords · commit-msg-format · mypy · interrogate · darglint · check-typed-api · check-weak-assertions · check-snowpark-api</title>
   <rect width="81" height="20" rx="3" fill="#555"/>
   <rect x="50" width="31" height="20" rx="3" fill="#007ec6"/>
   <rect x="50" width="4" height="20" fill="#007ec6"/>
   <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
     <text x="25" y="15" fill="#010101" fill-opacity=".3">hooks</text>
     <text x="25" y="14">hooks</text>
-    <text x="65" y="15" fill="#010101" fill-opacity=".3">10</text>
-    <text x="65" y="14">10</text>
+    <text x="65" y="15" fill="#010101" fill-opacity=".3">11</text>
+    <text x="65" y="14">11</text>
   </g>
 </svg>

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pinky-core"
-version = "0.1.0.dev4"
+version = "0.1.0.dev5"
 description = "Shared Python utilities for Snowflake development"
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -32,7 +32,18 @@ xml      = ["lxml", "lxml-stubs"]
 fec      = ["unidecode"]
 # Delegated lint/format/scan backends for pinky_core.lint (SQL / YAML / Python / secrets).
 lint     = ["sqlfluff>=3.0", "yamllint>=1.35", "ruff", "detect-secrets>=1.5"]
-dev      = [
+
+# Deps de dev en dependency-group (PEP 735), PAS en extra (2026-07-22, repo pilote).
+# `uv run` resynchronise l'environnement vers l'état PAR DÉFAUT : les extras n'en font pas partie, il
+# les DÉSINSTALLE donc silencieusement, puis retombe sur le premier pytest trouvé sur le PATH — c'est
+# ce qui avait produit un « 1180 tests au vert » qui validait en réalité les envs conda. Le groupe
+# `dev` de PEP 735, lui, est synchronisé par défaut : `uv run` redevient correct sans aucun flag à
+# retenir. (`[tool.uv] default-extras` est accepté sans erreur mais reste sans effet — testé.)
+# Côté CI, l'équivalent de `-e ".[dev]"` est `-e . --group dev` (pip >= 25.1 ; ensurepip livre 26.1.2
+# avec Python 3.12, donc aucune contrainte à gérer). Un extra reste le bon outil pour une option
+# destinée aux CONSOMMATEURS de la lib — validate/address/schedule/xml/fec/lint restent des extras.
+[dependency-groups]
+dev = [
     "mkdocs-material>=9.0",
     "mkdocs-awesome-pages-plugin>=2.0",
     "mkdocstrings[python]>=0.25",
@@ -52,6 +63,14 @@ Homepage   = "https://github.com/pinky-and-co/pinky-core"
 Repository = "https://github.com/pinky-and-co/pinky-core"
 Issues     = "https://github.com/pinky-and-co/pinky-core/issues"
 
+# ── uv ───────────────────────────────────────────────────────────────────────
+# The project environment lives in uv's cache, NOT in a `.venv` at the repo root: this workspace sits
+# on a synced iCloud drive, and ADR-0023 recorded confirmed corruption when a tool environment lives
+# inside one. Preview feature, accepted knowingly — `uv sync` prints the resolved path, so re-check it
+# still lands under ~/.cache/uv after a uv upgrade.
+[tool.uv]
+preview-features = ["centralized-project-envs"]
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/pinky_core"]
 

pinky_core-0.1.0.dev5/scripts/hooks/check_weak_assertions.py

@@ -0,0 +1,250 @@
+#!/usr/bin/env python3
+"""
+check_weak_assertions.py — Ratchet against weak assertions on generated output.
+
+Third and final stage of the "assertion faible sur sortie générée" pattern (tests.md §
+generator oracle): a test that only asserts a *fragment* of a generator's output
+(`assert "MY_DAG" in clause`) passes on the correct output AND on a wrong one — it freezes
+the bug in place. The rule (tests.md) bites on new code; the purge cleared the stock; THIS
+hook is the cliquet that keeps the stock at zero.
+
+It is a RATCHET, not an exhaustiveness guarantee. It flags only the narrow, audit-validated
+pattern, so it stays at ~0 flags on already-purged repos and never cries wolf (a hook one
+learns to `--no-verify` is worse than no hook):
+
+  Flag a generator ONLY when ALL hold:
+    1. an assert of the form  `assert "<str literal>" in <Y>`  (operator `in`, NOT `not in` —
+       a negative assertion genuinely proves an absence);
+    2. `<Y>` traces back to a generator — a call to a function whose name (stripped of leading
+       underscores) matches the generator convention, directly or via a variable assigned from
+       such a call;
+    3. that generator has NO equality oracle anywhere in the repo's tests/ tree — neither an inline
+       `assert <gen(...)> == <literal>` nor an oracle routed through a local helper whose body
+       does the `==` (e.g. `_assert_golden("...", html)` where `html = generate_html(...)`).
+
+The oracle need not sit in the SAME file as the fragment: tests.md asks for "at least one test"
+with a whole-output oracle, **repo-wide** — a fragment in test_web_precommit.py is legitimately
+covered by the oracle in test_precommit_config_oracle.py. pre-commit hands the hook only the
+CHANGED files, so main() builds the covered set by scanning every `.py` under the tests/ root(s)
+of the passed paths, not just argv. check_file() stays per-file (the testable unit of the AST
+scan); main() is the layer that applies the repo-wide covered set.
+
+Generators are matched BY NAME only (assumed hole, decided 2026-07-24): a badly-named generator
+escapes the ratchet — it is not blocked, merely unguarded. Widening to "returns markup" was
+rejected: it reopens the false positives the audit eliminated. (`html.py`'s `dl_card`/`task_table`
+were the audit's found instances — renamed `render_dl_card`/`render_task_table` to close the hole.)
+
+Usage (pre-commit local hook):
+  entry: python scripts/hooks/check_weak_assertions.py
+  language: system
+  types: [python]
+  files: ^tests/
+"""
+
+from __future__ import annotations
+
+import ast
+import os
+import sys
+from pathlib import Path
+
+# Generator naming convention (tests.md + card hook-cliquet). Matched on name.lstrip("_") so
+# private variants (`_build_ddl`, `_render_x`) are covered — bug #2 the purge audit already paid.
+_SUFFIXES: tuple[str, ...] = ("_sql", "_ddl", "_clause", "_statement", "_query")
+_PREFIXES: tuple[str, ...] = ("build_", "render_", "generate_")
+
+
+def _is_generator_name(name: str) -> bool:
+    bare = name.lstrip("_")
+    return bare.startswith(_PREFIXES) or bare.endswith(_SUFFIXES)
+
+
+def _call_name(func: ast.expr) -> str | None:
+    """The callee's bare name: `build_x` for both `build_x(...)` and `obj.build_x(...)`."""
+    if isinstance(func, ast.Name):
+        return func.id
+    if isinstance(func, ast.Attribute):
+        return func.attr
+    return None
+
+
+def _gen_from_expr(expr: ast.expr, var_to_gen: dict[str, str]) -> str | None:
+    """Generator name behind *expr*: a direct generator call, or a variable bound to one."""
+    if isinstance(expr, ast.Call):
+        name = _call_name(expr.func)
+        if name and _is_generator_name(name):
+            return name
+        return None
+    if isinstance(expr, ast.Name):
+        return var_to_gen.get(expr.id)
+    return None
+
+
+def _build_var_to_gen(scope: ast.AST) -> dict[str, str]:
+    """Map every `var = <generator call>` in *scope* to the generator's name."""
+    mapping: dict[str, str] = {}
+    for node in ast.walk(scope):
+        if isinstance(node, ast.Assign) and isinstance(node.value, ast.Call):
+            name = _call_name(node.value.func)
+            if name and _is_generator_name(name):
+                for target in node.targets:
+                    if isinstance(target, ast.Name):
+                        mapping[target.id] = name
+    return mapping
+
+
+def _has_eq(node: ast.AST) -> bool:
+    return any(
+        isinstance(n, ast.Compare) and any(isinstance(op, ast.Eq) for op in n.ops)
+        for n in ast.walk(node)
+    )
+
+
+def _collect_oracle_helpers(tree: ast.AST) -> set[str]:
+    """Module-level functions whose body performs an equality check.
+
+    A call to one of these, fed a generator's output, stands in for an inline `==` oracle
+    (bug #3, the most dangerous: without it the hook cries wolf on correctly-covered code).
+    Deliberately permissive — a false *exemption* only misses a flag; a false *positive*
+    gets the ratchet disabled, the worse failure for this card.
+    """
+    helpers: set[str] = set()
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) and _has_eq(node):
+            helpers.add(node.name)
+    return helpers
+
+
+def _iter_compares(test: ast.expr) -> list[ast.Compare]:
+    """The Compare nodes of an assert test: the bare compare, or the members of a `and`/`or`."""
+    if isinstance(test, ast.Compare):
+        return [test]
+    if isinstance(test, ast.BoolOp):
+        return [v for v in test.values if isinstance(v, ast.Compare)]
+    return []
+
+
+def _scan_scope(
+    scope: ast.AST,
+    var_to_gen: dict[str, str],
+    oracle_helpers: set[str],
+    weak: dict[tuple[str, int], None],
+    covered: set[str],
+) -> None:
+    for node in ast.walk(scope):
+        if isinstance(node, ast.Assert):
+            for cmp in _iter_compares(node.test):
+                if len(cmp.ops) != 1:
+                    continue
+                op, right = cmp.ops[0], cmp.comparators[0]
+                if isinstance(op, ast.In) and _is_str_literal(cmp.left):
+                    gen = _gen_from_expr(right, var_to_gen)
+                    if gen:
+                        weak[(gen, node.lineno)] = None
+                elif isinstance(op, ast.Eq):
+                    gen = _gen_from_expr(cmp.left, var_to_gen) or _gen_from_expr(
+                        right, var_to_gen
+                    )
+                    if gen:
+                        covered.add(gen)
+        elif isinstance(node, ast.Call):
+            name = _call_name(node.func)
+            if name in oracle_helpers:
+                for arg in node.args:
+                    gen = _gen_from_expr(arg, var_to_gen)
+                    if gen:
+                        covered.add(gen)
+
+
+def _is_str_literal(node: ast.expr) -> bool:
+    return isinstance(node, ast.Constant) and isinstance(node.value, str)
+
+
+def _scan(path: Path) -> tuple[dict[tuple[str, int], None], set[str]]:
+    """Parse *path* into its (weak fragment sites, generators with an equality oracle).
+
+    The two halves stay separate so callers can compose them across files: check_file() subtracts
+    covered from weak within the one file; main() applies a repo-wide covered set built from many.
+    """
+    # Distributed copies of this very hook live at scripts/hooks/ in every consumer repo — never
+    # under tests/, so `files: ^tests/` already excludes them; this guard keeps a manual run honest.
+    if "scripts/hooks" in path.as_posix():
+        return {}, set()
+    try:
+        tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    except (OSError, SyntaxError):
+        return {}, set()
+    oracle_helpers = _collect_oracle_helpers(tree)
+    weak: dict[tuple[str, int], None] = {}
+    covered: set[str] = set()
+    for fn in ast.walk(tree):
+        if isinstance(fn, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            _scan_scope(fn, _build_var_to_gen(fn), oracle_helpers, weak, covered)
+    return weak, covered
+
+
+def check_file(path: Path) -> list[tuple[int, str]]:
+    """Per-file flags: weak fragment sites whose generator has no oracle IN THIS FILE.
+
+    The testable unit of the hook — a single file's behaviour in isolation. Repo-wide oracle
+    resolution (a fragment covered by an oracle in a sibling file) is main()'s job, not this one's.
+    """
+    weak, covered = _scan(path)
+    return sorted((line, gen) for (gen, line) in weak if gen not in covered)
+
+
+def _is_disabled() -> bool:
+    disabled = os.environ.get("PINKY_DISABLED_HOOKS", "")
+    return Path(__file__).stem in {h.strip() for h in disabled.split(",") if h.strip()}
+
+
+def _tests_roots(paths: list[str]) -> set[Path]:
+    """The `tests/` directory ancestor of each passed path (empty when a path has none)."""
+    roots: set[Path] = set()
+    for p in paths:
+        for parent in Path(p).resolve().parents:
+            if parent.name == "tests":
+                roots.add(parent)
+                break
+    return roots
+
+
+def _repo_covered(paths: list[str]) -> set[str]:
+    """Generators with an equality oracle anywhere under the tests/ root(s) of *paths*.
+
+    pre-commit hands main() only the CHANGED files, but an oracle for a fragment's generator may
+    sit in an unchanged sibling — so the covered set is built from the whole tests/ tree, not argv.
+    Empty when no path lives under a `tests/` dir (a manual run on a stray file → per-file fallback).
+    """
+    covered: set[str] = set()
+    for root in _tests_roots(paths):
+        for f in root.rglob("*.py"):
+            covered |= _scan(f)[1]
+    return covered
+
+
+def main() -> int:
+    if _is_disabled():
+        return 0
+    paths = sys.argv[1:]
+    repo_covered = _repo_covered(paths)
+    failed = False
+    for filepath in paths:
+        for line, gen in check_file(Path(filepath)):
+            if gen in repo_covered:
+                continue  # oracle exists elsewhere in tests/ — the fragment is documentation, not a hole
+            print(
+                f"❌ [WEAK-ASSERT] {filepath}:{line}: `{gen}` — fragment `in` assertion with no "
+                f"equality oracle for the whole output"
+            )
+            failed = True
+    if failed:
+        print(
+            "   💡 Add one `assert <generator(...)> == <full expected output>` in the same test "
+            "file (tests.md § generator oracle). Fragment asserts stay welcome alongside it."
+        )
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{pinky_core-0.1.0.dev4 → pinky_core-0.1.0.dev5}/scripts/hooks/commit-msg

@@ -30,24 +30,23 @@ if echo "$COMMIT_MSG" | grep -qE "^💾 save: .{3,} \[skip ci\]"; then
     exit 0
 fi
 
-# Emoji → allowed type mapping
-# Python3 used for emoji extraction — macOS BSD grep lacks PCRE (-P) support
-EMOJI=$(python3 -c "
-import sys, re
-msg = sys.argv[1]
-parts = msg.split(None, 1)
-print(parts[0] if parts else '')
-" "$COMMIT_MSG" 2>/dev/null)
+# Emoji → allowed type mapping.
+#
+# Bash pur, zéro subprocess (2026-07-22). Les deux `python3 -c` d'avant se justifiaient par « macOS
+# BSD grep lacks PCRE (-P) », mais ils ne faisaient pas de PCRE : ils découpaient les deux premiers
+# tokens. `read` le fait nativement, et bash porte l'ERE avec `[[ =~ ]]` — aucun `-P` en jeu.
+# Ça enlève la dernière dépendance de ce hook à un interpréteur : `python3` existe sur macOS mais
+# n'est PAS garanti sur une machine Windows vanilla (ADR-0045 : `py -3` y est le lanceur canonique),
+# donc le frère n'aurait pas pu committer. Zéro interpréteur > choisir le bon lanceur.
+# Équivalence vérifiée sur 10 messages, emoji multi-octets à sélecteur de variation (♿️, ⚡️) et cas
+# limites (vide, sans emoji, mauvaise casse) inclus.
+#
+# Le découpage sur l'espace est sûr en UTF-8 : l'espace est ASCII et UTF-8 est auto-synchronisant,
+# donc un emoji multi-octets n'est jamais coupé en deux.
+read -r EMOJI REST <<< "$COMMIT_MSG"
 
-TYPE=$(python3 -c "
-import sys, re
-msg = sys.argv[1]
-parts = msg.split(None, 2)
-if len(parts) >= 2:
-    m = re.match(r'^([a-z_-]+)', parts[1])
-    if m:
-        print(m.group(1))
-" "$COMMIT_MSG" 2>/dev/null)
+TYPE=""
+[[ "$REST" =~ ^([a-z_-]+) ]] && TYPE="${BASH_REMATCH[1]}"
 
 if [ -z "$EMOJI" ] || [ -z "$TYPE" ]; then
     echo "❌ Invalid format — missing emoji or type."