Hook Configs YAML configuration files and their field-level documentation. Each config may have an associated schema that documents required and optional fields.
Content Rules8 Dependencies3 Project Structure4 Quality Gates5
20 of 20 configs
Universal banned-pattern rules and exceptions; the single source of truth for content bans.
Content Rules
banned_words.yaml Schema File
Universal banned-pattern rules and exceptions; the single source of truth for content bans.
Schema version of the banned-words config. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
Path-scoped exemptions applied to every project. Each entry whitelists patterns under specific paths so legitimate uses are not flagged.
Current: [HOVER TO SHOW VALUE]
Glob/regex paths the exemption block applies to (e.g. 'tests/', '\.toml$').
Banned patterns that are exempted under the matching paths.
The universal banned-pattern list. Every entry is enforced across all projects unless covered by a universal or per-project exception.
Current: [HOVER TO SHOW VALUE]
Regex pattern to match in file contents. Compiled by the banned-words scanner.
Human-readable explanation of why the pattern is banned; surfaced to the developer on violation and rendered in the wiki pattern library.
Pattern category ID (e.g. 'linter-suppression', 'ai-slop'). Drives wiki categorization. See config/pattern_categories.yaml for the full list.
Per-directory pattern overrides. Each key is a directory name; the value is a list of {pattern, reason} entries scoped to that directory.
Current: [HOVER TO SHOW VALUE]
Banned-pattern entries scoped to the named directory (e.g. 'tests').
Regex pattern scoped to the directory.
Reason the directory-scoped pattern is banned.
Patterns matched against file basenames rather than file contents. Catches versioned, backup, and temporary filenames.
Current: [HOVER TO SHOW VALUE]
Regex matched against the file basename (e.g. '_v[0-9]+').
Reason the filename pattern is banned.
Regex patterns blocked in commit messages; checked case-insensitively during commit-msg and pre-push stages.
Content Rules
blocked_commit_patterns.yaml Schema File
Regex patterns blocked in commit messages; checked case-insensitively during commit-msg and pre-push stages.
List of blocked regex patterns and their reasons. Each entry is checked case-insensitively against the full commit message body.
Current: [HOVER TO SHOW VALUE]
Regex pattern matched against the commit message. Examples include co-author attribution lines and AI-generated attribution strings.
Human-readable explanation of why the pattern is blocked; surfaced to the developer on violation.
Test coverage thresholds per test suite type; enforced by the coverage devolution checker to prevent regression.
Quality Gates
coverage_thresholds.yaml Schema File
Test coverage thresholds per test suite type; enforced by the coverage devolution checker to prevent regression.
Configuration for the unit test suite. Unit tests have a high coverage floor (90%) because they are fast and deterministic.
Current: [HOVER TO SHOW VALUE]
Directory path where unit tests live.
Minimum coverage percentage required for the suite to pass. Devolution is flagged when coverage drops below this threshold.
Source directory measured for coverage (the code under test).
Command used to run the test suite (e.g. 'uv run python -m pytest').
Configuration for the integration test suite. Integration tests use real git repos and subprocess spawns; coverage is supplementary with a low floor.
Current: [HOVER TO SHOW VALUE]
Directory path where integration tests live.
Minimum coverage percentage for integration tests. Low floor (5%) because coverage measurement is disabled to avoid tracing slow I/O.
Source directory measured for coverage.
Command used to run the integration test suite.
Set to 'false' to disable coverage tracing for this suite (avoids overhead of tracing slow I/O under PRoot).
Dead code analysis configuration consumed by lib/checks_dead_code.sh (the ci_check_dead_code shell function). Wraps the dangle Rust binary, which scans git-tracked files for unreferenced functions, classes, variables, and modules across 13 languages (Python, Lua, Bash/Shell, JavaScript, TypeScript incl. TSX, Rust, Go, and more). The keys below narrow which candidates dangle reports are surfaced as warnings.
Quality Gates
dead_code.yaml Schema File
Dead code analysis configuration consumed by lib/checks_dead_code.sh (the ci_check_dead_code shell function). Wraps the `dangle` Rust binary, which scans git-tracked files for unreferenced functions, classes, variables, and modules across 13 languages (Python, Lua, Bash/Shell, JavaScript, TypeScript incl. TSX, Rust, Go, and more). The keys below narrow which candidates dangle reports are surfaced as warnings.
Paths (directories or files) under which dead-code candidates are reported. Items whose file is not under a scan_paths entry are dropped from the report (dangle itself still scans the whole git-tracked repo and uses those files as reference sources). Defaults to ['ci'] when the key is absent.
Current: [HOVER TO SHOW VALUE]
Paths excluded from REPORTING. Files under these paths are still scanned for references by dangle but never appear in the dead-code report. Use for generated/vendored trees where the unreferenced-symbol noise is known and intentional.
Current: [HOVER TO SHOW VALUE]
Files excluded from REPORTING but still scanned for references. Used for test files and conftest modules that are never 'dead' themselves but whose imports matter. dangle's own test-file heuristic (test_ prefix or /tests/ segment) already suppresses reporting for most test files; reference_only_paths covers any remaining stragglers.
Current: [HOVER TO SHOW VALUE]
Specific names never reported as dead, regardless of reference count. Useful for module-level constants referenced only from test files (which dangle intentionally skips) and for conventional entry-point names.
Current: [HOVER TO SHOW VALUE]
Extended regex (ERE) patterns for names to ignore. Matched against the function/class/variable name reported by dangle before the trailing 'is not referenced' phrase.
Current: [HOVER TO SHOW VALUE]
Dependencies excluded from version-mismatch checks; used by check_dependency_versions to skip packages that are intentionally unversioned or externally managed.
Dependencies
dependency_excludes.yaml Schema File
Dependencies excluded from version-mismatch checks; used by check_dependency_versions to skip packages that are intentionally unversioned or externally managed.
Package names excluded from dependency version checks. Entries here are not flagged when their version constraints are missing or inconsistent.
Current: [HOVER TO SHOW VALUE]
Dependencies intentionally declared in both the workspace root and a workspace member; not flagged as redundant by check_duplicate_dependencies.
Dependencies
duplicate_dependency_excludes.yaml Schema File
Dependencies intentionally declared in both the workspace root and a workspace member; not flagged as redundant by check_duplicate_dependencies.
Package names excluded from duplicate-dependency detection. Self-duplicates (same dep in multiple sections of a single pyproject.toml) are NOT affected: version-mismatch self-duplicates always block, same-version duplicates warn.
Current: [HOVER TO SHOW VALUE]
Canonical manifest of per-project exemption/config files consumed by CI checks; consumers validate provenance (root-owned, immutable, regular file) and fail closed otherwise.
Quality Gates
exemption_files.yaml Schema File
Canonical manifest of per-project exemption/config files consumed by CI checks; consumers validate provenance (root-owned, immutable, regular file) and fail closed otherwise.
Schema version of the exemption manifest. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
The list of exemption/config files materialized in consumer projects.
Current: [HOVER TO SHOW VALUE]
Repo-relative location of the file in the consumer project.
CI-relative file copied when scaffolding the entry (optional).
Inline default content used when no default_source is given (optional).
Maximum line count per file by extension; enforced by the file-length checker to prevent oversized source files.
Quality Gates
file_length_limits.yaml Schema File
Maximum line count per file by extension; enforced by the file-length checker to prevent oversized source files.
Maximum number of lines allowed in a single file. Files exceeding this limit are flagged by the checker.
Current: [HOVER TO SHOW VALUE]
File extensions subject to the line-count limit. Only files matching these extensions are checked.
Current: [HOVER TO SHOW VALUE]
Maximum physical source-file size in bytes
Current: [HOVER TO SHOW VALUE]
Maximum direct source files in one module
Current: [HOVER TO SHOW VALUE]
Maximum direct source submodules in one module
Current: [HOVER TO SHOW VALUE]
Optional repository-relative module structural overrides
Maximum source-module depth relative to the repository root
Current: [HOVER TO SHOW VALUE]
Maximum total physical bytes across the source tree
Markdown documentation checker config: remote link checks, ignore globs, and known-broken reference exceptions.
Project Structure
markdown_docs.yaml Schema File
Markdown documentation checker config: remote link checks, ignore globs, and known-broken reference exceptions.
Whether to check remote HTTP(S) links. Slow and network-dependent; can be overridden via CLI --check-remote.
Current: [HOVER TO SHOW VALUE]
Timeout in seconds for each remote HTTP(S) link check.
Current: [HOVER TO SHOW VALUE]
Glob patterns for markdown files to skip entirely (e.g. node_modules, .venv, CHANGELOG.md).
Current: [HOVER TO SHOW VALUE]
Known-broken reference entries that should not fail CI. Each entry can specify a file (endswith match), a line (exact), and a reason for context.
Current: [HOVER TO SHOW VALUE]
Single source of truth for anti-pattern category IDs and human-readable labels, consumed by the CI checker for grouped violation reporting and by the wiki for /anti-patterns navigation.
Content Rules
pattern_categories.yaml Schema File
Single source of truth for anti-pattern category IDs and human-readable labels, consumed by the CI checker for grouped violation reporting and by the wiki for /anti-patterns navigation.
Schema version of the pattern category registry. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
The list of pattern categories; kept in sync with the PatternCategory union in web/src/types/patterns.ts.
Current: [HOVER TO SHOW VALUE]
Stable category identifier referenced by pattern definitions (e.g. 'linter-suppression').
Human-readable category label shown in violation reports and the wiki UI.
Frozen baseline of SHA-256 digests for broad-exemption policy files; only shrinkable through review.
Quality Gates
policy_integrity_baseline.yaml Schema File
Frozen baseline of SHA-256 digests for broad-exemption policy files; only shrinkable through review.
SHA-256 digests of project-scoped policy file states sanctioned as baseline.
Current: [HOVER TO SHOW VALUE]
SHA-256 digests of universal (cross-project) policy file states sanctioned as baseline.
Current: [HOVER TO SHOW VALUE]
Registry of workspace projects displayed on the wiki home page and project pages; the single source of truth for project display metadata.
Project Structure
projects.yaml Schema File
Registry of workspace projects displayed on the wiki home page and project pages; the single source of truth for project display metadata.
Schema version of the projects registry. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
The list of workspace projects rendered on the wiki home page and individual project pages.
Current: [HOVER TO SHOW VALUE]
URL slug for the project page (e.g. 'workspace-ci' renders at /workspace-ci).
Display name shown in project card titles and page headers.
Primary programming language label shown in project card tags.
Repository directory name under the workspace root; used to locate README.md, Makefile, and .git/ at runtime.
Remix Icon CSS class for the project card (e.g. 'ri-terminal-box-line').
Path to the project logo image under public/ (e.g. '/logos/workspace-ci.png').
Manifest of hooks every consumer project must wire; read by the hook generator and the required-hooks-present validator.
Project Structure
required_hooks.yaml Schema File
Manifest of hooks every consumer project must wire; read by the hook generator and the required-hooks-present validator.
Schema version of the required-hooks config. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
Ordered list of hook entries. Each entry defines a git hook (pre-commit, commit-msg, or pre-push) with its kind, entry point, and enforcement metadata.
Current: [HOVER TO SHOW VALUE]
Stable hook identifier; matches the '# === Hook: <id> ===' marker in generated .git/hooks/* files.
Hook implementation kind: shell | shell_inline | shell_with_arg | python_module | python_module_files | makefile_target.
Bash function name, python module path, make target name, or inline command string depending on kind.
Git hook stage: pre-commit | commit-msg | pre-push.
Whether staged filenames are passed as arguments to the hook entry.
Whether the hook runs unconditionally, even when no files are staged.
true: cannot be exempted via quality_exceptions.yaml. false: exemptable per-path because the check is heuristic.
Language hints the check applies to. [any] runs for every project; [python] | [node] | [rust] scopes by detected language.
Optional path pattern that scopes the hook (pass-through to the rendered hook).
File type filters for python_module_files hooks (e.g. [markdown]). Only matching staged files are passed.
Sensitive file detection configuration: extensions, keywords, and safe-list rules used to prevent accidental secret leakage.
Content Rules
sensitive_files.yaml Schema File
Sensitive file detection configuration: extensions, keywords, and safe-list rules used to prevent accidental secret leakage.
File extensions that may contain secrets. Files with these extensions trigger the sensitive-file blocker when their name also matches a sensitive keyword.
Current: [HOVER TO SHOW VALUE]
Filename keywords that suggest secrets (substring match, case-insensitive). A file is flagged when its name contains any of these keywords AND its extension is in sensitive_extensions.
Current: [HOVER TO SHOW VALUE]
Exact filenames that are always safe (standard project config files). These bypass the sensitive-file check entirely, regardless of keyword matches.
Current: [HOVER TO SHOW VALUE]
Filename prefixes that are always safe (e.g. 'tsconfig' matches tsconfig.json, tsconfig.app.json, etc.). These bypass the sensitive-file check.
Current: [HOVER TO SHOW VALUE]
Exemptions from the sensitive-files check; lists files that would otherwise be flagged as sensitive.
Content Rules
sensitive_files_exceptions.yaml Schema File
Exemptions from the sensitive-files check; lists files that would otherwise be flagged as sensitive.
Repo-relative paths exempted from sensitive-file detection (e.g. '.markdown_docs_exceptions.yaml').
Current: [HOVER TO SHOW VALUE]
Exemptions from the silent-swallow check; patterns allowed to suppress errors without reporting.
Content Rules
silent_swallow_exceptions.yaml Schema File
Exemptions from the silent-swallow check; patterns allowed to suppress errors without reporting.
List of sanctioned silent-swallow exceptions; empty by default.
Current: [HOVER TO SHOW VALUE]
Error-swallowing detection patterns: the single source of truth for all patterns checked by the silent-error-swallow detector.
Content Rules
silent_swallow_patterns.yaml Schema File
Error-swallowing detection patterns: the single source of truth for all patterns checked by the silent-error-swallow detector.
Schema version of the swallow-patterns config. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
Language-to-file-matching rules. Each key is a language identifier used by inline_patterns and multiline_detectors.
Current: [HOVER TO SHOW VALUE]
File extensions that identify this language (e.g. ['.py', '.sh']).
Exact filenames that identify this language (e.g. ['Makefile']).
Regex matched against the first line of extensionless files to detect this language.
Substring matches against the full path to identify this language (e.g. ['ansible']).
Pure regex patterns applied via re.search() per added line. No multi-line state or custom logic.
Current: [HOVER TO SHOW VALUE]
Stable pattern identifier emitted in violation output (e.g. 'sh-devnull-silent').
Python regex pattern compiled and applied via re.search() against each added line.
Language key from file_types that scopes this pattern (e.g. 'shell', 'python').
Human-readable explanation of what the pattern detects; rendered on the wiki pattern card.
Named Python functions with custom inline logic that cannot be expressed as a single regex (e.g. the cron multi-regex check).
Current: [HOVER TO SHOW VALUE]
Stable pattern identifier emitted in violation output.
Python function name that implements the check. Called with an AddedLine; returns a violation tuple or None.
Path to the Python source file containing the detector function; used by the wiki for source-code extraction.
Language key from file_types that scopes this detector.
Human-readable explanation of what the detector checks; rendered on the wiki pattern card.
Named Python functions with multi-line stateful detection logic. Each function scans across multiple added lines to find violations.
Current: [HOVER TO SHOW VALUE]
Stable pattern identifier emitted in violation output (e.g. 'py-except-pass').
Python function name that implements the multi-line check. Receives the full list of added lines; yields (AddedLine, pattern_id) tuples. Used for runtime dispatch in check_silent_swallow.py.
Specific helper function that classifies this particular pattern. Overrides detector for wiki source-code extraction when the detector is a top-level dispatcher (e.g. detect_python_multiline dispatches to _classify_except_body and _resolve_next_line). Falls back to detector when absent.
Path to the Python source file containing the detector function; used by the wiki for source-code extraction.
Language key from file_types that scopes this detector.
Human-readable explanation of what the multi-line detector finds; rendered on the wiki pattern card.
Catalog of AI governance standards, regulations, frameworks, and declarations; the single source of truth for the standards page.
Content Rules
standards.yaml Schema File
Catalog of AI governance standards, regulations, frameworks, and declarations; the single source of truth for the standards page.
Schema version of the standards catalog. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
The list of AI governance standards rendered on the standards page and indexed for search.
Current: [HOVER TO SHOW VALUE]
Stable identifier used in anchor links (/standards#<id>) and search indexing.
Short display title shown in card headers and search results.
Full official title of the standard, shown in the card detail body.
Issuing body or authority (e.g. 'NIST', 'European Parliament & Council').
Geographic or organizational scope (e.g. 'EU', 'US', 'International').
Publication or adoption date in ISO 8601 (YYYY-MM-DD) format.
Document type: regulation, standard, framework, declaration, code-of-conduct, executive-order, or treaty.
Legal status: binding, voluntary, or advisory.
One-paragraph summary of the standard's scope and key provisions.
Topic tags used for filtering and grouping (e.g. 'Risk Management', 'Governance').
Whether the full text is freely accessible (true) or requires purchase (false).
Path to a locally hosted PDF copy under public/ (only for free standards).
Official source URL for the full text (free standards) or landing page (paid standards).
Purchase URL for paid standards (only when free is false).
Approximate purchase price (only when free is false).
Total page count of the document, when known.
System dependency manifest checked and installed by 'make init' via scripts/install-system-deps; unified schema shared with WORKSPACE-VM and WORKSPACE-GATEWAY.
Dependencies
system-deps.yaml Schema File
System dependency manifest checked and installed by 'make init' via scripts/install-system-deps; unified schema shared with WORKSPACE-VM and WORKSPACE-GATEWAY.
The list of required system dependencies.
Current: [HOVER TO SHOW VALUE]
Binary name verified via find_binary (exactly one of check_cmd/check_type per entry).
Semantic check: c-compiler, network-tools, playwright-libs, libolm-headers, or apt-package.
Debian package installed via apt-get when the check fails (Linux).
Homebrew formula installed via brew when the check fails (macOS only).
Human-readable text shown in check output.
Optional misses warn but do not fail the check (default false).
Platforms the entry applies to (e.g. [linux], [darwin]); omitted means all platforms.
Hermetic install script path; flags the entry as bootstrap-owned so the system install phase skips it.
Traceability tag for deps flattened out of a consumer's bootstrap-components.yaml.
Display labels and icons for wiki UI components; the single source of truth for human-readable names of CI domain enums.
Project Structure
wiki_labels.yaml Schema File
Display labels and icons for wiki UI components; the single source of truth for human-readable names of CI domain enums.
Schema version of the wiki labels config. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
Maps hook stage IDs (pre-commit, commit-msg, pre-push) to display labels shown in hook card tags.
Current: [HOVER TO SHOW VALUE]
Maps hook kind IDs (shell, python_module, makefile_target, etc.) to display labels shown in hook card tags.
Current: [HOVER TO SHOW VALUE]
Maps standard type IDs to display metadata (label + icon) used in standard card rendering.
Current: [HOVER TO SHOW VALUE]
Human-readable label for the standard type (e.g. 'Regulation', 'Framework').
Remix Icon CSS class for the standard type (e.g. 'ri-government-line').
Maps swallow-detector language IDs (shell, python, js_ts, ansible, cron) to display labels shown in pattern card tags.
Current: [HOVER TO SHOW VALUE]
Maps CI config file names to display category labels used for grouping config cards on the config page.
Current: [HOVER TO SHOW VALUE]
Maps guard config file names to display category labels used for grouping guard config cards.
Current: [HOVER TO SHOW VALUE]
Supported languages for the pattern testing playground, rendered as selector options.
Current: [HOVER TO SHOW VALUE]
Language identifier used internally and by CodeMirror for syntax highlighting (e.g. 'python', 'shell').
Human-readable label shown in the language selector dropdown (e.g. 'Python', 'Shell').
