Hook Configs YAML configuration files and their field-level documentation. Each config may have an associated schema that documents required and optional fields.
Content Rules4 Dependencies2 Other9 Project Structure2 Quality Gates3
20 of 20 configs
Universal banned-pattern rules and exceptions; the single source of truth for content bans.
Content Rules
banned_words.yaml Schema File
Universal banned-pattern rules and exceptions; the single source of truth for content bans.
Schema version of the banned-words config. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
Path-scoped exemptions applied to every project. Each entry whitelists patterns under specific paths so legitimate uses are not flagged.
Current: [HOVER TO SHOW VALUE]
Glob/regex paths the exemption block applies to (e.g. 'tests/', '\.toml$').
Banned patterns that are exempted under the matching paths.
The universal banned-pattern list. Every entry is enforced across all projects unless covered by a universal or per-project exception.
Current: [HOVER TO SHOW VALUE]
Regex pattern to match in file contents. Compiled by the banned-words scanner.
Human-readable explanation of why the pattern is banned; surfaced to the developer on violation and rendered in the wiki pattern library.
Pattern category ID (e.g. 'linter-suppression', 'ai-slop'). Drives wiki categorization. See config/pattern_categories.yaml for the full list.
Per-directory pattern overrides. Each key is a directory name; the value is a list of {pattern, reason} entries scoped to that directory.
Current: [HOVER TO SHOW VALUE]
Banned-pattern entries scoped to the named directory (e.g. 'tests').
Regex pattern scoped to the directory.
Reason the directory-scoped pattern is banned.
Patterns matched against file basenames rather than file contents. Catches versioned, backup, and temporary filenames.
Current: [HOVER TO SHOW VALUE]
Regex matched against the file basename (e.g. '_v[0-9]+').
Reason the filename pattern is banned.
Regex patterns blocked in commit messages; checked case-insensitively during commit-msg and pre-push stages.
Content Rules
blocked_commit_patterns.yaml Schema File
Regex patterns blocked in commit messages; checked case-insensitively during commit-msg and pre-push stages.
List of blocked regex patterns and their reasons. Each entry is checked case-insensitively against the full commit message body.
Current: [HOVER TO SHOW VALUE]
Regex pattern matched against the commit message. Examples include co-author attribution lines and AI-generated attribution strings.
Human-readable explanation of why the pattern is blocked; surfaced to the developer on violation.
Test coverage thresholds per test suite type; enforced by the coverage devolution checker to prevent regression.
Quality Gates
coverage_thresholds.yaml Schema File
Test coverage thresholds per test suite type; enforced by the coverage devolution checker to prevent regression.
Configuration for the unit test suite. Unit tests have a high coverage floor (90%) because they are fast and deterministic.
Current: [HOVER TO SHOW VALUE]
Directory path where unit tests live.
Minimum coverage percentage required for the suite to pass. Devolution is flagged when coverage drops below this threshold.
Source directory measured for coverage (the code under test).
Command used to run the test suite (e.g. 'uv run python -m pytest').
Configuration for the integration test suite. Integration tests use real git repos and subprocess spawns; coverage is supplementary with a low floor.
Current: [HOVER TO SHOW VALUE]
Directory path where integration tests live.
Minimum coverage percentage for integration tests. Low floor (5%) because coverage measurement is disabled to avoid tracing slow I/O.
Source directory measured for coverage.
Command used to run the integration test suite.
Set to 'false' to disable coverage tracing for this suite (avoids overhead of tracing slow I/O under PRoot).
Dead code analysis configuration consumed by lib/checks_dead_code.sh (the ci_check_dead_code shell function). Wraps the dangle Rust binary, which scans git-tracked files for unreferenced functions, classes, variables, and modules across 13 languages (Python, Lua, Bash/Shell, JavaScript, TypeScript incl. TSX, Rust, Go, and more). The keys below narrow which candidates dangle reports are surfaced as warnings.
Quality Gates
dead_code.yaml Schema File
Dead code analysis configuration consumed by lib/checks_dead_code.sh (the ci_check_dead_code shell function). Wraps the `dangle` Rust binary, which scans git-tracked files for unreferenced functions, classes, variables, and modules across 13 languages (Python, Lua, Bash/Shell, JavaScript, TypeScript incl. TSX, Rust, Go, and more). The keys below narrow which candidates dangle reports are surfaced as warnings.
Paths (directories or files) under which dead-code candidates are reported. Items whose file is not under a scan_paths entry are dropped from the report (dangle itself still scans the whole git-tracked repo and uses those files as reference sources). Defaults to ['ci'] when the key is absent.
Current: [HOVER TO SHOW VALUE]
Paths excluded from REPORTING. Files under these paths are still scanned for references by dangle but never appear in the dead-code report. Use for generated/vendored trees where the unreferenced-symbol noise is known and intentional.
Current: [HOVER TO SHOW VALUE]
Files excluded from REPORTING but still scanned for references. Used for test files and conftest modules that are never 'dead' themselves but whose imports matter. dangle's own test-file heuristic (test_ prefix or /tests/ segment) already suppresses reporting for most test files; reference_only_paths covers any remaining stragglers.
Current: [HOVER TO SHOW VALUE]
Specific names never reported as dead, regardless of reference count. Useful for module-level constants referenced only from test files (which dangle intentionally skips) and for conventional entry-point names.
Current: [HOVER TO SHOW VALUE]
Extended regex (ERE) patterns for names to ignore. Matched against the function/class/variable name reported by dangle before the trailing 'is not referenced' phrase.
Current: [HOVER TO SHOW VALUE]
Dependencies excluded from version-mismatch checks; used by check_dependency_versions to skip packages that are intentionally unversioned or externally managed.
Dependencies
dependency_excludes.yaml Schema File
Dependencies excluded from version-mismatch checks; used by check_dependency_versions to skip packages that are intentionally unversioned or externally managed.
Package names excluded from dependency version checks. Entries here are not flagged when their version constraints are missing or inconsistent.
Current: [HOVER TO SHOW VALUE]
Dependencies intentionally declared in both the workspace root and a workspace member; not flagged as redundant by check_duplicate_dependencies.
Dependencies
duplicate_dependency_excludes.yaml Schema File
Dependencies intentionally declared in both the workspace root and a workspace member; not flagged as redundant by check_duplicate_dependencies.
Package names excluded from duplicate-dependency detection. Self-duplicates (same dep in multiple sections of a single pyproject.toml) are NOT affected: version-mismatch self-duplicates always block, same-version duplicates warn.
Current: [HOVER TO SHOW VALUE]
Other
exemption_files.yaml Schema File
Maximum line count per file by extension; enforced by the file-length checker to prevent oversized source files.
Quality Gates
file_length_limits.yaml Schema File
Maximum line count per file by extension; enforced by the file-length checker to prevent oversized source files.
Maximum number of lines allowed in a single file. Files exceeding this limit are flagged by the checker.
Current: [HOVER TO SHOW VALUE]
File extensions subject to the line-count limit. Only files matching these extensions are checked.
Current: [HOVER TO SHOW VALUE]
Markdown documentation checker config: remote link checks, ignore globs, and known-broken reference exceptions.
Project Structure
markdown_docs.yaml Schema File
Markdown documentation checker config: remote link checks, ignore globs, and known-broken reference exceptions.
Whether to check remote HTTP(S) links. Slow and network-dependent; can be overridden via CLI --check-remote.
Current: [HOVER TO SHOW VALUE]
Timeout in seconds for each remote HTTP(S) link check.
Current: [HOVER TO SHOW VALUE]
Glob patterns for markdown files to skip entirely (e.g. node_modules, .venv, CHANGELOG.md).
Current: [HOVER TO SHOW VALUE]
Known-broken reference entries that should not fail CI. Each entry can specify a file (endswith match), a line (exact), and a reason for context.
Current: [HOVER TO SHOW VALUE]
Other
pattern_categories.yaml Schema File
Registry of workspace projects displayed on the wiki home page and project pages; the single source of truth for project display metadata.
Other
projects.yaml Schema File
Registry of workspace projects displayed on the wiki home page and project pages; the single source of truth for project display metadata.
Schema version of the projects registry. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
The list of workspace projects rendered on the wiki home page and individual project pages.
Current: [HOVER TO SHOW VALUE]
URL slug for the project page (e.g. 'workspace-ci' renders at /workspace-ci).
Display name shown in project card titles and page headers.
Primary programming language label shown in project card tags.
Repository directory name under the workspace root; used to locate README.md, Makefile, and .git/ at runtime.
Remix Icon CSS class for the project card (e.g. 'ri-terminal-box-line').
Path to the project logo image under public/ (e.g. '/logos/workspace-ci.png').
Manifest of hooks every consumer project must wire; read by the hook generator and the required-hooks-present validator.
Project Structure
required_hooks.yaml Schema File
Manifest of hooks every consumer project must wire; read by the hook generator and the required-hooks-present validator.
Schema version of the required-hooks config. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
Ordered list of hook entries. Each entry defines a git hook (pre-commit, commit-msg, or pre-push) with its kind, entry point, and enforcement metadata.
Current: [HOVER TO SHOW VALUE]
Stable hook identifier; matches the '# === Hook: <id> ===' marker in generated .git/hooks/* files.
Hook implementation kind: shell | shell_inline | shell_with_arg | python_module | python_module_files | makefile_target.
Bash function name, python module path, make target name, or inline command string depending on kind.
Git hook stage: pre-commit | commit-msg | pre-push.
Whether staged filenames are passed as arguments to the hook entry.
Whether the hook runs unconditionally, even when no files are staged.
true: cannot be exempted via quality_exceptions.yaml. false: exemptable per-path because the check is heuristic.
true: included even at POC tier (basic-safety subset). false: strict-tier only.
Language hints the check applies to. [any] runs for every project; [python] | [node] | [rust] scopes by detected language.
Optional path pattern that scopes the hook (pass-through to the rendered hook).
File type filters for python_module_files hooks (e.g. [markdown]). Only matching staged files are passed.
Sensitive file detection configuration: extensions, keywords, and safe-list rules used to prevent accidental secret leakage.
Content Rules
sensitive_files.yaml Schema File
Sensitive file detection configuration: extensions, keywords, and safe-list rules used to prevent accidental secret leakage.
File extensions that may contain secrets. Files with these extensions trigger the sensitive-file blocker when their name also matches a sensitive keyword.
Current: [HOVER TO SHOW VALUE]
Filename keywords that suggest secrets (substring match, case-insensitive). A file is flagged when its name contains any of these keywords AND its extension is in sensitive_extensions.
Current: [HOVER TO SHOW VALUE]
Exact filenames that are always safe (standard project config files). These bypass the sensitive-file check entirely, regardless of keyword matches.
Current: [HOVER TO SHOW VALUE]
Filename prefixes that are always safe (e.g. 'tsconfig' matches tsconfig.json, tsconfig.app.json, etc.). These bypass the sensitive-file check.
Current: [HOVER TO SHOW VALUE]
Other
sensitive_files_exceptions.yaml Schema File
Other
silent_swallow_exceptions.yaml Schema File
Error-swallowing detection patterns: the single source of truth for all patterns checked by the silent-error-swallow detector.
Content Rules
silent_swallow_patterns.yaml Schema File
Error-swallowing detection patterns: the single source of truth for all patterns checked by the silent-error-swallow detector.
Schema version of the swallow-patterns config. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
Language-to-file-matching rules. Each key is a language identifier used by inline_patterns and multiline_detectors.
Current: [HOVER TO SHOW VALUE]
File extensions that identify this language (e.g. ['.py', '.sh']).
Exact filenames that identify this language (e.g. ['Makefile']).
Regex matched against the first line of extensionless files to detect this language.
Substring matches against the full path to identify this language (e.g. ['ansible']).
Pure regex patterns applied via re.search() per added line. No multi-line state or custom logic.
Current: [HOVER TO SHOW VALUE]
Stable pattern identifier emitted in violation output (e.g. 'sh-devnull-silent').
Python regex pattern compiled and applied via re.search() against each added line.
Language key from file_types that scopes this pattern (e.g. 'shell', 'python').
Human-readable explanation of what the pattern detects; rendered on the wiki pattern card.
Named Python functions with custom inline logic that cannot be expressed as a single regex (e.g. the cron multi-regex check).
Current: [HOVER TO SHOW VALUE]
Stable pattern identifier emitted in violation output.
Python function name that implements the check. Called with an AddedLine; returns a violation tuple or None.
Path to the Python source file containing the detector function; used by the wiki for source-code extraction.
Language key from file_types that scopes this detector.
Human-readable explanation of what the detector checks; rendered on the wiki pattern card.
Named Python functions with multi-line stateful detection logic. Each function scans across multiple added lines to find violations.
Current: [HOVER TO SHOW VALUE]
Stable pattern identifier emitted in violation output (e.g. 'py-except-pass').
Python function name that implements the multi-line check. Receives the full list of added lines; yields (AddedLine, pattern_id) tuples. Used for runtime dispatch in check_silent_swallow.py.
Specific helper function that classifies this particular pattern. Overrides detector for wiki source-code extraction when the detector is a top-level dispatcher (e.g. detect_python_multiline dispatches to _classify_except_body and _resolve_next_line). Falls back to detector when absent.
Path to the Python source file containing the detector function; used by the wiki for source-code extraction.
Language key from file_types that scopes this detector.
Human-readable explanation of what the multi-line detector finds; rendered on the wiki pattern card.
Catalog of AI governance standards, regulations, frameworks, and declarations; the single source of truth for the standards page.
Other
standards.yaml Schema File
Catalog of AI governance standards, regulations, frameworks, and declarations; the single source of truth for the standards page.
Schema version of the standards catalog. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
The list of AI governance standards rendered on the standards page and indexed for search.
Current: [HOVER TO SHOW VALUE]
Stable identifier used in anchor links (/standards#<id>) and search indexing.
Short display title shown in card headers and search results.
Full official title of the standard, shown in the card detail body.
Issuing body or authority (e.g. 'NIST', 'European Parliament & Council').
Geographic or organizational scope (e.g. 'EU', 'US', 'International').
Publication or adoption date in ISO 8601 (YYYY-MM-DD) format.
Document type: regulation, standard, framework, declaration, code-of-conduct, executive-order, or treaty.
Legal status: binding, voluntary, or advisory.
One-paragraph summary of the standard's scope and key provisions.
Topic tags used for filtering and grouping (e.g. 'Risk Management', 'Governance').
Whether the full text is freely accessible (true) or requires purchase (false).
Path to a locally hosted PDF copy under public/ (only for free standards).
Official source URL for the full text (free standards) or landing page (paid standards).
Purchase URL for paid standards (only when free is false).
Approximate purchase price (only when free is false).
Total page count of the document, when known.
Other
system-deps.yaml Schema File
Display labels and icons for wiki UI components; the single source of truth for human-readable names of CI domain enums.
Other
wiki_labels.yaml Schema File
Display labels and icons for wiki UI components; the single source of truth for human-readable names of CI domain enums.
Schema version of the wiki labels config. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
Maps hook stage IDs (pre-commit, commit-msg, pre-push) to display labels shown in hook card tags.
Current: [HOVER TO SHOW VALUE]
Maps hook kind IDs (shell, python_module, makefile_target, etc.) to display labels shown in hook card tags.
Current: [HOVER TO SHOW VALUE]
Maps standard type IDs to display metadata (label + icon) used in standard card rendering.
Current: [HOVER TO SHOW VALUE]
Human-readable label for the standard type (e.g. 'Regulation', 'Framework').
Remix Icon CSS class for the standard type (e.g. 'ri-government-line').
Maps swallow-detector language IDs (shell, python, js_ts, ansible, cron) to display labels shown in pattern card tags.
Current: [HOVER TO SHOW VALUE]
Maps CI config file names to display category labels used for grouping config cards on the config page.
Current: [HOVER TO SHOW VALUE]
Maps guard config file names to display category labels used for grouping guard config cards.
Current: [HOVER TO SHOW VALUE]
Supported languages for the pattern testing playground, rendered as selector options.
Current: [HOVER TO SHOW VALUE]
Language identifier used internally and by CodeMirror for syntax highlighting (e.g. 'python', 'shell').
Human-readable label shown in the language selector dropdown (e.g. 'Python', 'Shell').
Static wiki page entries for the search index; the single source of truth for page-level search metadata.
Other
wiki_pages.yaml Schema File
Static wiki page entries for the search index; the single source of truth for page-level search metadata.
Schema version of the wiki pages config. Bumped when the YAML shape changes.
Current: [HOVER TO SHOW VALUE]
Static wiki page entries indexed for search. Each entry describes one wiki page route.
Current: [HOVER TO SHOW VALUE]
Unique identifier for the search entry (e.g. 'page-home').
Display title shown in search results.
Section grouping label (e.g. 'Pages').
Searchable content text for the page.
URL path for the wiki page (e.g. '/patterns').
Additional search keywords for fuzzy matching.
