Code quality gate registry#
Every linux/scripts/preflight.sh slug with its script, allow files, test suites, mutations and hook tier, derived from the tree; the gate-registry preflight check fails when this table is stale.
Proof rules, in short. Tests: the suite names the needle – a basename, or for an inline gate the function on its run_check line. Mutations: every id is <prefix>.<kebab>, and the prefix decides. A prefix naming a preflight slug credits that gate, and its target must be that gate’s script or an imported module beside it. A prefix naming no slug must not target a registered gate’s file at all – it is a descriptive family over ordinary build scripts, and the family has to be declared in gate-proofs.allow. Anything else fails until it is renamed, declared or frozen. Hook tier: the widest scope any versioned hook gives the gate. hook+CI sits in _FAST_SLUGS and runs whole-tree on every commit, hook (whole tree)+CI is named at a hook’s top level and runs unconditionally, hook (whole tree, when relevant)+CI is run whole-tree by a block that fires only when the commit touches its inputs, hook (scoped)+CI is run by a hook block over the staged files alone, CI is none of those. Rationale: docs/code-quality-tooling.md#gate-proof-registry-gate-registry
slug |
preflight name |
script |
allow files |
tests |
mutations |
hook tier |
proof |
|---|---|---|---|---|---|---|---|
crlf-guard |
working-tree CRLF guard |
linux/scripts/preflight.sh |
— |
linux/scripts/tests/test-crlf-guard.sh |
crlf-guard.pattern-neutered, crlf-guard.mixed-blind, crlf-guard.lone-cr-blind, crlf-guard.index-column, crlf-guard.scope-sh-suffix-only, crlf-guard.scope-not-classified, crlf-guard.pipefail-pin |
hook+CI |
test+mutation |
shellcheck |
shellcheck gate |
linux/scripts/lint-shell.sh |
— |
linux/scripts/tests/test-crlf-guard.sh, linux/scripts/tests/test-dockerfile-env-order.sh, linux/scripts/tests/test-lint-gates.sh, linux/scripts/tests/test-lint-shell-scope.sh, linux/scripts/tests/test-lint-tools.sh, linux/scripts/tests/test-masked-assignments.sh, linux/scripts/tests/test-precommit-hook.sh, linux/scripts/tests/test-shellcheck-warnings.sh, linux/scripts/tests/test-workflow-lint.sh |
shellcheck.extensionless-arm, shellcheck.pin-only-path-bin, shellcheck.list-files-first, shellcheck.crlf-shebang, shellcheck.default-sweep-includes-hooks, shellcheck.root-argument-is-the-tree, shellcheck.non-git-root-refused, shellcheck.missing-root-refused, shellcheck.consumer-scope-is-tracked-files, shellcheck.empty-root-scope-is-an-error |
hook (scoped)+CI |
test+mutation |
stdout-returns |
stdout-as-return-value |
linux/scripts/verify_stdout_returns.py |
— |
linux/scripts/tests/test-stdout-returns.sh |
stdout-returns.unconsumed-not-a-finding, stdout-returns.redirect-is-the-fix, stdout-returns.command-position, stdout-returns.verdict-not-discarded, stdout-returns.root-argument-is-the-tree |
hook+CI |
test+mutation |
copy-coverage |
script COPY coverage |
linux/scripts/verify_script_copy_coverage.py |
— |
linux/scripts/tests/test-script-copy-coverage.sh |
copy-coverage.missing-fails, copy-coverage.transitive-refs, copy-coverage.dir-copy-expands, copy-coverage.bind-mount-provides, copy-coverage.continuations-joined, copy-coverage.known-base-is-per-dockerfile, copy-coverage.no-dockerfiles-fails, copy-coverage.report-is-read-only |
hook+CI |
test+mutation |
context-paths |
Dockerfile context paths |
linux/scripts/verify_dockerfile_context_paths.py |
— |
linux/scripts/tests/test-dockerfile-context-paths.sh |
context-paths.missing-fails, context-paths.copy-sources-checked, context-paths.mount-sources-checked, context-paths.escape-directive-honoured, context-paths.stage-copy-not-judged, context-paths.stage-mount-not-judged, context-paths.vars-are-wildcards, context-paths.context-is-per-dockerfile, context-paths.generated-is-per-dockerfile, context-paths.untracked-not-graded, context-paths.no-dockerfiles-fails, context-paths.external-floor-is-independent-of-git |
CI |
test+mutation |
critical-fixes |
critical fixes |
linux/scripts/verify-critical-fixes.sh |
— |
linux/scripts/tests/test-critical-fixes.sh |
critical-fixes.smoke-vulkan-any-path, critical-fixes.bare-sccache-scan, critical-fixes.transient-classifier-runs, critical-fixes.numpy-reseed-ban, critical-fixes.base-mount-scope, critical-fixes.ort-is-called, critical-fixes.ort-opencv-download-switch, critical-fixes.ort-binary-url, critical-fixes.ort-nuget-id, critical-fixes.ort-inbox-untouched, critical-fixes.ort-nuget-refusal-order, critical-fixes.ort-pypi-install, critical-fixes.ort-apt, critical-fixes.ort-so-map-package, critical-fixes.ort-so-map-deny-row, critical-fixes.ort-ffmpeg-vendor-pc, critical-fixes.ort-rearm-download, critical-fixes.ort-env-owners, critical-fixes.ort-opencv-have-preset, critical-fixes.ort-opencv-silent-off, critical-fixes.ort-genai-ort-home, critical-fixes.ort-genai-winml, critical-fixes.ort-genai-linux-ort-home, critical-fixes.ort-crate-env-windows, critical-fixes.ort-crate-env-windows-location, critical-fixes.ort-crate-env-linux-dylib, critical-fixes.ort-crate-env-custody, critical-fixes.ort-crate-env-smokes, critical-fixes.ort-crate-env-linux-row, critical-fixes.ort-gate-calls-present, critical-fixes.ort-gate-calls-once, critical-fixes.ort-gate-calls-definition, critical-fixes.ort-g2-per-file-mount-windows, critical-fixes.ort-g2-per-file-mount-linux, critical-fixes.ort-g2-closure, critical-fixes.ort-g2-run-mount-windows, critical-fixes.ort-g2-run-mount-linux, critical-fixes.ort-g1-windows, critical-fixes.ort-g1-linux, critical-fixes.ort-g5-heading, critical-fixes.ort-census-root-windows, critical-fixes.ort-census-root-linux, critical-fixes.ort-cargo-default-features, critical-fixes.ort-cargo-download-binaries, critical-fixes.ort-apt-context-free, critical-fixes.ort-apt-backslash-terminator, critical-fixes.ort-rearm-skip-value, critical-fixes.ort-env-not-a-comparison, critical-fixes.ort-env-form-brace, critical-fixes.ort-env-form-environ-index, critical-fixes.ort-env-form-setenv, critical-fixes.ort-env-form-set-item, critical-fixes.ort-env-set-item-not-a-read, critical-fixes.ort-env-form-setx, critical-fixes.ort-env-form-yaml, critical-fixes.ort-env-yaml-key-position, critical-fixes.ort-env-form-legacy-dockerfile, critical-fixes.ort-cargo-table-form, critical-fixes.ort-cargo-table-df, critical-fixes.ort-cargo-renamed-table, critical-fixes.ort-cargo-renamed-inline, critical-fixes.ort-cargo-dotted, critical-fixes.ort-cargo-deps-only, critical-fixes.ort-cargo-header-comment, critical-fixes.ort-judge-verdict-count, critical-fixes.ort-judge-deny-verdict, critical-fixes.ort-judge-path-scope, critical-fixes.ort-judge-exactly, critical-fixes.ort-judge-count-reaches-bash, critical-fixes.ort-env-prefilter-names, critical-fixes.summary-reaches-exit |
CI |
test+mutation |
patch-integrity |
patch integrity |
linux/scripts/verify-patch-integrity.sh |
— |
linux/scripts/tests/test-patch-integrity.sh |
patch-integrity.malformed-diff-fails, patch-integrity.orphan-fails, patch-integrity.corpus-is-shell-scripts, patch-integrity.helper-routing-reported, patch-integrity.raw-apply-site-is-advisory, patch-integrity.failure-count-is-the-exit |
hook+CI |
test+mutation |
code-dupes |
code duplication |
docs/scripts/verify_code_dupes.py |
docs/scripts/code-dupes.allow |
linux/scripts/tests/test-code-dupes.sh |
code-dupes.shrunk-budget, code-dupes.stale-row, code-dupes.stale-wording, code-dupes.stale-count, code-dupes.bookkeeping-exit, code-dupes.bookkeeping-before-findings, code-dupes.duplicate-row, code-dupes.kind-scopes-allow, code-dupes.baseline-keeps-reason, code-dupes.baseline-refuses-kind, code-dupes.allow-keys-declared, code-dupes.allow-rows-not-folded, code-dupes.ps-kind-recognised, code-dupes.ps-before-dockerfile, code-dupes.ps-windows-in-scope, code-dupes.ps-block-comment-blanked, code-dupes.ps-brace-may-open-next-line, code-dupes.ps-scope-var-folded, code-dupes.root-argument-is-the-tree |
hook+CI |
test+mutation |
artifact-parity |
artifact copy parity |
linux/scripts/verify-artifact-copy-parity.sh |
— |
linux/scripts/tests/test-artifact-copy-completeness.sh, linux/scripts/tests/test-runtime-image-gates.sh |
artifact-parity.completeness-check |
hook+CI |
test+mutation |
arg-consistency |
ARG consistency |
linux/scripts/01-core/verify-arg-consistency.sh |
— |
linux/scripts/tests/test-arg-consistency.sh |
arg-consistency.arg-default-drift-fatal, arg-consistency.defaultless-arg-fatal, arg-consistency.derived-arg-skipped, arg-consistency.gcc-case-mapping-pinned, arg-consistency.llvm-mapping-pinned, arg-consistency.gcc-literal-drift-fatal, arg-consistency.scan-vacuity-floor, arg-consistency.handforward-fatal, arg-consistency.handforward-excludes-tests, arg-consistency.forwarding-check-advisory, arg-consistency.script-drift-advisory |
hook+CI |
test+mutation |
version-snapshot |
version snapshot |
docs/scripts/sync_versions.py |
— |
linux/scripts/tests/test-version-snapshot.sh |
version-snapshot.snapshot-ored, version-snapshot.marker-tokens-ored, version-snapshot.inline-markers-ored, version-snapshot.deps-table-ored, version-snapshot.dockerfile-args-ored, version-snapshot.doc-literals-ored, version-snapshot.licence-subprocess-ored, version-snapshot.sync-unquotes-once, version-snapshot.sync-writes-only-on-change, version-snapshot.consumer-pins-tag-prefix, version-snapshot.consumer-pins-torch-row |
CI |
test+mutation |
mirror-consistency |
ubuntu mirror consistency |
linux/scripts/01-core/verify-ubuntu-mirror-consistency.sh |
— |
linux/scripts/tests/test-mirror-consistency.sh |
mirror-consistency.missing-arg-fails, mirror-consistency.base-needs-the-run, mirror-consistency.restore-is-wired, mirror-consistency.restore-runs-after-install, mirror-consistency.outcome-is-asserted, mirror-consistency.downgrade-precondition, mirror-consistency.errors-reach-exit, mirror-consistency.pocket-skew-is-caught, mirror-consistency.no-writer-is-not-a-pass, mirror-consistency.helper-symmetry-is-asserted |
CI |
test+mutation |
runtime-paths |
runtime path consistency |
linux/scripts/04-runtime/verify-runtime-paths.sh |
— |
linux/scripts/tests/test-runtime-paths.sh |
runtime-paths.missing-infra-fails, runtime-paths.infra-loop-reports-all, runtime-paths.warn-is-advisory, runtime-paths.warn-scope-is-narrow, runtime-paths.canonical-paths-expanded, runtime-paths.needs-no-envsubst |
CI |
test+mutation |
env-knobs |
env-knob registry |
linux/scripts/lint-env-knobs.sh |
linux/scripts/lint-env-knobs.allow |
linux/scripts/tests/test-env-knobs.sh |
env-knobs.stale-detected, env-knobs.stale-fails, env-knobs.stale-regardless-of-gate, env-knobs.ok-line-withheld, env-knobs.comment-line-not-consumer, env-knobs.trailing-comment-not-consumer, env-knobs.owner-trailing-comment, env-knobs.private-prefix-not-a-knob, env-knobs.escaped-literal-not-reader, env-knobs.owner-quoted-text, env-knobs.owner-command-position, env-knobs.owner-comment-text, env-knobs.owner-heredoc-body, env-knobs.owner-substitution-in-quotes, env-knobs.owner-keyword-prefix, env-knobs.owner-env-prefix-chain, env-knobs.owner-case-arm, env-knobs.owner-expansion-guard, env-knobs.heredoc-quoted-delimiter, env-knobs.heredoc-tab-terminator, env-knobs.heredoc-queue, env-knobs.heredoc-not-herestring, env-knobs.owner-chain-walks-back, env-knobs.owner-single-quoted-text, env-knobs.heredoc-delimiter-shape, env-knobs.heredoc-per-file-reset, env-knobs.quoted-hash-strip, env-knobs.arch-flags-are-owners, env-knobs.runtime-paths-owns-nothing, env-knobs.tool-pins-are-owners |
hook+CI |
test+mutation |
dockerfile-lint |
dockerfile lint (hadolint) |
linux/scripts/lint-dockerfiles.sh |
— |
linux/scripts/tests/test-dockerfile-env-order.sh, linux/scripts/tests/test-image-env.sh |
dockerfile-lint.env-order-same-instruction, dockerfile-lint.env-order-arg-excuse, dockerfile-lint.env-order-self-reference, dockerfile-lint.env-order-arg-scope-leak, dockerfile-lint.env-order-interior-comment, dockerfile-lint.env-order-empty-target-list, dockerfile-lint.env-order-missing-target, dockerfile-lint.env-order-not-wired, dockerfile-lint.root-argument-is-the-tree, dockerfile-lint.empty-root-scope-is-an-error, dockerfile-lint.consumer-config-wins, dockerfile-lint.image-env-name-rule, dockerfile-lint.image-env-address-rule, dockerfile-lint.image-env-url-authority, dockerfile-lint.image-env-version-exemption, dockerfile-lint.image-env-path-fragment, dockerfile-lint.image-env-env-expansion, dockerfile-lint.image-env-compile-run-arg, dockerfile-lint.image-env-arg-scope-resets, dockerfile-lint.image-env-escape-directive, dockerfile-lint.image-env-env-file-floor, dockerfile-lint.image-env-lint-wired |
CI |
test+mutation |
workflow-lint |
workflow lint (actionlint) |
linux/scripts/lint-workflows.sh |
linux/scripts/workflow-conventions.allow |
linux/scripts/tests/test-dockerfile-env-order.sh, linux/scripts/tests/test-workflow-lint.sh |
workflow-lint.findings-fail, workflow-lint.shellcheck-half-resolved, workflow-lint.shellcheck-rule-selftest, workflow-lint.root-argument-is-the-tree, workflow-lint.cd-into-lint-root, workflow-lint.version-pin-required, workflow-lint.sha-pin-required, workflow-lint.action-default-drifted, workflow-lint.action-default-required, workflow-lint.every-image-input-graded, workflow-lint.non-canonical-literal-fails, workflow-lint.call-site-platform-checked, workflow-lint.call-site-input-platform, workflow-lint.no-yaml-is-a-refusal |
CI |
test+mutation |
python-lint |
python lint (ruff) |
linux/scripts/lint-python.sh |
— |
linux/scripts/tests/test-dockerfile-env-order.sh, linux/scripts/tests/test-embedded-python-extract.sh, linux/scripts/tests/test-python-lint-gate.sh |
python-lint.gate-tier-neutered, python-lint.tier-boundary, python-lint.embedded-extraction-off, python-lint.embedded-file-discovery, python-lint.heredoc-python-decision, python-lint.hook-half-of-discovery, python-lint.root-argument-is-the-tree, python-lint.consumer-heredoc-extraction, python-lint.empty-root-scope-is-an-error, python-lint.heredoc-finding-names-its-source, python-lint.versions-env-is-data |
CI |
test+mutation |
secret-scan |
secret scan (gitleaks) |
linux/scripts/lint-secrets.sh |
— |
linux/scripts/tests/test-secret-scan.sh |
secret-scan.leak-fails, secret-scan.scope-is-the-argument, secret-scan.values-are-redacted, secret-scan.findings-are-printed, secret-scan.config-is-relative-in-tree, secret-scan.relative-root-is-the-callers, secret-scan.consumer-config-wins, secret-scan.hub-config-is-the-fallback |
CI |
test+mutation |
android-parity |
android stage parity |
linux/scripts/01-core/verify-android-stage-parity.sh |
— |
linux/scripts/tests/test-android-stage-parity.sh |
android-parity.divergence-fails, android-parity.missing-stage-fails, android-parity.block-ends-at-next-from, android-parity.lib-value-normalized, android-parity.comments-normalized, android-parity.stage-list-complete |
CI |
test+mutation |
script-tests |
linux script unit tests |
linux/scripts/tests/run-tests.sh |
— |
linux/scripts/tests/test-gate-registry.sh, linux/scripts/tests/test-host-skips.sh, linux/scripts/tests/test-smoke-arch-parity.sh |
script-tests.skip-only-on-git-bash |
CI |
by construction |
stage-graph |
cross stage graph validation |
linux/scripts/01-core/stage-defs.sh |
— |
linux/scripts/tests/test-stage-defs.sh |
stage-graph.loop-var-leak, stage-graph.validate-graph-verdict, stage-graph.cycle-is-a-verdict, stage-graph.deepstream-needs-nvidia-chain, stage-graph.deepstream-media-arg, stage-graph.deepstream-default-on, stage-graph.deepstream-default-amd64-only |
hook+CI |
test+mutation |
pkg-names |
distro package names |
linux/scripts/verify_package_names.py |
— |
linux/scripts/tests/test-package-names.sh |
pkg-names.unguarded-is-a-verdict, pkg-names.guard-precedence, pkg-names.array-must-be-handed-over, pkg-names.array-body-spans-lines, pkg-names.append-helper-destination, pkg-names.cpython-dev-table, pkg-names.quoted-name-is-not-a-call |
CI |
test+mutation |
advert-keys |
advertised version keys |
linux/scripts/verify_advertised_keys.py |
— |
linux/scripts/tests/test-advertised-keys.sh |
advert-keys.unprobed-row, advert-keys.healed-baseline |
hook+CI |
test+mutation |
masked-decls |
masked declarations |
linux/scripts/verify_masked_assignments.py |
linux/scripts/masked-assignments.allow |
linux/scripts/tests/test-masked-assignments.sh, linux/scripts/tests/test-prevention-gates.sh |
masked-decls.verdict-discarded, masked-decls.substitution-required, masked-decls.root-argument-is-the-tree |
hook+CI |
test+mutation |
trailing-conditional |
trailing-conditional returns |
linux/scripts/verify_trailing_conditional.py |
linux/scripts/trailing-conditional.allow |
linux/scripts/tests/test-trailing-conditional.sh |
trailing-conditional.explicit-or-tail, trailing-conditional.double-bracket-is-not-a-pipeline, trailing-conditional.last-semicolon-statement, trailing-conditional.continuation-joined-first, trailing-conditional.one-line-body, trailing-conditional.block-closer-verdict, trailing-conditional.closer-not-in-a-pipeline, trailing-conditional.separator-only-line-skipped, trailing-conditional.or-last-arm-judged, trailing-conditional.delegate-hop, trailing-conditional.group-is-unwrapped, trailing-conditional.brace-not-a-continuation, trailing-conditional.root-argument-is-the-tree |
hook+CI |
test+mutation |
comment-size |
comment block size |
linux/scripts/verify_comment_size.py |
linux/scripts/comment-size.allow |
linux/scripts/tests/test-prevention-gates.sh |
comment-size.verdict-discarded, comment-size.limit-not-enforced, comment-size.every-language-is-a-subject, comment-size.heredoc-is-data |
hook+CI |
test+mutation |
code-size |
code size (functions + files) |
linux/scripts/verify_code_size.py |
linux/scripts/file-size.allow, linux/scripts/function-size.allow |
linux/scripts/tests/test-code-complexity.sh, linux/scripts/tests/test-code-size.sh, linux/scripts/tests/test-dead-functions.sh, linux/scripts/tests/test-gate-registry.sh, linux/scripts/tests/test-trailing-conditional.sh |
code-size.new-offender, code-size.growth, code-size.unrecorded-shrink, code-size.stale-freeze, code-size.file-verdict-discarded, code-size.longest-not-last, code-size.python-ast, code-size.dockerfile-pass, code-size.llm-stack-is-a-subject, code-size.extent-code-lines, code-size.extent-comment-brace, code-size.extent-single-quote, code-size.extent-double-quote, code-size.extent-heredoc-body, code-size.extent-def-in-heredoc, code-size.fn-allow-keys-declared, code-size.file-allow-keys-declared, code-size.root-argument-is-the-tree |
hook+CI |
test+mutation |
code-complexity |
cyclomatic complexity + nesting |
linux/scripts/verify_code_complexity.py |
linux/scripts/code-complexity.allow |
linux/scripts/tests/test-code-complexity.sh |
code-complexity.new-offender, code-complexity.growth, code-complexity.unrecorded-shrink, code-complexity.stale-freeze, code-complexity.heredoc-skip, code-complexity.here-string, code-complexity.quotes-blanked, code-complexity.quote-state-per-line, code-complexity.subst-in-quotes, code-complexity.comments-dropped, code-complexity.case-arms, code-complexity.subst-not-arm, code-complexity.nesting-open, code-complexity.python-ast, code-complexity.elif-depth, code-complexity.metric-split, code-complexity.verdict-kept, code-complexity.command-position, code-complexity.command-position-reset, code-complexity.newline-token, code-complexity.escaped-dq, code-complexity.escaped-code, code-complexity.arith-dollar, code-complexity.arith-command, code-complexity.brace-delimited, code-complexity.allow-row-metric, code-complexity.cmd-op-newline, code-complexity.cmd-op-semicolon, code-complexity.cmd-op-arm-end, code-complexity.cmd-op-arm-fallthrough, code-complexity.cmd-op-arm-retry, code-complexity.cmd-op-andand, code-complexity.cmd-op-oror, code-complexity.cmd-op-pipe, code-complexity.cmd-op-background, code-complexity.cmd-op-subshell, code-complexity.cmd-op-substitution, code-complexity.cmd-op-brace-group, code-complexity.arith-after-space, code-complexity.arith-after-tab, code-complexity.arith-after-semicolon, code-complexity.arith-after-paren, code-complexity.arith-after-pipe, code-complexity.arith-after-amp, code-complexity.arith-line-start, code-complexity.delim-semicolon, code-complexity.allow-keys-declared, code-complexity.root-argument-is-the-tree |
hook+CI |
test+mutation |
dead-functions |
dead shell functions |
linux/scripts/verify_dead_functions.py |
linux/scripts/dead-functions.allow |
linux/scripts/tests/test-dead-functions.sh, linux/scripts/tests/test-doc-numbers.sh |
dead-functions.new-dead, dead-functions.comment-is-not-a-use, dead-functions.definition-is-not-a-use, dead-functions.comment-multiline, dead-functions.tab-indented-comment, dead-functions.head-multiline, dead-functions.allow-file-is-not-a-use, dead-functions.patch-and-diff-skipped, dead-functions.patches-dir-skipped, dead-functions.pytest-cache-skipped, dead-functions.dart-tool-skipped, dead-functions.mutations-manifest-skipped, dead-functions.dist-is-not-corpus, dead-functions.dist-skip-is-narrow, dead-functions.dockerfile-in-corpus, dead-functions.census-lists-the-masked, dead-functions.census-skips-sourcing-files, dead-functions.census-skips-named-files, dead-functions.host-config-is-a-subject, dead-functions.stale-freeze, dead-functions.one-liner-is-a-definition, dead-functions.function-keyword, dead-functions.census-masked-tier, dead-functions.census-masked-keyed-on-file, dead-functions.self-mention-not-a-use, dead-functions.unlinked-arm-wired, dead-functions.unlinked-own-file-mention, dead-functions.unlinked-outside-caller, dead-functions.unlinked-shared-basename, dead-functions.unlinked-reads-self, dead-functions.unlinked-tag, dead-functions.stale-row-names-its-disarmer, dead-functions.disarmer-needs-both-basenames, dead-functions.root-argument-is-the-tree |
hook+CI |
test+mutation |
shellcheck-warnings |
shellcheck warning ratchet |
linux/scripts/verify_shellcheck_warnings.py |
linux/scripts/shellcheck-warnings.allow |
linux/scripts/tests/test-lint-shell-scope.sh, linux/scripts/tests/test-precommit-hook.sh, linux/scripts/tests/test-shellcheck-warnings.sh |
shellcheck-warnings.verdict-exit, shellcheck-warnings.level-filter, shellcheck-warnings.x-follow-sources, shellcheck-warnings.files-count-filter, shellcheck-warnings.files-restriction, shellcheck-warnings.files-frozen-scope, shellcheck-warnings.scope-skip-note, shellcheck-warnings.abs-path-rel, shellcheck-warnings.keep-reason, shellcheck-warnings.partial-rewrite, shellcheck-warnings.list-files-exit2, shellcheck-warnings.json-exit2, shellcheck-warnings.tool-missing-exit, shellcheck-warnings.env-bin-override, shellcheck-warnings.allow-row-shape, shellcheck-warnings.allow-keys-from-left, shellcheck-warnings.allow-inline-hash-kept, shellcheck-warnings.bash-from-path, shellcheck-warnings.allow-reader-yields-rows, shellcheck-warnings.root-argument-is-the-tree |
hook (scoped)+CI |
test+mutation |
mutations |
mutation gate (can the tests fail?) |
docs/scripts/verify_mutations.py |
— |
linux/scripts/tests/test-mutation-gate.sh, linux/scripts/tests/test-precommit-hook.sh, linux/scripts/tests/test-prepush-hook.sh |
mutations.survivor-must-fail, mutations.restores-the-file, mutations.vacuous-bite, mutations.host-skip-only-on-git-bash, mutations.host-skip-reads-77, mutations.host-skipped-survivor-is-a-skip, mutations.skip-verdict-is-honest, mutations.isolated-copy, mutations.in-place-is-opt-in, mutations.workspace-cleanup, mutations.preflight-callsite-isolated, mutations.preflight-runs-the-gate, mutations.hook-callsite-isolated, mutations.hook-runs-the-gate, mutations.find-must-match-once, mutations.copy-preserves-mode, mutations.copy-does-not-follow-symlinks, mutations.symlink-target-refused, mutations.symlink-checked-before-exists, mutations.copy-drops-escaping-symlinks, mutations.shards-cover-every-entry, mutations.shard-failure-fails-the-run, mutations.report-is-printed, mutations.stale-check-runs-no-test, mutations.stale-check-verdict, mutations.push-stale-check-aborts, mutations.push-stale-check-whole-manifest, mutations.push-runs-the-gate, mutations.push-clears-git-env, mutations.copy-failure-loud, mutations.ignored-not-copied, mutations.timeout-kills-tree, mutations.changed-by-test-path, mutations.verdicts-stream, mutations.verdicts-tagged, mutations.shard-slices-partition, mutations.shard-spec-checked, mutations.ci-shard-passed-through, mutations.ci-shards-cover-the-manifest, mutations.ci-preflight-skips-the-slug, mutations.ci-same-setup, mutations.push-base-is-remote-tip, mutations.push-unfetched-tip-falls-back, mutations.push-passes-base, mutations.changed-uses-base |
hook (whole tree)+CI |
by construction |
gate-registry |
gate proof registry |
linux/scripts/verify_gate_registry.py |
linux/scripts/gate-proofs.allow |
linux/scripts/tests/test-gate-registry.sh |
gate-registry.new-unproven, gate-registry.stale-frozen, gate-registry.registry-stale, gate-registry.basename-is-the-contract, gate-registry.basename-boundary, gate-registry.inline-needle, gate-registry.script-tie-break, gate-registry.imported-module-mutations, gate-registry.fallback-dropped, gate-registry.inline-extent, gate-registry.hook-tier, gate-registry.by-construction, gate-registry.mutation-id-prefix, gate-registry.mutation-target-scope, gate-registry.off-convention-loud, gate-registry.hook-scoped-tier, gate-registry.wrong-prefix-loud, gate-registry.hook-whole-tree-tier, gate-registry.hook-block-staged-list, gate-registry.hook-block-changed, gate-registry.id-rule-not-gate-scoped, gate-registry.family-must-be-declared, gate-registry.family-not-a-slug-freeze, gate-registry.shell-out-ownership, gate-registry.call-site-credit, gate-registry.call-site-needs-the-name, gate-registry.hooks-are-all-of-them, gate-registry.hook-top-level-tier |
hook+CI |
test+mutation |
shared-config |
shared config owner-root sync |
linux/scripts/preflight.sh |
— |
linux/scripts/tests/test-shared-config.sh |
shared-config.verdict-reaches-the-exit-code, shared-config.missing-copy-is-a-verdict, shared-config.body-mode-drops-the-header, shared-config.knob-values-are-masked, shared-config.line-endings-normalised, shared-config.write-refuses-body-assets, shared-config.unknown-id-is-broken-input |
CI |
test+mutation |
cmake-format |
cmake-format check |
linux/scripts/preflight.sh |
— |
linux/scripts/tests/test-cmake-format.sh |
cmake-format.empty-walk-refused |
CI |
test+mutation |
doc-links |
docs cross-references |
docs/scripts/verify_doc_links.py |
docs/scripts/doc-header-pointers.allow |
linux/scripts/tests/test-doc-links.sh |
doc-links.code-pointers, doc-links.local-section-ref-unchecked, doc-links.git-free-floor, doc-links.tracked-output-floor, doc-links.flutter-checks-anchor, doc-links.header-scope, doc-links.header-anchor-exempt, doc-links.header-section-ref-exempt, doc-links.header-stale-row, doc-links.header-suffix-scope, doc-links.header-open-backlog, doc-links.root-argument-is-the-tree |
hook+CI |
test+mutation |
doc-dupes |
docs duplication |
docs/scripts/verify_doc_dupes.py |
docs/scripts/doc-dupes.allow |
linux/scripts/tests/test-doc-dupes.sh, linux/scripts/tests/test-precommit-hook.sh |
doc-dupes.over-threshold-fails, doc-dupes.owner-cutoff, doc-dupes.cross-file-only, doc-dupes.word-floor, doc-dupes.stale-row-fails, doc-dupes.report-lists-allowed, doc-dupes.root-argument-is-the-tree |
hook (whole tree, when relevant)+CI |
test+mutation |
sbom |
curated SBOM |
docs/scripts/generate_sbom.py |
— |
linux/scripts/tests/test-curated-sbom.sh |
sbom.check-fails-when-stale, sbom.check-is-byte-equality, sbom.timestamp-is-frozen, sbom.stdout-writes-nothing, sbom.tracks-versions-env |
CI |
test+mutation |