sets.lock.json

[
  {
    "commands": [],
    "rules": [
      {
        "files": {
          "exclude": [
            "**/tests/fixtures/**",
            "**/test/fixtures/**",
            "**/testdata/**"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-committed-logs",
        "message": "Keep captured logs in issues or ignored local storage. Commit the code that\nproduces and checks evidence, not the volatile output of a run. Synthetic log\nfixtures belong in an explicitly named fixture directory.\n",
        "path_regexp": "(?i)\\.log(?:\\.[0-9]+)?$"
      },
      {
        "files": {
          "exclude": [
            "**/tests/fixtures/**",
            "**/test/fixtures/**",
            "**/testdata/**"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-dated-source-metadata",
        "message": "Do not commit authoring dates in source or documentation. Git history owns\nedit chronology; keep the current contract and rationale in the file.\n",
        "regexp": "(?i)^[\\t ]*(?:(?:\\#|//+|/\\*+|\\*|--|;|<!--)\\s*)?(?:Da[t]e|Created|Updated|Last updated|Last modified):[\\t ]*[0-9]{4}-[0-9]{2}-[0-9]{2}"
      },
      {
        "builtin": "no-hand-copied-base-rule",
        "git": {
          "hooks": [
            "pre-commit",
            "manual"
          ]
        },
        "id": "no-hand-copied-base-rule",
        "message": "A rule a bundled set already ships is written out here by hand, from a set this\npolicy does not inherit. The bundled copy is re-read from the binary on every\nrun; a transcription is frozen at the moment it was typed, and nothing compares\nthe two.\n\nAt pre-commit only the ids this change adds are refused, measured against the\npolicy file at HEAD. Run `uphold guard --stage manual` for every transcription\nalready here: which ids, which set owns them, and what else that set would\nbring.\n"
      },
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "policy/**",
            "README.md"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-hardcoded-home-paths",
        "message": "Do not commit hardcoded user home paths. Use neutral paths such as\n/srv/example/... or discover runtime paths from configuration and system state.\n",
        "regexp": "(?:^|[^A-Za-z0-9_.-])(?:/home|/Users)/[A-Za-z0-9._-]+|[A-Za-z]:\\\\Users\\\\[A-Za-z0-9._-]+"
      },
      {
        "files": {
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": true,
          "word": false
        },
        "id": "no-merge-conflict-markers",
        "message": "Do not commit Git merge-conflict markers. Resolve the conflict and remove the\n<<<<<<< / ======= / >>>>>>> lines before committing.\n",
        "regexp": "^<{7} [\\s\\S]*?^={7}$[\\s\\S]*?^>{7} "
      },
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go"
          ],
          "exclude_cfg_test": false,
          "glob": [
            "*.md",
            "*.rst",
            "*.txt"
          ],
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-process-history-references",
        "message": "Do not reference process-history records (issue, pull request, or thread\nnumbers) in final docs. Extract the durable rule or final state instead.\n",
        "regexp": "(?i)\\bas discussed in (?:an? )?(?:issue|thread|pr)\\b"
      },
      {
        "files": {
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-source-changelog",
        "message": "Do not maintain change history in repository files. Git history owns changes\nand their dates; source and documentation describe the current behavior.\n",
        "path_regexp": "(?i)(?:^|/)(?:changelog|changes|history)(?:\\.(?:md|rst|txt))?$"
      },
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "**/docs/adr/**"
          ],
          "exclude_cfg_test": false,
          "glob": [
            "*.md",
            "*.rst",
            "*.txt"
          ],
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-status-source-metadata",
        "message": "Do not commit workflow-state metadata in source docs. Track decision state in\nyour tracker, not in tracked files. An architecture decision record is the\nexception: its status is the record's own standing, and docs/adr/ is excluded.\n",
        "regexp": "^Sta[t]us:[[:space:]]*[[:alnum:]_-]+"
      },
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "**/testdata/**"
          ],
          "exclude_cfg_test": false,
          "glob": [
            "*.md",
            "*.rst",
            "*.txt"
          ],
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-task-tracker-references",
        "message": "Source, configuration, and documentation must not depend on volatile\nissue or pull request records. State the durable contract and rationale here,\nor link to repository documentation. Issues may link to code; code must not\ndepend on issues. Keep logs, bug reports, and benchmark results in issues, and\nedit chronology in Git history.\n",
        "regexp": "github\\.com/[^[:space:])]+/(?:issues|pull)/[0-9]+|\\b(?:[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+|[A-Za-z0-9_.-]*[a-z][A-Za-z0-9_.-]*)#[0-9]+\\b|(?:^|\\b[a-z]+[\\t ]+|(?i:\\b(?:issue|pr)[\\t ]+)|\\(|\\[)#[0-9]+\\b|[,;/][\\t ]*#(?:[0-9]{1,2}|[0-9]{4,5}|[0-9]{7,})\\b|[,;/][\\t ]*#(?:[0-9]{3}|[0-9]{6})(?:[^\\w\\t ),;%]|[\\t ]*$|[\\t ]+(?:[^\\t ),;%0-9]|[0-9]+(?:[^0-9%]|$)))"
      },
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-tracked-private-data-paths",
        "message": "Do not commit local private data, build artifacts, traces, or HAR captures.\nKeep these under ignored local paths only.\n",
        "path_regexp": "^(?:data/private|artifacts|traces)(?:/|$)|\\.(?:har|trace)$"
      }
    ],
    "set": "process-residue",
    "stages": [
      "pre-commit",
      "manual"
    ]
  },
  {
    "commands": [],
    "rules": [
      {
        "files": {
          "exclude": [
            "*.md",
            "*.rst",
            "*.txt",
            "*.css",
            "*.scss",
            "*.sass",
            "*.less",
            "*.styl",
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "**/testdata/**"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-task-tracker-references-in-code",
        "message": "Source, configuration, and build files must not depend on volatile issue or\npull request records. State the durable contract and rationale in a comment, or\nlink to repository documentation. Issues may link to code; code must not depend\non issues. Keep logs, bug reports, and benchmark results in issues, and edit\nchronology in Git history.\n",
        "regexp": "github\\.com/[^[:space:])]+/(?:issues|pull)/[0-9]+|\\b(?:[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+|[A-Za-z0-9_.-]*[a-z][A-Za-z0-9_.-]*)#[0-9]+\\b|(?:^|\\b[a-z]+[\\t ]+|(?i:\\b(?:issue|pr)[\\t ]+)|\\(|\\[)#[0-9]+\\b|[,;/][\\t ]*#(?:[0-9]{1,2}|[0-9]{4,5}|[0-9]{7,})\\b|[,;/][\\t ]*#(?:[0-9]{3}|[0-9]{6})(?:[^\\w\\t ),;%]|[\\t ]*$|[\\t ]+(?:[^\\t ),;%0-9]|[0-9]+(?:[^0-9%]|$)))"
      }
    ],
    "set": "code-residue",
    "stages": [
      "pre-commit",
      "manual"
    ]
  },
  {
    "commands": [],
    "rules": [
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-browser-profile-artifacts",
        "message": "Do not commit browser profile or session-store files. Cookie jars, login\nstores, session stores, and profile databases can contain authenticated data.\n",
        "path_regexp": "(?i)(?:^|/)(?:cookies\\.sqlite|key4\\.db|logins\\.json|places\\.sqlite|sessionstore(?:-backups)?|sessionstore\\.jsonlz4|Login Data|Network Persistent State|Cookies)(?:$|/)"
      },
      {
        "files": {
          "exclude": [
            ".env.example",
            "*.enc.env",
            ".env.enc",
            "*.env.enc",
            "**/tests/**",
            "**/test/**",
            "**/*_test.go"
          ],
          "exclude_cfg_test": false,
          "glob": [
            ".env",
            ".env.*",
            "*.env",
            "*.env.*"
          ],
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-env-secret-values",
        "message": "Do not commit populated environment files. Use .env.example with empty or\nplaceholder values and keep real values in ignored local .env files.\n",
        "regexp": "^\\s*(?:[A-Z0-9_]*)(?:USERNAME|PASSWORD|TOKEN|COOKIE|SESSION|SECRET|API_?KEY|APP_ID|SUBSCRIPTION_KEY)\\s*=\\s*[^#\\s].*$"
      }
    ],
    "set": "credentials",
    "stages": []
  },
  {
    "commands": [],
    "rules": [
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "policy/**",
            "README.md",
            "third_party/**",
            "vendor/**"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-pinned-release-download",
        "message": "Do not fetch a pinned release artifact by URL. `releases/download/vX.Y.Z` names\na specific build in a path no manifest holds, so nothing tracks it and nothing\nre-verifies that the artifact behind it is still the one that was reviewed.\n\nUse the package manager, or a manifest entry a dependency bot can read.\n",
        "regexp": "releases/download/v?[0-9]"
      },
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "policy/**",
            "README.md",
            "third_party/**",
            "vendor/**"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-pinned-tool-install",
        "message": "Do not pin a tool version in an install command. A version typed into a shell\nline is a pin nothing watches: no manifest holds it and no dependency bot can\nopen a pull request against it, so it goes stale silently.\n\nInstall the floating version and let the toolchain resolve it, or move the pin\ninto a manifest something reads (go.mod, pyproject.toml, package.json, a\nlockfile) where a bot can see it move.\n\nThe same applies to a git tag given to an installer -- `cargo install --git URL\n--tag vX.Y.Z` -- and to the ref a hook manager pins a remote config at.\n",
        "regexp": "(?i)(go install \\S+@v?[0-9]+\\.[0-9]|pip[x]? install [^\\n]*==[0-9]|npm (i|install)( -g)? \\S+@[0-9]+\\.[0-9]|npx \\S+@[0-9]+\\.[0-9]|cargo install [^\\n]*(--version[ =]|--tag[ =]v?|@)[0-9]|--with [A-Za-z0-9_.-]+==[0-9]|^\\s*ref:\\s*[\"']?v?[0-9]+\\.[0-9])"
      },
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "policy/**",
            "README.md",
            "third_party/**",
            "vendor/**"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-pinned-versioned-fetch",
        "message": "Do not curl or wget a versioned URL. The version in the path is a pin nothing\nwatches, and the failure mode is not a stale dependency -- it is a 404 on a URL\nthat stopped existing, in the middle of a build, long after the pin was written.\n",
        "regexp": "(?i)(curl|wget)\\b.*https?://\\S+/v?[0-9]+\\.[0-9]+\\.[0-9]"
      }
    ],
    "set": "unmanaged-pins",
    "stages": []
  },
  {
    "commands": [],
    "rules": [
      {
        "files": {
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": true
        },
        "forbidden_literals": "running-os-identity",
        "id": "no-running-os-identity-metadata",
        "message": "Do not commit identity metadata from the running OS. The scan reads the current\nusername, home path, hostname and default route at runtime, then searches the\ntracked files for what it read. Use neutral placeholders instead --\nexample-user, example-host, example.test, /srv/example.\n"
      }
    ],
    "set": "host-identity",
    "stages": []
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "links-resolve",
        "files": {
          "exclude_cfg_test": false,
          "glob": [
            "*.md"
          ],
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-broken-doc-links",
        "message": "A documentation link points at a path that does not exist, or escapes the\nrepository. Repoint it or drop it: a reference nothing can follow is worse than\nno reference, because it reads as though someone checked -- and it pushes the\nnext author toward pasting a copy instead, which is the drift a citation exists\nto prevent. A link that has to leave this repository is an absolute forge URL\nnaming the owning repository and the path within it.\n",
        "require_any_link": true
      }
    ],
    "set": "broken-links",
    "stages": []
  },
  {
    "commands": [],
    "rules": [
      {
        "files": {
          "exclude_cfg_test": false,
          "glob": [
            "**/testdata/**",
            "**/tests/fixtures/**",
            "**/test/fixtures/**",
            "**/fixtures/**",
            "*_test.go"
          ],
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-non-ascii-in-fixtures",
        "message": "A test fixture holds non-ASCII content, which is what a capture from a live\nupstream looks like and is not what a synthetic fixture looks like. Replace it\nwith ASCII placeholders -- Fixture Account A, EXAMPLE.T, [REDACTED] -- so the\nfixture states what the test needs rather than what one session returned.\n",
        "regexp": "[^\\x09\\x0a\\x0d\\x20-\\x7e]"
      }
    ],
    "set": "captured-fixtures",
    "stages": []
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "anchors-resolve",
        "files": {
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-stale-anchored-fact",
        "message": "A document states a fact that has moved. The anchor beside the sentence names\nwhere the value lives, and the file it names now says something else -- or no\nlonger has the key, or is gone. Re-read the source and correct the sentence, or\ndrop the anchor if the sentence no longer needs the value inline. The document\nwas true when it was written, which is why nothing has failed until now.\n"
      }
    ],
    "set": "doc-claims",
    "stages": []
  },
  {
    "commands": [],
    "rules": [
      {
        "files": {
          "exclude_cfg_test": false,
          "glob": [
            "*.yml",
            "*.yaml"
          ],
          "include": [
            ".github/workflows"
          ],
          "multiline": false,
          "word": false
        },
        "id": "workflow-declares-permissions",
        "message": "A GitHub Actions workflow declares no top-level `permissions:` block, so its\nGITHUB_TOKEN gets whatever default the repository, organization or enterprise\nsettings grant -- a scope decided outside this file and invisible in it. Add a\ntop-level `permissions:` block naming the minimum: `contents: read` for a\nworkflow that only checks out and tests.\n\nA `permissions:` under a job scopes that job and does not answer this.\n",
        "require_regexp": "^[\"']?permissions[\"']?:"
      }
    ],
    "set": "default-token-grant",
    "stages": []
  },
  {
    "commands": [],
    "rules": [
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "policy/**",
            "README.md",
            "CONTRIBUTING.md",
            "third_party/**",
            "vendor/**"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": true,
          "word": false
        },
        "id": "no-hand-rolled-tool-install",
        "message": "Do not download and unpack a tool by hand. A `curl | tar` installer re-decides,\nper repository, everything a version manager already knows: which asset exists\nfor this architecture, which for this OS, and what to do when the release\ncarries neither.\n\nDeclare the tool instead -- a `mise.toml` `[tools]` row, a `.tool-versions`\nline -- and let the resolver fetch it. The version then lives somewhere a\ndependency bot can see it move, which a URL built out of shell variables does\nnot.\n\nThe measured failures of the hand-written form are not stale versions. They are\na `mv` into a directory that does not exist on a fresh runner, and a vendor\nrelease with no Linux asset on an architecture that was never tested locally --\neach one found once per repository, in CI, long after it was written.\n",
        "regexp": "(?i)\\b(curl|wget)\\b([^\\n]|\\\\\\n)*\\|([^\\n]|\\\\\\n)*\\b(tar|unzip|bsdtar|cpio)\\b"
      },
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "policy/**",
            "README.md",
            "CONTRIBUTING.md",
            "third_party/**",
            "vendor/**"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-hand-rolled-tool-symlink",
        "message": "Do not symlink a hand-installed tool onto PATH out of `$HOME/.local`. That link\nis the second half of a download-and-unpack installer, and it carries the half\nof the problem the download does not: the binary is now on PATH at a version no\nmanifest records, so every later check reports the tool as present and none of\nthem can say which one.\n\nLet the version manager own the binary, and link the version the manager\nresolved -- `ln -sfn \"$(mise which zig)\" /usr/local/bin/zig` -- when a link is\ngenuinely needed because the caller reads no shell profile (compose, a systemd\nunit, a non-interactive ssh). The link then makes the tool findable without also\ndeciding which one it is.\n",
        "regexp": "(?i)\\bln\\s+-[a-z]*s[a-z]*\\b[^\\n]*(\\$HOME|\\$\\{HOME\\}|~)/\\.local/(bin/|[^\\n]*\\s/usr(/local)?/bin/)"
      }
    ],
    "set": "hand-rolled-toolchain",
    "stages": []
  },
  {
    "commands": [],
    "rules": [
      {
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/*_test.go",
            "**/test_*.py",
            "**/*_test.py"
          ],
          "exclude_cfg_test": false,
          "glob": [
            "*.rs",
            "*.py",
            "*.pyi",
            "*.go",
            "*.toml",
            "*.yaml",
            "*.yml",
            "*.sh",
            "*.bash",
            "*.zsh",
            "*.fish",
            "*.ini",
            "*.cfg"
          ],
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-restated-line",
        "message": "This comment says what the next line already says. State a why, a constraint\nor a consequence, or delete it.\n",
        "trivial_comments": true
      },
      {
        "files": {
          "exclude_cfg_test": false,
          "glob": [
            "*.rs",
            "*.py",
            "*.go",
            "*.js",
            "*.ts",
            "*.tsx",
            "*.jsx",
            "*.c",
            "*.h",
            "*.cpp",
            "*.hpp",
            "*.java",
            "*.kt",
            "*.swift",
            "*.rb",
            "*.sh",
            "*.bash",
            "*.zsh",
            "*.fish",
            "*.toml",
            "*.yaml",
            "*.yml",
            "*.sql",
            "*.lua",
            "*.php",
            "*.cs"
          ],
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-user-data-measurement",
        "message": "This comment states a measurement, and no anchor checks it -- the value was\ntrue when it was written and nothing fails when it stops being. If it measures\nyour own data -- a size on disk, a count across a fleet, a duration timed on\none machine -- drop it: delete the number, and the sentence with it if it\ncannot stand alone, or move the figure to the commit or pull-request body. If\nthe number is not yours to measure -- a platform constant, a limit the code\nenforces, a worked example -- give the code the number, as a named constant\nthis comment can point at, or rewrite the example so it needs none. Do not\nspell the digits out as words: that states the same fact and only hides it\nfrom this rule.\n",
        "regexp": "^\\s*(?:#:?|///?|--|/\\*|\\*)(?:[^\\n]*[^\\w.-])?\\d[\\d_,.]*\\s?(?:%|(?:MB|KB|GB|ms|s|sec|seconds?|minutes?|hours?|files?|lines?|bytes?)\\b)|^\\s*(?:#:?|///?|--|/\\*|\\*)[^\\n]*\\b\\d+\\s+of\\s+\\d+\\b"
      }
    ],
    "set": "comment-facts",
    "stages": []
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "prevent-ai-author",
        "git": {
          "hooks": [
            "commit-msg"
          ]
        },
        "id": "prevent-ai-author"
      },
      {
        "builtin": "prevent-unusual-unicode",
        "git": {
          "hooks": [
            "commit-msg"
          ]
        },
        "id": "prevent-unusual-unicode"
      }
    ],
    "set": "commit-message-residue",
    "stages": [
      "commit-msg"
    ]
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "no-local-merge",
        "git": {
          "hooks": [
            "pre-merge-commit"
          ]
        },
        "id": "no-local-merge"
      },
      {
        "builtin": "no-merge-commit",
        "git": {
          "hooks": [
            "pre-commit"
          ]
        },
        "id": "no-merge-commit"
      }
    ],
    "set": "unreviewed-history",
    "stages": [
      "pre-commit",
      "pre-merge-commit"
    ]
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "prevent-author-mismatch",
        "git": {
          "hooks": [
            "pre-commit"
          ]
        },
        "id": "prevent-author-mismatch"
      }
    ],
    "set": "mismatched-author",
    "stages": [
      "pre-commit"
    ]
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "prevent-unusual-unicode-in-files",
        "git": {
          "hooks": [
            "pre-commit",
            "pre-merge-commit",
            "pre-push",
            "manual"
          ]
        },
        "id": "prevent-unusual-unicode-in-files"
      }
    ],
    "set": "invisible-characters",
    "stages": [
      "pre-commit",
      "pre-merge-commit",
      "pre-push",
      "manual"
    ]
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "no-stale-hook-pins",
        "git": {
          "hooks": [
            "manual"
          ]
        },
        "id": "no-stale-hook-pins"
      }
    ],
    "set": "stale-pins",
    "stages": [
      "manual"
    ]
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "no-stale-visibility",
        "git": {
          "hooks": [
            "pre-push",
            "manual"
          ]
        },
        "id": "no-stale-visibility"
      }
    ],
    "set": "stale-visibility",
    "stages": [
      "pre-push",
      "manual"
    ]
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "prevent-public-push",
        "git": {
          "hooks": [
            "pre-push"
          ]
        },
        "id": "prevent-public-push",
        "owner_required": true
      }
    ],
    "set": "unowned-push",
    "stages": [
      "pre-push"
    ]
  },
  {
    "commands": [],
    "private_owners_file": "xdg:principles/private-owners",
    "private_owners_optional": true,
    "rules": [
      {
        "builtin": "no-private-repo-names",
        "git": {
          "hooks": [
            "commit-msg"
          ]
        },
        "id": "no-private-repo-names",
        "visibility_required": true
      },
      {
        "builtin": "no-private-repo-names-in-files",
        "git": {
          "hooks": [
            "pre-merge-commit",
            "pre-push",
            "manual"
          ]
        },
        "id": "no-private-repo-names-in-files",
        "visibility_required": true
      },
      {
        "builtin": "no-private-repo-names-staged",
        "git": {
          "hooks": [
            "pre-commit"
          ]
        },
        "id": "no-private-repo-names-staged",
        "visibility_required": true
      }
    ],
    "set": "private-names",
    "stages": [
      "commit-msg",
      "pre-commit",
      "pre-merge-commit",
      "pre-push",
      "manual"
    ]
  },
  {
    "commands": [],
    "rules": [
      {
        "builtin": "removed-function-named",
        "git": {
          "hooks": [
            "commit-msg"
          ]
        },
        "id": "removed-function-named"
      }
    ],
    "set": "unnamed-removal",
    "stages": [
      "commit-msg"
    ]
  },
  {
    "commands": [
      "gh",
      "git push"
    ],
    "rules": [
      {
        "builtin": "text-literals",
        "command": {
          "before": [
            "gh",
            "git push"
          ],
          "scope": "always"
        },
        "id": "no-published-host-identity",
        "message": "Use neutral placeholders -- example-user, example-host, example.test,\n/srv/example -- instead of values taken from the local machine.\n"
      },
      {
        "builtin": "text-guards",
        "command": {
          "before": [
            "gh",
            "git push"
          ],
          "scope": "always"
        },
        "id": "no-published-markers",
        "message": "Published text must satisfy the repository's text-capable guards. A\npull-request body reaches a public API without passing a single git hook,\nwhich is why this check runs at publish time.\n"
      },
      {
        "builtin": "no-private-repo-names",
        "command": {
          "before": [
            "gh",
            "git push"
          ]
        },
        "id": "no-published-private-repo-names",
        "visibility": "public"
      },
      {
        "builtin": "prevent-unowned-target",
        "command": {
          "before": [
            "gh"
          ],
          "scope": "always"
        },
        "id": "unowned-forge-target",
        "owner_required": true
      }
    ],
    "set": "published-text",
    "stages": []
  },
  {
    "commands": [
      "gh",
      "git push"
    ],
    "rules": [
      {
        "command": {
          "before": [
            "gh",
            "git push"
          ]
        },
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/testdata/**",
            "**/fixtures/**",
            "**/*_test.go",
            "CHANGELOG*"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-announcing-sentence",
        "message": "This sentence says what the next one will say. Delete it and let the next\nsentence say it -- a reader who needs the announcement has already read past it.\n",
        "prose_regexp": "(?i)\\b(?:the (?:next|following) (?:section|paragraph|sentence)s? (?:will|describes?|explains?|shows?|covers?)|as (?:we|you) (?:will|shall) see|in what follows|this (?:section|document) (?:describes|explains|covers|discusses))\\b"
      },
      {
        "command": {
          "before": [
            "gh",
            "git push"
          ]
        },
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/testdata/**",
            "**/fixtures/**",
            "**/*_test.go",
            "CHANGELOG*"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-empty-hedge",
        "message": "This hedge admits no uncertainty -- it softens the claim without qualifying it.\nState the claim, or state what is actually unknown about it.\n",
        "prose_regexp": "(?i)\\b(?:arguably|it could be (?:said|argued)|in some sense|to some extent|it is worth noting|it should be noted|needless to say|as it were|so to speak)\\b"
      },
      {
        "command": {
          "before": [
            "gh",
            "git push"
          ]
        },
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/testdata/**",
            "**/fixtures/**",
            "**/*_test.go",
            "CHANGELOG*"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-restating-clause",
        "message": "This clause restates the one in front of it. Keep whichever half is clearer and\ndelete the other -- a sentence that needs a second statement of itself needs a\nbetter first one.\n",
        "prose_regexp": "(?i)(?:--|\\x{2014})[[:space:]]*(?:(?:in other words|which is to say|put differently|to put it (?:another way|differently))\\b|i\\.e\\.)"
      },
      {
        "command": {
          "before": [
            "gh",
            "git push"
          ]
        },
        "files": {
          "exclude": [
            "**/tests/**",
            "**/test/**",
            "**/testdata/**",
            "**/fixtures/**",
            "**/*_test.go",
            "CHANGELOG*"
          ],
          "exclude_cfg_test": false,
          "include": [
            "."
          ],
          "multiline": false,
          "word": false
        },
        "id": "no-unproposed-alternative",
        "message": "This answers an objection nobody made. Argue with the alternative that was\nactually proposed, or state the position and stop.\n",
        "prose_regexp": "(?i)\\b(?:one (?:might|could) (?:argue|object)|some (?:would|might|may) (?:argue|object)|it (?:might|could) be (?:argued|objected|tempting)|a (?:skeptic|sceptic|critic) (?:might|would|could))\\b"
      }
    ],
    "set": "prose-shapes",
    "stages": []
  }
]