{
  "intent": "Make the 'no inline Python in shell scripts' rule a gate that fails the commit, instead of prose in CLAUDE.md that nothing enforced.",
  "scope": [
    "meta/scripts/check_no_inline_python.sh (new pre-commit hook script)",
    ".pre-commit-config.yaml (register the no-inline-python hook)",
    "linux_configuration/scripts/single_use/utils/install_plagiarism_tools.sh (the one real violation)",
    "linux_configuration/scripts/single_use/utils/download_nltk_data.py (extracted from the inline block)",
    "Non-goal: the remaining 250-line file-length work; that lands separately"
  ],
  "changes": [
    "Added check_no_inline_python.sh: flags `python <<HEREDOC` and multi-line `python -c`, while permitting the single-line availability/version probes the rule explicitly allows. Skips commented-out examples so the rule's own documentation does not fail the hook.",
    "Extracted a 6-line inline `python3 -c` NLTK download block into download_nltk_data.py, invoked as `python3 \"$(dirname \"$0\")/download_nltk_data.py\"`. It now returns a non-zero exit on partial failure, which the inline version silently swallowed.",
    "Registered the hook with types_or: [shell, zsh]."
  ],
  "verification": [
    {
      "command": "find . -name '*.sh' ... | xargs bash meta/scripts/check_no_inline_python.sh",
      "result": "pass",
      "evidence": "Scanned every shell file in the repo: 1 genuine violation found (install_plagiarism_tools.sh:84), 0 false positives across ~250 files. After the extraction, the whole tree is clean."
    },
    {
      "command": "pre-commit run no-inline-python --all-files",
      "result": "pass",
      "evidence": "Block Python logic embedded in shell scripts.............................Passed"
    },
    {
      "command": "pre-commit run no-inline-python --files ./canary_tmp.sh (staged canary with a real heredoc)",
      "result": "pass",
      "evidence": "Hook exited non-zero and reported canary_tmp.sh:2: python3 <<'PY' -- proving the gate fires rather than passing vacuously. Canary deleted afterwards."
    },
    {
      "command": "bash -n + shellcheck install_plagiarism_tools.sh; ruff check + ruff format --check download_nltk_data.py",
      "result": "pass",
      "evidence": "bash -n OK; shellcheck OK; 'All checks passed!' and '1 file already formatted'. No suppressions added: T201 avoided via sys.stderr.write and INP001 via the #!/usr/bin/env python3 shebang, matching the sibling fast_count.py."
    }
  ],
  "risks": [
    "download_nltk_data.py imports nltk at module scope, which is not in meta/requirements.txt because it belongs to the plagiarism toolchain, not this repo. The installer pip-installs it immediately before invoking the module, so the import cannot fail in the real call path.",
    "The multi-line `python -c` regex keys on an unterminated quote. A single-line -c containing an escaped quote could in principle be misread; no such case exists in the repo today and the whole-tree scan found zero false positives."
  ],
  "rollback": [
    "git revert the commit; the hook stops running and the inline block returns.",
    "Validate by re-running: pre-commit run no-inline-python --all-files"
  ]
}