{
  "title": "Split mutate_session_autopsy_hooks.py and test_security_hardening.sh",
  "objective": "Bring two files under the repo-wide 250-line cap: meta/scripts/mutate_session_autopsy_hooks.py (253, over by 3) by moving its eight mutation operators into a sibling module, and linux_configuration/tests/test_security_hardening.sh (423) by moving its five test sections into three sourced libs -- neither changing what any check asserts or reports.",
  "acceptance_criteria": [
    "Both mutate_session_autopsy_hooks.py and _session_autopsy_mutations.py are at most 250 lines.",
    "ruff, mypy and pylint all pass on both files with no suppression added and no per-file-ignore introduced.",
    "Running the script produces output byte-identical to the same run at HEAD: the same eight mutations in the same order, each killing the same named tests, ending in 'PASS: all 12 tests killed by at least one mutation'.",
    "The deployed hooks under ~/.claude/hooks are not modified, which the script guarantees by copying before mutating.",
    "No test file is edited: nothing imports or patches this module, so the split needs no test change at all.",
    "test_security_hardening.sh and all three new libs are at most 250 lines, and the entry keeps its filename because .github/workflows/shell-tests.yml runs the suite by filename.",
    "The suite's output is byte-identical to a run from a detached worktree at HEAD once the repo path prefix is normalised, with the same exit status and the same Passed 18 / Failed 1 / Skipped 5 tally on this host.",
    "Each new shell lib passes shellcheck ALONE, without -x, which is the check that decides whether the seam is real; the SC2034 the seam exposes is resolved with a live_section() setter rather than a disable comment.",
    "shfmt reports no diff on the entry or any new lib."
  ],
  "out_of_scope": [
    "Changing any mutation operator, the set of mutations, or the tests they target.",
    "Adding meta/scripts/__init__.py. The sibling _schema_validation.py already establishes the convention here: a #!/usr/bin/env python3 shebang marks the file as a script and satisfies ruff's INP001 without turning meta/scripts into a package.",
    "Changing how the pre-commit hook invokes the script.",
    "Fixing the one pre-existing failure test_security_hardening.sh reports on this host.",
    "Splitting block_compulsive_opening.sh. Its install_all copies the running script to /usr/local/bin, so an entry+lib shape would ship an entry whose SCRIPT_DIR resolves to a directory with no lib/, breaking three daily-use apps and the pacman rewrap hook.",
    "Wiring the file-length pre-commit gate, which must land only once --all already exits 0."
  ],
  "verifier": "python3 meta/scripts/mutate_session_autopsy_hooks.py diffed against the same command run from a detached worktree at HEAD (expects identical output), plus pre-commit run --files on both files covering ruff, mypy, pylint and bandit; and bash linux_configuration/tests/test_security_hardening.sh diffed against the same suite run from a detached worktree at HEAD, plus shellcheck on each lib alone, shellcheck -x on the entry, and shfmt -d on all four shell files."
}