diff --git a/.chock/bin/antigravity.py b/.chock/bin/antigravity.py
index e08fd43..a0d4f13 100755
--- a/.chock/bin/antigravity.py
+++ b/.chock/bin/antigravity.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -608,7 +609,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -630,7 +631,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -649,7 +650,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -669,7 +670,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -683,7 +683,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/.chock/bin/claude_code.py b/.chock/bin/claude_code.py
index 5211c41..3e94a8b 100755
--- a/.chock/bin/claude_code.py
+++ b/.chock/bin/claude_code.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -663,7 +664,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -685,7 +686,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -704,7 +705,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -724,7 +725,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -738,13 +738,15 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
         return (VERDICT_ESCALATE, f"chock could not check this command: the {guard.stem} guard did not complete (see this hook's stderr). Approving runs it unchecked.")
     return None
 
+_GIT = _chock_shutil.which('git') or 'git'
+
 _INSTRUCTION = "Chock: this clone's git hooks are NOT installed -- git never clones hooks, so commit-time gates will not run locally until someone runs:\n    pip install chock && chock sync --repo .\nRun that before the first commit. (The repo's CI gate, where wired, enforces regardless.)"
 
 def _repo_root() -> _chock_Path:
@@ -754,7 +756,7 @@ def _repo_root() -> _chock_Path:
 def _hooks_pre_commit(repo_root: _chock_Path) -> _chock_Path | None:
     """The active pre-commit hook path, honouring core.hooksPath. None when git is absent."""
     try:
-        proc = _chock_subprocess.run(['git', 'rev-parse', '--git-path', 'hooks'], cwd=repo_root, capture_output=True, text=True, timeout=15)
+        proc = _chock_subprocess.run([_GIT, 'rev-parse', '--git-path', 'hooks'], cwd=repo_root, capture_output=True, text=True, timeout=15, check=False)
     except (OSError, _chock_subprocess.TimeoutExpired):
         return None
     if proc.returncode != 0:
diff --git a/.chock/bin/codex_cli.py b/.chock/bin/codex_cli.py
index 3b5a068..3d67533 100755
--- a/.chock/bin/codex_cli.py
+++ b/.chock/bin/codex_cli.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -650,7 +651,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -672,7 +673,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -691,7 +692,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -711,7 +712,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -725,7 +725,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/.chock/bin/cursor.py b/.chock/bin/cursor.py
index c1a44ed..767e653 100755
--- a/.chock/bin/cursor.py
+++ b/.chock/bin/cursor.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -573,7 +574,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -595,7 +596,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -614,7 +615,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -634,7 +635,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -648,7 +648,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/.chock/bin/devin.py b/.chock/bin/devin.py
index 02cee60..24a7ffd 100755
--- a/.chock/bin/devin.py
+++ b/.chock/bin/devin.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -634,7 +635,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -656,7 +657,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -675,7 +676,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -695,7 +696,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -709,7 +709,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/.chock/bin/gate.py b/.chock/bin/gate.py
index 32073d4..95b7ecd 100755
--- a/.chock/bin/gate.py
+++ b/.chock/bin/gate.py
@@ -8,6 +8,7 @@
 import json
 import os
 import re
+import shutil
 import subprocess
 import sys
 import tomllib
@@ -15,6 +16,8 @@
 from datetime import datetime, timezone
 from pathlib import Path
 
+_GIT = shutil.which("git") or "git"
+
 
 @dataclass
 class GateResult:
@@ -44,8 +47,8 @@ def _range(self) -> list[str]:
 
     def _git(self, *args: str) -> str:
         try:
-            proc = subprocess.run(
-                ["git", "-c", "core.quotePath=false", *args],
+            proc = subprocess.run(  # noqa: S603 -- reading repo facts via git is this class's whole job
+                [_GIT, "-c", "core.quotePath=false", *args],
                 cwd=str(self.repo_root),
                 capture_output=True,
                 text=True,
@@ -53,9 +56,10 @@ def _git(self, *args: str) -> str:
                 errors="replace",
                 check=True,
             )
-            return proc.stdout or ""
         except (subprocess.CalledProcessError, FileNotFoundError, UnicodeError):
             return ""
+        else:
+            return proc.stdout or ""
 
     def rev_exists(self, ref: str) -> bool:
         """True when `ref` resolves to a commit. Used to fail CI closed on a missing base."""
@@ -91,14 +95,15 @@ def push_refs(self) -> list[str]:
         refs: list[str] = []
         for line in self._push_stdin.splitlines():
             parts = line.split()
-            if len(parts) >= 3:
+            if len(parts) >= _PUSH_LINE_MIN_PARTS:
                 refs.append(parts[2])
         return refs
 
 
-def _kind_content_regex(ctx: GateContext, params: dict, event: str) -> GateResult:
+def _kind_content_regex(ctx: GateContext, params: dict, _event: str) -> GateResult:
     content_re = re.compile(params["content_pattern"])
-    path_re = re.compile(params["forbidden_path_regex"]) if params.get("forbidden_path_regex") else None
+    forbidden_path_regex = params.get("forbidden_path_regex")
+    path_re = re.compile(forbidden_path_regex) if forbidden_path_regex else None
     pragma_re = re.compile(params["allowlist_pragma"]) if params.get("allowlist_pragma") else None
     scan = params.get("scan", "added_lines")
     diff_filter = params.get("diff_filter", "ACMRT")
@@ -140,7 +145,7 @@ def _deps_requirements(text: str) -> set[str]:
     names: set[str] = set()
     for line in text.splitlines():
         s = line.strip()
-        if not s or s.startswith("#") or s.startswith("-"):
+        if not s or s.startswith(("#", "-")):
             continue
         m = _REQ_RE.match(line)
         if m:
@@ -206,11 +211,11 @@ def _extract(path: str, text: str) -> set[str]:
         return set()
     try:
         return fn(text)
-    except Exception:
+    except Exception:  # noqa: BLE001 -- untrusted, possibly-malformed manifest content; never crash the gate on it
         return set()
 
 
-def _kind_dependency_allowlist(ctx: GateContext, params: dict, event: str) -> GateResult:
+def _kind_dependency_allowlist(ctx: GateContext, params: dict, _event: str) -> GateResult:
     watched = set(params.get("manifests", []))
     allow: set[str] = set()
     allow_path = ctx.repo_root / params["allowlist_file"]
@@ -241,6 +246,15 @@ def _kind_dependency_allowlist(ctx: GateContext, params: dict, event: str) -> Ga
 _LOG_MAX_BYTES = 1_048_576
 _LOG_MATCH_CAP = 20
 
+#: A pre-push stdin line is `<local ref> <local sha> <remote ref> <remote sha>`;
+#: at least 3 whitespace-separated parts to reach the remote ref at index 2.
+_PUSH_LINE_MIN_PARTS = 3
+
+#: `<repo>/.chock/compiled/<policy>/git-hook/<script>`.resolve().parents needs at
+#: least 4 entries to reach the `compiled` directory at index 2 and its parent
+#: (the `.chock` root) at index 3.
+_MIN_COMPILED_PATH_DEPTH = 4
+
 
 def _log_outcome(gate_path: Path, event: str, spec: dict, result: GateResult) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
@@ -248,7 +262,7 @@ def _log_outcome(gate_path: Path, event: str, spec: dict, result: GateResult) ->
         if os.environ.get(GATE_LOG_ENV) == "0":
             return
         parents = gate_path.resolve().parents
-        if len(parents) < 4 or parents[2].name != "compiled":
+        if len(parents) < _MIN_COMPILED_PATH_DEPTH or parents[2].name != "compiled":
             return
         log_dir = parents[3] / "log"
         log_dir.mkdir(parents=True, exist_ok=True)
@@ -267,7 +281,7 @@ def _log_outcome(gate_path: Path, event: str, spec: dict, result: GateResult) ->
         }
         with log_path.open("a", encoding="utf-8") as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + "\n")
-    except Exception:
+    except Exception:  # noqa: BLE001 -- best effort logging: never raises, never changes the verdict
         return
 
 
@@ -321,8 +335,8 @@ def run(
 
 def _repo_root() -> Path:
     try:
-        out = subprocess.check_output(
-            ["git", "rev-parse", "--show-toplevel"], text=True, encoding="utf-8", errors="replace"
+        out = subprocess.check_output(  # noqa: S603 -- finding the repo root via git is this fallback's job
+            [_GIT, "rev-parse", "--show-toplevel"], text=True, encoding="utf-8", errors="replace"
         )
         return Path(out.strip())
     except (subprocess.CalledProcessError, FileNotFoundError, UnicodeError):
diff --git a/.chock/bin/gemini_cli.py b/.chock/bin/gemini_cli.py
index f466f97..b95eeb1 100755
--- a/.chock/bin/gemini_cli.py
+++ b/.chock/bin/gemini_cli.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -634,7 +635,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -656,7 +657,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -675,7 +676,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -695,7 +696,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -709,7 +709,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/.chock/bin/grok.py b/.chock/bin/grok.py
index 2ddef51..76db409 100755
--- a/.chock/bin/grok.py
+++ b/.chock/bin/grok.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -617,7 +618,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -639,7 +640,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -658,7 +659,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -678,7 +679,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -692,7 +692,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/.chock/bin/tabnine.py b/.chock/bin/tabnine.py
index 23b39e6..91fa650 100755
--- a/.chock/bin/tabnine.py
+++ b/.chock/bin/tabnine.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -617,7 +618,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -639,7 +640,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -658,7 +659,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -678,7 +679,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -692,7 +692,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/.chock/bin/vscode_copilot.py b/.chock/bin/vscode_copilot.py
index 1fb5e66..b3000b6 100755
--- a/.chock/bin/vscode_copilot.py
+++ b/.chock/bin/vscode_copilot.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -468,7 +469,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -490,7 +491,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -509,7 +510,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -529,7 +530,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -543,7 +543,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/.chock/bin/windsurf.py b/.chock/bin/windsurf.py
index 301ebb4..a3c13c1 100755
--- a/.chock/bin/windsurf.py
+++ b/.chock/bin/windsurf.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -546,7 +547,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -568,7 +569,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -587,7 +588,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -607,7 +608,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -621,7 +621,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/AGENTS.md b/AGENTS.md
index 0deba2b..7cc53bf 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -86,6 +86,15 @@ externalized_text: {
   coverage: [package_data_test, frozen_binary_spec],
   exceptions: {error_messages: beside_condition, behaviour: code}
 }
+static_analysis: {
+  bar: sonar_checkstyle_findbugs_via_ruff,
+  select: [C90, N, PLR, PLW, PLC, ERA, T20, ARG, RET, SIM, PIE, FBT, A, B, S, BLE, TRY, RUF],
+  thresholds: {complexity: 10, max_args: 5, max_branches: 12, max_returns: 6, max_statements: 50},
+  magic_values: {remedy: constant_or_data, duplication_check: tools/check_literal_duplication.py},
+  booleans: keyword_only_not_positional,
+  per_file_ignores: {require: reason, escape_hatch: "TODO(lint-adoption)" + enumerate_in_report},
+  never: blanket_fix
+}
 progressive_disclosure: {SKILL.md: activation_surface, depth: references/, inline: false}
 budgets: {SKILL.md: <=150, description: <=500, references: <=300, ambient_rule: <=2}
 validation: {pre_change: chock check, touched: [validate, eval]}
diff --git a/fuzz/fuzz_policy_id.py b/fuzz/fuzz_policy_id.py
index ec6ff88..c11a9fa 100644
--- a/fuzz/fuzz_policy_id.py
+++ b/fuzz/fuzz_policy_id.py
@@ -20,7 +20,7 @@
 
 with atheris.instrument_imports():
     from chock.compile.surfaces import parse_agent_selection
-    from chock.policy_id import InvalidPolicyId, validate_policy_id
+    from chock.policy_id import InvalidPolicyIdError, validate_policy_id
 
 SAFE = set(string.ascii_lowercase + string.digits + "-")
 VOCAB = {"alpha": 0, "beta": 0, "gamma": 0}
@@ -32,7 +32,7 @@ def one_input(data: bytes) -> None:
 
     try:
         validate_policy_id(candidate, candidate)
-    except InvalidPolicyId:
+    except InvalidPolicyIdError:
         pass
     else:
         # Acceptance implies shell/path safety -- the project's core id invariant.
diff --git a/pyproject.toml b/pyproject.toml
index 5b91f4e..baa1ea9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -123,7 +123,7 @@ where = ["src"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
-pythonpath = ["src"]
+pythonpath = ["src", "tools"]
 
 [tool.ruff]
 line-length = 120
@@ -140,6 +140,122 @@ target-version = "py311"
 extend-exclude = ["*.md", ".chock/bin/", "tests/fixtures/runtime_goldens/"]
 
 [tool.ruff.lint]
-select = ["E", "F", "W", "I"]
+# The Sonar/Checkstyle/FindBugs bar, in Python (plan/coding-standards.md §3, W50):
+# C90 complexity, N naming, PLR/PLW/PLC pylint refactor/warning/convention, ERA
+# commented-out code, T20 print-as-System.out, ARG unused args, RET/SIM/PIE
+# FindBugs-class correctness, FBT boolean traps, A builtin shadowing, B bugbear,
+# S bandit security, BLE blind except, TRY exception hygiene, RUF ruff-native.
+select = [
+    "E", "F", "W", "I",
+    "C90", "N", "PLR", "PLW", "PLC", "ERA", "T20", "ARG", "RET", "SIM", "PIE",
+    "FBT", "A", "B", "S", "BLE", "TRY", "RUF",
+]
 # Layout is governed by `ruff format`; long diagnostic strings are allowed.
 ignore = ["E501"]
+
+[tool.ruff.lint.mccabe]
+max-complexity = 10
+
+[tool.ruff.lint.pylint]
+max-args = 5
+max-branches = 12
+max-returns = 6
+max-statements = 50
+
+[tool.ruff.lint.per-file-ignores]
+# tests/ and acceptance/ assert with bare `assert` by design (S101), commonly pass
+# literal fixture values as positional args to helpers (FBT), and repeat short
+# literal strings as test data, not magic values (PLR2004).
+#
+# TODO(lint-adoption): the rest of each list below is baseline debt this wave did not
+# touch -- W50 scoped the fix to src/ (plan/spine-a/briefs/w50-chock-lint-adoption.md),
+# and `ruff check .` lints the whole repo, so widening `select` in this file makes these
+# out-of-scope trees newly fail unless deferred the same way. Enumerated by rule family
+# (not per-finding: 400+ findings across ~90 files) in plan/spine-a/reports/w50.md
+# (org-plan). A future wave should shrink these lists toward the tests/acceptance/**
+# baseline above, not grow them.
+"tests/**" = [
+    "S101", "FBT", "PLR2004",
+    "ARG001", "ARG002", "ARG004", "ARG005", "B905", "N806", "N814", "PLC0415",
+    "PLR0402", "PLR0913", "PLR0917", "PLW1510", "RUF005", "RUF043", "RUF059", "S105",
+    "S108", "S602", "S603", "S607", "SIM117", "SIM300", "T201", "TRY003",
+]
+"acceptance/**" = ["S101", "FBT", "PLR2004", "PLW1510", "S105", "S108", "S602", "S603"]
+"fuzz/**" = ["S101"]
+# docs/assets/gen_brand_assets.py derives docs/assets/social-preview.svg from repo data
+# (see the ci.yml brand-assets job) -- a dev/build script, not shipped source.
+"docs/assets/**" = ["ERA001", "PLR0913", "PLR0917", "PLR2004", "PLW2901", "RUF001", "RUF003", "RUF005", "S101", "S603", "T201"]
+# A standalone CLI dev-tool script: printing its findings to stderr is the feature.
+"tools/check_literal_duplication.py" = ["T201"]
+# The installed copy of the packaged template below (chock install-skills); same
+# print-is-the-feature reason.
+".agents/skills/policy-init/assets/templates/scripts-stub.py" = ["T201"]
+# Every import here is deliberately per-branch, not just at the top: tests/test_lifecycle.py
+# and tests/test_remove.py inject fakes with monkeypatch.setattr("chock.<mod>.<name>", ...)
+# against the *source* module, which only takes effect if the caller re-imports the name on
+# each call rather than binding it once at module load. Both also print their own genuine
+# CLI output (see the T201 note below), hence the combined rule list.
+"src/chock/lifecycle.py" = ["PLC0415", "T201"]
+"src/chock/scaffold/remove.py" = ["PLC0415", "T201"]
+# Genuine CLI/render surfaces: every print() here is chock's own end-user output --
+# argparse main()/*_main() status lines and tables, warnings the [WARN]/[ERROR] helpers in
+# chock/output.py don't cover (wrong stream, compound messages), or a report renderer
+# (validation/report.py, gatelog.py). chock has no other consumer of these strings, so
+# routing each through an indirection layer would not change behaviour, only add churn.
+"src/chock/cli.py" = ["T201"]
+"src/chock/toggles.py" = ["T201", "C901"]
+"src/chock/lock.py" = ["T201"]
+"src/chock/gatelog.py" = ["T201"]
+"src/chock/authoring/compliance.py" = ["T201"]
+"src/chock/authoring/matrix.py" = ["T201"]
+"src/chock/compile/compiler.py" = ["T201"]
+"src/chock/eval/cli.py" = ["T201"]
+"src/chock/gate/guard_runner.py" = ["T201", "PLR0911"]
+"src/chock/gate/runner.py" = ["T201", "PLR0913", "PLR0917", "PLR0911"]
+"src/chock/gateway/__main__.py" = ["T201"]
+"src/chock/hooks/autocompile.py" = ["T201"]
+"src/chock/hooks/install.py" = ["T201"]
+"src/chock/hooks/installers.py" = ["T201"]
+"src/chock/hooks/ownership.py" = ["T201"]
+"src/chock/hooks/sessionstart_install.py" = ["T201"]
+"src/chock/index/cli.py" = ["T201"]
+# The `# codeql[...]` alert-suppression comments above each print() read as commented-out
+# code to ERA001; CodeQL's own suppression syntax cannot carry a trailing noqa on the same
+# line (breaks its AlertSuppression matcher), so the ignore is file-scoped instead.
+"src/chock/output.py" = ["T201", "ERA001"]
+"src/chock/plugin/cli.py" = ["T201", "C901", "PLR0911", "PLR0912", "PLR0915"]
+"src/chock/plugin/marketplace.py" = ["T201"]
+"src/chock/registry/cli.py" = ["T201"]
+"src/chock/registry/core.py" = ["T201", "C901"]
+"src/chock/review/cli.py" = ["T201"]
+"src/chock/scaffold/add.py" = ["T201", "PLR0913"]
+"src/chock/scaffold/init.py" = ["T201", "C901", "PLR0912", "PLR0915"]
+"src/chock/scaffold/install_ci.py" = ["T201"]
+"src/chock/scaffold/new.py" = ["T201"]
+"src/chock/scaffold/recompile.py" = ["T201", "C901"]
+"src/chock/scaffold/skills.py" = ["T201"]
+"src/chock/scaffold/skills_bridge.py" = ["T201"]
+"src/chock/validation/engine.py" = ["T201", "PLR0913"]
+"src/chock/validation/frontier_ingest.py" = ["T201"]
+"src/chock/validation/report.py" = ["T201"]
+# Scaffolding template: `print` is the placeholder body of a `chock new` skill script
+# stub, not chock's own CLI surface.
+"src/chock/packs/_skills/policy-init/assets/templates/scripts-stub.py" = ["T201"]
+
+# TODO(lint-adoption): baseline complexity/arg-count findings, W50. Each needs an actual
+# function split or argument-bundling refactor to fix, which the brief marks as its own
+# careful, behaviour-preservation-checked step -- deferred here rather than attempted
+# under this same pass, and enumerated in plan/spine-a/reports/w50.md (org-plan) with the
+# specific function per finding. Every entry above this block was fixed, not deferred.
+"src/chock/eval/derive.py" = ["PLR0913", "PLR0917"]  # _case (6 args)
+"src/chock/eval/execute.py" = ["PLR0911"]  # _run_guard (8 returns)
+"src/chock/hooks/in_agent_install.py" = ["C901"]  # _install_merged, installed_policy_ids
+"src/chock/manifest.py" = ["C901", "PLR0912", "PLR0915"]  # _project_skill_frontmatter
+"src/chock/plugin/store.py" = ["PLR0913", "PLR0917"]  # 3 owned_subtrees-family builders (6 args each)
+"src/chock/validation/checks_content.py" = ["C901"]  # check_token_budgets
+"src/chock/validation/checks_determinism.py" = ["C901"]  # check_script_integrity
+"src/chock/validation/checks_evals.py" = ["C901"]  # check_eval_first
+"src/chock/validation/checks_orchestration.py" = ["C901", "PLR0912", "PLR0915"]  # check_dependencies_resolvable, check_composition_contract
+"src/chock/validation/checks_security.py" = ["PLR0911"]  # _scan_text_surfaces (8 returns)
+"src/chock/validation/frontier.py" = ["C901", "PLR0912"]  # check_frontier_mode
+"src/chock/validation/loading.py" = ["C901", "PLR0912"]  # discover_artifacts
diff --git a/src/chock/authoring/compliance.py b/src/chock/authoring/compliance.py
index b74efb9..7e75985 100644
--- a/src/chock/authoring/compliance.py
+++ b/src/chock/authoring/compliance.py
@@ -94,10 +94,7 @@ def _build_report(
     builtin = _load_builtin_controls(framework)
     claims = _collect_claims(repo_root, framework)
 
-    if framework in BUILTIN_FRAMEWORKS:
-        control_ids = list(builtin.keys())
-    else:
-        control_ids = sorted(claims.keys())
+    control_ids = list(builtin.keys()) if framework in BUILTIN_FRAMEWORKS else sorted(claims.keys())
 
     report: dict[str, Any] = {framework: {}}
     for control_id in control_ids:
@@ -131,10 +128,7 @@ def _format_table(
             detail = ", ".join(policy_strs)
         else:
             detail = "-"
-        if title:
-            first = f"{control_id:<12} {state:<10} {title}"
-        else:
-            first = f"{control_id:<12} {state:<10} {detail}"
+        first = f"{control_id:<12} {state:<10} {title}" if title else f"{control_id:<12} {state:<10} {detail}"
         lines.append(first)
         if title and policies:
             lines.append(f"{'':<12} {'':<10} {detail}")
diff --git a/src/chock/authoring/matrix.py b/src/chock/authoring/matrix.py
index b985712..6da403b 100644
--- a/src/chock/authoring/matrix.py
+++ b/src/chock/authoring/matrix.py
@@ -14,6 +14,10 @@
 INVARIANT_RE = re.compile(r"\*\*([A-Z]{2,4}-\d+)\*\*")
 MATRIX_ID_RE = re.compile(r"^\|\s*([A-Z]{2,4}-\d+)\s*\|")
 
+#: A `| id | ... | check | ... |` matrix row splits into at least this many
+#: `|`-delimited parts to reach the check column at index 3.
+_MATRIX_ROW_MIN_COLUMNS = 5
+
 
 def collect_spec_invariant_ids() -> set[str]:
     ids: set[str] = set()
@@ -40,7 +44,7 @@ def collect_matrix_ids_and_rows() -> tuple[set[str], list[str]]:
         inv_id = match.group(1)
         ids.add(inv_id)
         parts = [p.strip() for p in line.split("|")]
-        if len(parts) < 5 or not parts[3] or parts[3].lower() == "check":
+        if len(parts) < _MATRIX_ROW_MIN_COLUMNS or not parts[3] or parts[3].lower() == "check":
             rows_without_check.append(line.strip())
     return ids, rows_without_check
 
diff --git a/src/chock/compile/compiler.py b/src/chock/compile/compiler.py
index 35cac0b..0376594 100644
--- a/src/chock/compile/compiler.py
+++ b/src/chock/compile/compiler.py
@@ -21,11 +21,18 @@
     mcp_gateway,
 )
 from chock.compile.levels import IN_AGENT_TODAY, Grade, render_grade
-from chock.compile.surfaces import SURFACE_AGENTS, Surface, coverage_cell, parse_agent_selection
+from chock.compile.surfaces import (
+    AGENTS_ARG_REQUIRED_MSG,
+    SURFACE_AGENTS,
+    Surface,
+    coverage_cell,
+    parse_agent_selection,
+)
 from chock.config import agents_from_config
 from chock.hooks.in_agent_install import WIRED_VENDORS, installed_policy_ids
 from chock.manifest import ManifestSourceError, load_manifest
-from chock.policy_id import InvalidPolicyId, validate_policy_id
+from chock.output import error, warn
+from chock.policy_id import InvalidPolicyIdError, validate_policy_id
 from chock.scaffold.install_ci import ci_workflow_installed
 from chock.vendors import CHOCK_AGENT
 
@@ -60,13 +67,13 @@ def _load_manifest(policy_dir: Path) -> dict[str, Any]:
     try:
         result = load_manifest(policy_dir, warnings=warnings)
     except (yaml.YAMLError, OSError, ManifestSourceError) as exc:
-        print(f"[ERROR] {policy_dir / 'manifest.yaml'}: manifest_parse: {exc}", file=sys.stderr)
+        error(f"{policy_dir / 'manifest.yaml'}: manifest_parse: {exc}")
         return {}
     if result is None:
         return {}
     data, _ = result
     for warning in warnings:
-        print(f"[WARN] {policy_dir}: manifest_default: {warning}", file=sys.stderr)
+        warn(f"{policy_dir}: manifest_default: {warning}")
     return data
 
 
@@ -99,8 +106,8 @@ def compile_policy(
 
     try:
         validate_policy_id(policy_id, policy_dir.name)
-    except InvalidPolicyId as exc:
-        print(f"[ERROR] {policy_dir / 'manifest.yaml'}: manifest_id: {exc}", file=sys.stderr)
+    except InvalidPolicyIdError as exc:
+        error(f"{policy_dir / 'manifest.yaml'}: manifest_id: {exc}")
         return CompileResult(policy_id=policy_dir.name)
 
     output_root = Path(output_root) if output_root else DEFAULT_OUTPUT_ROOT
@@ -187,7 +194,7 @@ def main(argv: list[str] | None = None) -> int:
         except ValueError as exc:
             _parser_fail(parser, str(exc))
         if not agents:
-            _parser_fail(parser, "--agents requires at least one agent name")
+            _parser_fail(parser, AGENTS_ARG_REQUIRED_MSG)
 
     policy_dir = Path(args.policy_dir) if args.policy_dir else repo_root / ".agents/policies" / args.policy_id
     if not policy_dir.exists():
diff --git a/src/chock/compile/emitters/__init__.py b/src/chock/compile/emitters/__init__.py
index f557b39..7b82222 100644
--- a/src/chock/compile/emitters/__init__.py
+++ b/src/chock/compile/emitters/__init__.py
@@ -1 +1,6 @@
 """Emitters that translate policy manifests into target-surface enforcement artifacts."""
+
+from chock.resources import package_data_dir
+
+#: Shared template/data directory for every emitter in this package.
+DATA_DIR = package_data_dir("chock.compile.emitters", "data")
diff --git a/src/chock/compile/emitters/advisory.py b/src/chock/compile/emitters/advisory.py
index 6593828..4eb4ea0 100644
--- a/src/chock/compile/emitters/advisory.py
+++ b/src/chock/compile/emitters/advisory.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import re
+import shutil
 import subprocess
 from pathlib import Path
 from typing import Any
@@ -11,6 +12,7 @@
 
 _VALUE_CHARS = 48
 _PARAMS_CHARS = 120
+_GIT = shutil.which("git") or "git"
 
 _PLACEHOLDER = re.compile(r"\{(\w+)\}")
 
@@ -22,7 +24,10 @@ def repo_root_from_output(output_dir: Path) -> Path:
         if parent.name == ".chock" and parent.is_dir():
             return parent.parent
     try:
-        return Path(subprocess.check_output(["git", "rev-parse", "--show-toplevel"], text=True).strip())
+        out = subprocess.check_output(  # noqa: S603 -- finding the repo root via git is this fallback's job
+            [_GIT, "rev-parse", "--show-toplevel"], text=True
+        )
+        return Path(out.strip())
     except (subprocess.CalledProcessError, FileNotFoundError):
         return Path.cwd()
 
diff --git a/src/chock/compile/emitters/ci.py b/src/chock/compile/emitters/ci.py
index a5a7676..fec6c7a 100644
--- a/src/chock/compile/emitters/ci.py
+++ b/src/chock/compile/emitters/ci.py
@@ -5,13 +5,12 @@
 from pathlib import Path
 from typing import Any
 
+from chock.compile.emitters import DATA_DIR
 from chock.compile.emitters.advisory import repo_root_from_output, template_message
 from chock.emit import write_generated, write_generated_json
 from chock.gate.build import build_gate_json, vendor_runner
-from chock.resources import package_data_dir
 
-_DATA_DIR = package_data_dir("chock.compile.emitters", "data")
-STEP_TEMPLATE = _DATA_DIR.joinpath("ci_gate_step.yaml").read_text(encoding="utf-8")
+STEP_TEMPLATE = DATA_DIR.joinpath("ci_gate_step.yaml").read_text(encoding="utf-8")
 
 
 def emit(policy_dir: Path, output_dir: Path, manifest: dict[str, Any]) -> list[Path]:
diff --git a/src/chock/compile/emitters/git_hook.py b/src/chock/compile/emitters/git_hook.py
index 678dbcd..1b7d621 100644
--- a/src/chock/compile/emitters/git_hook.py
+++ b/src/chock/compile/emitters/git_hook.py
@@ -2,16 +2,16 @@
 
 from __future__ import annotations
 
+import contextlib
 from pathlib import Path
 from typing import Any
 
+from chock.compile.emitters import DATA_DIR
 from chock.compile.emitters.advisory import repo_root_from_output, template_message
 from chock.emit import write_generated, write_generated_json
 from chock.gate.build import build_gate_json, vendor_runner
-from chock.resources import package_data_dir
 
-_DATA_DIR = package_data_dir("chock.compile.emitters", "data")
-SHIM_TEMPLATE = _DATA_DIR.joinpath("git_hook_shim.sh").read_text(encoding="utf-8")
+SHIM_TEMPLATE = DATA_DIR.joinpath("git_hook_shim.sh").read_text(encoding="utf-8")
 
 
 def _emit_shims(output_dir: Path, policy_id: str, events: list[str]) -> list[Path]:
@@ -28,10 +28,8 @@ def _emit_shims(output_dir: Path, policy_id: str, events: list[str]) -> list[Pat
         shim = output_dir / script_name
         rendered = SHIM_TEMPLATE.replace("__POLICY_ID__", policy_id).replace("__EVENT__", event_arg)
         write_generated(shim, rendered)
-        try:
+        with contextlib.suppress(OSError):
             shim.chmod(0o755)
-        except OSError:
-            pass
         emitted.append(shim)
     return emitted
 
diff --git a/src/chock/compile/emitters/in_agent.py b/src/chock/compile/emitters/in_agent.py
index 37fd80c..067c7f6 100644
--- a/src/chock/compile/emitters/in_agent.py
+++ b/src/chock/compile/emitters/in_agent.py
@@ -7,12 +7,11 @@
 from typing import Any
 
 from chock import vendors
+from chock.compile.emitters import DATA_DIR
 from chock.emit import write_generated_json
-from chock.resources import package_data_dir
 
-_DATA_DIR = package_data_dir("chock.compile.emitters", "data")
-_BASH_TEMPLATE = _DATA_DIR.joinpath("agent_hook_bash.sh").read_text(encoding="utf-8").rstrip("\n")
-_POWERSHELL_TEMPLATE = _DATA_DIR.joinpath("agent_hook_powershell.ps1").read_text(encoding="utf-8").rstrip("\n")
+_BASH_TEMPLATE = DATA_DIR.joinpath("agent_hook_bash.sh").read_text(encoding="utf-8").rstrip("\n")
+_POWERSHELL_TEMPLATE = DATA_DIR.joinpath("agent_hook_powershell.ps1").read_text(encoding="utf-8").rstrip("\n")
 
 GUARD_SCRIPTS = {
     "block-destructive-commands": "block-destructive.sh",
@@ -38,11 +37,11 @@ def _guard_script(policy_dir: Path, policy_id: str) -> str | None:
 #: plugin hooks borrow this matcher exactly as the hand-written emitters did
 #: (tests/test_vendor_wire_facts.py trips when upstream closes the gap).
 MATCHER = vendors.shell_matcher("claude_code")
-assert MATCHER is not None
+assert MATCHER is not None  # noqa: S101 -- import-time upstream-data invariant, not request handling
 
 #: Wire token Claude Code substitutes for the repo root; agentseam 0.2.0's vendor-config
 #: schema carries no repo-root-token field yet, so the fact still lives here.
-PROJECT_DIR_TOKEN = "${CLAUDE_PROJECT_DIR}"
+PROJECT_DIR_TOKEN = "${CLAUDE_PROJECT_DIR}"  # noqa: S105 -- a shell variable reference, not a credential
 
 # Witnessed overrides: chock's agent-hooks file speaks `preToolUse` with bash/powershell/
 # timeoutSec entry keys (live deny, data/witnesses.json: vscode_copilot x agent-hooks);
diff --git a/src/chock/compile/emitters/mcp_gateway.py b/src/chock/compile/emitters/mcp_gateway.py
index 4662a2c..0a5882e 100644
--- a/src/chock/compile/emitters/mcp_gateway.py
+++ b/src/chock/compile/emitters/mcp_gateway.py
@@ -16,7 +16,7 @@
 }
 
 
-def emit(policy_dir: Path, output_dir: Path, manifest: dict[str, Any]) -> list[Path]:
+def emit(_policy_dir: Path, output_dir: Path, manifest: dict[str, Any]) -> list[Path]:
     """Emit gateway-gate.json when the policy's gate kind has a gateway runtime."""
     gate = (manifest.get("hook") or {}).get("gate") or {}
     kind = gate.get("kind")
diff --git a/src/chock/compile/levels.py b/src/chock/compile/levels.py
index 695379e..1071844 100644
--- a/src/chock/compile/levels.py
+++ b/src/chock/compile/levels.py
@@ -57,10 +57,11 @@ def level_rank(level: str) -> int:
     try:
         return IN_AGENT_LEVELS.index(level)
     except ValueError:
-        raise ValueError(
+        msg = (
             f"{level!r} has no rank on the in-agent ladder {IN_AGENT_LEVELS}; "
             f"{UNRANKED_LEVELS} describe different mechanisms and are deliberately unranked"
-        ) from None
+        )
+        raise ValueError(msg) from None
 
 
 BASIS_CAP = {
@@ -86,10 +87,11 @@ def cap_for(basis: str) -> str:
     try:
         return BASIS_CAP[basis]
     except KeyError:
-        raise ValueError(
+        msg = (
             f"no cap recorded for basis {basis!r}; a new evidence kind must be given a ceiling "
             f"before a grade may rest on it, not default to the strongest word"
-        ) from None
+        )
+        raise ValueError(msg) from None
 
 
 def weakest_basis(bases: Iterable[str]) -> str | None:
@@ -119,7 +121,8 @@ def resting_bases(mapped: str) -> tuple[str, ...]:
 def in_agent_level(agent: str, *, degrades_to: str = CONTROL_DEGRADES_TO) -> str:
     """The honest word for an INSTALLED in-agent pre-execution control on `agent`."""
     if degrades_to not in DEGRADATION_MODES:
-        raise ValueError(f"unknown degradation mode {degrades_to!r}; expected one of {DEGRADATION_MODES}")
+        msg = f"unknown degradation mode {degrades_to!r}; expected one of {DEGRADATION_MODES}"
+        raise ValueError(msg)
     mapped = _mapped_vendor(agent)
     if not mapped:
         return "none"
@@ -132,7 +135,7 @@ def in_agent_grade(agent: str, surface: str, *, degrades_to: str = CONTROL_DEGRA
     """`in_agent_level` with the evidence that bounds it and chock's own witness for `surface`."""
     mapped = _mapped_vendor(agent)
     if not mapped:
-        return Grade("none", None, False)
+        return Grade("none", None, witnessed=False)
     return Grade(
         in_agent_level(agent, degrades_to=degrades_to),
         weakest_basis(resting_bases(mapped)),
diff --git a/src/chock/compile/surfaces.py b/src/chock/compile/surfaces.py
index 1844536..60c9f67 100644
--- a/src/chock/compile/surfaces.py
+++ b/src/chock/compile/surfaces.py
@@ -8,6 +8,9 @@
 from chock.hooks.in_agent_install import AGENT_HOOKS_VENDORS
 from chock.vendors import CHOCK_AGENT
 
+#: Shared by every CLI subcommand that takes a required, non-empty `--agents` option.
+AGENTS_ARG_REQUIRED_MSG = "--agents requires at least one agent name"
+
 
 class Surface(str, Enum):
     AMBIENT_RULE = "ambient-rule"
@@ -31,10 +34,11 @@ class Surface(str, Enum):
 
 for _agent in IN_AGENT_TODAY:
     if not _matrix_can_block(_agent):  # pragma: no cover - membership already derives from can_block
-        raise AssertionError(
+        _msg = (
             f"agentseam's matrix no longer confirms {_agent!r} can block a pre-tool call; "
             "in-agent membership must be re-derived, not silently kept"
         )
+        raise AssertionError(_msg)
     _surface = Surface.AGENT_HOOKS if CHOCK_AGENT[_agent] in AGENT_HOOKS_VENDORS else Surface.PRE_TOOL_USE
     SURFACE_AGENTS[_agent].add(_surface)
 del _agent, _surface
@@ -55,7 +59,7 @@ def coverage_cell(
     supported = SURFACE_AGENTS.get(agent, set())
     active = emitted & supported if supported else set()
     if not active:
-        return Grade("none", None, False)
+        return Grade("none", None, witnessed=False)
 
     for installed, surface in (
         (pre_tool_use_installed, Surface.PRE_TOOL_USE),
@@ -67,10 +71,10 @@ def coverage_cell(
     if ci_gate_installed:
         commit_time |= active & INSTALLED_SURFACES & {Surface.CI_GATE}
     if commit_time:
-        return Grade("enforced-at-commit", None, False)
+        return Grade("enforced-at-commit", None, witnessed=False)
     if Surface.AMBIENT_RULE in active & INSTALLED_SURFACES:
-        return Grade("advisory", None, False)
-    return Grade("none", None, False)
+        return Grade("advisory", None, witnessed=False)
+    return Grade("none", None, witnessed=False)
 
 
 def coverage_level(
@@ -96,11 +100,12 @@ def parse_agent_selection(groups: list[str], valid: dict[str, object] | None = N
     valid = SURFACE_AGENTS if valid is None else valid
     agents: list[str] = []
     for group in groups:
-        for name in group.split(","):
-            name = name.strip()
+        for raw_name in group.split(","):
+            name = raw_name.strip()
             if name and name not in agents:
                 agents.append(name)
     unknown = [a for a in agents if a not in valid]
     if unknown:
-        raise ValueError(f"unknown agent(s): {', '.join(unknown)} -- valid: {', '.join(sorted(valid))}")
+        msg = f"unknown agent(s): {', '.join(unknown)} -- valid: {', '.join(sorted(valid))}"
+        raise ValueError(msg)
     return agents
diff --git a/src/chock/config.py b/src/chock/config.py
index 424657b..4a8c19c 100644
--- a/src/chock/config.py
+++ b/src/chock/config.py
@@ -29,10 +29,11 @@ def agents_from_config(repo_root: Path) -> list[str]:
         return sorted(SURFACE_AGENTS)
     unknown = [a for a in configured if a not in SURFACE_AGENTS]
     if unknown:
-        raise ValueError(
+        msg = (
             f".chock/config.yaml supported_agents: unknown agent(s): {', '.join(unknown)}"
             f" -- valid: {', '.join(sorted(SURFACE_AGENTS))}"
         )
+        raise ValueError(msg)
     deduped: list[str] = []
     for name in configured:
         if name not in deduped:
@@ -75,7 +76,7 @@ def policy_status(
     }
 
 
-def set_disabled(repo_root: Path | str, policy_id: str, disabled: bool) -> None:
+def set_disabled(repo_root: Path | str, policy_id: str, *, disabled: bool) -> None:
     """Add or remove a policy from policies.disabled; round-trip the config file."""
     path = Path(repo_root) / CONFIG_DIR / CONFIG_NAME
     config = load_config(repo_root) or {}
diff --git a/src/chock/eval/cli.py b/src/chock/eval/cli.py
index 1f85e6d..1f9b4b8 100644
--- a/src/chock/eval/cli.py
+++ b/src/chock/eval/cli.py
@@ -50,7 +50,7 @@ def main(argv: list[str] | None = None) -> int:
         return 2
 
     results = [run_deterministic(policy, repo_root) for policy in policies]
-    print(render_json(results) if args.json else render_text(results, args.verbose))
+    print(render_json(results) if args.json else render_text(results, verbose=args.verbose))
     return 1 if any(r.blocking for r in results) else 0
 
 
diff --git a/src/chock/eval/derive.py b/src/chock/eval/derive.py
index f625106..5a57d74 100644
--- a/src/chock/eval/derive.py
+++ b/src/chock/eval/derive.py
@@ -5,6 +5,7 @@
 from typing import Any
 
 from chock.eval.model import Case
+from chock.gate.schema import DEPENDENCY_ALLOWLIST_KIND
 
 UNLISTED = "chock-derived-eval-absent-package"
 
@@ -17,7 +18,7 @@
 
 _GO_PREFIX = "github.com/absent/"
 
-DERIVABLE_KINDS = ("forbidden_ref", "dependency_allowlist")
+DERIVABLE_KINDS = ("forbidden_ref", DEPENDENCY_ALLOWLIST_KIND)
 
 
 def _case(policy_id: str, suffix: str, category: str, prompt: str, expect: str, execute: dict[str, Any]) -> Case:
@@ -126,7 +127,7 @@ def _dependency_allowlist(policy_id: str, gate: dict[str, Any]) -> list[Case]:
 
 _DERIVERS = {
     "forbidden_ref": _forbidden_ref,
-    "dependency_allowlist": _dependency_allowlist,
+    DEPENDENCY_ALLOWLIST_KIND: _dependency_allowlist,
 }
 
 
diff --git a/src/chock/eval/execute.py b/src/chock/eval/execute.py
index 30a666a..80ab9b2 100644
--- a/src/chock/eval/execute.py
+++ b/src/chock/eval/execute.py
@@ -7,6 +7,7 @@
 import json
 import os
 import shlex
+import shutil
 import subprocess
 import tempfile
 from pathlib import Path
@@ -23,10 +24,14 @@
 ALLOW = "allow"
 ERROR = "error"
 
+#: gate_runner.run()'s process-exit convention: 0 allow, 1 block, 2 spec error.
+_GATE_EXIT_SPEC_ERROR = 2
+_GIT = shutil.which("git") or "git"
+
 
 def _git(repo: Path, *args: str, stdin: str | None = None) -> subprocess.CompletedProcess:
-    return subprocess.run(
-        ["git", *args],
+    return subprocess.run(  # noqa: S603 -- fixture harness: replays a case's own git commands
+        [_GIT, *args],
         cwd=str(repo),
         capture_output=True,
         text=True,
@@ -100,7 +105,7 @@ def _run_gate(repo: Path, gate_spec: dict[str, Any], spec: dict[str, Any]) -> tu
             os.environ[GATE_LOG_ENV] = prior_log
     reason = " ".join(captured.getvalue().split())
 
-    if code == 2:
+    if code == _GATE_EXIT_SPEC_ERROR:
         return ERROR, f"gate reported a spec error: {reason}".strip()
     return (BLOCK if code == 1 else ALLOW), reason or f"gate exit {code}"
 
@@ -117,7 +122,7 @@ def _run_guard(repo: Path, guard: Path, command: str) -> tuple[str, str]:
 
     try:
         env = {**os.environ, "CHOCK_RAW_COMMAND": command}
-        proc = subprocess.run(
+        proc = subprocess.run(  # noqa: S603 -- running the guard under test is the point of this harness
             [bash, str(guard), *args],
             cwd=str(repo),
             capture_output=True,
diff --git a/src/chock/eval/report.py b/src/chock/eval/report.py
index 917d7e4..632431d 100644
--- a/src/chock/eval/report.py
+++ b/src/chock/eval/report.py
@@ -16,7 +16,7 @@ def _trim(detail: str) -> str:
     return detail if len(detail) <= _DETAIL_WIDTH else detail[: _DETAIL_WIDTH - 1] + "…"
 
 
-def render_text(policies: list[PolicyResult], verbose: bool = False) -> str:
+def render_text(policies: list[PolicyResult], *, verbose: bool = False) -> str:
     lines: list[str] = []
     for policy in policies:
         shown = [r for r in policy.results if verbose or r.outcome != "skipped"]
diff --git a/src/chock/eval/suites.py b/src/chock/eval/suites.py
index 0bc5e7f..11d7ecc 100644
--- a/src/chock/eval/suites.py
+++ b/src/chock/eval/suites.py
@@ -84,7 +84,7 @@ def discover_policies(repo_root: Path, policy_id: str | None = None) -> list[Pol
     for _artifact_type, directory in discover_artifacts(Path(repo_root)):
         try:
             loaded = load_manifest(directory)
-        except Exception:
+        except Exception:  # noqa: BLE001, S112 -- best-effort discovery: skip any dir whose manifest fails to load
             continue
         if loaded is None:
             continue
diff --git a/src/chock/evidence.py b/src/chock/evidence.py
index 34697e2..f59e289 100644
--- a/src/chock/evidence.py
+++ b/src/chock/evidence.py
@@ -71,20 +71,23 @@ class Claim(NamedTuple):
 def _text(row: dict[str, Any], field: str, where: str) -> str:
     value = row.get(field)
     if not isinstance(value, str) or not value.strip():
-        raise EvidenceError(f"{where}: {field!r} is missing or empty in {row!r}")
+        msg = f"{where}: {field!r} is missing or empty in {row!r}"
+        raise EvidenceError(msg)
     return value
 
 
 def _one_of(value: str, allowed: tuple[str, ...], field: str, where: str) -> str:
     if value not in allowed:
-        raise EvidenceError(f"{where}: {field}={value!r} is not one of {allowed}")
+        msg = f"{where}: {field}={value!r} is not one of {allowed}"
+        raise EvidenceError(msg)
     return value
 
 
 def _rows(source: Path | list[dict[str, Any]], where: str) -> list[dict[str, Any]]:
     data = json.loads(Path(source).read_text(encoding="utf-8")) if isinstance(source, Path) else source
     if not isinstance(data, list) or any(not isinstance(row, dict) for row in data):
-        raise EvidenceError(f"{where}: expected a list of rows")
+        msg = f"{where}: expected a list of rows"
+        raise EvidenceError(msg)
     return data
 
 
@@ -92,7 +95,8 @@ def _no_duplicates(keys: list[tuple[str, ...]], where: str) -> None:
     seen: set[tuple[str, ...]] = set()
     for key in keys:
         if key in seen:
-            raise EvidenceError(f"{where}: {key} recorded twice; one row per subject or the loser is invisible")
+            msg = f"{where}: {key} recorded twice; one row per subject or the loser is invisible"
+            raise EvidenceError(msg)
         seen.add(key)
 
 
@@ -106,7 +110,8 @@ def parse_witnesses(source: Path | list[dict[str, Any]] | None = None) -> tuple[
         surface = _one_of(_text(row, "surface", where), WITNESS_SURFACES, "surface", where)
         date = _text(row, "date", where)
         if not _DATE.match(date):
-            raise EvidenceError(f"{where}: date={date!r} is not an ISO date; a witness without a day is a vibe")
+            msg = f"{where}: date={date!r} is not an ISO date; a witness without a day is a vibe"
+            raise EvidenceError(msg)
         witnesses.append(Witness(agent, surface, _text(row, "client", where), date, _text(row, "method", where)))
     _no_duplicates([(w.agent, w.surface) for w in witnesses], where)
     return tuple(witnesses)
@@ -123,11 +128,13 @@ def parse_claims(source: Path | list[dict[str, Any]] | None = None) -> tuple[Cla
         verdict = _one_of(_text(row, "verdict", where), WIRE_VERDICTS, "verdict", where)
         honours = row.get("honours")
         if not isinstance(honours, bool):
-            raise EvidenceError(f"{where}: honours is missing or not a boolean in {row!r}")
+            msg = f"{where}: honours is missing or not a boolean in {row!r}"
+            raise EvidenceError(msg)
         evidence = _one_of(_text(row, "evidence", where), CLAIM_EVIDENCE, "evidence", where)
         test = _text(row, "test", where) if evidence == TESTED else row.get("test")
         if evidence != TESTED and test is not None:
-            raise EvidenceError(f"{where}: {agent} {name} names a test but is only {evidence!r}")
+            msg = f"{where}: {agent} {name} names a test but is only {evidence!r}"
+            raise EvidenceError(msg)
         claims.append(Claim(agent, name, verdict, honours, evidence, test))
     _no_duplicates([(c.agent, c.claim) for c in claims], where)
     return tuple(claims)
diff --git a/src/chock/gate/build.py b/src/chock/gate/build.py
index 0db5611..cdd0ee2 100644
--- a/src/chock/gate/build.py
+++ b/src/chock/gate/build.py
@@ -2,11 +2,13 @@
 
 from __future__ import annotations
 
+import contextlib
 import shutil
 from pathlib import Path
 from typing import Any
 
 from chock.config import load_config
+from chock.manifest import load_manifest
 
 
 def _resolve_dotted(config: dict[str, Any], key: str) -> Any:
@@ -21,8 +23,6 @@ def _resolve_dotted(config: dict[str, Any], key: str) -> Any:
 
 def build_gate_json(policy_dir: Path, repo_root: Path) -> dict[str, Any] | None:
     """Load a manifest hook.gate, resolve config references, and return a flat gate.json dict."""
-    from chock.manifest import load_manifest
-
     result = load_manifest(policy_dir)
     if result is None:
         return None
@@ -55,15 +55,14 @@ def vendor_runner(artifact_root: Path) -> Path:
     """Copy the stdlib-only runner into `<artifact_root>/bin/gate.py`."""
     source = Path(__file__).resolve().parent / "runner.py"
     if not source.exists():
-        raise FileNotFoundError(
+        msg = (
             f"Vendored gate runner source not found at {source}. "
             "If this is a packaged binary, ensure gate/runner.py is bundled as a data file."
         )
+        raise FileNotFoundError(msg)
     dest = Path(artifact_root) / "bin" / "gate.py"
     dest.parent.mkdir(parents=True, exist_ok=True)
     shutil.copy2(source, dest)
-    try:
+    with contextlib.suppress(OSError):
         dest.chmod(0o755)
-    except OSError:
-        pass
     return dest
diff --git a/src/chock/gate/data/imports.py.tmpl b/src/chock/gate/data/imports.py.tmpl
index ab40fad..703fe92 100644
--- a/src/chock/gate/data/imports.py.tmpl
+++ b/src/chock/gate/data/imports.py.tmpl
@@ -1,5 +1,6 @@
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
diff --git a/src/chock/gate/guard_runner.py b/src/chock/gate/guard_runner.py
index f184521..a9ae218 100644
--- a/src/chock/gate/guard_runner.py
+++ b/src/chock/gate/guard_runner.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import os
 import shlex
 import subprocess
@@ -47,10 +48,11 @@ def find_bash(guard: Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = subprocess.run(
+            proc = subprocess.run(  # noqa: S603 -- probing candidate shells is this function's job
                 [candidate, "-c", f'test -f "{guard.as_posix()}"'],
                 capture_output=True,
                 timeout=10,
+                check=False,
             )
         except (OSError, subprocess.SubprocessError):
             continue
@@ -76,7 +78,7 @@ def run_guard(guard: Path, command: str) -> str:
 
     try:
         env = {**os.environ, "CHOCK_RAW_COMMAND": command}
-        proc = subprocess.run(
+        proc = subprocess.run(  # noqa: S603 -- running the guard script against the command is the feature
             [bash, str(guard), *args],
             capture_output=True,
             text=True,
@@ -84,6 +86,7 @@ def run_guard(guard: Path, command: str) -> str:
             errors="replace",
             env=env,
             timeout=_GUARD_TIMEOUT_SECONDS,
+            check=False,
         )
     except subprocess.TimeoutExpired:
         print(
@@ -111,7 +114,7 @@ def run_guard(guard: Path, command: str) -> str:
     return GUARD_CLEAN
 
 
-def log_outcome(guard: Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if os.environ.get(GATE_LOG_ENV) == "0":
@@ -131,8 +134,6 @@ def log_outcome(guard: Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / "gate-events.jsonl"
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / "gate-events.1.jsonl")
-        import json
-
         record = {
             "ts": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
             "policy_id": guard.parent.parent.name,
@@ -144,7 +145,7 @@ def log_outcome(guard: Path, tool: str, blocked: bool) -> None:
         }
         with log_path.open("a", encoding="utf-8") as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + "\n")
-    except Exception:
+    except Exception:  # noqa: BLE001 -- best effort logging: never raises, never changes the verdict
         return
 
 
@@ -155,7 +156,7 @@ def evaluate(argv: list[str], command: str, tool: str = "") -> tuple[str, str] |
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f"Blocked by chock policy: {guard.stem}")
     if verdict == GUARD_ERRORED:
diff --git a/src/chock/gate/runner.py b/src/chock/gate/runner.py
index 32073d4..95b7ecd 100644
--- a/src/chock/gate/runner.py
+++ b/src/chock/gate/runner.py
@@ -8,6 +8,7 @@
 import json
 import os
 import re
+import shutil
 import subprocess
 import sys
 import tomllib
@@ -15,6 +16,8 @@
 from datetime import datetime, timezone
 from pathlib import Path
 
+_GIT = shutil.which("git") or "git"
+
 
 @dataclass
 class GateResult:
@@ -44,8 +47,8 @@ def _range(self) -> list[str]:
 
     def _git(self, *args: str) -> str:
         try:
-            proc = subprocess.run(
-                ["git", "-c", "core.quotePath=false", *args],
+            proc = subprocess.run(  # noqa: S603 -- reading repo facts via git is this class's whole job
+                [_GIT, "-c", "core.quotePath=false", *args],
                 cwd=str(self.repo_root),
                 capture_output=True,
                 text=True,
@@ -53,9 +56,10 @@ def _git(self, *args: str) -> str:
                 errors="replace",
                 check=True,
             )
-            return proc.stdout or ""
         except (subprocess.CalledProcessError, FileNotFoundError, UnicodeError):
             return ""
+        else:
+            return proc.stdout or ""
 
     def rev_exists(self, ref: str) -> bool:
         """True when `ref` resolves to a commit. Used to fail CI closed on a missing base."""
@@ -91,14 +95,15 @@ def push_refs(self) -> list[str]:
         refs: list[str] = []
         for line in self._push_stdin.splitlines():
             parts = line.split()
-            if len(parts) >= 3:
+            if len(parts) >= _PUSH_LINE_MIN_PARTS:
                 refs.append(parts[2])
         return refs
 
 
-def _kind_content_regex(ctx: GateContext, params: dict, event: str) -> GateResult:
+def _kind_content_regex(ctx: GateContext, params: dict, _event: str) -> GateResult:
     content_re = re.compile(params["content_pattern"])
-    path_re = re.compile(params["forbidden_path_regex"]) if params.get("forbidden_path_regex") else None
+    forbidden_path_regex = params.get("forbidden_path_regex")
+    path_re = re.compile(forbidden_path_regex) if forbidden_path_regex else None
     pragma_re = re.compile(params["allowlist_pragma"]) if params.get("allowlist_pragma") else None
     scan = params.get("scan", "added_lines")
     diff_filter = params.get("diff_filter", "ACMRT")
@@ -140,7 +145,7 @@ def _deps_requirements(text: str) -> set[str]:
     names: set[str] = set()
     for line in text.splitlines():
         s = line.strip()
-        if not s or s.startswith("#") or s.startswith("-"):
+        if not s or s.startswith(("#", "-")):
             continue
         m = _REQ_RE.match(line)
         if m:
@@ -206,11 +211,11 @@ def _extract(path: str, text: str) -> set[str]:
         return set()
     try:
         return fn(text)
-    except Exception:
+    except Exception:  # noqa: BLE001 -- untrusted, possibly-malformed manifest content; never crash the gate on it
         return set()
 
 
-def _kind_dependency_allowlist(ctx: GateContext, params: dict, event: str) -> GateResult:
+def _kind_dependency_allowlist(ctx: GateContext, params: dict, _event: str) -> GateResult:
     watched = set(params.get("manifests", []))
     allow: set[str] = set()
     allow_path = ctx.repo_root / params["allowlist_file"]
@@ -241,6 +246,15 @@ def _kind_dependency_allowlist(ctx: GateContext, params: dict, event: str) -> Ga
 _LOG_MAX_BYTES = 1_048_576
 _LOG_MATCH_CAP = 20
 
+#: A pre-push stdin line is `<local ref> <local sha> <remote ref> <remote sha>`;
+#: at least 3 whitespace-separated parts to reach the remote ref at index 2.
+_PUSH_LINE_MIN_PARTS = 3
+
+#: `<repo>/.chock/compiled/<policy>/git-hook/<script>`.resolve().parents needs at
+#: least 4 entries to reach the `compiled` directory at index 2 and its parent
+#: (the `.chock` root) at index 3.
+_MIN_COMPILED_PATH_DEPTH = 4
+
 
 def _log_outcome(gate_path: Path, event: str, spec: dict, result: GateResult) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
@@ -248,7 +262,7 @@ def _log_outcome(gate_path: Path, event: str, spec: dict, result: GateResult) ->
         if os.environ.get(GATE_LOG_ENV) == "0":
             return
         parents = gate_path.resolve().parents
-        if len(parents) < 4 or parents[2].name != "compiled":
+        if len(parents) < _MIN_COMPILED_PATH_DEPTH or parents[2].name != "compiled":
             return
         log_dir = parents[3] / "log"
         log_dir.mkdir(parents=True, exist_ok=True)
@@ -267,7 +281,7 @@ def _log_outcome(gate_path: Path, event: str, spec: dict, result: GateResult) ->
         }
         with log_path.open("a", encoding="utf-8") as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + "\n")
-    except Exception:
+    except Exception:  # noqa: BLE001 -- best effort logging: never raises, never changes the verdict
         return
 
 
@@ -321,8 +335,8 @@ def run(
 
 def _repo_root() -> Path:
     try:
-        out = subprocess.check_output(
-            ["git", "rev-parse", "--show-toplevel"], text=True, encoding="utf-8", errors="replace"
+        out = subprocess.check_output(  # noqa: S603 -- finding the repo root via git is this fallback's job
+            [_GIT, "rev-parse", "--show-toplevel"], text=True, encoding="utf-8", errors="replace"
         )
         return Path(out.strip())
     except (subprocess.CalledProcessError, FileNotFoundError, UnicodeError):
diff --git a/src/chock/gate/runtime_bundle.py b/src/chock/gate/runtime_bundle.py
index cf59f47..4bcda64 100644
--- a/src/chock/gate/runtime_bundle.py
+++ b/src/chock/gate/runtime_bundle.py
@@ -25,6 +25,7 @@
 _RENAME = {
     "os": "_chock_os",
     "shlex": "_chock_shlex",
+    "shutil": "_chock_shutil",
     "subprocess": "_chock_subprocess",
     "datetime": "_chock_datetime",
     "timezone": "_chock_timezone",
@@ -55,7 +56,7 @@ def _extract(module) -> str:
 
 
 _DISPATCH = _DATA_DIR.joinpath("dispatch.py.tmpl").read_text(encoding="utf-8")
-_DISPATCH_BRANCH_TOKEN = "# __SESSION_START_BRANCH__\n"
+_DISPATCH_BRANCH_TOKEN = "# __SESSION_START_BRANCH__\n"  # noqa: S105 -- a template marker, not a credential
 
 _SESSION_START_BRANCH = _DATA_DIR.joinpath("session_start_branch.py.tmpl").read_text(encoding="utf-8")
 
diff --git a/src/chock/gate/schema.py b/src/chock/gate/schema.py
index e6fa7e0..6838a76 100644
--- a/src/chock/gate/schema.py
+++ b/src/chock/gate/schema.py
@@ -6,10 +6,16 @@
 
 SUPPORTED_MANIFESTS = sorted(EXTRACTORS)
 
+#: Gate kind name -- shared with eval/derive.py, which cannot import this framework-side
+#: module's sibling (the vendored, stdlib-only gate/runner.py duplicates it independently).
+DEPENDENCY_ALLOWLIST_KIND = "dependency_allowlist"
+
+#: Every param schema below is a closed object -- no undeclared keys.
+_CLOSED_OBJECT = {"type": "object", "additionalProperties": False}
+
 KIND_PARAM_SCHEMAS: dict[str, dict] = {
     "content_regex": {
-        "type": "object",
-        "additionalProperties": False,
+        **_CLOSED_OBJECT,
         "required": ["content_pattern"],
         "properties": {
             "scan": {"type": "string", "enum": ["added_lines", "staged_blob"]},
@@ -20,17 +26,15 @@
         },
     },
     "forbidden_ref": {
-        "type": "object",
-        "additionalProperties": False,
+        **_CLOSED_OBJECT,
         "required": ["refs"],
         "properties": {
             "refs": {"type": "array", "minItems": 1, "items": {"type": "string"}},
             "config_key": {"type": "string"},
         },
     },
-    "dependency_allowlist": {
-        "type": "object",
-        "additionalProperties": False,
+    DEPENDENCY_ALLOWLIST_KIND: {
+        **_CLOSED_OBJECT,
         "required": ["manifests", "allowlist_file"],
         "properties": {
             "manifests": {
@@ -42,8 +46,7 @@
         },
     },
     "egress_allowlist": {
-        "type": "object",
-        "additionalProperties": False,
+        **_CLOSED_OBJECT,
         "required": ["allowed_hosts"],
         "properties": {
             "allowed_hosts": {"type": "array", "minItems": 1, "items": {"type": "string", "minLength": 1}},
diff --git a/src/chock/gate/sessionstart.py b/src/chock/gate/sessionstart.py
index c08f61d..79a38fc 100644
--- a/src/chock/gate/sessionstart.py
+++ b/src/chock/gate/sessionstart.py
@@ -3,9 +3,12 @@
 from __future__ import annotations
 
 import os
+import shutil
 import subprocess
 from pathlib import Path
 
+_GIT = shutil.which("git") or "git"
+
 _INSTRUCTION = (
     "Chock: this clone's git hooks are NOT installed -- git never clones hooks, "
     "so commit-time gates will not run locally until someone runs:\n"
@@ -22,12 +25,13 @@ def _repo_root() -> Path:
 def _hooks_pre_commit(repo_root: Path) -> Path | None:
     """The active pre-commit hook path, honouring core.hooksPath. None when git is absent."""
     try:
-        proc = subprocess.run(
-            ["git", "rev-parse", "--git-path", "hooks"],
+        proc = subprocess.run(  # noqa: S603 -- reading the hooks path via git is this function's job
+            [_GIT, "rev-parse", "--git-path", "hooks"],
             cwd=repo_root,
             capture_output=True,
             text=True,
             timeout=15,
+            check=False,
         )
     except (OSError, subprocess.TimeoutExpired):
         return None
@@ -50,7 +54,10 @@ def _armed(repo_root: Path) -> bool:
 
 
 def _chock_importable() -> bool:
-    import importlib.util
+    # The vendored runtime bundle's fixed import set (chock/gate/data/imports.py.tmpl)
+    # doesn't carry importlib.util -- composing that dotted attribute access through the
+    # bundle's Name-only renamer isn't worth the complexity for one call site.
+    import importlib.util  # noqa: PLC0415
 
     try:
         return importlib.util.find_spec("chock") is not None
diff --git a/src/chock/gateway/gates.py b/src/chock/gateway/gates.py
index e531230..d3c63dd 100644
--- a/src/chock/gateway/gates.py
+++ b/src/chock/gateway/gates.py
@@ -69,10 +69,7 @@ def _hosts_in(text: str) -> Iterator[str]:
 
     def _emit(authority: str) -> Iterator[str]:
         authority = authority.rsplit("@", 1)[-1]
-        if authority.startswith("["):
-            host = authority[1:].split("]", 1)[0]
-        else:
-            host = authority.split(":", 1)[0]
+        host = authority[1:].split("]", 1)[0] if authority.startswith("[") else authority.split(":", 1)[0]
         host = host.lower().rstrip(".")
         key = host or "\x00no-host"
         if key not in seen:
@@ -121,7 +118,7 @@ def _eval_egress_allowlist(spec: dict[str, Any], arguments: Any) -> str | None:
 RUNTIME_KINDS = tuple(sorted(_EVALUATORS))
 
 
-def evaluate(gates: list[dict[str, Any]], tool_name: str, arguments: Any) -> str | None:
+def evaluate(gates: list[dict[str, Any]], _tool_name: str, arguments: Any) -> str | None:
     """First blocking message across all gates, or None to allow."""
     for spec in gates:
         kind = spec.get("kind")
diff --git a/src/chock/gateway/proxy.py b/src/chock/gateway/proxy.py
index 14d993c..323c71e 100644
--- a/src/chock/gateway/proxy.py
+++ b/src/chock/gateway/proxy.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import json
 import subprocess
 import sys
@@ -26,10 +27,8 @@ def _blocked_response(request_id: Any, message: str) -> str:
 
 def _force_utf8(stream: Any) -> None:
     """Best-effort: pin a text stream to UTF-8 with replacement."""
-    try:
+    with contextlib.suppress(AttributeError, ValueError, OSError):
         stream.reconfigure(encoding="utf-8", errors="replace")
-    except (AttributeError, ValueError, OSError):
-        pass
 
 
 class Gateway:
@@ -48,7 +47,7 @@ def _write_out(self, line: str, stream: TextIO) -> None:
 
     def start_downstream(self, *, pipe_output: bool = True) -> None:
         """Spawn the wrapped server. `pipe_output=False` is for tests that read the"""
-        self.process = subprocess.Popen(
+        self.process = subprocess.Popen(  # noqa: S603 -- spawning the configured downstream MCP server is the feature
             self.downstream_argv,
             stdin=subprocess.PIPE,
             stdout=subprocess.PIPE,
@@ -62,14 +61,12 @@ def start_downstream(self, *, pipe_output: bool = True) -> None:
             threading.Thread(target=self._pipe_downstream, daemon=True).start()
 
     def _pipe_downstream(self) -> None:
-        assert self.process and self.process.stdout
+        assert self.process and self.process.stdout  # noqa: S101 -- start_downstream() always runs first
         for line in self.process.stdout:
             self._write_out(line, sys.stdout)
         self._downstream_ended.set()
-        try:
+        with contextlib.suppress(OSError, ValueError):
             sys.stdin.close()
-        except (OSError, ValueError):
-            pass
 
     def _block_message(self, item: Any) -> str | None:
         """Block message for a single request object, or None to allow it."""
diff --git a/src/chock/hooks/autocompile.py b/src/chock/hooks/autocompile.py
index f40e30e..7cb599d 100644
--- a/src/chock/hooks/autocompile.py
+++ b/src/chock/hooks/autocompile.py
@@ -2,9 +2,15 @@
 
 from __future__ import annotations
 
-import sys
 from pathlib import Path
 
+import yaml
+
+from chock.compile.surfaces import Surface
+from chock.config import agents_from_config, load_config, policy_status
+from chock.output import warn
+from chock.policies import discover_policy_dirs
+
 
 def compile_one_dropin(
     pack_dir: Path,
@@ -14,12 +20,6 @@ def compile_one_dropin(
     repo_root: Path | None = None,
 ) -> bool:
     """Compile a single drop-in policy's git-hook output. Returns True if it compiled."""
-    import yaml
-
-    from chock.compile.compiler import compile_policy
-    from chock.compile.surfaces import Surface
-    from chock.config import policy_status
-
     mf_path = pack_dir / "manifest.yaml"
     if not mf_path.exists():
         return False
@@ -40,6 +40,10 @@ def compile_one_dropin(
     if expected.is_dir() and any(expected.iterdir()):
         return False
 
+    # Tests patch chock.compile.compiler.compile_policy directly (test_engine_scan.py,
+    # test_agent_selection.py), which only takes effect on a fresh per-call lookup.
+    from chock.compile.compiler import compile_policy  # noqa: PLC0415
+
     compile_policy(
         pack_dir,
         targets=[Surface.GIT_HOOK.value],
@@ -54,14 +58,11 @@ def compile_one_dropin(
 def auto_compile(repo_root: Path) -> None:
     """Compile any policy that has a hook gate but no compiled git-hook output yet."""
     try:
-        from chock.config import agents_from_config, load_config
-        from chock.policies import discover_policy_dirs
-
         config = load_config(repo_root)
         agents = agents_from_config(repo_root)
         pack_dirs = discover_policy_dirs(repo_root)
     except Exception as exc:  # noqa: BLE001
-        print(f"[WARN] auto-compile could not enumerate policies: {exc}", file=sys.stderr)
+        warn(f"auto-compile could not enumerate policies: {exc}")
         return
 
     compiled_root = repo_root / ".chock" / "compiled"
@@ -69,7 +70,4 @@ def auto_compile(repo_root: Path) -> None:
         try:
             compile_one_dropin(pack_dir, config, compiled_root, agents=agents, repo_root=repo_root)
         except Exception as exc:  # noqa: BLE001
-            print(
-                f"[WARN] skipped policy '{pack_dir.name}': {exc}. Other policies still compiled.",
-                file=sys.stderr,
-            )
+            warn(f"skipped policy '{pack_dir.name}': {exc}. Other policies still compiled.")
diff --git a/src/chock/hooks/in_agent_generic.py b/src/chock/hooks/in_agent_generic.py
index 385eb64..500e709 100644
--- a/src/chock/hooks/in_agent_generic.py
+++ b/src/chock/hooks/in_agent_generic.py
@@ -26,7 +26,8 @@ def load_config(path: Path) -> dict:
             if isinstance(loaded, dict):
                 settings = loaded
         except (json.JSONDecodeError, OSError):
-            raise ValueError(f"{path} is not readable JSON; leaving it untouched") from None
+            msg = f"{path} is not readable JSON; leaving it untouched"
+            raise ValueError(msg) from None
     return settings
 
 
diff --git a/src/chock/hooks/in_agent_install.py b/src/chock/hooks/in_agent_install.py
index 410d4d0..5e056e9 100644
--- a/src/chock/hooks/in_agent_install.py
+++ b/src/chock/hooks/in_agent_install.py
@@ -242,7 +242,8 @@ def install_hooks(repo_root: Path, vendor: str) -> list[str]:
         return install_generic(repo_root, vendor)
     if vendor == _OWNED_FILE_VENDOR:
         return _install_agent_hooks(repo_root)
-    raise ValueError(f"no in-agent wiring for vendor {vendor!r}; wired: {WIRED_VENDORS}")
+    msg = f"no in-agent wiring for vendor {vendor!r}; wired: {WIRED_VENDORS}"
+    raise ValueError(msg)
 
 
 def _installed_agent_hooks_entries(repo_root: Path) -> list[dict]:
@@ -265,8 +266,6 @@ def installed_policy_ids(repo_root: Path, vendor: str) -> set[str]:
         return installed_generic_ids(repo_root, vendor)
     if vendor == _OWNED_FILE_VENDOR:
         installed = _installed_agent_hooks_entries(repo_root)
-        if not installed:
-            return set()
         return {pid for pid, entry in _compiled_agent_hooks(repo_root).items() if entry in installed}
 
     wiring = _MERGED[vendor]
diff --git a/src/chock/hooks/install.py b/src/chock/hooks/install.py
index ea26d0a..40b3301 100644
--- a/src/chock/hooks/install.py
+++ b/src/chock/hooks/install.py
@@ -4,11 +4,12 @@
 from __future__ import annotations
 
 import argparse
+import shutil
 import subprocess
-import sys
 from pathlib import Path
 
-from chock.hooks.installers import (  # noqa: F401
+from chock.hooks.in_agent_install import WIRED_VENDORS, install_hooks, install_label
+from chock.hooks.installers import (
     DISPATCHER_TEMPLATE,
     GENERATED_MARKER,
     INTERPRETER_PLACEHOLDER,
@@ -23,6 +24,9 @@
     is_git_repo,
     relocate_existing_hook,
 )
+from chock.hooks.sessionstart_install import install_sessionstart_hook
+from chock.output import error, warn
+from chock.scaffold.recompile import refresh_after_install
 
 __all__ = [
     "DISPATCHER_TEMPLATE",
@@ -49,13 +53,14 @@ def main(argv=None) -> int:
     if args.repo_root:
         repo_root = Path(args.repo_root).resolve()
     else:
+        git = shutil.which("git") or "git"
         repo_root = Path(
-            subprocess.check_output(
-                ["git", "rev-parse", "--show-toplevel"], text=True, encoding="utf-8", errors="replace"
+            subprocess.check_output(  # noqa: S603 -- finding the repo root via git is this branch's job
+                [git, "rev-parse", "--show-toplevel"], text=True, encoding="utf-8", errors="replace"
             ).strip()
         )
     if not is_git_repo(repo_root):
-        print(f"[ERROR] {NOT_A_GIT_REPO.format(root=repo_root)}", file=sys.stderr)
+        error(NOT_A_GIT_REPO.format(root=repo_root))
         return 1
 
     hooks_dir = get_hooks_dir(repo_root)
@@ -64,30 +69,24 @@ def main(argv=None) -> int:
     install_validate_hook(hooks_dir, repo_root)
     install_policy_hooks(repo_root, hooks_dir)
 
-    from chock.hooks.in_agent_install import WIRED_VENDORS, install_hooks, install_label
-
     wired = False
     for vendor in WIRED_VENDORS:
         try:
             installed = install_hooks(repo_root, vendor)
         except ValueError as exc:
-            print(f"[WARN] {exc}", file=sys.stderr)
+            warn(str(exc))
         else:
             if installed:
                 print(f"Registered {len(installed)} {install_label(vendor)}")
                 wired = True
     if wired:
-        from chock.scaffold.recompile import refresh_after_install
-
         refresh_after_install(repo_root)
 
-    from chock.hooks.sessionstart_install import install_sessionstart_hook
-
     try:
         if install_sessionstart_hook(repo_root):
             print("Registered SessionStart arm hook in .claude/settings.json")
     except ValueError as exc:
-        print(f"[WARN] {exc}", file=sys.stderr)
+        warn(str(exc))
     return 0
 
 
diff --git a/src/chock/hooks/installers.py b/src/chock/hooks/installers.py
index 36a5ce5..2a1c70a 100644
--- a/src/chock/hooks/installers.py
+++ b/src/chock/hooks/installers.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import shutil
 import subprocess
 import sys
@@ -15,19 +16,21 @@
     relocate_existing_hook,
     remove_self_relocated_hook,
 )
+from chock.output import warn
 from chock.resources import package_data_dir
 
 _DATA_DIR = package_data_dir("chock.hooks", "data")
 DISPATCHER_TEMPLATE = _DATA_DIR.joinpath("dispatcher.sh").read_text(encoding="utf-8")
 _VALIDATE_WRAPPER_WINDOWS_TEMPLATE = _DATA_DIR.joinpath("validate_wrapper_windows.sh").read_text(encoding="utf-8")
 _POLICY_WRAPPER_TEMPLATE = _DATA_DIR.joinpath("policy_wrapper.sh").read_text(encoding="utf-8")
+_GIT = shutil.which("git") or "git"
 
 
 def _git(repo_root: Path, *args: str) -> str | None:
     """Answer a read-only git query from inside `repo_root`. None when git cannot answer."""
     try:
-        return subprocess.check_output(
-            ["git", *args],
+        return subprocess.check_output(  # noqa: S603 -- reading repo facts via git is this helper's job
+            [_GIT, *args],
             text=True,
             encoding="utf-8",
             errors="replace",
@@ -114,7 +117,7 @@ def _render_hook(source: Path, dest: Path) -> None:
     write_generated(dest, rendered)
 
 
-def install_validate_hook(hooks_dir: Path, repo_root: Path) -> None:
+def install_validate_hook(hooks_dir: Path, _repo_root: Path) -> None:
     """Install the Chock validate hook into pre-commit.d/."""
     impl_dir = hooks_dir / "pre-commit.d"
     impl_dir.mkdir(parents=True, exist_ok=True)
@@ -132,10 +135,8 @@ def install_validate_hook(hooks_dir: Path, repo_root: Path) -> None:
         impl = impl_dir / "99-chock-validate"
         _render_hook(source_dir / "pre-commit", impl)
 
-    try:
+    with contextlib.suppress(OSError):
         impl.chmod(0o755)
-    except Exception:
-        pass
     print(f"Implementation registered at {impl}")
 
 
@@ -150,7 +151,7 @@ def _discover_policy_hooks(repo_root: Path, script_name: str) -> list[Path]:
 def install_policy_hooks(repo_root: Path, hooks_dir: Path) -> None:
     """Discover compiler-generated git-pre-commit.sh and git-pre-push.sh and register them."""
     if not is_git_repo(repo_root):
-        print(f"[WARN] {NOT_A_GIT_REPO.format(root=repo_root)}", file=sys.stderr)
+        warn(NOT_A_GIT_REPO.format(root=repo_root))
         return
 
     auto_compile(repo_root)
@@ -177,8 +178,6 @@ def install_policy_hooks(repo_root: Path, hooks_dir: Path) -> None:
             rel = _repo_relative(impl_source, repo_root)
             content = _POLICY_WRAPPER_TEMPLATE.replace("__MARKER__", GENERATED_MARKER).replace("__SOURCE_REL__", rel)
             write_generated(wrapper, content)
-            try:
+            with contextlib.suppress(OSError):
                 wrapper.chmod(0o755)
-            except Exception:
-                pass
         print(f"Registered {len(implementations)} {event} policy implementation(s)")
diff --git a/src/chock/hooks/runtime_vendor.py b/src/chock/hooks/runtime_vendor.py
index 5c3d304..e6b9845 100644
--- a/src/chock/hooks/runtime_vendor.py
+++ b/src/chock/hooks/runtime_vendor.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 from pathlib import Path
 
 from chock.gate import runtime_bundle
@@ -16,8 +17,6 @@ def vendor_runtime(repo_root: Path, agent: str) -> Path:
     dest = Path(repo_root) / runtime_rel(agent)
     dest.parent.mkdir(parents=True, exist_ok=True)
     dest.write_text(runtime_bundle.render(agent), encoding="utf-8")
-    try:
+    with contextlib.suppress(OSError):
         dest.chmod(0o755)
-    except OSError:
-        pass
     return dest
diff --git a/src/chock/hooks/sessionstart_install.py b/src/chock/hooks/sessionstart_install.py
index 71aa73d..71f414a 100644
--- a/src/chock/hooks/sessionstart_install.py
+++ b/src/chock/hooks/sessionstart_install.py
@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import json
-import sys
 from pathlib import Path
 
 from agentseam import contract as _contract
@@ -17,6 +16,7 @@
     _normalize_fragment,
 )
 from chock.hooks.runtime_vendor import runtime_rel, vendor_runtime
+from chock.output import warn
 
 SETTINGS_REL = Path(vendors.config_path("claude_code"))
 ARM_EVENT = vendors.wire_event("claude_code", _contract.SESSION_START)
@@ -57,7 +57,8 @@ def install_sessionstart_hook(repo_root: Path) -> bool:
             if isinstance(loaded, dict):
                 settings = loaded
         except (json.JSONDecodeError, OSError):
-            raise ValueError(f"{settings_path} is not readable JSON; leaving it untouched") from None
+            msg = f"{settings_path} is not readable JSON; leaving it untouched"
+            raise ValueError(msg) from None
 
     hooks = settings.setdefault("hooks", {}) if isinstance(settings.get("hooks", {}), dict) else {}
     settings["hooks"] = hooks
@@ -76,7 +77,7 @@ def install_sessionstart_hook(repo_root: Path) -> bool:
 
     vendor_adapter(repo_root)
 
-    desired = kept + [install_form]
+    desired = [*kept, install_form]
     if isinstance(existing, list) and desired == existing:
         return False
     hooks[ARM_EVENT] = desired
@@ -90,7 +91,7 @@ def main(argv: list[str] | None = None) -> int:  # pragma: no cover - thin CLI s
     try:
         changed = install_sessionstart_hook(root)
     except ValueError as exc:
-        print(f"[WARN] {exc}", file=sys.stderr)
+        warn(str(exc))
         return 1
     print("SessionStart arm hook " + ("installed" if changed else "already current"))
     return 0
diff --git a/src/chock/index/builder.py b/src/chock/index/builder.py
index 26a6933..de362d2 100644
--- a/src/chock/index/builder.py
+++ b/src/chock/index/builder.py
@@ -2,15 +2,17 @@
 
 from __future__ import annotations
 
-import sys
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
 import yaml
 
+from chock.compile.emitters.advisory import substitute_policy_vars, template_message
 from chock.config import _disabled_list, load_config
+from chock.gate.build import build_gate_json
 from chock.manifest import ManifestSourceError, load_manifest
+from chock.output import warn
 
 _ENFORCEMENT_ORDER = {"block": 0, "verify": 1, "advise": 2}
 
@@ -54,9 +56,6 @@ def _load_policy(root: Path, artifact_dir: Path, warnings: list[str]) -> tuple[d
 
 def _summarize_hook(manifest: dict[str, Any], artifact_dir: Path, root: Path) -> str:
     """One-line gate summary from a hook manifest, resolved against this repo's config."""
-    from chock.compile.emitters.advisory import template_message
-    from chock.gate.build import build_gate_json
-
     gate = (manifest.get("hook") or {}).get("gate") or {}
     if gate.get("message"):
         spec = build_gate_json(artifact_dir, root)
@@ -79,8 +78,6 @@ def _entry_from_manifest(artifact_dir: Path, manifest: dict[str, Any], rel_path:
     pid = _default_id(artifact_dir, manifest)
     name = manifest.get("name") or pid
     enforcement = manifest.get("enforcement") or "advise"
-    from chock.compile.emitters.advisory import substitute_policy_vars
-
     rule_text = substitute_policy_vars(str((manifest.get("rule") or {}).get("text", "")), artifact_dir)
     description = _one_liner(manifest.get("description", ""))
 
@@ -100,7 +97,8 @@ def _entry_from_manifest(artifact_dir: Path, manifest: dict[str, Any], rel_path:
 
 def build_entries(root: Path) -> tuple[list[IndexEntry], list[str]]:
     """Return a list of active IndexEntry objects plus any manifest warnings."""
-    from chock.validation.loading import discover_artifacts
+    # chock.validation.loading -> chock.validation (package) -> checks_repo -> this module (cycle).
+    from chock.validation.loading import discover_artifacts  # noqa: PLC0415
 
     config = load_config(root)
     disabled = _disabled_list(config)
@@ -139,4 +137,4 @@ def max_tokens_for(root: Path, default: int = 2000) -> int:
 def emit_warnings(warnings: list[str]) -> None:
     """Print collected manifest warnings to stderr."""
     for message in warnings:
-        print(f"[WARN] {message}", file=sys.stderr)
+        warn(message)
diff --git a/src/chock/index/cli.py b/src/chock/index/cli.py
index f392bbb..297b9bb 100644
--- a/src/chock/index/cli.py
+++ b/src/chock/index/cli.py
@@ -9,6 +9,7 @@
 from chock.emit import write_generated
 from chock.index.builder import build_entries, emit_warnings, max_tokens_for
 from chock.index.render import render_index
+from chock.output import error, warn
 from chock.scaffold.agents_md import is_stale as agents_md_is_stale
 from chock.scaffold.agents_md import update_agents_md
 from chock.scaffold.skills_bridge import update_skill_bridges
@@ -53,7 +54,7 @@ def _report_cost(output) -> None:
     if output.extended is not None:
         print(f"INDEX-extended.md: ~{output.extended_tokens} tokens (demoted advise entries)")
     if output.warning:
-        print(f"[WARN] {output.warning}", file=sys.stderr)
+        warn(output.warning)
 
 
 def is_stale(root: Path) -> tuple[bool, str | None]:
@@ -85,13 +86,13 @@ def cmd_refresh(argv: list[str] | None = None) -> int:
     try:
         output = _generate(root)
     except OSError as exc:
-        print(f"[ERROR] Failed to read repository files: {exc}", file=sys.stderr)
+        error(f"Failed to read repository files: {exc}")
         return 2
 
     if args.check:
         stale, reason = is_stale(root)
         if output.warning:
-            print(f"[WARN] {output.warning}", file=sys.stderr)
+            warn(output.warning)
         if stale:
             print(reason, file=sys.stderr)
             return 1
diff --git a/src/chock/index/render.py b/src/chock/index/render.py
index 45b41fe..a6e0b1e 100644
--- a/src/chock/index/render.py
+++ b/src/chock/index/render.py
@@ -34,7 +34,7 @@ def _skill_line(entry: IndexEntry) -> str:
     return f"- **{entry.id}** — {entry.description or 'no description'}\n  → `{entry.manifest_path}`"
 
 
-def _render_main(entries: list[IndexEntry], has_extended: bool) -> str:
+def _render_main(entries: list[IndexEntry], *, has_extended: bool) -> str:
     lines: list[str] = [_HEADER, "", _TITLE, ""]
     sections: dict[str, list[str]] = {"rule": [], "hook": [], "skill": []}
 
@@ -71,7 +71,7 @@ def _render_extended(entries: list[IndexEntry]) -> str:
     ]
     for entry in entries:
         if entry.artifact == "rule":
-            lines.extend(_rule_lines(entry) + [""])
+            lines.extend([*_rule_lines(entry), ""])
         elif entry.artifact == "hook":
             lines.append(_gate_line(entry) + "\n")
         else:
@@ -99,7 +99,7 @@ def render_index(entries: Iterable[IndexEntry], max_tokens: int) -> IndexOutput:
     while True:
         main = [e for e in sorted_entries if e.id not in demoted]
         has_extended = bool(demoted)
-        text = _render_main(main, has_extended)
+        text = _render_main(main, has_extended=has_extended)
         tokens = _token_estimate(text)
         if tokens <= max_tokens:
             break
@@ -114,7 +114,7 @@ def render_index(entries: Iterable[IndexEntry], max_tokens: int) -> IndexOutput:
             break
 
     main = [e for e in sorted_entries if e.id not in demoted]
-    main_text = _render_main(main, bool(demoted))
+    main_text = _render_main(main, has_extended=bool(demoted))
     main_tokens = _token_estimate(main_text)
 
     extended_text: str | None = None
diff --git a/src/chock/lock.py b/src/chock/lock.py
index fecad70..c91e8b0 100644
--- a/src/chock/lock.py
+++ b/src/chock/lock.py
@@ -10,6 +10,7 @@
 from typing import Any
 
 from chock.manifest import resolve_manifest_path
+from chock.vendored import vendored_differences
 
 LOCKFILE_NAME = "chock.lock"
 LOCKFILE_VERSION = "1"
@@ -57,7 +58,7 @@ def compute_artifacts_hash(repo_root: Path, policy_id: str) -> str | None:
     return compute_pack_hash(compiled_dir)
 
 
-def build_lock(repo_root: Path, source_root: Path | None = None) -> dict[str, Any]:
+def build_lock(repo_root: Path) -> dict[str, Any]:
     """Build a lockfile from the policies installed in a repo."""
     lock: dict[str, Any] = {
         "lockfile_version": LOCKFILE_VERSION,
@@ -93,8 +94,6 @@ def verify_lock(repo_root: Path | None = None) -> tuple[bool, list[str]]:
     lock = read_lock(repo_root)
     failures: list[str] = []
 
-    from chock.vendored import vendored_differences
-
     failures += [
         f"vendored runtime modified ({d}) -- this is what executes gates" for d in vendored_differences(repo_root)
     ]
@@ -128,7 +127,7 @@ def main(argv: list[str] | None = None) -> int:
     argv = list(argv or [])
     valid_commands = {"init", "verify"}
     if not argv or argv[0] not in valid_commands:
-        argv = ["verify"] + argv
+        argv = ["verify", *argv]
 
     root_parser = argparse.ArgumentParser(add_help=False)
     root_parser.add_argument("--root", "--repo", default=".", dest="root", help="Repo root")
diff --git a/src/chock/manifest.py b/src/chock/manifest.py
index 25b341c..2b6620e 100644
--- a/src/chock/manifest.py
+++ b/src/chock/manifest.py
@@ -13,6 +13,14 @@
 MANIFEST_NAMES: tuple[str, ...] = (CANONICAL_MANIFEST,)
 SKILL_MD = "SKILL.md"
 INTERFACE_YAML = "interface.yaml"
+#: manifest.security's field name gating whether in-content instructions may be obeyed (SEC-1).
+CONTENT_INSTRUCTIONS_KEY = "content_instructions"
+#: Boolean top-level manifest fields, coerced via _as_bool rather than passed through.
+DETERMINIZATION_REVIEWED_KEY = "determinization_reviewed"
+AGENT_SPECIFIC_VOCABULARY_KEY = "agent_specific_vocabulary"
+
+#: Longest a manifest/frontmatter `name` may be before it's flagged.
+_MAX_NAME_LENGTH = 128
 
 
 class ManifestSourceError(Exception):
@@ -71,7 +79,8 @@ def _project_skill_frontmatter(
     ac = _chock_metadata(frontmatter)
 
     if "description" not in frontmatter or frontmatter["description"] is None:
-        raise ManifestSourceError("description is a required frontmatter field")
+        msg = "description is a required frontmatter field"
+        raise ManifestSourceError(msg)
 
     data: dict[str, Any] = {}
 
@@ -79,13 +88,11 @@ def _project_skill_frontmatter(
     if not isinstance(front_name, str):
         front_name = str(front_name)
 
-    if front_name != artifact_dir.name:
-        if warnings is not None:
-            warnings.append(f"frontmatter name '{front_name}' does not match directory name '{artifact_dir.name}'")
+    if front_name != artifact_dir.name and warnings is not None:
+        warnings.append(f"frontmatter name '{front_name}' does not match directory name '{artifact_dir.name}'")
 
-    if len(front_name) > 128:
-        if warnings is not None:
-            warnings.append(f"name exceeds 128 characters ({len(front_name)})")
+    if len(front_name) > _MAX_NAME_LENGTH and warnings is not None:
+        warnings.append(f"name exceeds 128 characters ({len(front_name)})")
 
     data["id"] = ac.get("id") or artifact_dir.name
     data["name"] = ac.get("name") or front_name
@@ -105,7 +112,9 @@ def _project_skill_frontmatter(
     _set_or_default(data, "lifecycle.status", lifecycle.get("status"), "draft", warnings)
 
     security = ac.get("security") or {}
-    _set_or_default(data, "security.content_instructions", security.get("content_instructions"), "never-obey", warnings)
+    _set_or_default(
+        data, "security.content_instructions", security.get(CONTENT_INSTRUCTIONS_KEY), "never-obey", warnings
+    )
 
     skill_type = ac.get("skill_type")
     _set_or_default(data, "skill.skill_type", skill_type, "nl", warnings)
@@ -115,6 +124,7 @@ def _project_skill_frontmatter(
     if "approval" in ac:
         data["skill"]["approval"] = ac["approval"]
 
+    bool_keys = (DETERMINIZATION_REVIEWED_KEY, AGENT_SPECIFIC_VOCABULARY_KEY)
     for key in [
         "applies_to",
         "optimization",
@@ -123,13 +133,13 @@ def _project_skill_frontmatter(
         "conflicts_with",
         "bundle",
         "categories",
-        "determinization_reviewed",
+        DETERMINIZATION_REVIEWED_KEY,
         "scripts",
         "compliance",
-        "agent_specific_vocabulary",
+        AGENT_SPECIFIC_VOCABULARY_KEY,
     ]:
         if key in ac:
-            if key in ("determinization_reviewed", "agent_specific_vocabulary"):
+            if key in bool_keys:
                 data[key] = _as_bool(ac[key])
             else:
                 data[key] = ac[key]
@@ -181,10 +191,7 @@ def _parse_skill_frontmatter(text: str) -> dict[str, Any]:
     if end == -1:
         return {}
 
-    try:
-        return yaml.safe_load("\n".join(lines[:end])) or {}
-    except yaml.YAMLError:
-        raise
+    return yaml.safe_load("\n".join(lines[:end])) or {}
 
 
 def normalize_manifest(data: dict[str, Any]) -> dict[str, Any]:
@@ -221,7 +228,8 @@ def load_manifest(
     has_manifest = (artifact_dir / CANONICAL_MANIFEST).exists()
     has_skill = (artifact_dir / SKILL_MD).exists()
     if has_manifest and has_skill:
-        raise ManifestSourceError(f"both {CANONICAL_MANIFEST} and {SKILL_MD} are present; remove one")
+        msg = f"both {CANONICAL_MANIFEST} and {SKILL_MD} are present; remove one"
+        raise ManifestSourceError(msg)
 
     data = load_manifest_file(path, warnings)
     interface = _load_interface(artifact_dir, warnings)
diff --git a/src/chock/output.py b/src/chock/output.py
new file mode 100644
index 0000000..3077992
--- /dev/null
+++ b/src/chock/output.py
@@ -0,0 +1,27 @@
+"""Shared stderr diagnostics: one place owning the `[WARN]`/`[ERROR]` prefix convention."""
+
+from __future__ import annotations
+
+import sys
+
+# CodeQL (py/clear-text-logging-sensitive-data) flags both prints below by name-based
+# heuristic, not by an actual credential flow: every caller passes a diagnostic string --
+# an exception message, a file path, or an INDEX token-BUDGET count. The traced source is
+# index/render.py's `max_tokens`/`main_tokens` (LLM context-window counts, not auth tokens)
+# reaching index/cli.py's `warn(output.warning)`. compile/emitters/in_agent.py's
+# PROJECT_DIR_TOKEN (a literal shell placeholder string, already ruled non-sensitive at its
+# own definition: bandit S105) does not reach either function below -- it is only ever
+# written to disk via write_generated_json, never logged. Audited every warn()/error() call
+# site in src/; none carries credential material. T201/ERA001 are file-scoped in
+# pyproject.toml: this is the designated output surface, and the codeql[...] suppression
+# comments below read as commented-out code to ERA001.
+
+
+def warn(message: str) -> None:
+    # codeql[py/clear-text-logging-sensitive-data]
+    print(f"[WARN] {message}", file=sys.stderr)
+
+
+def error(message: str) -> None:
+    # codeql[py/clear-text-logging-sensitive-data]
+    print(f"[ERROR] {message}", file=sys.stderr)
diff --git a/src/chock/packs/__init__.py b/src/chock/packs/__init__.py
index f1313db..90ea886 100644
--- a/src/chock/packs/__init__.py
+++ b/src/chock/packs/__init__.py
@@ -24,4 +24,4 @@ def to_path(traversable: Traversable) -> Path:
     return Path(str(traversable))
 
 
-__all__ = ["packs_root", "to_path", "Traversable"]
+__all__ = ["Traversable", "packs_root", "to_path"]
diff --git a/src/chock/plugin/build.py b/src/chock/plugin/build.py
index b4daf2f..735897c 100644
--- a/src/chock/plugin/build.py
+++ b/src/chock/plugin/build.py
@@ -40,11 +40,12 @@ class PluginNameError(ValueError):
 def plugin_name(policy_id: str) -> str:
     """Validate a policy id as an Agent Plugins `name`."""
     if len(policy_id) > _NAME_MAX or not _NAME_PATTERN.match(policy_id):
-        raise PluginNameError(
+        msg = (
             f"policy id {policy_id!r} is not a valid Agent Plugins name: "
             f"lowercase alphanumerics, dots and hyphens, no leading/trailing separator, "
             f"no '--' or '..', max {_NAME_MAX} chars"
         )
+        raise PluginNameError(msg)
     return policy_id
 
 
diff --git a/src/chock/plugin/claude.py b/src/chock/plugin/claude.py
index f9711c4..685d7d4 100644
--- a/src/chock/plugin/claude.py
+++ b/src/chock/plugin/claude.py
@@ -54,7 +54,7 @@ def _hook_command(script: str) -> str:
     return f'python3 "{adapter}" --guard "{guard}"'
 
 
-def build_claude_manifest(manifest: dict[str, Any], policy_dir: Path, enforced: bool) -> dict[str, Any]:
+def build_claude_manifest(manifest: dict[str, Any], policy_dir: Path, *, enforced: bool) -> dict[str, Any]:
     """Derive `.claude-plugin/plugin.json` from a policy manifest."""
     policy_id = manifest.get("id") or Path(policy_dir).name
     provenance = manifest.get("provenance") or {}
diff --git a/src/chock/plugin/cli.py b/src/chock/plugin/cli.py
index eaa5e38..2649c41 100644
--- a/src/chock/plugin/cli.py
+++ b/src/chock/plugin/cli.py
@@ -9,6 +9,7 @@
 
 from chock.compile.compiler import _load_manifest
 from chock.manifest import CANONICAL_MANIFEST
+from chock.output import error
 from chock.plugin.build import (
     NAMESPACE,
     PluginNameError,
@@ -116,7 +117,7 @@ def main(argv: list[str] | None = None) -> int:
                     else:
                         build_plugin(policy_dir, manifest, repo_root, out_dir=target)
                 else:
-                    assert target is not None
+                    assert target is not None  # noqa: S101 -- hook_formats requiring --out-dir was checked above
                     differ, build = HOOK_EMITTERS[fmt]
                     if args.check:
                         differences.extend(differ(policy_dir, manifest, repo_root, target))
@@ -125,7 +126,7 @@ def main(argv: list[str] | None = None) -> int:
             if not args.check:
                 written += 1
         except PluginNameError as exc:
-            print(f"[ERROR] {policy_dir}: {exc}", file=sys.stderr)
+            error(f"{policy_dir}: {exc}")
             return 2
 
     if out_root is not None:
diff --git a/src/chock/plugin/codex.py b/src/chock/plugin/codex.py
index 9851e81..1fb7e8c 100644
--- a/src/chock/plugin/codex.py
+++ b/src/chock/plugin/codex.py
@@ -59,7 +59,7 @@ def _hook_command(script: str) -> str:
     return f'python3 "{adapter}" --guard "{guard}"'
 
 
-def build_codex_manifest(manifest: dict[str, Any], policy_dir: Path, enforced: bool) -> dict[str, Any]:
+def build_codex_manifest(manifest: dict[str, Any], policy_dir: Path, *, enforced: bool) -> dict[str, Any]:
     """Derive `.codex-plugin/plugin.json` from a policy manifest."""
     policy_id = str(manifest.get("id") or Path(policy_dir).name)
     provenance = manifest.get("provenance") or {}
diff --git a/src/chock/plugin/copilot.py b/src/chock/plugin/copilot.py
index 95d455a..c6f3f24 100644
--- a/src/chock/plugin/copilot.py
+++ b/src/chock/plugin/copilot.py
@@ -51,14 +51,14 @@
 
 def _hook_command(script: str) -> str:
     """One interpreter invocation, guarded so an unresolved plugin root ALLOWS."""
-    assert PLUGIN_ROOT.startswith("${") and PLUGIN_ROOT.endswith("}"), PLUGIN_ROOT
+    assert PLUGIN_ROOT.startswith("${") and PLUGIN_ROOT.endswith("}"), PLUGIN_ROOT  # noqa: S101 -- build-time constant, not request input
     root = f"{PLUGIN_ROOT[:-1]}:-}}"
     adapter = f'"$r/{_SCRIPTS_TEMPLATE.format(name="vscode_copilot.py")}"'
     guard = f'"$r/{_SCRIPTS_TEMPLATE.format(name=script)}"'
     return f'r="{root}"; [ -n "$r" ] && [ -f {adapter} ] || exit 0; exec python3 {adapter} --guard {guard}'
 
 
-def build_copilot_manifest(manifest: dict[str, Any], policy_dir: Path, enforced: bool) -> dict[str, Any]:
+def build_copilot_manifest(manifest: dict[str, Any], policy_dir: Path, *, enforced: bool) -> dict[str, Any]:
     """Derive the root `plugin.json` from a policy manifest."""
     data = build_manifest(manifest, policy_dir)
     posture = POSTURE_ENFORCED_COPILOT if enforced else POSTURE_ADVISORY
diff --git a/src/chock/plugin/cursor.py b/src/chock/plugin/cursor.py
index 0c01c5c..b62709a 100644
--- a/src/chock/plugin/cursor.py
+++ b/src/chock/plugin/cursor.py
@@ -60,7 +60,7 @@ def _hook_command(script: str) -> str:
     return f'python3 "{adapter}" --guard "{guard}"'
 
 
-def build_cursor_manifest(manifest: dict[str, Any], policy_dir: Path, enforced: bool) -> dict[str, Any]:
+def build_cursor_manifest(manifest: dict[str, Any], policy_dir: Path, *, enforced: bool) -> dict[str, Any]:
     """Derive `.cursor-plugin/plugin.json` from a policy manifest."""
     policy_id = str(manifest.get("id") or Path(policy_dir).name)
     provenance = manifest.get("provenance") or {}
diff --git a/src/chock/plugin/marketplace.py b/src/chock/plugin/marketplace.py
index 15af7de..6e88a86 100644
--- a/src/chock/plugin/marketplace.py
+++ b/src/chock/plugin/marketplace.py
@@ -112,11 +112,16 @@ def lock_differences(dist_root: Path) -> list[str]:
 CATALOG_DOCS = "https://github.com/open-coder-ai/chock-catalog/blob/main/docs"
 
 
+#: Summaries longer than this are truncated (at _SUMMARY_TRUNCATE_AT) with an ellipsis.
+_SUMMARY_MAX_LEN = 99
+_SUMMARY_TRUNCATE_AT = 96
+
+
 def _summary(description: str) -> str:
     """First sentence of the description, with the bracketed posture note stripped."""
-    text = description.split("[")[0].strip()
+    text = description.split("[", maxsplit=1)[0].strip()
     first = text.split(". ")[0].strip().rstrip(".")
-    return (first[:96].rstrip() + "...") if len(first) > 99 else first
+    return (first[:_SUMMARY_TRUNCATE_AT].rstrip() + "...") if len(first) > _SUMMARY_MAX_LEN else first
 
 
 def render_catalog_page(dist_root: Path, tree: str = CLAUDE_TREE) -> str:
diff --git a/src/chock/plugin/store.py b/src/chock/plugin/store.py
index 33341dd..0e213bc 100644
--- a/src/chock/plugin/store.py
+++ b/src/chock/plugin/store.py
@@ -20,7 +20,7 @@
 #: this one constant, borrowed from the two agents where agentseam does record it, instead
 #: of repeating the literal.
 SCRIPTS_TEMPLATE = packaging.supports("claude_code", packaging.EXECUTABLE)
-assert SCRIPTS_TEMPLATE == packaging.supports("copilot", packaging.EXECUTABLE)
+assert packaging.supports("copilot", packaging.EXECUTABLE) == SCRIPTS_TEMPLATE  # noqa: S101 -- import-time cross-check of two upstream constants
 
 
 def owned_subtrees(store: str) -> tuple[str, ...]:
diff --git a/src/chock/policy_id.py b/src/chock/policy_id.py
index 6038f02..e1950a3 100644
--- a/src/chock/policy_id.py
+++ b/src/chock/policy_id.py
@@ -7,16 +7,18 @@
 POLICY_ID_RE = re.compile(r"^[a-z][a-z0-9-]{2,63}$")
 
 
-class InvalidPolicyId(ValueError):
+class InvalidPolicyIdError(ValueError):
     """A policy id is unsafe to use as a path or command token, or disagrees with its folder."""
 
 
 def validate_policy_id(policy_id: str, folder_name: str) -> None:
-    """Raise InvalidPolicyId unless `policy_id` is schema-valid and equals its folder name."""
+    """Raise InvalidPolicyIdError unless `policy_id` is schema-valid and equals its folder name."""
     if not isinstance(policy_id, str) or not POLICY_ID_RE.fullmatch(policy_id):
-        raise InvalidPolicyId(
+        msg = (
             f"policy id {policy_id!r} is not a valid identifier (must match {POLICY_ID_RE.pattern}); "
             "refusing to use it as a filesystem path or command token"
         )
+        raise InvalidPolicyIdError(msg)
     if policy_id != folder_name:
-        raise InvalidPolicyId(f"policy id {policy_id!r} does not match its folder name {folder_name!r}")
+        msg = f"policy id {policy_id!r} does not match its folder name {folder_name!r}"
+        raise InvalidPolicyIdError(msg)
diff --git a/src/chock/registry/core.py b/src/chock/registry/core.py
index 8c1ec7b..ef6e242 100644
--- a/src/chock/registry/core.py
+++ b/src/chock/registry/core.py
@@ -142,7 +142,7 @@ def compute_script_hashes(artifact_dir: Path, manifest: dict[str, Any]) -> dict[
     return hashes
 
 
-def extract_dependencies(data: dict[str, Any], artifact: str) -> list[str]:
+def extract_dependencies(data: dict[str, Any], _artifact: str) -> list[str]:
     deps: list[str] = []
     deps_data = data.get("dependencies", {})
     for dep in deps_data.get("skills", []):
@@ -157,7 +157,8 @@ def entry_from_manifest(
     artifact_dir = manifest_path.parent
     result = load_manifest(artifact_dir, warnings=warnings)
     if result is None:
-        raise ManifestSourceError(f"no manifest in {artifact_dir}")
+        msg = f"no manifest in {artifact_dir}"
+        raise ManifestSourceError(msg)
     data, resolved_path = result
     rel_path = resolved_path.parent.relative_to(root).as_posix()
     return RegistryEntry(
@@ -204,6 +205,16 @@ def save_registry(entries: dict[str, list[RegistryEntry]], root: Path | None = N
     write_generated_json(registry_path(root), data)
 
 
+def rescan_and_report(root: Path | None = None) -> None:
+    """Rescan the artifact registry, print any manifest-parse skips, then persist it."""
+    entries, skips = scan(root)
+    if skips:
+        print(f"[WARN] {len(skips)} manifest(s) skipped during registry scan:")
+        for skip in skips:
+            print(f"  [ERROR] {skip.path} :: manifest_parse: {skip.reason}")
+    save_registry(entries, root)
+
+
 def load_registry(root: Path | None = None) -> dict[str, list[RegistryEntry]]:
     root = root or repo_root()
     path = registry_path(root)
@@ -214,14 +225,14 @@ def load_registry(root: Path | None = None) -> dict[str, list[RegistryEntry]]:
 
 
 def resolve(
-    id: str,
+    artifact_id: str,
     version: str | None = None,
     artifact_type: str | None = None,
     root: Path | None = None,
 ) -> RegistryEntry | None:
     """Resolve an ID to the best matching registry entry."""
     entries = load_registry(root)
-    versions = entries.get(id, [])
+    versions = entries.get(artifact_id, [])
     if not versions:
         return None
 
diff --git a/src/chock/review/cli.py b/src/chock/review/cli.py
index 6f1b521..2451855 100644
--- a/src/chock/review/cli.py
+++ b/src/chock/review/cli.py
@@ -8,6 +8,7 @@
 from pathlib import Path
 
 from chock.emit import write_generated
+from chock.output import error
 from chock.review.evidence import (
     EVIDENCE_DIR,
     EvidenceError,
@@ -23,7 +24,7 @@
 def _emit(args: argparse.Namespace) -> int:
     root = Path(args.repo).resolve()
     checks = args.checks or sorted(check_registry(root))
-    evidence = build(root, args.base, {"kind": args.kind, "id": args.by}, checks, args.allow_empty)
+    evidence = build(root, args.base, {"kind": args.kind, "id": args.by}, checks, allow_empty=args.allow_empty)
 
     dest = Path(args.out) if args.out else root / EVIDENCE_DIR / f"{evidence['diff_sha'][:12]}.json"
     dest.parent.mkdir(parents=True, exist_ok=True)
@@ -92,7 +93,7 @@ def main(argv: list[str] | None = None) -> int:
     try:
         return int(args.fn(args))
     except EvidenceError as exc:
-        print(f"[ERROR] {exc}", file=sys.stderr)
+        error(str(exc))
         return 2
 
 
diff --git a/src/chock/review/evidence.py b/src/chock/review/evidence.py
index b55bb29..21e3ab9 100644
--- a/src/chock/review/evidence.py
+++ b/src/chock/review/evidence.py
@@ -2,16 +2,21 @@
 
 from __future__ import annotations
 
+import contextlib
 import hashlib
+import io
 import json
+import shutil
 import subprocess
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
+from chock.cli import main as cli_main
 from chock.config import load_config
 
 SCHEMA_URL = "https://open-coder-ai.github.io/chock/schemas/v0/reviewer-evidence-v1.json"
+_GIT = shutil.which("git") or "git"
 
 EMPTY_DIFF_SHA = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
 
@@ -32,9 +37,12 @@ class EvidenceError(RuntimeError):
 
 
 def _git(root: Path, *args: str) -> str:
-    proc = subprocess.run(["git", *args], cwd=root, capture_output=True, encoding="utf-8", errors="replace")
+    proc = subprocess.run(  # noqa: S603 -- reading repo facts via git is this helper's job
+        [_GIT, *args], cwd=root, capture_output=True, encoding="utf-8", errors="replace", check=False
+    )
     if proc.returncode != 0:
-        raise EvidenceError(f"git {' '.join(args)} failed: {proc.stderr.strip()}")
+        msg = f"git {' '.join(args)} failed: {proc.stderr.strip()}"
+        raise EvidenceError(msg)
     return proc.stdout
 
 
@@ -75,16 +83,13 @@ def check_registry(root: Path) -> dict[str, list[str]]:
 
 def run_check(root: Path, argv: list[str]) -> tuple[str, str]:
     """Run one registry entry. Returns (pass|fail, first line of output)."""
-    from chock.cli import main as cli_main
-
     resolved = [a.replace("{root}", str(root)) for a in argv]
     if resolved and resolved[0] == "python":
-        proc = subprocess.run(resolved, cwd=root, capture_output=True, encoding="utf-8", errors="replace")
+        proc = subprocess.run(  # noqa: S603 -- running a repo-registered review check is this function's job
+            resolved, cwd=root, capture_output=True, encoding="utf-8", errors="replace", check=False
+        )
         code, out = proc.returncode, (proc.stdout or proc.stderr)
     else:
-        import contextlib
-        import io
-
         buffer = io.StringIO()
         with contextlib.redirect_stdout(buffer), contextlib.redirect_stderr(buffer):
             try:
@@ -101,7 +106,7 @@ def working_tree_is_dirty(root: Path) -> bool:
 
 
 def build(
-    root: Path, base_ref: str, produced_by: dict[str, str], checks: list[str], allow_empty: bool = False
+    root: Path, base_ref: str, produced_by: dict[str, str], checks: list[str], *, allow_empty: bool = False
 ) -> dict[str, Any]:
     """Run every named check and record the result. Attestations are added by a reviewer."""
     if not allow_empty and diff_sha(root, base_ref) == EMPTY_DIFF_SHA:
@@ -110,15 +115,17 @@ def build(
             if working_tree_is_dirty(root)
             else f"HEAD is identical to {base_ref}"
         )
-        raise EvidenceError(
+        msg = (
             f"nothing to attest: the diff against {base_ref} is empty ({hint}). "
             f"Pass --allow-empty to record evidence for an empty change anyway."
         )
+        raise EvidenceError(msg)
 
     registry = check_registry(root)
     unknown = [c for c in checks if c not in registry]
     if unknown:
-        raise EvidenceError(f"unknown check(s): {', '.join(sorted(unknown))}. Known: {', '.join(sorted(registry))}")
+        msg = f"unknown check(s): {', '.join(sorted(unknown))}. Known: {', '.join(sorted(registry))}"
+        raise EvidenceError(msg)
 
     verified = []
     for name in checks:
@@ -183,4 +190,5 @@ def load(path: Path) -> dict[str, Any]:
     try:
         return json.loads(Path(path).read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError) as exc:
-        raise EvidenceError(f"cannot read evidence at {path}: {exc}") from exc
+        msg = f"cannot read evidence at {path}: {exc}"
+        raise EvidenceError(msg) from exc
diff --git a/src/chock/scaffold/adapters.py b/src/chock/scaffold/adapters.py
index fc6aea3..32b8cca 100644
--- a/src/chock/scaffold/adapters.py
+++ b/src/chock/scaffold/adapters.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 from pathlib import Path
 
 from agentseam import instructions as agentseam_instructions
@@ -56,10 +57,8 @@ def remove_instructions(repo_root: Path, deselected: list[str]) -> dict[str, str
         if path.exists() and not path.read_text(encoding="utf-8").strip():
             path.unlink()
             parent = path.parent
-            try:
+            with contextlib.suppress(OSError):
                 parent.rmdir()
-            except OSError:
-                pass
     if "aider" in deselected:
         conf = Path(repo_root) / _AIDER_CONF_REL
         if conf.exists() and conf.read_text(encoding="utf-8") == packaged_template(_AIDER_CONF_REL):
diff --git a/src/chock/scaffold/add.py b/src/chock/scaffold/add.py
index a80947d..e03692d 100644
--- a/src/chock/scaffold/add.py
+++ b/src/chock/scaffold/add.py
@@ -10,7 +10,12 @@
 from dataclasses import dataclass
 from pathlib import Path
 
+import yaml
+
+from chock.config import agents_from_config as _agents_from_config
 from chock.lock import compute_pack_hash, read_lock, write_lock
+from chock.output import error
+from chock.scaffold.recompile import BookkeepingError, recompile
 
 
 class IntegrityError(RuntimeError):
@@ -27,8 +32,14 @@ class IntegrityError(RuntimeError):
 
 
 def _run(args: list[str], cwd: Path | None = None) -> subprocess.CompletedProcess:
-    return subprocess.run(
-        args, cwd=str(cwd) if cwd else None, capture_output=True, text=True, encoding="utf-8", errors="replace"
+    return subprocess.run(  # noqa: S603 -- running git to fetch the requested catalog is this command's job
+        args,
+        cwd=str(cwd) if cwd else None,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+        check=False,
     )
 
 
@@ -44,7 +55,8 @@ def fetch_catalog(source: str, ref: str | None, into: Path) -> tuple[Path, str |
     args += [source, str(into)]
     result = _run(args)
     if result.returncode != 0:
-        raise RuntimeError(f"could not fetch catalog {source}:\n{result.stderr.strip()}")
+        msg = f"could not fetch catalog {source}:\n{result.stderr.strip()}"
+        raise RuntimeError(msg)
 
     resolved = _run(["git", "rev-parse", "HEAD"], cwd=into)
     return into, (resolved.stdout.strip() or None) if resolved.returncode == 0 else None
@@ -53,7 +65,8 @@ def fetch_catalog(source: str, ref: str | None, into: Path) -> tuple[Path, str |
 def _reject_unsafe_id(artifact_id: str) -> None:
     """Refuse an artifact id that is anything but a single path component."""
     if artifact_id in ("", ".", "..") or "/" in artifact_id or "\\" in artifact_id or Path(artifact_id).is_absolute():
-        raise ValueError(f"invalid artifact id {artifact_id!r}: expected a single name, not a path")
+        msg = f"invalid artifact id {artifact_id!r}: expected a single name, not a path"
+        raise ValueError(msg)
 
 
 def locate(catalog_root: Path, artifact_id: str) -> tuple[Path, Path]:
@@ -63,8 +76,6 @@ def locate(catalog_root: Path, artifact_id: str) -> tuple[Path, Path]:
 
     registry = catalog_root / "registry.yaml"
     if registry.exists():
-        import yaml
-
         data = yaml.safe_load(registry.read_text(encoding="utf-8")) or {}
         for entry in data.get("policies", []) or []:
             if entry.get("id") == artifact_id and entry.get("path"):
@@ -81,7 +92,8 @@ def locate(catalog_root: Path, artifact_id: str) -> tuple[Path, Path]:
             return candidate, dest
 
     searched = ", ".join(f"{a}/" for a in _AREAS)
-    raise FileNotFoundError(f"{artifact_id!r} is not in this catalog (checked registry.yaml and {searched})")
+    msg = f"{artifact_id!r} is not in this catalog (checked registry.yaml and {searched})"
+    raise FileNotFoundError(msg)
 
 
 @dataclass
@@ -98,6 +110,7 @@ def add(
     artifact_id: str,
     source: str,
     ref: str | None,
+    *,
     force: bool,
     verify_sha: str | None = None,
 ) -> Added:
@@ -108,11 +121,13 @@ def add(
 
         digest = compute_pack_hash(src)
         if verify_sha and digest != verify_sha:
-            raise IntegrityError(f"{artifact_id}: expected sha256 {verify_sha}, got {digest}. Nothing was installed.")
+            msg = f"{artifact_id}: expected sha256 {verify_sha}, got {digest}. Nothing was installed."
+            raise IntegrityError(msg)
 
         dest = repo_root / area / artifact_id
         if dest.exists() and not force:
-            raise FileExistsError(f"{area.as_posix()}/{artifact_id} already exists; use --force to replace it")
+            msg = f"{area.as_posix()}/{artifact_id} already exists; use --force to replace it"
+            raise FileExistsError(msg)
         if dest.exists():
             shutil.rmtree(dest)
         dest.parent.mkdir(parents=True, exist_ok=True)
@@ -154,7 +169,7 @@ def main(argv: list[str] | None = None) -> int:
 
     repo_root = Path(args.repo).resolve()
     try:
-        added = add(repo_root, args.artifact_id, args.source, args.ref, args.force, args.verify_sha)
+        added = add(repo_root, args.artifact_id, args.source, args.ref, force=args.force, verify_sha=args.verify_sha)
     except (RuntimeError, FileNotFoundError, FileExistsError) as exc:
         print(f"chock add: {exc}", file=sys.stderr)
         return 1
@@ -172,9 +187,6 @@ def main(argv: list[str] | None = None) -> int:
         print("Run `chock sync --repo .` to compile it.")
         return 0
 
-    from chock.config import agents_from_config as _agents_from_config
-    from chock.scaffold.recompile import BookkeepingError, recompile
-
     try:
         agents = _agents_from_config(repo_root)
     except ValueError as exc:
@@ -183,7 +195,7 @@ def main(argv: list[str] | None = None) -> int:
     try:
         recompile(repo_root, agents, skip_hooks=True)
     except BookkeepingError as exc:
-        print(f"[ERROR] {exc}", file=sys.stderr)
+        error(str(exc))
         return 1
     record_provenance(repo_root, args.artifact_id, args.source, args.ref, added)
     print("Compiled. Run `chock sync --repo .` to activate commit-time enforcement.")
diff --git a/src/chock/scaffold/agents_md.py b/src/chock/scaffold/agents_md.py
index 4df4ce8..2d3a52f 100644
--- a/src/chock/scaffold/agents_md.py
+++ b/src/chock/scaffold/agents_md.py
@@ -7,6 +7,7 @@
 
 from chock.emit import write_generated
 from chock.resources import package_data_dir
+from chock.scaffold.templates import packaged_template
 
 POINTER_START = "<!-- chock:pointer:start -->"
 POINTER_END = "<!-- chock:pointer:end -->"
@@ -23,8 +24,6 @@
 
 
 def _fresh_agents_md() -> str:
-    from chock.scaffold.templates import packaged_template
-
     return packaged_template("AGENTS.md").replace("{{repo_name}}", "chock-consumer")
 
 
diff --git a/src/chock/scaffold/init.py b/src/chock/scaffold/init.py
index bf5d9a6..ea6730e 100644
--- a/src/chock/scaffold/init.py
+++ b/src/chock/scaffold/init.py
@@ -9,9 +9,14 @@
 
 import yaml
 
+from chock.compile.surfaces import AGENTS_ARG_REQUIRED_MSG
+from chock.config import agents_from_config, load_config
 from chock.emit import write_generated
 from chock.hooks.install import NOT_A_GIT_REPO, get_hooks_dir, install_validate_hook, is_git_repo
+from chock.index.cli import cmd_refresh
 from chock.lock import build_lock, write_lock
+from chock.output import error, warn
+from chock.registry.core import rescan_and_report
 from chock.scaffold.adapters import (
     CHOCK_AGENT,
     deselected_agents,
@@ -20,7 +25,8 @@
     write_instructions,
 )
 from chock.scaffold.agents_md import update_agents_md
-from chock.scaffold.recompile import BookkeepingError, recompile
+from chock.scaffold.recompile import BookkeepingError, discover_policy_dirs, recompile
+from chock.scaffold.skills import install_skills
 from chock.scaffold.templates import (
     GITATTRIBUTES_TEMPLATE,
     _dependency_allowlist_template,
@@ -28,9 +34,10 @@
     packaged_template,
     write_vendored_guardrails,
 )
+from chock.validation import engine as validator_engine
 
 
-def _write_agents_md(repo_root: Path, force: bool) -> Path:
+def _write_agents_md(repo_root: Path, *, force: bool) -> Path:
     path = repo_root / "AGENTS.md"
     if force or not path.exists():
         repo_name = repo_root.name or "chock-consumer"
@@ -40,7 +47,7 @@ def _write_agents_md(repo_root: Path, force: bool) -> Path:
     return path
 
 
-def _fresh_config(agents: list[str], agent_agnostic: bool) -> dict[str, object]:
+def _fresh_config(agents: list[str], *, agent_agnostic: bool) -> dict[str, object]:
     text = packaged_template(".chock/config.yaml").format(
         agents=yaml.safe_dump(list(agents), default_flow_style=True).strip(),
         agent_agnostic="true" if agent_agnostic else "false",
@@ -51,8 +58,6 @@ def _fresh_config(agents: list[str], agent_agnostic: bool) -> dict[str, object]:
 
 def _fresh_policies(repo_root: Path, fresh: dict[str, object]) -> dict[str, object]:
     """The template's `policies` block, minus toggles for policies that are not installed."""
-    from chock.scaffold.recompile import discover_policy_dirs
-
     policies = dict(fresh.get("policies") or {})  # type: ignore[arg-type]
     installed = {d.name for d in discover_policy_dirs(repo_root)}
     policies["disabled"] = [pid for pid in policies.get("disabled") or [] if pid in installed]
@@ -60,15 +65,13 @@ def _fresh_policies(repo_root: Path, fresh: dict[str, object]) -> dict[str, obje
     return policies
 
 
-def _write_config(repo_root: Path, agents: list[str], agent_agnostic: bool) -> Path:
+def _write_config(repo_root: Path, agents: list[str], *, agent_agnostic: bool) -> Path:
     """Write .chock/config.yaml, preserving existing policies and user defaults."""
     path = repo_root / ".chock" / "config.yaml"
     path.parent.mkdir(parents=True, exist_ok=True)
 
-    from chock.config import load_config
-
     existing = load_config(repo_root) if path.exists() else {}
-    fresh = _fresh_config(agents, agent_agnostic)
+    fresh = _fresh_config(agents, agent_agnostic=agent_agnostic)
 
     existing_chock = existing.get("chock") or {}
     chock = {**existing_chock, **dict(fresh.get("chock", {}))}
@@ -84,7 +87,7 @@ def _write_config(repo_root: Path, agents: list[str], agent_agnostic: bool) -> P
 
     if not path.exists() or existing != merged:
         if path.exists():
-            print("[WARN] .chock/config.yaml rewritten; YAML comments are not preserved", file=sys.stderr)
+            warn(".chock/config.yaml rewritten; YAML comments are not preserved")
         path.write_text(
             yaml.safe_dump(merged, sort_keys=False, default_flow_style=None, allow_unicode=True),
             encoding="utf-8",
@@ -96,13 +99,11 @@ def _write_config(repo_root: Path, agents: list[str], agent_agnostic: bool) -> P
     return path
 
 
-def _normalize_agents(args_agents: list[str] | None, agent_agnostic: bool, repo_root: Path) -> list[str]:
+def _normalize_agents(args_agents: list[str] | None, *, agent_agnostic: bool, repo_root: Path) -> list[str]:
     if agent_agnostic:
         return sorted(CHOCK_AGENT)
     if args_agents:
         return list(args_agents)
-    from chock.config import agents_from_config, load_config
-
     if (load_config(repo_root).get("chock") or {}).get("supported_agents"):
         return agents_from_config(repo_root)
     return ["claude", "copilot", "gemini"]
@@ -113,8 +114,6 @@ def _normalize_agents(args_agents: list[str] | None, agent_agnostic: bool, repo_
 
 def _report_policy_state(repo_root: Path) -> None:
     """Say plainly whether anything is being enforced, and how to change that."""
-    from chock.scaffold.recompile import discover_policy_dirs
-
     installed = discover_policy_dirs(repo_root)
     if installed:
         print(f"Policies: {len(installed)} installed. Nothing was added or overwritten -- they are yours.")
@@ -142,13 +141,13 @@ def cmd_init(argv: list[str] | None = None) -> int:
         except ValueError as exc:
             parser.error(str(exc))
         if not selection:
-            parser.error("--agents requires at least one agent name")
+            parser.error(AGENTS_ARG_REQUIRED_MSG)
 
     repo_root = Path(args.repo).resolve()
     repo_root.mkdir(parents=True, exist_ok=True)
 
     try:
-        agents = _normalize_agents(selection, args.agent_agnostic, repo_root)
+        agents = _normalize_agents(selection, agent_agnostic=args.agent_agnostic, repo_root=repo_root)
     except ValueError as exc:
         print(str(exc), file=sys.stderr)
         return 2
@@ -164,26 +163,22 @@ def cmd_init(argv: list[str] | None = None) -> int:
     (repo_root / "docs").mkdir(exist_ok=True)
 
     preserved: list[str] = []
-    _write_agents_md(repo_root, args.force)
-    if _preserve_or_write(repo_root / "docs" / "README.md", packaged_template("docs/README.md"), args.force):
+    _write_agents_md(repo_root, force=args.force)
+    if _preserve_or_write(repo_root / "docs" / "README.md", packaged_template("docs/README.md"), force=args.force):
         preserved.append("docs/README.md")
-    if _preserve_or_write(repo_root / ".gitattributes", GITATTRIBUTES_TEMPLATE, args.force):
+    if _preserve_or_write(repo_root / ".gitattributes", GITATTRIBUTES_TEMPLATE, force=args.force):
         preserved.append(".gitattributes")
-    preserved += write_vendored_guardrails(repo_root, args.force)
-    _write_config(repo_root, agents, args.agent_agnostic)
-
-    from chock.scaffold.skills import install_skills
+    preserved += write_vendored_guardrails(repo_root, force=args.force)
+    _write_config(repo_root, agents, agent_agnostic=args.agent_agnostic)
 
     installed_skills = install_skills(repo_root, overwrite=False)
 
     try:
         recompile(repo_root, agents, skip_hooks=skip_hooks)
     except BookkeepingError as exc:
-        print(f"[ERROR] {exc}", file=sys.stderr)
+        error(str(exc))
         return 1
 
-    from chock.index.cli import cmd_refresh
-
     cmd_refresh(["--repo", str(repo_root)])
 
     write_instructions(repo_root, agents)
@@ -195,20 +190,10 @@ def cmd_init(argv: list[str] | None = None) -> int:
     try:
         write_lock(build_lock(repo_root), repo_root)
     except OSError as exc:
-        print(
-            f"[ERROR] chock.lock was not written ({exc}). Re-run `chock init` once the cause is fixed.", file=sys.stderr
-        )
+        error(f"chock.lock was not written ({exc}). Re-run `chock init` once the cause is fixed.")
         return 1
 
-    from chock.registry.core import save_registry, scan
-    from chock.validation import engine as validator_engine
-
-    entries, skips = scan(repo_root)
-    if skips:
-        print(f"[WARN] {len(skips)} manifest(s) skipped during registry scan:")
-        for skip in skips:
-            print(f"  [ERROR] {skip.path} :: manifest_parse: {skip.reason}")
-    save_registry(entries, repo_root)
+    rescan_and_report(repo_root)
 
     if validator_engine.main([str(repo_root)]) != 0:
         return 1
diff --git a/src/chock/scaffold/new.py b/src/chock/scaffold/new.py
index 6a09f64..3cdb70b 100644
--- a/src/chock/scaffold/new.py
+++ b/src/chock/scaffold/new.py
@@ -8,6 +8,9 @@
 from pathlib import Path
 
 import chock
+from chock.index.cli import cmd_refresh
+from chock.output import error
+from chock.registry.core import rescan_and_report
 
 
 class TemplateError(RuntimeError):
@@ -23,13 +26,16 @@ def _render_template(filename: str, **values: str) -> str:
     try:
         template = path.read_text(encoding="utf-8")
     except OSError as exc:
-        raise TemplateError(f"Unable to read template '{path}': {exc.strerror or exc}") from exc
+        msg = f"Unable to read template '{path}': {exc.strerror or exc}"
+        raise TemplateError(msg) from exc
     if not template.strip():
-        raise TemplateError(f"Template '{path}' is empty")
+        msg = f"Template '{path}' is empty"
+        raise TemplateError(msg)
     try:
         return template.format(**values)
     except (KeyError, ValueError, IndexError) as exc:
-        raise TemplateError(f"Malformed template '{path}': {exc}") from exc
+        msg = f"Malformed template '{path}': {exc}"
+        raise TemplateError(msg) from exc
 
 
 def _new_policy(id_: str, root: Path) -> None:
@@ -82,19 +88,10 @@ def cmd_new(argv: list[str] | None = None) -> int:
         elif args.artifact == "subagent":
             _new_subagent(args.id, root)
     except TemplateError as exc:
-        print(f"[ERROR] {exc}", file=sys.stderr)
+        error(str(exc))
         return 2
 
-    from chock.registry.core import save_registry, scan
-
-    entries, skips = scan(root)
-    if skips:
-        print(f"[WARN] {len(skips)} manifest(s) skipped during registry scan:")
-        for skip in skips:
-            print(f"  [ERROR] {skip.path} :: manifest_parse: {skip.reason}")
-    save_registry(entries, root)
-
-    from chock.index.cli import cmd_refresh
+    rescan_and_report(root)
 
     cmd_refresh(["--repo", str(root)])
 
diff --git a/src/chock/scaffold/recompile.py b/src/chock/scaffold/recompile.py
index 96a354f..0334401 100644
--- a/src/chock/scaffold/recompile.py
+++ b/src/chock/scaffold/recompile.py
@@ -4,16 +4,21 @@
 
 import json
 import shutil
-import sys
 import tempfile
 from pathlib import Path
 from typing import Any
 
 from chock.compile.compiler import _load_manifest, compile_policy
 from chock.compile.levels import DISABLED, Grade
-from chock.config import load_config, policy_status
+from chock.config import agents_from_config, load_config, policy_status
 from chock.emit import write_generated_json
+from chock.hooks.in_agent_install import WIRED_VENDORS, install_hooks, install_label, installed_policy_ids
+from chock.hooks.installers import get_hooks_dir, install_policy_hooks
+from chock.hooks.sessionstart_install import install_sessionstart_hook
+from chock.index.cli import cmd_refresh
+from chock.output import warn
 from chock.policies import discover_policy_dirs
+from chock.registry.core import save_registry, scan
 from chock.vendored import vendored_differences
 
 
@@ -32,7 +37,7 @@ def _compile_all(repo_root: Path, agents: list[str], compiled_root: Path) -> dic
         status = policy_status(config, policy_id, manifest)
 
         if status["state"] == "disabled":
-            coverage[policy_id] = {agent: Grade(DISABLED, None, False)._asdict() for agent in agents}
+            coverage[policy_id] = {agent: Grade(DISABLED, None, witnessed=False)._asdict() for agent in agents}
             continue
 
         result = compile_policy(
@@ -86,43 +91,41 @@ def compiled_differences(repo_root: Path | str, agents: list[str]) -> list[str]:
 
 def _refresh_bookkeeping(repo_root: Path) -> None:
     """Bring the index and the registry back in line with the policies on disk."""
-    from chock.index.cli import cmd_refresh
-    from chock.registry.core import save_registry, scan
-
     try:
         entries, _skips = scan(repo_root)
         save_registry(entries, repo_root)
     except Exception as exc:  # noqa: BLE001
-        print(f"[WARN] registry scan failed: {exc}. Run `chock registry scan`.", file=sys.stderr)
+        warn(f"registry scan failed: {exc}. Run `chock registry scan`.")
 
     try:
         cmd_refresh(["--repo", str(repo_root)])
     except Exception as exc:  # noqa: BLE001
-        print(f"[WARN] index refresh failed: {exc}. Run `chock sync`.", file=sys.stderr)
+        warn(f"index refresh failed: {exc}. Run `chock sync`.")
 
     try:
-        from chock.lock import build_lock, write_lock
+        # Tests patch chock.lock.write_lock/build_lock directly (test_adopter_safety.py),
+        # which only takes effect on a fresh per-call lookup.
+        from chock.lock import build_lock, write_lock  # noqa: PLC0415
 
         write_lock(build_lock(repo_root), repo_root)
-    except Exception as exc:  # noqa: BLE001
-        raise BookkeepingError(
+    except Exception as exc:
+        msg = (
             f"chock.lock was not updated ({exc}). The compiled artifacts are in place, but the "
             "lockfile still attests the previous ones -- `chock check --only verify` will fail "
             "until a `chock sync --repo .` succeeds."
-        ) from exc
+        )
+        raise BookkeepingError(msg) from exc
 
 
 def refresh_after_install(repo_root: Path) -> None:
     """Recompile so coverage reflects the settings.json an install just wrote."""
     try:
-        from chock.config import agents_from_config
-
         recompile(repo_root, agents_from_config(repo_root), skip_hooks=True)
     except Exception as exc:  # noqa: BLE001 - never fail an install over bookkeeping
-        print(f"[WARN] coverage not refreshed: {exc}. Run `chock sync --repo .`", file=sys.stderr)
+        warn(f"coverage not refreshed: {exc}. Run `chock sync --repo .`")
 
 
-def recompile(repo_root: Path | str, agents: list[str], skip_hooks: bool = False) -> dict[str, Any]:
+def recompile(repo_root: Path | str, agents: list[str], *, skip_hooks: bool = False) -> dict[str, Any]:
     """Compile all enabled policies from a clean compiled/ directory and install hooks."""
     repo_root = Path(repo_root)
     chock_dir = repo_root / ".chock"
@@ -148,19 +151,13 @@ def recompile(repo_root: Path | str, agents: list[str], skip_hooks: bool = False
     write_generated_json(coverage_path, coverage)
 
     if not skip_hooks:
-        from chock.hooks.installers import get_hooks_dir, install_policy_hooks
-
         install_policy_hooks(repo_root, get_hooks_dir(repo_root))
 
-        from chock.hooks.sessionstart_install import install_sessionstart_hook
-
         try:
             if install_sessionstart_hook(repo_root):
                 print("Registered SessionStart arm hook in .claude/settings.json")
         except ValueError as exc:
-            print(f"[WARN] {exc}", file=sys.stderr)
-
-        from chock.hooks.in_agent_install import WIRED_VENDORS, install_hooks, install_label, installed_policy_ids
+            warn(str(exc))
 
         def _witness() -> tuple[set[str], ...]:
             return tuple(installed_policy_ids(repo_root, vendor) for vendor in WIRED_VENDORS)
@@ -170,7 +167,7 @@ def _witness() -> tuple[set[str], ...]:
             try:
                 installed = install_hooks(repo_root, vendor)
             except ValueError as exc:
-                print(f"[WARN] {exc}", file=sys.stderr)
+                warn(str(exc))
             else:
                 if installed:
                     print(f"Registered {len(installed)} {install_label(vendor)}")
diff --git a/src/chock/scaffold/skills.py b/src/chock/scaffold/skills.py
index 3203a1f..d5ad88b 100644
--- a/src/chock/scaffold/skills.py
+++ b/src/chock/scaffold/skills.py
@@ -9,7 +9,9 @@
 from pathlib import Path
 
 import chock
+from chock.index.cli import cmd_refresh
 from chock.packs import packs_root, to_path
+from chock.registry.core import rescan_and_report
 
 AUTHORING_SKILLS = [
     "policy-init",
@@ -132,21 +134,12 @@ def cmd_install_skills(argv: list[str] | None = None) -> int:
         print("No skills installed", file=sys.stderr)
         return 1
 
-    from chock.registry.core import save_registry, scan
-
-    entries, skips = scan(repo_root)
-    if skips:
-        print(f"[WARN] {len(skips)} manifest(s) skipped during registry scan:")
-        for skip in skips:
-            print(f"  [ERROR] {skip.path} :: manifest_parse: {skip.reason}")
-    save_registry(entries, repo_root)
+    rescan_and_report(repo_root)
 
     print(f"Installed {len(installed)} skill(s) into .agents/skills/:")
     for skill_id in installed:
         print(f"  {skill_id}")
 
-    from chock.index.cli import cmd_refresh
-
     cmd_refresh(["--repo", str(repo_root)])
     return 0
 
diff --git a/src/chock/scaffold/skills_bridge.py b/src/chock/scaffold/skills_bridge.py
index 57f218c..b5321d2 100644
--- a/src/chock/scaffold/skills_bridge.py
+++ b/src/chock/scaffold/skills_bridge.py
@@ -8,6 +8,7 @@
 import sys
 from pathlib import Path
 
+from chock.output import warn
 from chock.resources import package_data_dir
 
 AGENT_BRIDGES: dict[str, str] = {
@@ -55,17 +56,19 @@ def _bridge_one(link: Path, target: Path) -> str:
     rel = Path(os.path.relpath(str(target), str(link.parent)))
     try:
         os.symlink(rel, link, target_is_directory=True)
-        return "symlink"
     except OSError:
         pass
+    else:
+        return "symlink"
 
     try:
         shutil.copytree(str(target), str(link))
-        _mark_bridge(link)
-        return "copy"
     except OSError as exc:
-        print(f"[WARN] skills-bridge: could not bridge {target.name}: {exc}", file=sys.stderr)
+        warn(f"skills-bridge: could not bridge {target.name}: {exc}")
         return "error"
+    else:
+        _mark_bridge(link)
+        return "copy"
 
 
 def _skill_dirs(skills_root: Path) -> list[Path]:
diff --git a/src/chock/scaffold/templates.py b/src/chock/scaffold/templates.py
index fbebf5b..183086e 100644
--- a/src/chock/scaffold/templates.py
+++ b/src/chock/scaffold/templates.py
@@ -4,14 +4,13 @@
 
 from pathlib import Path
 
+import chock
 from chock.emit import write_generated
 from chock.resources import package_data_dir
 
 
 def packaged_template(rel_path: str) -> str:
     """Read a file from the packaged chock-init template tree."""
-    import chock
-
     base = Path(chock.__file__).parent / "packs" / "_skills" / "chock-init"
     return (base / "assets" / "templates" / rel_path).read_text(encoding="utf-8")
 
@@ -26,18 +25,18 @@ def _dependency_allowlist_template() -> str:
 SKILLS_GUARDRAIL = _SCAFFOLD_DATA_DIR.joinpath("skills_guardrail.md").read_text(encoding="utf-8")
 
 
-def write_vendored_guardrails(repo_root: Path, force: bool) -> list[str]:
+def write_vendored_guardrails(repo_root: Path, *, force: bool) -> list[str]:
     """Write the guardrail pair into .agents/policies/ and .agents/skills/."""
     preserved: list[str] = []
     for rel_dir, content in ((".agents/policies", POLICIES_GUARDRAIL), (".agents/skills", SKILLS_GUARDRAIL)):
         for name in ("AGENTS.md", "CLAUDE.md"):
             rel = f"{rel_dir}/{name}"
-            if _preserve_or_write(repo_root / rel, content, force):
+            if _preserve_or_write(repo_root / rel, content, force=force):
                 preserved.append(rel)
     return preserved
 
 
-def _preserve_or_write(path: Path, content: str, force: bool) -> bool:
+def _preserve_or_write(path: Path, content: str, *, force: bool) -> bool:
     """Write `content` unless the adopter has already edited what is there. True if left alone."""
     if path.exists() and not force and path.read_text(encoding="utf-8") != content:
         return True
diff --git a/src/chock/toggles.py b/src/chock/toggles.py
index ea540a7..a75d744 100644
--- a/src/chock/toggles.py
+++ b/src/chock/toggles.py
@@ -11,12 +11,15 @@
 import yaml
 
 from chock.compile.levels import Grade, render_grade
+from chock.compile.surfaces import AGENTS_ARG_REQUIRED_MSG
 from chock.config import agents_from_config as _agents_from_config
 from chock.config import load_config, policy_status, set_disabled
+from chock.index.cli import cmd_refresh
 from chock.manifest import ManifestSourceError, load_manifest
+from chock.output import error, warn
 from chock.policies import discover_policy_dirs
 from chock.scaffold.adapters import parse_agent_selection
-from chock.scaffold.recompile import BookkeepingError, recompile
+from chock.scaffold.recompile import BookkeepingError, compiled_differences, recompile
 
 
 def _cell(value: Any) -> str:
@@ -35,13 +38,13 @@ def _load_manifest(pack_dir: Path) -> dict[str, Any]:
     try:
         result = load_manifest(pack_dir, warnings=warnings)
     except (yaml.YAMLError, OSError, ManifestSourceError) as exc:
-        print(f"[ERROR] {pack_dir / 'manifest.yaml'}: manifest_parse: {exc}", file=sys.stderr)
+        error(f"{pack_dir / 'manifest.yaml'}: manifest_parse: {exc}")
         return {}
     if result is None:
         return {}
     data, _ = result
     for warning in warnings:
-        print(f"[WARN] {pack_dir}: manifest_default: {warning}", file=sys.stderr)
+        warn(f"{pack_dir}: manifest_default: {warning}")
     return data
 
 
@@ -81,13 +84,12 @@ def disable_main(argv: list[str] | None) -> int:
     except ValueError as exc:
         print(str(exc), file=sys.stderr)
         return 2
-    set_disabled(repo_root, args.policy_id, True)
+    set_disabled(repo_root, args.policy_id, disabled=True)
     try:
         recompile(repo_root, agents)
     except BookkeepingError as exc:
-        print(f"[ERROR] {exc}", file=sys.stderr)
+        error(str(exc))
         return 1
-    from chock.index.cli import cmd_refresh
 
     cmd_refresh(["--repo", str(repo_root)])
     print(f"Disabled {args.policy_id}")
@@ -110,13 +112,12 @@ def enable_main(argv: list[str] | None) -> int:
     except ValueError as exc:
         print(str(exc), file=sys.stderr)
         return 2
-    set_disabled(repo_root, args.policy_id, False)
+    set_disabled(repo_root, args.policy_id, disabled=False)
     try:
         recompile(repo_root, agents)
     except BookkeepingError as exc:
-        print(f"[ERROR] {exc}", file=sys.stderr)
+        error(str(exc))
         return 1
-    from chock.index.cli import cmd_refresh
 
     cmd_refresh(["--repo", str(repo_root)])
     print(f"Enabled {args.policy_id}")
@@ -158,9 +159,9 @@ def policies_main(argv: list[str] | None) -> int:
 
     headers = ("id", "state", "coverage", "mandatory")
     widths = [max(len(h), *(len(r[i]) for r in rows)) for i, h in enumerate(headers)]
-    print("  ".join(h.ljust(w) for h, w in zip(headers, widths)).rstrip())
+    print("  ".join(h.ljust(w) for h, w in zip(headers, widths, strict=True)).rstrip())
     for row in rows:
-        print("  ".join(cell.ljust(w) for cell, w in zip(row, widths)).rstrip())
+        print("  ".join(cell.ljust(w) for cell, w in zip(row, widths, strict=True)).rstrip())
     return 0
 
 
@@ -193,11 +194,9 @@ def recompile_main(argv: list[str] | None) -> int:
         except ValueError as exc:
             _parser_fail(parser, str(exc))
         if not agents:
-            _parser_fail(parser, "--agents requires at least one agent name")
+            _parser_fail(parser, AGENTS_ARG_REQUIRED_MSG)
 
     if args.check:
-        from chock.scaffold.recompile import compiled_differences
-
         drift = compiled_differences(repo_root, agents)
         if drift:
             print(f"Compiled artifacts are out of date ({len(drift)} difference(s)):")
@@ -211,7 +210,7 @@ def recompile_main(argv: list[str] | None) -> int:
     try:
         coverage = recompile(repo_root, agents, skip_hooks=args.skip_hooks)
     except BookkeepingError as exc:
-        print(f"[ERROR] {exc}", file=sys.stderr)
+        error(str(exc))
         return 1
     print(f"Recompiled {len(coverage)} policies")
     for policy_id, cov in sorted(coverage.items()):
diff --git a/src/chock/validation/checks_content.py b/src/chock/validation/checks_content.py
index 678acb7..a80ea73 100644
--- a/src/chock/validation/checks_content.py
+++ b/src/chock/validation/checks_content.py
@@ -8,7 +8,7 @@
 
 import yaml
 
-from chock.manifest import CANONICAL_MANIFEST, resolve_manifest_path
+from chock.manifest import AGENT_SPECIFIC_VOCABULARY_KEY, CANONICAL_MANIFEST, resolve_manifest_path
 from chock.validation.loading import (
     ARTIFACT_TYPES,
     BUDGETS,
@@ -20,6 +20,13 @@
 )
 from chock.validation.report import Finding, Report
 
+#: A SKILL.md prose paragraph longer than this many words should move to references/.
+_MAX_PARAGRAPH_WORDS = 150
+#: Lines shorter than this are too generic (e.g. list bullets) to count as duplicated content.
+_MIN_DUPLICATE_LINE_LEN = 40
+#: `text.split("---", 2)` on well-formed frontmatter yields [before, frontmatter, body].
+_FRONTMATTER_SPLIT_PARTS = 3
+
 
 def check_token_budgets(artifact_dir: Path, manifest: dict[str, Any], artifact_type: str, report: Report) -> None:
     if artifact_type == "rule":
@@ -69,23 +76,25 @@ def check_token_budgets(artifact_dir: Path, manifest: dict[str, Any], artifact_t
         for ref in refs_dir.iterdir():
             if ref.is_file():
                 lines = count_lines(ref)
-                if lines > BUDGETS["reference_file_lines"]:
+                max_reference_lines = BUDGETS["reference_file_lines"]
+                if lines > max_reference_lines:
                     report.add(
                         Finding(
                             str(ref),
                             "token_budget",
                             "error",
-                            f"Reference file exceeds {BUDGETS['reference_file_lines']} lines (found {lines}). Split into focused files.",
+                            f"Reference file exceeds {max_reference_lines} lines (found {lines}). Split into focused files.",
                         )
                     )
 
 
 def check_progressive_disclosure(
-    artifact_dir: Path, manifest: dict[str, Any], artifact_type: str, report: Report
+    artifact_dir: Path, _manifest: dict[str, Any], artifact_type: str, report: Report
 ) -> None:
     """Body stays lean; depth lives in references/ loaded on demand."""
     if artifact_type != "skill":
         return
+    category = "progressive_disclosure"
 
     skill_md = artifact_dir / "SKILL.md"
     if not skill_md.exists():
@@ -100,7 +109,7 @@ def check_progressive_disclosure(
             report.add(
                 Finding(
                     str(skill_md),
-                    "progressive_disclosure",
+                    category,
                     "error",
                     f"SKILL.md body contains a depth section ('{marker.strip()}'). Move it to references/.",
                 )
@@ -109,11 +118,11 @@ def check_progressive_disclosure(
     paragraphs = re.split(r"\n\s*\n", body)
     for para in paragraphs:
         word_count = len(para.split())
-        if word_count > 150 and not para.strip().startswith("-") and not para.strip().startswith("|"):
+        if word_count > _MAX_PARAGRAPH_WORDS and not para.strip().startswith("-") and not para.strip().startswith("|"):
             report.add(
                 Finding(
                     str(skill_md),
-                    "progressive_disclosure",
+                    category,
                     "warning",
                     f"SKILL.md body contains a ~{word_count}-word prose block. Consider moving it to references/ and linking it.",
                 )
@@ -127,14 +136,14 @@ def check_progressive_disclosure(
                 report.add(
                     Finding(
                         str(skill_md),
-                        "progressive_disclosure",
+                        category,
                         "warning",
                         f"Reference file '{ref.name}' is not addressed from SKILL.md body.",
                     )
                 )
 
 
-def check_yagni(artifact_dir: Path, manifest: dict[str, Any], artifact_type: str, report: Report) -> None:
+def check_yagni(artifact_dir: Path, _manifest: dict[str, Any], _artifact_type: str, report: Report) -> None:
     """Detect over-bloating: empty folders, unused templates, duplicated content."""
     for sub in artifact_dir.iterdir():
         if sub.is_dir() and not any(sub.iterdir()):
@@ -154,10 +163,12 @@ def check_yagni(artifact_dir: Path, manifest: dict[str, Any], artifact_type: str
             ref_lines = {
                 line.strip()
                 for line in ref_text.splitlines()
-                if len(line.strip()) > 40 and line.strip() != security_footer
+                if len(line.strip()) > _MIN_DUPLICATE_LINE_LEN and line.strip() != security_footer
             }
             body_lines = {
-                line.strip() for line in body.splitlines() if len(line.strip()) > 40 and line.strip() != security_footer
+                line.strip()
+                for line in body.splitlines()
+                if len(line.strip()) > _MIN_DUPLICATE_LINE_LEN and line.strip() != security_footer
             }
             duplicates = ref_lines & body_lines
             if duplicates:
@@ -179,7 +190,7 @@ def check_no_agent_specific_leakage(
     if artifact_type not in ARTIFACT_TYPES:
         return
 
-    if manifest.get("agent_specific_vocabulary"):
+    if manifest.get(AGENT_SPECIFIC_VOCABULARY_KEY):
         return
 
     skill_md = artifact_dir / "SKILL.md"
@@ -211,7 +222,7 @@ def extract_skill_md_description(skill_md: Path) -> str | None:
     if not text.startswith("---"):
         return None
     parts = text.split("---", 2)
-    if len(parts) < 3:
+    if len(parts) < _FRONTMATTER_SPLIT_PARTS:
         return None
     try:
         front = yaml.safe_load(parts[1]) or {}
diff --git a/src/chock/validation/checks_determinism.py b/src/chock/validation/checks_determinism.py
index ef7396d..de46a03 100644
--- a/src/chock/validation/checks_determinism.py
+++ b/src/chock/validation/checks_determinism.py
@@ -7,7 +7,7 @@
 from pathlib import Path
 from typing import Any
 
-from chock.manifest import CANONICAL_MANIFEST, resolve_manifest_path
+from chock.manifest import CANONICAL_MANIFEST, DETERMINIZATION_REVIEWED_KEY, resolve_manifest_path
 from chock.validation.checks_security import _is_script_file
 from chock.validation.patterns import (
     _DETERMINISTIC_HEURISTIC_PATTERNS,
@@ -194,7 +194,7 @@ def check_determinization_heuristic(
     skill_type = skill.get("skill_type") or manifest.get("skill_type")
     if skill_type != "nl":
         return
-    if manifest.get("determinization_reviewed"):
+    if manifest.get(DETERMINIZATION_REVIEWED_KEY):
         return
 
     files_to_check = []
diff --git a/src/chock/validation/checks_drift.py b/src/chock/validation/checks_drift.py
index a7578c9..aa28bf6 100644
--- a/src/chock/validation/checks_drift.py
+++ b/src/chock/validation/checks_drift.py
@@ -3,21 +3,29 @@
 from __future__ import annotations
 
 import json
+import shutil
 import subprocess
 from pathlib import Path
 from typing import Any
 
+from chock.compile.compiler import _load_manifest
+from chock.config import agents_from_config as _agents_from_config
+from chock.plugin.build import PluginNameError, plugin_differences
+from chock.policies import discover_policy_dirs
 from chock.validation.report import Finding, Report
 
+_GIT = shutil.which("git") or "git"
+
 
 def _staged_paths(root: Path) -> list[str] | None:
     """Repo-relative staged paths, or None when there is no index to read."""
-    proc = subprocess.run(
-        ["git", "diff", "--cached", "--name-only", "-z"],
+    proc = subprocess.run(  # noqa: S603 -- reading the staged diff via git is this function's job
+        [_GIT, "diff", "--cached", "--name-only", "-z"],
         cwd=root,
         capture_output=True,
         encoding="utf-8",
         errors="replace",
+        check=False,
     )
     if proc.returncode != 0:
         return None
@@ -39,10 +47,8 @@ def _drift_severity(root: Path, event: str | None, policy_dirs: list[Path]) -> t
 
 def check_compiled_drift(root: Path, report: Report, event: str | None = None) -> None:
     """The compiled tree must still be what the manifests produce."""
-    from chock.compile.compiler import _load_manifest
-    from chock.config import agents_from_config as _agents_from_config
-    from chock.policies import discover_policy_dirs
-    from chock.scaffold.recompile import compiled_differences
+    # chock.scaffold.recompile -> chock.registry.core -> ... -> this module (cycle).
+    from chock.scaffold.recompile import compiled_differences  # noqa: PLC0415
 
     compiled_root = root / ".chock" / "compiled"
 
@@ -89,10 +95,6 @@ def check_compiled_drift(root: Path, report: Report, event: str | None = None) -
 
 def check_plugin_drift(root: Path, report: Report, event: str | None = None) -> None:
     """Packaged Agent Plugins output must still be what the manifest produces."""
-    from chock.compile.compiler import _load_manifest
-    from chock.plugin.build import PluginNameError, plugin_differences
-    from chock.policies import discover_policy_dirs
-
     policy_dirs = list(discover_policy_dirs(root))
     packaged = [d for d in policy_dirs if (d / "plugin.json").exists()]
     if not packaged:
diff --git a/src/chock/validation/checks_evals.py b/src/chock/validation/checks_evals.py
index 21fe3a6..c0767a4 100644
--- a/src/chock/validation/checks_evals.py
+++ b/src/chock/validation/checks_evals.py
@@ -67,47 +67,51 @@ def check_eval_first(artifact_dir: Path, manifest: dict[str, Any], artifact_type
         return
     cases = [c for c in cases if isinstance(c, dict)]
     categories = [str(c.get("category", c.get("type", ""))).lower() for c in cases]
-    if len(cases) < BUDGETS["eval_suite_min_cases"]:
+    min_suite_cases = BUDGETS["eval_suite_min_cases"]
+    if len(cases) < min_suite_cases:
         report.add(
             Finding(
                 str(suite_file),
                 "eval_first",
                 "error",
-                f"Eval suite has {len(cases)} case(s); need >= {BUDGETS['eval_suite_min_cases']}.",
+                f"Eval suite has {len(cases)} case(s); need >= {min_suite_cases}.",
             )
         )
-    if categories.count("trigger") < BUDGETS["eval_trigger_cases_min"]:
+    min_trigger_cases = BUDGETS["eval_trigger_cases_min"]
+    if categories.count("trigger") < min_trigger_cases:
+        report.add(Finding(str(suite_file), "eval_first", "error", f"Need >= {min_trigger_cases} trigger case(s)."))
+    min_negative_trigger_cases = BUDGETS["eval_negative_trigger_cases_min"]
+    if categories.count("negative_trigger") < min_negative_trigger_cases:
         report.add(
             Finding(
-                str(suite_file), "eval_first", "error", f"Need >= {BUDGETS['eval_trigger_cases_min']} trigger case(s)."
+                str(suite_file),
+                "eval_first",
+                "error",
+                f"Need >= {min_negative_trigger_cases} negative_trigger case(s).",
             )
         )
-    if categories.count("negative_trigger") < BUDGETS["eval_negative_trigger_cases_min"]:
+    min_behavior_cases = BUDGETS["eval_behavior_cases_min"]
+    if categories.count("behavior") < min_behavior_cases:
         report.add(
             Finding(
                 str(suite_file),
                 "eval_first",
                 "error",
-                f"Need >= {BUDGETS['eval_negative_trigger_cases_min']} negative_trigger case(s).",
+                f"Need >= {min_behavior_cases} behavior case(s).",
             )
         )
-    if categories.count("behavior") < BUDGETS["eval_behavior_cases_min"]:
+
+    if (
+        artifact_type == "skill"
+        and manifest.get("security", {}).get("processes_external_content")
+        and categories.count("adversarial") < 1
+        and categories.count("security") < 1
+    ):
         report.add(
             Finding(
                 str(suite_file),
                 "eval_first",
                 "error",
-                f"Need >= {BUDGETS['eval_behavior_cases_min']} behavior case(s).",
+                "security.processes_external_content is true but eval suite has no adversarial or security case (SEC-6).",
             )
         )
-
-    if artifact_type == "skill" and manifest.get("security", {}).get("processes_external_content"):
-        if categories.count("adversarial") < 1 and categories.count("security") < 1:
-            report.add(
-                Finding(
-                    str(suite_file),
-                    "eval_first",
-                    "error",
-                    "security.processes_external_content is true but eval suite has no adversarial or security case (SEC-6).",
-                )
-            )
diff --git a/src/chock/validation/checks_gate_shape.py b/src/chock/validation/checks_gate_shape.py
index 42e570e..6b9b0c2 100644
--- a/src/chock/validation/checks_gate_shape.py
+++ b/src/chock/validation/checks_gate_shape.py
@@ -9,16 +9,18 @@
 from chock.validation.loading import schema_validator
 from chock.validation.report import Finding, Report
 
+_CATEGORY = "manifest_gate_params"
+
 
 def _validate_gate(gate: dict[str, Any], gate_ref: str, report: Report, *, tool_use_allowed: bool = False) -> None:
     """Validate a gate spec: kind is known and params match the kind schema."""
     kind = gate.get("kind")
     if not kind:
-        report.add(Finding(gate_ref, "manifest_gate_params", "error", "gate is missing 'kind'"))
+        report.add(Finding(gate_ref, _CATEGORY, "error", "gate is missing 'kind'"))
         return
 
     if kind not in KINDS and kind not in GATEWAY_ONLY_KINDS:
-        report.add(Finding(gate_ref, "manifest_gate_params", "error", f"unknown gate kind: {kind!r}"))
+        report.add(Finding(gate_ref, _CATEGORY, "error", f"unknown gate kind: {kind!r}"))
         return
 
     events = gate.get("on") or []
@@ -26,7 +28,7 @@ def _validate_gate(gate: dict[str, Any], gate_ref: str, report: Report, *, tool_
         report.add(
             Finding(
                 gate_ref,
-                "manifest_gate_params",
+                _CATEGORY,
                 "error",
                 f"{kind} has no commit/push runtime; it binds only at tool_use (mcp-gateway)",
             )
@@ -36,7 +38,7 @@ def _validate_gate(gate: dict[str, Any], gate_ref: str, report: Report, *, tool_
         report.add(
             Finding(
                 gate_ref,
-                "manifest_gate_params",
+                _CATEGORY,
                 "error",
                 "tool_use is only allowed in hook.gate, not in gate.yaml",
             )
@@ -51,7 +53,7 @@ def _validate_gate(gate: dict[str, Any], gate_ref: str, report: Report, *, tool_
             report.add(
                 Finding(
                     f"{gate_ref} (params)",
-                    "manifest_gate_params",
+                    _CATEGORY,
                     "error",
                     f"{exc.message} at {path_str}",
                 )
diff --git a/src/chock/validation/checks_manifest_advice.py b/src/chock/validation/checks_manifest_advice.py
index ecaa05a..47f4370 100644
--- a/src/chock/validation/checks_manifest_advice.py
+++ b/src/chock/validation/checks_manifest_advice.py
@@ -52,7 +52,7 @@ def _check_manifest_local_propagation(artifact_dir: Path, manifest: dict[str, An
         )
 
 
-def check_manifest_advice(artifact_dir, manifest: dict[str, Any], artifact_type: str, report: Report) -> None:
+def check_manifest_advice(artifact_dir, manifest: dict[str, Any], _artifact_type: str, report: Report) -> None:
     """Validate structural manifest invariants that are warnings only."""
     artifact_dir = Path(artifact_dir)
     _check_manifest_optimizable_no_evals(artifact_dir, manifest, report)
diff --git a/src/chock/validation/checks_manifest_schema.py b/src/chock/validation/checks_manifest_schema.py
index 9ad21e3..3f4a8f3 100644
--- a/src/chock/validation/checks_manifest_schema.py
+++ b/src/chock/validation/checks_manifest_schema.py
@@ -6,7 +6,7 @@
 from typing import Any
 
 from chock.manifest import CANONICAL_MANIFEST, resolve_manifest_path
-from chock.policy_id import InvalidPolicyId, validate_policy_id
+from chock.policy_id import InvalidPolicyIdError, validate_policy_id
 from chock.validation.checks_gate_shape import _validate_gate
 from chock.validation.report import Finding, Report
 
@@ -28,7 +28,7 @@ def _check_manifest_id_folder(artifact_dir: Path, manifest: dict[str, Any], repo
     effective_id = manifest.get("id") or artifact_dir.name
     try:
         validate_policy_id(effective_id, artifact_dir.name)
-    except InvalidPolicyId as exc:
+    except InvalidPolicyIdError as exc:
         report.add(Finding(str(_manifest_ref(artifact_dir)), "manifest_id_folder", "error", str(exc)))
 
 
@@ -167,7 +167,7 @@ def _check_manifest_workflow_uses(artifact_dir: Path, manifest: dict[str, Any],
             )
 
 
-def check_manifest_schema(artifact_dir, manifest: dict[str, Any], artifact_type: str, report: Report) -> None:
+def check_manifest_schema(artifact_dir, manifest: dict[str, Any], _artifact_type: str, report: Report) -> None:
     """Validate structural manifest invariants that are errors."""
     artifact_dir = Path(artifact_dir)
     _check_manifest_id_folder(artifact_dir, manifest, report)
diff --git a/src/chock/validation/checks_orchestration.py b/src/chock/validation/checks_orchestration.py
index 330b57a..cb27d21 100644
--- a/src/chock/validation/checks_orchestration.py
+++ b/src/chock/validation/checks_orchestration.py
@@ -6,7 +6,7 @@
 from pathlib import Path
 from typing import Any
 
-from chock.manifest import CANONICAL_MANIFEST, resolve_manifest_path
+from chock.manifest import CANONICAL_MANIFEST, CONTENT_INSTRUCTIONS_KEY, resolve_manifest_path
 from chock.validation.report import Finding, Report
 
 
@@ -208,7 +208,7 @@ def check_composition_contract(
             )
 
 
-def check_lifecycle_guards(artifact_dir: Path, manifest: dict[str, Any], artifact_type: str, report: Report) -> None:
+def check_lifecycle_guards(artifact_dir: Path, manifest: dict[str, Any], _artifact_type: str, report: Report) -> None:
     """Check spec §8 lifecycle transition guards."""
     lifecycle = manifest.get("lifecycle", {})
     status = lifecycle.get("status", "draft")
@@ -216,7 +216,7 @@ def check_lifecycle_guards(artifact_dir: Path, manifest: dict[str, Any], artifac
 
     if status == "review":
         security = manifest.get("security", {})
-        if security.get("content_instructions") != "never-obey":
+        if security.get(CONTENT_INSTRUCTIONS_KEY) != "never-obey":
             report.add(
                 Finding(
                     _manifest_ref(artifact_dir),
@@ -257,7 +257,7 @@ def check_lifecycle_guards(artifact_dir: Path, manifest: dict[str, Any], artifac
             )
 
 
-def check_trust_tier(artifact_dir: Path, manifest: dict[str, Any], artifact_type: str, report: Report) -> None:
+def check_trust_tier(artifact_dir: Path, manifest: dict[str, Any], _artifact_type: str, report: Report) -> None:
     """Check spec §9 trust tier rules."""
     provenance = manifest.get("provenance", {})
     lifecycle = manifest.get("lifecycle", {})
diff --git a/src/chock/validation/checks_policy_toggles.py b/src/chock/validation/checks_policy_toggles.py
index 5a453f5..46928ca 100644
--- a/src/chock/validation/checks_policy_toggles.py
+++ b/src/chock/validation/checks_policy_toggles.py
@@ -84,13 +84,16 @@ def check_policy_toggles(repo_root: Path, report: Report) -> None:
                 )
             )
             continue
-        if manifest.get("enforcement") == "block" and policy_id in SECURITY_BLOCK_GUARDS:
-            if override.get("enforcement") == "advise" or override.get("surfaces") == ["ambient-rule"]:
-                report.add(
-                    Finding(
-                        str(repo_root / ".chock" / "config.yaml"),
-                        "policy_toggles",
-                        "warning",
-                        f"Block security guard {policy_id} is downgraded to advisory",
-                    )
+        if (
+            manifest.get("enforcement") == "block"
+            and policy_id in SECURITY_BLOCK_GUARDS
+            and (override.get("enforcement") == "advise" or override.get("surfaces") == ["ambient-rule"])
+        ):
+            report.add(
+                Finding(
+                    str(repo_root / ".chock" / "config.yaml"),
+                    "policy_toggles",
+                    "warning",
+                    f"Block security guard {policy_id} is downgraded to advisory",
                 )
+            )
diff --git a/src/chock/validation/checks_repo.py b/src/chock/validation/checks_repo.py
index 4b9ace4..7a8e61a 100644
--- a/src/chock/validation/checks_repo.py
+++ b/src/chock/validation/checks_repo.py
@@ -11,6 +11,7 @@
 from chock.index.builder import max_tokens_for
 from chock.index.cli import is_stale
 from chock.scaffold.agents_md import POINTER_BLOCK, POINTER_END, POINTER_START
+from chock.validation.loading import discover_artifacts
 from chock.validation.report import Finding, Report
 
 _POINTER_RE = re.compile(
@@ -112,8 +113,6 @@ def check_ambient_rule_blocks(root: Path, report: Report) -> None:
 
 def _resolve_id(root: Path, policy_id: str) -> bool:
     """Does an installed artifact answer to this id?"""
-    from chock.validation.loading import discover_artifacts
-
     for _artifact_type, artifact_dir in discover_artifacts(root):
         if artifact_dir.name == policy_id:
             return True
diff --git a/src/chock/validation/checks_security.py b/src/chock/validation/checks_security.py
index 41d3614..345f146 100644
--- a/src/chock/validation/checks_security.py
+++ b/src/chock/validation/checks_security.py
@@ -8,7 +8,7 @@
 
 import yaml
 
-from chock.manifest import CANONICAL_MANIFEST
+from chock.manifest import CANONICAL_MANIFEST, CONTENT_INSTRUCTIONS_KEY
 from chock.validation.loading import (
     find_manifest,
 )
@@ -53,7 +53,7 @@ def _split_eval_suite(path: Path) -> tuple[str, list[str]] | None:
     return yaml.safe_dump(remainder_doc, sort_keys=False), case_texts
 
 
-def _scan_text_surfaces(artifact_dir: Path, manifest: dict[str, Any], artifact_type: str, report: Report) -> None:
+def _scan_text_surfaces(artifact_dir: Path, _manifest: dict[str, Any], _artifact_type: str, report: Report) -> None:
     """Scan every text surface in the artifact folder for prompt-injection tripwires (SEC-4)."""
     text_suffixes = {".md", ".yaml", ".yml", ".txt"}
     for path in artifact_dir.rglob("*"):
@@ -95,7 +95,7 @@ def check_security_baseline(artifact_dir: Path, manifest: dict[str, Any], artifa
     manifest_ref = str(manifest_path or artifact_dir / CANONICAL_MANIFEST)
 
     security = manifest.get("security", {})
-    if security.get("content_instructions") != "never-obey":
+    if security.get(CONTENT_INSTRUCTIONS_KEY) != "never-obey":
         report.add(
             Finding(manifest_ref, "security", "error", "security.content_instructions must be 'never-obey' (SEC-1).")
         )
diff --git a/src/chock/validation/engine.py b/src/chock/validation/engine.py
index b434b70..b3878d7 100644
--- a/src/chock/validation/engine.py
+++ b/src/chock/validation/engine.py
@@ -53,6 +53,7 @@
 )
 from chock.validation.frontier import check_frontier_mode
 from chock.validation.loading import (
+    MANIFEST_SCHEMA,
     discover_artifacts,
     load_schema,
     validate_yaml_against_schema,
@@ -85,10 +86,10 @@ def validate_artifact(
         report.add(Finding(str(manifest_path or artifact_dir), "manifest_default", "warning", warning))
 
     schema_name = {
-        "rule": "manifest.schema.json",
-        "hook": "manifest.schema.json",
-        "skill": "manifest.schema.json",
-        "workflow": "manifest.schema.json",
+        "rule": MANIFEST_SCHEMA,
+        "hook": MANIFEST_SCHEMA,
+        "skill": MANIFEST_SCHEMA,
+        "workflow": MANIFEST_SCHEMA,
         "eval": "eval.schema.json",
         "subagent": "subagent.schema.json",
     }.get(artifact_type)
@@ -97,7 +98,7 @@ def validate_artifact(
         schema = load_schema(schema_name)
         validate_yaml_against_schema(manifest, schema, str(manifest_path or artifact_dir), report)
     elif manifest and manifest_path and manifest_path.name in MANIFEST_NAMES:
-        base_schema = load_schema("manifest.schema.json")
+        base_schema = load_schema(MANIFEST_SCHEMA)
         validate_yaml_against_schema(manifest, base_schema, str(manifest_path), report)
 
     check_token_budgets(artifact_dir, manifest, artifact_type, report)
@@ -192,5 +193,5 @@ def main(argv: list[str] | None = None) -> int:
     check_compiled_drift(root, report, event=args.event)
     check_plugin_drift(root, report, event=args.event)
 
-    emit(report, args.json)
+    emit(report, use_json=args.json)
     return 0 if report.is_clean() else 1
diff --git a/src/chock/validation/frontier.py b/src/chock/validation/frontier.py
index bfa1f6f..34cfcfb 100644
--- a/src/chock/validation/frontier.py
+++ b/src/chock/validation/frontier.py
@@ -14,6 +14,9 @@
 )
 from chock.validation.report import Finding, Report
 
+#: A frontier standard snapshot older than this many days is flagged stale (FRS-1).
+_MAX_FRONTIER_AGE_DAYS = 90
+
 
 def load_frontier_standard(agent: str) -> dict[str, Any] | None:
     standard_map = {
@@ -64,7 +67,7 @@ def check_frontier_mode(
         try:
             fetched = datetime.datetime.fromisoformat(fetched_at)
             age_days = (datetime.datetime.now(datetime.timezone.utc) - fetched).days
-            if age_days > 90:
+            if age_days > _MAX_FRONTIER_AGE_DAYS:
                 report.add(
                     Finding(
                         str(artifact_dir),
@@ -73,8 +76,8 @@ def check_frontier_mode(
                         f"Frontier standard for {agent} was last fetched {age_days} days ago; run ingest.py to refresh (FRS-1).",
                     )
                 )
-        except Exception:
-            pass
+        except (ValueError, TypeError):
+            pass  # malformed/missing fetched_at: skip staleness reporting, not a validation failure
 
     if artifact_type == "skill":
         desc_std = standard.get("skill_description", {})
diff --git a/src/chock/validation/frontier_ingest.py b/src/chock/validation/frontier_ingest.py
index 12bae88..c8708c5 100644
--- a/src/chock/validation/frontier_ingest.py
+++ b/src/chock/validation/frontier_ingest.py
@@ -8,11 +8,15 @@
 import json
 import re
 import sys
+import urllib.request
 from pathlib import Path
 from typing import Any
 
 STANDARDS_DIR = Path(__file__).parent / "frontier_standards"
 
+#: Agent Skills feature name for shell-command-in-frontmatter dynamic expansion.
+_DYNAMIC_CONTEXT_INJECTION = "dynamic_context_injection"
+
 SEEDS: dict[str, dict[str, Any]] = {
     "agentskills": {
         "source": "https://agentskills.io/specification.md",
@@ -55,9 +59,9 @@
         "features": [
             "invocation_control",
             "subagent_execution",
-            "dynamic_context_injection",
+            _DYNAMIC_CONTEXT_INJECTION,
         ],
-        "dynamic_context_injection": {
+        _DYNAMIC_CONTEXT_INJECTION: {
             "syntax": "!`command`",
             "allowed": True,
         },
@@ -72,11 +76,9 @@ def fetch_url(url: str) -> str:
         print(f"WARN: refusing non-https fetch: {url}", file=sys.stderr)
         return ""
     try:
-        import urllib.request
-
-        with urllib.request.urlopen(url, timeout=30) as response:  # nosec B310 -- https enforced above
+        with urllib.request.urlopen(url, timeout=30) as response:  # noqa: S310 -- https:// enforced above
             return response.read().decode("utf-8")
-    except Exception as exc:
+    except Exception as exc:  # noqa: BLE001 -- best-effort fetch, by contract: never raise, always return a string
         print(f"WARN: could not fetch {url}: {exc}", file=sys.stderr)
         return ""
 
@@ -165,7 +167,7 @@ def parse_claude_code(text: str) -> dict[str, Any]:
         }
 
     if "!`" in text:
-        data["dynamic_context_injection"] = {
+        data[_DYNAMIC_CONTEXT_INJECTION] = {
             "syntax": "!`command`",
             "allowed": True,
         }
@@ -184,7 +186,7 @@ def _merge_into_seed(seed: dict[str, Any], fetched: dict[str, Any]) -> dict[str,
     return merged
 
 
-def ingest(agent: str, use_network: bool = True) -> dict[str, Any]:
+def ingest(agent: str, *, use_network: bool = True) -> dict[str, Any]:
     seed = SEEDS.get(agent, {})
     source = seed.get("source", "")
     if use_network and source:
diff --git a/src/chock/validation/loading.py b/src/chock/validation/loading.py
index 63dc2a8..6547c00 100644
--- a/src/chock/validation/loading.py
+++ b/src/chock/validation/loading.py
@@ -15,6 +15,7 @@
 from chock.validation.report import Finding, Report
 
 SCHEMA_DIR = package_data_dir("chock.validation", "schemas")
+MANIFEST_SCHEMA = "manifest.schema.json"
 
 BUDGETS = {
     "skill_md_lines": 150,
@@ -47,14 +48,15 @@ def _build_schema_store() -> dict[str, Any]:
 def load_schema(name: str) -> dict[str, Any]:
     path = SCHEMA_DIR / name
     if not path.exists():
-        raise FileNotFoundError(f"Schema not found: {path}")
+        msg = f"Schema not found: {path}"
+        raise FileNotFoundError(msg)
     with path.open("r", encoding="utf-8") as f:
         if name.endswith(".json"):
             return json.load(f)
         return yaml.safe_load(f)
 
 
-ARTIFACT_TYPES: frozenset[str] = frozenset(load_schema("manifest.schema.json")["properties"]["artifact"]["enum"])
+ARTIFACT_TYPES: frozenset[str] = frozenset(load_schema(MANIFEST_SCHEMA)["properties"]["artifact"]["enum"])
 
 
 def _registry() -> Registry:
diff --git a/src/chock/validation/report.py b/src/chock/validation/report.py
index acb2485..084a14e 100644
--- a/src/chock/validation/report.py
+++ b/src/chock/validation/report.py
@@ -32,7 +32,7 @@ def is_clean(self) -> bool:
         return not self.errors
 
 
-def emit(report: Report, use_json: bool) -> None:
+def emit(report: Report, *, use_json: bool) -> None:
     if use_json:
         print(
             json.dumps(
diff --git a/src/chock/vendored.py b/src/chock/vendored.py
index f6724ab..2a2d093 100644
--- a/src/chock/vendored.py
+++ b/src/chock/vendored.py
@@ -2,8 +2,10 @@
 
 from __future__ import annotations
 
+from importlib import resources
 from pathlib import Path
 
+from chock.gate import runtime_bundle
 from chock.vendors import in_agent_vendors
 
 VENDORED_RUNTIMES = {
@@ -14,15 +16,11 @@
 
 def _expected_bytes(kind: str, source) -> bytes | None:
     if kind == "static":
-        import importlib.resources as resources
-
         package, source_name = source
         try:
             return resources.files(package).joinpath(source_name).read_bytes()
         except (FileNotFoundError, ModuleNotFoundError, OSError):  # pragma: no cover - packaging failure
             return None
-    from chock.gate import runtime_bundle
-
     return runtime_bundle.render(source).encode("utf-8")
 
 
diff --git a/tests/fixtures/runtime_goldens/antigravity.py b/tests/fixtures/runtime_goldens/antigravity.py
index e08fd43..a0d4f13 100644
--- a/tests/fixtures/runtime_goldens/antigravity.py
+++ b/tests/fixtures/runtime_goldens/antigravity.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -608,7 +609,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -630,7 +631,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -649,7 +650,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -669,7 +670,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -683,7 +683,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/tests/fixtures/runtime_goldens/claude_code.py b/tests/fixtures/runtime_goldens/claude_code.py
index 5211c41..3e94a8b 100644
--- a/tests/fixtures/runtime_goldens/claude_code.py
+++ b/tests/fixtures/runtime_goldens/claude_code.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -663,7 +664,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -685,7 +686,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -704,7 +705,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -724,7 +725,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -738,13 +738,15 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
         return (VERDICT_ESCALATE, f"chock could not check this command: the {guard.stem} guard did not complete (see this hook's stderr). Approving runs it unchecked.")
     return None
 
+_GIT = _chock_shutil.which('git') or 'git'
+
 _INSTRUCTION = "Chock: this clone's git hooks are NOT installed -- git never clones hooks, so commit-time gates will not run locally until someone runs:\n    pip install chock && chock sync --repo .\nRun that before the first commit. (The repo's CI gate, where wired, enforces regardless.)"
 
 def _repo_root() -> _chock_Path:
@@ -754,7 +756,7 @@ def _repo_root() -> _chock_Path:
 def _hooks_pre_commit(repo_root: _chock_Path) -> _chock_Path | None:
     """The active pre-commit hook path, honouring core.hooksPath. None when git is absent."""
     try:
-        proc = _chock_subprocess.run(['git', 'rev-parse', '--git-path', 'hooks'], cwd=repo_root, capture_output=True, text=True, timeout=15)
+        proc = _chock_subprocess.run([_GIT, 'rev-parse', '--git-path', 'hooks'], cwd=repo_root, capture_output=True, text=True, timeout=15, check=False)
     except (OSError, _chock_subprocess.TimeoutExpired):
         return None
     if proc.returncode != 0:
diff --git a/tests/fixtures/runtime_goldens/codex_cli.py b/tests/fixtures/runtime_goldens/codex_cli.py
index 3b5a068..3d67533 100644
--- a/tests/fixtures/runtime_goldens/codex_cli.py
+++ b/tests/fixtures/runtime_goldens/codex_cli.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -650,7 +651,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -672,7 +673,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -691,7 +692,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -711,7 +712,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -725,7 +725,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/tests/fixtures/runtime_goldens/cursor.py b/tests/fixtures/runtime_goldens/cursor.py
index c1a44ed..767e653 100644
--- a/tests/fixtures/runtime_goldens/cursor.py
+++ b/tests/fixtures/runtime_goldens/cursor.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -573,7 +574,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -595,7 +596,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -614,7 +615,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -634,7 +635,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -648,7 +648,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/tests/fixtures/runtime_goldens/devin.py b/tests/fixtures/runtime_goldens/devin.py
index 02cee60..24a7ffd 100644
--- a/tests/fixtures/runtime_goldens/devin.py
+++ b/tests/fixtures/runtime_goldens/devin.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -634,7 +635,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -656,7 +657,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -675,7 +676,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -695,7 +696,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -709,7 +709,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/tests/fixtures/runtime_goldens/gemini_cli.py b/tests/fixtures/runtime_goldens/gemini_cli.py
index f466f97..b95eeb1 100644
--- a/tests/fixtures/runtime_goldens/gemini_cli.py
+++ b/tests/fixtures/runtime_goldens/gemini_cli.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -634,7 +635,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -656,7 +657,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -675,7 +676,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -695,7 +696,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -709,7 +709,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/tests/fixtures/runtime_goldens/grok.py b/tests/fixtures/runtime_goldens/grok.py
index 2ddef51..76db409 100644
--- a/tests/fixtures/runtime_goldens/grok.py
+++ b/tests/fixtures/runtime_goldens/grok.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -617,7 +618,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -639,7 +640,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -658,7 +659,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -678,7 +679,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -692,7 +692,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/tests/fixtures/runtime_goldens/tabnine.py b/tests/fixtures/runtime_goldens/tabnine.py
index 23b39e6..91fa650 100644
--- a/tests/fixtures/runtime_goldens/tabnine.py
+++ b/tests/fixtures/runtime_goldens/tabnine.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -617,7 +618,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -639,7 +640,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -658,7 +659,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -678,7 +679,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -692,7 +692,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/tests/fixtures/runtime_goldens/vscode_copilot.py b/tests/fixtures/runtime_goldens/vscode_copilot.py
index 1fb5e66..b3000b6 100644
--- a/tests/fixtures/runtime_goldens/vscode_copilot.py
+++ b/tests/fixtures/runtime_goldens/vscode_copilot.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -468,7 +469,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -490,7 +491,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -509,7 +510,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -529,7 +530,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -543,7 +543,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/tests/fixtures/runtime_goldens/windsurf.py b/tests/fixtures/runtime_goldens/windsurf.py
index 301ebb4..a3c13c1 100644
--- a/tests/fixtures/runtime_goldens/windsurf.py
+++ b/tests/fixtures/runtime_goldens/windsurf.py
@@ -15,6 +15,7 @@
 
 import os as _chock_os
 import shlex as _chock_shlex
+import shutil as _chock_shutil
 import subprocess as _chock_subprocess
 from datetime import datetime as _chock_datetime, timezone as _chock_timezone
 from pathlib import Path as _chock_Path
@@ -546,7 +547,7 @@ def find_bash(guard: _chock_Path) -> str | None:
     """First interpreter that can actually see `guard`, or None."""
     for candidate in _BASH_CANDIDATES:
         try:
-            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10)
+            proc = _chock_subprocess.run([candidate, '-c', f'test -f "{guard.as_posix()}"'], capture_output=True, timeout=10, check=False)
         except (OSError, _chock_subprocess.SubprocessError):
             continue
         if proc.returncode == 0:
@@ -568,7 +569,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_UNCHECKED
     try:
         env = {**_chock_os.environ, 'CHOCK_RAW_COMMAND': command}
-        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS)
+        proc = _chock_subprocess.run([bash, str(guard), *args], capture_output=True, text=True, encoding='utf-8', errors='replace', env=env, timeout=_GUARD_TIMEOUT_SECONDS, check=False)
     except _chock_subprocess.TimeoutExpired:
         print(f'chock: guard timed out after {_GUARD_TIMEOUT_SECONDS}s, not checked', file=sys.stderr)
         return GUARD_ERRORED
@@ -587,7 +588,7 @@ def run_guard(guard: _chock_Path, command: str) -> str:
         return GUARD_ERRORED
     return GUARD_CLEAN
 
-def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
+def log_outcome(guard: _chock_Path, tool: str, *, blocked: bool) -> None:
     """Append one outcome record. Best effort: never raises, never changes the verdict."""
     try:
         if _chock_os.environ.get(GATE_LOG_ENV) == '0':
@@ -607,7 +608,6 @@ def log_outcome(guard: _chock_Path, tool: str, blocked: bool) -> None:
         log_path = log_dir / 'gate-events.jsonl'
         if log_path.exists() and log_path.stat().st_size > _LOG_MAX_BYTES:
             log_path.replace(log_dir / 'gate-events.1.jsonl')
-        import json
         record = {'ts': _chock_datetime.now(_chock_timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'), 'policy_id': guard.parent.parent.name, 'surface': 'pre-tool-use', 'event': 'tool_use', 'kind': guard.stem, 'tool': tool, 'verdict': 'block' if blocked else 'allow'}
         with log_path.open('a', encoding='utf-8') as fh:
             fh.write(json.dumps(record, ensure_ascii=False) + '\n')
@@ -621,7 +621,7 @@ def evaluate(argv: list[str], command: str, tool: str='') -> tuple[str, str] | N
         return None
     verdict = run_guard(guard, command)
     if verdict in (GUARD_BLOCKED, GUARD_CLEAN):
-        log_outcome(guard, tool, verdict == GUARD_BLOCKED)
+        log_outcome(guard, tool, blocked=verdict == GUARD_BLOCKED)
     if verdict == GUARD_BLOCKED:
         return (VERDICT_DENY, f'Blocked by chock policy: {guard.stem}')
     if verdict == GUARD_ERRORED:
diff --git a/tests/test_config.py b/tests/test_config.py
index 3708339..a9a5f58 100644
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -67,7 +67,7 @@ def test_set_disabled_round_trips_without_clobbering_defaults(tmp_path: Path) ->
         encoding="utf-8",
     )
 
-    set_disabled(tmp_path, "block-no-verify", True)
+    set_disabled(tmp_path, "block-no-verify", disabled=True)
 
     after = yaml.safe_load(config_path.read_text(encoding="utf-8"))
     assert after["policies"]["disabled"] == ["block-no-verify"]
@@ -83,7 +83,7 @@ def test_set_disabled_can_enable(tmp_path: Path) -> None:
         encoding="utf-8",
     )
 
-    set_disabled(tmp_path, "block-no-verify", False)
+    set_disabled(tmp_path, "block-no-verify", disabled=False)
 
     after = yaml.safe_load(config_path.read_text(encoding="utf-8"))
     assert after["policies"]["disabled"] == []
diff --git a/tests/test_copilot_hook_runtime.py b/tests/test_copilot_hook_runtime.py
index 967070d..69f3c4c 100644
--- a/tests/test_copilot_hook_runtime.py
+++ b/tests/test_copilot_hook_runtime.py
@@ -59,7 +59,7 @@ def test_hook_allows_when_the_plugin_root_cannot_be_resolved(policy, tmp_path: P
 
     env = {k: v for k, v in os.environ.items() if k != "PLUGIN_ROOT"}
     for label, extra in (("unset", {}), ("set but wrong", {"PLUGIN_ROOT": str(tmp_path / "nope")})):
-        done = subprocess.run(  # noqa: S602 - `shell=True` IS the client's invocation under test
+        done = subprocess.run(  # `shell=True` IS the client's invocation under test
             command,
             shell=True,
             input='{"tool_name":"Bash","tool_input":{"command":"rm -rf /"}}',
diff --git a/tests/test_literal_duplication.py b/tests/test_literal_duplication.py
new file mode 100644
index 0000000..be93a31
--- /dev/null
+++ b/tests/test_literal_duplication.py
@@ -0,0 +1,96 @@
+"""tools/check_literal_duplication.py: the check itself, and that src/ passes it."""
+
+from __future__ import annotations
+
+import json
+import textwrap
+from pathlib import Path
+
+import check_literal_duplication as literal_dup
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_src_has_no_undeclared_repeated_literals() -> None:
+    violations = literal_dup.find_violations(ROOT / "src")
+    assert not violations, f"repeated literals need a constant or an allowlist entry: {sorted(violations)}"
+
+
+def test_allowlist_entries_all_carry_a_reason() -> None:
+    allowlist = literal_dup.load_allowlist()
+    for literal, reason in allowlist.items():
+        assert isinstance(reason, str) and reason.strip(), literal
+
+
+def test_allowlist_rejects_empty_reason(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    bad = tmp_path / "allowlist.json"
+    bad.write_text(json.dumps({"some literal": "   "}), encoding="utf-8")
+    monkeypatch.setattr(literal_dup, "ALLOWLIST_PATH", bad)
+    with pytest.raises(ValueError, match="no reason"):
+        literal_dup.load_allowlist()
+
+
+def test_docstrings_are_not_flagged(tmp_path: Path) -> None:
+    (tmp_path / "mod.py").write_text(
+        textwrap.dedent(
+            '''
+            """This is a plenty-long module docstring, repeated below."""
+
+            class C:
+                """This is a plenty-long module docstring, repeated below."""
+
+                def m(self):
+                    """This is a plenty-long module docstring, repeated below."""
+            '''
+        ),
+        encoding="utf-8",
+    )
+    assert literal_dup.scan(tmp_path) == {}
+
+
+def test_repeated_non_docstring_literal_is_found(tmp_path: Path) -> None:
+    literal = "x" * 25
+    (tmp_path / "a.py").write_text(f'A = "{literal}"\n', encoding="utf-8")
+    (tmp_path / "b.py").write_text(f'B = "{literal}"\n', encoding="utf-8")
+    (tmp_path / "c.py").write_text(f'C = "{literal}"\n', encoding="utf-8")
+    occurrences = literal_dup.scan(tmp_path)
+    assert len(occurrences[literal]) == 3
+
+
+def test_short_literals_are_not_flagged(tmp_path: Path) -> None:
+    short = "x" * (literal_dup.MIN_LITERAL_LEN - 1)
+    for name in "abc":
+        (tmp_path / f"{name}.py").write_text(f'V = "{short}"\n', encoding="utf-8")
+    assert literal_dup.scan(tmp_path) == {}
+
+
+def test_data_templates_tests_dirs_are_excluded(tmp_path: Path) -> None:
+    literal = "y" * 25
+    for sub in ("data", "templates", "tests"):
+        d = tmp_path / sub
+        d.mkdir()
+        (d / "m.py").write_text(f'V = "{literal}"\n', encoding="utf-8")
+    (tmp_path / "one_more.py").write_text(f'V = "{literal}"\n', encoding="utf-8")
+    occurrences = literal_dup.scan(tmp_path)
+    # Only the top-level file counts -- the three excluded dirs don't contribute.
+    assert occurrences[literal] == [tmp_path / "one_more.py"]
+
+
+def test_allowlisted_literal_is_not_a_violation(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    literal = "z" * 25
+    for name in "abc":
+        (tmp_path / f"{name}.py").write_text(f'V = "{literal}"\n', encoding="utf-8")
+    allowlist_path = tmp_path / "allowlist.json"
+    allowlist_path.write_text(json.dumps({literal: "deliberately shared across a, b, c"}), encoding="utf-8")
+    monkeypatch.setattr(literal_dup, "ALLOWLIST_PATH", allowlist_path)
+    assert literal_dup.find_violations(tmp_path) == {}
+
+
+def test_cli_reports_violations_via_exit_code(tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys) -> None:
+    literal = "w" * 25
+    for name in "abc":
+        (tmp_path / f"{name}.py").write_text(f'V = "{literal}"\n', encoding="utf-8")
+    monkeypatch.setattr(literal_dup, "ALLOWLIST_PATH", tmp_path / "does-not-exist.json")
+    assert literal_dup.main([str(tmp_path)]) == 1
+    assert literal in capsys.readouterr().err
diff --git a/tests/test_manifest_id_safety.py b/tests/test_manifest_id_safety.py
index a04b683..e900adc 100644
--- a/tests/test_manifest_id_safety.py
+++ b/tests/test_manifest_id_safety.py
@@ -8,7 +8,7 @@
 import pytest
 
 from chock.compile.compiler import compile_policy
-from chock.policy_id import InvalidPolicyId, validate_policy_id
+from chock.policy_id import InvalidPolicyIdError, validate_policy_id
 from chock.scaffold.add import _reject_unsafe_id, locate
 
 FRAMEWORK_ROOT = Path(__file__).resolve().parents[1]
@@ -40,12 +40,12 @@ def test_validate_policy_id_accepts_the_canonical_shape():
     ],
 )
 def test_validate_policy_id_rejects_unsafe_ids(bad_id):
-    with pytest.raises(InvalidPolicyId):
+    with pytest.raises(InvalidPolicyIdError):
         validate_policy_id(bad_id, bad_id)
 
 
 def test_validate_policy_id_requires_folder_match():
-    with pytest.raises(InvalidPolicyId):
+    with pytest.raises(InvalidPolicyIdError):
         validate_policy_id("branch-guard", "protect-main-branch")
 
 
diff --git a/tests/test_properties.py b/tests/test_properties.py
index 15664f4..ee563bd 100644
--- a/tests/test_properties.py
+++ b/tests/test_properties.py
@@ -9,7 +9,7 @@
 from hypothesis import strategies as st
 
 from chock.compile.surfaces import parse_agent_selection
-from chock.policy_id import POLICY_ID_RE, InvalidPolicyId, validate_policy_id
+from chock.policy_id import POLICY_ID_RE, InvalidPolicyIdError, validate_policy_id
 
 SAFE_CHARS = set(string.ascii_lowercase + string.digits + "-")
 
@@ -31,7 +31,7 @@ def test_validator_agrees_with_the_published_pattern(candidate: str) -> None:
     if POLICY_ID_RE.fullmatch(candidate):
         validate_policy_id(candidate, candidate)
     else:
-        with pytest.raises(InvalidPolicyId):
+        with pytest.raises(InvalidPolicyIdError):
             validate_policy_id(candidate, candidate)
 
 
@@ -39,7 +39,7 @@ def test_validator_agrees_with_the_published_pattern(candidate: str) -> None:
 def test_one_hot_byte_anywhere_is_rejected(policy_id: str, hot: str) -> None:
     for pos in (0, len(policy_id) // 2, len(policy_id)):
         poisoned = policy_id[:pos] + hot + policy_id[pos:]
-        with pytest.raises(InvalidPolicyId):
+        with pytest.raises(InvalidPolicyIdError):
             validate_policy_id(poisoned, poisoned)
 
 
@@ -48,7 +48,7 @@ def test_id_must_equal_folder(policy_id: str, folder: str) -> None:
     if policy_id == folder:
         validate_policy_id(policy_id, folder)
     else:
-        with pytest.raises(InvalidPolicyId):
+        with pytest.raises(InvalidPolicyIdError):
             validate_policy_id(policy_id, folder)
 
 
diff --git a/tools/check_literal_duplication.py b/tools/check_literal_duplication.py
new file mode 100644
index 0000000..c6439ca
--- /dev/null
+++ b/tools/check_literal_duplication.py
@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""Sonar S1192-style check: string literals repeated 3+ times are a maintenance bug.
+
+Flags any non-docstring string constant, >= MIN_LITERAL_LEN chars, that appears
+>= MIN_OCCURRENCES times across the scanned Python files, outside data/, templates/
+and tests/ directories (those are expected to hold or exercise repeated text) --
+unless the literal is listed in literal_duplication_allowlist.json with a reason.
+"""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import json
+import sys
+from collections import defaultdict
+from pathlib import Path
+
+MIN_LITERAL_LEN = 20
+MIN_OCCURRENCES = 3
+
+#: Path segments whose contents are expected to hold or exercise repeated text.
+_EXCLUDED_PATH_PARTS = {"data", "templates", "tests"}
+#: Vendored/bundled output, not source this check should police (see pyproject.toml
+#: [tool.ruff] extend-exclude for the matching rationale).
+_EXCLUDED_PATH_PREFIXES = (".chock/bin",)
+
+ALLOWLIST_PATH = Path(__file__).with_name("literal_duplication_allowlist.json")
+
+
+class AllowlistEntryMissingReasonError(ValueError):
+    """An allowlist entry has no (or a blank) reason explaining the duplication."""
+
+    def __init__(self, literal: str) -> None:
+        super().__init__(f"literal_duplication_allowlist.json entry has no reason: {literal!r}")
+
+
+def _docstring_node_ids(tree: ast.Module) -> set[int]:
+    """id() of every Constant node that is a module/class/function docstring."""
+    ids: set[int] = set()
+    scopes: list[ast.AST] = [tree]
+    scopes.extend(n for n in ast.walk(tree) if isinstance(n, ast.ClassDef | ast.FunctionDef | ast.AsyncFunctionDef))
+    for node in scopes:
+        body = getattr(node, "body", None)
+        if not body:
+            continue
+        first = body[0]
+        if isinstance(first, ast.Expr) and isinstance(first.value, ast.Constant) and isinstance(first.value.value, str):
+            ids.add(id(first.value))
+    return ids
+
+
+def _literals_in_file(path: Path) -> list[str]:
+    try:
+        source = path.read_text(encoding="utf-8")
+        tree = ast.parse(source, filename=str(path))
+    except (SyntaxError, UnicodeDecodeError, OSError):
+        return []
+    skip_ids = _docstring_node_ids(tree)
+    return [
+        node.value
+        for node in ast.walk(tree)
+        if isinstance(node, ast.Constant)
+        and isinstance(node.value, str)
+        and len(node.value) >= MIN_LITERAL_LEN
+        and id(node) not in skip_ids
+    ]
+
+
+def _is_excluded(rel_path: Path) -> bool:
+    posix = rel_path.as_posix()
+    if any(posix.startswith(prefix) for prefix in _EXCLUDED_PATH_PREFIXES):
+        return True
+    return any(part in _EXCLUDED_PATH_PARTS for part in rel_path.parts[:-1])
+
+
+def scan(root: Path) -> dict[str, list[Path]]:
+    """Map each qualifying literal to every file it occurs in (repeats included)."""
+    occurrences: dict[str, list[Path]] = defaultdict(list)
+    for path in sorted(root.rglob("*.py")):
+        if _is_excluded(path.relative_to(root)):
+            continue
+        for literal in _literals_in_file(path):
+            occurrences[literal].append(path)
+    return occurrences
+
+
+def load_allowlist() -> dict[str, str]:
+    """literal -> reason. Raises if any entry lacks a non-empty reason."""
+    if not ALLOWLIST_PATH.exists():
+        return {}
+    raw = json.loads(ALLOWLIST_PATH.read_text(encoding="utf-8"))
+    for literal, reason in raw.items():
+        if not isinstance(reason, str) or not reason.strip():
+            raise AllowlistEntryMissingReasonError(literal)
+    return raw
+
+
+def find_violations(root: Path) -> dict[str, list[Path]]:
+    """Qualifying literals repeated >= MIN_OCCURRENCES times and not allowlisted."""
+    allowlist = load_allowlist()
+    occurrences = scan(root)
+    return {
+        literal: files
+        for literal, files in occurrences.items()
+        if len(files) >= MIN_OCCURRENCES and literal not in allowlist
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("root", nargs="?", default="src", help="directory to scan (default: src)")
+    args = parser.parse_args(argv)
+    violations = find_violations(Path(args.root))
+    if not violations:
+        print("No repeated literals found.")
+        return 0
+    for literal, files in sorted(violations.items(), key=lambda kv: -len(kv[1])):
+        print(f"{len(files)}x {literal!r}", file=sys.stderr)
+        for f in files:
+            print(f"    {f}", file=sys.stderr)
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/literal_duplication_allowlist.json b/tools/literal_duplication_allowlist.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/tools/literal_duplication_allowlist.json
@@ -0,0 +1 @@
+{}