Skip Carried Verbatim Trees in Rendered Reviewer Configs

.coderabbit.yaml

@@ -1,5 +1,6 @@
-# The two trees below are what scripts/build_dist.py generates from .agents/skills/ and CI holds current.
+# The first two trees below are what scripts/build_dist.py generates from .agents/skills/ and CI holds current.
 # A finding in either therefore belongs at its source, and a review of every copy is one finding three times.
+# The third is a tree spec/files.json carries verbatim, which scripts/agent_policy.py requires every repository's file to skip.
 reviews:
   # Auto review covers only the default branch unless a base is listed here, each entry a regex.
   # The default branch stays included whatever is listed.
@@ -13,6 +14,7 @@ reviews:
   path_filters:
     - "!.github/skills/**"
     - "!.claude-plugin/fleet-skills/**"
+    - "!lib/fleet/sh/**"
   # Canonical prose is linted for style in CI and read whole by the local review pass.
   # A review comment on it therefore earns its place only by naming something false or unfollowable.
   path_instructions:

.pr_agent.toml

@@ -1,7 +1,8 @@
-# The two trees below are what scripts/build_dist.py generates from .agents/skills/ and CI holds current.
+# The first two trees below are what scripts/build_dist.py generates from .agents/skills/ and CI holds current.
 # A finding in either therefore belongs at its source, and a review of every copy is one finding three times.
+# The third is a tree spec/files.json carries verbatim, which scripts/agent_policy.py requires every repository's file to skip.
 [ignore]
-glob = ['.github/skills/**', '.claude-plugin/fleet-skills/**']
+glob = ['.github/skills/**', '.claude-plugin/fleet-skills/**', 'lib/fleet/sh/**']
 
 [review_agent]
 # A crash claimed against a name the build accepts was disproven by running the build.

docs/pr-reviewer-reference.md

@@ -64,7 +64,7 @@ The formal review body was empty. All useful state lived in inline comments, so
 
 ### Generated Mirrors
 
-`.github/skills/` and `.claude-plugin/fleet-skills/` are the trees `scripts/build_dist.py` generates from `.agents/skills/`, and CI holds them current. So a finding in either belongs at its source, and a review of every copy is one finding three times. Two committed files tell CodeRabbit and Qodo to skip them. Copilot's exclusion is a repository setting this account does not have, so `.github/copilot-instructions.md` asks instead.
+`.github/skills/` and `.claude-plugin/fleet-skills/` are the trees `scripts/build_dist.py` generates from `.agents/skills/`, and CI holds them current. So a finding in either belongs at its source, and a review of every copy is one finding three times. Two committed files tell CodeRabbit and Qodo to skip them. A fleet repository carries `.github/skills/` byte for byte, so the `.coderabbit.yaml` and `.pr_agent.toml` that `repo-config/configure.sh` renders there skip it too. They skip every other tree `spec/files.json` carries verbatim as well. Copilot's exclusion is a repository setting this account does not have, so `.github/copilot-instructions.md` asks instead.
 
 - **CodeRabbit** reads [`reviews.path_filters`][coderabbit-config] from `.coderabbit.yaml` at the repository root, where a pattern prefixed with `!` excludes.
 - **Qodo** reads [its configuration][qodo-config] from `.pr_agent.toml` at the root of the default branch, so the file binds only once it is promoted to `main`. Its [`[ignore]` glob list][qodo-ignore] names the paths to skip.

repo-config/README.md

@@ -109,7 +109,7 @@ The fleet-standard general settings live in [`settings.json`][settings-json] and
 
 `scripts/agent_policy.py` renders each repository's `.github/agent-policy.json` from `spec/agent-policy.default.json` and the registry entry. An entry may carry an optional `agentPolicy` with a `review.bots` object holding any subset of the fields of `copilot`, `coderabbit`, and `qodo`. Each bot's object is the default bot merged shallowly with the override. The `guard` section cannot be declared, since the workflow model alone decides it. `spec/validate.py` runs the renderer for every entry that declares one, so a malformed override fails CI.
 
-The same render drives the bot-side settings. Copilot's ruleset rule follows the render, as the Rulesets section states. CodeRabbit's `reviews.auto_review.enabled` and `base_branches` in `.coderabbit.yaml` follow it, and so does Qodo's `config.disable_auto_feedback` in `.pr_agent.toml`. The same file always sets `auto_pause_after_reviewed_commits` to `0`. That is because a repository's file replaces CodeRabbit's central and UI settings unless it sets `inheritance: true`, so CodeRabbit's default pause would apply otherwise. CodeRabbit's automatic review always includes the default branch, so an automatic CodeRabbit whose `bases` lack `@default` is refused. Qodo's automatic review covers every pull request. An automatic Qodo whose `bases` miss `main` or `develop` is therefore refused. CodeRabbit's `base_branches` search where a policy base matches whole. So each base is written as `^(?:base)$`, unless it already starts with `^` and ends with an unescaped `$`.
+The same render drives the bot-side settings. Copilot's ruleset rule follows the render, as the Rulesets section states. CodeRabbit's `reviews.auto_review.enabled` and `base_branches` in `.coderabbit.yaml` follow it, and so does Qodo's `config.disable_auto_feedback` in `.pr_agent.toml`. The same file always sets `auto_pause_after_reviewed_commits` to `0`. That is because a repository's file replaces CodeRabbit's central and UI settings unless it sets `inheritance: true`, so CodeRabbit's default pause would apply otherwise. Both files also always skip each tree `spec/files.json` carries verbatim, such as `.github/skills/`. CodeRabbit's `reviews.path_filters` holds `!.github/skills/**`, and Qodo's `ignore.glob` holds `.github/skills/**`. Such a tree is the hub's text byte for byte. So a finding on it belongs at the hub's source, not on a carrier's pull request. Each entry is added beside any the repository lists, and only its absence is drift. CodeRabbit's automatic review always includes the default branch, so an automatic CodeRabbit whose `bases` lack `@default` is refused. Qodo's automatic review covers every pull request. An automatic Qodo whose `bases` miss `main` or `develop` is therefore refused. CodeRabbit's `base_branches` search where a policy base matches whole. So each base is written as `^(?:base)$`, unless it already starts with `^` and ends with an unescaped `$`.
 
 `repo-config/configure.sh apply owner/repo --checkout <path>` writes the three files into a local checkout of that repository. It touches only the keys above in the two bot files, keeps every other key and comment, and creates an absent file. It refuses a checkout whose `origin` is another repository, and a path that is not the work tree's top level. `apply` plans the files with `write --dry-run` before its first API write, so a checkout that refuses stops the run with nothing applied. It never stages or commits, so the caller commits the files through the ordinary pull request flow. Without `--checkout`, `apply` writes no policy files and says so.
 

scripts/README.md

@@ -474,7 +474,7 @@ uv run --no-project --script scripts/agent_policy.py write --registry registry/r
 uv run --no-project --script scripts/agent_policy.py check --registry registry/repos.json --name Fixture --model release --repo acme/widget --ref main
 ```
 
-`facts` is the read-only view of the bot settings `write` applies and of where `rulesets` places the Copilot rule. It prints whether the Copilot ruleset rule belongs on `main` and on `develop`, CodeRabbit's `enabled`, `base_branches` and `auto_pause_after_reviewed_commits`, and Qodo's `disable_auto_feedback`. `rulesets` writes `main.json` and `develop.json` into `--out-dir`, composed from the hub's `repo-config/` payloads the model selects. Each is its source payload with the Copilot rule placed where `facts` says, in the shape the `main` source carries. Each payload carrying the required status check rule drops it where the entry declares `pullRequestCheck: false`. `write` refuses unless the checkout is a work tree's top level whose `origin` is the named repository. `render` also refuses an automatic Qodo that misses `main` or `develop`. CodeRabbit's `base_branches` are written as `^(?:base)$` unless already anchored. It writes the policy file whole and sets only those keys in `.coderabbit.yaml` and `.pr_agent.toml`, keeping everything else. An existing file keeps its own line endings. A new file is written CRLF where its `.editorconfig` files set `end_of_line = crlf` for it, and LF otherwise. Those files are read up the directory tree as an editor reads them, until one sets `root = true`. It plans all three files before writing any, so one refusal leaves the checkout untouched. It prints `wrote` or `unchanged` per file and never stages or commits. `--dry-run` plans only and prints `would write` or `unchanged`. `check` reads the three files through the contents API and prints `ok` or `FAIL` per assertion. It exits `0` when clean and `1` on a refusal, drift or a missing file. It exits `2` when the command could not run or a file could not be read. The YAML, TOML and EditorConfig libraries are imported only by `write` and `check`, so `render`, `facts` and `rulesets` run on the standard library.
+`facts` is the read-only view of the bot settings `write` applies and of where `rulesets` places the Copilot rule. It prints whether the Copilot ruleset rule belongs on `main` and on `develop`, CodeRabbit's `enabled`, `base_branches`, `auto_pause_after_reviewed_commits` and `path_filters`, and Qodo's `disable_auto_feedback` and `ignore_glob`. `rulesets` writes `main.json` and `develop.json` into `--out-dir`, composed from the hub's `repo-config/` payloads the model selects. Each is its source payload with the Copilot rule placed where `facts` says, in the shape the `main` source carries. Each payload carrying the required status check rule drops it where the entry declares `pullRequestCheck: false`. `write` refuses unless the checkout is a work tree's top level whose `origin` is the named repository. `render` also refuses an automatic Qodo that misses `main` or `develop`. CodeRabbit's `base_branches` are written as `^(?:base)$` unless already anchored. It writes the policy file whole and sets only those keys in `.coderabbit.yaml` and `.pr_agent.toml`, keeping everything else. The two exclusion lists gain each required entry they lack and keep the repository's own, and `check` fails only a required entry that is missing. An existing file keeps its own line endings. A new file is written CRLF where its `.editorconfig` files set `end_of_line = crlf` for it, and LF otherwise. Those files are read up the directory tree as an editor reads them, until one sets `root = true`. It plans all three files before writing any, so one refusal leaves the checkout untouched. It prints `wrote` or `unchanged` per file and never stages or commits. `--dry-run` plans only and prints `would write` or `unchanged`. `check` reads the three files through the contents API and prints `ok` or `FAIL` per assertion. It exits `0` when clean and `1` on a refusal, drift or a missing file. It exits `2` when the command could not run or a file could not be read. The YAML, TOML and EditorConfig libraries are imported only by `write` and `check`, so `render`, `facts` and `rulesets` run on the standard library.
 
 ## `central_config.py`