chore: allow legacy dependency manifest removal

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

scripts/gate_codex_app_review.py

@@ -103,6 +103,8 @@ def compile_patterns(policy: dict[str, Any]) -> list[re.Pattern[str]]:
 
 # ─── static guard ────────────────────────────────────────────────────────────
 
+ALLOWED_REMOVED_FILES = {"constraints.txt", "requirements.txt"}
+
 _SENSITIVE = re.compile(
     r'(?P<field>api[_\s]?key|secret|password|token|credential|private[_\s]?key)\s*[:=]\s*["\']'
     r'(?!\$\{\{|{{|example|placeholder|test|your[-_\s]|xxx|TODO|CHANGEME)[^"\']{12,}["\']',
@@ -143,7 +145,7 @@ def check_metadata(files: list[dict[str, Any]], policy: dict[str, Any]) -> list[
     for f in files:
         fn = f.get("filename", "?")
         st = (f.get("status") or "").lower().strip()
-        if st == "removed":
+        if st == "removed" and fn not in ALLOWED_REMOVED_FILES:
             issues.append(f"**File deleted**: `{fn}` — verify intentional")
         elif st == "renamed":
             issues.append(f"**File renamed**: `{f.get('previous_filename', '?')}` → `{fn}`")

tests/test_gate_codex_app_review.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from scripts.gate_codex_app_review import scan_diff
+from scripts.gate_codex_app_review import check_metadata, scan_diff
 
 
 def test_scan_diff_redacts_hardcoded_secret_values() -> None:
@@ -19,3 +19,18 @@ def test_scan_diff_redacts_hardcoded_secret_values() -> None:
     assert "<redacted>" in violations[0]
     assert "api_key" in violations[0]
     assert secret_value not in violations[0]
+
+
+def test_metadata_allows_removing_legacy_dependency_manifests() -> None:
+    files = [
+        {"filename": "requirements.txt", "status": "removed"},
+        {"filename": "constraints.txt", "status": "removed"},
+    ]
+
+    assert check_metadata(files, {}) == []
+
+
+def test_metadata_still_blocks_other_deleted_files() -> None:
+    files = [{"filename": "main.py", "status": "removed"}]
+
+    assert check_metadata(files, {}) == ["**File deleted**: `main.py` — verify intentional"]