[UC-3697] Configure pre-commit and agentic enablement for fdm_materials

.agents/hooks.json

@@ -0,0 +1,38 @@
+{
+  "safety-and-compliance": {
+    "PreToolUse": [
+      {
+        "matcher": "run_command|write_to_file|replace_file_content|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 .agents/hooks/block-absolute-paths.py",
+            "timeout": 15
+          },
+          {
+            "type": "command",
+            "command": "python3 .agents/hooks/block-secrets.py",
+            "timeout": 15
+          },
+          {
+            "type": "command",
+            "command": "python3 .agents/hooks/git-branch-guard.py",
+            "timeout": 15
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "write_to_file|replace_file_content|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .agents/hooks/post-edit-linter.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ]
+  }
+}

.agents/hooks/block-absolute-paths.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+import sys, re, subprocess
+
+def check_staged_files():
+    result = subprocess.run(["git", "diff", "--cached", "--name-only"], capture_output=True, text=True)
+    files = [f for f in result.stdout.splitlines() if f.strip()]
+
+    home_pattern = re.compile(r'/home/[a-zA-Z0-9_-]+/')
+    users_pattern = re.compile(r'/Users/[a-zA-Z0-9_-]+/')
+
+    failed = False
+    for filepath in files:
+        if "block-absolute-paths.py" in filepath or "AGENTS.md" in filepath:
+            continue
+        try:
+            with open(filepath, "r", encoding="utf-8", errors="ignore") as f:
+                for idx, line in enumerate(f, 1):
+                    if home_pattern.search(line) or users_pattern.search(line):
+                        print(f"SECURITY ERROR: Absolute path detected in {filepath}:{idx}: {line.strip()}")
+                        failed = True
+        except Exception:
+            pass
+
+    if failed:
+        sys.exit(1)
+
+if __name__ == "__main__":
+    check_staged_files()

.agents/hooks/block-secrets.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+import sys, re, subprocess
+
+SECRET_PATTERNS = [
+    re.compile(r'-----BEGIN (?:RSA|OPENSSH|DSA|EC|PGP) PRIVATE KEY-----'),
+    re.compile(r'AIzaSy[A-Za-z0-9_-]{33}'),
+    re.compile(r'ghp_[A-Za-z0-9]{36}'),
+    re.compile(r'glpat-[A-Za-z0-9_-]{20}')
+]
+
+def check_secrets():
+    result = subprocess.run(["git", "diff", "--cached", "--name-only"], capture_output=True, text=True)
+    files = [f for f in result.stdout.splitlines() if f.strip()]
+
+    failed = False
+    for filepath in files:
+        if "block-secrets.py" in filepath:
+            continue
+        try:
+            with open(filepath, "r", encoding="utf-8", errors="ignore") as f:
+                for idx, line in enumerate(f, 1):
+                    for pattern in SECRET_PATTERNS:
+                        if pattern.search(line):
+                            print(f"SECURITY ERROR: Secret detected in {filepath}:{idx}")
+                            failed = True
+        except Exception:
+            pass
+
+    if failed:
+        sys.exit(1)
+
+if __name__ == "__main__":
+    check_secrets()

.agents/hooks/git-branch-guard.py

@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+import sys, subprocess
+
+FORBIDDEN_BRANCHES = ["main", "master", "staging"]
+
+def check_branch():
+    result = subprocess.run(["git", "rev-parse", "--abbrev-ref", "HEAD"], capture_output=True, text=True)
+    branch = result.stdout.strip()
+    if branch in FORBIDDEN_BRANCHES:
+        print(f"BRANCH GUARD ERROR: Cannot commit directly to '{branch}' branch. Create a feature/bugfix branch.")
+        sys.exit(1)
+
+if __name__ == "__main__":
+    check_branch()

.agents/hooks/post-edit-linter.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -e
+
+# Run quick format/linter checks if available
+if command -v flake8 >/dev/null 2>&1; then
+  git diff --name-only --cached | grep -E '\.py$' | xargs -r flake8 --select=E9,F63,F7,F82 || true
+fi

.agents/rules/01-jira-commit-standards.md

@@ -0,0 +1,13 @@
+---
+description: Jira work tracking and commit message standards.
+---
+# Jira & Git Commit Standards
+
+1. **Jira Work Tracking**:
+   - All branches MUST reference an active Jira ticket starting with project key `UC` (e.g. `UC-123_description`).
+2. **Commit Title Standard**:
+   - Every commit title MUST start with bracketed Jira ticket key: `[UC-XXXX] <Descriptive Title>`.
+   - Do NOT use semantic commit prefixes (`feat:`, `fix:`, `chore:`, `refactor:`) in commit or PR titles.
+3. **Pull Request Policy**:
+   - Always open PRs in **DRAFT** state.
+   - Merging is strictly restricted to human developers.

.agents/rules/02-security-and-paths.md

@@ -0,0 +1,12 @@
+---
+description: Security guidelines, secret protection, and path sanitation.
+---
+# Security & Path Protection Guidelines
+
+1. **No Hardcoded Absolute Paths**:
+   - Never commit absolute local filesystem paths (e.g. `/home/username/` or `/Users/username/`).
+2. **No Secret Leaks**:
+   - Never commit private keys, API tokens, or passphrases.
+   - Use RAM-backed filesystem mounts (`/dev/shm`) for temporary secret processing.
+3. **Branch Guard**:
+   - Direct commits to `main`, `master`, or `staging` branches are strictly forbidden.

.agents/rules/03-fdm-material-rules.md

@@ -0,0 +1,10 @@
+---
+paths:
+  - "**/*.xml.fdm_material"
+---
+# Material Profile Guidelines (fdm_materials)
+
+1. **Schema Compliance**:
+   - All profile changes MUST pass `./run_check_material_profiles.sh`.
+2. **GUID Stability**:
+   - Material GUIDs must remain strictly stable across profile updates for WASM slicing resolution.

.agents/rules/04-debian-package-and-deployment-rules.md

@@ -0,0 +1,21 @@
+---
+description: Guidelines for compiling Debian packages, managing recipes, and deploying to printers.
+---
+# Debian Packaging, Recipe Management & Printer Deployment
+
+1. **Compiling Debian Packages**:
+   - Service build script: `./build_for_ultimaker.sh`.
+   - Packages compile into `.deb` artifacts inside local Docker container environments.
+2. **Firmware Recipe Integration (`jedi-cookbook`)**:
+   - Firmware update images (`.swu`) bundle debian packages specified in `.recipe` files under `S-Line/`, `Falcon/`, `Colorado/`, or `UM3/`.
+   - Recipe line format: `deb <package_name> <version>`.
+   - Recipe version bumps: Ensure the corresponding `.deb` package artifact is built and published upstream before updating recipe versions.
+3. **Deploying Packages & Testing on Printers**:
+   - Deploy compiled service packages directly to a networked test printer:
+     ```bash
+     ../jedi-build/deploy_to_printer.sh deploy <package_name> <printer-ip>
+     ```
+   - Interactive SSH terminal access to printer:
+     ```bash
+     ./dev/umssh.sh <printer-ip>
+     ```

.agents/rules/05-ultimaker-skill-discovery-rules.md

@@ -0,0 +1,26 @@
+---
+description: Mandate for dynamic discovery and usage of domain-specific UltiMaker engineering skills from UltiCortex.
+---
+# Dynamic UltiMaker AI Skill Discovery & Usage
+
+AI agents working in this repository MUST dynamically discover and install specialized domain skills from `Ultimaker/UltiCortex` when performing relevant tasks:
+
+```bash
+# Search available skills
+gh skill search ultimaker --owner Ultimaker
+
+# Install specific skill
+gh skill install Ultimaker/UltiCortex <skill-name>
+```
+
+## Mandated Skill Triggers
+1. **`ultimaker-printer-ssh`**:
+   - **Trigger**: When deploying packages, checking DBus properties, testing build outputs, or troubleshooting local services on physical or emulated 3D printers over SSH.
+2. **`ultimaker-digital-factory`**:
+   - **Trigger**: When working on cloud state synchronization, WSS WebSocket connections, IoT connectivity, telemetry, or Digital Factory API features.
+3. **`ultimaker-log-analyzer`**:
+   - **Trigger**: When analyzing log dumps (`/var/log/messages`, systemd journal, `opinicus.log`, `okuda.log`, `stardust.log`).
+4. **`ultimaker-firmware-developer`**:
+   - **Trigger**: When modifying core DBus interfaces, state machine frameworks, or CMake/Conan build tooling.
+ 5. **`ultimaker-support-articles`**:
+   - **Trigger**: When introducing user-facing feature changes or behavioral shifts that impact public documentation or support workflows.

.agents/rules/06-pull-request-lifecycle-rules.md

@@ -0,0 +1,25 @@
+---
+description: Mandatory pre-PR local verification, PR description structure, Copilot review request, and CI status check watch loop.
+---
+# Pull Request Lifecycle & Quality Gate Policy
+
+1. **Mandatory Local Pre-PR Verification**:
+   - Before creating or updating any Pull Request, run local verification checks (`pre-commit run --all-files`, `./build_for_ultimaker.sh`, unit tests, linters).
+   - Only create or update the PR if all local checks pass cleanly without errors.
+
+2. **Pull Request Creation & Description Standards**:
+   - All PRs MUST be created in **DRAFT** state (`gh pr create --draft`).
+   - Title MUST start with the bracketed Jira ticket key: `[PROJECT-KEY] <Descriptive Title>`.
+   - Description MUST include:
+     - Active Jira issue link (`EMB-XXX`).
+     - Overview of changes ("Why" and "How").
+     - Support documentation warning block (`> [!WARNING]`) if support articles are impacted.
+     - Empty human reviewer checklist at the bottom: `- [ ] Initiating developer reviewed AI-generated code`.
+
+3. **Copilot AI Review & CI Watch Loop**:
+   - Request Copilot AI review on PR (`gh pr comment <PR> --body "@github-copilot review"`).
+   - Monitor CI status checks (`gh pr checks <PR> --watch`).
+   - Address and resolve all Copilot review comments and threads before considering PR ready.
+
+4. **Human Merge Policy**:
+   - Merging is strictly restricted to human developers. AI agents MUST NOT merge PRs.

.claude/hooks.json

@@ -0,0 +1,38 @@
+{
+  "safety-and-compliance": {
+    "PreToolUse": [
+      {
+        "matcher": "run_command|write_to_file|replace_file_content|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 .agents/hooks/block-absolute-paths.py",
+            "timeout": 15
+          },
+          {
+            "type": "command",
+            "command": "python3 .agents/hooks/block-secrets.py",
+            "timeout": 15
+          },
+          {
+            "type": "command",
+            "command": "python3 .agents/hooks/git-branch-guard.py",
+            "timeout": 15
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "write_to_file|replace_file_content|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .agents/hooks/post-edit-linter.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ]
+  }
+}

.claude/rules/debian-package-and-deployment-rules.md

@@ -0,0 +1,21 @@
+---
+description: Guidelines for compiling Debian packages, managing recipes, and deploying to printers.
+---
+# Debian Packaging, Recipe Management & Printer Deployment
+
+1. **Compiling Debian Packages**:
+   - Service build script: `./build_for_ultimaker.sh`.
+   - Packages compile into `.deb` artifacts inside local Docker container environments.
+2. **Firmware Recipe Integration (`jedi-cookbook`)**:
+   - Firmware update images (`.swu`) bundle debian packages specified in `.recipe` files under `S-Line/`, `Falcon/`, `Colorado/`, or `UM3/`.
+   - Recipe line format: `deb <package_name> <version>`.
+   - Recipe version bumps: Ensure the corresponding `.deb` package artifact is built and published upstream before updating recipe versions.
+3. **Deploying Packages & Testing on Printers**:
+   - Deploy compiled service packages directly to a networked test printer:
+     ```bash
+     ../jedi-build/deploy_to_printer.sh deploy <package_name> <printer-ip>
+     ```
+   - Interactive SSH terminal access to printer:
+     ```bash
+     ./dev/umssh.sh <printer-ip>
+     ```

.claude/rules/fdm-material-rules.md

@@ -0,0 +1,10 @@
+---
+paths:
+  - "**/*.xml.fdm_material"
+---
+# Material Profile Guidelines (fdm_materials)
+
+1. **Schema Compliance**:
+   - All profile changes MUST pass `./run_check_material_profiles.sh`.
+2. **GUID Stability**:
+   - Material GUIDs must remain strictly stable across profile updates for WASM slicing resolution.

.claude/rules/jira-commit-standards.md

@@ -0,0 +1,13 @@
+---
+description: Jira work tracking and commit message standards.
+---
+# Jira & Git Commit Standards
+
+1. **Jira Work Tracking**:
+   - All branches MUST reference an active Jira ticket starting with project key `UC` (e.g. `UC-123_description`).
+2. **Commit Title Standard**:
+   - Every commit title MUST start with bracketed Jira ticket key: `[UC-XXXX] <Descriptive Title>`.
+   - Do NOT use semantic commit prefixes (`feat:`, `fix:`, `chore:`, `refactor:`) in commit or PR titles.
+3. **Pull Request Policy**:
+   - Always open PRs in **DRAFT** state.
+   - Merging is strictly restricted to human developers.

.claude/rules/pull-request-lifecycle-rules.md

@@ -0,0 +1,25 @@
+---
+description: Mandatory pre-PR local verification, PR description structure, Copilot review request, and CI status check watch loop.
+---
+# Pull Request Lifecycle & Quality Gate Policy
+
+1. **Mandatory Local Pre-PR Verification**:
+   - Before creating or updating any Pull Request, run local verification checks (`pre-commit run --all-files`, `./build_for_ultimaker.sh`, unit tests, linters).
+   - Only create or update the PR if all local checks pass cleanly without errors.
+
+2. **Pull Request Creation & Description Standards**:
+   - All PRs MUST be created in **DRAFT** state (`gh pr create --draft`).
+   - Title MUST start with the bracketed Jira ticket key: `[PROJECT-KEY] <Descriptive Title>`.
+   - Description MUST include:
+     - Active Jira issue link (`EMB-XXX`).
+     - Overview of changes ("Why" and "How").
+     - Support documentation warning block (`> [!WARNING]`) if support articles are impacted.
+     - Empty human reviewer checklist at the bottom: `- [ ] Initiating developer reviewed AI-generated code`.
+
+3. **Copilot AI Review & CI Watch Loop**:
+   - Request Copilot AI review on PR (`gh pr comment <PR> --body "@github-copilot review"`).
+   - Monitor CI status checks (`gh pr checks <PR> --watch`).
+   - Address and resolve all Copilot review comments and threads before considering PR ready.
+
+4. **Human Merge Policy**:
+   - Merging is strictly restricted to human developers. AI agents MUST NOT merge PRs.

.claude/rules/security-and-paths.md

@@ -0,0 +1,12 @@
+---
+description: Security guidelines, secret protection, and path sanitation.
+---
+# Security & Path Protection Guidelines
+
+1. **No Hardcoded Absolute Paths**:
+   - Never commit absolute local filesystem paths (e.g. `/home/username/` or `/Users/username/`).
+2. **No Secret Leaks**:
+   - Never commit private keys, API tokens, or passphrases.
+   - Use RAM-backed filesystem mounts (`/dev/shm`) for temporary secret processing.
+3. **Branch Guard**:
+   - Direct commits to `main`, `master`, or `staging` branches are strictly forbidden.

.claude/rules/ultimaker-skill-discovery-rules.md

@@ -0,0 +1,26 @@
+---
+description: Mandate for dynamic discovery and usage of domain-specific UltiMaker engineering skills from UltiCortex.
+---
+# Dynamic UltiMaker AI Skill Discovery & Usage
+
+AI agents working in this repository MUST dynamically discover and install specialized domain skills from `Ultimaker/UltiCortex` when performing relevant tasks:
+
+```bash
+# Search available skills
+gh skill search ultimaker --owner Ultimaker
+
+# Install specific skill
+gh skill install Ultimaker/UltiCortex <skill-name>
+```
+
+## Mandated Skill Triggers
+1. **`ultimaker-printer-ssh`**:
+   - **Trigger**: When deploying packages, checking DBus properties, testing build outputs, or troubleshooting local services on physical or emulated 3D printers over SSH.
+2. **`ultimaker-digital-factory`**:
+   - **Trigger**: When working on cloud state synchronization, WSS WebSocket connections, IoT connectivity, telemetry, or Digital Factory API features.
+3. **`ultimaker-log-analyzer`**:
+   - **Trigger**: When analyzing log dumps (`/var/log/messages`, systemd journal, `opinicus.log`, `okuda.log`, `stardust.log`).
+4. **`ultimaker-firmware-developer`**:
+   - **Trigger**: When modifying core DBus interfaces, state machine frameworks, or CMake/Conan build tooling.
+ 5. **`ultimaker-support-articles`**:
+   - **Trigger**: When introducing user-facing feature changes or behavioral shifts that impact public documentation or support workflows.

.flake8

@@ -0,0 +1,4 @@
+[flake8]
+max-line-length = 160
+ignore = E501, E251, F401
+exclude = .git, __pycache__, build, dist