@boyingliu01/xp-gate 0.12.0 → 0.12.2

package/bin/xp-gate.js

@@ -135,6 +135,14 @@ const COMMANDS = {
       handleSprintStatus(subargs).then(code => process.exit(code));
     },
     usage: 'xp-gate sprint-status [--json] [--watch] [--dir <path>]'
+  },
+  'next-sprint': {
+    description: 'Analyze remaining open issues and plan next iteration',
+    run: subargs => {
+      const { handleNextSprint } = require('../lib/next-sprint.js');
+      handleNextSprint(subargs).then(code => process.exit(code));
+    },
+    usage: 'xp-gate next-sprint [--json] [--plan] [--dir <path>]'
   }
 };
 

package/gate-3.sh

@@ -0,0 +1,68 @@
+# ============================================================================
+# GATE 3: Cyclomatic Complexity Check
+# Uses lizard - checks cyclomatic complexity of changed source files
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 3: Cyclomatic complexity..."
+GATE_3_START=$(gate_start_ms)
+
+if [ "$PROJECT_LANG" = "documentation-only" ]; then
+  echo "⏭️  SKIPPED - Complexity (documentation project)."
+  GATE_3_STATUS="SKIP"
+
+elif [ "$PROJECT_LANG" = "powershell" ]; then
+  echo "ℹ️  No PowerShell Clean Code / SOLID tool available"
+  echo "⏭️  SKIPPED - Complexity (no PowerShell tool)"
+  GATE_3_STATUS="SKIP"
+  
+else
+  CCN_THRESHOLD=5
+  
+  # Check lizard availability
+  LIZARD_CMD=""
+  if command -v lizard > /dev/null 2>&1; then
+    LIZARD_CMD=lizard
+  elif [ -f ~/.local/bin/lizard ]; then
+    LIZARD_CMD=~/.local/bin/lizard
+  fi
+  
+  if [ -n "$LIZARD_CMD" ]; then
+    LIZARD_PATH=$(eval echo "$LIZARD_CMD")
+    
+    # Get changed source files for complexity check
+    CC_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|swift|cpp|c|hpp|h|m|mm|kt)$' || true)
+    
+    if [ -n "$CC_FILES" ]; then
+      echo "Checking complexity for source files..."
+      
+      # Run lizard with CCN threshold
+      CC_OUTPUT=$($LIZARD_PATH -C $CCN_THRESHOLD $CC_FILES 2>&1 || true)
+      
+      # Parse warning count from the summary table: "Warning cnt   8"
+      # Use anchored grep to avoid matching lizard table headers (e.g. "Rt" column)
+      CC_WARNINGS=$(echo "$CC_OUTPUT" | grep "^Warning cnt" | awk '{print $NF}' | tr -d '[:space:]' | sed 's/[^0-9]//g' || true)
+      CC_WARNINGS=${CC_WARNINGS:-0}
+      
+      if [ "$CC_WARNINGS" -gt 0 ]; then
+        echo "$CC_OUTPUT"
+        echo ""
+        echo "❌ BLOCKED - $CC_WARNINGS functions with CCN > $CCN_THRESHOLD found."
+        echo "Refactor high-complexity functions to keep below $CCN_THRESHOLD complexity."
+        exit 1
+      else
+        echo "✅ PASSED - All functions within complexity threshold ($CCN_THRESHOLD)."
+        GATE_3_STATUS="PASS"
+      fi
+    else
+      echo "⏭️  SKIPPED - Complexity (no source files to check)."
+      GATE_3_STATUS="SKIP"
+    fi
+  else
+    echo "⚠️  WARN - lizard not installed, complexity check not performed"
+    echo "   Install with: pip install --user lizard"
+    echo "   Gate 3: Complexity check (WARN, tool not available)"
+    GATE_3_STATUS="WARN"
+  fi
+fi
+record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "${CC_WARNINGS:-0}" "$GATE_3_START"

package/gate-4.sh

@@ -0,0 +1,80 @@
+# ============================================================================
+# GATE 4: Principles Checker (Clean Code + SOLID)
+# Reuses existing principles checker logic
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 4: Principles checker (Clean Code + SOLID)..."
+GATE_4_START=$(gate_start_ms)
+
+GATE_4_STATUS=""
+
+if [ "$PROJECT_LANG" = "documentation-only" ]; then
+  echo "⏭️  SKIPPED - Principles check (documentation project)."
+  GATE_4_STATUS="SKIP"
+  
+else
+  # Get source files to check against principles
+  PRINCIPLES_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx|py|go|java|kt|dart|swift|cpp|c|hpp|h|m|mm)$' || true)
+  
+  if [ -n "$PRINCIPLES_FILES" ]; then
+    # Check for principles checker in installed modules first, then project src/
+    PRINCIPLES_DIR=""
+    if [ -d ".xp-gate/modules/principles" ]; then
+      PRINCIPLES_DIR=".xp-gate/modules/principles"
+    elif [ -f "src/principles/index.ts" ]; then
+      PRINCIPLES_DIR="src/principles"
+    elif [ -d "$HOME/.config/xp-gate/modules/principles" ]; then
+      PRINCIPLES_DIR="$HOME/.config/xp-gate/modules/principles"
+    fi
+    
+    if [ -n "$PRINCIPLES_DIR" ]; then
+      echo "Checking Clean Code + SOLID principles..."
+      
+      if command -v npx > /dev/null 2>&1; then
+        # Run principles checker and store results
+        if npx tsx $PRINCIPLES_DIR/index.ts --files $PRINCIPLES_FILES --format json > /tmp/principles-output.json 2>/dev/null; then
+          # Check severity levels
+          ERROR_COUNT=$(grep -c '"severity":"error"' /tmp/principles-output.json 2>/dev/null || true)
+          ERROR_COUNT=${ERROR_COUNT:-0}
+          WARNING_COUNT=$(grep -c '"severity":"warning"' /tmp/principles-output.json 2>/dev/null || true)
+          WARNING_COUNT=${WARNING_COUNT:-0}
+          
+          if [ "$ERROR_COUNT" -gt 0 ]; then
+            echo ""
+            echo "❌ BLOCKED - $ERROR_COUNT principle ERROR(S) found"
+            echo "Critical violations must be fixed before commit:"
+            echo "  - error-handling violations"
+            echo "  - SOLID principle violations"
+            echo "  - architectural violations"
+            npx tsx $PRINCIPLES_DIR/index.ts --files $PRINCIPLES_FILES --format console
+            GATE_4_STATUS="FAIL"
+            exit 1
+          fi
+          
+          echo "✅ PASSED - Principles checker (no errors found)."
+          GATE_4_STATUS="PASS"
+          if [ "$WARNING_COUNT" -gt 0 ]; then
+            echo "ℹ️  $WARNING_COUNT warnings found (will be handled by Boy Scout Rule)."
+          fi
+        else
+          echo "⚠️  Warning: Principles checker execution failed"
+          echo "⏭️  SKIPPED - Principles check (execution issue)"
+          GATE_4_STATUS="SKIP"
+        fi
+      else
+        echo "ℹ️  npx not available - skipping principles check"
+        echo "⏭️  SKIPPED - Principles check (no Node.js/npx)"
+        GATE_4_STATUS="SKIP"
+      fi
+    else
+      echo "ℹ️  Principles checker not found in project - skipping"
+      echo "⏭️  SKIPPED - Principles check (checker not in project)"
+      GATE_4_STATUS="SKIP"
+    fi
+  else
+    echo "⏭️  SKIPPED - Principles check (no matching source files changed)"
+    GATE_4_STATUS="SKIP"
+  fi
+fi
+record_gate_audit "gate-4" "principles" "$GATE_4_STATUS" "${WARNING_COUNT:-0}" "$GATE_4_START"

package/gate-7.sh

@@ -0,0 +1,45 @@
+# ============================================================================
+# GATE 7: IaC Security Scanning (Terraform, Kubernetes, Docker)
+# Detects security issues in Infrastructure as Code files
+# Tools: checkov (recommended), hadolint, kube-score, tflint
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 7: IaC Security Scanning (Terraform, Kubernetes, Docker)..."
+GATE_7_START=$(gate_start_ms)
+
+# Check if any IaC files are changed
+IAC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E "\.(tf|yaml|yml)$|Dockerfile" || true)
+if [ -z "$IAC_FILES" ]; then
+  echo "✅ PASSED - No IaC files detected in changes."
+  GATE_7_STATUS="PASS"
+else
+  # Run IaC adapter
+  if [ -f "githooks/adapters/iac.sh" ]; then
+    # shellcheck source=githooks/adapters/iac.sh
+    source "githooks/adapters/iac.sh"
+    
+    # Run static analysis for IaC files
+    IAC_OUTPUT=$(run_static_analysis "$IAC_FILES" 2>&1)
+    IAC_EXIT=$?
+    
+    echo "$IAC_OUTPUT"
+    
+    if [ $IAC_EXIT -eq 0 ]; then
+      echo "✅ PASSED - IaC security scan."
+      GATE_7_STATUS="PASS"
+    else
+      echo ""
+      echo "❌ BLOCKED - IaC security issues detected"
+      echo "Fix the security issues above before committing."
+      echo "Tip: Install checkov for comprehensive IaC scanning: pip install checkov"
+      GATE_7_STATUS="FAIL"
+      exit 1
+    fi
+  else
+    echo "ℹ️  SKIP - IaC adapter not found"
+    echo "⏭️  SKIPPED - IaC security (no IaC adapter found)"
+    GATE_7_STATUS="SKIP"
+  fi
+fi
+record_gate_audit "gate-7" "iac-security" "$GATE_7_STATUS" "0" "$GATE_7_START"

package/gate-8.sh

@@ -0,0 +1,56 @@
+# ============================================================================
+# GATE 8: Secret Scanning (gitleaks)
+# Detects secrets (API keys, passwords, tokens) in staged files
+# Tool: gitleaks -- https://github.com/gitleaks/gitleaks
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 8: Secret scanning (gitleaks)..."
+GATE_8_START=$(gate_start_ms)
+
+# Gitleaks availability check
+GITLEAKS_CMD=""
+if command -v gitleaks >/dev/null 2>&1; then
+  GITLEAKS_CMD="gitleaks"
+elif [ -f "$HOME/.local/bin/gitleaks" ]; then
+  GIBLEAKS_CMD="$HOME/.local/bin/gitleaks"
+fi
+
+if [ -n "$GITLEAKS_CMD" ]; then
+  GITLEAKS_CONFIG=""
+  if [ -f ".gitleaks.toml" ]; then
+    GITLEAKS_CONFIG="--config=.gitleaks.toml"
+  fi
+
+  # Run gitleaks on staged changes only (pre-commit mode for speed)
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --pre-commit --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path=/tmp/gitleaks-report.json 2>&1)
+  GITLEAKS_EXIT=$?
+
+  if [ "$GITLEAKS_EXIT" -eq 0 ]; then
+    echo "     ✅ PASSED - No secrets detected."
+    GATE_8_STATUS="PASS"
+  elif [ "$GITLEAKS_EXIT" -eq 1 ]; then
+    # Secrets found — output details
+    echo "$GITLEAKS_OUTPUT"
+    echo ""
+    echo "❌ BLOCKED - Secrets detected in staged files."
+    echo ""
+    echo "Remediation options:"
+    echo "  1. Remove the secret and use environment variables instead"
+    echo "  2. Add a false positive to .gitleaks.toml allowlist"
+    echo "  3. Use git secret or vault for sensitive data"
+    echo ""
+    echo "See: https://github.com/gitleaks/gitleaks"
+    exit 1
+  else
+    echo "     ⚠️  gitleaks exited with code $GITLEAKS_EXIT - skipping gate"
+    echo "     ✅ Secret Scanning (SKIP, gitleaks error)"
+    GATE_8_STATUS="SKIP"
+  fi
+else
+  echo "     ℹ️  gitleaks not installed — secret scanning unavailable"
+  echo "     Install: brew install gitleaks (macOS) | winget install gitleaks (Windows) | scripts/install-gitleaks.sh (Linux)"
+  echo "     ⏭️  SKIPPED - Secret scanning (gitleaks not installed)"
+  GATE_8_STATUS="SKIP"
+fi
+record_gate_audit "gate-8" "secret-scanning" "$GATE_8_STATUS" "0" "$GATE_8_START"

package/gate-9.sh

@@ -0,0 +1,130 @@
+# ============================================================================
+# GATE 9: Semgrep SAST Security Scan
+# Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
+# Tool: semgrep -- https://semgrep.dev
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 9: Semgrep SAST Security Scan..."
+GATE_9_START=$(gate_start_ms)
+
+GATE_9_STATUS=""
+
+# Semgrep availability check
+SEMGREP_CMD=""
+if command -v semgrep >/dev/null 2>&1; then
+  SEMGREP_CMD="semgrep"
+elif [ -f "$HOME/.local/bin/semgrep" ]; then
+  SEMGREP_CMD="$HOME/.local/bin/semgrep"
+fi
+
+if [ -z "$SEMGREP_CMD" ]; then
+  echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
+  echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
+  echo "     Pre-cache rules: semgrep --config=p/security-audit"
+  echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
+  GATE_9_STATUS="WARN"
+else
+  # Get staged files filtered to Semgrep-supported languages
+  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+
+  if [ -z "$SEMGREP_FILES" ]; then
+    echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
+    GATE_9_STATUS="SKIP"
+  else
+    # Run semgrep with JSON output
+    # --config=p/security-audit: explicit security ruleset
+    # --json: machine-readable output
+    # --disable-version-check: skip network call
+    SEMGREP_OUTPUT=$($SEMGREP_CMD scan --config=p/security-audit --json --disable-version-check $SEMGREP_FILES 2>&1)
+    SEMGREP_EXIT=$?
+
+    if [ "$SEMGREP_EXIT" -eq 0 ]; then
+      echo "     ✅ PASSED - No security vulnerabilities found."
+      GATE_9_STATUS="PASS"
+    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
+      # Findings detected - parse JSON to categorize
+      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    results = data.get('results', [])
+    count = 0
+    for r in results:
+        extra = r.get('extra', {})
+        severity = extra.get('severity', '').upper()
+        if severity in ('CRITICAL', 'HIGH'):
+            count += 1
+    print(count)
+except:
+    print('0')
+" 2>/dev/null || echo "0")
+
+      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    results = data.get('results', [])
+    count = 0
+    for r in results:
+        extra = r.get('extra', {})
+        severity = extra.get('severity', '').upper()
+        if severity in ('MEDIUM', 'LOW'):
+            count += 1
+    print(count)
+except:
+    print('0')
+" 2>/dev/null || echo "0")
+
+      # Extract top finding details
+      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    results = data.get('results', [])
+    for r in results[:5]:  # Show top 5
+        extra = r.get('extra', {})
+        severity = extra.get('severity', 'UNKNOWN').upper()
+        rule_id = r.get('check_id', 'unknown')
+        path = r.get('path', 'unknown')
+        start_line = r.get('start', {}).get('line', '?')
+        message = extra.get('message', '')[:80]
+        print(f'  [{severity}] {rule_id}')
+        print(f'  {path}:{start_line} → {message}')
+        print()
+except:
+    print('  (Failed to parse semgrep output)')
+" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+
+      if [ "$CRITICAL_HIGH" -gt 0 ]; then
+        echo ""
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "   GATE 9: Semgrep Security Gate"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
+        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  ❌ BLOCKED — Critical/High vulnerability found"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "$FINDING_DETAILS"
+        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+        GATE_9_STATUS="FAIL"
+        exit 1
+      else
+        echo ""
+        echo "     ✅ PASSED - No critical/high vulnerabilities"
+        if [ "$MEDIUM_LOW" -gt 0 ]; then
+          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
+          echo "$FINDING_DETAILS"
+        fi
+        GATE_9_STATUS="PASS"
+      fi
+    else
+      # semgrep runtime error (timeout, config error, etc.)
+      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
+      GATE_9_STATUS="SKIP"
+    fi
+  fi
+fi
+record_gate_audit "gate-9" "sast-security" "$GATE_9_STATUS" "0" "$GATE_9_START"

package/lib/__tests__/doctor.test.js

@@ -108,6 +108,10 @@ describe('doctor', () => {
       path.join(dir, 'adapters', 'python.sh'),
       '#!/usr/bin/env bash\necho "py adapter"\n'
     );
+    const gateScripts = ['gate-3.sh', 'gate-4.sh', 'gate-7.sh', 'gate-8.sh', 'gate-9.sh'];
+    for (const script of gateScripts) {
+      fs.writeFileSync(path.join(dir, 'adapters', script), `#!/bin/bash\n# ${script}\n`);
+    }
   }
 
   function tuiJsonPath() {
@@ -139,7 +143,14 @@ describe('doctor', () => {
     createXpGatePreCommit(globalHooksDir());
     createXpGatePrePush(globalHooksDir());
     createXpGateAdapterCommon(globalAdaptersDir());
-    createXpGateAdapterScripts(globalAdaptersDir());
+    // For global mode, create adapters directly in globalAdaptersDir (not in a subdirectory)
+    fs.mkdirSync(globalAdaptersDir(), { recursive: true });
+    fs.writeFileSync(path.join(globalAdaptersDir(), 'typescript.sh'), '#!/usr/bin/env bash\necho "ts adapter"\n');
+    fs.writeFileSync(path.join(globalAdaptersDir(), 'python.sh'), '#!/usr/bin/env bash\necho "py adapter"\n');
+    const gateScripts = ['gate-3.sh', 'gate-4.sh', 'gate-7.sh', 'gate-8.sh', 'gate-9.sh'];
+    for (const script of gateScripts) {
+      fs.writeFileSync(path.join(globalAdaptersDir(), script), `#!/bin/bash\n# ${script}\n`);
+    }
     createXpGatePreCommit(projectHooksDir());
     createXpGatePrePush(projectHooksDir());
     createXpGateAdapterCommon(projectGithooksDir());
@@ -805,4 +816,92 @@ describe('doctor', () => {
     // Should still have exactly one entry
     expect(tui.plugin.filter(p => p === '@boyingliu01/opencode-plugin/tui').length).toBe(1);
   });
+
+  // === Issue #263 follow-up: Gate script detection ===
+
+  function createGateScripts(dir) {
+    fs.mkdirSync(dir, { recursive: true });
+    const gateScripts = ['gate-3.sh', 'gate-4.sh', 'gate-7.sh', 'gate-8.sh', 'gate-9.sh'];
+    for (const script of gateScripts) {
+      fs.writeFileSync(path.join(dir, script), `#!/bin/bash\n# ${script}\n`);
+    }
+  }
+
+  it('gate scripts: PASS when all expected gate scripts exist', async () => {
+    setupLocalInstall();
+    ensureTuiRegistered();
+    seedVersionCache();
+    createGateScripts(projectAdaptersDir());
+    mockExecSuccess();
+    const { doctor } = require('../doctor');
+
+    const result = await doctor([]);
+
+    expect(result).toBe(0);
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining('Gate scripts')
+    );
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining('5 gate script(s)')
+    );
+  });
+
+  it('gate scripts: FAIL when gate scripts are missing', async () => {
+    setupLocalInstall();
+    seedVersionCache();
+    // Clear adapters dir and create with only language adapters, no gate scripts
+    fs.rmSync(projectAdaptersDir(), { recursive: true, force: true });
+    fs.mkdirSync(projectAdaptersDir(), { recursive: true });
+    fs.writeFileSync(path.join(projectAdaptersDir(), 'typescript.sh'), '#!/bin/bash\n');
+    mockExecSuccess();
+    const { doctor } = require('../doctor');
+
+    const result = await doctor([]);
+
+    expect(result).toBe(1);
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining('Gate scripts')
+    );
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining('Missing')
+    );
+  });
+
+  it('--fix: restores missing gate scripts', async () => {
+    setupLocalInstall();
+    seedVersionCache();
+    // Clear adapters dir and create with only language adapters, no gate scripts
+    fs.rmSync(projectAdaptersDir(), { recursive: true, force: true });
+    fs.mkdirSync(projectAdaptersDir(), { recursive: true });
+    fs.writeFileSync(path.join(projectAdaptersDir(), 'typescript.sh'), '#!/bin/bash\n');
+    mockExecSuccess();
+    const { doctor } = require('../doctor');
+
+    const result = await doctor(['--fix']);
+
+    expect(result).toBe(0);
+    expect(fs.existsSync(path.join(projectAdaptersDir(), 'gate-3.sh'))).toBe(true);
+    expect(fs.existsSync(path.join(projectAdaptersDir(), 'gate-4.sh'))).toBe(true);
+    expect(fs.existsSync(path.join(projectAdaptersDir(), 'gate-7.sh'))).toBe(true);
+    expect(fs.existsSync(path.join(projectAdaptersDir(), 'gate-8.sh'))).toBe(true);
+    expect(fs.existsSync(path.join(projectAdaptersDir(), 'gate-9.sh'))).toBe(true);
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining('Restored')
+    );
+  });
+
+  it('--fix: idempotent for gate scripts — does not overwrite existing', async () => {
+    setupLocalInstall();
+    seedVersionCache();
+    createGateScripts(projectAdaptersDir());
+    const originalContent = fs.readFileSync(path.join(projectAdaptersDir(), 'gate-3.sh'), 'utf8');
+    mockExecSuccess();
+    const { doctor } = require('../doctor');
+
+    const result = await doctor(['--fix']);
+
+    expect(result).toBe(0);
+    const currentContent = fs.readFileSync(path.join(projectAdaptersDir(), 'gate-3.sh'), 'utf8');
+    expect(currentContent).toBe(originalContent);
+  });
 });

package/lib/__tests__/next-sprint.test.js

@@ -0,0 +1,231 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+describe('next-sprint', () => {
+  let tmpDir;
+  let consoleSpy;
+  let processExitSpy;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'next-sprint-test-'));
+    consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+    processExitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
+    // Clear require cache to ensure fresh module for each test
+    delete require.cache[require.resolve('../next-sprint')];
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    vi.restoreAllMocks();
+  });
+
+  function createState(overrides = {}) {
+    const stateDir = path.join(tmpDir, '.sprint-state');
+    fs.mkdirSync(stateDir, { recursive: true });
+    const state = {
+      id: 'sprint-2026-06-30-01',
+      task_description: 'Test Sprint',
+      phase: 4,
+      status: 'completed',
+      started_at: new Date().toISOString(),
+      phase_history: [
+        {
+          phase: 2,
+          phase_name: 'BUILD',
+          status: 'completed',
+          reqs: {
+            'REQ-001': { name: 'Implement login', status: 'completed' },
+            'REQ-002': { name: 'Implement logout', status: 'completed' },
+          },
+        },
+      ],
+      ...overrides,
+    };
+    fs.writeFileSync(path.join(stateDir, 'sprint-state.json'), JSON.stringify(state));
+    return state;
+  }
+
+  function mockGhCli(issues) {
+    const { execSync } = require('child_process');
+    vi.spyOn(require('child_process'), 'execSync').mockImplementation((cmd) => {
+      if (cmd.includes('gh issue list')) {
+        return JSON.stringify(issues);
+      }
+      return '';
+    });
+  }
+
+  describe('readSprintState', () => {
+    it('returns null when no sprint state exists', () => {
+      const { readSprintState } = require('../next-sprint');
+      const result = readSprintState(tmpDir);
+      expect(result).toBeNull();
+    });
+
+    it('returns parsed state when sprint state exists', () => {
+      const state = createState();
+      const { readSprintState } = require('../next-sprint');
+      const result = readSprintState(tmpDir);
+      expect(result).toBeDefined();
+      expect(result.id).toBe('sprint-2026-06-30-01');
+    });
+  });
+
+  describe('getCurrentSprintReqs', () => {
+    it('extracts requirements from sprint state', () => {
+      createState();
+      const { readSprintState, getCurrentSprintReqs } = require('../next-sprint');
+      const state = readSprintState(tmpDir);
+      const reqs = getCurrentSprintReqs(state);
+      expect(reqs).toHaveLength(2);
+      expect(reqs[0].name).toBe('Implement login');
+      expect(reqs[1].name).toBe('Implement logout');
+    });
+
+    it('returns empty array when no phase history', () => {
+      const { getCurrentSprintReqs } = require('../next-sprint');
+      const reqs = getCurrentSprintReqs({ phase_history: [] });
+      expect(reqs).toEqual([]);
+    });
+  });
+
+  describe('filterRemainingIssues', () => {
+    it('filters out issues already in sprint', () => {
+      const issues = [
+        { number: 1, title: 'Implement login', labels: [], createdAt: '2026-06-30T00:00:00Z' },
+        { number: 2, title: 'Implement logout', labels: [], createdAt: '2026-06-30T00:00:00Z' },
+        { number: 3, title: 'Implement signup', labels: [], createdAt: '2026-06-30T00:00:00Z' },
+      ];
+      const sprintReqs = [{ name: 'Implement login' }, { name: 'Implement logout' }];
+      const { filterRemainingIssues } = require('../next-sprint');
+      const result = filterRemainingIssues(issues, sprintReqs);
+      expect(result).toHaveLength(1);
+      expect(result[0].number).toBe(3);
+    });
+
+    it('returns all issues when no sprint reqs', () => {
+      const issues = [
+        { number: 1, title: 'Implement login', labels: [], createdAt: '2026-06-30T00:00:00Z' },
+        { number: 2, title: 'Implement logout', labels: [], createdAt: '2026-06-30T00:00:00Z' },
+      ];
+      const { filterRemainingIssues } = require('../next-sprint');
+      const result = filterRemainingIssues(issues, []);
+      expect(result).toHaveLength(2);
+    });
+  });
+
+  describe('formatIssuesTable', () => {
+    it('formats issues as table', () => {
+      const issues = [
+        { number: 1, title: 'Implement login', labels: [{ name: 'feature' }], createdAt: '2026-06-30T00:00:00Z' },
+        { number: 2, title: 'Implement logout', labels: [{ name: 'bug' }], createdAt: '2026-06-30T00:00:00Z' },
+      ];
+      const { formatIssuesTable } = require('../next-sprint');
+      const result = formatIssuesTable(issues);
+      expect(result).toContain('Remaining Open Issues');
+      expect(result).toContain('Implement login');
+      expect(result).toContain('feature');
+    });
+
+    it('handles empty issues', () => {
+      const { formatIssuesTable } = require('../next-sprint');
+      const result = formatIssuesTable([]);
+      expect(result).toBe('No remaining issues found.');
+    });
+  });
+
+  describe('generateSprintPlan', () => {
+    it('generates sprint plan for remaining issues', () => {
+      const issues = [
+        { number: 1, title: 'Implement login', labels: [], createdAt: '2026-06-30T00:00:00Z' },
+        { number: 2, title: 'Implement logout', labels: [], createdAt: '2026-06-30T00:00:00Z' },
+      ];
+      const { generateSprintPlan } = require('../next-sprint');
+      const result = generateSprintPlan(issues);
+      expect(result).toContain('Suggested Next Sprint Plan');
+      expect(result).toContain('#1');
+      expect(result).toContain('sprint-flow');
+    });
+
+    it('returns null when no issues', () => {
+      const { generateSprintPlan } = require('../next-sprint');
+      const result = generateSprintPlan([]);
+      expect(result).toBeNull();
+    });
+  });
+
+  describe('handleNextSprint', () => {
+    it('outputs remaining issues in table format', async () => {
+      createState();
+      const { execSync } = require('child_process');
+      vi.spyOn(require('child_process'), 'execSync').mockImplementation((cmd) => {
+        if (cmd.includes('gh issue list')) {
+          return JSON.stringify([
+            { number: 1, title: 'Implement login', labels: [{ name: 'feature' }], createdAt: '2026-06-30T00:00:00Z' },
+            { number: 2, title: 'Implement logout', labels: [{ name: 'bug' }], createdAt: '2026-06-30T00:00:00Z' },
+            { number: 3, title: 'Implement signup', labels: [{ name: 'enhancement' }], createdAt: '2026-06-30T00:00:00Z' },
+          ]);
+        }
+        return '';
+      });
+      delete require.cache[require.resolve('../next-sprint')];
+      const { handleNextSprint } = require('../next-sprint');
+      const result = await handleNextSprint(['--dir', tmpDir]);
+      expect(result).toBe(0);
+      expect(consoleSpy).toHaveBeenCalled();
+      const output = consoleSpy.mock.calls.map(c => c[0]).join('\n');
+      expect(output).toContain('Remaining Open Issues');
+      expect(output).toContain('Implement signup');
+    });
+
+    it('outputs JSON when --json flag', async () => {
+      createState();
+      vi.spyOn(require('child_process'), 'execSync').mockImplementation((cmd) => {
+        if (cmd.includes('gh issue list')) {
+          return JSON.stringify([
+            { number: 1, title: 'Implement login', labels: [], createdAt: '2026-06-30T00:00:00Z' },
+          ]);
+        }
+        return '';
+      });
+      delete require.cache[require.resolve('../next-sprint')];
+      const { handleNextSprint } = require('../next-sprint');
+      const result = await handleNextSprint(['--json', '--dir', tmpDir]);
+      expect(result).toBe(0);
+      const output = consoleSpy.mock.calls.map(c => c[0]).join('\n');
+      const parsed = JSON.parse(output);
+      expect(parsed).toHaveProperty('current_sprint');
+      expect(parsed).toHaveProperty('remaining_issues');
+    });
+
+    it('outputs plan when --plan flag', async () => {
+      createState();
+      vi.spyOn(require('child_process'), 'execSync').mockImplementation((cmd) => {
+        if (cmd.includes('gh issue list')) {
+          return JSON.stringify([
+            { number: 5, title: 'Implement password reset', labels: [], createdAt: '2026-06-30T00:00:00Z' },
+          ]);
+        }
+        return '';
+      });
+      delete require.cache[require.resolve('../next-sprint')];
+      const { handleNextSprint } = require('../next-sprint');
+      const result = await handleNextSprint(['--plan', '--dir', tmpDir]);
+      expect(result).toBe(0);
+      const output = consoleSpy.mock.calls.map(c => c[0]).join('\n');
+      expect(output).toContain('Suggested Next Sprint Plan');
+    });
+
+    it('returns 1 when gh CLI not available', async () => {
+      vi.spyOn(require('child_process'), 'execSync').mockImplementation(() => {
+        throw new Error('gh: command not found');
+      });
+      delete require.cache[require.resolve('../next-sprint')];
+      const { handleNextSprint } = require('../next-sprint');
+      const result = await handleNextSprint(['--dir', tmpDir]);
+      expect(result).toBe(1);
+    });
+  });
+});

package/lib/doctor.js

@@ -176,7 +176,20 @@ function checkSingleHook(hooksDir, name, signature, label, checks) {
   return 0;
 }
 
+/**
+ * Expected gate scripts that should be present in the adapters directory.
+ * gate-5.sh and gate-6.sh are inline in pre-commit, so they are NOT expected here.
+ */
+const EXPECTED_GATE_SCRIPTS = [
+  'gate-3.sh',
+  'gate-4.sh',
+  'gate-7.sh',
+  'gate-8.sh',
+  'gate-9.sh',
+];
+
 function checkAdapters(checks, mode, gitDir) {
+  let issues = 0;
   const adaptersDir = mode === 'local'
     ? path.join(path.dirname(gitDir || ''), 'githooks', 'adapters')
     : GLOBAL_ADAPTERS_DIR;
@@ -190,8 +203,22 @@ function checkAdapters(checks, mode, gitDir) {
     checks.push({ name: 'Adapters directory', status: 'FAIL', detail: 'Empty directory' });
     return 1;
   }
-  checks.push({ name: 'Adapters directory', status: 'PASS', detail: `${adapterFiles.length} adapter(s)` });
-  return 0;
+  checks.push({ name: 'Adapters directory', status: 'PASS', detail: `${adapterFiles.length} file(s)` });
+
+  // Check for missing gate scripts (Issue #263 follow-up)
+  const missingGates = EXPECTED_GATE_SCRIPTS.filter(g => !adapterFiles.includes(g));
+  if (missingGates.length > 0) {
+    checks.push({
+      name: 'Gate scripts',
+      status: 'FAIL',
+      detail: `Missing: ${missingGates.join(', ')} — run 'xp-gate doctor --fix' to restore`
+    });
+    issues++;
+  } else {
+    checks.push({ name: 'Gate scripts', status: 'PASS', detail: `${EXPECTED_GATE_SCRIPTS.length} gate script(s)` });
+  }
+
+  return issues;
 }
 
 /**
@@ -429,6 +456,37 @@ function fixMissingAdapters(mode, srcDir, adaptersDir) {
   return false;
 }
 
+/**
+ * Restore missing gate scripts from package root to adapters directory.
+ * Gate scripts (gate-3.sh through gate-9.sh) are stored in the package root,
+ * not in the adapters subdirectory.
+ */
+function fixMissingGateScripts(srcDir, adaptersDir) {
+  if (!adaptersDir || !fs.existsSync(adaptersDir)) return false;
+
+  const existingFiles = fs.readdirSync(adaptersDir);
+  const missingGates = EXPECTED_GATE_SCRIPTS.filter(g => !existingFiles.includes(g));
+
+  if (missingGates.length === 0) return false;
+
+  let restored = 0;
+  for (const gateScript of missingGates) {
+    const srcFile = path.join(srcDir, gateScript);
+    const destFile = path.join(adaptersDir, gateScript);
+    if (fs.existsSync(srcFile)) {
+      fs.copyFileSync(srcFile, destFile);
+      fs.chmodSync(destFile, 0o755);
+      restored++;
+    }
+  }
+
+  if (restored > 0) {
+    console.log(`  ✓ Restored ${restored} gate script(s)`);
+    return true;
+  }
+  return false;
+}
+
 function fixConfigMismatches(config) {
   let fixed = false;
   fixed = fixVersionMismatch(config, getPackageVersion()) || fixed;
@@ -481,6 +539,7 @@ function fixIssues(checks, config) {
   fixed = fixHooksByMode(config, srcDir) || fixed;
   fixed = fixGlobalHooksPath(config) || fixed;
   fixed = fixMissingAdapters(config.mode, srcDir, getAdaptersDirByMode(config)) || fixed;
+  fixed = fixMissingGateScripts(srcDir, getAdaptersDirByMode(config)) || fixed;
   fixed = fixTuiRegistration() || fixed;
   fixed = printCliToolGuidance() || fixed;
 

package/lib/init.js

@@ -35,6 +35,13 @@ function copyAdapters(srcDir, destDir) {
       }
     });
   }
+  // Copy gate scripts (gate-3.sh through gate-9.sh) from package root to destDir.
+  // These are sourced by pre-commit via GATE_DIR which resolves to the adapter dir.
+  fs.readdirSync(srcDir).forEach(f => {
+    if (f.startsWith('gate-') && f.endsWith('.sh')) {
+      fs.copyFileSync(path.join(srcDir, f), path.join(destDir, f));
+    }
+  });
 }
 
 function copyRecursive(src, dest) {

package/lib/next-sprint.js

@@ -0,0 +1,129 @@
+const childProcess = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+function readSprintState(dir) {
+  try {
+    const stateFile = path.join(dir, '.sprint-state', 'sprint-state.json');
+    if (!fs.existsSync(stateFile)) return null;
+    return JSON.parse(fs.readFileSync(stateFile, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function getCurrentSprintReqs(state) {
+  if (!state?.phase_history) return [];
+  const reqs = [];
+  for (const phase of state.phase_history) {
+    if (phase.reqs) {
+      for (const [id, req] of Object.entries(phase.reqs)) {
+        reqs.push({ id, name: req.name, status: req.status });
+      }
+    }
+  }
+  return reqs;
+}
+
+function fetchOpenIssues(repoRoot) {
+  try {
+    const result = childProcess.execSync('gh issue list --state open --json number,title,labels,createdAt', {
+      cwd: repoRoot,
+      encoding: 'utf8',
+      timeout: 30000,
+    });
+    return JSON.parse(result);
+  } catch (err) {
+    if (err.message.includes('gh: command not found')) {
+      console.error('Error: gh CLI not found. Install it from https://cli.github.com/');
+      return null;
+    }
+    if (err.message.includes('not logged in')) {
+      console.error('Error: Not logged in to GitHub. Run "gh auth login" first.');
+      return null;
+    }
+    console.error('Error fetching issues:', err.message);
+    return null;
+  }
+}
+
+function filterRemainingIssues(issues, sprintReqs) {
+  const sprintTitles = new Set(sprintReqs.map(r => r.name?.toLowerCase()));
+  return issues.filter(issue => {
+    const titleLower = issue.title.toLowerCase();
+    return !sprintTitles.has(titleLower);
+  });
+}
+
+function formatIssuesTable(issues) {
+  if (issues.length === 0) return 'No remaining issues found.';
+  const lines = ['Remaining Open Issues:', ''];
+  lines.push('┌──────┬────────────────────────────────────────────┬─────────────────────┬───────────┐');
+  lines.push('│ #    │ Title                                      │ Labels              │ Created   │');
+  lines.push('├──────┼────────────────────────────────────────────┼─────────────────────┼───────────┤');
+  for (const issue of issues) {
+    const num = String(issue.number).padEnd(4);
+    const title = issue.title.slice(0, 40).padEnd(40);
+    const labels = (issue.labels || []).map(l => l.name).join(', ').slice(0, 19).padEnd(19);
+    const created = issue.createdAt ? issue.createdAt.slice(0, 10) : 'N/A';
+    lines.push(`│ ${num} │ ${title} │ ${labels} │ ${created} │`);
+  }
+  lines.push('└──────┴────────────────────────────────────────────┴─────────────────────┴───────────┘');
+  lines.push(`Total: ${issues.length} remaining issues`);
+  return lines.join('\n');
+}
+
+function generateSprintPlan(issues) {
+  if (issues.length === 0) return null;
+  const lines = ['Suggested Next Sprint Plan:', ''];
+  const prioritized = issues.slice(0, 5);
+  for (let i = 0; i < prioritized.length; i++) {
+    const issue = prioritized[i];
+    lines.push(`${i + 1}. #${issue.number} - ${issue.title}`);
+  }
+  if (issues.length > 5) {
+    lines.push(`... and ${issues.length - 5} more issues`);
+  }
+  lines.push('');
+  lines.push('To start a sprint, run:');
+  lines.push(`  /sprint-flow "Implement #${prioritized[0].number}: ${prioritized[0].title}"`);
+  return lines.join('\n');
+}
+
+async function handleNextSprint(args = []) {
+  const jsonFlag = args.includes('--json');
+  const planFlag = args.includes('--plan');
+  const dirIdx = args.indexOf('--dir');
+  let repoRoot = process.cwd();
+  if (dirIdx >= 0 && dirIdx + 1 < args.length) {
+    repoRoot = path.resolve(args[dirIdx + 1]);
+  }
+  const state = readSprintState(repoRoot);
+  const sprintReqs = state ? getCurrentSprintReqs(state) : [];
+  const issues = fetchOpenIssues(repoRoot);
+  if (issues === null) return 1;
+  const remaining = filterRemainingIssues(issues, sprintReqs);
+  if (jsonFlag) {
+    console.log(JSON.stringify({ current_sprint: state?.id || null, sprint_reqs: sprintReqs, remaining_issues: remaining }, null, 2));
+    return 0;
+  }
+  console.log(formatIssuesTable(remaining));
+  if (planFlag) {
+    const plan = generateSprintPlan(remaining);
+    if (plan) {
+      console.log('');
+      console.log(plan);
+    }
+  }
+  return 0;
+}
+
+module.exports = {
+  handleNextSprint,
+  fetchOpenIssues,
+  filterRemainingIssues,
+  formatIssuesTable,
+  generateSprintPlan,
+  readSprintState,
+  getCurrentSprintReqs,
+};

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"
@@ -16,7 +16,12 @@
     "principles/",
     "mutation/",
     "mock-policy/",
-    "build-integrity/"
+    "build-integrity/",
+    "gate-3.sh",
+    "gate-4.sh",
+    "gate-7.sh",
+    "gate-8.sh",
+    "gate-9.sh"
   ],
   "exports": {
     "./tui": "./plugins/opencode/tui-plugin.ts"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → USER ACCEPTANCE → FEEDBACK → SHIP → LAND → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-07-01
-**Commit:** bd129b3
+**Commit:** 58ec6df
 **Branch:** main
-**Version:** 0.12.0.0
+**Version:** 0.12.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.