@boyingliu01/xp-gate 0.12.4 → 0.12.6

package/adapters/python.sh

@@ -47,7 +47,16 @@ run_tests() {
   echo "Running Python tests..."
   PYTEST_OUTPUT=$(pytest --exitfirst --tb=short 2>&1)
   PYTEST_EXIT=$?
-  echo "$PYTEST_OUTPUT" | tail -30
+
+  # Show the short summary tail — this is where FAILED/assert diagnostics live.
+  # With --exitfirst we stop at the first failure, so the last ~10 lines are the
+  # most actionable: they contain the test name, assert expression, and expected
+  # vs actual values.  Full output is saved to /tmp/ for post-mortem inspection.
+  echo "$PYTEST_OUTPUT" | grep -E "(FAILED|PASSED|passed|failed|error|ERROR|assert)" | tail -10
+  echo "$PYTEST_OUTPUT" | tail -5
+
+  # Save full output for post-mortem inspection
+  echo "$PYTEST_OUTPUT" > /tmp/xp-gate-pytest-output-$$.log
 
   # Check for collection errors (ModuleNotFoundError / ImportError)
   if echo "$PYTEST_OUTPUT" | grep -qi "ModuleNotFoundError\|ImportError"; then
@@ -78,7 +87,9 @@ run_coverage() {
   echo "Running Python coverage..."
   PYTEST_OUTPUT=$(pytest --exitfirst --tb=short --cov=. --cov-fail-under=80 2>&1)
   PYTEST_EXIT=$?
-  echo "$PYTEST_OUTPUT" | tail -30
+  echo "$PYTEST_OUTPUT" | grep -E "(FAILED|PASSED|passed|failed|error|ERROR|TOTAL|assert)" | tail -10
+  echo "$PYTEST_OUTPUT" | tail -5
+  echo "$PYTEST_OUTPUT" > /tmp/xp-gate-pytest-cov-output-$$.log
 
   # Check for collection errors (ModuleNotFoundError / ImportError)
   if echo "$PYTEST_OUTPUT" | grep -qi "ModuleNotFoundError\|ImportError"; then

package/gate-9.sh

@@ -1,14 +1,14 @@
 # ============================================================================
-# GATE 9: Semgrep SAST Security Scan
+# GATE 10: Semgrep SAST Security Scan
 # Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
 # Tool: semgrep -- https://semgrep.dev
 # ============================================================================
 
  2>&1 echo ""
- 2>&1 echo "→ Gate 9: Semgrep SAST Security Scan..."
-GATE_9_START=$(gate_start_ms)
+ 2>&1 echo "→ Gate 10: Semgrep SAST Security Scan..."
+GATE_10_START=$(gate_start_ms)
 
-GATE_9_STATUS=""
+GATE_10_STATUS=""
 
 # Semgrep availability check
 SEMGREP_CMD=""
@@ -22,15 +22,15 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
   echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
   echo "     Pre-cache rules: semgrep --config=p/security-audit"
-  echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
-  GATE_9_STATUS="WARN"
+  echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
+  GATE_10_STATUS="WARN"
 else
   # Get staged files filtered to Semgrep-supported languages
   SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
-    GATE_9_STATUS="SKIP"
+    GATE_10_STATUS="SKIP"
   else
     # Run semgrep with JSON output
     # --config=p/security-audit: explicit security ruleset
@@ -41,7 +41,7 @@ else
 
     if [ "$SEMGREP_EXIT" -eq 0 ]; then
       echo "     ✅ PASSED - No security vulnerabilities found."
-      GATE_9_STATUS="PASS"
+      GATE_10_STATUS="PASS"
     elif [ "$SEMGREP_EXIT" -eq 1 ]; then
       # Findings detected - parse JSON to categorize
       CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | python3 -c "
@@ -99,7 +99,7 @@ except:
       if [ "$CRITICAL_HIGH" -gt 0 ]; then
         echo ""
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 9: Semgrep Security Gate"
+        echo "   GATE 10: Semgrep Security Gate"
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
         echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
@@ -108,7 +108,7 @@ except:
         echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
         echo "$FINDING_DETAILS"
         echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_9_STATUS="FAIL"
+        GATE_10_STATUS="FAIL"
         exit 1
       else
         echo ""
@@ -117,14 +117,14 @@ except:
           echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
           echo "$FINDING_DETAILS"
         fi
-        GATE_9_STATUS="PASS"
+        GATE_10_STATUS="PASS"
       fi
     else
       # semgrep runtime error (timeout, config error, etc.)
       echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
-      GATE_9_STATUS="SKIP"
+      GATE_10_STATUS="SKIP"
     fi
   fi
 fi
-record_gate_audit "gate-9" "sast-security" "$GATE_9_STATUS" "0" "$GATE_9_START"
+record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"

package/hooks/gate-9.sh

@@ -0,0 +1,130 @@
+# ============================================================================
+# GATE 10: Semgrep SAST Security Scan
+# Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
+# Tool: semgrep -- https://semgrep.dev
+# ============================================================================
+
+ 2>&1 echo ""
+ 2>&1 echo "→ Gate 10: Semgrep SAST Security Scan..."
+GATE_10_START=$(gate_start_ms)
+
+GATE_10_STATUS=""
+
+# Semgrep availability check
+SEMGREP_CMD=""
+if command -v semgrep >/dev/null 2>&1; then
+  SEMGREP_CMD="semgrep"
+elif [ -f "$HOME/.local/bin/semgrep" ]; then
+  SEMGREP_CMD="$HOME/.local/bin/semgrep"
+fi
+
+if [ -z "$SEMGREP_CMD" ]; then
+  echo "     ⚠️  WARN - semgrep not installed — SAST scanning unavailable"
+  echo "     Install: brew install semgrep (macOS) | pip install semgrep (Linux) | pip install semgrep (Windows)"
+  echo "     Pre-cache rules: semgrep --config=p/security-audit"
+  echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
+  GATE_10_STATUS="WARN"
+else
+  # Get staged files filtered to Semgrep-supported languages
+  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+
+  if [ -z "$SEMGREP_FILES" ]; then
+    echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
+    GATE_10_STATUS="SKIP"
+  else
+    # Run semgrep with JSON output
+    # --config=p/security-audit: explicit security ruleset
+    # --json: machine-readable output
+    # --disable-version-check: skip network call
+    SEMGREP_OUTPUT=$($SEMGREP_CMD scan --config=p/security-audit --json --disable-version-check $SEMGREP_FILES 2>&1)
+    SEMGREP_EXIT=$?
+
+    if [ "$SEMGREP_EXIT" -eq 0 ]; then
+      echo "     ✅ PASSED - No security vulnerabilities found."
+      GATE_10_STATUS="PASS"
+    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
+      # Findings detected - parse JSON to categorize
+      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    results = data.get('results', [])
+    count = 0
+    for r in results:
+        extra = r.get('extra', {})
+        severity = extra.get('severity', '').upper()
+        if severity in ('CRITICAL', 'HIGH'):
+            count += 1
+    print(count)
+except:
+    print('0')
+" 2>/dev/null || echo "0")
+
+      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    results = data.get('results', [])
+    count = 0
+    for r in results:
+        extra = r.get('extra', {})
+        severity = extra.get('severity', '').upper()
+        if severity in ('MEDIUM', 'LOW'):
+            count += 1
+    print(count)
+except:
+    print('0')
+" 2>/dev/null || echo "0")
+
+      # Extract top finding details
+      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    results = data.get('results', [])
+    for r in results[:5]:  # Show top 5
+        extra = r.get('extra', {})
+        severity = extra.get('severity', 'UNKNOWN').upper()
+        rule_id = r.get('check_id', 'unknown')
+        path = r.get('path', 'unknown')
+        start_line = r.get('start', {}).get('line', '?')
+        message = extra.get('message', '')[:80]
+        print(f'  [{severity}] {rule_id}')
+        print(f'  {path}:{start_line} → {message}')
+        print()
+except:
+    print('  (Failed to parse semgrep output)')
+" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+
+      if [ "$CRITICAL_HIGH" -gt 0 ]; then
+        echo ""
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "   GATE 10: Semgrep Security Gate"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
+        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "  ❌ BLOCKED — Critical/High vulnerability found"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "$FINDING_DETAILS"
+        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+        GATE_10_STATUS="FAIL"
+        exit 1
+      else
+        echo ""
+        echo "     ✅ PASSED - No critical/high vulnerabilities"
+        if [ "$MEDIUM_LOW" -gt 0 ]; then
+          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
+          echo "$FINDING_DETAILS"
+        fi
+        GATE_10_STATUS="PASS"
+      fi
+    else
+      # semgrep runtime error (timeout, config error, etc.)
+      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
+      GATE_10_STATUS="SKIP"
+    fi
+  fi
+fi
+record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"

package/hooks/pre-commit

@@ -932,11 +932,9 @@ elif [ "$PROJECT_LANG" = "python" ]; then
     else
       echo "✅ PASSED - pylint found no duplicates."
     fi
-  elif require_tool "ruff" "Gate 2" "pip install ruff"; then
-    ruff check --select=DUP $(echo "$CHANGED_FILES" | grep "\.py$") 2>&1 | head -30
-    echo "✅ PASSED - ruff duplicate code check completed."
   else
-    exit 1
+    echo "ℹ️  pylint not found — skipping Python duplicate code check."
+    echo "   Install pylint: pip install pylint"
   fi
 
 elif [ "$PROJECT_LANG" = "go" ]; then
@@ -1223,6 +1221,13 @@ else
         fi
       done
 
+      if [ "$TEST_FOUND" = false ] && [ "$ext" = "py" ]; then
+        module_name="${filename//-/_}"
+        if grep -rq "import $module_name\|from $module_name import" tests/ 2>/dev/null; then
+          TEST_FOUND=true
+        fi
+      fi
+
       if [ "$TEST_FOUND" = false ]; then
         echo "⚠️  TEST PAIRING WARNING: Source file without corresponding test: $src_file"
         echo "   Expected patterns for .${ext}: ${patterns[0]}, ${patterns[1]:-...}"
@@ -1294,22 +1299,52 @@ else
     done
   fi
 
-  # First, run tests using adapter system
+  # Run tests + coverage in a single pass (optimization: avoids running vitest twice)
+  # For TypeScript with test:coverage script, use coverage-enabled run directly.
+  # For other languages, fall back to the adapter's run_tests + run_coverage pair.
   echo "Running tests..."
   
   # Route to appropriate test runner via adapter
   ADAPTER_FILE=$(resolve_adapter_path "$PROJECT_LANG")
   if [ "${PROJECT_LANG}" != "unknown" ] && [ -n "$ADAPTER_FILE" ]; then
     if source "$ADAPTER_FILE" 2>/dev/null; then
-      TESTS_OUTPUT=$(run_tests 2>&1)
-      TESTS_EXIT_CODE=$?
-      echo "$TESTS_OUTPUT" | head -50
-      if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
-        echo ""
-        echo "❌ BLOCKED - Tests FAILED"
-        exit 1
+      # TypeScript: single vitest run --coverage (combines tests + coverage)
+      if [ "$PROJECT_LANG" = "typescript" ] && [ -f "package.json" ]; then
+        if npx vitest --version >/dev/null 2>&1; then
+          echo "Running TypeScript tests with coverage..."
+          TESTS_OUTPUT=$(npx vitest run --coverage 2>&1)
+          TESTS_EXIT_CODE=$?
+          echo "$TESTS_OUTPUT" | head -60
+          if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
+            echo ""
+            echo "❌ BLOCKED - Tests FAILED"
+            exit 1
+          else
+            echo "✅ PASSED - Unit tests passed (with coverage)."
+          fi
+        else
+          # Fallback: run_tests without coverage
+          TESTS_OUTPUT=$(run_tests 2>&1)
+          TESTS_EXIT_CODE=$?
+          echo "$TESTS_OUTPUT" | head -50
+          if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
+            echo ""
+            echo "❌ BLOCKED - Tests FAILED"
+            exit 1
+          fi
+        fi
       else
-        echo "✅ PASSED - Unit tests passed."
+        # Non-TypeScript: standard adapter test flow
+        TESTS_OUTPUT=$(run_tests 2>&1)
+        TESTS_EXIT_CODE=$?
+        echo "$TESTS_OUTPUT" | head -50
+        if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
+          echo ""
+          echo "❌ BLOCKED - Tests FAILED"
+          exit 1
+        else
+          echo "✅ PASSED - Unit tests passed."
+        fi
       fi
     else
       echo "✅ PASSED - Could not source ${PROJECT_LANG} adapter for tests, assuming none to run."
@@ -1318,29 +1353,18 @@ else
     echo "✅ PASSED - No ${PROJECT_LANG} adapter found for tests, assuming none to run."
   fi
   
-  # Next, run coverage check
+  # Next, run coverage check (skip for TypeScript — already done above)
   echo "Running coverage check..."
 
   if [ "${PROJECT_LANG}" != "unknown" ] && [ -n "$ADAPTER_FILE" ]; then
     if source "$ADAPTER_FILE" 2>/dev/null; then
       case "$PROJECT_LANG" in
         "typescript")
-          if [ -f "package.json" ] && grep -q '"test:coverage"' package.json 2>/dev/null; then
-            echo "Running TypeScript coverage with minimum 80% requirement..."
-            npx vitest run --coverage 2>&1
-            COV_EXIT=$?
-            if [ "$COV_EXIT" -ne 0 ]; then
-              echo ""
-              echo "❌ BLOCKED - Coverage check FAILED (exit code: $COV_EXIT)"
-              echo "Coverage must meet the thresholds defined in vitest.config.ts"
-              exit 1
-            fi
-          else
-            echo "No 'test:coverage' script in package.json, running coverage via adapter..."
-            run_coverage_output=$(run_coverage 2>&1)
-            COV_EXIT=$?
-            echo "$run_coverage_output" | head -30
-          fi
+          # Coverage already collected in the test section above (optimized single vitest run --coverage).
+          # The --coverage flag produces coverage/coverage-summary.json which the unconditional
+          # stage-2 enforcement reads. No need to run vitest again here.
+          echo "TypeScript coverage already collected during test run."
+          COV_EXIT=0
           ;;
         "python")
           if command -v pytest &> /dev/null && command -v coverage &> /dev/null; then
@@ -1793,19 +1817,74 @@ if [ -n "$ORIGINAL_DIR" ]; then
 fi
 
 # ============================================================================
-# GATE 9: Semgrep SAST Security Scan
-# Extracted to gate-9.sh for maintainability
+# GATE 9: Build Integrity Check (TypeScript compilation + package + imports)
+# ============================================================================
+2>&1 echo ""
+2>&1 echo "→ Gate 9: Build integrity... "
+GATE_9_START=$(gate_start_ms)
+GATE_9_STATUS="SKIP"
+
+if [ -f "package.json" ] && [ -f "tsconfig.json" ]; then
+  GATE_9_SCRIPT=""
+  if [ -f "$PROJECT_ROOT/src/build-integrity/gate-10.ts" ]; then
+    GATE_9_SCRIPT="$PROJECT_ROOT/src/build-integrity/gate-10.ts"
+  elif [ -f ".xp-gate/modules/build-integrity/gate-10.ts" ]; then
+    GATE_9_SCRIPT=".xp-gate/modules/build-integrity/gate-10.ts"
+  elif [ -f "$HOME/.config/xp-gate/modules/build-integrity/gate-10.ts" ]; then
+    GATE_9_SCRIPT="$HOME/.config/xp-gate/modules/build-integrity/gate-10.ts"
+  fi
+
+  if [ -n "$GATE_9_SCRIPT" ]; then
+    CHANGED_FILES_CSV=$(echo "$CHANGED_FILES" | tr ' ' ',')
+    GATE_9_OUTPUT=$(mktemp)
+    if timeout 120s npx tsx "$GATE_9_SCRIPT" --changed-files "$CHANGED_FILES_CSV" --project-root "$PROJECT_ROOT" --timeout 115000 > "$GATE_9_OUTPUT" 2>&1; then
+      GATE_9_STATUS="PASS"
+      echo "     ✅ Build integrity check passed."
+    else
+      GATE_9_EXIT=$?
+      if [ $GATE_9_EXIT -eq 124 ]; then
+        GATE_9_STATUS="SKIP"
+        echo "     ⏱️  Build integrity check timed out (120s). SKIPPED."
+      else
+        GATE_9_STATUS="BLOCK"
+        cat "$GATE_9_OUTPUT"
+        echo ""
+        echo "❌ BLOCKED - Gate 9: Build integrity check failed"
+        echo "Fix type errors, broken imports, or package manifest issues before committing."
+        rm -f "$GATE_9_OUTPUT"
+        exit 1
+      fi
+    fi
+    rm -f "$GATE_9_OUTPUT"
+  else
+    echo "     ℹ️  Build integrity script not found - skipping"
+    echo "     ⏭️  SKIPPED - Build integrity (gate-10.ts not available)"
+  fi
+else
+  echo "     ℹ️  Not a TypeScript project - skipping build integrity check"
+  echo "     ⏭️  SKIPPED - Build integrity (not a TypeScript project)"
+fi
+
+GATE_9_END=$(date +%s)
+GATE_9_DURATION=$((GATE_9_END - GATE_9_START))
+echo "✅ Gate 9 completed in ${GATE_9_DURATION}s"
+echo ""
+# ============================================================================
+
+# ============================================================================
+# GATE 10: Semgrep SAST Security Scan
+# Extracted to gate-10.sh for maintainability
 # ============================================================================
 source "$GATE_DIR/gate-9.sh"
 # ============================================================================
 
 # ============================================================================
-# GATE 10: Sprint Flow Enforcement
+# GATE 11: Sprint Flow Enforcement
 # Validates sprint state consistency (delphi-review APPROVED before BUILD)
 # Uses sprint-gate.sh for standalone validation logic
 # ============================================================================
-GATE_10_START=$(date +%s)
-GATE_10_STATUS="PASS"
+GATE_11_START=$(date +%s)
+GATE_11_STATUS="PASS"
 
 SPRINT_GATE_SCRIPT=""
 if [ -f "$GATE_DIR/sprint-gate.sh" ]; then
@@ -1816,19 +1895,19 @@ fi
 
 if [ -n "$SPRINT_GATE_SCRIPT" ]; then
   if ! bash "$SPRINT_GATE_SCRIPT" --pre-commit; then
-    GATE_10_STATUS="BLOCK"
-    echo "❌ BLOCKED - Gate 10: Sprint Flow Enforcement"
+    GATE_11_STATUS="BLOCK"
+    echo "❌ BLOCKED - Gate 11: Sprint Flow Enforcement"
     # Sprint gate failure is a hard block — exit immediately
     exit 1
   fi
 else
-  echo "⏭️  SKIPPED - Gate 10: Sprint Flow (sprint-gate.sh not found)"
-  GATE_10_STATUS="SKIP"
+  echo "⏭️  SKIPPED - Gate 11: Sprint Flow (sprint-gate.sh not found)"
+  GATE_11_STATUS="SKIP"
 fi
 
-GATE_10_END=$(date +%s)
-GATE_10_DURATION=$((GATE_10_END - GATE_10_START))
-echo "✅ Gate 10 completed in ${GATE_10_DURATION}s"
+GATE_11_END=$(date +%s)
+GATE_11_DURATION=$((GATE_11_END - GATE_11_START))
+echo "✅ Gate 11 completed in ${GATE_11_DURATION}s"
 echo ""
 # ============================================================================
 
@@ -1838,13 +1917,13 @@ generate_quality_report() {
   local TIMESTAMP
   local BRANCH
   local PASSED_COUNT=0
-  local TOTAL_GATES=10
+  local TOTAL_GATES=11
 
   COMMIT_HASH=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
   BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
   TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
-  for gate in 1 2 3 4 5 6 7 8 9 10; do
+  for gate in 1 2 3 4 5 6 7 8 9 10 11; do
     local status_var="GATE_${gate}_STATUS"
     if [ "${!status_var}" = "PASS" ]; then
       PASSED_COUNT=$((PASSED_COUNT + 1))
@@ -1886,7 +1965,7 @@ generate_quality_report() {
 
   cat > "$REPORT_FILE" << ENDJSON
 {
-  "reportVersion": "1.1",
+  "reportVersion": "2.0",
   "generatedAt": "$TIMESTAMP",
   "branch": "$BRANCH",
   "commit": "$COMMIT_HASH",
@@ -1943,14 +2022,19 @@ generate_quality_report() {
       "status": "${GATE_8_STATUS:-PASS}",
       "tool": "gitleaks"
     },
-    "gate9_sast": {
-      "name": "SAST Security Scan",
+    "gate9_build_integrity": {
+      "name": "Build Integrity",
       "status": "${GATE_9_STATUS:-PASS}",
+      "tool": "tsc + npm pack + import check"
+    },
+    "gate10_sast": {
+      "name": "SAST Security Scan",
+      "status": "${GATE_10_STATUS:-PASS}",
       "tool": "semgrep"
     },
-    "gate10_sprint_flow": {
+    "gate11_sprint_flow": {
       "name": "Sprint Flow Enforcement",
-      "status": "${GATE_10_STATUS:-PASS}",
+      "status": "${GATE_11_STATUS:-PASS}",
       "tool": "sprint-gate.sh"
     }
   }
@@ -1992,8 +2076,9 @@ PY
   GATES_JSON="${GATES_JSON}\"gate6\":{\"status\":\"${GATE_6_STATUS:-PASS}\",\"name\":\"Architecture+BoyScout\",\"bsBlocked\":${BS_BLOCKED}},"
   GATES_JSON="${GATES_JSON}\"gate7\":{\"status\":\"${GATE_7_STATUS:-PASS}\",\"name\":\"IaC Security\"},"
   GATES_JSON="${GATES_JSON}\"gate8\":{\"status\":\"${GATE_8_STATUS:-PASS}\",\"name\":\"Secret Scanning\"},"
-  GATES_JSON="${GATES_JSON}\"gate9\":{\"status\":\"${GATE_9_STATUS:-PASS}\",\"name\":\"SAST Security\"},"
-  GATES_JSON="${GATES_JSON}\"gate10\":{\"status\":\"${GATE_10_STATUS:-PASS}\",\"name\":\"Sprint Flow\"}}"
+  GATES_JSON="${GATES_JSON}\"gate9\":{\"status\":\"${GATE_9_STATUS:-PASS}\",\"name\":\"Build Integrity\"},"
+  GATES_JSON="${GATES_JSON}\"gate10\":{\"status\":\"${GATE_10_STATUS:-PASS}\",\"name\":\"SAST Security\"},"
+  GATES_JSON="${GATES_JSON}\"gate11\":{\"status\":\"${GATE_11_STATUS:-PASS}\",\"name\":\"Sprint Flow\"}}"
   GATES_JSON="${GATES_JSON}}"
 
   echo "{\"timestamp\":\"$TIMESTAMP\",\"commit\":\"$COMMIT_HASH\",\"branch\":\"$BRANCH\",\"score\":$SCORE,\"passed\":$PASSED_COUNT,\"total\":$TOTAL_GATES,\"gates\":$GATES_JSON,\"coverage\":\"$COV_PCT\",\"complexityWarnings\":${CC_WARNINGS:-0},\"principleWarnings\":${WARNING_COUNT:-0},\"boyScoutBlocked\":${BS_BLOCKED}}" >> "$HISTORY_FILE"
@@ -2012,8 +2097,9 @@ PY
   printf "  %-45s %s\n" "Gate 6: Architecture + Boy Scout" "${GATE_6_STATUS:-PASS}"
   printf "  %-45s %s\n" "Gate 7: IaC Security" "${GATE_7_STATUS:-PASS}"
   printf "  %-45s %s\n" "Gate 8: Secret Scanning" "${GATE_8_STATUS:-PASS}"
-  printf "  %-45s %s\n" "Gate 9: SAST Security" "${GATE_9_STATUS:-PASS}"
-  printf "  %-45s %s\n" "Gate 10: Sprint Flow" "${GATE_10_STATUS:-PASS}"
+  printf "  %-45s %s\n" "Gate 9: Build Integrity" "${GATE_9_STATUS:-PASS}"
+  printf "  %-45s %s\n" "Gate 10: SAST Security" "${GATE_10_STATUS:-PASS}"
+  printf "  %-45s %s\n" "Gate 11: Sprint Flow" "${GATE_11_STATUS:-PASS}"
   echo ""
   echo "  Overall Score: $SCORE/10 | $PASSED_COUNT/$TOTAL_GATES gates passed"
   echo "  Branch status: $REPORT_FILE"

package/lib/arch.js

@@ -4,7 +4,11 @@ const { spawnSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 
-// Looks for architecture.yaml in CWD, then walks up to git root.
+function isPythonProject(dir) {
+  const markers = ['setup.py', 'setup.cfg', 'pyproject.toml', 'requirements.txt'];
+  return markers.some((m) => fs.existsSync(path.join(dir, m)));
+}
+
 function findArchConfig(startDir) {
   let dir = path.resolve(startDir);
   const root = path.parse(dir).root;
@@ -17,6 +21,39 @@ function findArchConfig(startDir) {
   return null;
 }
 
+function runArchlinter(config) {
+  const result = spawnSync(
+    'npx',
+    ['-y', '@archlinter/cli', 'scan', '.', '--config', config],
+    { stdio: 'inherit', shell: process.platform === 'win32' },
+  );
+  if (result.error && result.error.code === 'ENOENT') {
+    console.error('[xp-gate arch] ERROR: npx not found in PATH. Install Node.js >=18.');
+    return 1;
+  }
+  return result.status === null ? 1 : result.status;
+}
+
+function runArchy(config) {
+  const result = spawnSync('archy', ['check', '.', '--config', config], {
+    stdio: 'inherit',
+    shell: process.platform === 'win32',
+  });
+  if (result.error && result.error.code === 'ENOENT') {
+    console.warn('[xp-gate arch] archy not found on PATH; trying npx fallback.');
+    const npxResult = spawnSync('npx', ['-y', 'archy', 'check', '.', '--config', config], {
+      stdio: 'inherit',
+      shell: process.platform === 'win32',
+    });
+    if (npxResult.error && npxResult.error.code === 'ENOENT') {
+      console.error('[xp-gate arch] ERROR: neither archy nor npx found in PATH.');
+      return 1;
+    }
+    return npxResult.status === null ? 1 : npxResult.status;
+  }
+  return result.status === null ? 1 : result.status;
+}
+
 function arch(args) {
   const configIdx = args.indexOf('--config');
   const explicitConfig = configIdx >= 0 ? args[configIdx + 1] : null;
@@ -33,17 +70,12 @@ function arch(args) {
     return Promise.resolve(1);
   }
 
-  const result = spawnSync('npx', ['-y', '@archlinter/cli', 'scan', '.', '--config', config], {
-    stdio: 'inherit',
-    shell: process.platform === 'win32',
-  });
-
-  if (result.error && result.error.code === 'ENOENT') {
-    console.error('[xp-gate arch] ERROR: npx not found in PATH. Install Node.js >=18.');
-    return Promise.resolve(1);
+  if (isPythonProject(process.cwd())) {
+    console.log('[xp-gate arch] Detected Python project — using archy');
+    return Promise.resolve(runArchy(config));
   }
 
-  return Promise.resolve(result.status === null ? 1 : result.status);
+  return Promise.resolve(runArchlinter(config));
 }
 
 module.exports = { arch };

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/scripts/prepack.cjs

@@ -80,21 +80,6 @@ function main() {
   }
 
   console.error(`[prepack] done: ${copied} skills bundled for @boyingliu01/opencode-plugin`);
-
-  // Validate tui-plugin.ts structural integrity (Issue #248: stale cache detection)
-  const tuiFile = path.join(PLUGIN_ROOT, 'tui-plugin.ts');
-  const tuiContent = fs.readFileSync(tuiFile, 'utf8');
-  const ok1 = tuiContent.includes('discoverActiveSprints') && tuiContent.includes('.worktrees');
-  const ok2 = !tuiContent.match(/from\s+["'][^"']*\.\.\/\.\.\/src[^"']*["']/);
-  if (!ok1) {
-    console.error('[prepack] ERROR: tui-plugin.ts is missing discoverActiveSprints — old version detected');
-    process.exit(1);
-  }
-  if (!ok2) {
-    console.error('[prepack] ERROR: tui-plugin.ts contains broken import paths to ../../src/...');
-    process.exit(1);
-  }
-  console.error('[prepack] OK: tui-plugin.ts structural checks passed');
 }
 
 main();

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 10 quality gates (Gate 0-9), Sprint Flow (11 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → USER ACCEPTANCE → FEEDBACK → SHIP → LAND → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/principles/index.ts

@@ -72,8 +72,21 @@ export async function main(args: string[]): Promise<number> {
   return result.summary.totalViolations > 0 ? 1 : 0;
 }
 
+// Support both CJS (require.main === module) and ESM (import.meta.url) runtimes.
+// npx tsx loads files via import() making require.main unreliable.
+function isDirectExecution(): boolean {
+  if (typeof require !== 'undefined' && require.main === module) {
+    return true;
+  }
+  if (typeof import.meta !== 'undefined' && import.meta.url && process.argv[1]) {
+    const fileUrl = `file://${process.argv[1]}`;
+    return import.meta.url === fileUrl || import.meta.url.endsWith(`/${process.argv[1]}`);
+  }
+  return false;
+}
+
 const args = process.argv.slice(2);
-if (typeof require !== 'undefined' && require.main === module) {
+if (isDirectExecution()) {
   main(args)
     .then(exitCode => {
       if (exitCode !== 0) {
@@ -84,4 +97,4 @@ if (typeof require !== 'undefined' && require.main === module) {
       console.error('Analysis failed:', err.message);
       process.exit(1);
     });
-}
+}

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, 3 experts from ≥2 providers, domestic models only). Supports design + code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 **11-phase** development pipeline: ISOLATE → AUTO-ESTIMATE → THINK → PLAN → BUILD → REVIEW → SHIP → LAND → USER ACCEPTANCE → FEEDBACK → CLEANUP. Phase 2 default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE in Phase 1: design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-03
-**Commit:** c3ed581
+**Generated:** 2026-07-05
+**Commit:** e639b50
 **Branch:** main
-**Version:** 0.12.4.0
+**Version:** 0.12.6.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.