@boyingliu01/xp-gate 0.15.5 → 0.18.1

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-07-23
-**Commit:** 766602e
+**Generated:** 2026-07-25
+**Commit:** 3150b22
 **Branch:** main
-**Version:** 0.15.5.0
+**Version:** 0.18.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
-**Generated:** 2026-07-23
-**Commit:** 766602e
+**Generated:** 2026-07-25
+**Commit:** 3150b22
 **Branch:** main
-**Version:** 0.15.5.0
+**Version:** 0.18.0.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/scripts/__tests__/check-mattpocock-license.test.js

@@ -0,0 +1,229 @@
+/**
+ * @test C0-mattpocock-license-gate
+ * @intent Verify check-mattpocock-license.cjs enforces the C0 publish gate:
+ *         (a) valid MIT license → PASS (exit 0);
+ *         (b) corrupted license → FAIL (exit 1), missing license → clean-room path (exit 2);
+ *         (c) network failure with valid cache → offline fallback (exit 0, source "cache").
+ *         All scenarios run hermetically: no real GitHub calls (local 404 server / --offline).
+ * @covers AC-C0-01, AC-C0-02, AC-C0-03
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const http = require('http');
+const { spawnSync } = require('child_process');
+
+const SCRIPT = path.resolve(__dirname, '..', 'check-mattpocock-license.cjs');
+
+// Valid MIT license text (mirrors mattpocock/skills LICENSE, verified 2026-07-26).
+const VALID_MIT_LICENSE = `MIT License
+
+Copyright (c) 2026 Matt Pocock
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+`;
+
+const CORRUPTED_LICENSE = 'PROPRIETARY LICENSE\nAll rights reserved. Redistribution prohibited.\n';
+
+function createTempDir() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'license-check-test-'));
+}
+
+function cleanupTempDir(dir) {
+  fs.rmSync(dir, { recursive: true, force: true });
+}
+
+/**
+ * Build hermetic env overrides so the script never touches the real network
+ * or the real repo paths. Default URL points at a closed localhost port
+ * (instant ECONNREFUSED) — individual tests override with a local 404 server.
+ */
+function buildEnv(tmpDir, licenseUrl) {
+  return {
+    ...process.env,
+    XPGATE_LICENSE_URL: licenseUrl || 'http://127.0.0.1:9/LICENSE',
+    XPGATE_LICENSE_CACHE: path.join(tmpDir, 'mattpocock-license.cache.md'),
+    XPGATE_LICENSE_VERDICT: path.join(tmpDir, 'mattpocock-license-verdict.json'),
+    XPGATE_CLEAN_ROOM_DECISION: path.join(tmpDir, 'clean-room-decision.json'),
+  };
+}
+
+function runScript(args, env) {
+  const result = spawnSync(process.execPath, [SCRIPT, ...args], {
+    env,
+    stdio: 'pipe',
+    timeout: 30000,
+  });
+  const verdictPath = env.XPGATE_LICENSE_VERDICT;
+  return {
+    status: result.status,
+    stderr: (result.stderr || Buffer.alloc(0)).toString(),
+    stdout: (result.stdout || Buffer.alloc(0)).toString(),
+    verdict: fs.existsSync(verdictPath) ? JSON.parse(fs.readFileSync(verdictPath, 'utf8')) : null,
+  };
+}
+
+/** Start a localhost HTTP server that always returns 404 (fake dead license URL). */
+function start404Server() {
+  return new Promise((resolve) => {
+    const server = http.createServer((req, res) => {
+      res.statusCode = 404;
+      res.end('Not Found');
+    });
+    server.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      resolve({ server, url: `http://127.0.0.1:${port}/LICENSE` });
+    });
+  });
+}
+
+function stopServer(server) {
+  return new Promise((resolve) => {
+    server.close(() => resolve());
+  });
+}
+
+describe('check-mattpocock-license (C0 gate)', () => {
+  let tmpDir;
+
+  beforeEach(() => {
+    tmpDir = createTempDir();
+  });
+
+  afterEach(() => {
+    cleanupTempDir(tmpDir);
+  });
+
+  // ── Scenario (a): valid MIT license → PASS ────────────────────────────
+  it('(a) exits 0 with PASS verdict when the cache holds a valid MIT license (--offline)', () => {
+    const env = buildEnv(tmpDir);
+    fs.writeFileSync(env.XPGATE_LICENSE_CACHE, VALID_MIT_LICENSE, 'utf8');
+
+    const r = runScript(['--offline'], env);
+
+    expect(r.status).toBe(0);
+    expect(r.verdict).not.toBeNull();
+    expect(r.verdict.verdict).toBe('PASS');
+    expect(r.verdict.license_type).toBe('MIT');
+    expect(r.verdict.source).toBe('cache');
+    expect(r.verdict.sha256).toMatch(/^[0-9a-f]{64}$/);
+    expect(r.verdict.checked_at).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+  });
+
+  // ── Scenario (b): corrupted / missing LICENSE → FAIL ──────────────────
+  it('(b1) exits 1 with FAIL verdict and clean-room mitigation when the license is corrupted', () => {
+    const env = buildEnv(tmpDir);
+    fs.writeFileSync(env.XPGATE_LICENSE_CACHE, CORRUPTED_LICENSE, 'utf8');
+
+    const r = runScript(['--offline'], env);
+
+    expect(r.status).toBe(1);
+    expect(r.verdict).not.toBeNull();
+    expect(r.verdict.verdict).toBe('FAIL');
+    expect(r.stderr).toMatch(/clean-room/i);
+  });
+
+  it('(b2) exits 2 with clean-room rewrite instruction when the license is missing (404 + no cache)', async () => {
+    const { server, url } = await start404Server();
+    try {
+      const env = buildEnv(tmpDir, url);
+      // No cache file written → license entirely missing.
+
+      const r = runScript([], env);
+
+      // Exit 2 per MUST-DO §6: "LICENSE missing or unrecognizable" triggers the clean-room path.
+      expect(r.status).toBe(2);
+      expect(r.verdict).not.toBeNull();
+      expect(r.verdict.verdict).toBe('FAIL');
+      expect(r.verdict.source).toBe('none');
+      expect(r.stderr).toMatch(/clean-room rewrite/i);
+    } finally {
+      await stopServer(server);
+    }
+  });
+
+  // ── Scenario (c): offline fallback to cache ───────────────────────────
+  it('(c) exits 0 with source "cache" when the network fails but a valid cache exists', async () => {
+    const { server, url } = await start404Server();
+    try {
+      const env = buildEnv(tmpDir, url);
+      fs.writeFileSync(env.XPGATE_LICENSE_CACHE, VALID_MIT_LICENSE, 'utf8');
+
+      // No --offline flag: network is attempted first, fails (404), then falls back to cache.
+      const r = runScript([], env);
+
+      expect(r.status).toBe(0);
+      expect(r.verdict).not.toBeNull();
+      expect(r.verdict.verdict).toBe('PASS');
+      expect(r.verdict.license_type).toBe('MIT');
+      expect(r.verdict.source).toBe('cache');
+      expect(r.stderr).toMatch(/offline cache/i);
+    } finally {
+      await stopServer(server);
+    }
+  });
+
+  // ── --force-clean-room override ───────────────────────────────────────
+  it('records a clean-room decision and exits 0 with --force-clean-room', () => {
+    const env = buildEnv(tmpDir);
+    // No cache, dead network URL — without the override this would exit 2.
+
+    const r = runScript(['--force-clean-room'], env);
+
+    expect(r.status).toBe(0);
+    expect(fs.existsSync(env.XPGATE_CLEAN_ROOM_DECISION)).toBe(true);
+    const decision = JSON.parse(fs.readFileSync(env.XPGATE_CLEAN_ROOM_DECISION, 'utf8'));
+    expect(decision.decision).toBe('clean-room-rewrite');
+    expect(decision.recorded_at).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+  });
+});
+
+// ── Unit tests for the pure validation function (in-process) ──────────────
+describe('validateLicense (unit)', () => {
+  const { validateLicense, sha256, EXIT_PASS, EXIT_FAIL, EXIT_MISSING } = require('../check-mattpocock-license.cjs');
+
+  it('accepts a valid MIT license', () => {
+    const result = validateLicense(VALID_MIT_LICENSE);
+    expect(result.valid).toBe(true);
+    expect(result.licenseType).toBe('MIT');
+  });
+
+  it('rejects a proprietary license', () => {
+    const result = validateLicense(CORRUPTED_LICENSE);
+    expect(result.valid).toBe(false);
+  });
+
+  it('rejects empty input', () => {
+    expect(validateLicense('').valid).toBe(false);
+    expect(validateLicense(null).valid).toBe(false);
+  });
+
+  it('computes a stable SHA-256 hex digest', () => {
+    expect(sha256('MIT License')).toBe(sha256('MIT License'));
+    expect(sha256('MIT License')).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it('exports distinct exit code constants', () => {
+    expect(EXIT_PASS).toBe(0);
+    expect(EXIT_FAIL).toBe(1);
+    expect(EXIT_MISSING).toBe(2);
+  });
+});

package/scripts/__tests__/sync-package-content.test.js

@@ -262,6 +262,56 @@ describe('syncGateScripts', () => {
   });
 });
 
+/**
+ * @test REQ-450 sync-hooks
+ * @intent Verify syncHooks() copies githooks pre-commit, pre-push, adapter-common.sh,
+ *        and lib/ subdirectory to src/npm-package/hooks/
+ * @covers AC-450-01, AC-450-02, AC-450-03, AC-450-04
+ */
+describe('syncHooks', () => {
+  const WORKTREE_PATH = path.resolve(__dirname, '..', '..', '..', '..');
+  const PKG_ROOT = path.join(WORKTREE_PATH, 'src', 'npm-package');
+  const HOOKS_DIR = path.join(PKG_ROOT, 'hooks');
+  const syncScript = path.join(WORKTREE_PATH, 'src', 'npm-package', 'scripts', 'sync-package-content.js');
+  const nodeExe = process.execPath;
+
+  // Ensure hooks are re-synced once before tests run; share the result.
+  let syncOk = false;
+  beforeAll(() => {
+    const result = spawnSync(nodeExe, [syncScript], {
+      cwd: WORKTREE_PATH,
+      stdio: 'pipe',
+      timeout: 15000,
+    });
+    syncOk = result.status === 0;
+    if (!syncOk) {
+      console.error('sync stderr:', result.stderr?.toString() || '(empty)');
+      console.error('sync stdout:', result.stdout?.toString() || '(empty)');
+    }
+  }, 15000);
+
+  it('syncHooks copies pre-commit to hooks dir', () => {
+    expect(syncOk, 'sync script must exit 0').toBe(true);
+    expect(fs.existsSync(path.join(HOOKS_DIR, 'pre-commit')), 'pre-commit must exist').toBe(true);
+  });
+
+  it('syncHooks copies pre-push to hooks dir', () => {
+    expect(syncOk, 'sync script must exit 0').toBe(true);
+    expect(fs.existsSync(path.join(HOOKS_DIR, 'pre-push')), 'pre-push must exist').toBe(true);
+  });
+
+  it('syncHooks copies adapter-common.sh to hooks dir', () => {
+    expect(syncOk, 'sync script must exit 0').toBe(true);
+    expect(fs.existsSync(path.join(HOOKS_DIR, 'adapter-common.sh')), 'adapter-common.sh must exist').toBe(true);
+  });
+
+  it('syncHooks copies lib/now-ms.sh to hooks/lib dir', () => {
+    expect(syncOk, 'sync script must exit 0').toBe(true);
+    const libFile = path.join(HOOKS_DIR, 'lib', 'now-ms.sh');
+    expect(fs.existsSync(libFile), `lib/now-ms.sh must exist in hooks dir: ${libFile}`).toBe(true);
+  });
+});
+
 /**
  * @test REQ-329 adapter-mirror-drift
  * @intent Verify checkAdapterDrift() detects file count and content mismatches

package/scripts/check-mattpocock-license.cjs

@@ -0,0 +1,302 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * C0 License Verification Gate (v0.18.0 Phase C0)
+ *
+ * Verifies that mattpocock/skills ships a permissive (MIT) license before the
+ * 4 built-in Matt Pocock skills (grilling, grill-with-docs, batch-grill-me,
+ * domain-modeling) are packed into the npm distribution. Design doc §6/§12/§16.4:
+ * a confirmed permissive license is a publish blocker; without it the skills
+ * must be clean-room rewritten from the functional spec instead of copied.
+ *
+ * Flow:
+ *   1. Fetch https://raw.githubusercontent.com/mattpocock/skills/main/LICENSE
+ *      (10s timeout, one retry). On success, refresh the offline cache.
+ *   2. On network failure, fall back to the offline cache
+ *      (.xp-gate/mattpocock-license.cache.md).
+ *   3. Validate the text is a compliant MIT license (regex: "MIT License"
+ *      header + grant clause) and record SHA-256 as evidence.
+ *   4. Write a verdict JSON to lib/mattpocock-license-verdict.json.
+ *
+ * Exit codes:
+ *   0  PASS — MIT license confirmed (network or cache)
+ *   1  FAIL — license obtained but NOT a compliant MIT license
+ *   2  MISSING — license could not be obtained at all (triggers clean-room path)
+ *
+ * CLI flags:
+ *   --offline             Skip network; use the offline cache only.
+ *   --refresh             Re-fetch from network and update the cache
+ *                         (default flow already does this; explicit for clarity).
+ *   --force-clean-room    Record a clean-room rewrite decision to
+ *                         .xp-gate/clean-room-decision.json and exit 0 for this
+ *                         publish only (original skill text must NOT be copied).
+ *
+ * Env overrides (used by tests for hermetic execution):
+ *   XPGATE_LICENSE_URL           license URL to fetch
+ *   XPGATE_LICENSE_CACHE         offline cache file path
+ *   XPGATE_LICENSE_VERDICT       verdict JSON output path
+ *   XPGATE_CLEAN_ROOM_DECISION   clean-room decision JSON path
+ *
+ * Zero runtime dependencies (Node built-ins only).
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const https = require('https');
+const http = require('http');
+
+const PKG_ROOT = path.resolve(__dirname, '..');
+const REPO_ROOT = path.resolve(PKG_ROOT, '..', '..');
+
+const DEFAULT_LICENSE_URL = 'https://raw.githubusercontent.com/mattpocock/skills/main/LICENSE';
+const NETWORK_TIMEOUT_MS = 10000;
+const MAX_RETRIES = 1;
+const MAX_REDIRECTS = 3;
+
+const LICENSE_URL = process.env.XPGATE_LICENSE_URL || DEFAULT_LICENSE_URL;
+const CACHE_PATH = process.env.XPGATE_LICENSE_CACHE || path.join(REPO_ROOT, '.xp-gate', 'mattpocock-license.cache.md');
+const VERDICT_PATH = process.env.XPGATE_LICENSE_VERDICT || path.join(PKG_ROOT, 'lib', 'mattpocock-license-verdict.json');
+const CLEAN_ROOM_PATH = process.env.XPGATE_CLEAN_ROOM_DECISION || path.join(REPO_ROOT, '.xp-gate', 'clean-room-decision.json');
+
+const EXIT_PASS = 0;
+const EXIT_FAIL = 1; // license obtained but non-compliant
+const EXIT_MISSING = 2; // license missing/unrecognizable → clean-room path
+
+function sha256(text) {
+  return crypto.createHash('sha256').update(text, 'utf8').digest('hex');
+}
+
+/**
+ * Validate that license text is a compliant MIT license.
+ * Regex-based (tolerates copyright-year changes upstream) rather than a fixed
+ * hash, with the SHA-256 recorded separately as tamper evidence.
+ * @param {string} text
+ * @returns {{ valid: boolean, licenseType: string|null, reason: string }}
+ */
+function validateLicense(text) {
+  if (typeof text !== 'string' || text.trim().length === 0) {
+    return { valid: false, licenseType: null, reason: 'license text is empty' };
+  }
+  const hasMitHeader = /MIT License/i.test(text);
+  const hasGrantClause = /Permission is hereby granted, free of charge/i.test(text);
+  const hasNoWarranty = /THE SOFTWARE IS PROVIDED "AS IS"/i.test(text);
+  const hasExpectedCopyright = /Copyright \(c\)\s+\d{4}\s+Matt Pocock/i.test(text);
+
+  if (hasMitHeader && hasGrantClause && hasNoWarranty) {
+    return {
+      valid: true,
+      licenseType: 'MIT',
+      reason: hasExpectedCopyright
+        ? 'MIT License with Matt Pocock copyright notice'
+        : 'MIT License (copyright holder differs from expected "Matt Pocock")',
+    };
+  }
+  return {
+    valid: false,
+    licenseType: null,
+    reason: 'text does not match MIT License terms (missing "MIT License" header, grant clause, or warranty disclaimer)',
+  };
+}
+
+/**
+ * Fetch a URL, following up to MAX_REDIRECTS redirects.
+ * Supports https: and http: (http only used by tests against a local server).
+ * @param {string} url
+ * @param {{ timeoutMs?: number, redirectsLeft?: number }} [options]
+ * @returns {Promise<string>}
+ */
+function fetchUrl(url, options) {
+  const timeoutMs = (options && options.timeoutMs) || NETWORK_TIMEOUT_MS;
+  const redirectsLeft = options && typeof options.redirectsLeft === 'number' ? options.redirectsLeft : MAX_REDIRECTS;
+
+  return new Promise((resolve, reject) => {
+    let mod;
+    if (url.startsWith('https:')) mod = https;
+    else if (url.startsWith('http:')) mod = http;
+    else {
+      reject(new Error(`unsupported URL scheme: ${url}`));
+      return;
+    }
+
+    const req = mod.get(url, (res) => {
+      const status = res.statusCode || 0;
+      if (status >= 300 && status < 400 && res.headers.location && redirectsLeft > 0) {
+        res.resume();
+        const next = new URL(res.headers.location, url).toString();
+        fetchUrl(next, { timeoutMs, redirectsLeft: redirectsLeft - 1 }).then(resolve, reject);
+        return;
+      }
+      if (status !== 200) {
+        res.resume();
+        reject(new Error(`HTTP ${status} for ${url}`));
+        return;
+      }
+      const chunks = [];
+      res.on('data', (chunk) => chunks.push(chunk));
+      res.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+      res.on('error', reject);
+    });
+    req.setTimeout(timeoutMs, () => {
+      req.destroy(new Error(`timeout after ${timeoutMs}ms fetching ${url}`));
+    });
+    req.on('error', reject);
+  });
+}
+
+/**
+ * Fetch with one retry after the initial attempt fails.
+ * @param {string} url
+ * @param {number} [retries]
+ * @returns {Promise<string>}
+ */
+async function fetchWithRetry(url, retries) {
+  const attempts = (typeof retries === 'number' ? retries : MAX_RETRIES) + 1;
+  let lastErr;
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      return await fetchUrl(url);
+    } catch (err) {
+      lastErr = err;
+      console.error(`[license-check] network attempt ${attempt}/${attempts} failed: ${err.message}`);
+    }
+  }
+  throw lastErr;
+}
+
+function writeJson(filePath, obj) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(obj, null, 2)}\n`, 'utf8');
+}
+
+function handleForceCleanRoom() {
+  const recordedAt = new Date().toISOString();
+  const decision = {
+    decision: 'clean-room-rewrite',
+    recorded_at: recordedAt,
+    note: 'mattpocock/skills LICENSE missing or non-compliant at publish time. '
+      + 'The 4 built-in skills (grilling, grill-with-docs, batch-grill-me, domain-modeling) '
+      + 'must be clean-room rewritten from the functional spec (interview discipline / '
+      + 'CONTEXT.md+ADR formats / batch decision protocol) — original expression must NOT be copied.',
+  };
+  writeJson(CLEAN_ROOM_PATH, decision);
+  writeJson(VERDICT_PATH, {
+    verdict: 'FAIL',
+    license_type: null,
+    sha256: null,
+    checked_at: recordedAt,
+    source: 'clean-room-decision',
+    clean_room: true,
+  });
+  console.error(`[license-check] clean-room decision recorded: ${CLEAN_ROOM_PATH}`);
+  console.error('[license-check] WARNING: publishing under clean-room override — verbatim skill text must NOT be shipped until the rewrite lands.');
+  process.exit(EXIT_PASS);
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const offline = args.includes('--offline');
+  const refresh = args.includes('--refresh');
+
+  if (args.includes('--force-clean-room')) {
+    handleForceCleanRoom();
+    return;
+  }
+
+  let text = null;
+  let source = null;
+
+  if (offline) {
+    console.error('[license-check] --offline: skipping network fetch');
+  } else {
+    if (refresh) console.error('[license-check] --refresh: re-fetching license from network');
+    try {
+      text = await fetchWithRetry(LICENSE_URL);
+      source = 'network';
+      // Refresh the offline cache on every successful network fetch.
+      try {
+        fs.mkdirSync(path.dirname(CACHE_PATH), { recursive: true });
+        fs.writeFileSync(CACHE_PATH, text, 'utf8');
+        console.error(`[license-check] offline cache updated: ${CACHE_PATH}`);
+      } catch (cacheErr) {
+        console.error(`[license-check] WARN: failed to update offline cache: ${cacheErr.message}`);
+      }
+    } catch (netErr) {
+      console.error(`[license-check] network unavailable: ${netErr.message}`);
+    }
+  }
+
+  if (text === null && fs.existsSync(CACHE_PATH)) {
+    text = fs.readFileSync(CACHE_PATH, 'utf8');
+    source = 'cache';
+    console.error(`[license-check] using offline cache: ${CACHE_PATH}`);
+  }
+
+  const checkedAt = new Date().toISOString();
+
+  if (text === null) {
+    writeJson(VERDICT_PATH, {
+      verdict: 'FAIL',
+      license_type: null,
+      sha256: null,
+      checked_at: checkedAt,
+      source: 'none',
+      error: 'license missing: network fetch failed and no offline cache available',
+    });
+    console.error('[license-check] ERROR: mattpocock/skills LICENSE could not be obtained (network failed, no cache).');
+    console.error('[license-check] This is a publish blocker (design §6 C0 license gate).');
+    console.error('[license-check] Mitigation: start a clean-room rewrite of the 4 built-in skills from the functional spec,');
+    console.error('[license-check]   or run `npm run license-check -- --force-clean-room` to record the clean-room rewrite path for this publish.');
+    process.exit(EXIT_MISSING);
+  }
+
+  const result = validateLicense(text);
+  const digest = sha256(text);
+
+  if (!result.valid) {
+    writeJson(VERDICT_PATH, {
+      verdict: 'FAIL',
+      license_type: result.licenseType,
+      sha256: digest,
+      checked_at: checkedAt,
+      source,
+      reason: result.reason,
+    });
+    console.error(`[license-check] FAIL: ${result.reason}`);
+    console.error(`[license-check] sha256: ${digest} (source: ${source})`);
+    console.error('[license-check] The license is NOT a compliant MIT license — verbatim redistribution of the skills is prohibited.');
+    console.error('[license-check] Mitigation: run `npm run license-check -- --force-clean-room` to record the clean-room rewrite path.');
+    process.exit(EXIT_FAIL);
+  }
+
+  writeJson(VERDICT_PATH, {
+    verdict: 'PASS',
+    license_type: 'MIT',
+    sha256: digest,
+    checked_at: checkedAt,
+    source,
+  });
+  console.error(`[license-check] PASS: MIT License confirmed (${result.reason})`);
+  console.error(`[license-check] sha256: ${digest}`);
+  console.error(`[license-check] source: ${source}`);
+  console.error(`[license-check] verdict written: ${VERDICT_PATH}`);
+  process.exit(EXIT_PASS);
+}
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(`[license-check] unexpected error: ${err.message}`);
+    process.exit(EXIT_MISSING);
+  });
+}
+
+module.exports = {
+  validateLicense,
+  sha256,
+  fetchUrl,
+  fetchWithRetry,
+  EXIT_PASS,
+  EXIT_FAIL,
+  EXIT_MISSING,
+};