@boyingliu01/xp-gate 0.18.4 → 0.19.0

package/hooks/lib/validate-code-walkthrough.cjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+
+const REQUIRED_ROLES = ['architecture', 'technical', 'feasibility'];
+const VALIDITY_MS = 60 * 60 * 1000;
+
+function fail(message) {
+  console.error(`Invalid code walkthrough evidence: ${message}`);
+  process.exit(1);
+}
+
+function isPlainObject(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function parseTimestamp(value, field) {
+  const match = typeof value === 'string'
+    ? value.match(/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?Z$/)
+    : null;
+  if (!match) fail(`${field} must be a canonical UTC ISO-8601 timestamp.`);
+
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, fractionText] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const milliseconds = Number((fractionText || '').padEnd(3, '0') || 0);
+  const date = new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  date.setUTCHours(hour, minute, second, milliseconds);
+
+  if (date.getUTCFullYear() !== year
+      || date.getUTCMonth() !== month - 1
+      || date.getUTCDate() !== day
+      || date.getUTCHours() !== hour
+      || date.getUTCMinutes() !== minute
+      || date.getUTCSeconds() !== second
+      || date.getUTCMilliseconds() !== milliseconds) {
+    fail(`${field} must contain a valid UTC calendar date and time.`);
+  }
+  return date.getTime();
+}
+
+function validateExpert(expert, index, roles, models) {
+  if (!isPlainObject(expert)) fail(`experts[${index}] must be a plain object.`);
+  if (!REQUIRED_ROLES.includes(expert.role)) fail(`experts[${index}].role is invalid.`);
+  if (roles.has(expert.role)) fail(`expert role ${expert.role} is duplicated.`);
+  roles.add(expert.role);
+
+  if (expert.verdict !== 'APPROVED') fail(`expert ${expert.role} must be APPROVED.`);
+  if (expert.result_type !== 'delphi_expert_result') {
+    fail(`expert ${expert.role} must be a successful Delphi expert result.`);
+  }
+  if (expert.error !== undefined || expert.fallback !== undefined) {
+    fail(`expert ${expert.role} contains an error or fallback marker.`);
+  }
+
+  if (typeof expert.requested_model !== 'string' || expert.requested_model.trim() === '') {
+    fail(`expert ${expert.role} requested_model must be non-empty.`);
+  }
+  const model = expert.requested_model.trim();
+  if (models.has(model)) fail(`requested_model ${model} is duplicated.`);
+  models.add(model);
+
+  if (expert.resolved_model !== null
+      && (typeof expert.resolved_model !== 'string' || expert.resolved_model.trim() === '')) {
+    fail(`expert ${expert.role} resolved_model must be non-empty or null.`);
+  }
+}
+
+function validateEvidence(evidence, expectedCommit, expectedBranch, now) {
+  if (!isPlainObject(evidence)) fail('top level must be a plain object.');
+  if (evidence.commit !== expectedCommit) fail('commit does not match HEAD.');
+  if (evidence.branch !== expectedBranch) fail('branch does not match the current branch.');
+  if (evidence.verdict !== 'APPROVED') fail('top-level verdict must be APPROVED.');
+
+  const timestamp = parseTimestamp(evidence.timestamp, 'timestamp');
+  const expires = parseTimestamp(evidence.expires, 'expires');
+  if (timestamp > now) fail('timestamp is in the future.');
+  if (expires <= now) fail('evidence has expired.');
+  if (expires - timestamp !== VALIDITY_MS) {
+    fail('expires must be exactly one hour after timestamp.');
+  }
+
+  if (typeof evidence.consensus_ratio !== 'number'
+      || !Number.isFinite(evidence.consensus_ratio)
+      || evidence.consensus_ratio < 0.90
+      || evidence.consensus_ratio > 1) {
+    fail('consensus_ratio must be a finite number from 0.90 through 1.');
+  }
+
+  if (!Array.isArray(evidence.experts) || evidence.experts.length !== 3) {
+    fail('experts must contain exactly three records.');
+  }
+  const roles = new Set();
+  const models = new Set();
+  evidence.experts.forEach((expert, index) => {
+    validateExpert(expert, index, roles, models);
+  });
+  if (roles.size !== REQUIRED_ROLES.length) fail('all required expert roles must be present.');
+}
+
+function main() {
+  const [file, expectedCommit, expectedBranch, nowValue] = process.argv.slice(2);
+  if (!file || !expectedCommit || !expectedBranch) {
+    fail('usage: validate-code-walkthrough.cjs <file> <commit> <branch> [now].');
+  }
+
+  let evidence;
+  try {
+    evidence = JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    fail('file must exist and contain valid JSON.');
+  }
+  const now = nowValue === undefined ? Date.now() : parseTimestamp(nowValue, 'current time');
+  validateEvidence(evidence, expectedCommit, expectedBranch, now);
+}
+
+main();

package/hooks/pre-commit

@@ -14,7 +14,21 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ADAPTER_DIR=""
 GLOBAL_ADAPTER_DIR="$HOME/.config/xp-gate/adapters"
-PROJECT_GITHOOKS="$(git rev-parse --show-toplevel 2>/dev/null)/githooks"
+
+# BEGIN GIT CONTEXT FALLBACK
+if ! declare -F run_without_git_context >/dev/null 2>&1; then
+  run_without_git_context() (
+    unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_CONFIG GIT_CONFIG_PARAMETERS
+    unset GIT_CONFIG_COUNT GIT_OBJECT_DIRECTORY GIT_DIR GIT_WORK_TREE
+    unset GIT_IMPLICIT_WORK_TREE GIT_GRAFT_FILE GIT_INDEX_FILE
+    unset GIT_NO_REPLACE_OBJECTS GIT_REPLACE_REF_BASE GIT_PREFIX
+    unset GIT_SHALLOW_FILE GIT_COMMON_DIR
+    "$@"
+  )
+fi
+# END GIT CONTEXT FALLBACK
+
+PROJECT_GITHOOKS="$(run_without_git_context git rev-parse --show-toplevel 2>/dev/null)/githooks"
 GATES_DIR="$SCRIPT_DIR/gates"
 
 if [ -f "$GLOBAL_ADAPTER_DIR/adapter-common.sh" ]; then
@@ -89,7 +103,7 @@ _quality_report_on_exit() {
 }
 trap '_quality_report_on_exit' EXIT
 
-PROJECT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo "$(cd "$SCRIPT_DIR/../.." 2>/dev/null || echo "$SCRIPT_DIR/..")" )"
+PROJECT_ROOT="$(run_without_git_context git rev-parse --show-toplevel 2>/dev/null || echo "$(cd "$SCRIPT_DIR/../.." 2>/dev/null || echo "$SCRIPT_DIR/..")" )"
 if [[ -d "$PROJECT_ROOT/node_modules/.bin" ]]; then
   export PATH="$PROJECT_ROOT/node_modules/.bin:$PATH"
 fi
@@ -415,6 +429,17 @@ if [ -z "$CHANGED_FILES" ]; then
   exit 0
 fi
 
+any_changed_files_match() {
+  local pattern
+
+  for pattern in "$@"; do
+    if printf '%s\n' "$CHANGED_FILES" | grep -qE -- "$pattern"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
 # ============================================================================
 # Multi-language detection (v0.15.0+): detect all languages from changed file
 # extensions, with fallback to manifest-based detection.
@@ -1387,6 +1412,14 @@ else
   # --- BLOCK path: New .ts/.tsx files without corresponding tests ---
   NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v 'node_modules/' | grep -v '\.next/' | grep -v '\.nuxt/' | grep -v 'dist/' | grep -v 'build/' | grep -v '.turbo/' | grep -v '.cache/' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
 
+  # Strip PROJECT_SUBDIR prefix from new-TS-file paths when running in a subdirectory.
+  # git diff returns repo-root relative paths, but after cd "$PROJECT_SUBDIR"
+  # the test-pairing [ -f ] checks below need subdirectory-relative paths.
+  # (Mirrors the v0.14.31+ Gate 5b fix at lines 1603-1608; Gate 5a was missing it.)
+  if [ -n "$PROJECT_SUBDIR" ] && [ "$PROJECT_SUBDIR" != "." ] && [ -n "$NEW_TS_FILES" ]; then
+    NEW_TS_FILES=$(echo "$NEW_TS_FILES" | sed "s|^${PROJECT_SUBDIR}/||")
+  fi
+
   if [ -n "$NEW_TS_FILES" ]; then
     BLOCKED_TS_FILES=0
     for src_file in $NEW_TS_FILES; do
@@ -1749,8 +1782,8 @@ else
     if [ "${CURRENT_LANG}" != "unknown" ] && [ -n "$ADAPTER_FILE" ]; then
     if source "$ADAPTER_FILE" 2>/dev/null; then
       # TypeScript: vitest with smart test selection
-      if [ "$CURRENT_LANG" = "typescript" ] && [ -f "package.json" ]; then
-        if npx vitest --version >/dev/null 2>&1; then
+      if [ "$CURRENT_LANG" = "typescript" ] && { [ -f "package.json" ] || [ -f "$PROJECT_ROOT/package.json" ]; }; then
+        if run_without_git_context npx vitest --version >/dev/null 2>&1; then
           # Count changed test files to decide strategy
           CHANGED_TEST_FILE_COUNT=$(echo "$CHANGED_TEST_FILES" | grep -c '.' || echo "0")
           
@@ -1766,7 +1799,7 @@ else
           if [ "$CHANGED_TEST_FILE_COUNT" -gt 20 ] 2>/dev/null; then
             # Too many test files changed → full run
             echo "Too many test files changed ($CHANGED_TEST_FILE_COUNT), running full test suite..."
-            TESTS_OUTPUT=$(npx vitest run --coverage 2>&1)
+            TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage 2>&1)
             TESTS_EXIT_CODE=$?
             echo "$TESTS_OUTPUT" | head -60
             if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1781,7 +1814,7 @@ else
             SMART_TARGETS=$(echo "$CHANGED_TEST_FILES" | tr '\n' ' ')
             echo "Running ${CHANGED_TEST_FILE_COUNT} changed test file(s) with coverage..."
             echo "   Target(s): $(echo "$CHANGED_TEST_FILES" | tr '\n' ' ')"
-            TESTS_OUTPUT=$(npx vitest run --coverage $SMART_TARGETS 2>&1)
+            TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage $SMART_TARGETS 2>&1)
             TESTS_EXIT_CODE=$?
             echo "$TESTS_OUTPUT" | head -60
             if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1825,7 +1858,7 @@ else
             if [ -n "$RELATED_TESTS" ]; then
               echo "   Found related test(s): $(echo "$RELATED_TESTS" | tr '\n' ' ')"
               PARTIAL_TEST_RUN=true  # Mark as partial run for coverage check
-              TESTS_OUTPUT=$(npx vitest run --coverage $RELATED_TESTS 2>&1)
+              TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage $RELATED_TESTS 2>&1)
               TESTS_EXIT_CODE=$?
               echo "$TESTS_OUTPUT" | head -60
               if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1838,7 +1871,7 @@ else
             else
               # No related tests found → full run is safest
               echo "   No related test files found, running full test suite..."
-              TESTS_OUTPUT=$(npx vitest run --coverage 2>&1)
+              TESTS_OUTPUT=$(run_without_git_context npx vitest run --coverage 2>&1)
               TESTS_EXIT_CODE=$?
               echo "$TESTS_OUTPUT" | head -60
               if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1857,7 +1890,7 @@ else
           fi
         else
           # Fallback: run_tests without coverage
-          TESTS_OUTPUT=$(run_tests 2>&1)
+          TESTS_OUTPUT=$(run_without_git_context run_tests 2>&1)
           TESTS_EXIT_CODE=$?
           echo "$TESTS_OUTPUT" | head -50
           if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
@@ -1868,15 +1901,21 @@ else
         fi
       else
         # Non-TypeScript: standard adapter test flow
-        TESTS_OUTPUT=$(run_tests 2>&1)
-        TESTS_EXIT_CODE=$?
-        echo "$TESTS_OUTPUT" | head -50
-        if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
-          echo ""
-          echo "❌ BLOCKED - Tests FAILED"
-          exit 1
-      else
-        echo "✅ PASSED - Unit tests passed."
+        # Skip for Python — tests already run with coverage in the coverage section below.
+        # Running them here first without coverage doubles pre-commit time for no benefit.
+        if [ "$CURRENT_LANG" = "python" ]; then
+          echo "ℹ️  Python tests deferred to coverage section (single pass)."
+        else
+          TESTS_OUTPUT=$(run_without_git_context run_tests 2>&1)
+          TESTS_EXIT_CODE=$?
+          echo "$TESTS_OUTPUT" | head -50
+          if [ "$TESTS_EXIT_CODE" -ne 0 ]; then
+            echo ""
+            echo "❌ BLOCKED - Tests FAILED"
+            exit 1
+          else
+            echo "✅ PASSED - Unit tests passed."
+          fi
         fi
       fi
     else
@@ -2056,6 +2095,45 @@ else
         echo "⚠️  coverage/lcov.info not found. Ensure dart test --coverage was run."
       fi
       ;;
+    "powershell")
+      COVERAGE_ENFORCED=true
+      if [ -f "coverage.xml" ]; then
+        COVERAGE_RESULT=$(node -e "
+          try {
+            const fs = require('fs');
+            const xml = fs.readFileSync('coverage.xml', 'utf8');
+            const counters = [...xml.matchAll(/<counter\b([^>]*)\/?\s*>/gi)]
+              .map((match) => Object.fromEntries(
+                [...match[1].matchAll(/([\w:-]+)\s*=\s*(['\"])(.*?)\2/g)]
+                  .map((attribute) => [attribute[1].toUpperCase(), attribute[3]])
+              ))
+              .filter((counter) => counter.TYPE === 'LINE');
+            const reportCounter = counters.at(-1);
+            const missed = Number(reportCounter?.MISSED);
+            const covered = Number(reportCounter?.COVERED);
+            const total = missed + covered;
+            if (!Number.isFinite(missed) || !Number.isFinite(covered) || missed < 0 || covered < 0 || total <= 0) {
+              throw new Error('invalid LINE counter');
+            }
+            const percentage = (covered / total) * 100;
+            console.log((percentage < 80 ? 'below' : 'pass') + '|' + Math.round(percentage));
+          } catch (error) { console.log('parse_error'); }
+        " 2>/dev/null) || COVERAGE_RESULT="parse_error"
+        if [ "$COVERAGE_RESULT" != "parse_error" ] && [ -n "$COVERAGE_RESULT" ]; then
+          COVERAGE_STATUS=${COVERAGE_RESULT%%|*}
+          COVERAGE_PERCENT=${COVERAGE_RESULT#*|}
+          if [ "$COVERAGE_STATUS" = "below" ]; then
+            echo "❌ BLOCKED - PowerShell coverage ${COVERAGE_PERCENT}% below 80% threshold"
+            exit 1
+          fi
+          echo "PowerShell coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
+        else
+          echo "⚠️  Could not parse PowerShell coverage from coverage.xml"
+        fi
+      else
+        echo "⚠️  coverage.xml not found. Ensure Pester coverage was run."
+      fi
+      ;;
     *)
       # Default: attempt to parse coverage from common formats regardless of language
       COVERAGE_ENFORCED=true
@@ -2165,6 +2243,15 @@ elif has_project_lang "powershell" 2>/dev/null || [ "$PROJECT_LANG" = "powershel
      echo "     ⏭️  SKIPPED - Architecture validation (no tool for PowerShell)"
 
 else
+  run_archlint() (
+    cd "$PROJECT_ROOT" || exit 1
+    if [ "$ARCHLINT_KIND" = "npx" ]; then
+      npx @archlinter/cli "$@"
+    else
+      "$ARCHLINT_BIN" "$@"
+    fi
+  )
+
   # Check if architecture config exists (use $PROJECT_ROOT — hook may have cd'd to a subdir via ARCH-03)
   if [ -f "$PROJECT_ROOT/architecture.yaml" ] || [ -f "$PROJECT_ROOT/.architecturerc" ] || [ -f "$PROJECT_ROOT/.archlint.yaml" ]; then
     # Different architecture tools per language
@@ -2172,12 +2259,14 @@ else
     case "$CURRENT_LANG" in
       "typescript")
         # Try local npx install first (devDependencies), fall back to global
-        if npx --no-install @archlinter/cli --version >/dev/null 2>&1; then
-          ARCHLINT_CMD="npx --no-install @archlinter/cli"
+        if [ -x "$PROJECT_ROOT/node_modules/.bin/archlint" ]; then
+          ARCHLINT_KIND="binary"
+          ARCHLINT_BIN="$PROJECT_ROOT/node_modules/.bin/archlint"
         elif command -v archlint >/dev/null 2>&1; then
-          ARCHLINT_CMD="archlint"
-        elif npx @archlinter/cli --version >/dev/null 2>&1; then
-          ARCHLINT_CMD="npx @archlinter/cli"
+          ARCHLINT_KIND="binary"
+          ARCHLINT_BIN="$(command -v archlint)"
+        elif (cd "$PROJECT_ROOT" && npx @archlinter/cli --version) >/dev/null 2>&1; then
+          ARCHLINT_KIND="npx"
         else
           echo "     ❌ BLOCKED - archlint not installed"
           echo "     Install with: npm install --save-dev @archlinter/cli"
@@ -2186,17 +2275,17 @@ else
          echo "     Running archlint for TypeScript..."
           # Use diff mode with baseline for ratchet (block only new violations)
           # Fall back to raw scan if no baseline exists (new project, zero-tolerance)
-          if [ -f ".architecture-baseline.json" ]; then
-            ARCHLINT_OUTPUT=$($ARCHLINT_CMD diff .architecture-baseline.json --fail-on high 2>&1)
+          if [ -f "$PROJECT_ROOT/.architecture-baseline.json" ]; then
+            ARCHLINT_OUTPUT=$(run_archlint diff .architecture-baseline.json --fail-on high 2>&1)
           else
-            ARCHLINT_OUTPUT=$($ARCHLINT_CMD scan . -f table --quiet 2>&1)
+            ARCHLINT_OUTPUT=$(run_archlint scan . -f table --quiet 2>&1)
           fi
          ARCHLINT_EXIT=$?
          echo "$ARCHLINT_OUTPUT" | tail -30
          if [ "$ARCHLINT_EXIT" -ne 0 ]; then
            echo ""
            echo "❌ BLOCKED - Architecture violations detected"
-           if [ -f ".architecture-baseline.json" ]; then
+             if [ -f "$PROJECT_ROOT/.architecture-baseline.json" ]; then
              echo "New architecture violations found (baseline ratchet mode)."
              echo "Fix the new violations above, or update the baseline with: npx @archlinter/cli snapshot -o .architecture-baseline.json"
            else
@@ -2205,7 +2294,7 @@ else
            fi
            exit 1
          fi
-         if [ -f ".architecture-baseline.json" ]; then
+           if [ -f "$PROJECT_ROOT/.architecture-baseline.json" ]; then
            echo "     ✅ TypeScript architecture validation completed (baseline ratchet mode)."
          else
            echo "     ✅ TypeScript architecture validation completed (zero-tolerance mode). no baseline found."
@@ -2276,7 +2365,7 @@ else
       echo "   Required configuration file (.archlint.yaml / architecture.yaml) is NOT found."
       echo "   Architecture Quality Gate requires explicit architecture constraints."
       echo ""
-      echo "   Create .archlint.yaml with: npx archlint init --no-interactive"
+  echo "   Quick fix: create .archlint.yaml with: npx archlint init --no-interactive"
       echo "   Or architecture.yaml for custom Clean Architecture layer definitions:"
       echo "     layers:"
       echo "       - name: api"
@@ -2451,13 +2540,20 @@ echo ""
 
 # ============================================================================
 # GATE 10: Semgrep SAST Security Scan
-# Extracted to gate-10.sh for maintainability (sourced as gate-9.sh)
+# Extracted to gate-10.sh for maintainability
 # v0.14.3+ (Issue #312): Skip if no code files changed
+# v0.18.5 (Issue #397): Fix gate status variable collision — SAST now sets GATE_10_STATUS
 # ============================================================================
 if any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|dart|sh)$"; then
-source "$GATE_DIR/gate-9.sh"
+  if [ -f "$GATE_DIR/gate-10.sh" ]; then
+    source "$GATE_DIR/gate-10.sh"
+  else
+    echo "⏭️  SKIPPED - SAST (gate-10.sh not found)"
+    GATE_10_STATUS="SKIP"
+  fi
 else
   echo "✅ PASSED - No code files changed, skipping SAST scan."
+  GATE_10_STATUS="PASS"
 fi
 # ============================================================================
 
@@ -2561,7 +2657,7 @@ generate_quality_report() {
   # ── Branch-level quality status file ─────────────────────────────────────────────
   local STATUS_DIR=".xp-gate/quality-status"
   local REPORT_FILE="${STATUS_DIR}/${BRANCH}.json"
-  mkdir -p "$STATUS_DIR"
+  mkdir -p "$(dirname "$REPORT_FILE")"
 
   cat > "$REPORT_FILE" << ENDJSON
 {
@@ -2714,5 +2810,6 @@ if [ -n "$_wp_marker" ] && [ "$_wp_marker" != "/xp-gate-precommit-marker" ]; the
 fi
 
 generate_quality_report
+_QUALITY_REPORT_DONE=1
 
-exit 0
+exit 0

package/hooks/pre-push

@@ -867,116 +867,47 @@ if [ ! -f "$RESULT_FILE" ]; then
   exit 1
 fi
 
-# Check jq availability (MANDATORY - zero degradation)
-if ! command -v jq &> /dev/null; then
+# Check Node.js availability (MANDATORY - zero degradation)
+if ! command -v node >/dev/null 2>&1; then
   echo ""
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo "   ❌ ENVIRONMENT ERROR - PUSH BLOCKED"
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo ""
-  echo "jq is NOT installed. Required for JSON validation."
+  echo "Node.js is NOT installed. Required for JSON validation."
   echo ""
-  echo "Install jq:"
-  echo "  apt-get install jq (Debian/Ubuntu)"
-  echo "  brew install jq (macOS)"
-  echo "  choco install jq (Windows)"
-  echo ""
-  echo "Zero degradation principle: Cannot proceed without jq."
+  echo "Install Node.js 18 or newer, then retry the push."
   echo ""
   exit 1
 fi
 
-# Validate result file content
-# SHA self-reference paradox fix: if the result file was committed as part of
-# HEAD, its content references HEAD^ (the commit being reviewed), not HEAD.
-CURRENT_COMMIT=$(git rev-parse HEAD)
-if git diff-tree --no-commit-id --name-only -r HEAD 2>/dev/null | grep -qx "$RESULT_FILE"; then
-  # Result file is part of the latest commit — compare against the reviewed commit
-  EXPECTED_COMMIT=$(git rev-parse HEAD^ 2>/dev/null || echo "unknown")
-else
-  # Result file is working-tree only — compare against current HEAD
-  EXPECTED_COMMIT="$CURRENT_COMMIT"
-fi
+# Walkthrough evidence must bind to the exact feature-branch HEAD being pushed.
+EXPECTED_COMMIT=$(git rev-parse HEAD)
 
-# Check JSON validity
-if ! jq empty "$RESULT_FILE" 2>/dev/null; then
+# Validate the complete evidence contract without interpolating JSON into shell.
+HOOK_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+MW_VALIDATOR="$HOOK_DIR/lib/validate-code-walkthrough.cjs"
+if [ ! -f "$MW_VALIDATOR" ]; then
   echo ""
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo "   ❌ RESULT FILE INVALID - PUSH BLOCKED"
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo ""
-  echo "$RESULT_FILE is not valid JSON."
+  echo "Gate MW validator is missing: $MW_VALIDATOR"
   echo ""
   echo "Re-run: /delphi-review --mode code-walkthrough"
   echo ""
   exit 1
 fi
 
-RESULT_COMMIT=$(jq -r '.commit' "$RESULT_FILE")
-RESULT_VERDICT=$(jq -r '.verdict' "$RESULT_FILE")
-RESULT_EXPIRES=$(jq -r '.expires' "$RESULT_FILE")
-RESULT_BRANCH=$(jq -r '.branch' "$RESULT_FILE")
 CURRENT_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-
-# Branch match check (optional but recommended)
-if [ "$RESULT_BRANCH" != "$CURRENT_BRANCH" ]; then
-  echo ""
-  echo "⚠️ WARNING: Result file is for different branch"
-  echo "  Expected: $CURRENT_BRANCH"
-  echo "  Found: $RESULT_BRANCH"
-  echo ""
-  echo "Proceeding with commit verification..."
-fi
-
-# Commit match check
-if [ "$RESULT_COMMIT" != "$EXPECTED_COMMIT" ]; then
+if ! VALIDATION_ERROR=$(node "$MW_VALIDATOR" "$RESULT_FILE" "$EXPECTED_COMMIT" "$CURRENT_BRANCH" "$CURRENT_TIME" 2>&1); then
   echo ""
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo "   ❌ RESULT FILE OUTDATED - PUSH BLOCKED"
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo ""
-  echo "Result file is for a different commit:"
-    echo "  Expected: $EXPECTED_COMMIT"
-    echo "  Found: $RESULT_COMMIT"
-  echo ""
-  echo "Re-run: /delphi-review --mode code-walkthrough"
-  echo ""
-  exit 1
-fi
-
-# Verdict check
-if [ "$RESULT_VERDICT" != "APPROVED" ]; then
-  echo ""
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "   ❌ GATE MW: CODE WALKTHROUGH NOT APPROVED - PUSH BLOCKED"
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo ""
-  echo "Verdict: $RESULT_VERDICT"
-  echo ""
-  
-  # Show issues if available
-  ISSUES=$(jq -r '.issues[] | "- [\(.severity)] \(.description)"' "$RESULT_FILE" 2>/dev/null)
-  if [ -n "$ISSUES" ]; then
-    echo "Issues found:"
-    echo "$ISSUES"
-    echo ""
-  fi
-  
-  echo "Fix issues and re-run: /delphi-review --mode code-walkthrough"
-  echo ""
-  exit 1
-fi
-
-# Expiration check
-if [[ "$CURRENT_TIME" > "$RESULT_EXPIRES" ]]; then
-  echo ""
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo "   ❌ RESULT FILE EXPIRED - PUSH BLOCKED"
-  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  echo ""
-  echo "Code walkthrough result has expired:"
-  echo "  Expired: $RESULT_EXPIRES"
-  echo "  Current: $CURRENT_TIME"
+  echo "$VALIDATION_ERROR"
   echo ""
   echo "Re-run: /delphi-review --mode code-walkthrough"
   echo ""
@@ -996,16 +927,9 @@ echo "Files changed: $FILES_CHANGED"
 echo "Lines: +$LINES_ADDED -$LINES_DELETED"
 echo ""
 echo "Code walkthrough result:"
-echo "  Commit: $RESULT_COMMIT"
+echo "  Commit: $EXPECTED_COMMIT"
 echo "  Verdict: APPROVED"
-echo "  Expires: $RESULT_EXPIRES"
-
-# Show confidence if available
-CONFIDENCE=$(jq -r '.confidence' "$RESULT_FILE" 2>/dev/null)
-if [ -n "$CONFIDENCE" ] && [ "$CONFIDENCE" != "null" ]; then
-  echo "  Confidence: $CONFIDENCE/10"
-fi
 
 echo ""
 echo "Proceeding with push..."
-exit 0
+exit 0