@boyingliu01/xp-gate 0.20.1 → 0.21.0

package/gate-10.sh

@@ -57,82 +57,125 @@ else
 $SEMGREP_FILES
 EOF
 
-    # Run semgrep with JSON output
-    # --config=p/security-audit: explicit security ruleset
-    # --json: machine-readable output
-    # --disable-version-check: skip network call
-    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1)
-    SEMGREP_EXIT=$?
+    # The verdict is parsed from the JSON with node (see below), so node is a
+    # hard dependency of this gate — check it BEFORE spending a semgrep run
+    # (#518 R2): without it we would silently SKIP every finding as
+    # "unparseable" and lose the whole security net on minimal CI images.
+    if ! command -v node >/dev/null 2>&1; then
+      echo "     ⚠️  WARN - node is not installed — Gate 10 needs it to parse semgrep's JSON verdict"
+      echo "     Install node (https://nodejs.org); without it SAST findings cannot be classified"
+      echo "     ⏭️  SKIPPED - SAST (node not installed)"
+      GATE_10_STATUS="SKIP"
+    else
 
-    if [ "$SEMGREP_EXIT" -eq 0 ]; then
-      echo "     ✅ PASSED - No security vulnerabilities found (files scanned: ${#SEMGREP_ARGS[@]})."
-      GATE_10_STATUS="PASS"
-    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
-      # Findings detected - parse JSON to categorize
-      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # Run semgrep with JSON output. stdout and stderr are captured SEPARATELY:
+    # --json writes findings to stdout, progress/summary lines to stderr, and the
+    # old `2>&1` merge poisoned the very JSON the verdict now depends on (#518).
+    # SEMGREP_OUTPUT keeps its name and role — what the tool said, printed on the
+    # SKIP path (AC-475-04).
+    #
+    # #518: the exit code does NOT carry the verdict. semgrep exits 0 even with
+    # ERROR-severity findings, and its exit-code semantics have drifted across
+    # versions and platforms (upstream currently reports findings WITH --error
+    # as exit 1 and failures as 2, but that mapping is not something a gate
+    # should bet on). The JSON carries what the exit code never could —
+    # per-severity counts — so the verdict is read from the JSON and the exit
+    # code is demoted to "did the tool itself run". --error stays OFF: it would
+    # add nothing the JSON does not already provide, and keeping it off leaves
+    # failure exit codes unambiguous for the #475 diagnostics path.
+    SEMGREP_STDOUT_FILE=$(mktemp)
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
+    SEMGREP_EXIT=$?
 
-      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # One node pass over the JSON: first line = verdict counts, remaining lines =
+    # finding details. The severity vocabulary is the UNION of the two scales
+    # (#518): semgrep's own ERROR is its most severe tier (it maps to the old
+    # CRITICAL/HIGH → BLOCK intent), its WARNING/INFO align with the old
+    # MEDIUM/LOW → warnings-only tier. Anything OUTSIDE both lists (missing,
+    # empty, or a future/new tier) counts as BLOCKING — a security gate must
+    # fail closed on severities it does not recognize (#518 R2). Parsing
+    # failure degrades to PARSE=FAIL — a fail-closed SKIP below, never a PASS.
+    SEMGREP_VERDICT=$(node -e '
+let d="";process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>{
+let data;try{data=JSON.parse(d);}catch(e){console.log("PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0");return;}
+const results=data.results||[];const errors=data.errors||[];
+const sev=r=>((r.extra&&r.extra.severity)||"").toUpperCase();
+const WARNV=["WARNING","INFO","MEDIUM","LOW"];
+let b=0,w=0;results.forEach(r=>{if(WARNV.indexOf(sev(r))>=0)w++;else b++;});
+console.log("PARSE=OK RESULTS="+results.length+" ERRORS="+errors.length+" BLOCKING="+b+" WARNINGS="+w);
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};const s=sev(r)||"UNKNOWN";
+console.log("  ["+s+"] "+(r.check_id||"unknown"));
+console.log("  "+(r.path||"unknown")+":"+((r.start&&r.start.line)||"?")+" → "+(extra.message||"").slice(0,80));
+console.log("");});
+});' < "$SEMGREP_STDOUT_FILE") || SEMGREP_VERDICT="PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0"
 
-      # Extract top finding details
-      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-results.slice(0,5).forEach(r=>{const extra=r.extra||{};
-const severity=(extra.severity||'UNKNOWN').toUpperCase();
-const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
-const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
-console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
-}catch(e){console.log('  (Failed to parse semgrep output)');}
-});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+    PARSE_LINE=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '1p')
+    FINDING_DETAILS=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '2,$p')
+    V_PARSE=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/^PARSE=\([A-Z]*\) .*/\1/p')
+    V_RESULTS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* RESULTS=\([0-9]*\) .*/\1/p')
+    V_ERRORS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* ERRORS=\([0-9]*\) .*/\1/p')
+    V_BLOCKING=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* BLOCKING=\([0-9]*\) .*/\1/p')
+    V_WARNINGS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* WARNINGS=\([0-9]*\)$/\1/p')
+    # Keep the raw stdout tail for the unparseable branch's diagnostics BEFORE
+    # the temp file goes away (#518 R2: stderr alone often says nothing there).
+    SEMGREP_STDOUT_TAIL=$(tail -5 "$SEMGREP_STDOUT_FILE" 2>/dev/null)
+    rm -f "$SEMGREP_STDOUT_FILE"
 
-      if [ "$CRITICAL_HIGH" -gt 0 ]; then
-        echo ""
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 10: Semgrep Security Gate"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
-        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  ❌ BLOCKED — Critical/High vulnerability found"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "$FINDING_DETAILS"
-        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_10_STATUS="FAIL"
-        exit 1
-      else
-        echo ""
-        echo "     ✅ PASSED - No critical/high vulnerabilities"
-        if [ "$MEDIUM_LOW" -gt 0 ]; then
-          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
-          echo "$FINDING_DETAILS"
-        fi
-        GATE_10_STATUS="PASS"
+    # Fail closed: an unparseable payload OR an OK parse with any missing count
+    # field (verdict-line format drift) must SKIP, never silently degrade to
+    # PASS (#518).
+    if [ "$V_PARSE" != "OK" ] || [ -z "$V_RESULTS" ] || [ -z "$V_ERRORS" ] || [ -z "$V_BLOCKING" ] || [ -z "$V_WARNINGS" ]; then
+      # Unparseable output: nothing the exit code claims can be trusted (#518).
+      # Fail closed — SKIP with diagnostics, never a PASS.
+      echo "     ⚠️  semgrep output unparseable or verdict fields missing (exit code ${SEMGREP_EXIT}) — cannot determine verdict"
+      if [ -n "$SEMGREP_OUTPUT" ]; then
+        echo "     ── what semgrep reported on stderr ──"
+        printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
       fi
-    else
-      # semgrep runtime error (timeout, config error, etc.)
-      #
-      # SEMGREP_OUTPUT is captured above and was never shown here, so an intermittent
-      # ruleset-fetch failure looked identical to a broken install: the gate printed
-      # "runtime error" and kept the reason to itself (#475). The verdict stays SKIP --
-      # an operational failure must not block the commit, and must not be called a pass.
-      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      if [ -n "$SEMGREP_STDOUT_TAIL" ]; then
+        echo "     ── what semgrep wrote to stdout (tail) ──"
+        printf '%s\n' "$SEMGREP_STDOUT_TAIL" | sed 's/^/     /'
+      fi
+      echo "     ⏭️  SKIPPED - SAST (semgrep output unparseable)"
+      GATE_10_STATUS="SKIP"
+    elif [ "$V_RESULTS" -eq 0 ] && { [ "$V_ERRORS" -gt 0 ] || [ "$SEMGREP_EXIT" -ne 0 ]; }; then
+      # Nothing was scanned to a verdict: semgrep either failed outright
+      # (nonzero exit) or completed but reported scan errors for every input
+      # (#518 R2: exit 0 + results:[] + errors:[{...}] used to fall through to
+      # PASS). An operational failure must neither block nor claim a pass
+      # (#475 kept).
+      echo "     ⚠️  semgrep exit=${SEMGREP_EXIT}, scan errors=${V_ERRORS}, findings=${V_RESULTS} — nothing to judge"
       if [ -n "$SEMGREP_OUTPUT" ]; then
         echo "     ── what semgrep reported ──"
         printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
       fi
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
       GATE_10_STATUS="SKIP"
+    elif [ "$V_BLOCKING" -gt 0 ]; then
+      echo ""
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "   GATE 10: Semgrep Security Gate"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  CRITICAL/HIGH/ERROR:     ${V_BLOCKING}  ❌ BLOCKED"
+      echo "  MEDIUM/LOW/WARNING/INFO: ${V_WARNINGS}  ⚠️  warning"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  ❌ BLOCKED — blocking-severity vulnerability found"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "$FINDING_DETAILS"
+      echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+      GATE_10_STATUS="FAIL"
+      exit 1
+    else
+      echo ""
+      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: ${#SEMGREP_ARGS[@]})"
+      if [ "$V_WARNINGS" -gt 0 ]; then
+        echo "     ⚠️  ${V_WARNINGS} non-blocking findings (warnings only)"
+        echo "$FINDING_DETAILS"
+      fi
+      GATE_10_STATUS="PASS"
     fi
+
+    fi # node available
   fi
 fi
 record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"

package/gate-3.sh

@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 # ============================================================================
 # GATE 3: Cyclomatic Complexity Check
 # Uses lizard - checks cyclomatic complexity of changed source files
@@ -17,7 +18,45 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
   GATE_3_STATUS="SKIP"
   
 else
-  CCN_THRESHOLD=5
+  # S2 (#507): three-level CCN threshold override --
+  # .xp-gate/ccn-threshold (positive integer) > XP_GATE_CCN_THRESHOLD > 5.
+  # Invalid values WARN on stderr and fall back to the default; the resolved
+  # value reaches the gate-3 audit record via the --detail argument below.
+  # Implemented with bash builtins only (no tr/grep spawns): every process
+  # spawn is expensive on Windows under AV filter drivers.
+  resolve_ccn_threshold() {
+    local default=5 val
+    if [ -f ".xp-gate/ccn-threshold" ]; then
+      val=$(<".xp-gate/ccn-threshold")
+      val="${val//[[:space:]]/}"
+      case "$val" in
+        ''|*[!0-9]*|0)
+          echo "WARN - invalid .xp-gate/ccn-threshold value '${val}' (expected a positive integer), falling back to ${default}" >&2
+          ;;
+        *)
+          echo "$val"
+          return 0
+          ;;
+      esac
+      echo "$default"
+      return 0
+    fi
+    val=${XP_GATE_CCN_THRESHOLD:-}
+    if [ -n "$val" ]; then
+      case "$val" in
+        ''|*[!0-9]*|0)
+          echo "WARN - invalid XP_GATE_CCN_THRESHOLD value '${val}' (expected a positive integer), falling back to ${default}" >&2
+          ;;
+        *)
+          echo "$val"
+          return 0
+          ;;
+      esac
+    fi
+    echo "$default"
+  }
+
+  CCN_THRESHOLD=$(resolve_ccn_threshold)
   
   # Check lizard availability
   LIZARD_CMD=""
@@ -37,7 +76,16 @@ else
       echo "Checking complexity for source files..."
       
       # Run lizard with CCN threshold
-      CC_OUTPUT=$($LIZARD_PATH -C $CCN_THRESHOLD $CC_FILES 2>&1 || true)
+      # One path per line, into an array. Unquoted $CC_FILES relied on word
+      # splitting, which also splits any path containing a space -- handing
+      # lizard two bogus paths and checking neither (#457 defect class, same
+      # fix as gate-4's PRINCIPLES_ARGS). Quoting the scalar would instead
+      # collapse the list into one argument. An array does both.
+      CC_FILES_ARGS=()
+      while IFS= read -r _cc_file; do
+        [ -n "$_cc_file" ] && CC_FILES_ARGS+=("$_cc_file")
+      done <<< "$CC_FILES"
+      CC_OUTPUT=$("$LIZARD_PATH" -C "$CCN_THRESHOLD" ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>&1 || true)
       
       # Parse warning count from the summary table: "Warning cnt   8"
       # Use anchored grep to avoid matching lizard table headers (e.g. "Rt" column)
@@ -65,4 +113,4 @@ else
     GATE_3_STATUS="WARN"
   fi
 fi
-record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "${CC_WARNINGS:-0}" "$GATE_3_START"
+record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "${CC_WARNINGS:-0}" "$GATE_3_START" "ccn_threshold=${CCN_THRESHOLD:-5}"

package/gate-4.sh

@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 # ============================================================================
 # GATE 4: Principles Checker (Clean Code + SOLID)
 # Reuses existing principles checker logic
@@ -23,6 +24,31 @@ if ! declare -F run_tsx >/dev/null 2>&1; then
   }
 fi
 
+# Java rule coverage annotation (#507 S4, AC-507-04-02). The normative matrix
+# lives in docs/java-principles-coverage.md; these constants mirror it. Before
+# #507 the Java adapter fed rules only {name,type,line,code}, so the 12 rules
+# reading structured metrics silently saw `undefined` and a Java commit got a
+# green "checked" with zero effective coverage. 12/15 now fire; the three
+# inert ones are rule-side gaps documented in the coverage doc -- they must
+# NOT be announced as covered.
+JAVA_COVERAGE_EFFECTIVE=12
+JAVA_COVERAGE_TOTAL=15
+JAVA_COVERAGE_INERT="lsp, many-exports, code-duplication"
+
+# Print the coverage annotation when (and only when) the staged file list
+# contains Java sources. Non-Java commits keep the original output byte for
+# byte. Pure shell builtins: no subprocess per file.
+java_coverage_note() {
+  local _f _has_java=""
+  for _f in "$@"; do
+    case "$_f" in
+      *.java|*.Java|*.JAVA) _has_java=1; break ;;
+    esac
+  done
+  [ -n "$_has_java" ] || return 0
+  echo "ℹ️  Java rule coverage: $JAVA_COVERAGE_EFFECTIVE/$JAVA_COVERAGE_TOTAL rules effective (inert on Java: $JAVA_COVERAGE_INERT -- see docs/java-principles-coverage.md)"
+}
+
  2>&1 echo ""
  2>&1 echo "→ Gate 4: Principles checker (Clean Code + SOLID)..."
 GATE_4_START=$(gate_start_ms)
@@ -72,7 +98,12 @@ else
     
     if [ -n "$PRINCIPLES_DIR" ]; then
       echo "Checking Clean Code + SOLID principles..."
-      
+
+      # AC-507-04-02: say what a Java commit is actually covered for, instead
+      # of implying a full 15-rule check (#507). Printed before the run so it
+      # appears on both the PASS and the FAIL path.
+      java_coverage_note ${PRINCIPLES_ARGS[@]+"${PRINCIPLES_ARGS[@]}"}
+
       if command -v npx > /dev/null 2>&1 || [ -f "$PRINCIPLES_BASE/node_modules/tsx/dist/cli.mjs" ]; then
         # Run principles checker and store results.
         #

package/hooks/gate-10.sh

@@ -57,82 +57,125 @@ else
 $SEMGREP_FILES
 EOF
 
-    # Run semgrep with JSON output
-    # --config=p/security-audit: explicit security ruleset
-    # --json: machine-readable output
-    # --disable-version-check: skip network call
-    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1)
-    SEMGREP_EXIT=$?
+    # The verdict is parsed from the JSON with node (see below), so node is a
+    # hard dependency of this gate — check it BEFORE spending a semgrep run
+    # (#518 R2): without it we would silently SKIP every finding as
+    # "unparseable" and lose the whole security net on minimal CI images.
+    if ! command -v node >/dev/null 2>&1; then
+      echo "     ⚠️  WARN - node is not installed — Gate 10 needs it to parse semgrep's JSON verdict"
+      echo "     Install node (https://nodejs.org); without it SAST findings cannot be classified"
+      echo "     ⏭️  SKIPPED - SAST (node not installed)"
+      GATE_10_STATUS="SKIP"
+    else
 
-    if [ "$SEMGREP_EXIT" -eq 0 ]; then
-      echo "     ✅ PASSED - No security vulnerabilities found (files scanned: ${#SEMGREP_ARGS[@]})."
-      GATE_10_STATUS="PASS"
-    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
-      # Findings detected - parse JSON to categorize
-      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # Run semgrep with JSON output. stdout and stderr are captured SEPARATELY:
+    # --json writes findings to stdout, progress/summary lines to stderr, and the
+    # old `2>&1` merge poisoned the very JSON the verdict now depends on (#518).
+    # SEMGREP_OUTPUT keeps its name and role — what the tool said, printed on the
+    # SKIP path (AC-475-04).
+    #
+    # #518: the exit code does NOT carry the verdict. semgrep exits 0 even with
+    # ERROR-severity findings, and its exit-code semantics have drifted across
+    # versions and platforms (upstream currently reports findings WITH --error
+    # as exit 1 and failures as 2, but that mapping is not something a gate
+    # should bet on). The JSON carries what the exit code never could —
+    # per-severity counts — so the verdict is read from the JSON and the exit
+    # code is demoted to "did the tool itself run". --error stays OFF: it would
+    # add nothing the JSON does not already provide, and keeping it off leaves
+    # failure exit codes unambiguous for the #475 diagnostics path.
+    SEMGREP_STDOUT_FILE=$(mktemp)
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
+    SEMGREP_EXIT=$?
 
-      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # One node pass over the JSON: first line = verdict counts, remaining lines =
+    # finding details. The severity vocabulary is the UNION of the two scales
+    # (#518): semgrep's own ERROR is its most severe tier (it maps to the old
+    # CRITICAL/HIGH → BLOCK intent), its WARNING/INFO align with the old
+    # MEDIUM/LOW → warnings-only tier. Anything OUTSIDE both lists (missing,
+    # empty, or a future/new tier) counts as BLOCKING — a security gate must
+    # fail closed on severities it does not recognize (#518 R2). Parsing
+    # failure degrades to PARSE=FAIL — a fail-closed SKIP below, never a PASS.
+    SEMGREP_VERDICT=$(node -e '
+let d="";process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>{
+let data;try{data=JSON.parse(d);}catch(e){console.log("PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0");return;}
+const results=data.results||[];const errors=data.errors||[];
+const sev=r=>((r.extra&&r.extra.severity)||"").toUpperCase();
+const WARNV=["WARNING","INFO","MEDIUM","LOW"];
+let b=0,w=0;results.forEach(r=>{if(WARNV.indexOf(sev(r))>=0)w++;else b++;});
+console.log("PARSE=OK RESULTS="+results.length+" ERRORS="+errors.length+" BLOCKING="+b+" WARNINGS="+w);
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};const s=sev(r)||"UNKNOWN";
+console.log("  ["+s+"] "+(r.check_id||"unknown"));
+console.log("  "+(r.path||"unknown")+":"+((r.start&&r.start.line)||"?")+" → "+(extra.message||"").slice(0,80));
+console.log("");});
+});' < "$SEMGREP_STDOUT_FILE") || SEMGREP_VERDICT="PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0"
 
-      # Extract top finding details
-      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-results.slice(0,5).forEach(r=>{const extra=r.extra||{};
-const severity=(extra.severity||'UNKNOWN').toUpperCase();
-const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
-const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
-console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
-}catch(e){console.log('  (Failed to parse semgrep output)');}
-});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+    PARSE_LINE=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '1p')
+    FINDING_DETAILS=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '2,$p')
+    V_PARSE=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/^PARSE=\([A-Z]*\) .*/\1/p')
+    V_RESULTS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* RESULTS=\([0-9]*\) .*/\1/p')
+    V_ERRORS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* ERRORS=\([0-9]*\) .*/\1/p')
+    V_BLOCKING=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* BLOCKING=\([0-9]*\) .*/\1/p')
+    V_WARNINGS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* WARNINGS=\([0-9]*\)$/\1/p')
+    # Keep the raw stdout tail for the unparseable branch's diagnostics BEFORE
+    # the temp file goes away (#518 R2: stderr alone often says nothing there).
+    SEMGREP_STDOUT_TAIL=$(tail -5 "$SEMGREP_STDOUT_FILE" 2>/dev/null)
+    rm -f "$SEMGREP_STDOUT_FILE"
 
-      if [ "$CRITICAL_HIGH" -gt 0 ]; then
-        echo ""
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 10: Semgrep Security Gate"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
-        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  ❌ BLOCKED — Critical/High vulnerability found"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "$FINDING_DETAILS"
-        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_10_STATUS="FAIL"
-        exit 1
-      else
-        echo ""
-        echo "     ✅ PASSED - No critical/high vulnerabilities"
-        if [ "$MEDIUM_LOW" -gt 0 ]; then
-          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
-          echo "$FINDING_DETAILS"
-        fi
-        GATE_10_STATUS="PASS"
+    # Fail closed: an unparseable payload OR an OK parse with any missing count
+    # field (verdict-line format drift) must SKIP, never silently degrade to
+    # PASS (#518).
+    if [ "$V_PARSE" != "OK" ] || [ -z "$V_RESULTS" ] || [ -z "$V_ERRORS" ] || [ -z "$V_BLOCKING" ] || [ -z "$V_WARNINGS" ]; then
+      # Unparseable output: nothing the exit code claims can be trusted (#518).
+      # Fail closed — SKIP with diagnostics, never a PASS.
+      echo "     ⚠️  semgrep output unparseable or verdict fields missing (exit code ${SEMGREP_EXIT}) — cannot determine verdict"
+      if [ -n "$SEMGREP_OUTPUT" ]; then
+        echo "     ── what semgrep reported on stderr ──"
+        printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
       fi
-    else
-      # semgrep runtime error (timeout, config error, etc.)
-      #
-      # SEMGREP_OUTPUT is captured above and was never shown here, so an intermittent
-      # ruleset-fetch failure looked identical to a broken install: the gate printed
-      # "runtime error" and kept the reason to itself (#475). The verdict stays SKIP --
-      # an operational failure must not block the commit, and must not be called a pass.
-      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      if [ -n "$SEMGREP_STDOUT_TAIL" ]; then
+        echo "     ── what semgrep wrote to stdout (tail) ──"
+        printf '%s\n' "$SEMGREP_STDOUT_TAIL" | sed 's/^/     /'
+      fi
+      echo "     ⏭️  SKIPPED - SAST (semgrep output unparseable)"
+      GATE_10_STATUS="SKIP"
+    elif [ "$V_RESULTS" -eq 0 ] && { [ "$V_ERRORS" -gt 0 ] || [ "$SEMGREP_EXIT" -ne 0 ]; }; then
+      # Nothing was scanned to a verdict: semgrep either failed outright
+      # (nonzero exit) or completed but reported scan errors for every input
+      # (#518 R2: exit 0 + results:[] + errors:[{...}] used to fall through to
+      # PASS). An operational failure must neither block nor claim a pass
+      # (#475 kept).
+      echo "     ⚠️  semgrep exit=${SEMGREP_EXIT}, scan errors=${V_ERRORS}, findings=${V_RESULTS} — nothing to judge"
       if [ -n "$SEMGREP_OUTPUT" ]; then
         echo "     ── what semgrep reported ──"
         printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
       fi
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
       GATE_10_STATUS="SKIP"
+    elif [ "$V_BLOCKING" -gt 0 ]; then
+      echo ""
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "   GATE 10: Semgrep Security Gate"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  CRITICAL/HIGH/ERROR:     ${V_BLOCKING}  ❌ BLOCKED"
+      echo "  MEDIUM/LOW/WARNING/INFO: ${V_WARNINGS}  ⚠️  warning"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  ❌ BLOCKED — blocking-severity vulnerability found"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "$FINDING_DETAILS"
+      echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+      GATE_10_STATUS="FAIL"
+      exit 1
+    else
+      echo ""
+      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: ${#SEMGREP_ARGS[@]})"
+      if [ "$V_WARNINGS" -gt 0 ]; then
+        echo "     ⚠️  ${V_WARNINGS} non-blocking findings (warnings only)"
+        echo "$FINDING_DETAILS"
+      fi
+      GATE_10_STATUS="PASS"
     fi
+
+    fi # node available
   fi
 fi
 record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"

package/hooks/gate-3.sh

@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 # ============================================================================
 # GATE 3: Cyclomatic Complexity Check
 # Uses lizard - checks cyclomatic complexity of changed source files
@@ -17,7 +18,45 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
   GATE_3_STATUS="SKIP"
   
 else
-  CCN_THRESHOLD=5
+  # S2 (#507): three-level CCN threshold override --
+  # .xp-gate/ccn-threshold (positive integer) > XP_GATE_CCN_THRESHOLD > 5.
+  # Invalid values WARN on stderr and fall back to the default; the resolved
+  # value reaches the gate-3 audit record via the --detail argument below.
+  # Implemented with bash builtins only (no tr/grep spawns): every process
+  # spawn is expensive on Windows under AV filter drivers.
+  resolve_ccn_threshold() {
+    local default=5 val
+    if [ -f ".xp-gate/ccn-threshold" ]; then
+      val=$(<".xp-gate/ccn-threshold")
+      val="${val//[[:space:]]/}"
+      case "$val" in
+        ''|*[!0-9]*|0)
+          echo "WARN - invalid .xp-gate/ccn-threshold value '${val}' (expected a positive integer), falling back to ${default}" >&2
+          ;;
+        *)
+          echo "$val"
+          return 0
+          ;;
+      esac
+      echo "$default"
+      return 0
+    fi
+    val=${XP_GATE_CCN_THRESHOLD:-}
+    if [ -n "$val" ]; then
+      case "$val" in
+        ''|*[!0-9]*|0)
+          echo "WARN - invalid XP_GATE_CCN_THRESHOLD value '${val}' (expected a positive integer), falling back to ${default}" >&2
+          ;;
+        *)
+          echo "$val"
+          return 0
+          ;;
+      esac
+    fi
+    echo "$default"
+  }
+
+  CCN_THRESHOLD=$(resolve_ccn_threshold)
   
   # Check lizard availability
   LIZARD_CMD=""
@@ -37,7 +76,16 @@ else
       echo "Checking complexity for source files..."
       
       # Run lizard with CCN threshold
-      CC_OUTPUT=$($LIZARD_PATH -C $CCN_THRESHOLD $CC_FILES 2>&1 || true)
+      # One path per line, into an array. Unquoted $CC_FILES relied on word
+      # splitting, which also splits any path containing a space -- handing
+      # lizard two bogus paths and checking neither (#457 defect class, same
+      # fix as gate-4's PRINCIPLES_ARGS). Quoting the scalar would instead
+      # collapse the list into one argument. An array does both.
+      CC_FILES_ARGS=()
+      while IFS= read -r _cc_file; do
+        [ -n "$_cc_file" ] && CC_FILES_ARGS+=("$_cc_file")
+      done <<< "$CC_FILES"
+      CC_OUTPUT=$("$LIZARD_PATH" -C "$CCN_THRESHOLD" ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>&1 || true)
       
       # Parse warning count from the summary table: "Warning cnt   8"
       # Use anchored grep to avoid matching lizard table headers (e.g. "Rt" column)
@@ -65,4 +113,4 @@ else
     GATE_3_STATUS="WARN"
   fi
 fi
-record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "${CC_WARNINGS:-0}" "$GATE_3_START"
+record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "${CC_WARNINGS:-0}" "$GATE_3_START" "ccn_threshold=${CCN_THRESHOLD:-5}"