@boyingliu01/xp-gate 0.20.2 → 0.21.0

package/adapters/python.sh

@@ -9,10 +9,26 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=/dev/null
 source "$SCRIPT_DIR/../adapter-common.sh" 2>/dev/null || true
 
-run_static_analysis() {
-  require_tool mypy "mypy" || return 1
+# A mypy target must exist AND actually contain .py files: a bare directory
+# check lets through TS repos' src/ (mypy exits 2 with "There are no .py[i]
+# files in directory" — #513 R1 expert-B reproduction), and a file check
+# alone would accept empty shell directories. Supports files too, so a
+# scope declaration may name a single .py file.
+_mypy_target_usable() {
+  [ -e "$1" ] || return 1
+  [ -n "$(find "$1" -name '*.py' -print 2>/dev/null | grep .)" ]
+}
 
-  # 口径 = CI type job（.github/workflows/ci.yml:43-45）的两条命令，逐字一致。
+run_static_analysis() {
+  # NOTE: require_tool mypy runs AFTER target resolution, not here (#513 R2
+  # expert-C): a repo with no type surface AND no mypy installed must reach
+  # the SKIP branch (nothing to check) instead of false-BLOCKing on the
+  # missing tool. The tool is only required when there is something to check.
+
+  # 口径 = CI type job（.github/workflows/ci.yml:43-45）的目录集合（src/、
+  # scripts/），并按调用方式对齐：**逐目录单独调用**（#513 R1 专家 B 实测：
+  # 合并为 `mypy src scripts` 一次跑，src/util.py 与 scripts/util.py 同名时
+  # 报 "Duplicate module named" exit 2，而 CI 分开跑各自 exit 0）。
   # 为什么不能写 `mypy .`：`.` 会递归扫到两类文件，而它们在仓库里从未被声明为
   # 门禁面，CI 也从不检查：
   #   ① 根目录一次性调研/演示脚本（fetch_*.py、demo_*.py、validate_*.py 等）——
@@ -28,10 +44,61 @@ run_static_analysis() {
   # 口径一致性由仓库侧 BATS 测试双向锁住：
   # githooks/__tests__/adapter-mypy-pester-scope.test.bats（含"适配器里不得再
   # 出现裸 mypy ."），防止 `mypy .` 被写回来时无人报警。
+  #
+  # #513：上述 `src/`+`scripts/` 是"单一仓库的 CI 声明面"，不能当成所有 Python
+  # 仓库的布局硬编码——无 src/ 的仓库（如 skill-cert 的 engine/ 布局）会得到
+  # `mypy: can't read file 'src'` 而对任何 .py 提交恒 BLOCK，违反本项目
+  # "门禁无法运行 → SKIP 而非 BLOCK" 规范。口径回归"按仓库声明"三级解析：
+  #   ① 仓库根 `.xp-gate-mypy-scope`（每行一个目录；支持整行或行内 # 注释）
+  #      存在则为其权威声明，声明条目同样过 usable 守卫（缺失/无 .py → WARN 跳过）；
+  #   ② 否则仅对 usable 的默认目录（src/、scripts/）执行；
+  #   ③ 两者皆无（或声明为空）→ 打印提示并 exit 0，绝不把 mypy 空跑一次。
   echo "Running Python static analysis (mypy)..."
-  mypy src/ || return 1
-  mypy scripts/
-  return $?
+  local -a MYPY_TARGETS=()
+  local _mypy_declared=0
+  if [ -f .xp-gate-mypy-scope ]; then
+    while IFS= read -r line || [ -n "$line" ]; do
+      line="${line%%#*}"
+      line="${line#"${line%%[![:space:]]*}"}"
+      line="${line%"${line##*[![:space:]]}"}"
+      [ -z "$line" ] && continue
+      _mypy_declared=1
+      if _mypy_target_usable "$line"; then
+        MYPY_TARGETS+=("$line")
+      else
+        echo "  ⚠ mypy scope: declared target '$line' does not exist or contains no .py files — skipped"
+      fi
+    done < .xp-gate-mypy-scope
+    echo "  scope: .xp-gate-mypy-scope declaration"
+    if [ "${#MYPY_TARGETS[@]}" -eq 0 ]; then
+      if [ "$_mypy_declared" -eq 1 ]; then
+        echo "  ⚠ mypy: .xp-gate-mypy-scope has no usable target (all missing or without .py files) — skipping"
+      else
+        echo "  ⚠ mypy: .xp-gate-mypy-scope is present but empty (comments/blank lines only) — skipping"
+      fi
+      return 0
+    fi
+  else
+    if [ -d src ] && _mypy_target_usable src; then
+      MYPY_TARGETS+=(src)
+    fi
+    if [ -d scripts ] && _mypy_target_usable scripts; then
+      MYPY_TARGETS+=(scripts)
+    fi
+    if [ "${#MYPY_TARGETS[@]}" -eq 0 ]; then
+      echo "  ℹ️  mypy: repo declares no type surface (no .xp-gate-mypy-scope; src/ scripts/ absent or without .py files) — skipping"
+      echo "      if this repo does have a type surface, declare it: create .xp-gate-mypy-scope (one directory per line)"
+      return 0
+    fi
+  fi
+  # 逐目标调用并聚合退出码（口径见函数头注释）。
+  require_tool mypy "mypy" || return 1
+  local _mypy_rc=0
+  local _mypy_t
+  for _mypy_t in "${MYPY_TARGETS[@]}"; do
+    mypy "$_mypy_t" || _mypy_rc=1
+  done
+  return $_mypy_rc
 }
 
 run_lint() {

package/gate-10.sh

@@ -57,82 +57,125 @@ else
 $SEMGREP_FILES
 EOF
 
-    # Run semgrep with JSON output
-    # --config=p/security-audit: explicit security ruleset
-    # --json: machine-readable output
-    # --disable-version-check: skip network call
-    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1)
-    SEMGREP_EXIT=$?
+    # The verdict is parsed from the JSON with node (see below), so node is a
+    # hard dependency of this gate — check it BEFORE spending a semgrep run
+    # (#518 R2): without it we would silently SKIP every finding as
+    # "unparseable" and lose the whole security net on minimal CI images.
+    if ! command -v node >/dev/null 2>&1; then
+      echo "     ⚠️  WARN - node is not installed — Gate 10 needs it to parse semgrep's JSON verdict"
+      echo "     Install node (https://nodejs.org); without it SAST findings cannot be classified"
+      echo "     ⏭️  SKIPPED - SAST (node not installed)"
+      GATE_10_STATUS="SKIP"
+    else
 
-    if [ "$SEMGREP_EXIT" -eq 0 ]; then
-      echo "     ✅ PASSED - No security vulnerabilities found (files scanned: ${#SEMGREP_ARGS[@]})."
-      GATE_10_STATUS="PASS"
-    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
-      # Findings detected - parse JSON to categorize
-      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # Run semgrep with JSON output. stdout and stderr are captured SEPARATELY:
+    # --json writes findings to stdout, progress/summary lines to stderr, and the
+    # old `2>&1` merge poisoned the very JSON the verdict now depends on (#518).
+    # SEMGREP_OUTPUT keeps its name and role — what the tool said, printed on the
+    # SKIP path (AC-475-04).
+    #
+    # #518: the exit code does NOT carry the verdict. semgrep exits 0 even with
+    # ERROR-severity findings, and its exit-code semantics have drifted across
+    # versions and platforms (upstream currently reports findings WITH --error
+    # as exit 1 and failures as 2, but that mapping is not something a gate
+    # should bet on). The JSON carries what the exit code never could —
+    # per-severity counts — so the verdict is read from the JSON and the exit
+    # code is demoted to "did the tool itself run". --error stays OFF: it would
+    # add nothing the JSON does not already provide, and keeping it off leaves
+    # failure exit codes unambiguous for the #475 diagnostics path.
+    SEMGREP_STDOUT_FILE=$(mktemp)
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
+    SEMGREP_EXIT=$?
 
-      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # One node pass over the JSON: first line = verdict counts, remaining lines =
+    # finding details. The severity vocabulary is the UNION of the two scales
+    # (#518): semgrep's own ERROR is its most severe tier (it maps to the old
+    # CRITICAL/HIGH → BLOCK intent), its WARNING/INFO align with the old
+    # MEDIUM/LOW → warnings-only tier. Anything OUTSIDE both lists (missing,
+    # empty, or a future/new tier) counts as BLOCKING — a security gate must
+    # fail closed on severities it does not recognize (#518 R2). Parsing
+    # failure degrades to PARSE=FAIL — a fail-closed SKIP below, never a PASS.
+    SEMGREP_VERDICT=$(node -e '
+let d="";process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>{
+let data;try{data=JSON.parse(d);}catch(e){console.log("PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0");return;}
+const results=data.results||[];const errors=data.errors||[];
+const sev=r=>((r.extra&&r.extra.severity)||"").toUpperCase();
+const WARNV=["WARNING","INFO","MEDIUM","LOW"];
+let b=0,w=0;results.forEach(r=>{if(WARNV.indexOf(sev(r))>=0)w++;else b++;});
+console.log("PARSE=OK RESULTS="+results.length+" ERRORS="+errors.length+" BLOCKING="+b+" WARNINGS="+w);
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};const s=sev(r)||"UNKNOWN";
+console.log("  ["+s+"] "+(r.check_id||"unknown"));
+console.log("  "+(r.path||"unknown")+":"+((r.start&&r.start.line)||"?")+" → "+(extra.message||"").slice(0,80));
+console.log("");});
+});' < "$SEMGREP_STDOUT_FILE") || SEMGREP_VERDICT="PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0"
 
-      # Extract top finding details
-      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-results.slice(0,5).forEach(r=>{const extra=r.extra||{};
-const severity=(extra.severity||'UNKNOWN').toUpperCase();
-const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
-const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
-console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
-}catch(e){console.log('  (Failed to parse semgrep output)');}
-});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+    PARSE_LINE=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '1p')
+    FINDING_DETAILS=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '2,$p')
+    V_PARSE=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/^PARSE=\([A-Z]*\) .*/\1/p')
+    V_RESULTS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* RESULTS=\([0-9]*\) .*/\1/p')
+    V_ERRORS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* ERRORS=\([0-9]*\) .*/\1/p')
+    V_BLOCKING=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* BLOCKING=\([0-9]*\) .*/\1/p')
+    V_WARNINGS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* WARNINGS=\([0-9]*\)$/\1/p')
+    # Keep the raw stdout tail for the unparseable branch's diagnostics BEFORE
+    # the temp file goes away (#518 R2: stderr alone often says nothing there).
+    SEMGREP_STDOUT_TAIL=$(tail -5 "$SEMGREP_STDOUT_FILE" 2>/dev/null)
+    rm -f "$SEMGREP_STDOUT_FILE"
 
-      if [ "$CRITICAL_HIGH" -gt 0 ]; then
-        echo ""
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 10: Semgrep Security Gate"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
-        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  ❌ BLOCKED — Critical/High vulnerability found"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "$FINDING_DETAILS"
-        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_10_STATUS="FAIL"
-        exit 1
-      else
-        echo ""
-        echo "     ✅ PASSED - No critical/high vulnerabilities"
-        if [ "$MEDIUM_LOW" -gt 0 ]; then
-          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
-          echo "$FINDING_DETAILS"
-        fi
-        GATE_10_STATUS="PASS"
+    # Fail closed: an unparseable payload OR an OK parse with any missing count
+    # field (verdict-line format drift) must SKIP, never silently degrade to
+    # PASS (#518).
+    if [ "$V_PARSE" != "OK" ] || [ -z "$V_RESULTS" ] || [ -z "$V_ERRORS" ] || [ -z "$V_BLOCKING" ] || [ -z "$V_WARNINGS" ]; then
+      # Unparseable output: nothing the exit code claims can be trusted (#518).
+      # Fail closed — SKIP with diagnostics, never a PASS.
+      echo "     ⚠️  semgrep output unparseable or verdict fields missing (exit code ${SEMGREP_EXIT}) — cannot determine verdict"
+      if [ -n "$SEMGREP_OUTPUT" ]; then
+        echo "     ── what semgrep reported on stderr ──"
+        printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
       fi
-    else
-      # semgrep runtime error (timeout, config error, etc.)
-      #
-      # SEMGREP_OUTPUT is captured above and was never shown here, so an intermittent
-      # ruleset-fetch failure looked identical to a broken install: the gate printed
-      # "runtime error" and kept the reason to itself (#475). The verdict stays SKIP --
-      # an operational failure must not block the commit, and must not be called a pass.
-      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      if [ -n "$SEMGREP_STDOUT_TAIL" ]; then
+        echo "     ── what semgrep wrote to stdout (tail) ──"
+        printf '%s\n' "$SEMGREP_STDOUT_TAIL" | sed 's/^/     /'
+      fi
+      echo "     ⏭️  SKIPPED - SAST (semgrep output unparseable)"
+      GATE_10_STATUS="SKIP"
+    elif [ "$V_RESULTS" -eq 0 ] && { [ "$V_ERRORS" -gt 0 ] || [ "$SEMGREP_EXIT" -ne 0 ]; }; then
+      # Nothing was scanned to a verdict: semgrep either failed outright
+      # (nonzero exit) or completed but reported scan errors for every input
+      # (#518 R2: exit 0 + results:[] + errors:[{...}] used to fall through to
+      # PASS). An operational failure must neither block nor claim a pass
+      # (#475 kept).
+      echo "     ⚠️  semgrep exit=${SEMGREP_EXIT}, scan errors=${V_ERRORS}, findings=${V_RESULTS} — nothing to judge"
       if [ -n "$SEMGREP_OUTPUT" ]; then
         echo "     ── what semgrep reported ──"
         printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
       fi
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
       GATE_10_STATUS="SKIP"
+    elif [ "$V_BLOCKING" -gt 0 ]; then
+      echo ""
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "   GATE 10: Semgrep Security Gate"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  CRITICAL/HIGH/ERROR:     ${V_BLOCKING}  ❌ BLOCKED"
+      echo "  MEDIUM/LOW/WARNING/INFO: ${V_WARNINGS}  ⚠️  warning"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  ❌ BLOCKED — blocking-severity vulnerability found"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "$FINDING_DETAILS"
+      echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+      GATE_10_STATUS="FAIL"
+      exit 1
+    else
+      echo ""
+      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: ${#SEMGREP_ARGS[@]})"
+      if [ "$V_WARNINGS" -gt 0 ]; then
+        echo "     ⚠️  ${V_WARNINGS} non-blocking findings (warnings only)"
+        echo "$FINDING_DETAILS"
+      fi
+      GATE_10_STATUS="PASS"
     fi
+
+    fi # node available
   fi
 fi
 record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"

package/hooks/gate-10.sh

@@ -57,82 +57,125 @@ else
 $SEMGREP_FILES
 EOF
 
-    # Run semgrep with JSON output
-    # --config=p/security-audit: explicit security ruleset
-    # --json: machine-readable output
-    # --disable-version-check: skip network call
-    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1)
-    SEMGREP_EXIT=$?
+    # The verdict is parsed from the JSON with node (see below), so node is a
+    # hard dependency of this gate — check it BEFORE spending a semgrep run
+    # (#518 R2): without it we would silently SKIP every finding as
+    # "unparseable" and lose the whole security net on minimal CI images.
+    if ! command -v node >/dev/null 2>&1; then
+      echo "     ⚠️  WARN - node is not installed — Gate 10 needs it to parse semgrep's JSON verdict"
+      echo "     Install node (https://nodejs.org); without it SAST findings cannot be classified"
+      echo "     ⏭️  SKIPPED - SAST (node not installed)"
+      GATE_10_STATUS="SKIP"
+    else
 
-    if [ "$SEMGREP_EXIT" -eq 0 ]; then
-      echo "     ✅ PASSED - No security vulnerabilities found (files scanned: ${#SEMGREP_ARGS[@]})."
-      GATE_10_STATUS="PASS"
-    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
-      # Findings detected - parse JSON to categorize
-      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # Run semgrep with JSON output. stdout and stderr are captured SEPARATELY:
+    # --json writes findings to stdout, progress/summary lines to stderr, and the
+    # old `2>&1` merge poisoned the very JSON the verdict now depends on (#518).
+    # SEMGREP_OUTPUT keeps its name and role — what the tool said, printed on the
+    # SKIP path (AC-475-04).
+    #
+    # #518: the exit code does NOT carry the verdict. semgrep exits 0 even with
+    # ERROR-severity findings, and its exit-code semantics have drifted across
+    # versions and platforms (upstream currently reports findings WITH --error
+    # as exit 1 and failures as 2, but that mapping is not something a gate
+    # should bet on). The JSON carries what the exit code never could —
+    # per-severity counts — so the verdict is read from the JSON and the exit
+    # code is demoted to "did the tool itself run". --error stays OFF: it would
+    # add nothing the JSON does not already provide, and keeping it off leaves
+    # failure exit codes unambiguous for the #475 diagnostics path.
+    SEMGREP_STDOUT_FILE=$(mktemp)
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
+    SEMGREP_EXIT=$?
 
-      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # One node pass over the JSON: first line = verdict counts, remaining lines =
+    # finding details. The severity vocabulary is the UNION of the two scales
+    # (#518): semgrep's own ERROR is its most severe tier (it maps to the old
+    # CRITICAL/HIGH → BLOCK intent), its WARNING/INFO align with the old
+    # MEDIUM/LOW → warnings-only tier. Anything OUTSIDE both lists (missing,
+    # empty, or a future/new tier) counts as BLOCKING — a security gate must
+    # fail closed on severities it does not recognize (#518 R2). Parsing
+    # failure degrades to PARSE=FAIL — a fail-closed SKIP below, never a PASS.
+    SEMGREP_VERDICT=$(node -e '
+let d="";process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>{
+let data;try{data=JSON.parse(d);}catch(e){console.log("PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0");return;}
+const results=data.results||[];const errors=data.errors||[];
+const sev=r=>((r.extra&&r.extra.severity)||"").toUpperCase();
+const WARNV=["WARNING","INFO","MEDIUM","LOW"];
+let b=0,w=0;results.forEach(r=>{if(WARNV.indexOf(sev(r))>=0)w++;else b++;});
+console.log("PARSE=OK RESULTS="+results.length+" ERRORS="+errors.length+" BLOCKING="+b+" WARNINGS="+w);
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};const s=sev(r)||"UNKNOWN";
+console.log("  ["+s+"] "+(r.check_id||"unknown"));
+console.log("  "+(r.path||"unknown")+":"+((r.start&&r.start.line)||"?")+" → "+(extra.message||"").slice(0,80));
+console.log("");});
+});' < "$SEMGREP_STDOUT_FILE") || SEMGREP_VERDICT="PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0"
 
-      # Extract top finding details
-      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-results.slice(0,5).forEach(r=>{const extra=r.extra||{};
-const severity=(extra.severity||'UNKNOWN').toUpperCase();
-const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
-const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
-console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
-}catch(e){console.log('  (Failed to parse semgrep output)');}
-});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+    PARSE_LINE=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '1p')
+    FINDING_DETAILS=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '2,$p')
+    V_PARSE=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/^PARSE=\([A-Z]*\) .*/\1/p')
+    V_RESULTS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* RESULTS=\([0-9]*\) .*/\1/p')
+    V_ERRORS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* ERRORS=\([0-9]*\) .*/\1/p')
+    V_BLOCKING=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* BLOCKING=\([0-9]*\) .*/\1/p')
+    V_WARNINGS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* WARNINGS=\([0-9]*\)$/\1/p')
+    # Keep the raw stdout tail for the unparseable branch's diagnostics BEFORE
+    # the temp file goes away (#518 R2: stderr alone often says nothing there).
+    SEMGREP_STDOUT_TAIL=$(tail -5 "$SEMGREP_STDOUT_FILE" 2>/dev/null)
+    rm -f "$SEMGREP_STDOUT_FILE"
 
-      if [ "$CRITICAL_HIGH" -gt 0 ]; then
-        echo ""
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 10: Semgrep Security Gate"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
-        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  ❌ BLOCKED — Critical/High vulnerability found"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "$FINDING_DETAILS"
-        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_10_STATUS="FAIL"
-        exit 1
-      else
-        echo ""
-        echo "     ✅ PASSED - No critical/high vulnerabilities"
-        if [ "$MEDIUM_LOW" -gt 0 ]; then
-          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
-          echo "$FINDING_DETAILS"
-        fi
-        GATE_10_STATUS="PASS"
+    # Fail closed: an unparseable payload OR an OK parse with any missing count
+    # field (verdict-line format drift) must SKIP, never silently degrade to
+    # PASS (#518).
+    if [ "$V_PARSE" != "OK" ] || [ -z "$V_RESULTS" ] || [ -z "$V_ERRORS" ] || [ -z "$V_BLOCKING" ] || [ -z "$V_WARNINGS" ]; then
+      # Unparseable output: nothing the exit code claims can be trusted (#518).
+      # Fail closed — SKIP with diagnostics, never a PASS.
+      echo "     ⚠️  semgrep output unparseable or verdict fields missing (exit code ${SEMGREP_EXIT}) — cannot determine verdict"
+      if [ -n "$SEMGREP_OUTPUT" ]; then
+        echo "     ── what semgrep reported on stderr ──"
+        printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
       fi
-    else
-      # semgrep runtime error (timeout, config error, etc.)
-      #
-      # SEMGREP_OUTPUT is captured above and was never shown here, so an intermittent
-      # ruleset-fetch failure looked identical to a broken install: the gate printed
-      # "runtime error" and kept the reason to itself (#475). The verdict stays SKIP --
-      # an operational failure must not block the commit, and must not be called a pass.
-      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
+      if [ -n "$SEMGREP_STDOUT_TAIL" ]; then
+        echo "     ── what semgrep wrote to stdout (tail) ──"
+        printf '%s\n' "$SEMGREP_STDOUT_TAIL" | sed 's/^/     /'
+      fi
+      echo "     ⏭️  SKIPPED - SAST (semgrep output unparseable)"
+      GATE_10_STATUS="SKIP"
+    elif [ "$V_RESULTS" -eq 0 ] && { [ "$V_ERRORS" -gt 0 ] || [ "$SEMGREP_EXIT" -ne 0 ]; }; then
+      # Nothing was scanned to a verdict: semgrep either failed outright
+      # (nonzero exit) or completed but reported scan errors for every input
+      # (#518 R2: exit 0 + results:[] + errors:[{...}] used to fall through to
+      # PASS). An operational failure must neither block nor claim a pass
+      # (#475 kept).
+      echo "     ⚠️  semgrep exit=${SEMGREP_EXIT}, scan errors=${V_ERRORS}, findings=${V_RESULTS} — nothing to judge"
       if [ -n "$SEMGREP_OUTPUT" ]; then
         echo "     ── what semgrep reported ──"
         printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
       fi
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
       GATE_10_STATUS="SKIP"
+    elif [ "$V_BLOCKING" -gt 0 ]; then
+      echo ""
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "   GATE 10: Semgrep Security Gate"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  CRITICAL/HIGH/ERROR:     ${V_BLOCKING}  ❌ BLOCKED"
+      echo "  MEDIUM/LOW/WARNING/INFO: ${V_WARNINGS}  ⚠️  warning"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  ❌ BLOCKED — blocking-severity vulnerability found"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "$FINDING_DETAILS"
+      echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+      GATE_10_STATUS="FAIL"
+      exit 1
+    else
+      echo ""
+      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: ${#SEMGREP_ARGS[@]})"
+      if [ "$V_WARNINGS" -gt 0 ]; then
+        echo "     ⚠️  ${V_WARNINGS} non-blocking findings (warnings only)"
+        echo "$FINDING_DETAILS"
+      fi
+      GATE_10_STATUS="PASS"
     fi
+
+    fi # node available
   fi
 fi
 record_gate_audit "gate-10" "sast-security" "$GATE_10_STATUS" "0" "$GATE_10_START"

package/hooks/pre-commit

@@ -710,30 +710,53 @@ if [ -z "$PROJECT_LANGS" ] && [ -z "$_CONFIG_LANGS" ]; then
       done
       return 1
     }
+    # #515: when the repo ROOT itself declares the project, a nested marker that
+    # is merely a module file (skill_cert/cli/setup.py incident) must not hijack
+    # PROJECT_SUBDIR — Gates 1-9 would run from the wrong cwd and false-BLOCK on
+    # root-relative paths. The root-marker set below MUST stay aligned with
+    # _detect_subdir's marker set above (10 markers): every ecosystem recognized
+    # for subproject derivation is also protected at the root. The JS-monorepo
+    # check runs FIRST (#515 R2 delphi walkthrough): a root package.json with a
+    # "workspaces" key declares a JS monorepo (often together with a shared
+    # tsconfig.json), not a single project, so derivation keeps running there.
+    # Known limitation (#527): Gradle multi-module, CMake subdirectories and
+    # pnpm/Lerna workspaces are not disambiguated from single projects yet —
+    # see the pinned BATS case.
+    _skip_subdir_derive=0
+    if [ -f package.json ] && grep -q '"workspaces":' package.json 2>/dev/null; then
+      _skip_subdir_derive=0 # JS monorepo root: subproject derivation stays on
+    elif [ -f package.json ] || [ -f tsconfig.json ] || [ -f pyproject.toml ] || \
+         [ -f setup.py ] || [ -f go.mod ] || [ -f pubspec.yaml ] || \
+         [ -f pom.xml ] || [ -f build.gradle ] || \
+         [ -f build.gradle.kts ] || [ -f CMakeLists.txt ]; then
+      _skip_subdir_derive=1
+    fi
     _subdir_set=""
-    while IFS= read -r _changed; do
-      [ -z "$_changed" ] && continue
-      _d=$(_detect_subdir "$_changed" 2>/dev/null) || true
-      if [ -n "$_d" ] && [ "$_d" != "." ]; then
-        case " $_subdir_set " in
-          *" $_d "*) ;; # already seen
-          *) _subdir_set="${_subdir_set} $_d" ;;
-        esac
-      fi
-    done <<CHANGEDFILELIST
+    if [ "$_skip_subdir_derive" -eq 0 ]; then
+      while IFS= read -r _changed; do
+        [ -z "$_changed" ] && continue
+        _d=$(_detect_subdir "$_changed" 2>/dev/null) || true
+        if [ -n "$_d" ] && [ "$_d" != "." ]; then
+          case " $_subdir_set " in
+            *" $_d "*) ;; # already seen
+            *) _subdir_set="${_subdir_set} $_d" ;;
+          esac
+        fi
+      done <<CHANGEDFILELIST
 $CHANGED_FILES
 CHANGEDFILELIST
-    _subdir_count=$(echo "$_subdir_set" | awk '{ n=0; for(i=1;i<=NF;i++) n++; print n }')
-    if [ "$_subdir_count" = "1" ]; then
-      PROJECT_SUBDIR=$(echo "$_subdir_set" | awk '{print $1}')
-      echo ""
-      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-      echo "   📁 MULTILANGUAGE SUBDIR DETECTED FROM CHANGED FILES"
-      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-      echo ""
-      echo "Language: $PROJECT_LANGS"
-      echo "Location: $PROJECT_SUBDIR/"
-      echo ""
+      _subdir_count=$(echo "$_subdir_set" | awk '{ n=0; for(i=1;i<=NF;i++) n++; print n }')
+      if [ "$_subdir_count" = "1" ]; then
+        PROJECT_SUBDIR=$(echo "$_subdir_set" | awk '{print $1}')
+        echo ""
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo "   📁 MULTILANGUAGE SUBDIR DETECTED FROM CHANGED FILES"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+        echo ""
+        echo "Language: $PROJECT_LANGS"
+        echo "Location: $PROJECT_SUBDIR/"
+        echo ""
+      fi
     fi
   fi
 

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-12T10:19:27.219Z",
+  "checked_at": "2026-10-13T15:10:08.282Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.20.2",
+  "version": "0.21.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.20.2",
+  "version": "0.21.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.20.2",
+  "version": "0.21.0",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.20.2",
+  "version": "0.21.0",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.20.2",
+  "version": "0.21.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-12
-**Commit:** unknown
-**Branch:** unknown
-**Version:** 0.20.2.0
+**Generated:** 2026-10-13
+**Commit:** 05a08fcf
+**Branch:** main
+**Version:** 0.21.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.