@boyingliu01/xp-gate 0.21.0 → 0.22.0

package/hooks/gate-9.sh

@@ -3,6 +3,13 @@
 # Detects security vulnerabilities (SQL injection, XSS, etc.) in staged files
 # Tool: semgrep -- https://semgrep.dev
 # ============================================================================
+# #532: this is a legacy gate-9 fallback copy, kept alive by
+# resolveGateScript(9) in TS-less deployments (xp-gate gate sast without the
+# src/gates/gate-9.ts entry). The verdict semantics below are ported from
+# gate-10.sh (the #518 fix, v0.21.0) — the verdict block must stay byte
+# identical across githooks/gate-9.sh, githooks/gates/gate-9-sast-security.sh
+# and githooks/adapters/gate-9.sh; parity is asserted by
+# githooks/__tests__/issue-532-gate9-verdict.test.bats (AC-A-02-04).
 
  2>&1 echo ""
  2>&1 echo "→ Gate 9: Semgrep SAST Security Scan..."
@@ -32,73 +39,149 @@ else
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
     GATE_9_STATUS="SKIP"
   else
-    # Run semgrep with JSON output
-    # --config=p/security-audit: explicit security ruleset
-    # --json: machine-readable output
-    # --disable-version-check: skip network call
-    SEMGREP_OUTPUT=$($SEMGREP_CMD scan --config=p/security-audit --json --disable-version-check $SEMGREP_FILES 2>&1)
-    SEMGREP_EXIT=$?
+    # One path per line into an array. Quoting the newline-joined list would hand
+    # semgrep ONE argument containing newlines -> "Invalid scanning root" once
+    # >=2 files are staged (#490). Same defect class as the Gate 4 --files fix
+    # (#457): an array is the only form that keeps spaces intact AND splits files.
+    #
+    # Each element gets a ./ prefix: a tracked path may legitimately start with
+    # '-' (`git add -- ./-o.ts`), and bare in argv that element reads as an option
+    # and rewrites the scan it was meant to constrain. ./ is a path to every
+    # argument parser.
+    #
+    # The unquoted heredoc below expands $SEMGREP_FILES once, then feeds literal
+    # lines to `read`; bash never rescans the result for separators. Its correct
+    # reading rests on one property of the producer above, not of the loop:
+    # `git diff --cached --name-only` terminates paths with LF and quotes control
+    # characters (a CR in a name arrives as the four bytes \215, never as a bare
+    # CR), so one line is exactly one path. Asserted for spaces and a leading '-'
+    # by AC-490-04.
+    SEMGREP_ARGS=()
+    while IFS= read -r _semgrep_file; do
+      [ -n "$_semgrep_file" ] && SEMGREP_ARGS+=("./$_semgrep_file")
+    done <<EOF
+$SEMGREP_FILES
+EOF
 
-    if [ "$SEMGREP_EXIT" -eq 0 ]; then
-      echo "     ✅ PASSED - No security vulnerabilities found."
-      GATE_9_STATUS="PASS"
-    elif [ "$SEMGREP_EXIT" -eq 1 ]; then
-      # Findings detected - parse JSON to categorize
-      CRITICAL_HIGH=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='CRITICAL'||s==='HIGH';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # The verdict is parsed from the JSON with node (see below), so node is a
+    # hard dependency of this gate — check it BEFORE spending a semgrep run
+    # (#518 R2): without it we would silently SKIP every finding as
+    # "unparseable" and lose the whole security net on minimal CI images.
+    if ! command -v node >/dev/null 2>&1; then
+      echo "     ⚠️  WARN - node is not installed — Gate 9 needs it to parse semgrep's JSON verdict"
+      echo "     Install node (https://nodejs.org); without it SAST findings cannot be classified"
+      echo "     ⏭️  SKIPPED - SAST (node not installed)"
+      GATE_9_STATUS="SKIP"
+    else
 
-      MEDIUM_LOW=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-const count=results.filter(r=>{const s=(r.extra&&r.extra.severity||'').toUpperCase();return s==='MEDIUM'||s==='LOW';}).length;
-console.log(count);}catch(e){console.log('0');}
-});" 2>/dev/null || echo "0")
+    # Run semgrep with JSON output. stdout and stderr are captured SEPARATELY:
+    # --json writes findings to stdout, progress/summary lines to stderr, and the
+    # old `2>&1` merge poisoned the very JSON the verdict now depends on (#518).
+    # SEMGREP_OUTPUT keeps its name and role — what the tool said, printed on the
+    # SKIP path (AC-475-04).
+    #
+    # #518: the exit code does NOT carry the verdict. semgrep exits 0 even with
+    # ERROR-severity findings, and its exit-code semantics have drifted across
+    # versions and platforms (upstream currently reports findings WITH --error
+    # as exit 1 and failures as 2, but that mapping is not something a gate
+    # should bet on). The JSON carries what the exit code never could —
+    # per-severity counts — so the verdict is read from the JSON and the exit
+    # code is demoted to "did the tool itself run". --error stays OFF: it would
+    # add nothing the JSON does not already provide, and keeping it off leaves
+    # failure exit codes unambiguous for the #475 diagnostics path.
+    SEMGREP_STDOUT_FILE=$(mktemp)
+    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
+    SEMGREP_EXIT=$?
 
-      # Extract top finding details
-      FINDING_DETAILS=$(echo "$SEMGREP_OUTPUT" | node -e "
-let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
-try{const data=JSON.parse(d);const results=data.results||[];
-results.slice(0,5).forEach(r=>{const extra=r.extra||{};
-const severity=(extra.severity||'UNKNOWN').toUpperCase();
-const ruleId=r.check_id||'unknown';const path=r.path||'unknown';
-const line=(r.start&&r.start.line)||'?';const msg=(extra.message||'').slice(0,80);
-console.log('  ['+severity+'] '+ruleId);console.log('  '+path+':'+line+' → '+msg);console.log();});
-}catch(e){console.log('  (Failed to parse semgrep output)');}
-});" 2>/dev/null || echo "  (Failed to parse semgrep output)")
+    # One node pass over the JSON: first line = verdict counts, remaining lines =
+    # finding details. The severity vocabulary is the UNION of the two scales
+    # (#518): semgrep's own ERROR is its most severe tier (it maps to the old
+    # CRITICAL/HIGH → BLOCK intent), its WARNING/INFO align with the old
+    # MEDIUM/LOW → warnings-only tier. Anything OUTSIDE both lists (missing,
+    # empty, or a future/new tier) counts as BLOCKING — a security gate must
+    # fail closed on severities it does not recognize (#518 R2). Parsing
+    # failure degrades to PARSE=FAIL — a fail-closed SKIP below, never a PASS.
+    SEMGREP_VERDICT=$(node -e '
+let d="";process.stdin.on("data",c=>d+=c);process.stdin.on("end",()=>{
+let data;try{data=JSON.parse(d);}catch(e){console.log("PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0");return;}
+const results=data.results||[];const errors=data.errors||[];
+const sev=r=>((r.extra&&r.extra.severity)||"").toUpperCase();
+const WARNV=["WARNING","INFO","MEDIUM","LOW"];
+let b=0,w=0;results.forEach(r=>{if(WARNV.indexOf(sev(r))>=0)w++;else b++;});
+console.log("PARSE=OK RESULTS="+results.length+" ERRORS="+errors.length+" BLOCKING="+b+" WARNINGS="+w);
+results.slice(0,5).forEach(r=>{const extra=r.extra||{};const s=sev(r)||"UNKNOWN";
+console.log("  ["+s+"] "+(r.check_id||"unknown"));
+console.log("  "+(r.path||"unknown")+":"+((r.start&&r.start.line)||"?")+" → "+(extra.message||"").slice(0,80));
+console.log("");});
+});' < "$SEMGREP_STDOUT_FILE") || SEMGREP_VERDICT="PARSE=FAIL RESULTS=0 ERRORS=0 BLOCKING=0 WARNINGS=0"
 
-      if [ "$CRITICAL_HIGH" -gt 0 ]; then
-        echo ""
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "   GATE 9: Semgrep Security Gate"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  CRITICAL/HIGH: ${CRITICAL_HIGH}  ❌ BLOCKED"
-        echo "  MEDIUM/LOW:    ${MEDIUM_LOW}  ⚠️  warning"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "  ❌ BLOCKED — Critical/High vulnerability found"
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        echo "$FINDING_DETAILS"
-        echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
-        GATE_9_STATUS="FAIL"
-        exit 1
-      else
-        echo ""
-        echo "     ✅ PASSED - No critical/high vulnerabilities"
-        if [ "$MEDIUM_LOW" -gt 0 ]; then
-          echo "     ⚠️  ${MEDIUM_LOW} medium/low findings (warnings only)"
-          echo "$FINDING_DETAILS"
-        fi
-        GATE_9_STATUS="PASS"
+    PARSE_LINE=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '1p')
+    FINDING_DETAILS=$(printf '%s\n' "$SEMGREP_VERDICT" | sed -n '2,$p')
+    V_PARSE=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/^PARSE=\([A-Z]*\) .*/\1/p')
+    V_RESULTS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* RESULTS=\([0-9]*\) .*/\1/p')
+    V_ERRORS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* ERRORS=\([0-9]*\) .*/\1/p')
+    V_BLOCKING=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* BLOCKING=\([0-9]*\) .*/\1/p')
+    V_WARNINGS=$(printf '%s\n' "$PARSE_LINE" | sed -n 's/.* WARNINGS=\([0-9]*\)$/\1/p')
+    # Keep the raw stdout tail for the unparseable branch's diagnostics BEFORE
+    # the temp file goes away (#518 R2: stderr alone often says nothing there).
+    SEMGREP_STDOUT_TAIL=$(tail -5 "$SEMGREP_STDOUT_FILE" 2>/dev/null)
+    rm -f "$SEMGREP_STDOUT_FILE"
+
+    # Fail closed: an unparseable payload OR an OK parse with any missing count
+    # field (verdict-line format drift) must SKIP, never silently degrade to
+    # PASS (#518).
+    if [ "$V_PARSE" != "OK" ] || [ -z "$V_RESULTS" ] || [ -z "$V_ERRORS" ] || [ -z "$V_BLOCKING" ] || [ -z "$V_WARNINGS" ]; then
+      # Unparseable output: nothing the exit code claims can be trusted (#518).
+      # Fail closed — SKIP with diagnostics, never a PASS.
+      echo "     ⚠️  semgrep output unparseable or verdict fields missing (exit code ${SEMGREP_EXIT}) — cannot determine verdict"
+      if [ -n "$SEMGREP_OUTPUT" ]; then
+        echo "     ── what semgrep reported on stderr ──"
+        printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
+      fi
+      if [ -n "$SEMGREP_STDOUT_TAIL" ]; then
+        echo "     ── what semgrep wrote to stdout (tail) ──"
+        printf '%s\n' "$SEMGREP_STDOUT_TAIL" | sed 's/^/     /'
+      fi
+      echo "     ⏭️  SKIPPED - SAST (semgrep output unparseable)"
+      GATE_9_STATUS="SKIP"
+    elif [ "$V_RESULTS" -eq 0 ] && { [ "$V_ERRORS" -gt 0 ] || [ "$SEMGREP_EXIT" -ne 0 ]; }; then
+      # Nothing was scanned to a verdict: semgrep either failed outright
+      # (nonzero exit) or completed but reported scan errors for every input
+      # (#518 R2: exit 0 + results:[] + errors:[{...}] used to fall through to
+      # PASS). An operational failure must neither block nor claim a pass
+      # (#475 kept).
+      echo "     ⚠️  semgrep exit=${SEMGREP_EXIT}, scan errors=${V_ERRORS}, findings=${V_RESULTS} — nothing to judge"
+      if [ -n "$SEMGREP_OUTPUT" ]; then
+        echo "     ── what semgrep reported ──"
+        printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
       fi
-    else
-      # semgrep runtime error (timeout, config error, etc.)
-      echo "     ⚠️  semgrep exited with code ${SEMGREP_EXIT} — skipping gate"
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
       GATE_9_STATUS="SKIP"
+    elif [ "$V_BLOCKING" -gt 0 ]; then
+      echo ""
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "   GATE 9: Semgrep Security Gate"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  CRITICAL/HIGH/ERROR:     ${V_BLOCKING}  ❌ BLOCKED"
+      echo "  MEDIUM/LOW/WARNING/INFO: ${V_WARNINGS}  ⚠️  warning"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "  ❌ BLOCKED — blocking-severity vulnerability found"
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+      echo "$FINDING_DETAILS"
+      echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
+      GATE_9_STATUS="FAIL"
+      exit 1
+    else
+      echo ""
+      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: ${#SEMGREP_ARGS[@]})"
+      if [ "$V_WARNINGS" -gt 0 ]; then
+        echo "     ⚠️  ${V_WARNINGS} non-blocking findings (warnings only)"
+        echo "$FINDING_DETAILS"
+      fi
+      GATE_9_STATUS="PASS"
     fi
+
+    fi # node available
   fi
 fi
 record_gate_audit "gate-9" "sast-security" "$GATE_9_STATUS" "0" "$GATE_9_START"

package/hooks/lib/coverage-total.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+# Gate 5's Python coverage parsing and threshold verdict (#523).
+#
+# Sourced by githooks/pre-commit; kept in its own file so the contract is
+# unit-testable without executing the hook
+# (githooks/__tests__/issue-523-python-coverage-parse.test.bats).
+#
+# The defect this file exists for: `coverage report --format=total` prints a
+# BARE number ("97"), but the hook piped it through `grep -o '[0-9]*%'` — a
+# pattern that requires a literal percent sign — so COVERAGE_PERCENT was always
+# empty and the 80% threshold branch never executed. The gate answered "Could
+# not determine" forever: a silent no-op, not a verdict.
+
+# Parse the raw output of `coverage report --format=total` (stdin) and echo the
+# integer total percentage — or nothing when the input carries no number.
+#
+# coverage.py 7.x --format=total prints a bare number; other tools (and older
+# forms) append a percent sign. Only a line that IS a bare number (optionally
+# %-suffixed) is accepted — a line that merely CONTAINS a number ("WARNING: 2
+# files skipped") must not be mistaken for the total, so the whole line is
+# matched, not the first token. A decimal part is truncated (floor — the
+# conservative direction for a threshold gate, the same convention as the Java
+# path's ${VAR%.*}). Inputs without any bare-number line (empty, "No data to
+# report.", warnings) produce NO output so the caller takes its
+# cannot-determine path: a wrong number is worse than none.
+parse_coverage_total() {
+  awk '
+    {
+      line = $0
+      sub(/%$/, "", line)
+      gsub(/^[ \t]+|[ \t]+$/, "", line)
+      if (line ~ /^[0-9]+(\.[0-9]+)?$/) {
+        sub(/\.[0-9]+$/, "", line)
+        print line
+        exit
+      }
+    }
+  '
+}
+
+# Gate 5 Stage 2 Python coverage enforcement — the hook's python case body,
+# extracted so the mock-PATH test exercises the real control flow. Echoes the
+# verdict lines and returns 1 on BLOCK (the caller turns that into `exit 1`).
+#
+# COVERAGE_PERCENT is deliberately NOT declared local: the hook's quality
+# report reads it after the Stage-2 loop (last writer wins across languages),
+# exactly as the inline branch did.
+enforce_python_coverage() {
+  if ! command -v coverage &> /dev/null; then
+    echo "⚠️  coverage.py not available, cannot enforce Python coverage threshold."
+    return 0
+  fi
+
+  COVERAGE_PERCENT=""
+  if [ -f ".coverage" ]; then
+    COVERAGE_PERCENT=$(coverage report --format=total 2>/dev/null | parse_coverage_total) || true
+  fi
+  if [ -z "$COVERAGE_PERCENT" ] && [ -f "coverage/.coverage" ]; then
+    COVERAGE_PERCENT=$(coverage report --format=total -i coverage 2>/dev/null | parse_coverage_total) || true
+  fi
+
+  if [ -n "$COVERAGE_PERCENT" ]; then
+    if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+      echo "❌ BLOCKED - Python coverage ${COVERAGE_PERCENT}% below 80% threshold"
+      return 1
+    fi
+    echo "Python coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
+  else
+    echo "⚠️  Could not determine Python coverage percentage. Ensure pytest-cov or coverage.py data exists."
+  fi
+  return 0
+}

package/hooks/pre-commit

@@ -224,6 +224,12 @@ source "${AUDIT_SCRIPT_DIR}/lib/jscpd-run.sh"
 # Issue #476: Gate 11's sprint-gate.sh resolution chain and decision translation.
 source "${AUDIT_SCRIPT_DIR}/lib/sprint-gate-report.sh"
 
+# Issue #523: Gate 5's Python coverage parsing and threshold verdict. The old
+# `grep -o '[0-9]*%'` never matched --format=total's bare number, so the 80%
+# branch never ran; sourced as a library so the fail-closed contract is
+# unit-testable without executing this hook.
+source "${AUDIT_SCRIPT_DIR}/lib/coverage-total.sh"
+
 # Read max_duration_ms from .xp-gate-config.json (default 7200000 = 2 hours)
 _MAX_DURATION_MS=$(node -e "try{const c=JSON.parse(require('fs').readFileSync('${PROJECT_ROOT_FOR_AUDIT}/.xp-gate-config.json','utf8'));console.log((c.audit&&c.audit.max_duration_ms)||7200000);}catch(e){console.log(7200000);}" 2>/dev/null || echo "7200000")
 
@@ -710,6 +716,39 @@ if [ -z "$PROJECT_LANGS" ] && [ -z "$_CONFIG_LANGS" ]; then
       done
       return 1
     }
+    # #527: two ecosystems whose MULTI-module layouts normally carry a root
+    # marker, so a root marker alone cannot prove "single project":
+    #   - Gradle: root build.gradle(.kts) + settings.gradle(.kts) with include
+    #   - CMake:  root CMakeLists.txt + a nested */CMakeLists.txt
+    # Both probes are bounded (two file reads for Gradle; one maxdepth-7 find
+    # for CMake — MC-05, no new unbounded scan) and only run once a root marker
+    # is present. A false positive keeps derivation ON — the #515 default —
+    # so the failure direction is never a false BLOCK.
+    _gradle_multi_module_root() {
+      local _sg
+      for _sg in settings.gradle settings.gradle.kts; do
+        # include ':app' (Groovy) / include(":app") (Kotlin DSL). The char
+        # class anchors on the token after `include`, so `includeBuild` and
+        # comment prose cannot false-positive.
+        if [ -f "$_sg" ] && grep -qE "include[[:space:]]*['\"(]" "$_sg" 2>/dev/null; then
+          return 0
+        fi
+      done
+      return 1
+    }
+    _cmake_multi_module_root() {
+      [ -f "CMakeLists.txt" ] || return 1
+      # A nested CMakeLists.txt (depth 2..7 below the root) means the root file
+      # is a wiring file, not the whole project.
+      # -prune, not -not -path: filters the output AND stops traversal, so
+      # .git/node_modules are never descended into — the old form walked the
+      # whole tree on every commit of a repo that has both a root
+      # CMakeLists.txt and a big node_modules (#532 walkthrough FC-04).
+      # -mindepth is deliberately absent (a global -mindepth suppresses the
+      # depth-1 prune action); the root file is excluded by the awk NF>2
+      # filter instead (./CMakeLists.txt has no directory component).
+      [ -n "$(find . -maxdepth 7 \( -path '*/.git' -o -path '*/node_modules' \) -prune -o -name "CMakeLists.txt" -print 2>/dev/null | awk -F/ 'NF>2' | head -1)" ]
+    }
     # #515: when the repo ROOT itself declares the project, a nested marker that
     # is merely a module file (skill_cert/cli/setup.py incident) must not hijack
     # PROJECT_SUBDIR — Gates 1-9 would run from the wrong cwd and false-BLOCK on
@@ -719,9 +758,12 @@ if [ -z "$PROJECT_LANGS" ] && [ -z "$_CONFIG_LANGS" ]; then
     # check runs FIRST (#515 R2 delphi walkthrough): a root package.json with a
     # "workspaces" key declares a JS monorepo (often together with a shared
     # tsconfig.json), not a single project, so derivation keeps running there.
-    # Known limitation (#527): Gradle multi-module, CMake subdirectories and
-    # pnpm/Lerna workspaces are not disambiguated from single projects yet —
-    # see the pinned BATS case.
+    # #527 (resolved): Gradle multi-module and CMake subdirectory layouts are
+    # disambiguated by the predicates above; the short-circuit now applies to
+    # genuinely single-project roots. pnpm/Lerna workspaces remain a known
+    # limitation (no probe yet). Migration: repos that depended on the old
+    # short-circuit set XP_GATE_ROOT_SHORTCIRCUIT=1 (or delete the root
+    # marker); see githooks/__tests__/issue-527-subdir-multimodule.test.bats.
     _skip_subdir_derive=0
     if [ -f package.json ] && grep -q '"workspaces":' package.json 2>/dev/null; then
       _skip_subdir_derive=0 # JS monorepo root: subproject derivation stays on
@@ -729,7 +771,16 @@ if [ -z "$PROJECT_LANGS" ] && [ -z "$_CONFIG_LANGS" ]; then
          [ -f setup.py ] || [ -f go.mod ] || [ -f pubspec.yaml ] || \
          [ -f pom.xml ] || [ -f build.gradle ] || \
          [ -f build.gradle.kts ] || [ -f CMakeLists.txt ]; then
-      _skip_subdir_derive=1
+      # #527: before short-circuiting, ask whether the root marker declares
+      # MODULES (Gradle settings include / nested CMakeLists) rather than one
+      # project. The override restores the pre-#527 behavior explicitly.
+      if [ "${XP_GATE_ROOT_SHORTCIRCUIT:-0}" = "1" ]; then
+        _skip_subdir_derive=1
+      elif _gradle_multi_module_root || _cmake_multi_module_root; then
+        _skip_subdir_derive=0 # root marker declares modules — keep deriving
+      else
+        _skip_subdir_derive=1
+      fi
     fi
     _subdir_set=""
     if [ "$_skip_subdir_derive" -eq 0 ]; then
@@ -2267,7 +2318,23 @@ else
           ;;
         "python")
           if command -v pytest &> /dev/null && command -v coverage &> /dev/null; then
-            pytest --cov=. --cov-fail-under=80 --tb=short
+            # Issue #45 (merged in #514, replacing a machine-side hotfix that
+            # kept drifting out of the repo — the exact class #514 exists to
+            # kill). BOTH the scope and the threshold must come from the
+            # target repo's pyproject.toml ([tool.coverage.run] source,
+            # [tool.coverage.report] fail_under — e.g. source=["src"],
+            # fail_under=82): a hardcoded `--cov=. --cov-fail-under=80` counts
+            # tests/ into the denominator and produced a measured 76.49%
+            # false-red BLOCKED. tomllib first; a repo declaring neither gets
+            # the historical `--cov=. --cov-fail-under=80` behavior verbatim.
+            PY_COV_SOURCE=$(python -c "import tomllib;print(' '.join('--cov='+s for s in tomllib.load(open('pyproject.toml','rb'))['tool']['coverage']['run'].get('source',[])))" 2>/dev/null || echo "")
+            PY_COV_FAIL_UNDER=$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['tool']['coverage']['report']['fail_under'])" 2>/dev/null || echo "")
+            if [ -z "$PY_COV_FAIL_UNDER" ]; then
+              PY_COV_FAIL_UNDER=$(grep -oE 'fail_under *= *[0-9]+' pyproject.toml 2>/dev/null | grep -oE '[0-9]+' | head -1)
+            fi
+            [ -z "$PY_COV_SOURCE" ] && PY_COV_SOURCE="--cov=."
+            [ -z "$PY_COV_FAIL_UNDER" ] && PY_COV_FAIL_UNDER=80
+            pytest $PY_COV_SOURCE --cov-fail-under="$PY_COV_FAIL_UNDER" --tb=short
             COV_EXIT=$?
           else
             echo "pytest/coverage not available, running coverage via adapter..."
@@ -2361,26 +2428,11 @@ else
       ;;
     "python")
       COVERAGE_ENFORCED=true
-      if command -v coverage &> /dev/null; then
-        COVERAGE_PERCENT=""
-        if [ -f ".coverage" ]; then
-          COVERAGE_PERCENT=$(coverage report --format=total 2>/dev/null | grep -o '[0-9]*%' | head -1 | tr -d '%') || true
-        fi
-        if [ -z "$COVERAGE_PERCENT" ] && [ -f "coverage/.coverage" ]; then
-          COVERAGE_PERCENT=$(coverage report --format=total -i coverage 2>/dev/null | grep -o '[0-9]*%' | head -1 | tr -d '%') || true
-        fi
-        if [ -n "$COVERAGE_PERCENT" ]; then
-          if [ "$COVERAGE_PERCENT" -lt 80 ]; then
-            echo "❌ BLOCKED - Python coverage ${COVERAGE_PERCENT}% below 80% threshold"
-            exit 1
-          fi
-          echo "Python coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
-        else
-          echo "⚠️  Could not determine Python coverage percentage. Ensure pytest-cov or coverage.py data exists."
-        fi
-      else
-        echo "⚠️  coverage.py not available, cannot enforce Python coverage threshold."
-      fi
+      # Issue #523: parsing + threshold verdict live in lib/coverage-total.sh
+      # (the old `grep -o '[0-9]*%'` never matched --format=total's bare
+      # number, so this branch never reached the threshold). Returns 1 on
+      # BLOCK after echoing the verdict.
+      enforce_python_coverage || exit 1
       ;;
     "java")
       COVERAGE_ENFORCED=true
@@ -3143,8 +3195,17 @@ else
   GATE_11_STATUS="SKIP"
 fi
 
-GATE_11_END=$(date +%s)
-GATE_11_DURATION=$((GATE_11_END - GATE_11_START))
+# Issue #524: pair the units. gate_start_ms is epoch MILLISECONDS (#370 helper);
+# the old `date +%s` end was epoch SECONDS, so the subtraction printed about
+# -1.79e12 s and poisoned .xp-gate/reports/pre-commit/*.json. now_ms is the same
+# helper gate_start_ms delegates to; display divides by 1000.
+GATE_11_END=$(now_ms)
+GATE_11_DURATION_MS=$((GATE_11_END - GATE_11_START))
+if [ "$GATE_11_DURATION_MS" -lt 0 ] 2>/dev/null; then
+  # Clock skew or a poisoned timestamp must not print a negative runtime.
+  GATE_11_DURATION_MS=0
+fi
+GATE_11_DURATION=$((GATE_11_DURATION_MS / 1000))
 echo "   Gate 11 ($GATE_11_STATUS) completed in ${GATE_11_DURATION}s"
 record_gate_audit "gate-11" "sprint-flow" "$GATE_11_STATUS" "0" "$GATE_11_START"
 echo ""

package/hooks/pre-push

@@ -49,6 +49,7 @@ report = {
     'verdict': '$verdict',
   },
   'gates': [
+    {'id': 'MP', 'name': 'Gate-Script Mirror Parity', 'status': '${GATE_MP_STATUS:-SKIP}', 'details': {}},
     {'id': '10', 'name': 'Build Integrity', 'status': '${GATE_10_STATUS:-SKIP}', 'details': {}},
     {'id': 'M', 'name': 'Mutation Testing', 'status': '${GATE_M_STATUS:-SKIP}', 'details': {}},
     {'id': 'M-Python', 'name': 'Mutation Testing (Python)', 'status': '${GATE_M_PYTHON_STATUS:-SKIP}', 'details': {}},
@@ -167,6 +168,37 @@ if [ "$DOC_ONLY" = "true" ]; then
   exit 0
 fi
 
+# ============================================================================
+# GATE MP: GATE-SCRIPT MIRROR PARITY (#532 / REQ-A-02 / AC-A-02-04)
+# ============================================================================
+# The npm package ships byte mirrors of every gate script (package root,
+# hooks/, adapters/). A canonical edit without `sync-package-content.js --fix`
+# ships stale copies silently — the #532 SAST verdict fix almost shipped that
+# way (the fix landed on gate-10.sh while three fallback copies kept the
+# #518 defects). Push is the moment code leaves the machine, so the parity
+# guard runs here (fail-closed) and in CI's mirror-parity job. Read-only:
+# compares bytes and git index modes; heals nothing.
+GATE_MP_STATUS="SKIP"
+MP_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
+if [ -f "$MP_ROOT/scripts/check-hook-mirror.sh" ]; then
+  if (cd "$MP_ROOT" && bash scripts/check-hook-mirror.sh); then
+    GATE_MP_STATUS="PASS"
+    echo "✅ Gate MP: gate-script mirror parity OK"
+  else
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo "   ❌ GATE MP FAILED — PUSH BLOCKED"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo "A gate script changed without its npm-package mirrors being synced."
+    echo "Fix locally: node src/npm-package/scripts/sync-package-content.js --fix"
+    echo "Then commit the mirrors and push again."
+    exit 1
+  fi
+else
+  echo "⚠️ Gate MP: check-hook-mirror.sh not found. SKIP — Gate MP."
+fi
+echo ""
+
 # Size limits check — REMOVED: AI workflows generate large cumulative pushes; size is not a quality signal
   DIFF_STATS=$(git diff origin/main...HEAD --stat 2>/dev/null || git diff origin/master...HEAD --stat 2>/dev/null)
   FILES_CHANGED=$(echo "$DIFF_STATS" | tail -1 | grep -oE '[0-9]+ file' | grep -oE '[0-9]+' || echo "0")