@boyingliu01/xp-gate 0.27.1 → 0.27.3

package/adapters/gate-7.sh

@@ -14,10 +14,28 @@ if [ -z "$IAC_FILES" ]; then
   echo "✅ PASSED - No IaC files detected in changes."
   GATE_7_STATUS="PASS"
 else
-  # Run IaC adapter
-  if [ -f "githooks/adapters/iac.sh" ]; then
-    # shellcheck source=githooks/adapters/iac.sh
-    source "githooks/adapters/iac.sh"
+  # Run IaC adapter. Resolution follows the documented 3-tier convention
+  # (adapter-common.sh): global ~/.config/xp-gate/adapters -> project
+  # githooks/adapters -> script dir. The old cwd-only test silently SKIPped
+  # IaC security in every consumer repo without an in-repo githooks/ dir,
+  # even with the adapter installed globally (e2e sweep 2026-10-17; pinned
+  # by __tests__/gate-7-adapter-resolution.test.bats).
+  IAC_ADAPTER=""
+  for _candidate in \
+    "$HOME/.config/xp-gate/adapters/iac.sh" \
+    "githooks/adapters/iac.sh" \
+    "${SCRIPT_DIR:-}/adapters/iac.sh"; do
+    if [ -n "$_candidate" ] && [ -f "$_candidate" ]; then
+      IAC_ADAPTER="$_candidate"
+      break
+    fi
+  done
+  if [ -n "$IAC_ADAPTER" ]; then
+    # Audit trail: which tier won (r14 walkthrough MAJ-02 — a silent tier-order
+    # regression must be visible in the gate output, not only in test diffs).
+    echo "   IaC adapter resolved from: $IAC_ADAPTER"
+    # shellcheck source=/dev/null
+    source "$IAC_ADAPTER"
     
     # Run static analysis for IaC files
     IAC_OUTPUT=$(run_static_analysis "$IAC_FILES" 2>&1)

package/adapters/java.sh

@@ -111,13 +111,23 @@ wc_java_json_violation_count() {
   local json_file="$1"
   [ -s "$json_file" ] || return 1
 
-  # Array-shaped: opens with [ and closes with ]. (A bare [] is valid clean
-  # output; an object wrapper is outside the pinned contract.)
-  [ "$(head -c 1 "$json_file")" = "[" ] || return 1
-  local tail
+  # Two shapes are accepted, each closed by its own bracket:
+  #   - bare array `[ ... ]` — the originally pinned contract ([] = clean);
+  #   - object wrapper `{ ..., "issues": [ ... ] }` — what wc-java-lint 0.4.x
+  #     actually emits ({summary, issues}). Rejecting it fail-closed every
+  #     real Java commit on well-formed JSON (e2e sweep 2026-10-17; pinned by
+  #     __tests__/issue-507-wc-java-object-json.test.bats). A truncated
+  #     response still fails its closing-bracket test -> BLOCK.
+  local head1 tail shape
+  head1=$(head -c 1 "$json_file")
   tail=$(tr -d '[:space:]' < "$json_file" | tail -c 1)
-  [ "$tail" = "]" ] || return 1
+  case "$head1" in
+    "[") shape=array;  [ "$tail" = "]" ] || return 1 ;;
+    "{") shape=object; [ "$tail" = "}" ] || return 1 ;;
+    *) return 1 ;;
+  esac
 
+  local structural obj_count file_count rule_count sev_count
   # Strip string VALUE literals (`: "..."` -> `: ""`). Keys must survive
   # (they are the tokens being counted); values must vanish (violation
   # messages routinely contain braces or the words file/rule/severity --
@@ -131,8 +141,60 @@ wc_java_json_violation_count() {
   # variant either fails to strip values (count desync -> BLOCK, annoying but
   # safe) or, worst case, errors to empty counts and disarms the lying-tool
   # BLOCK below (fail-open). Delphi round-2 A-MAJOR-2.
-  local structural obj_count file_count rule_count sev_count
   structural=$(sed -E 's/:([[:space:]]*)"([^"\\]|\\.)*"/:\1""/g' "$json_file" 2>/dev/null)
+
+  if [ "$shape" = "object" ]; then
+    # Object wrapper ({summary, issues}). Parse the ISSUES ARRAY exactly with
+    # brace-depth tracking (issues are JSON objects, so a record ends exactly
+    # where its nesting returns to the array level). For each record: all
+    # three keys must be present exactly once. A key outside any record —
+    # e.g. split triples in sibling objects, the lying-tool shape of r14
+    # CI-02 — makes the per-record key totals disagree with the global
+    # stripped counts -> BLOCK. Values were stripped first so braces inside
+    # messages cannot skew the depth.
+    file_count=$(grep -o '"file"' <<< "$structural" | wc -l | tr -d '[:space:]')
+    rule_count=$(grep -o '"rule"' <<< "$structural" | wc -l | tr -d '[:space:]')
+    sev_count=$(grep -o '"severity"' <<< "$structural" | wc -l | tr -d '[:space:]')
+    [ "$file_count" -eq "$rule_count" ] || return 1
+    [ "$file_count" -eq "$sev_count" ] || return 1
+    # Everything from the "issues" member onward (the tool emits it last; if
+    # a future format moves it, keys before it fall outside record parsing ->
+    # sum mismatch -> BLOCK, fail closed). Flatten to one line first: real
+    # output is pretty-printed across lines.
+    flattened=$(tr '\n' ' ' <<< "$structural")
+    tail_from_issues=$(sed -n 's/.*"issues"[[:space:]]*:[[:space:]]*\[/\n/p' <<< "$flattened")
+    [ -n "$tail_from_issues" ] || return 1
+    records=$(awk '
+      { rest = $0
+        depth = 0; rec = ""
+        for (i = 1; i <= length(rest); i++) {
+          c = substr(rest, i, 1)
+          if (depth == 0 && c == "]") break
+          if (c == "{") { depth++; if (depth == 1) { rec = ""; continue } }
+          if (c == "}") { depth--; if (depth == 0) { print rec; continue } }
+          if (depth >= 1) rec = rec c
+        }
+      }' <<< "$tail_from_issues")
+    rec_count=0
+    rf=0; rr=0; rs=0
+    while IFS= read -r _rec; do
+      [ -n "$_rec" ] || continue
+      cf=$(grep -o '"file"' <<< "$_rec" | wc -l | tr -d '[:space:]')
+      cr=$(grep -o '"rule"' <<< "$_rec" | wc -l | tr -d '[:space:]')
+      cs=$(grep -o '"severity"' <<< "$_rec" | wc -l | tr -d '[:space:]')
+      [ "$cf" -eq 1 ] || return 1
+      [ "$cr" -eq 1 ] || return 1
+      [ "$cs" -eq 1 ] || return 1
+      rf=$((rf + cf)); rr=$((rr + cr)); rs=$((rs + cs))
+      rec_count=$((rec_count + 1))
+    done <<< "$records"
+    [ "$rf" -eq "$file_count" ] || return 1
+    [ "$rr" -eq "$rule_count" ] || return 1
+    [ "$rs" -eq "$sev_count" ] || return 1
+    echo "$rec_count"
+    return 0
+  fi
+
   obj_count=$(grep -o '{' <<< "$structural" | wc -l | tr -d '[:space:]')
   file_count=$(grep -o '"file"' <<< "$structural" | wc -l | tr -d '[:space:]')
   rule_count=$(grep -o '"rule"' <<< "$structural" | wc -l | tr -d '[:space:]')

package/gate-7.sh

@@ -14,10 +14,28 @@ if [ -z "$IAC_FILES" ]; then
   echo "✅ PASSED - No IaC files detected in changes."
   GATE_7_STATUS="PASS"
 else
-  # Run IaC adapter
-  if [ -f "githooks/adapters/iac.sh" ]; then
-    # shellcheck source=githooks/adapters/iac.sh
-    source "githooks/adapters/iac.sh"
+  # Run IaC adapter. Resolution follows the documented 3-tier convention
+  # (adapter-common.sh): global ~/.config/xp-gate/adapters -> project
+  # githooks/adapters -> script dir. The old cwd-only test silently SKIPped
+  # IaC security in every consumer repo without an in-repo githooks/ dir,
+  # even with the adapter installed globally (e2e sweep 2026-10-17; pinned
+  # by __tests__/gate-7-adapter-resolution.test.bats).
+  IAC_ADAPTER=""
+  for _candidate in \
+    "$HOME/.config/xp-gate/adapters/iac.sh" \
+    "githooks/adapters/iac.sh" \
+    "${SCRIPT_DIR:-}/adapters/iac.sh"; do
+    if [ -n "$_candidate" ] && [ -f "$_candidate" ]; then
+      IAC_ADAPTER="$_candidate"
+      break
+    fi
+  done
+  if [ -n "$IAC_ADAPTER" ]; then
+    # Audit trail: which tier won (r14 walkthrough MAJ-02 — a silent tier-order
+    # regression must be visible in the gate output, not only in test diffs).
+    echo "   IaC adapter resolved from: $IAC_ADAPTER"
+    # shellcheck source=/dev/null
+    source "$IAC_ADAPTER"
     
     # Run static analysis for IaC files
     IAC_OUTPUT=$(run_static_analysis "$IAC_FILES" 2>&1)

package/hooks/gate-7.sh

@@ -14,10 +14,28 @@ if [ -z "$IAC_FILES" ]; then
   echo "✅ PASSED - No IaC files detected in changes."
   GATE_7_STATUS="PASS"
 else
-  # Run IaC adapter
-  if [ -f "githooks/adapters/iac.sh" ]; then
-    # shellcheck source=githooks/adapters/iac.sh
-    source "githooks/adapters/iac.sh"
+  # Run IaC adapter. Resolution follows the documented 3-tier convention
+  # (adapter-common.sh): global ~/.config/xp-gate/adapters -> project
+  # githooks/adapters -> script dir. The old cwd-only test silently SKIPped
+  # IaC security in every consumer repo without an in-repo githooks/ dir,
+  # even with the adapter installed globally (e2e sweep 2026-10-17; pinned
+  # by __tests__/gate-7-adapter-resolution.test.bats).
+  IAC_ADAPTER=""
+  for _candidate in \
+    "$HOME/.config/xp-gate/adapters/iac.sh" \
+    "githooks/adapters/iac.sh" \
+    "${SCRIPT_DIR:-}/adapters/iac.sh"; do
+    if [ -n "$_candidate" ] && [ -f "$_candidate" ]; then
+      IAC_ADAPTER="$_candidate"
+      break
+    fi
+  done
+  if [ -n "$IAC_ADAPTER" ]; then
+    # Audit trail: which tier won (r14 walkthrough MAJ-02 — a silent tier-order
+    # regression must be visible in the gate output, not only in test diffs).
+    echo "   IaC adapter resolved from: $IAC_ADAPTER"
+    # shellcheck source=/dev/null
+    source "$IAC_ADAPTER"
     
     # Run static analysis for IaC files
     IAC_OUTPUT=$(run_static_analysis "$IAC_FILES" 2>&1)