@boyingliu01/xp-gate 0.27.6 → 0.28.0

package/gate-10.sh

@@ -53,12 +53,31 @@ else
     # lines to `read`; bash never rescans the result for separators. Its correct
     # reading rests on one property of the producer above, not of the loop:
     # `git diff --cached --name-only` terminates paths with LF and quotes control
-    # characters (a CR in a name arrives as the four bytes \215, never as a bare
-    # CR), so one line is exactly one path. Asserted for spaces and a leading '-'
     # by AC-490-04.
+    #
+    # #543: semgrep 1.171 ignores .semgrepignore ENTIRELY when files are passed
+    # as explicit targets (measured: file target -> an ignored finding survives
+    # every suppression form — ignore patterns, --exclude, --exclude-rule,
+    # --project-root; directory target + --include -> the ignore file is honored,
+    # proven fail-closed by removing it and watching the findings return). The
+    # gate therefore passes each staged file's DIRECTORY as a target plus one
+    # --include per staged basename. Coverage stays exact for the staged set
+    # (verified: scanned == staged); the only widening is same-basename siblings
+    # outside the staged set, which scan too — scanning MORE is the safe side.
     SEMGREP_ARGS=()
+    SEMGREP_FILE_COUNT=0
+    SEMGREP_DIRS_SEEN=$'\n'
     while IFS= read -r _semgrep_file; do
-      [ -n "$_semgrep_file" ] && SEMGREP_ARGS+=("./$_semgrep_file")
+      [ -n "$_semgrep_file" ] || continue
+      SEMGREP_FILE_COUNT=$((SEMGREP_FILE_COUNT + 1))
+      SEMGREP_ARGS+=("--include=${_semgrep_file##*/}")
+      _semgrep_dir="./${_semgrep_file%/*}"
+      # A repo-root file has no directory component ("./x.ts" strips to "./").
+      [ "$_semgrep_dir" = "./" ] && _semgrep_dir="."
+      case "$SEMGREP_DIRS_SEEN" in
+        *"$_semgrep_dir"*) : ;;
+        *) SEMGREP_ARGS+=("$_semgrep_dir"); SEMGREP_DIRS_SEEN="$SEMGREP_DIRS_SEEN$_semgrep_dir"$'\n' ;;
+      esac
     done <<EOF
 $SEMGREP_FILES
 EOF
@@ -173,12 +192,12 @@ console.log("");});
       echo "$FINDING_DETAILS"
       echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
       GATE_10_STATUS="FAIL"
-      GATE_10_SCANNED_FILES=${#SEMGREP_ARGS[@]}
+      GATE_10_SCANNED_FILES=$SEMGREP_FILE_COUNT
       exit 1
     else
-      GATE_10_SCANNED_FILES=${#SEMGREP_ARGS[@]}
+      GATE_10_SCANNED_FILES=$SEMGREP_FILE_COUNT
       echo ""
-      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: ${#SEMGREP_ARGS[@]})"
+      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: $SEMGREP_FILE_COUNT)"
       if [ "$V_WARNINGS" -gt 0 ]; then
         echo "     ⚠️  ${V_WARNINGS} non-blocking findings (warnings only)"
         echo "$FINDING_DETAILS"

package/gate-12-file-hygiene.sh

@@ -25,11 +25,20 @@ if [ -z "$STAGED_FILES" ]; then
   return 0 2>/dev/null || true
 fi
 
+# REQ-F2: a docs-only commit cannot introduce code regressions; conflict
+# markers and YAML/JSON syntax are still checked (diff-scoped below).
+if [ "${DOCS_ONLY_COMMIT:-false}" = true ]; then
+  echo "     ⏭️  SKIPPED - File hygiene heavy checks (documentation-only commit; diff-scoped checks still run)."
+  GATE_12_STATUS="SKIP"
+  GATE_12_DOCS_ONLY=true
+fi
+
 HYGIENE_ISSUES=0
 HYGIENE_FILES=""
 
 # --- Check 1: Trailing whitespace ---
 TRAILING_WS_FILES=""
+if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files by checking if file contains null bytes
@@ -43,6 +52,7 @@ while IFS= read -r file; do
 done <<EOF
 $STAGED_FILES
 EOF
+fi
 
 if [ -n "$TRAILING_WS_FILES" ]; then
   echo "     ⚠️  Trailing whitespace detected in:"
@@ -55,6 +65,7 @@ fi
 
 # --- Check 2: Missing EOF newline ---
 NO_EOF_NEWLINE_FILES=""
+if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
@@ -72,6 +83,7 @@ while IFS= read -r file; do
 done <<EOF
 $STAGED_FILES
 EOF
+fi
 
 if [ -n "$NO_EOF_NEWLINE_FILES" ]; then
   echo "     ⚠️  Missing EOF newline in:"
@@ -83,7 +95,16 @@ if [ -n "$NO_EOF_NEWLINE_FILES" ]; then
 fi
 
 # --- Check 3: Merge conflict markers ---
+# Runs in BOTH modes. Docs-only commits read the staged DIFF (hunk cost)
+# instead of every full blob — a marker line must be ADDED to matter, so
+# '^+' minus '+++' headers is the precise scope.
 CONFLICT_MARKER_FILES=""
+if [ "${GATE_12_DOCS_ONLY:-false}" = true ]; then
+  if git diff --cached --no-color --diff-filter=d 2>/dev/null \
+      | grep -E '^\+' | grep -v '^+++' | grep -qE '^\+(<<<<<<<|=======|>>>>>>>)'; then
+    CONFLICT_MARKER_FILES="$STAGED_FILES"
+  fi
+else
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
@@ -97,6 +118,7 @@ while IFS= read -r file; do
 done <<EOF
 $STAGED_FILES
 EOF
+fi
 
 if [ -n "$CONFLICT_MARKER_FILES" ]; then
   echo "     ❌ Merge conflict markers detected in:"
@@ -109,6 +131,7 @@ fi
 
 # --- Check 4: Oversized files ---
 OVERSIZED_FILES=""
+if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   [ ! -f "$file" ] && continue
@@ -120,6 +143,7 @@ while IFS= read -r file; do
 done <<EOF
 $STAGED_FILES
 EOF
+fi
 
 if [ -n "$OVERSIZED_FILES" ]; then
   echo "     ⚠️  Oversized files (>${MAX_FILE_SIZE_BYTES} bytes):"
@@ -150,6 +174,10 @@ elif command -v jq >/dev/null 2>&1; then
   JSON_CMD="jq"
 fi
 
+# Check which staged YAML/JSON files actually changed (REQ-F3: a repo with 40
+# YAML configs but one edited file validates ONE blob, not forty).
+CHANGED_YAML_JSON=$(git diff --cached --name-only --diff-filter=d -- '*.yml' '*.yaml' '*.json' 2>/dev/null)
+
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   [ ! -f "$file" ] && continue
@@ -192,7 +220,7 @@ let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{JSON.p
       ;;
   esac
 done <<EOF
-$STAGED_FILES
+$CHANGED_YAML_JSON
 EOF
 
 if [ -n "$YAML_JSON_ERRORS" ]; then
@@ -207,6 +235,12 @@ elif [ "$YAML_JSON_CHECK_COUNT" -gt 0 ]; then
 fi
 
 # --- Result ---
+if [ "${GATE_12_DOCS_ONLY:-false}" = true ] && [ "$HYGIENE_ISSUES" -eq 0 ]; then
+  echo "     ✅ PASSED - File Hygiene (docs-only commit: diff-scoped conflict-marker + YAML/JSON checks clean)."
+  GATE_12_STATUS="PASS"
+  record_gate_audit "gate-12" "file-hygiene" "$GATE_12_STATUS" "0" "$GATE_12_START" "" "docs_only_change"
+  return 0 2>/dev/null || true
+fi
 if [ "$HYGIENE_ISSUES" -eq 0 ]; then
   echo "     ✅ PASSED - No file hygiene issues detected."
   GATE_12_STATUS="PASS"

package/gate-3.sh

@@ -92,7 +92,76 @@ else
         [ -n "$_cc_file" ] && CC_FILES_ARGS+=("$_cc_file")
       done <<< "$CC_FILES"
       CC_OUTPUT=$("$LIZARD_PATH" -C "$CCN_THRESHOLD" ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>&1 || true)
-      
+
+      # REQ-D (sprint-20261018-quality): baseline ratchet. When
+      # .ccn-baseline.json exists it replaces the flat threshold verdict:
+      # recorded functions may not get WORSE (strictly greater blocks), new
+      # functions face the live thresholds, improvements only hint. The
+      # legacy path below stays byte-for-byte for repos without a baseline.
+      if [ -f ".ccn-baseline.json" ]; then
+        # #544: lizard's raw CCN is not what the baseline was recorded with.
+        # The baseline comes from scripts/ccn-report.cjs, which re-derives every
+        # above-threshold CCN from brace-balanced source (lizard's TS parser
+        # loses braces on generic-arrow fields and charges neighbours). Feeding
+        # the ratchet raw numbers compared two different engines — a function
+        # at its recorded ceiling read as "worse" purely from span inflation.
+        # Route the CSV through the same verifier; on rows it cannot verify the
+        # helper exits non-zero, and this gate fails closed instead of passing
+        # an unvalidated number.
+        CC_CSV=$("$LIZARD_PATH" --csv ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>/dev/null || true)
+        CC_REPORT="$(git rev-parse --show-toplevel 2>/dev/null)/scripts/ccn-report.cjs"
+        # Fail closed when the verifier is unavailable. Previously this fell
+        # through and graded the RAW lizard CSV, while CI hard-fails on the same
+        # condition — so the hook and CI could reach opposite verdicts on
+        # identical code, and the hook silently compared baseline numbers
+        # (recorded by ccn-report's brace-verified engine) against an engine it
+        # no longer had. Agreeing with CI is the point of having both.
+        if [ ! -f "$CC_REPORT" ] || ! command -v node >/dev/null 2>&1; then
+          echo "❌ BLOCKED - complexity verifier unavailable (scripts/ccn-report.cjs needs node)."
+          echo "CI fails on this same condition; refusing to grade unverified CCN locally."
+          GATE_3_DETAIL="mode=ratchet verifier=MISSING"
+          exit 1
+        fi
+        if [ -f "$CC_REPORT" ] && command -v node >/dev/null 2>&1; then
+          _cc_verify_failed=0
+          CC_CSV_VERIFIED=$(printf '%s\n' "$CC_CSV" | node "$CC_REPORT" --csv-verified batch --root "$(git rev-parse --show-toplevel 2>/dev/null)") || _cc_verify_failed=1
+          if [ "$_cc_verify_failed" -ne 0 ]; then
+            echo "❌ BLOCKED - complexity could not be span-verified; refusing to grade unverified CCN."
+            GATE_3_DETAIL="mode=ratchet verify=FAILED"
+            exit 1
+          fi
+          CC_CSV="$CC_CSV_VERIFIED"
+        fi
+        RATCHET_LIB="$GATE_DIR/lib/ccn-ratchet.sh"
+        [ -f "$RATCHET_LIB" ] || RATCHET_LIB="$(git rev-parse --show-toplevel 2>/dev/null)/githooks/lib/ccn-ratchet.sh"
+        # shellcheck source=/dev/null
+        . "$RATCHET_LIB"
+        # NOTE: the thresholds must be plain assignments BEFORE the pipe. As a
+        # prefix to a variable assignment (`T=1 V=$(... | fn)`) they land in the
+        # assignment's subshell, so the function sees no thresholds AND reads an
+        # empty stdin — the verdict comes back empty and Gate 3 passes on zero
+        # rows (measured while wiring #544: same input passed or blocked
+        # depending only on where the prefix sat).
+        CCN_WARN_THRESHOLD="$CCN_THRESHOLD"
+        CCN_BLOCK_THRESHOLD=$((CCN_THRESHOLD * 2))
+        RATCHET_VERDICT=$(printf '%s\n' "$CC_CSV" | evaluate_ccn_ratchet ".ccn-baseline.json")
+        CC_VIOLATIONS=$(printf '%s\n' "$RATCHET_VERDICT" | grep -c '^BLOCK ' || true)
+        CC_LOWER=$(printf '%s\n' "$RATCHET_VERDICT" | grep -c '^LOWER ' || true)
+        printf '%s\n' "$RATCHET_VERDICT" | grep -v '^OK ' || true
+        if [ "${CC_LOWER:-0}" -gt 0 ]; then
+          echo "ℹ️  $CC_LOWER function(s) improved below baseline — refresh with: node scripts/ccn-report.cjs --write-baseline"
+        fi
+        GATE_3_DETAIL="mode=ratchet"
+        if [ "${CC_VIOLATIONS:-0}" -gt 0 ]; then
+          echo ""
+          echo "❌ BLOCKED - $CC_VIOLATIONS function(s) violate the complexity ratchet (.ccn-baseline.json)."
+          echo "Revert the increase, or refactor; refresh the baseline only via ccn-baseline-refresh commits."
+          exit 1
+        else
+          echo "✅ PASSED - Complexity within ratchet baseline."
+          GATE_3_STATUS="PASS"
+        fi
+      else
       # Parse warning count from the summary table: "Warning cnt   8"
       # Use anchored grep to avoid matching lizard table headers (e.g. "Rt" column)
       CC_WARNINGS=$(echo "$CC_OUTPUT" | grep "^Warning cnt" | awk '{print $NF}' | tr -d '[:space:]' | sed 's/[^0-9]//g' || true)
@@ -108,6 +177,7 @@ else
         echo "✅ PASSED - All functions within complexity threshold ($CCN_THRESHOLD)."
         GATE_3_STATUS="PASS"
       fi
+      fi
     else
       echo "⏭️  SKIPPED - Complexity (no source files to check)."
       GATE_3_STATUS="SKIP"
@@ -121,4 +191,10 @@ else
     GATE_3_REASON="tool_not_installed"
   fi
 fi
-record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "${CC_WARNINGS:-0}" "$GATE_3_START" "ccn_threshold=${CCN_THRESHOLD:-5}"
+# The audit's issues_found comes from whichever mode actually ran. In ratchet
+# mode the count lives in CC_VIOLATIONS (functions worse than their recorded
+# baseline); the flat-threshold mode parses CC_WARNINGS from lizard's own table.
+# Reading only CC_WARNINGS meant every ratchet block recorded issues_found=0 —
+# the gate failed while the journal claimed nothing was found.
+CC_ISSUES="${CC_VIOLATIONS:-${CC_WARNINGS:-0}}"
+record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "$CC_ISSUES" "$GATE_3_START" "ccn_threshold=${CCN_THRESHOLD:-5}${GATE_3_DETAIL:+ $GATE_3_DETAIL}"

package/gate-9.sh

@@ -57,8 +57,19 @@ else
     # CR), so one line is exactly one path. Asserted for spaces and a leading '-'
     # by AC-490-04.
     SEMGREP_ARGS=()
+    SEMGREP_FILE_COUNT=0
+    SEMGREP_DIRS_SEEN=$'\n'
     while IFS= read -r _semgrep_file; do
-      [ -n "$_semgrep_file" ] && SEMGREP_ARGS+=("./$_semgrep_file")
+      [ -n "$_semgrep_file" ] || continue
+      SEMGREP_FILE_COUNT=$((SEMGREP_FILE_COUNT + 1))
+      SEMGREP_ARGS+=("--include=${_semgrep_file##*/}")
+      _semgrep_dir="./${_semgrep_file%/*}"
+      # A repo-root file has no directory component ("./x.ts" strips to "./").
+      [ "$_semgrep_dir" = "./" ] && _semgrep_dir="."
+      case "$SEMGREP_DIRS_SEEN" in
+        *"$_semgrep_dir"*) : ;;
+        *) SEMGREP_ARGS+=("$_semgrep_dir"); SEMGREP_DIRS_SEEN="$SEMGREP_DIRS_SEEN$_semgrep_dir"$'\n' ;;
+      esac
     done <<EOF
 $SEMGREP_FILES
 EOF
@@ -173,7 +184,7 @@ console.log("");});
       exit 1
     else
       echo ""
-      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: ${#SEMGREP_ARGS[@]})"
+      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: $SEMGREP_FILE_COUNT)"
       if [ "$V_WARNINGS" -gt 0 ]; then
         echo "     ⚠️  ${V_WARNINGS} non-blocking findings (warnings only)"
         echo "$FINDING_DETAILS"

package/hooks/gate-10.sh

@@ -53,12 +53,31 @@ else
     # lines to `read`; bash never rescans the result for separators. Its correct
     # reading rests on one property of the producer above, not of the loop:
     # `git diff --cached --name-only` terminates paths with LF and quotes control
-    # characters (a CR in a name arrives as the four bytes \215, never as a bare
-    # CR), so one line is exactly one path. Asserted for spaces and a leading '-'
     # by AC-490-04.
+    #
+    # #543: semgrep 1.171 ignores .semgrepignore ENTIRELY when files are passed
+    # as explicit targets (measured: file target -> an ignored finding survives
+    # every suppression form — ignore patterns, --exclude, --exclude-rule,
+    # --project-root; directory target + --include -> the ignore file is honored,
+    # proven fail-closed by removing it and watching the findings return). The
+    # gate therefore passes each staged file's DIRECTORY as a target plus one
+    # --include per staged basename. Coverage stays exact for the staged set
+    # (verified: scanned == staged); the only widening is same-basename siblings
+    # outside the staged set, which scan too — scanning MORE is the safe side.
     SEMGREP_ARGS=()
+    SEMGREP_FILE_COUNT=0
+    SEMGREP_DIRS_SEEN=$'\n'
     while IFS= read -r _semgrep_file; do
-      [ -n "$_semgrep_file" ] && SEMGREP_ARGS+=("./$_semgrep_file")
+      [ -n "$_semgrep_file" ] || continue
+      SEMGREP_FILE_COUNT=$((SEMGREP_FILE_COUNT + 1))
+      SEMGREP_ARGS+=("--include=${_semgrep_file##*/}")
+      _semgrep_dir="./${_semgrep_file%/*}"
+      # A repo-root file has no directory component ("./x.ts" strips to "./").
+      [ "$_semgrep_dir" = "./" ] && _semgrep_dir="."
+      case "$SEMGREP_DIRS_SEEN" in
+        *"$_semgrep_dir"*) : ;;
+        *) SEMGREP_ARGS+=("$_semgrep_dir"); SEMGREP_DIRS_SEEN="$SEMGREP_DIRS_SEEN$_semgrep_dir"$'\n' ;;
+      esac
     done <<EOF
 $SEMGREP_FILES
 EOF
@@ -173,12 +192,12 @@ console.log("");});
       echo "$FINDING_DETAILS"
       echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
       GATE_10_STATUS="FAIL"
-      GATE_10_SCANNED_FILES=${#SEMGREP_ARGS[@]}
+      GATE_10_SCANNED_FILES=$SEMGREP_FILE_COUNT
       exit 1
     else
-      GATE_10_SCANNED_FILES=${#SEMGREP_ARGS[@]}
+      GATE_10_SCANNED_FILES=$SEMGREP_FILE_COUNT
       echo ""
-      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: ${#SEMGREP_ARGS[@]})"
+      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: $SEMGREP_FILE_COUNT)"
       if [ "$V_WARNINGS" -gt 0 ]; then
         echo "     ⚠️  ${V_WARNINGS} non-blocking findings (warnings only)"
         echo "$FINDING_DETAILS"

package/hooks/gate-12-file-hygiene.sh

@@ -25,11 +25,20 @@ if [ -z "$STAGED_FILES" ]; then
   return 0 2>/dev/null || true
 fi
 
+# REQ-F2: a docs-only commit cannot introduce code regressions; conflict
+# markers and YAML/JSON syntax are still checked (diff-scoped below).
+if [ "${DOCS_ONLY_COMMIT:-false}" = true ]; then
+  echo "     ⏭️  SKIPPED - File hygiene heavy checks (documentation-only commit; diff-scoped checks still run)."
+  GATE_12_STATUS="SKIP"
+  GATE_12_DOCS_ONLY=true
+fi
+
 HYGIENE_ISSUES=0
 HYGIENE_FILES=""
 
 # --- Check 1: Trailing whitespace ---
 TRAILING_WS_FILES=""
+if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files by checking if file contains null bytes
@@ -43,6 +52,7 @@ while IFS= read -r file; do
 done <<EOF
 $STAGED_FILES
 EOF
+fi
 
 if [ -n "$TRAILING_WS_FILES" ]; then
   echo "     ⚠️  Trailing whitespace detected in:"
@@ -55,6 +65,7 @@ fi
 
 # --- Check 2: Missing EOF newline ---
 NO_EOF_NEWLINE_FILES=""
+if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
@@ -72,6 +83,7 @@ while IFS= read -r file; do
 done <<EOF
 $STAGED_FILES
 EOF
+fi
 
 if [ -n "$NO_EOF_NEWLINE_FILES" ]; then
   echo "     ⚠️  Missing EOF newline in:"
@@ -83,7 +95,16 @@ if [ -n "$NO_EOF_NEWLINE_FILES" ]; then
 fi
 
 # --- Check 3: Merge conflict markers ---
+# Runs in BOTH modes. Docs-only commits read the staged DIFF (hunk cost)
+# instead of every full blob — a marker line must be ADDED to matter, so
+# '^+' minus '+++' headers is the precise scope.
 CONFLICT_MARKER_FILES=""
+if [ "${GATE_12_DOCS_ONLY:-false}" = true ]; then
+  if git diff --cached --no-color --diff-filter=d 2>/dev/null \
+      | grep -E '^\+' | grep -v '^+++' | grep -qE '^\+(<<<<<<<|=======|>>>>>>>)'; then
+    CONFLICT_MARKER_FILES="$STAGED_FILES"
+  fi
+else
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   # Skip binary files
@@ -97,6 +118,7 @@ while IFS= read -r file; do
 done <<EOF
 $STAGED_FILES
 EOF
+fi
 
 if [ -n "$CONFLICT_MARKER_FILES" ]; then
   echo "     ❌ Merge conflict markers detected in:"
@@ -109,6 +131,7 @@ fi
 
 # --- Check 4: Oversized files ---
 OVERSIZED_FILES=""
+if [ "${GATE_12_DOCS_ONLY:-false}" != true ]; then
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   [ ! -f "$file" ] && continue
@@ -120,6 +143,7 @@ while IFS= read -r file; do
 done <<EOF
 $STAGED_FILES
 EOF
+fi
 
 if [ -n "$OVERSIZED_FILES" ]; then
   echo "     ⚠️  Oversized files (>${MAX_FILE_SIZE_BYTES} bytes):"
@@ -150,6 +174,10 @@ elif command -v jq >/dev/null 2>&1; then
   JSON_CMD="jq"
 fi
 
+# Check which staged YAML/JSON files actually changed (REQ-F3: a repo with 40
+# YAML configs but one edited file validates ONE blob, not forty).
+CHANGED_YAML_JSON=$(git diff --cached --name-only --diff-filter=d -- '*.yml' '*.yaml' '*.json' 2>/dev/null)
+
 while IFS= read -r file; do
   [ -z "$file" ] && continue
   [ ! -f "$file" ] && continue
@@ -192,7 +220,7 @@ let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{JSON.p
       ;;
   esac
 done <<EOF
-$STAGED_FILES
+$CHANGED_YAML_JSON
 EOF
 
 if [ -n "$YAML_JSON_ERRORS" ]; then
@@ -207,6 +235,12 @@ elif [ "$YAML_JSON_CHECK_COUNT" -gt 0 ]; then
 fi
 
 # --- Result ---
+if [ "${GATE_12_DOCS_ONLY:-false}" = true ] && [ "$HYGIENE_ISSUES" -eq 0 ]; then
+  echo "     ✅ PASSED - File Hygiene (docs-only commit: diff-scoped conflict-marker + YAML/JSON checks clean)."
+  GATE_12_STATUS="PASS"
+  record_gate_audit "gate-12" "file-hygiene" "$GATE_12_STATUS" "0" "$GATE_12_START" "" "docs_only_change"
+  return 0 2>/dev/null || true
+fi
 if [ "$HYGIENE_ISSUES" -eq 0 ]; then
   echo "     ✅ PASSED - No file hygiene issues detected."
   GATE_12_STATUS="PASS"

package/hooks/gate-3.sh

@@ -92,7 +92,76 @@ else
         [ -n "$_cc_file" ] && CC_FILES_ARGS+=("$_cc_file")
       done <<< "$CC_FILES"
       CC_OUTPUT=$("$LIZARD_PATH" -C "$CCN_THRESHOLD" ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>&1 || true)
-      
+
+      # REQ-D (sprint-20261018-quality): baseline ratchet. When
+      # .ccn-baseline.json exists it replaces the flat threshold verdict:
+      # recorded functions may not get WORSE (strictly greater blocks), new
+      # functions face the live thresholds, improvements only hint. The
+      # legacy path below stays byte-for-byte for repos without a baseline.
+      if [ -f ".ccn-baseline.json" ]; then
+        # #544: lizard's raw CCN is not what the baseline was recorded with.
+        # The baseline comes from scripts/ccn-report.cjs, which re-derives every
+        # above-threshold CCN from brace-balanced source (lizard's TS parser
+        # loses braces on generic-arrow fields and charges neighbours). Feeding
+        # the ratchet raw numbers compared two different engines — a function
+        # at its recorded ceiling read as "worse" purely from span inflation.
+        # Route the CSV through the same verifier; on rows it cannot verify the
+        # helper exits non-zero, and this gate fails closed instead of passing
+        # an unvalidated number.
+        CC_CSV=$("$LIZARD_PATH" --csv ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>/dev/null || true)
+        CC_REPORT="$(git rev-parse --show-toplevel 2>/dev/null)/scripts/ccn-report.cjs"
+        # Fail closed when the verifier is unavailable. Previously this fell
+        # through and graded the RAW lizard CSV, while CI hard-fails on the same
+        # condition — so the hook and CI could reach opposite verdicts on
+        # identical code, and the hook silently compared baseline numbers
+        # (recorded by ccn-report's brace-verified engine) against an engine it
+        # no longer had. Agreeing with CI is the point of having both.
+        if [ ! -f "$CC_REPORT" ] || ! command -v node >/dev/null 2>&1; then
+          echo "❌ BLOCKED - complexity verifier unavailable (scripts/ccn-report.cjs needs node)."
+          echo "CI fails on this same condition; refusing to grade unverified CCN locally."
+          GATE_3_DETAIL="mode=ratchet verifier=MISSING"
+          exit 1
+        fi
+        if [ -f "$CC_REPORT" ] && command -v node >/dev/null 2>&1; then
+          _cc_verify_failed=0
+          CC_CSV_VERIFIED=$(printf '%s\n' "$CC_CSV" | node "$CC_REPORT" --csv-verified batch --root "$(git rev-parse --show-toplevel 2>/dev/null)") || _cc_verify_failed=1
+          if [ "$_cc_verify_failed" -ne 0 ]; then
+            echo "❌ BLOCKED - complexity could not be span-verified; refusing to grade unverified CCN."
+            GATE_3_DETAIL="mode=ratchet verify=FAILED"
+            exit 1
+          fi
+          CC_CSV="$CC_CSV_VERIFIED"
+        fi
+        RATCHET_LIB="$GATE_DIR/lib/ccn-ratchet.sh"
+        [ -f "$RATCHET_LIB" ] || RATCHET_LIB="$(git rev-parse --show-toplevel 2>/dev/null)/githooks/lib/ccn-ratchet.sh"
+        # shellcheck source=/dev/null
+        . "$RATCHET_LIB"
+        # NOTE: the thresholds must be plain assignments BEFORE the pipe. As a
+        # prefix to a variable assignment (`T=1 V=$(... | fn)`) they land in the
+        # assignment's subshell, so the function sees no thresholds AND reads an
+        # empty stdin — the verdict comes back empty and Gate 3 passes on zero
+        # rows (measured while wiring #544: same input passed or blocked
+        # depending only on where the prefix sat).
+        CCN_WARN_THRESHOLD="$CCN_THRESHOLD"
+        CCN_BLOCK_THRESHOLD=$((CCN_THRESHOLD * 2))
+        RATCHET_VERDICT=$(printf '%s\n' "$CC_CSV" | evaluate_ccn_ratchet ".ccn-baseline.json")
+        CC_VIOLATIONS=$(printf '%s\n' "$RATCHET_VERDICT" | grep -c '^BLOCK ' || true)
+        CC_LOWER=$(printf '%s\n' "$RATCHET_VERDICT" | grep -c '^LOWER ' || true)
+        printf '%s\n' "$RATCHET_VERDICT" | grep -v '^OK ' || true
+        if [ "${CC_LOWER:-0}" -gt 0 ]; then
+          echo "ℹ️  $CC_LOWER function(s) improved below baseline — refresh with: node scripts/ccn-report.cjs --write-baseline"
+        fi
+        GATE_3_DETAIL="mode=ratchet"
+        if [ "${CC_VIOLATIONS:-0}" -gt 0 ]; then
+          echo ""
+          echo "❌ BLOCKED - $CC_VIOLATIONS function(s) violate the complexity ratchet (.ccn-baseline.json)."
+          echo "Revert the increase, or refactor; refresh the baseline only via ccn-baseline-refresh commits."
+          exit 1
+        else
+          echo "✅ PASSED - Complexity within ratchet baseline."
+          GATE_3_STATUS="PASS"
+        fi
+      else
       # Parse warning count from the summary table: "Warning cnt   8"
       # Use anchored grep to avoid matching lizard table headers (e.g. "Rt" column)
       CC_WARNINGS=$(echo "$CC_OUTPUT" | grep "^Warning cnt" | awk '{print $NF}' | tr -d '[:space:]' | sed 's/[^0-9]//g' || true)
@@ -108,6 +177,7 @@ else
         echo "✅ PASSED - All functions within complexity threshold ($CCN_THRESHOLD)."
         GATE_3_STATUS="PASS"
       fi
+      fi
     else
       echo "⏭️  SKIPPED - Complexity (no source files to check)."
       GATE_3_STATUS="SKIP"
@@ -121,4 +191,10 @@ else
     GATE_3_REASON="tool_not_installed"
   fi
 fi
-record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "${CC_WARNINGS:-0}" "$GATE_3_START" "ccn_threshold=${CCN_THRESHOLD:-5}"
+# The audit's issues_found comes from whichever mode actually ran. In ratchet
+# mode the count lives in CC_VIOLATIONS (functions worse than their recorded
+# baseline); the flat-threshold mode parses CC_WARNINGS from lizard's own table.
+# Reading only CC_WARNINGS meant every ratchet block recorded issues_found=0 —
+# the gate failed while the journal claimed nothing was found.
+CC_ISSUES="${CC_VIOLATIONS:-${CC_WARNINGS:-0}}"
+record_gate_audit "gate-3" "complexity" "$GATE_3_STATUS" "$CC_ISSUES" "$GATE_3_START" "ccn_threshold=${CCN_THRESHOLD:-5}${GATE_3_DETAIL:+ $GATE_3_DETAIL}"

package/hooks/gate-9.sh

@@ -57,8 +57,19 @@ else
     # CR), so one line is exactly one path. Asserted for spaces and a leading '-'
     # by AC-490-04.
     SEMGREP_ARGS=()
+    SEMGREP_FILE_COUNT=0
+    SEMGREP_DIRS_SEEN=$'\n'
     while IFS= read -r _semgrep_file; do
-      [ -n "$_semgrep_file" ] && SEMGREP_ARGS+=("./$_semgrep_file")
+      [ -n "$_semgrep_file" ] || continue
+      SEMGREP_FILE_COUNT=$((SEMGREP_FILE_COUNT + 1))
+      SEMGREP_ARGS+=("--include=${_semgrep_file##*/}")
+      _semgrep_dir="./${_semgrep_file%/*}"
+      # A repo-root file has no directory component ("./x.ts" strips to "./").
+      [ "$_semgrep_dir" = "./" ] && _semgrep_dir="."
+      case "$SEMGREP_DIRS_SEEN" in
+        *"$_semgrep_dir"*) : ;;
+        *) SEMGREP_ARGS+=("$_semgrep_dir"); SEMGREP_DIRS_SEEN="$SEMGREP_DIRS_SEEN$_semgrep_dir"$'\n' ;;
+      esac
     done <<EOF
 $SEMGREP_FILES
 EOF
@@ -173,7 +184,7 @@ console.log("");});
       exit 1
     else
       echo ""
-      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: ${#SEMGREP_ARGS[@]})"
+      echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: $SEMGREP_FILE_COUNT)"
       if [ "$V_WARNINGS" -gt 0 ]; then
         echo "     ⚠️  ${V_WARNINGS} non-blocking findings (warnings only)"
         echo "$FINDING_DETAILS"

package/hooks/lib/audit-sanitize.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# ============================================================================
+# audit-sanitize.sh — honest gate-duration bookkeeping (REQ-B, #536 family)
+#
+# .xp-gate/audit.jsonl carried 389 records whose duration_ms was an epoch-
+# sized integer: a poisoned start_ms (empty -> arithmetic 0, or a SECONDS-unit
+# value from a pre-#370 code path) turned `end - start` into "now". The old
+# handler clamped negatives to 0 and flagged >2h runs with duration_anomaly,
+# but still wrote the astronomical number itself. Fail closed on the input
+# instead: when start_ms cannot be a millisecond epoch, record null + reason
+# so every consumer can exclude the sample instead of averaging a lie.
+#
+# Source this file: source "$(dirname "${BASH_SOURCE[0]}")/lib/audit-sanitize.sh"
+# ============================================================================
+
+# Millisecond epochs are 13 digits from 2001 through 2286; seconds epochs are
+# 10 digits in that whole window. A 10-digit start is therefore provably the
+# wrong unit, and anything else non-numeric is corruption. Both cases yield
+# "null"; a valid 13-digit value passes through untouched.
+sanitize_start() {
+  local s="$1"
+  case "$s" in
+    ''|*[!0-9]*) printf 'null' ;;
+    *)
+      if [ "${#s}" -eq 13 ]; then
+        printf '%s' "$s"
+      else
+        printf 'null'
+      fi
+      ;;
+  esac
+}
+
+# compute_duration_ms <start_ms> <end_ms> -> delta | null
+compute_duration_ms() {
+  local clean_end clean_start
+  clean_start=$(sanitize_start "$1")
+  clean_end=$(sanitize_start "$2")
+  if [ "$clean_start" = "null" ] || [ "$clean_end" = "null" ]; then
+    printf 'null'
+    return
+  fi
+  local delta=$((clean_end - clean_start))
+  if [ "$delta" -lt 0 ]; then
+    # Clock skew between two now_ms() calls is rarer than poisoning but the
+    # same rule applies: a negative runtime must never masquerade as 0.
+    printf 'null'
+    return
+  fi
+  printf '%s' "$delta"
+}