@boyingliu01/xp-gate 0.28.1 → 0.30.0

package/lib/__tests__/doctor-module-resolution-parity.test.js

@@ -16,10 +16,20 @@
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
-import { spawnSync } from 'node:child_process';
+import { spawnSync, execFileSync } from 'node:child_process';
 import { describe, expect, it } from 'vitest';
 
 const PRE_COMMIT = readFileSync(resolve(__dirname, '..', '..', '..', '..', 'githooks', 'pre-commit'), 'utf8');
+// #505 replaced the two hand-written shell chains with one data file generated
+// from lib/hook-module-resolution.js — the same module doctor.js requires. The
+// parity test therefore verifies the NEW contract: the generated data is current,
+// and the hook + doctor both honour it. The scenarios below still drive the hook's
+// real text through bash, so agreement is measured, not asserted.
+const RESOLUTION_DATA = readFileSync(
+  resolve(__dirname, '..', '..', '..', '..', 'githooks', 'hook-module-resolution.sh'),
+  'utf8',
+);
+const { RESOLUTION_ORDER, GATE_RESOLUTION_ORDER, ADAPTER_DIR_ORDER } = require('../hook-module-resolution.js');
 
 /**
  * Extract one bash function's full text, brace-balanced from the declaration.
@@ -149,13 +159,28 @@ function hookResolvesAll(blocks, resolverText, t, lang, gateModule) {
     `GLOBAL_ADAPTER_DIR='${t.globalAdapters}'`,
     `PROJECT_GITHOOKS='${t.projectGithooks}'`,
     `SCRIPT_DIR='${t.scriptDir}'`,
-    blocks.adapterDir,
+    `ADAPTER_DIR=''`,
+    resolverText,
     blocks.gateDir,
+    // The real chains, driven by the same data the hook loads.
+    '_hook_adapter_dir() {',
+    '  local entry base suffix base_dir',
+    '  eval "set -- \\"\\${HOOK_ADAPTER_DIR_TIERS[@]}\\""',
+    '  for entry in "$@"; do',
+    '    entry="${entry#*|}"; base="${entry%%|*}"; suffix="${entry#*|}"',
+    '    base_dir="$(_hook_tier_base "$base")"',
+    '    [ -n "$base_dir" ] || continue',
+    '    if [ -f "$base_dir/$suffix" ]; then printf "%s" "$base_dir"; return 0; fi',
+    '  done',
+    '  return 1',
+    '}',
+    'ADAPTER_DIR="$(_hook_adapter_dir)" || ADAPTER_DIR="$SCRIPT_DIR"',
+    'GATE_DIR="$(_hook_resolve_dir "$HOOK_GATE_PROBE" HOOK_GATE_TIERS)" || GATE_DIR=""',
+    'if [ -z "$GATE_DIR" ]; then GATE_DIR="$ADAPTER_DIR"; fi',
     'echo "ADAPTER=$ADAPTER_DIR"',
     'echo "GATE=$GATE_DIR"',
     `if [ -f "$ADAPTER_DIR/adapter-common.sh" ]; then echo "COMMON=$ADAPTER_DIR/adapter-common.sh"; else echo "COMMON="; fi`,
     `if [ -f "$GATE_DIR/${gateModule}" ]; then echo "MODULE=$GATE_DIR/${gateModule}"; else echo "MODULE="; fi`,
-    resolverText,
     // Captured by substitution rather than read off the last stdout line: the
     // script ends with a newline, so "last line" is always the empty one.
     `echo "LANG=$(resolve_adapter_path ${lang} || true)"`,
@@ -194,14 +219,53 @@ function hookResolves(fnText, tree, lang) {
 }
 
 describe('doctor module resolution parity with pre-commit (#495)', () => {
-  const resolverText = extractFunction(PRE_COMMIT, 'resolve_adapter_path() {');
-  // The two tier chains the hook runs before it ever calls the resolver. Read
-  // from the hook's text, not restated here: #495 Round 2's project-tier label
-  // was wrong precisely because doctor carried a second, hand-written tier list.
+  // #505: the resolver helpers come from the hook, the tier DATA from the
+  // generated file. Concatenating them is what the hook itself does, so the
+  // bash side here is the production code path, not a paraphrase of it.
+  const helpers = [
+    extractFunction(PRE_COMMIT, '_hook_tier_base() {'),
+    extractFunction(PRE_COMMIT, '_hook_resolve() {'),
+    extractFunction(PRE_COMMIT, '_hook_resolve_dir() {'),
+    extractFunction(PRE_COMMIT, 'resolve_adapter_path() {'),
+  ].join('\n');
+  // `blocks` keeps the names the scenarios use: the data file supplies the
+  // ADAPTER_DIR/GATE_DIR chains that used to be matched out of the hook text.
   const blocks = {
-    adapterDir: matchBlock(PRE_COMMIT, /if \[ -f "\$GLOBAL_ADAPTER_DIR\/adapter-common\.sh" \]; then[\s\S]*?\nfi/, 'the ADAPTER_DIR tier chain'),
-    gateDir: matchBlock(PRE_COMMIT, /if \[ -f "\$ADAPTER_DIR\/gate-3\.sh" \]; then[\s\S]*?\nfi/, 'the GATE_DIR tier chain'),
+    adapterDir: '',
+    gateDir: '',
   };
+  const resolverText = `${RESOLUTION_DATA}\n${helpers}`;
+
+  it('AC-505-01: the generated shell data is current with its JS source', () => {
+    // Stale data would silently run a different order than doctor reports — the
+    // exact failure mode #505 exists to make impossible.
+    expect(() => execFileSync(
+      process.execPath,
+      [resolve(__dirname, '..', '..', '..', '..', 'scripts', 'generate-hook-resolution.cjs'), '--check'],
+      { stdio: 'pipe' },
+    )).not.toThrow();
+  });
+
+  it('AC-505-02: the hook loads the generated data instead of carrying its own order', () => {
+    // Anti-vacuity for the whole feature: if the hook re-grew a literal cascade,
+    // the single-source-of-truth claim would be false even while scenarios pass.
+    expect(PRE_COMMIT).toContain('hook-module-resolution.sh');
+    expect(PRE_COMMIT).toContain('HOOK_ADAPTER_TIERS');
+    expect(PRE_COMMIT).toContain('HOOK_GATE_TIERS');
+    // The old hand-written chains must be gone.
+    expect(PRE_COMMIT).not.toContain('$ADAPTER_DIR/${lang}.sh');
+    expect(PRE_COMMIT).not.toMatch(/if \[ -f "\$ADAPTER_DIR\/gate-3\.sh" \]; then/);
+    // And every tier the JS declares must appear in the emitted shell data.
+    for (const t of RESOLUTION_ORDER) {
+      expect(RESOLUTION_DATA).toContain(`${t.tier_id}|${t.base}|${t.template}`);
+    }
+    for (const t of GATE_RESOLUTION_ORDER) {
+      expect(RESOLUTION_DATA).toContain(`'${t.tier_id}|${t.base}|'`);
+    }
+    for (const t of ADAPTER_DIR_ORDER) {
+      expect(RESOLUTION_DATA).toContain(`${t.tier_id}|${t.base}|${t.probe}`);
+    }
+  });
 
   it('AC-495-11: flat and nested present -> both languages pick the flat copy', () => {
     const { listExecutedModules } = require('../doctor');
@@ -241,8 +305,12 @@ describe('doctor module resolution parity with pre-commit (#495)', () => {
     }
 
     // Anti-vacuity: the guard executed the hook's real text, not a paraphrase.
-    expect(resolverText).toMatch(/\$ADAPTER_DIR\/\$\{lang\}\.sh/);
-    expect(resolverText).toMatch(/\$ADAPTER_DIR\/adapters\/\$\{lang\}\.sh/);
+    // #505 moved the literal paths out of the hook, so assert that the tiers it
+    // now reads still describe the two layouts those paths used to spell out.
+    expect(resolverText).toContain('HOOK_ADAPTER_TIERS');
+    const adapterTemplates = RESOLUTION_ORDER.map((t) => t.template);
+    expect(adapterTemplates).toContain('{name}.sh');
+    expect(adapterTemplates).toContain('adapters/{name}.sh');
   });
 
   // The scenarios below put a copy of the same module in EVERY tier the hook can

package/lib/__tests__/sprint-state-manager.test.js

@@ -143,6 +143,37 @@ describe('SprintStateManager', () => {
       expect(result.phase_history[0].duration_seconds).toBeGreaterThanOrEqual(0);
     });
 
+    it('stamps a duration when a phase goes straight from pending to completed', () => {
+      // Regression: `xp-gate phase-transition N completed --render` never emits
+      // an in_progress step, so gating started_at on in_progress left
+      // duration_seconds permanently null — the blank duration column on the
+      // status panel. Observed on sprint-20261019-47 phases 2-6.
+      const initialState = createInitialState(tmpDir);
+      manager.write(initialState);
+
+      const result = manager.transitionPhase(2, 'completed');
+
+      expect(result.phase_history[0].status).toBe('completed');
+      expect(result.phase_history[0].started_at).toBeDefined();
+      expect(result.phase_history[0].completed_at).toBeDefined();
+      expect(result.phase_history[0].duration_seconds).not.toBeNull();
+      expect(result.phase_history[0].duration_seconds).toBeGreaterThanOrEqual(0);
+      expect(Number.isNaN(result.phase_history[0].duration_seconds)).toBe(false);
+    });
+
+    it('never writes a NaN duration, even for an unparseable started_at', () => {
+      const state = createInitialState(tmpDir);
+      state.phase_history = [
+        { phase: 2, phase_name: 'DESIGN', status: 'pending', started_at: 'not-a-date' },
+      ];
+      manager.write(state);
+
+      const result = manager.transitionPhase(2, 'completed');
+
+      expect(Number.isNaN(result.phase_history[0].duration_seconds)).toBe(false);
+      expect(result.phase_history[0].duration_seconds).toBe(0);
+    });
+
     it('calls onTransition callback', () => {
       const initialState = createInitialState(tmpDir);
       manager.write(initialState);

package/lib/doctor.js

@@ -15,6 +15,9 @@ const {
 } = require('./shared-paths.js');
 const { checkUpgrade, formatUpgradeMsg } = require('./check-version.js');
 const { GATE_CLI_TOOLS, checkCliTool, getToolInstallCmd, checkBash } = require('./detect-deps.js');
+// #505: the single source of truth for module resolution order. The hook reads a
+// generated shell projection of this same module.
+const { RESOLUTION_ORDER } = require('./hook-module-resolution.js');
 const {
   diagnoseTuiRegistration, diagnoseInstalledSkills,
   fixTuiRegistration, ensureTuiRegistration, readTuiJson,
@@ -398,6 +401,16 @@ function pathsEquivalent(a, b) {
  */
 const DRIFT_COMPARED_HOOKS = ['pre-commit', 'pre-push', 'post-merge'];
 
+/**
+ * Non-hook files that must sit beside the installed hooks.
+ *
+ * These are not Git entry points, so they are not in DRIFT_COMPARED_HOOKS, but
+ * the hooks source them and die without them:
+ *   - hook-module-resolution.sh (#505): pre-commit aborts FATAL when the module
+ *     resolution order is missing. It is generated from lib/hook-module-resolution.js.
+ */
+const HOOK_SUPPORT_FILES = ['hook-module-resolution.sh'];
+
 /**
  * Compare the hooks that actually execute (the installed copy under
  * core.hooksPath) against the repository's source-of-truth `githooks/` (#451).
@@ -546,35 +559,35 @@ function listExecutedModules(installedAdapterDir) {
   const found = [];
   const seen = new Set();
 
-  let entries;
-  try {
-    entries = fs.readdirSync(installedAdapterDir, { withFileTypes: true });
-  } catch {
-    return found;
-  }
+  // #505: the tier order is DATA, not a second implementation. The hook reads a
+  // generated shell projection of the same module; both reference
+  // RESOLUTION_ORDER, so "which copy executes" has one answer. Previously this
+  // function re-derived the order by hand and a parity test was the only thing
+  // keeping it honest.
+  //
+  // Tiers are walked in order; a name is reported once, from the first tier that
+  // resolves it — matching the hook, which stops at the first existing file.
+  for (const tier of RESOLUTION_ORDER) {
+    // Only the two ADAPTER_DIR-rooted tiers describe the installed adapter dir.
+    if (tier.base !== 'ADAPTER_DIR') continue;
+    // `{name}.sh` (flat) -> the dir itself; `adapters/{name}.sh` -> <dir>/adapters.
+    const dir = tier.template.includes('/')
+      ? path.join(installedAdapterDir, tier.template.split('/{name}.sh')[0])
+      : installedAdapterDir;
 
-  for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith('.sh')) continue;
-    const file = path.join(installedAdapterDir, entry.name);
-    if (seen.has(entry.name)) continue;
-    seen.add(entry.name);
-    found.push({ name: entry.name, file });
-  }
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
 
-  // Nested copies only count for names with no flat counterpart, because that
-  // is exactly the fallback resolve_adapter_path() takes.
-  const nestedDir = path.join(installedAdapterDir, 'adapters');
-  let nestedEntries = [];
-  try {
-    nestedEntries = fs.readdirSync(nestedDir, { withFileTypes: true });
-  } catch {
-    nestedEntries = [];
-  }
-  for (const entry of nestedEntries) {
-    if (!entry.isFile() || !entry.name.endsWith('.sh')) continue;
-    if (seen.has(entry.name)) continue;
-    seen.add(entry.name);
-    found.push({ name: entry.name, file: path.join(nestedDir, entry.name) });
+    for (const entry of entries) {
+      if (!entry.isFile() || !entry.name.endsWith('.sh')) continue;
+      if (seen.has(entry.name)) continue;
+      seen.add(entry.name);
+      found.push({ name: entry.name, file: path.join(dir, entry.name) });
+    }
   }
 
   return found;
@@ -1153,6 +1166,26 @@ function syncGlobalHooksFromRepo(ctx = {}) {
     }
   }
 
+  // Hook support files (#505): sourced by the hooks but not Git entry points, so
+  // they need the same copy treatment or an upgraded install dies at the source
+  // line. Treated like the hooks themselves (always refreshed, no refusal) —
+  // they hold no machine-local content.
+  for (const name of HOOK_SUPPORT_FILES) {
+    const source = path.join(repoHooks, name);
+    if (!fs.existsSync(source)) continue;
+    const target = path.join(installedHooks, name);
+    try {
+      if (fs.existsSync(target) && filesAreIdentical(source, target)) {
+        skipped.push(name);
+        continue;
+      }
+      fs.copyFileSync(source, target);
+      synced.push(name);
+    } catch (err) {
+      errors.push(`${name}: ${err.message}`);
+    }
+  }
+
   // lib/ shared libraries: pre-commit sources lib/*.sh, so a synced hook file
   // without its libraries dies at the source line on the machine (#488).
   const repoLib = path.join(repoHooks, 'lib');

package/lib/hook-module-resolution.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+/**
+ * Single source of truth for hook module resolution order (#505).
+ *
+ * THE PROBLEM THIS SOLVES
+ * The order in which a hook finds its modules (adapter-common.sh, gate-*.sh,
+ * lib/*.sh, language adapters) used to be written out twice: once in shell
+ * (`resolve_adapter_path()` and the `GATE_DIR` cascade in githooks/pre-commit)
+ * and once in JavaScript (`listExecutedModules()` in lib/doctor.js). The two must
+ * agree or doctor reports a different module surface than the one that actually
+ * executes — exactly the divergence behind #495/#500. A parity test pinned the
+ * behaviour, but a test only fails AFTER someone writes the wrong thing; the
+ * order itself was still duplicated.
+ *
+ * THE FIX
+ * The order lives here, in RESOLUTION_ORDER, as data. Both sides read it:
+ *   - JS:  require('./hook-module-resolution.js')  (doctor.js)
+ *   - SH:  the hook sources hook-module-resolution.sh, GENERATED from this file
+ *          by `node scripts/generate-hook-resolution.sh` (run by sync-package-content).
+ * A change to the order reaches the shell automatically; drifting requires
+ * deliberately ignoring the generator.
+ *
+ * SCOPE NOTE: this is the ADAPTER/GATE lookup order only. It does not change
+ * which files are installed or how they are copied.
+ */
+
+/**
+ * Ordered resolution tiers. The first tier that contains the requested file wins.
+ *
+ * `base` names which directory variable supplies the root; `template` is the path
+ * relative to it, with `{name}` standing for the module basename.
+ *
+ * `tier_id` is stable and is what shell and JS compare on, so both can report the
+ * same tier for the same file without string-matching paths.
+ */
+const RESOLUTION_ORDER = Object.freeze([
+  Object.freeze({
+    tier_id: 'adapter_flat',
+    base: 'ADAPTER_DIR',
+    template: '{name}.sh',
+    comment: 'Global install layout: modules sit flat next to adapter-common.sh',
+  }),
+  Object.freeze({
+    tier_id: 'adapter_nested',
+    base: 'ADAPTER_DIR',
+    template: 'adapters/{name}.sh',
+    comment: 'Nested layout under the adapter dir',
+  }),
+  Object.freeze({
+    tier_id: 'project_nested',
+    base: 'PROJECT_GITHOOKS',
+    template: 'adapters/{name}.sh',
+    comment: 'Project githooks adapters/',
+  }),
+  Object.freeze({
+    tier_id: 'script_nested',
+    base: 'SCRIPT_DIR',
+    template: 'adapters/{name}.sh',
+    comment: 'Hook directory fallback',
+  }),
+]);
+
+/**
+ * Order used when resolving GATE scripts. Gates are looked up flat first
+ * (co-located with adapter-common.sh), then in the project githooks root.
+ */
+const GATE_RESOLUTION_ORDER = Object.freeze([
+  Object.freeze({
+    tier_id: 'gate_adapter_dir',
+    base: 'ADAPTER_DIR',
+    template: '{name}',
+    comment: 'Gates co-located with adapter-common.sh',
+  }),
+  Object.freeze({
+    tier_id: 'gate_project',
+    base: 'PROJECT_GITHOOKS',
+    template: '{name}',
+    comment: 'Project githooks/',
+  }),
+  Object.freeze({
+    tier_id: 'gate_script_dir',
+    base: 'SCRIPT_DIR',
+    template: '{name}',
+    comment: 'Hook directory fallback',
+  }),
+]);
+
+/**
+ * Order in which the hook picks the directory that holds adapter-common.sh
+ * (ADAPTER_DIR). Same reasoning as RESOLUTION_ORDER: this cascade decides which
+ * tree every later lookup searches, so it must have one definition.
+ *
+ * `probe` is the file whose presence in `base` makes that tier win.
+ */
+const ADAPTER_DIR_ORDER = Object.freeze([
+  Object.freeze({
+    tier_id: 'global',
+    base: 'GLOBAL_ADAPTER_DIR',
+    probe: 'adapter-common.sh',
+    comment: '~/.config/xp-gate/adapters — global install',
+  }),
+  Object.freeze({
+    tier_id: 'project',
+    base: 'PROJECT_GITHOOKS',
+    probe: 'adapter-common.sh',
+    comment: '<repo>/githooks — per-project init',
+  }),
+  Object.freeze({
+    tier_id: 'script',
+    base: 'SCRIPT_DIR',
+    probe: 'adapter-common.sh',
+    comment: 'Hook directory fallback',
+  }),
+]);
+
+/**
+ * The probe file used to decide which tier supplies gate scripts. It is the
+ * first gate, so it is present wherever the gate suite is installed.
+ */
+const GATE_PROBE = 'gate-3.sh';
+
+module.exports = {
+  RESOLUTION_ORDER,
+  GATE_RESOLUTION_ORDER,
+  ADAPTER_DIR_ORDER,
+  GATE_PROBE,
+};

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-19T12:54:56.485Z",
+  "checked_at": "2026-10-20T10:37:54.490Z",
   "source": "network"
 }

package/lib/retro.js

@@ -23,6 +23,29 @@ const { execSync } = require('child_process');
  */
 const MAX_SANE_DURATION_MS = 2 * 60 * 60 * 1000;
 
+/**
+ * Whether an audit entry's duration_ms is a trustworthy sample.
+ *
+ * `e.duration_ms || 0` used to fold null into ZERO, which both dragged the mean
+ * down and hid that the sample was missing — the same class of lie as the
+ * epoch-sized values that started this line of work.
+ *
+ * BOTH signals must be honoured, not just one:
+ *   - duration_anomaly: entries written before #475 carry an explicit flag.
+ *     Dropping this check silently re-admitted every legacy poisoned sample, and
+ *     the fixture average came out 33433ms instead of 150ms.
+ *   - non-finite / out-of-range: a poisoned start now writes null or a
+ *     nonsensical value outright, so those are excluded too.
+ *
+ * @param {{duration_ms?: number|null, duration_anomaly?: boolean}} entry
+ * @returns {boolean}
+ */
+function isUsableDuration(entry) {
+  if (entry.duration_anomaly) return false;
+  const ms = entry.duration_ms;
+  return Number.isFinite(ms) && ms >= 0 && ms <= MAX_SANE_DURATION_MS;
+}
+
 /**
  * Get git commit subjects within a date window.
  * @param {string} dir - Repository root
@@ -113,13 +136,7 @@ function buildReport(opts) {
   L.push('## Activity Summary');
   const gateEntries = audit.filter(e => e.gate_id);
   const passed = gateEntries.filter(e => e.passed).length;
-  // REQ-B: a duration is only usable when it is a finite non-negative number.
-  // `e.duration_ms || 0` used to fold null into ZERO, which both dragged the
-  // mean down and hid the fact that the sample was missing — the same class of
-  // lie as the epoch-sized values this sprint removed. The legacy
-  // duration_anomaly flag is no longer the only signal: a poisoned start now
-  // writes null outright, so anything null must be excluded and counted.
-  const measurable = gateEntries.filter(e => Number.isFinite(e.duration_ms) && e.duration_ms >= 0 && e.duration_ms <= MAX_SANE_DURATION_MS);
+  const measurable = gateEntries.filter(isUsableDuration);
   const excluded = gateEntries.length - measurable.length;
   const nullDurations = gateEntries.filter(e => e.duration_ms === null).length;
   const avgMs = measurable.length > 0

package/lib/sprint-state-manager.js

@@ -30,16 +30,24 @@ function applyHistoryEntry(state, phase, phaseName, status) {
   }
 
   entry.status = status;
-  if (status === 'in_progress' && !entry.started_at) {
+  // Stamp started_at on FIRST sight of any status, not only on `in_progress`.
+  // Phases are routinely moved straight from pending to completed (the `--render`
+  // path, and any sprint where the agent does not explicitly mark in_progress),
+  // so gating this on `in_progress` left started_at unset and duration_seconds
+  // permanently null — the empty-duration column on the status panel.
+  if (!entry.started_at) {
     entry.started_at = new Date().toISOString();
   }
   if (status === 'completed' || status === 'skipped') {
     entry.completed_at = new Date().toISOString();
-    if (entry.started_at) {
-      const startMs = new Date(entry.started_at).getTime();
-      const endMs = new Date(entry.completed_at).getTime();
-      entry.duration_seconds = Math.round((endMs - startMs) / 1000);
-    }
+    const startMs = new Date(entry.started_at).getTime();
+    const endMs = new Date(entry.completed_at).getTime();
+    // Never emit NaN/negative: a bad or future started_at degrades to 0, which
+    // the audit treats as "unknown" rather than inventing a number.
+    const elapsed = endMs - startMs;
+    entry.duration_seconds = Number.isFinite(elapsed) && elapsed >= 0
+      ? Math.round(elapsed / 1000)
+      : 0;
   }
   return entry;
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-19
-**Commit:** 9b545de5
+**Generated:** 2026-10-20
+**Commit:** 81dd7464
 **Branch:** main
-**Version:** 0.28.1.0
+**Version:** 0.30.0.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-19
-**Commit:** 9b545de5
+**Generated:** 2026-10-20
+**Commit:** 81dd7464
 **Branch:** main
-**Version:** 0.28.1.0
+**Version:** 0.30.0.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.28.1",
+  "version": "0.30.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "./bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.28.1",
+  "version": "0.30.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-19
-**Commit:** 9b545de5
+**Generated:** 2026-10-20
+**Commit:** 81dd7464
 **Branch:** main
-**Version:** 0.28.1.0
+**Version:** 0.30.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/grill-with-docs/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: grill-with-docs
+version: 1.1.0
 description: A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
 disable-model-invocation: true
 ---

package/plugins/claude-code/skills/grilling/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: grilling
+version: 1.1.0
 description: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
 ---
 

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-19
-**Commit:** 9b545de5
+**Generated:** 2026-10-20
+**Commit:** 81dd7464
 **Branch:** main
-**Version:** 0.28.1.0
+**Version:** 0.30.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-19
-**Commit:** 9b545de5
+**Generated:** 2026-10-20
+**Commit:** 81dd7464
 **Branch:** main
-**Version:** 0.28.1.0
+**Version:** 0.30.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.28.1",
+  "version": "0.30.0",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-19
-**Commit:** 9b545de5
+**Generated:** 2026-10-20
+**Commit:** 81dd7464
 **Branch:** main
-**Version:** 0.28.1.0
+**Version:** 0.30.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/grill-with-docs/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: grill-with-docs
+version: 1.1.0
 description: A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
 disable-model-invocation: true
 ---

package/plugins/dsh/skills/grilling/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: grilling
+version: 1.1.0
 description: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
 ---
 

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-19
-**Commit:** 9b545de5
+**Generated:** 2026-10-20
+**Commit:** 81dd7464
 **Branch:** main
-**Version:** 0.28.1.0
+**Version:** 0.30.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.