@boyingliu01/xp-gate 0.30.1 → 0.30.3

package/hooks/gate-10.sh

@@ -12,7 +12,20 @@ GATE_10_START=$(gate_start_ms)
 GATE_10_STATUS=""
 # #536: audit trail for "did this commit actually get scanned?". The report
 # surfaces reason + scanned_files so a non-scan never reads as a clean PASS.
+#
+# GATE_10_REASON and GATE_10_SCANNED_FILES are consumed by the sourcing parent
+# (pre-commit builds its report JSON from them after `source gate-10.sh`), not
+# inside this file. The linter checks one file at a time and cannot see the
+# consumer, so each assignment is flagged SC2034 "appears unused" -- which
+# blocks Gate 1 for any repo that vendors this adapter, because that repo's own
+# lint pass runs over the vendored copy (#548). Each assignment carries a
+# scoped directive with that reason stated at the site.
+#
+# Consumed by the sourcing parent (pre-commit report JSON), not here.
+# shellcheck disable=SC2034
 GATE_10_REASON=""
+# Consumed by the sourcing parent (pre-commit report JSON), not here.
+# shellcheck disable=SC2034
 GATE_10_SCANNED_FILES=0
 
 # Semgrep availability check
@@ -29,14 +42,21 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     Pre-cache rules: semgrep --config=p/security-audit"
   echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
   GATE_10_STATUS="WARN"
+  # Consumed by the sourcing parent (pre-commit report JSON), not here.
+  # shellcheck disable=SC2034
   GATE_10_REASON="tool_not_installed"
 else
-  # Get staged files filtered to Semgrep-supported languages
-  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  # Get staged files filtered to Semgrep-supported languages.
+  # #547 finding 3: ps1|psm1 were missing, so a PowerShell-only commit never
+  # reached semgrep even when Gate 10 ran -- the SAST gate was simply absent
+  # for that language.
+  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift|ps1|psm1)$' || true)
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
     GATE_10_STATUS="SKIP"
+    # Consumed by the sourcing parent (pre-commit report JSON), not here.
+    # shellcheck disable=SC2034
     GATE_10_REASON="no_supported_files"
   else
     # One path per line into an array. Quoting the newline-joined list would hand
@@ -91,6 +111,8 @@ EOF
       echo "     Install node (https://nodejs.org); without it SAST findings cannot be classified"
       echo "     ⏭️  SKIPPED - SAST (node not installed)"
       GATE_10_STATUS="SKIP"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_10_REASON="tool_not_installed"
     else
 
@@ -164,6 +186,8 @@ console.log("");});
       fi
       echo "     ⏭️  SKIPPED - SAST (semgrep output unparseable)"
       GATE_10_STATUS="SKIP"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_10_REASON="output_unparseable"
     elif [ "$V_RESULTS" -eq 0 ] && { [ "$V_ERRORS" -gt 0 ] || [ "$SEMGREP_EXIT" -ne 0 ]; }; then
       # Nothing was scanned to a verdict: semgrep either failed outright
@@ -178,6 +202,8 @@ console.log("");});
       fi
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
       GATE_10_STATUS="SKIP"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_10_REASON="semgrep_runtime_error"
     elif [ "$V_BLOCKING" -gt 0 ]; then
       echo ""
@@ -192,9 +218,13 @@ console.log("");});
       echo "$FINDING_DETAILS"
       echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
       GATE_10_STATUS="FAIL"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_10_SCANNED_FILES=$SEMGREP_FILE_COUNT
       exit 1
     else
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_10_SCANNED_FILES=$SEMGREP_FILE_COUNT
       echo ""
       echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: $SEMGREP_FILE_COUNT)"

package/hooks/gate-3.sh

@@ -8,11 +8,15 @@
  2>&1 echo "→ Gate 3: Cyclomatic complexity..."
 GATE_3_START=$(gate_start_ms)
 # #537: every non-run records WHY so the report can say why a gate is SKIP.
+# Consumed by the sourcing parent (pre-commit report JSON), not here.
+# shellcheck disable=SC2034
 GATE_3_REASON=""
 
 if [ "$PROJECT_LANG" = "documentation-only" ]; then
   echo "⏭️  SKIPPED - Complexity (documentation project)."
   GATE_3_STATUS="SKIP"
+  # Consumed by the sourcing parent (pre-commit report JSON), not here.
+  # shellcheck disable=SC2034
   GATE_3_REASON="documentation_project"
 
 elif [ "$PROJECT_LANG" = "powershell" ]; then
@@ -21,6 +25,8 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
   GATE_3_STATUS="SKIP"
   # #537: a PowerShell-primary repo was invisible to this dimension while the
   # score implied full coverage — say exactly why nothing ran.
+  # Consumed by the sourcing parent (pre-commit report JSON), not here.
+  # shellcheck disable=SC2034
   GATE_3_REASON="no_powershell_tool"
   
 else
@@ -159,7 +165,10 @@ else
         # empty stdin — the verdict comes back empty and Gate 3 passes on zero
         # rows (measured while wiring #544: same input passed or blocked
         # depending only on where the prefix sat).
+        # Consumed by evaluate_ccn_ratchet in the sourced lib, not here.
+        # shellcheck disable=SC2034
         CCN_WARN_THRESHOLD="$CCN_THRESHOLD"
+        # shellcheck disable=SC2034
         CCN_BLOCK_THRESHOLD=$((CCN_THRESHOLD * 2))
         RATCHET_VERDICT=$(printf '%s\n' "$CC_CSV" | evaluate_ccn_ratchet ".ccn-baseline.json")
         CC_VIOLATIONS=$(printf '%s\n' "$RATCHET_VERDICT" | grep -c '^BLOCK ' || true)
@@ -179,16 +188,44 @@ else
           GATE_3_STATUS="PASS"
         fi
       else
-      # Parse warning count from the summary table: "Warning cnt   8"
-      # Use anchored grep to avoid matching lizard table headers (e.g. "Rt" column)
-      CC_WARNINGS=$(echo "$CC_OUTPUT" | grep "^Warning cnt" | awk '{print $NF}' | tr -d '[:space:]' | sed 's/[^0-9]//g' || true)
-      CC_WARNINGS=${CC_WARNINGS:-0}
-      
-      if [ "$CC_WARNINGS" -gt 0 ]; then
+      # #543: count from lizard's machine-readable CSV, never its tables.
+      #
+      # The previous parser grepped '^Warning cnt' for a summary row. Two things
+      # made that never match: "Warning cnt" is a column header in the MIDDLE of
+      # a line ("Total nloc  Avg.NLOC  ...  Warning cnt  Fun Rt  nloc Rt"), and
+      # lizard omits the summary block entirely when given explicit file
+      # arguments -- which is how this gate always invokes it. CC_WARNINGS was
+      # therefore always 0 and the flat-threshold path could not block anything.
+      #
+      # --csv has a stable column order (NLOC,CCN,token,PARAM,length,location,
+      # file,name,signature,...), so the verdict comes from the same numbers
+      # lizard uses, independent of version and table formatting. --csv here is
+      # the flat-threshold run; the ratchet branch above builds its own.
+      CC_CSV_FLAT=$("$LIZARD_PATH" --csv -C "$CCN_THRESHOLD" ${CC_FILES_ARGS[@]+"${CC_FILES_ARGS[@]}"} 2>/dev/null || true)
+      CC_WARNINGS=$(printf '%s\n' "$CC_CSV_FLAT" | awk -F, -v t="$CCN_THRESHOLD" '
+        NF > 1 && $2 + 0 > t + 0 { c++ }
+        END { print c + 0 }
+      ')
+      # A lizard that produced no parsable row must not read as "clean". Without
+      # this, a crashing or mis-invoked lizard yields 0 warnings and the gate
+      # reports PASSED on zero analysed functions -- the same silent-success
+      # failure this issue is about.
+      if ! printf '%s\n' "$CC_CSV_FLAT" | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { found = 1; exit }
+                                                 END { exit(found ? 0 : 1) }'; then
+        echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
+        GATE_3_STATUS="WARN"
+        # Consumed by the sourcing parent (pre-commit report JSON), not here.
+        # shellcheck disable=SC2034
+        GATE_3_REASON="lizard_output_unparsable"
+      elif [ "$CC_WARNINGS" -gt 0 ]; then
         echo "$CC_OUTPUT"
         echo ""
         echo "❌ BLOCKED - $CC_WARNINGS functions with CCN > $CCN_THRESHOLD found."
         echo "Refactor high-complexity functions to keep below $CCN_THRESHOLD complexity."
+        GATE_3_STATUS="BLOCK"
+        # Consumed by the sourcing parent (pre-commit report JSON), not here.
+        # shellcheck disable=SC2034
+        GATE_3_REASON="ccn_over_threshold"
         exit 1
       else
         echo "✅ PASSED - All functions within complexity threshold ($CCN_THRESHOLD)."
@@ -198,6 +235,8 @@ else
     else
       echo "⏭️  SKIPPED - Complexity (no source files to check)."
       GATE_3_STATUS="SKIP"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_3_REASON="no_source_files_changed"
     fi
   else
@@ -205,6 +244,8 @@ else
     echo "   Install with: pip install --user lizard"
     echo "   Gate 3: Complexity check (WARN, tool not available)"
     GATE_3_STATUS="WARN"
+    # Consumed by the sourcing parent (pre-commit report JSON), not here.
+    # shellcheck disable=SC2034
     GATE_3_REASON="tool_not_installed"
   fi
 fi

package/hooks/gate-4.sh

@@ -56,11 +56,15 @@ GATE_4_START=$(gate_start_ms)
 GATE_4_STATUS=""
 # #537: every non-run records WHY (no files / tool missing / unsupported lang)
 # so the quality report can distinguish "not applicable" from "not covered".
+# Consumed by the sourcing parent, not here (see #548).
+# shellcheck disable=SC2034
 GATE_4_REASON=""
 
 if [ "$PROJECT_LANG" = "documentation-only" ]; then
   echo "⏭️  SKIPPED - Principles check (documentation project)."
   GATE_4_STATUS="SKIP"
+  # Consumed by the sourcing parent, not here (see #548).
+  # shellcheck disable=SC2034
   GATE_4_REASON="documentation_project"
   
 else
@@ -156,6 +160,8 @@ else
           echo "⚠️  Warning: Principles checker execution failed"
           echo "⏭️  SKIPPED - Principles check (execution issue)"
           GATE_4_STATUS="SKIP"
+          # Consumed by the sourcing parent, not here (see #548).
+          # shellcheck disable=SC2034
           GATE_4_REASON="checker_execution_error"
           rm -f "$PRINCIPLES_JSON"
         else
@@ -191,17 +197,23 @@ else
         echo "ℹ️  npx/tsx not available - skipping principles check"
         echo "⏭️  SKIPPED - Principles check (no Node.js/tsx)"
         GATE_4_STATUS="SKIP"
+        # Consumed by the sourcing parent, not here (see #548).
+        # shellcheck disable=SC2034
         GATE_4_REASON="tool_not_installed"
       fi
     else
       echo "ℹ️  Principles checker not found in project - skipping"
       echo "⏭️  SKIPPED - Principles check (checker not in project)"
       GATE_4_STATUS="SKIP"
+      # Consumed by the sourcing parent, not here (see #548).
+      # shellcheck disable=SC2034
       GATE_4_REASON="checker_not_found"
     fi
   else
     echo "⏭️  SKIPPED - Principles check (no matching source files changed)"
     GATE_4_STATUS="SKIP"
+    # Consumed by the sourcing parent, not here (see #548).
+    # shellcheck disable=SC2034
     GATE_4_REASON="no_matching_files_changed"
   fi
 fi

package/hooks/gate-7.sh

@@ -12,11 +12,15 @@ GATE_7_START=$(gate_start_ms)
 IAC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E "\.(tf|yaml|yml)$|Dockerfile" || true)
 # #536: scanned_files makes a trivial PASS (nothing to scan) auditable in the
 # quality report instead of reading like a covered security check.
+# Consumed by the sourcing parent, not here (see #548).
+# shellcheck disable=SC2034
 GATE_7_SCANNED_FILES=0
 if [ -z "$IAC_FILES" ]; then
   echo "✅ PASSED - No IaC files detected in changes."
   GATE_7_STATUS="PASS"
 else
+  # Consumed by the sourcing parent, not here (see #548).
+  # shellcheck disable=SC2034
   GATE_7_SCANNED_FILES=$(printf '%s\n' "$IAC_FILES" | sed -n '/./p' | wc -l | tr -d '[:space:]')
   # Run IaC adapter. Resolution follows the documented 3-tier convention
   # (adapter-common.sh): global ~/.config/xp-gate/adapters -> project

package/hooks/hook-module-resolution.sh

@@ -7,12 +7,22 @@
 # is its shell projection. Editing it by hand makes the hook disagree with
 # doctor.js, which reads the JS module directly — the exact divergence
 # #495/#500 were about.
+#
+# Every HOOK_* constant below is read by the sourcing parent, not by this
+# file. A linter checking this file alone cannot see that consumer, so each
+# declaration carries a scoped directive with the reason stated at the site
+# (#548 -- the same false SC2034 used to block consumer repos that vendor
+# these hook modules). The directives are generated, not hand-added.
 
 # Probe file used to pick the gate tier.
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_GATE_PROBE="gate-3.sh"
 
 # ADAPTER_DIR cascade, highest priority first.
 # Each entry is "tier_id|base_var|probe_file".
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_ADAPTER_DIR_TIERS=(
   'global|GLOBAL_ADAPTER_DIR|adapter-common.sh'
   'project|PROJECT_GITHOOKS|adapter-common.sh'
@@ -21,6 +31,8 @@ HOOK_ADAPTER_DIR_TIERS=(
 
 # Adapter resolution tiers, highest priority first.
 # Each entry is "tier_id|base_var|template" with {name} as the basename.
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_ADAPTER_TIERS=(
   'adapter_flat|ADAPTER_DIR|{name}.sh'
   'adapter_nested|ADAPTER_DIR|adapters/{name}.sh'
@@ -32,6 +44,8 @@ HOOK_ADAPTER_TIERS=(
 # Semantics differ from adapter tiers: each entry names the DIRECTORY that
 # would hold the gate probe, so a match yields the directory (GATE_DIR), not
 # the probe file itself. Entry format: "tier_id|base_var|(empty suffix)".
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_GATE_TIERS=(
   'gate_adapter_dir|ADAPTER_DIR|'
   'gate_project|PROJECT_GITHOOKS|'

package/hooks/lib/coverage-total.sh

@@ -70,7 +70,7 @@ enforce_python_coverage() {
   fi
 
   if [ -n "$COVERAGE_PERCENT" ]; then
-    if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+    if [ "$COVERAGE_PERCENT" -lt "${COVERAGE_THRESHOLD:-80}" ]; then
       # #399: a subset run (smart test selection) measures only the tested
       # files, so its global total is meaningless as a verdict — the full
       # suite may well be >=80% even when the subset is not. Warn exactly as

package/hooks/pre-commit

@@ -1,4 +1,20 @@
 #!/bin/bash
+# Line-ending self-check (#546). Must stay on the first executable line: if this
+# file is ever rewritten with CRLF, bash needs to reach this check before the
+# parser chokes somewhere far away and blames an innocent line. `tr` also
+# strips the \r from this very line, so the check runs even when everything
+# around it is broken.
+if tr -d '\r' < "$0" | sed -n '2p' | tr -d '\r' | grep -q 'Line-ending self-check'; then
+  if [ "$(tr -cd '\r' < "$0" | wc -c | tr -d '[:space:]')" -gt 0 ]; then
+    echo "======================================================================" >&2
+    echo "FATAL: hook has CRLF line endings — bash cannot parse it (#546)." >&2
+    echo "  file: $0" >&2
+    echo "  fix : tr -d '\\r' < \"$0\" > \"$0.tmp\" && mv \"$0.tmp\" \"$0\" && chmod +x \"$0\"" >&2
+    echo "Or re-sync the installed copy: xp-gate doctor --sync-hooks" >&2
+    echo "======================================================================" >&2
+    exit 1
+  fi
+fi
 # OpenCode Quality Gates - Pre-Commit Hook - 12 numbered gates (Gate 0–11)
 # 
 # DESIGN PRINCIPLE: Tool unavailable = SKIP (graceful degradation), tool available + check fails = BLOCK
@@ -41,6 +57,41 @@ fi
 # shellcheck source=/dev/null
 . "$HOOK_RESOLUTION_SH"
 
+# --- Coverage threshold: ONE resolver, one number (#555) --------------------
+# The threshold used to exist three times with two different values: the report
+# printed a literal 80, coverage-total.sh compared against a literal 80, and the
+# generic block branch echoed "below 80% threshold" — while the repo's own
+# pyproject declared fail_under. CI honours the declared value, so a commit at
+# 81% passed the hook (judged against 80) and failed CI (82). The report was the
+# worst of the three: it quoted a threshold as though it were the enforced one,
+# and a plausible wrong number is harder to notice than a visible gap.
+#
+# Resolve from the repo's own declaration, in the order the tools themselves
+# use: pyproject [tool.coverage.report] fail_under, then .coveragerc. A repo
+# declaring neither keeps the historical 80.
+_resolve_coverage_threshold() {
+  _rct_value=""
+  _rct_src="default"
+  if [ -f pyproject.toml ]; then
+    _rct_value=$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['tool']['coverage']['report']['fail_under'])" 2>/dev/null || true)
+    [ -n "$_rct_value" ] && _rct_src="pyproject.toml [tool.coverage.report] fail_under"
+    if [ -z "$_rct_value" ]; then
+      _rct_value=$(grep -oE '^[[:space:]]*fail_under[[:space:]]*=[[:space:]]*[0-9]+' pyproject.toml 2>/dev/null | grep -oE '[0-9]+' | head -1 || true)
+      [ -n "$_rct_value" ] && _rct_src="pyproject.toml fail_under (text scan)"
+    fi
+  fi
+  if [ -z "$_rct_value" ] && [ -f .coveragerc ]; then
+    _rct_value=$(grep -oE '^[[:space:]]*fail_under[[:space:]]*=[[:space:]]*[0-9]+' .coveragerc 2>/dev/null | grep -oE '[0-9]+' | head -1 || true)
+    [ -n "$_rct_value" ] && _rct_src=".coveragerc fail_under"
+  fi
+  case "$_rct_value" in
+    ''|*[!0-9]*) _rct_value="80"; _rct_src="default (no fail_under declared)" ;;
+  esac
+  COVERAGE_THRESHOLD_SOURCE="$_rct_src"
+  printf '%s' "$_rct_value"
+}
+COVERAGE_THRESHOLD="$(_resolve_coverage_threshold)"
+
 # Look up one tier's directory variable by name without eval-ing arbitrary input:
 # the base names are a closed set baked into the generated file.
 _hook_tier_base() {
@@ -1238,7 +1289,7 @@ fi
 GATE_1_START=$(gate_start_ms)
 GATE_1_STATUS="PASS"
 GATE_1_DETAIL=""
-if ! any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|mm|dart|sh)$" "\.ya?ml$" "\.json$" "Dockerfile" "\.tf$"; then
+if ! any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|mm|dart|sh|ps1|psm1)$" "\.ya?ml$" "\.json$" "Dockerfile" "\.tf$"; then
   echo "✅ PASSED - No code files changed, skipping lint."
   GATE_1_STATUS="SKIP"
   GATE_1_DETAIL="no_matching_files"
@@ -1764,6 +1815,58 @@ else
   fi
     ;;
 
+    powershell)
+      # #547 finding 2: PowerShell had no arm here, so it fell into the generic
+      # `*)` branch, where a non-zero analysis verdict printed a non-blocking
+      # line and GATE_1_STATUS stayed PASS. The java arm's XP_G1_REASON
+      # protocol applies verbatim: 0 = pass, 1 = block, 2 = unusable
+      # (fail-closed), 3 = WARN with a reason that STAYS in the scoring
+      # denominator so a skip is visible in retro instead of vanishing.
+      POWERSHELL_ADAPTER=$(resolve_adapter_path "powershell")
+      if [ -z "$POWERSHELL_ADAPTER" ]; then
+        echo "⚠️  WARN - PowerShell adapter not found (code quality NOT verified)"
+        GATE_1_STATUS="WARN"
+        GATE_1_DETAIL="powershell: adapter missing"
+      else
+        PS_G1_EXIT=0
+        # Subshell: reasons cross as `XP_G1_REASON: ...` stdout lines, exactly
+        # as in the java arm — an export inside the adapter cannot reach us.
+        PS_G1_OUTPUT=$(source "$POWERSHELL_ADAPTER" 2>/dev/null; run_static_analysis 2>&1) || PS_G1_EXIT=$?
+        PS_G1_REASON=$(printf '%s\n' "$PS_G1_OUTPUT" | sed -n 's/^XP_G1_REASON: //p' | head -1)
+        if [ -n "$PS_G1_REASON" ]; then
+          PS_G1_OUTPUT=$(printf '%s\n' "$PS_G1_OUTPUT" | grep -v '^XP_G1_REASON: ')
+        fi
+        [ -n "$PS_G1_OUTPUT" ] && printf '%s\n' "$PS_G1_OUTPUT" | head -40
+        case "$PS_G1_EXIT" in
+          0)
+            echo "✅ PASSED - PowerShell code quality (PSScriptAnalyzer)."
+            ;;
+          1)
+            echo "❌ BLOCKED - PSScriptAnalyzer violations (fix or add suppressions)"
+            GATE_1_STATUS="BLOCK"
+            GATE_1_DETAIL="powershell: PSScriptAnalyzer findings"
+            exit 1
+            ;;
+          2)
+            echo "❌ BLOCKED - PowerShell static analysis unusable (fail-closed): ${PS_G1_REASON:-unknown}"
+            GATE_1_STATUS="BLOCK"
+            GATE_1_DETAIL="powershell: ${PS_G1_REASON:-unusable}"
+            exit 1
+            ;;
+          3)
+            echo "⚠️  WARN - PowerShell code quality NOT verified: ${PS_G1_REASON:-engine unavailable}"
+            GATE_1_STATUS="WARN"
+            GATE_1_DETAIL="powershell: ${PS_G1_REASON:-engine unavailable}"
+            ;;
+          *)
+            echo "⚠️  WARN - PowerShell code quality NOT verified (unexpected verdict $PS_G1_EXIT)"
+            GATE_1_STATUS="WARN"
+            GATE_1_DETAIL="powershell: unexpected verdict $PS_G1_EXIT"
+            ;;
+        esac
+      fi
+      ;;
+
     *)
       # Route to appropriate adapter for other languages
       ADAPTER_FILE=$(resolve_adapter_path "$CURRENT_LANG")
@@ -2711,11 +2814,18 @@ else
                 PY_TARGET_COUNT=$(printf '%s\n' "$PY_TARGETS" | grep -c '.' || true)
                 echo "ℹ️  Python: selective run ($PY_STRATEGY) — $PY_TARGET_COUNT target(s):"
                 printf '%s\n' "$PY_TARGETS" | sed 's/^/     /'
-                # Subset run: keep --cov so data is collected, but drop the
-                # global threshold — subset coverage is meaningless globally.
+                # Subset run: keep --cov so data is collected, but the global
+                # threshold must be actively DISABLED, not merely omitted.
+                # Omitting --cov-fail-under does not work (#556): pytest-cov
+                # reads fail_under from pyproject on its own, so the floor
+                # stayed in force, a selective run at 23% exited 1, and the
+                # exit was escalated to a hard BLOCK -- printing "Partial
+                # coverage ... not full suite" immediately above "BLOCKED -
+                # Coverage check FAILED". --cov-fail-under=0 is the documented
+                # way to switch it off for one invocation.
                 PARTIAL_TEST_RUN=true
                 # shellcheck disable=SC2086
-                pytest $PY_XDIST_ARGS $PY_COV_SOURCE --tb=short $PY_TARGETS
+                pytest $PY_XDIST_ARGS $PY_COV_SOURCE --cov-fail-under=0 --tb=short $PY_TARGETS
                 COV_EXIT=$((COV_EXIT || $?))
               fi
             fi
@@ -2731,7 +2841,7 @@ else
             go test -coverprofile=coverage.out ./... 2>/dev/null
             TOTAL_COVERAGE=$(go tool cover -func=coverage.out 2>/dev/null | grep "^total:" | awk '{print substr($3, 1, length($3)-1)}')
             if [ -n "$TOTAL_COVERAGE" ] && (( $(echo "$TOTAL_COVERAGE < 80" | bc -l 2>/dev/null || echo "0") )); then
-              echo "❌ BLOCKED - Go coverage $TOTAL_COVERAGE% below 80% threshold"
+              echo "❌ BLOCKED - Go coverage $TOTAL_COVERAGE% below ${COVERAGE_THRESHOLD}% threshold"
               exit 1
             fi
             echo "Go coverage: $TOTAL_COVERAGE%"
@@ -2789,14 +2899,14 @@ else
           } catch(e) { console.log('parse_error'); }
         " 2>/dev/null)
         if [ "$COVERAGE_PERCENT" != "parse_error" ] && [ -n "$COVERAGE_PERCENT" ]; then
-          if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+          if [ "$COVERAGE_PERCENT" -lt "$COVERAGE_THRESHOLD" ]; then
             # Only a subset test run (smart selection) leaves partial coverage data;
             # a full suite run must block on <80% even when many test files changed.
             if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
               echo "⚠️  Partial coverage ${COVERAGE_PERCENT}% (subset test run, not full suite)."
               echo "    Run 'npx vitest run --coverage' for full coverage check."
             else
-              echo "❌ BLOCKED - TypeScript coverage ${COVERAGE_PERCENT}% below 80% threshold"
+              echo "❌ BLOCKED - TypeScript coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
               exit 1
             fi
           else
@@ -2860,7 +2970,7 @@ else
               echo "⚠️  Partial coverage ${COVERAGE_ROUNDED}% (subset test run, not full suite)."
               echo "    Run the full test suite for a complete Java coverage check."
             else
-              echo "❌ BLOCKED - Java coverage ${COVERAGE_ROUNDED}% below 80% threshold"
+              echo "❌ BLOCKED - Java coverage ${COVERAGE_ROUNDED}% below ${COVERAGE_THRESHOLD}% threshold"
               exit 1
             fi
           else
@@ -2886,8 +2996,8 @@ else
       if [ -f "coverage/lcov.info" ]; then
         COVERAGE_PERCENT=$(parse_lcov_coverage "coverage/lcov.info" 2>/dev/null) || COVERAGE_PERCENT="0"
         if [ "$COVERAGE_PERCENT" != "0" ] && [ -n "$COVERAGE_PERCENT" ]; then
-          if [ "$COVERAGE_PERCENT" -lt 80 ]; then
-            echo "❌ BLOCKED - Flutter/Dart coverage ${COVERAGE_PERCENT}% below 80% threshold"
+          if [ "$COVERAGE_PERCENT" -lt "$COVERAGE_THRESHOLD" ]; then
+            echo "❌ BLOCKED - Flutter/Dart coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
             exit 1
           fi
           echo "Flutter/Dart coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
@@ -2926,7 +3036,7 @@ else
           COVERAGE_STATUS=${COVERAGE_RESULT%%|*}
           COVERAGE_PERCENT=${COVERAGE_RESULT#*|}
           if [ "$COVERAGE_STATUS" = "below" ]; then
-            echo "❌ BLOCKED - PowerShell coverage ${COVERAGE_PERCENT}% below 80% threshold"
+            echo "❌ BLOCKED - PowerShell coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
             exit 1
           fi
           echo "PowerShell coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
@@ -2963,14 +3073,14 @@ else
         fi
       fi
       if [ -n "$COVERAGE_PERCENT" ] && [ "$COVERAGE_PERCENT" != "parse_error" ] && [ "$COVERAGE_PERCENT" -gt 0 ]; then
-        if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+        if [ "$COVERAGE_PERCENT" -lt "$COVERAGE_THRESHOLD" ]; then
           # Only a subset test run (smart selection) warns — the full suite may
           # still reach ≥80%; a full suite run must block.
           if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
             echo "⚠️  Partial coverage ${COVERAGE_PERCENT}% (subset test run, not full suite)."
             echo "    Run the full test suite for a complete ${CURRENT_LANG} coverage check."
           else
-            echo "❌ BLOCKED - ${CURRENT_LANG} coverage ${COVERAGE_PERCENT}% below 80% threshold"
+            echo "❌ BLOCKED - ${CURRENT_LANG} coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
             exit 1
           fi
         else
@@ -3019,10 +3129,15 @@ else
             }
           } catch(e) { console.log('parse_error'); }
         " 2>/dev/null)
+        # NOTE (#555): the 80 below is deliberately NOT $COVERAGE_THRESHOLD.
+        # That one is the project-level floor a repo declares in fail_under;
+        # this is the bar a single NEW file must clear to justify existing at
+        # all. Tying them would mean a repo with fail_under=82 could not add a
+        # file at 81% even while the project sits well above its floor.
         if [ "$FILE_COV" = "no_data" ] || [ "$FILE_COV" = "parse_error" ]; then
           echo "     ⚠️  $new_file — no coverage data (file may be excluded or not exercised)"
         elif [ "$FILE_COV" -lt 80 ]; then
-          echo "     ❌ $new_file — ${FILE_COV}% coverage (below 80% threshold)"
+          echo "     ❌ $new_file — ${FILE_COV}% coverage (below 80% per-new-file threshold)"
           NEW_FILE_COV_FAIL=true
         else
           echo "     ✅ $new_file — ${FILE_COV}% coverage"
@@ -3036,8 +3151,13 @@ else
       fi
     fi
   fi
+  # Only reached on the non-docs-only path. Assigning PASS outside the if/else
+  # overwrote the docs-only SKIP a few hundred lines above and reported
+  # "Tests + Coverage: PASS (coverage: N/A)" for a commit where no test ran
+  # (#554) -- a SKIP promoted to PASS inflates the pass rate and hides that the
+  # gate never executed.
+  GATE_5_STATUS="PASS"
 fi
-GATE_5_STATUS="PASS"
 record_gate_audit "gate-5" "tests-coverage" "$GATE_5_STATUS" "0" "$GATE_5_START" "${GATE_5_DETAIL:-}"
 
 # ============================================================================
@@ -3582,7 +3702,7 @@ echo ""
 # v0.14.3+ (Issue #312): Skip if no code files changed
 # v0.18.5 (Issue #397): Fix gate status variable collision — SAST now sets GATE_10_STATUS
 # ============================================================================
-if any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|dart|sh)$"; then
+if any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|dart|sh|ps1|psm1)$"; then
   if [ -f "$GATE_DIR/gate-10.sh" ]; then
     source "$GATE_DIR/gate-10.sh"
   else
@@ -3885,7 +4005,8 @@ generate_quality_report() {
     "gate5_tests": {
       "name": "Tests + Coverage",
       "status": "${GATE_5_STATUS:-PASS}",
-      "thresholds": { "lines": 80, "functions": 80, "branches": 70, "statements": 80 },
+      "thresholds": { "lines": ${COVERAGE_THRESHOLD}, "functions": null, "branches": null, "statements": null },
+      "threshold_source": "${COVERAGE_THRESHOLD_SOURCE}",
       "actual": { "coverage": "${COV_PCT}" },
       "failedTests": $FAILED_TESTS_JSON
     },