@boyingliu01/xp-gate 0.30.2 → 0.30.3

package/hooks/gate-3.sh

@@ -8,11 +8,15 @@
  2>&1 echo "→ Gate 3: Cyclomatic complexity..."
 GATE_3_START=$(gate_start_ms)
 # #537: every non-run records WHY so the report can say why a gate is SKIP.
+# Consumed by the sourcing parent (pre-commit report JSON), not here.
+# shellcheck disable=SC2034
 GATE_3_REASON=""
 
 if [ "$PROJECT_LANG" = "documentation-only" ]; then
   echo "⏭️  SKIPPED - Complexity (documentation project)."
   GATE_3_STATUS="SKIP"
+  # Consumed by the sourcing parent (pre-commit report JSON), not here.
+  # shellcheck disable=SC2034
   GATE_3_REASON="documentation_project"
 
 elif [ "$PROJECT_LANG" = "powershell" ]; then
@@ -21,6 +25,8 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
   GATE_3_STATUS="SKIP"
   # #537: a PowerShell-primary repo was invisible to this dimension while the
   # score implied full coverage — say exactly why nothing ran.
+  # Consumed by the sourcing parent (pre-commit report JSON), not here.
+  # shellcheck disable=SC2034
   GATE_3_REASON="no_powershell_tool"
   
 else
@@ -159,7 +165,10 @@ else
         # empty stdin — the verdict comes back empty and Gate 3 passes on zero
         # rows (measured while wiring #544: same input passed or blocked
         # depending only on where the prefix sat).
+        # Consumed by evaluate_ccn_ratchet in the sourced lib, not here.
+        # shellcheck disable=SC2034
         CCN_WARN_THRESHOLD="$CCN_THRESHOLD"
+        # shellcheck disable=SC2034
         CCN_BLOCK_THRESHOLD=$((CCN_THRESHOLD * 2))
         RATCHET_VERDICT=$(printf '%s\n' "$CC_CSV" | evaluate_ccn_ratchet ".ccn-baseline.json")
         CC_VIOLATIONS=$(printf '%s\n' "$RATCHET_VERDICT" | grep -c '^BLOCK ' || true)
@@ -205,6 +214,8 @@ else
                                                  END { exit(found ? 0 : 1) }'; then
         echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
         GATE_3_STATUS="WARN"
+        # Consumed by the sourcing parent (pre-commit report JSON), not here.
+        # shellcheck disable=SC2034
         GATE_3_REASON="lizard_output_unparsable"
       elif [ "$CC_WARNINGS" -gt 0 ]; then
         echo "$CC_OUTPUT"
@@ -212,6 +223,8 @@ else
         echo "❌ BLOCKED - $CC_WARNINGS functions with CCN > $CCN_THRESHOLD found."
         echo "Refactor high-complexity functions to keep below $CCN_THRESHOLD complexity."
         GATE_3_STATUS="BLOCK"
+        # Consumed by the sourcing parent (pre-commit report JSON), not here.
+        # shellcheck disable=SC2034
         GATE_3_REASON="ccn_over_threshold"
         exit 1
       else
@@ -222,6 +235,8 @@ else
     else
       echo "⏭️  SKIPPED - Complexity (no source files to check)."
       GATE_3_STATUS="SKIP"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_3_REASON="no_source_files_changed"
     fi
   else
@@ -229,6 +244,8 @@ else
     echo "   Install with: pip install --user lizard"
     echo "   Gate 3: Complexity check (WARN, tool not available)"
     GATE_3_STATUS="WARN"
+    # Consumed by the sourcing parent (pre-commit report JSON), not here.
+    # shellcheck disable=SC2034
     GATE_3_REASON="tool_not_installed"
   fi
 fi

package/hooks/gate-4.sh

@@ -56,11 +56,15 @@ GATE_4_START=$(gate_start_ms)
 GATE_4_STATUS=""
 # #537: every non-run records WHY (no files / tool missing / unsupported lang)
 # so the quality report can distinguish "not applicable" from "not covered".
+# Consumed by the sourcing parent, not here (see #548).
+# shellcheck disable=SC2034
 GATE_4_REASON=""
 
 if [ "$PROJECT_LANG" = "documentation-only" ]; then
   echo "⏭️  SKIPPED - Principles check (documentation project)."
   GATE_4_STATUS="SKIP"
+  # Consumed by the sourcing parent, not here (see #548).
+  # shellcheck disable=SC2034
   GATE_4_REASON="documentation_project"
   
 else
@@ -156,6 +160,8 @@ else
           echo "⚠️  Warning: Principles checker execution failed"
           echo "⏭️  SKIPPED - Principles check (execution issue)"
           GATE_4_STATUS="SKIP"
+          # Consumed by the sourcing parent, not here (see #548).
+          # shellcheck disable=SC2034
           GATE_4_REASON="checker_execution_error"
           rm -f "$PRINCIPLES_JSON"
         else
@@ -191,17 +197,23 @@ else
         echo "ℹ️  npx/tsx not available - skipping principles check"
         echo "⏭️  SKIPPED - Principles check (no Node.js/tsx)"
         GATE_4_STATUS="SKIP"
+        # Consumed by the sourcing parent, not here (see #548).
+        # shellcheck disable=SC2034
         GATE_4_REASON="tool_not_installed"
       fi
     else
       echo "ℹ️  Principles checker not found in project - skipping"
       echo "⏭️  SKIPPED - Principles check (checker not in project)"
       GATE_4_STATUS="SKIP"
+      # Consumed by the sourcing parent, not here (see #548).
+      # shellcheck disable=SC2034
       GATE_4_REASON="checker_not_found"
     fi
   else
     echo "⏭️  SKIPPED - Principles check (no matching source files changed)"
     GATE_4_STATUS="SKIP"
+    # Consumed by the sourcing parent, not here (see #548).
+    # shellcheck disable=SC2034
     GATE_4_REASON="no_matching_files_changed"
   fi
 fi

package/hooks/gate-7.sh

@@ -12,11 +12,15 @@ GATE_7_START=$(gate_start_ms)
 IAC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E "\.(tf|yaml|yml)$|Dockerfile" || true)
 # #536: scanned_files makes a trivial PASS (nothing to scan) auditable in the
 # quality report instead of reading like a covered security check.
+# Consumed by the sourcing parent, not here (see #548).
+# shellcheck disable=SC2034
 GATE_7_SCANNED_FILES=0
 if [ -z "$IAC_FILES" ]; then
   echo "✅ PASSED - No IaC files detected in changes."
   GATE_7_STATUS="PASS"
 else
+  # Consumed by the sourcing parent, not here (see #548).
+  # shellcheck disable=SC2034
   GATE_7_SCANNED_FILES=$(printf '%s\n' "$IAC_FILES" | sed -n '/./p' | wc -l | tr -d '[:space:]')
   # Run IaC adapter. Resolution follows the documented 3-tier convention
   # (adapter-common.sh): global ~/.config/xp-gate/adapters -> project

package/hooks/hook-module-resolution.sh

@@ -7,12 +7,22 @@
 # is its shell projection. Editing it by hand makes the hook disagree with
 # doctor.js, which reads the JS module directly — the exact divergence
 # #495/#500 were about.
+#
+# Every HOOK_* constant below is read by the sourcing parent, not by this
+# file. A linter checking this file alone cannot see that consumer, so each
+# declaration carries a scoped directive with the reason stated at the site
+# (#548 -- the same false SC2034 used to block consumer repos that vendor
+# these hook modules). The directives are generated, not hand-added.
 
 # Probe file used to pick the gate tier.
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_GATE_PROBE="gate-3.sh"
 
 # ADAPTER_DIR cascade, highest priority first.
 # Each entry is "tier_id|base_var|probe_file".
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_ADAPTER_DIR_TIERS=(
   'global|GLOBAL_ADAPTER_DIR|adapter-common.sh'
   'project|PROJECT_GITHOOKS|adapter-common.sh'
@@ -21,6 +31,8 @@ HOOK_ADAPTER_DIR_TIERS=(
 
 # Adapter resolution tiers, highest priority first.
 # Each entry is "tier_id|base_var|template" with {name} as the basename.
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_ADAPTER_TIERS=(
   'adapter_flat|ADAPTER_DIR|{name}.sh'
   'adapter_nested|ADAPTER_DIR|adapters/{name}.sh'
@@ -32,6 +44,8 @@ HOOK_ADAPTER_TIERS=(
 # Semantics differ from adapter tiers: each entry names the DIRECTORY that
 # would hold the gate probe, so a match yields the directory (GATE_DIR), not
 # the probe file itself. Entry format: "tier_id|base_var|(empty suffix)".
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_GATE_TIERS=(
   'gate_adapter_dir|ADAPTER_DIR|'
   'gate_project|PROJECT_GITHOOKS|'

package/hooks/lib/coverage-total.sh

@@ -70,7 +70,7 @@ enforce_python_coverage() {
   fi
 
   if [ -n "$COVERAGE_PERCENT" ]; then
-    if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+    if [ "$COVERAGE_PERCENT" -lt "${COVERAGE_THRESHOLD:-80}" ]; then
       # #399: a subset run (smart test selection) measures only the tested
       # files, so its global total is meaningless as a verdict — the full
       # suite may well be >=80% even when the subset is not. Warn exactly as

package/hooks/pre-commit

@@ -1,4 +1,20 @@
 #!/bin/bash
+# Line-ending self-check (#546). Must stay on the first executable line: if this
+# file is ever rewritten with CRLF, bash needs to reach this check before the
+# parser chokes somewhere far away and blames an innocent line. `tr` also
+# strips the \r from this very line, so the check runs even when everything
+# around it is broken.
+if tr -d '\r' < "$0" | sed -n '2p' | tr -d '\r' | grep -q 'Line-ending self-check'; then
+  if [ "$(tr -cd '\r' < "$0" | wc -c | tr -d '[:space:]')" -gt 0 ]; then
+    echo "======================================================================" >&2
+    echo "FATAL: hook has CRLF line endings — bash cannot parse it (#546)." >&2
+    echo "  file: $0" >&2
+    echo "  fix : tr -d '\\r' < \"$0\" > \"$0.tmp\" && mv \"$0.tmp\" \"$0\" && chmod +x \"$0\"" >&2
+    echo "Or re-sync the installed copy: xp-gate doctor --sync-hooks" >&2
+    echo "======================================================================" >&2
+    exit 1
+  fi
+fi
 # OpenCode Quality Gates - Pre-Commit Hook - 12 numbered gates (Gate 0–11)
 # 
 # DESIGN PRINCIPLE: Tool unavailable = SKIP (graceful degradation), tool available + check fails = BLOCK
@@ -41,6 +57,41 @@ fi
 # shellcheck source=/dev/null
 . "$HOOK_RESOLUTION_SH"
 
+# --- Coverage threshold: ONE resolver, one number (#555) --------------------
+# The threshold used to exist three times with two different values: the report
+# printed a literal 80, coverage-total.sh compared against a literal 80, and the
+# generic block branch echoed "below 80% threshold" — while the repo's own
+# pyproject declared fail_under. CI honours the declared value, so a commit at
+# 81% passed the hook (judged against 80) and failed CI (82). The report was the
+# worst of the three: it quoted a threshold as though it were the enforced one,
+# and a plausible wrong number is harder to notice than a visible gap.
+#
+# Resolve from the repo's own declaration, in the order the tools themselves
+# use: pyproject [tool.coverage.report] fail_under, then .coveragerc. A repo
+# declaring neither keeps the historical 80.
+_resolve_coverage_threshold() {
+  _rct_value=""
+  _rct_src="default"
+  if [ -f pyproject.toml ]; then
+    _rct_value=$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['tool']['coverage']['report']['fail_under'])" 2>/dev/null || true)
+    [ -n "$_rct_value" ] && _rct_src="pyproject.toml [tool.coverage.report] fail_under"
+    if [ -z "$_rct_value" ]; then
+      _rct_value=$(grep -oE '^[[:space:]]*fail_under[[:space:]]*=[[:space:]]*[0-9]+' pyproject.toml 2>/dev/null | grep -oE '[0-9]+' | head -1 || true)
+      [ -n "$_rct_value" ] && _rct_src="pyproject.toml fail_under (text scan)"
+    fi
+  fi
+  if [ -z "$_rct_value" ] && [ -f .coveragerc ]; then
+    _rct_value=$(grep -oE '^[[:space:]]*fail_under[[:space:]]*=[[:space:]]*[0-9]+' .coveragerc 2>/dev/null | grep -oE '[0-9]+' | head -1 || true)
+    [ -n "$_rct_value" ] && _rct_src=".coveragerc fail_under"
+  fi
+  case "$_rct_value" in
+    ''|*[!0-9]*) _rct_value="80"; _rct_src="default (no fail_under declared)" ;;
+  esac
+  COVERAGE_THRESHOLD_SOURCE="$_rct_src"
+  printf '%s' "$_rct_value"
+}
+COVERAGE_THRESHOLD="$(_resolve_coverage_threshold)"
+
 # Look up one tier's directory variable by name without eval-ing arbitrary input:
 # the base names are a closed set baked into the generated file.
 _hook_tier_base() {
@@ -1238,7 +1289,7 @@ fi
 GATE_1_START=$(gate_start_ms)
 GATE_1_STATUS="PASS"
 GATE_1_DETAIL=""
-if ! any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|mm|dart|sh)$" "\.ya?ml$" "\.json$" "Dockerfile" "\.tf$"; then
+if ! any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|mm|dart|sh|ps1|psm1)$" "\.ya?ml$" "\.json$" "Dockerfile" "\.tf$"; then
   echo "✅ PASSED - No code files changed, skipping lint."
   GATE_1_STATUS="SKIP"
   GATE_1_DETAIL="no_matching_files"
@@ -1764,6 +1815,58 @@ else
   fi
     ;;
 
+    powershell)
+      # #547 finding 2: PowerShell had no arm here, so it fell into the generic
+      # `*)` branch, where a non-zero analysis verdict printed a non-blocking
+      # line and GATE_1_STATUS stayed PASS. The java arm's XP_G1_REASON
+      # protocol applies verbatim: 0 = pass, 1 = block, 2 = unusable
+      # (fail-closed), 3 = WARN with a reason that STAYS in the scoring
+      # denominator so a skip is visible in retro instead of vanishing.
+      POWERSHELL_ADAPTER=$(resolve_adapter_path "powershell")
+      if [ -z "$POWERSHELL_ADAPTER" ]; then
+        echo "⚠️  WARN - PowerShell adapter not found (code quality NOT verified)"
+        GATE_1_STATUS="WARN"
+        GATE_1_DETAIL="powershell: adapter missing"
+      else
+        PS_G1_EXIT=0
+        # Subshell: reasons cross as `XP_G1_REASON: ...` stdout lines, exactly
+        # as in the java arm — an export inside the adapter cannot reach us.
+        PS_G1_OUTPUT=$(source "$POWERSHELL_ADAPTER" 2>/dev/null; run_static_analysis 2>&1) || PS_G1_EXIT=$?
+        PS_G1_REASON=$(printf '%s\n' "$PS_G1_OUTPUT" | sed -n 's/^XP_G1_REASON: //p' | head -1)
+        if [ -n "$PS_G1_REASON" ]; then
+          PS_G1_OUTPUT=$(printf '%s\n' "$PS_G1_OUTPUT" | grep -v '^XP_G1_REASON: ')
+        fi
+        [ -n "$PS_G1_OUTPUT" ] && printf '%s\n' "$PS_G1_OUTPUT" | head -40
+        case "$PS_G1_EXIT" in
+          0)
+            echo "✅ PASSED - PowerShell code quality (PSScriptAnalyzer)."
+            ;;
+          1)
+            echo "❌ BLOCKED - PSScriptAnalyzer violations (fix or add suppressions)"
+            GATE_1_STATUS="BLOCK"
+            GATE_1_DETAIL="powershell: PSScriptAnalyzer findings"
+            exit 1
+            ;;
+          2)
+            echo "❌ BLOCKED - PowerShell static analysis unusable (fail-closed): ${PS_G1_REASON:-unknown}"
+            GATE_1_STATUS="BLOCK"
+            GATE_1_DETAIL="powershell: ${PS_G1_REASON:-unusable}"
+            exit 1
+            ;;
+          3)
+            echo "⚠️  WARN - PowerShell code quality NOT verified: ${PS_G1_REASON:-engine unavailable}"
+            GATE_1_STATUS="WARN"
+            GATE_1_DETAIL="powershell: ${PS_G1_REASON:-engine unavailable}"
+            ;;
+          *)
+            echo "⚠️  WARN - PowerShell code quality NOT verified (unexpected verdict $PS_G1_EXIT)"
+            GATE_1_STATUS="WARN"
+            GATE_1_DETAIL="powershell: unexpected verdict $PS_G1_EXIT"
+            ;;
+        esac
+      fi
+      ;;
+
     *)
       # Route to appropriate adapter for other languages
       ADAPTER_FILE=$(resolve_adapter_path "$CURRENT_LANG")
@@ -2711,11 +2814,18 @@ else
                 PY_TARGET_COUNT=$(printf '%s\n' "$PY_TARGETS" | grep -c '.' || true)
                 echo "ℹ️  Python: selective run ($PY_STRATEGY) — $PY_TARGET_COUNT target(s):"
                 printf '%s\n' "$PY_TARGETS" | sed 's/^/     /'
-                # Subset run: keep --cov so data is collected, but drop the
-                # global threshold — subset coverage is meaningless globally.
+                # Subset run: keep --cov so data is collected, but the global
+                # threshold must be actively DISABLED, not merely omitted.
+                # Omitting --cov-fail-under does not work (#556): pytest-cov
+                # reads fail_under from pyproject on its own, so the floor
+                # stayed in force, a selective run at 23% exited 1, and the
+                # exit was escalated to a hard BLOCK -- printing "Partial
+                # coverage ... not full suite" immediately above "BLOCKED -
+                # Coverage check FAILED". --cov-fail-under=0 is the documented
+                # way to switch it off for one invocation.
                 PARTIAL_TEST_RUN=true
                 # shellcheck disable=SC2086
-                pytest $PY_XDIST_ARGS $PY_COV_SOURCE --tb=short $PY_TARGETS
+                pytest $PY_XDIST_ARGS $PY_COV_SOURCE --cov-fail-under=0 --tb=short $PY_TARGETS
                 COV_EXIT=$((COV_EXIT || $?))
               fi
             fi
@@ -2731,7 +2841,7 @@ else
             go test -coverprofile=coverage.out ./... 2>/dev/null
             TOTAL_COVERAGE=$(go tool cover -func=coverage.out 2>/dev/null | grep "^total:" | awk '{print substr($3, 1, length($3)-1)}')
             if [ -n "$TOTAL_COVERAGE" ] && (( $(echo "$TOTAL_COVERAGE < 80" | bc -l 2>/dev/null || echo "0") )); then
-              echo "❌ BLOCKED - Go coverage $TOTAL_COVERAGE% below 80% threshold"
+              echo "❌ BLOCKED - Go coverage $TOTAL_COVERAGE% below ${COVERAGE_THRESHOLD}% threshold"
               exit 1
             fi
             echo "Go coverage: $TOTAL_COVERAGE%"
@@ -2789,14 +2899,14 @@ else
           } catch(e) { console.log('parse_error'); }
         " 2>/dev/null)
         if [ "$COVERAGE_PERCENT" != "parse_error" ] && [ -n "$COVERAGE_PERCENT" ]; then
-          if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+          if [ "$COVERAGE_PERCENT" -lt "$COVERAGE_THRESHOLD" ]; then
             # Only a subset test run (smart selection) leaves partial coverage data;
             # a full suite run must block on <80% even when many test files changed.
             if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
               echo "⚠️  Partial coverage ${COVERAGE_PERCENT}% (subset test run, not full suite)."
               echo "    Run 'npx vitest run --coverage' for full coverage check."
             else
-              echo "❌ BLOCKED - TypeScript coverage ${COVERAGE_PERCENT}% below 80% threshold"
+              echo "❌ BLOCKED - TypeScript coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
               exit 1
             fi
           else
@@ -2860,7 +2970,7 @@ else
               echo "⚠️  Partial coverage ${COVERAGE_ROUNDED}% (subset test run, not full suite)."
               echo "    Run the full test suite for a complete Java coverage check."
             else
-              echo "❌ BLOCKED - Java coverage ${COVERAGE_ROUNDED}% below 80% threshold"
+              echo "❌ BLOCKED - Java coverage ${COVERAGE_ROUNDED}% below ${COVERAGE_THRESHOLD}% threshold"
               exit 1
             fi
           else
@@ -2886,8 +2996,8 @@ else
       if [ -f "coverage/lcov.info" ]; then
         COVERAGE_PERCENT=$(parse_lcov_coverage "coverage/lcov.info" 2>/dev/null) || COVERAGE_PERCENT="0"
         if [ "$COVERAGE_PERCENT" != "0" ] && [ -n "$COVERAGE_PERCENT" ]; then
-          if [ "$COVERAGE_PERCENT" -lt 80 ]; then
-            echo "❌ BLOCKED - Flutter/Dart coverage ${COVERAGE_PERCENT}% below 80% threshold"
+          if [ "$COVERAGE_PERCENT" -lt "$COVERAGE_THRESHOLD" ]; then
+            echo "❌ BLOCKED - Flutter/Dart coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
             exit 1
           fi
           echo "Flutter/Dart coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
@@ -2926,7 +3036,7 @@ else
           COVERAGE_STATUS=${COVERAGE_RESULT%%|*}
           COVERAGE_PERCENT=${COVERAGE_RESULT#*|}
           if [ "$COVERAGE_STATUS" = "below" ]; then
-            echo "❌ BLOCKED - PowerShell coverage ${COVERAGE_PERCENT}% below 80% threshold"
+            echo "❌ BLOCKED - PowerShell coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
             exit 1
           fi
           echo "PowerShell coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
@@ -2963,14 +3073,14 @@ else
         fi
       fi
       if [ -n "$COVERAGE_PERCENT" ] && [ "$COVERAGE_PERCENT" != "parse_error" ] && [ "$COVERAGE_PERCENT" -gt 0 ]; then
-        if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+        if [ "$COVERAGE_PERCENT" -lt "$COVERAGE_THRESHOLD" ]; then
           # Only a subset test run (smart selection) warns — the full suite may
           # still reach ≥80%; a full suite run must block.
           if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
             echo "⚠️  Partial coverage ${COVERAGE_PERCENT}% (subset test run, not full suite)."
             echo "    Run the full test suite for a complete ${CURRENT_LANG} coverage check."
           else
-            echo "❌ BLOCKED - ${CURRENT_LANG} coverage ${COVERAGE_PERCENT}% below 80% threshold"
+            echo "❌ BLOCKED - ${CURRENT_LANG} coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
             exit 1
           fi
         else
@@ -3019,10 +3129,15 @@ else
             }
           } catch(e) { console.log('parse_error'); }
         " 2>/dev/null)
+        # NOTE (#555): the 80 below is deliberately NOT $COVERAGE_THRESHOLD.
+        # That one is the project-level floor a repo declares in fail_under;
+        # this is the bar a single NEW file must clear to justify existing at
+        # all. Tying them would mean a repo with fail_under=82 could not add a
+        # file at 81% even while the project sits well above its floor.
         if [ "$FILE_COV" = "no_data" ] || [ "$FILE_COV" = "parse_error" ]; then
           echo "     ⚠️  $new_file — no coverage data (file may be excluded or not exercised)"
         elif [ "$FILE_COV" -lt 80 ]; then
-          echo "     ❌ $new_file — ${FILE_COV}% coverage (below 80% threshold)"
+          echo "     ❌ $new_file — ${FILE_COV}% coverage (below 80% per-new-file threshold)"
           NEW_FILE_COV_FAIL=true
         else
           echo "     ✅ $new_file — ${FILE_COV}% coverage"
@@ -3036,8 +3151,13 @@ else
       fi
     fi
   fi
+  # Only reached on the non-docs-only path. Assigning PASS outside the if/else
+  # overwrote the docs-only SKIP a few hundred lines above and reported
+  # "Tests + Coverage: PASS (coverage: N/A)" for a commit where no test ran
+  # (#554) -- a SKIP promoted to PASS inflates the pass rate and hides that the
+  # gate never executed.
+  GATE_5_STATUS="PASS"
 fi
-GATE_5_STATUS="PASS"
 record_gate_audit "gate-5" "tests-coverage" "$GATE_5_STATUS" "0" "$GATE_5_START" "${GATE_5_DETAIL:-}"
 
 # ============================================================================
@@ -3582,7 +3702,7 @@ echo ""
 # v0.14.3+ (Issue #312): Skip if no code files changed
 # v0.18.5 (Issue #397): Fix gate status variable collision — SAST now sets GATE_10_STATUS
 # ============================================================================
-if any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|dart|sh)$"; then
+if any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|dart|sh|ps1|psm1)$"; then
   if [ -f "$GATE_DIR/gate-10.sh" ]; then
     source "$GATE_DIR/gate-10.sh"
   else
@@ -3885,7 +4005,8 @@ generate_quality_report() {
     "gate5_tests": {
       "name": "Tests + Coverage",
       "status": "${GATE_5_STATUS:-PASS}",
-      "thresholds": { "lines": 80, "functions": 80, "branches": 70, "statements": 80 },
+      "thresholds": { "lines": ${COVERAGE_THRESHOLD}, "functions": null, "branches": null, "statements": null },
+      "threshold_source": "${COVERAGE_THRESHOLD_SOURCE}",
       "actual": { "coverage": "${COV_PCT}" },
       "failedTests": $FAILED_TESTS_JSON
     },

package/hooks/pre-push

@@ -1,4 +1,20 @@
 #!/bin/bash
+# Line-ending self-check (#546). Must stay on the first executable line: if this
+# file is ever rewritten with CRLF, bash needs to reach this check before the
+# parser chokes somewhere far away and blames an innocent line. `tr` also
+# strips the \r from this very line, so the check runs even when everything
+# around it is broken.
+if tr -d '\r' < "$0" | sed -n '2p' | tr -d '\r' | grep -q 'Line-ending self-check'; then
+  if [ "$(tr -cd '\r' < "$0" | wc -c | tr -d '[:space:]')" -gt 0 ]; then
+    echo "======================================================================" >&2
+    echo "FATAL: hook has CRLF line endings — bash cannot parse it (#546)." >&2
+    echo "  file: $0" >&2
+    echo "  fix : tr -d '\\r' < \"$0\" > \"$0.tmp\" && mv \"$0.tmp\" \"$0\" && chmod +x \"$0\"" >&2
+    echo "Or re-sync the installed copy: xp-gate doctor --sync-hooks" >&2
+    echo "======================================================================" >&2
+    exit 1
+  fi
+fi
 # Pre-push Hook — 8 gates: Gate 10 (Build Integrity) + M/M-Python/M-Go/M-Java/M-Kotlin (Mutation)
 # + M2 (Mock Density, WARNING) + ML (Mock Layering) + UI (UI Sprint Gates) + MW (Code Walkthrough) + S (Sprint Flow)
 #
@@ -220,6 +236,10 @@ if [ -f "$MP_ROOT/scripts/check-hook-mirror.sh" ]; then
   fi
 else
   echo "⚠️ Gate MP: check-hook-mirror.sh not found. SKIP — Gate MP."
+  echo "   Gate MP did not run; this push was not checked for mirror drift."
+  GATE_MP_STATUS="SKIP"
+  GATE_MP_SKIP_REASON="mirror_script_not_found"
+  GATES_SKIPPED="${GATES_SKIPPED:-}Gate MP (mirror parity: script not found)|"
   MP_DURATION_MS=0
 fi
 echo ""
@@ -491,6 +511,13 @@ PY_SOURCE_FILES=$(echo "$PY_FILES" | grep -v '/venv/' | grep -v '/\.venv/' || tr
 
 if [ -z "$PY_SOURCE_FILES" ]; then
   echo "📚 No changed Python source files. SKIP — Gate M (Python)."
+  # #557: this outermost branch was the only Gate M (Python) path that assigned
+  # no status, while Gate M (TypeScript) records a reason on every path. Without
+  # it, "no Python in this push" and "the tool is missing" look identical in the
+  # journals, which is the gap #404 P0 spent effort closing for the TS gate.
+  GATE_M_PY_STATUS="SKIP"
+  GATE_M_PY_SKIP_REASON="no_python_source_files"
+  GATES_SKIPPED="${GATES_SKIPPED:-}Gate M Python (no changed Python source files)|"
 else
   PYTHON_FILE_LIST=$(echo "$PY_SOURCE_FILES" | tr '\n' ',' | sed 's/,$//')
   echo "🐍 Changed Python files: $PYTHON_FILE_LIST"
@@ -504,6 +531,7 @@ else
       case $MUTATION_EXIT in
         0)
           echo "✅ Gate M (Python): PASS"
+          GATE_M_PY_STATUS="PASS"
           ;;
         1)
           echo ""
@@ -519,16 +547,28 @@ else
         124)
           cat "$MUTATION_OUTPUT"
           echo "⏱ Gate M (Python): TIMEOUT (120s). Allowing push with warning."
+          # A timeout means the mutation score was never measured. Saying
+          # nothing here let the closing banner claim success for a gate that
+          # started work and could not finish (#557).
+          GATE_M_PY_STATUS="TIMEOUT"
+          GATE_M_PY_SKIP_REASON="timeout_120s"
+          GATES_SKIPPED="${GATES_SKIPPED:-}Gate M Python (TIMEOUT — score never measured)|"
           ;;
         *)
           cat "$MUTATION_OUTPUT"
           echo "⚠ Gate M (Python): Unexpected exit code $MUTATION_EXIT. Allowing push with warning."
+          GATE_M_PY_STATUS="ERROR"
+          GATE_M_PY_SKIP_REASON="unexpected_exit_${MUTATION_EXIT}"
+          GATES_SKIPPED="${GATES_SKIPPED:-}Gate M Python (error, exit ${MUTATION_EXIT} — score never measured)|"
           ;;
       esac
 
       rm -f "$MUTATION_OUTPUT"
     else
       echo "⚠ Gate M script not found. SKIP — Gate M (Python)."
+      GATE_M_PY_STATUS="SKIP"
+      GATE_M_PY_SKIP_REASON="gate_m_script_not_found"
+      GATES_SKIPPED="${GATES_SKIPPED:-}Gate M Python (gate-m.ts not found)|"
     fi
   else
     echo "⚠ mutmut not installed. SKIP — Gate M (Python)."
@@ -929,11 +969,51 @@ if [[ "$XP_GATE_SKIP_UI_GATES" == "1" ]]; then
   AUDIT_ENTRY="{\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"branch\":\"$CURRENT_BRANCH\",\"commit\":\"$(git rev-parse HEAD)\",\"user\":\"$(git config user.name || echo 'unknown')\",\"reason\":\"$XP_GATE_BYPASS_REASON\",\"bypass_type\":\"ui-gates\"}"
   echo "$AUDIT_ENTRY" >> .audit-log.jsonl
 else
-    # Detect UI changes in pushed files
-    UI_DETECTION=$(echo "$PUSHED_FILES" | npx -y tsx src/npm-package/lib/ui-detector.ts --push-mode --from-stdin 2>/dev/null) || true
-    
-    IS_UI_SPRINT=$(echo "$UI_DETECTION" | jq -r '.isUiSprint' 2>/dev/null || echo "false")
-    
+    # Detect UI changes in pushed files.
+    #
+    # stderr is kept out of the captured value but its ABSENCE is no longer
+    # treated as a clean "no UI here" answer (#553). jq -r prints the empty
+    # string and exits 0 on empty input, so the old `|| echo "false"` fallback
+    # was unreachable; an empty verdict became "", which is not "true", which
+    # silently took the "No UI changes detected — skipping" branch. A push whose
+    # only change was src/ui/streamlit_app.py was therefore told there was
+    # nothing to review — the failure Gate UI exists to prevent, inverted.
+    UI_DETECTION=$(echo "$PUSHED_FILES" | npx -y tsx src/npm-package/lib/ui-detector.ts --push-mode --from-stdin 2>/dev/null)
+    UI_DETECT_EXIT=$?
+
+    if [ "$UI_DETECT_EXIT" -eq 0 ] && [ -n "$UI_DETECTION" ]; then
+      IS_UI_SPRINT=$(echo "$UI_DETECTION" | jq -r 'if type == "object" then (.isUiSprint | tostring) else "unknown" end' 2>/dev/null)
+    else
+      IS_UI_SPRINT=""
+    fi
+    # Three answers, not two. "" (detector missing, crashed, or emitted nothing)
+    # is "unknown", and unknown must never read as "no UI".
+    if [ -z "$IS_UI_SPRINT" ] || [ "$IS_UI_SPRINT" = "null" ]; then
+      IS_UI_SPRINT="unknown"
+    fi
+
+    if [ "$IS_UI_SPRINT" = "unknown" ]; then
+      # A missing detector must not disable UI review. Fall back to a path
+      # check over the same file list: a cheap, conservative substitute for a
+      # verdict we do not have.
+      UI_PATH_HITS=$(echo "$PUSHED_FILES" | grep -Ei '(^|/)(src/ui|ui|components|pages|views|screens)/|[.](tsx|jsx|vue|svelte|css|scss|sass|less)$' || true)
+      if [ -n "$UI_PATH_HITS" ]; then
+        echo ""
+        echo "❌ Gate UI: could not evaluate the UI verdict (detector unavailable or produced no verdict, exit ${UI_DETECT_EXIT})."
+        echo "   This push touches UI-looking paths:"
+        echo "$UI_PATH_HITS" | sed 's/^/     /'
+        echo ""
+        echo "   The gate cannot claim there is nothing to review when it never got an answer."
+        echo "   Fix: install the detector (npx -y tsx must be able to load src/npm-package/lib/ui-detector.ts),"
+        echo "   or run the review explicitly: xp-gate ui-review"
+        echo "   To accept the risk for this push: XP_GATE_SKIP_UI_GATES=1 XP_GATE_BYPASS_REASON=\"<why>\""
+        echo ""
+        exit 1
+      fi
+      echo "ℹ️  Gate UI: detector unavailable (exit ${UI_DETECT_EXIT}) and no UI-looking paths in this push — nothing to review."
+      IS_UI_SPRINT="false"
+    fi
+
     if [[ "$IS_UI_SPRINT" == "true" ]]; then
       UI_RESULT_FILE=".ui-gate-result.json"
       MISSING_RESULTS=()
@@ -1067,10 +1147,21 @@ fi
 fi
 
 # ============================================================================
-# ALL CHECKS PASSED
+# Closing banner. States what actually happened (#557): a gate that skipped is
+# named. The heading used to read "ALL CHECKS PASSED" unconditionally while Gate
+# MP and Gate M (Python) skipped on a typical push without recording why, so a
+# reviewer skimming the log had no signal that mutation testing never ran.
 # ============================================================================
 echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+# Trim the trailing separator and turn it into a displayable list.
+SKIPPED_DISPLAY=$(printf '%s' "${GATES_SKIPPED:-}" | sed 's/|$//' | sed 's/|/ , /g')
+if [ -n "$SKIPPED_DISPLAY" ]; then
+  echo "   ⚠️  NO BLOCKING FAILURES — but not every gate ran:"
+  echo "$SKIPPED_DISPLAY" | tr ',' '\n' | sed '/^[[:space:]]*$/d' | sed 's/^[[:space:]]*/     - /'
+else
+  echo "   ✅ ALL CHECKS PASSED"
+fi
 # Say what actually happened. Printing "VERIFIED" on a skipped gate would be a
 # claim the hook cannot support — the same dishonesty (evidence asserting an
 # unperformed check) that Gate MW exists to prevent.