@boyingliu01/xp-gate 0.30.2 → 0.30.3

package/hooks/sprint-gate.sh

@@ -181,6 +181,65 @@ read_verdict() {
   json_extract "$APPROVED_FILE" '.verdict // ""' || echo ""
 }
 
+# --- Helper: sprint age in days, or empty if unknown ---
+# Reads status + started_at from sprint-state.json. #551: the gate judged only
+# `phase` and the delphi verdict, so a state file left at status=in_progress
+# reported "sprint phase 6 validated" on unrelated commits for as long as
+# nobody fixed it. An advancing sprint and an abandoned one were
+# indistinguishable -- worse than SKIP, because SKIP is honest and PASS lies.
+read_sprint_status() {
+  if [ ! -f "$SPRINT_STATE_JSON" ] || [ "$JSON_PARSER" = "none" ]; then
+    echo ""
+    return
+  fi
+  json_validate "$SPRINT_STATE_JSON" || { echo ""; return; }
+  json_extract "$SPRINT_STATE_JSON" '.status // ""' 2>/dev/null || echo ""
+}
+
+read_sprint_age_days() {
+  if [ ! -f "$SPRINT_STATE_JSON" ] || [ "$JSON_PARSER" = "none" ]; then
+    echo ""
+    return
+  fi
+  json_validate "$SPRINT_STATE_JSON" || { echo ""; return; }
+  local started
+  started=$(json_extract "$SPRINT_STATE_JSON" '.started_at // ""' 2>/dev/null || echo "")
+  # Older state files may carry updated_at only; either is the last sign of life.
+  if [ -z "$started" ] || [ "$started" = "null" ]; then
+    started=$(json_extract "$SPRINT_STATE_JSON" '.updated_at // ""' 2>/dev/null || echo "")
+  fi
+  if [ -z "$started" ] || [ "$started" = "null" ]; then
+    echo ""
+    return
+  fi
+  # Portable ISO-8601 -> epoch. GNU date first, BSD date second, node last; if
+  # all fail the age is unknown and the caller must not invent one.
+  local epoch=""
+  epoch=$(date -u -d "$started" +%s 2>/dev/null || true)
+  if [ -z "$epoch" ]; then
+    epoch=$(date -u -j -f "%Y-%m-%dT%H:%M:%SZ" "$started" +%s 2>/dev/null || true)
+  fi
+  if [ -z "$epoch" ] && command -v node >/dev/null 2>&1; then
+    epoch=$(node -e "const t=Date.parse(process.argv[1]);if(Number.isFinite(t))process.stdout.write(String(Math.floor(t/1000)))" "$started" 2>/dev/null || true)
+  fi
+  if [ -z "$epoch" ]; then
+    echo ""
+    return
+  fi
+  local now
+  now=$(date -u +%s)
+  local age=$(( (now - epoch) / 86400 ))
+  [ "$age" -lt 0 ] && age=0
+  echo "$age"
+}
+
+# Threshold in days beyond which an in_progress sprint is considered abandoned.
+# Configurable because the right number is project-specific: a weekly cadence
+# wants 14, a monthly one wants more. Default 14 = two full weeks without
+# progress: enough that a sprint paused over a holiday is not called dead, tight
+# enough that the reported 12-day case is caught within two days of it firing.
+SPRINT_STALE_DAYS="${SPRINT_STALE_DAYS:-14}"
+
 # --- Pre-commit mode ---
 if [ "$MODE" = "pre-commit" ]; then
   PHASE=$(read_phase)
@@ -222,8 +281,28 @@ if [ "$MODE" = "pre-commit" ]; then
       exit 1
     fi
 
-    # All checks passed
-    echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated\"}"
+    # #551: staleness. A sprint left at status=in_progress past the threshold is
+    # abandoned, not validated -- reporting PASS for it means the gate cannot
+    # distinguish an advancing sprint from a forgotten one, and it injects
+    # ancient phase_history into every unrelated commit's audit trail. SKIP is
+    # the honest answer: the gate declines to certify a sprint nobody is
+    # driving, without blocking work that has nothing to do with it.
+    SPRINT_STATUS=$(read_sprint_status)
+    SPRINT_AGE_DAYS=$(read_sprint_age_days)
+    if [ "$SPRINT_STATUS" = "in_progress" ] && [ -n "$SPRINT_AGE_DAYS" ] \
+       && [ "$SPRINT_AGE_DAYS" -ge "$SPRINT_STALE_DAYS" ] 2>/dev/null; then
+      echo "{\"decision\":\"skip\",\"reason\":\"STALE SPRINT: status=in_progress for ${SPRINT_AGE_DAYS} days (threshold ${SPRINT_STALE_DAYS}) — not certifying it. Finish it (sprint-flow close) or clear .sprint-state/sprint-state.json\"}"
+      exit 0
+    fi
+
+    # All checks passed. Name the age so "validated" is not an unconditional
+    # claim: a 29-day-old sprint under a 30-day threshold is a very different
+    # situation from one opened today, and the log should say which it is.
+    if [ -n "$SPRINT_AGE_DAYS" ]; then
+      echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint open ${SPRINT_AGE_DAYS} day(s), staleness threshold ${SPRINT_STALE_DAYS})\"}"
+    else
+      echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint age unknown — started_at unreadable)\"}"
+    fi
     exit 0
   fi
 

package/lib/__tests__/hook-health.test.js

@@ -0,0 +1,85 @@
+/**
+ * @test REQ-546 hook health: line endings and bash parseability
+ * @intent Verify doctor can tell a hook that merely EXISTS from a hook git can
+ *         actually run. #546: a pre-commit rewritten with CRLF line endings
+ *         failed every commit while `xp-gate doctor` reported it healthy,
+ *         because the check only asked whether the file was there.
+ * @covers AC-05, AC-08
+ */
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const { inspectHookFile } = require('../hook-health');
+
+let TMP_DIR;
+
+beforeAll(() => {
+  TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'hook-health-'));
+});
+
+afterAll(() => {
+  fs.rmSync(TMP_DIR, { recursive: true, force: true });
+});
+
+function write(name, content) {
+  const p = path.join(TMP_DIR, name);
+  fs.writeFileSync(p, content);
+  return p;
+}
+
+describe('inspectHookFile', () => {
+  test('a healthy LF hook reports ok', () => {
+    const p = write('good.sh', '#!/bin/bash\nfoo() {\n  echo hi\n}\nfoo\n');
+    const r = inspectHookFile(p);
+    expect(r.ok).toBe(true);
+    expect(r.crlfLines).toBe(0);
+    expect(r.problems).toEqual([]);
+  });
+
+  test('an all-CRLF hook is reported with a CRLF count', () => {
+    const p = write('crlf.sh', '#!/bin/bash\r\nfoo() {\r\n  echo hi\r\n}\r\nfoo\r\n');
+    const r = inspectHookFile(p);
+    expect(r.ok).toBe(false);
+    expect(r.crlfLines).toBe(5);
+    expect(r.problems.join(' ')).toMatch(/CRLF/);
+  });
+
+  test('a single stray CRLF is enough to fail', () => {
+    // One bad line is all bash needs to choke on, and it is the case an
+    // "is the file mostly fine" heuristic would wave through.
+    const p = write('one.sh', '#!/bin/bash\necho one\necho two\r\necho three\n');
+    const r = inspectHookFile(p);
+    expect(r.ok).toBe(false);
+    expect(r.crlfLines).toBe(1);
+  });
+
+  test('CRLF in the middle of a multi-line construct is flagged', () => {
+    // The exact shape from #546: the \r lands inside a construct bash is
+    // mid-way through parsing, so the reported line number drifts far from
+    // the real cause.
+    const p = write('mid.sh', 'case "$x" in\r\n  a) echo a ;;\r\nesac\n');
+    const r = inspectHookFile(p);
+    expect(r.ok).toBe(false);
+    expect(r.crlfLines).toBe(2);
+  });
+
+  test('a syntax error with clean line endings is reported as unparseable', () => {
+    const p = write('bad.sh', '#!/bin/bash\nif [ 1 -eq 1 ]; then\n  echo x\n');
+    const r = inspectHookFile(p);
+    expect(r.ok).toBe(false);
+    expect(r.problems.join(' ')).toMatch(/not parseable|syntax/i);
+  });
+
+  test('a binary-looking file does not crash the inspector', () => {
+    const p = path.join(TMP_DIR, 'bin.sh');
+    fs.writeFileSync(p, Buffer.from([0x00, 0xff, 0xfe, 0x0a]));
+    expect(() => inspectHookFile(p)).not.toThrow();
+  });
+
+  test('a missing file reports missing rather than throwing', () => {
+    const r = inspectHookFile(path.join(TMP_DIR, 'nope.sh'));
+    expect(r.ok).toBe(false);
+    expect(r.problems.join(' ')).toMatch(/missing/i);
+  });
+});

package/lib/coverage-total.sh

@@ -0,0 +1,92 @@
+#!/bin/bash
+# Gate 5's Python coverage parsing and threshold verdict (#523).
+#
+# Sourced by githooks/pre-commit; kept in its own file so the contract is
+# unit-testable without executing the hook
+# (githooks/__tests__/issue-523-python-coverage-parse.test.bats).
+#
+# The defect this file exists for: `coverage report --format=total` prints a
+# BARE number ("97"), but the hook piped it through `grep -o '[0-9]*%'` — a
+# pattern that requires a literal percent sign — so COVERAGE_PERCENT was always
+# empty and the 80% threshold branch never executed. The gate answered "Could
+# not determine" forever: a silent no-op, not a verdict.
+
+# Parse the raw output of `coverage report --format=total` (stdin) and echo the
+# integer total percentage — or nothing when the input carries no number.
+#
+# coverage.py 7.x --format=total prints a bare number; other tools (and older
+# forms) append a percent sign. Only a line that IS a bare number (optionally
+# %-suffixed) is accepted — a line that merely CONTAINS a number ("WARNING: 2
+# files skipped") must not be mistaken for the total, so the whole line is
+# matched, not the first token. A decimal part is truncated (floor — the
+# conservative direction for a threshold gate, the same convention as the Java
+# path's ${VAR%.*}). Inputs without any bare-number line (empty, "No data to
+# report.", warnings) produce NO output so the caller takes its
+# cannot-determine path: a wrong number is worse than none.
+parse_coverage_total() {
+  awk '
+    {
+      line = $0
+      sub(/%$/, "", line)
+      gsub(/^[ \t]+|[ \t]+$/, "", line)
+      if (line ~ /^[0-9]+(\.[0-9]+)?$/) {
+        sub(/\.[0-9]+$/, "", line)
+        print line
+        exit
+      }
+    }
+  '
+}
+
+# Gate 5 Stage 2 Python coverage enforcement — the hook's python case body,
+# extracted so the mock-PATH test exercises the real control flow. Echoes the
+# verdict lines and returns 1 on BLOCK (the caller turns that into `exit 1`).
+#
+# COVERAGE_PERCENT is deliberately NOT declared local: the hook's quality
+# report reads it after the Stage-2 loop (last writer wins across languages),
+# exactly as the inline branch did.
+enforce_python_coverage() {
+  # Critical-1 (#399): when the test run was skipped (PY_STRATEGY=skip, set in
+  # pre-commit before this Stage-2 function), refuse to consume a stale
+  # .coverage left by an earlier subset run — its low % is meaningless for a
+  # commit that changed no Python and must not BLOCK a docs-only change. This
+  # mirrors the TS branch's TESTS_SKIPPED guard.
+  if [ "${PY_TEST_SKIPPED:-false}" = "true" ]; then
+    echo "ℹ️  Test run was skipped — skipping Python coverage check."
+    return 0
+  fi
+
+  if ! command -v coverage &> /dev/null; then
+    echo "⚠️  coverage.py not available, cannot enforce Python coverage threshold."
+    return 0
+  fi
+
+  COVERAGE_PERCENT=""
+  if [ -f ".coverage" ]; then
+    COVERAGE_PERCENT=$(coverage report --format=total 2>/dev/null | parse_coverage_total) || true
+  fi
+  if [ -z "$COVERAGE_PERCENT" ] && [ -f "coverage/.coverage" ]; then
+    COVERAGE_PERCENT=$(coverage report --format=total -i coverage 2>/dev/null | parse_coverage_total) || true
+  fi
+
+  if [ -n "$COVERAGE_PERCENT" ]; then
+    if [ "$COVERAGE_PERCENT" -lt "${COVERAGE_THRESHOLD:-80}" ]; then
+      # #399: a subset run (smart test selection) measures only the tested
+      # files, so its global total is meaningless as a verdict — the full
+      # suite may well be >=80% even when the subset is not. Warn exactly as
+      # the TypeScript branch does (#286) instead of blocking. Full runs keep
+      # the hard BLOCK below.
+      if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
+        echo "⚠️  Partial coverage ${COVERAGE_PERCENT}% (subset test run, not full suite)."
+        echo "    Run the full suite for a real Python coverage check."
+        return 0
+      fi
+      echo "❌ BLOCKED - Python coverage ${COVERAGE_PERCENT}% below 80% threshold"
+      return 1
+    fi
+    echo "Python coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
+  else
+    echo "⚠️  Could not determine Python coverage percentage. Ensure pytest-cov or coverage.py data exists."
+  fi
+  return 0
+}

package/lib/doctor.js

@@ -18,6 +18,14 @@ const { GATE_CLI_TOOLS, checkCliTool, getToolInstallCmd, checkBash } = require('
 // #505: the single source of truth for module resolution order. The hook reads a
 // generated shell projection of this same module.
 const { RESOLUTION_ORDER } = require('./hook-module-resolution.js');
+const { inspectHookFile } = require('./hook-health.js');
+
+/**
+ * Files above this size get a `bash -n` probe in addition to the CRLF scan.
+ * Real xp-gate hooks are 40 KB (pre-push) to 190 KB (pre-commit); test fixtures
+ * and stubs are a few hundred bytes. 4 KB separates them comfortably.
+ */
+const PARSE_CHECK_MIN_BYTES = 4096;
 const {
   diagnoseTuiRegistration, diagnoseInstalledSkills,
   fixTuiRegistration, ensureTuiRegistration, readTuiJson,
@@ -1256,10 +1264,46 @@ function checkSingleHook(hooksDir, name, signature, label, checks) {
     checks.push({ name: `${label}: ${name}`, status: 'FAIL', detail: 'Missing or not xp-gate' });
     return 1;
   }
+  // Existence and signature are not enough (#546): a hook rewritten with CRLF
+  // line endings, or truncated mid-write, satisfies both and still cannot run.
+  // Reporting it as healthy is worse than reporting nothing, because the
+  // operator stops looking.
+  //
+  // The CRLF scan is pure and cheap; the `bash -n` probe spawns a process, so it
+  // is skipped for files under the size floor below — test fixtures and stub
+  // hooks are not the things that break here, and spawning bash per stub made
+  // doctor slower than its own test timeout.
+  const health = inspectHookFile(hookPath, { parseCheck: shouldParseCheck(hookPath) });
+  if (!health.ok) {
+    checks.push({
+      name: `${label}: ${name}`,
+      status: 'FAIL',
+      detail: health.problems.join('; '),
+    });
+    return 1;
+  }
   checks.push({ name: `${label}: ${name}`, status: 'PASS', detail: hookPath });
   return 0;
 }
 
+/**
+ * Should the `bash -n` probe run for this hook?
+ *
+ * Measured on a real install: a 190 KB pre-commit takes ~90 ms to parse, but a
+ * dozen stubs in a test fixture still add up to seconds of process spawns. The
+ * CRLF scan catches the #546 failure without spawning anything, so the probe is
+ * reserved for files large enough to be a real hook.
+ * @param {string} hookPath - Hook path
+ * @returns {boolean} Whether to run the parse check
+ */
+function shouldParseCheck(hookPath) {
+  try {
+    return fs.statSync(hookPath).size > PARSE_CHECK_MIN_BYTES;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Expected gate scripts that should be present in the adapters directory.
  * gate-5.sh and gate-6.sh are inline in pre-commit, so they are NOT expected here.

package/lib/hook-health.js

@@ -0,0 +1,121 @@
+/**
+ * Hook file health inspection (#546).
+ *
+ * `xp-gate doctor` used to answer one question about an installed hook: does the
+ * file exist and does it carry the xp-gate signature. A hook can satisfy both
+ * and still be unrunnable — #546 was a pre-commit that had been rewritten with
+ * CRLF line endings, which fails every commit while doctor reported ✓.
+ *
+ * Two independent failure modes are checked here:
+ *   - CRLF line endings: git runs hooks through bash, and a stray \r makes the
+ *     parser choke at a line number far from the real cause (the reported line
+ *     is wherever the multi-line construct that swallowed the \r began).
+ *   - Unparseable syntax: a truncated or mangled write leaves a hook that
+ *     exists but cannot run.
+ *
+ * Both are reported per file rather than as a single boolean, because the
+ * operator needs to know which one happened: CRLF has a mechanical fix, a
+ * syntax error does not.
+ */
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+/**
+ * Locate a bash binary without assuming it is on PATH under that exact name.
+ * @returns {string|null} Path or bare command name, null when none found
+ */
+function findBash() {
+  const candidates = ['bash'];
+  if (process.platform === 'win32') {
+    // Git for Windows ships bash outside PATH far more often than inside it.
+    const pf = process.env.ProgramFiles || 'C:\\Program Files';
+    const pf86 = process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)';
+    const local = process.env.LOCALAPPDATA;
+    if (local) candidates.push(path.join(local, 'Programs', 'Git', 'bin', 'bash.exe'));
+    candidates.push(path.join(pf, 'Git', 'bin', 'bash.exe'));
+    candidates.push(path.join(pf86, 'Git', 'bin', 'bash.exe'));
+    candidates.push(path.join(pf, 'Git', 'usr', 'bin', 'bash.exe'));
+  }
+  for (const c of candidates) {
+    if (path.isAbsolute(c)) {
+      if (fs.existsSync(c)) return c;
+      continue;
+    }
+    const probe = spawnSync(c, ['--version'], { encoding: 'utf8', timeout: 10000 });
+    if (!probe.error && probe.status === 0) return c;
+  }
+  return null;
+}
+
+/**
+ * Count lines that end with CRLF.
+ * @param {string} text - File content
+ * @returns {number} Number of CRLF-terminated lines
+ */
+function countCrlfLines(text) {
+  const matches = text.match(/\r\n/g);
+  return matches ? matches.length : 0;
+}
+
+/**
+ * Ask bash whether it can parse the file (`bash -n`).
+ * @param {string} filePath - Hook to check
+ * @param {string} bashBin - Resolved bash binary
+ * @returns {{checked: boolean, ok: boolean, detail: string}} Parse verdict
+ */
+function checkParseable(filePath, bashBin) {
+  if (!bashBin) return { checked: false, ok: true, detail: 'bash not found; parse check skipped' };
+  const res = spawnSync(bashBin, ['-n', filePath], { encoding: 'utf8', timeout: 30000 });
+  if (res.error) return { checked: false, ok: true, detail: `bash -n could not run: ${res.error.message}` };
+  if (res.status === 0) return { checked: true, ok: true, detail: 'parses' };
+  // bash reports the first syntax error it hits. Under CRLF that line number is
+  // unreliable, which is exactly why the CRLF count is reported alongside.
+  const firstLine = String(res.stderr || '').split('\n').find(l => l.trim()) || `exit ${res.status}`;
+  return { checked: true, ok: false, detail: firstLine.trim() };
+}
+
+/**
+ * Inspect one hook file for the conditions that make git unable to run it.
+ * @param {string} filePath - Hook path
+ * @param {{bashBin?: string|null, parseCheck?: boolean}} [options] - Overrides
+ * @returns {{ok: boolean, crlfLines: number, parseable: boolean, problems: string[]}}
+ */
+function inspectHookFile(filePath, options = {}) {
+  const problems = [];
+
+  if (!fs.existsSync(filePath)) {
+    return { ok: false, crlfLines: 0, parseable: false, problems: [`hook file is missing: ${filePath}`] };
+  }
+
+  let text = '';
+  try {
+    text = fs.readFileSync(filePath, 'latin1');
+  } catch (err) {
+    return { ok: false, crlfLines: 0, parseable: false, problems: [`hook file is unreadable: ${err.message}`] };
+  }
+
+  const crlfLines = countCrlfLines(text);
+  if (crlfLines > 0) {
+    problems.push(
+      `hook has CRLF line endings (${crlfLines} line(s)) — bash will fail to parse it; ` +
+        'run `tr -d "\\r" < hook > hook.fixed && mv hook.fixed hook`'
+    );
+  }
+
+  // A CRLF hit already answers the question this probe exists to answer, and
+  // the probe is the expensive half. Callers can also opt out for stubs.
+  if (crlfLines > 0 || options.parseCheck === false) {
+    return { ok: problems.length === 0, crlfLines, parseable: crlfLines === 0, problems };
+  }
+
+  const bashBin = options.bashBin !== undefined ? options.bashBin : findBash();
+  const parsed = checkParseable(filePath, bashBin);
+  if (!parsed.ok) {
+    problems.push(`hook is not parseable by bash: ${parsed.detail}`);
+  }
+
+  return { ok: problems.length === 0, crlfLines, parseable: parsed.ok, problems };
+}
+
+module.exports = { inspectHookFile, findBash, countCrlfLines };

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-20T12:36:08.136Z",
+  "checked_at": "2026-10-20T19:22:03.640Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.30.2",
+  "version": "0.30.3",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.30.2",
+  "version": "0.30.3",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.30.2",
+  "version": "0.30.3",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.30.2",
+  "version": "0.30.3",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-20
-**Commit:** 9fab5b3b
+**Commit:** 03f6d10a
 **Branch:** main
-**Version:** 0.30.2.0
+**Version:** 0.30.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.30.2",
+  "version": "0.30.3",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {