@boyingliu01/xp-gate 0.30.2 → 0.30.4

package/gate-4.sh

@@ -56,11 +56,15 @@ GATE_4_START=$(gate_start_ms)
 GATE_4_STATUS=""
 # #537: every non-run records WHY (no files / tool missing / unsupported lang)
 # so the quality report can distinguish "not applicable" from "not covered".
+# Consumed by the sourcing parent, not here (see #548).
+# shellcheck disable=SC2034
 GATE_4_REASON=""
 
 if [ "$PROJECT_LANG" = "documentation-only" ]; then
   echo "⏭️  SKIPPED - Principles check (documentation project)."
   GATE_4_STATUS="SKIP"
+  # Consumed by the sourcing parent, not here (see #548).
+  # shellcheck disable=SC2034
   GATE_4_REASON="documentation_project"
   
 else
@@ -156,6 +160,8 @@ else
           echo "⚠️  Warning: Principles checker execution failed"
           echo "⏭️  SKIPPED - Principles check (execution issue)"
           GATE_4_STATUS="SKIP"
+          # Consumed by the sourcing parent, not here (see #548).
+          # shellcheck disable=SC2034
           GATE_4_REASON="checker_execution_error"
           rm -f "$PRINCIPLES_JSON"
         else
@@ -191,17 +197,23 @@ else
         echo "ℹ️  npx/tsx not available - skipping principles check"
         echo "⏭️  SKIPPED - Principles check (no Node.js/tsx)"
         GATE_4_STATUS="SKIP"
+        # Consumed by the sourcing parent, not here (see #548).
+        # shellcheck disable=SC2034
         GATE_4_REASON="tool_not_installed"
       fi
     else
       echo "ℹ️  Principles checker not found in project - skipping"
       echo "⏭️  SKIPPED - Principles check (checker not in project)"
       GATE_4_STATUS="SKIP"
+      # Consumed by the sourcing parent, not here (see #548).
+      # shellcheck disable=SC2034
       GATE_4_REASON="checker_not_found"
     fi
   else
     echo "⏭️  SKIPPED - Principles check (no matching source files changed)"
     GATE_4_STATUS="SKIP"
+    # Consumed by the sourcing parent, not here (see #548).
+    # shellcheck disable=SC2034
     GATE_4_REASON="no_matching_files_changed"
   fi
 fi

package/gate-7.sh

@@ -12,11 +12,15 @@ GATE_7_START=$(gate_start_ms)
 IAC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E "\.(tf|yaml|yml)$|Dockerfile" || true)
 # #536: scanned_files makes a trivial PASS (nothing to scan) auditable in the
 # quality report instead of reading like a covered security check.
+# Consumed by the sourcing parent, not here (see #548).
+# shellcheck disable=SC2034
 GATE_7_SCANNED_FILES=0
 if [ -z "$IAC_FILES" ]; then
   echo "✅ PASSED - No IaC files detected in changes."
   GATE_7_STATUS="PASS"
 else
+  # Consumed by the sourcing parent, not here (see #548).
+  # shellcheck disable=SC2034
   GATE_7_SCANNED_FILES=$(printf '%s\n' "$IAC_FILES" | sed -n '/./p' | wc -l | tr -d '[:space:]')
   # Run IaC adapter. Resolution follows the documented 3-tier convention
   # (adapter-common.sh): global ~/.config/xp-gate/adapters -> project

package/hooks/gate-10.sh

@@ -12,7 +12,20 @@ GATE_10_START=$(gate_start_ms)
 GATE_10_STATUS=""
 # #536: audit trail for "did this commit actually get scanned?". The report
 # surfaces reason + scanned_files so a non-scan never reads as a clean PASS.
+#
+# GATE_10_REASON and GATE_10_SCANNED_FILES are consumed by the sourcing parent
+# (pre-commit builds its report JSON from them after `source gate-10.sh`), not
+# inside this file. The linter checks one file at a time and cannot see the
+# consumer, so each assignment is flagged SC2034 "appears unused" -- which
+# blocks Gate 1 for any repo that vendors this adapter, because that repo's own
+# lint pass runs over the vendored copy (#548). Each assignment carries a
+# scoped directive with that reason stated at the site.
+#
+# Consumed by the sourcing parent (pre-commit report JSON), not here.
+# shellcheck disable=SC2034
 GATE_10_REASON=""
+# Consumed by the sourcing parent (pre-commit report JSON), not here.
+# shellcheck disable=SC2034
 GATE_10_SCANNED_FILES=0
 
 # Semgrep availability check
@@ -29,14 +42,21 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     Pre-cache rules: semgrep --config=p/security-audit"
   echo "     Gate 10: SAST Security (WARN, semgrep not installed)"
   GATE_10_STATUS="WARN"
+  # Consumed by the sourcing parent (pre-commit report JSON), not here.
+  # shellcheck disable=SC2034
   GATE_10_REASON="tool_not_installed"
 else
-  # Get staged files filtered to Semgrep-supported languages
-  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  # Get staged files filtered to Semgrep-supported languages.
+  # #547 finding 3: ps1|psm1 were missing, so a PowerShell-only commit never
+  # reached semgrep even when Gate 10 ran -- the SAST gate was simply absent
+  # for that language.
+  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift|ps1|psm1)$' || true)
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"
     GATE_10_STATUS="SKIP"
+    # Consumed by the sourcing parent (pre-commit report JSON), not here.
+    # shellcheck disable=SC2034
     GATE_10_REASON="no_supported_files"
   else
     # One path per line into an array. Quoting the newline-joined list would hand
@@ -71,11 +91,27 @@ else
       [ -n "$_semgrep_file" ] || continue
       SEMGREP_FILE_COUNT=$((SEMGREP_FILE_COUNT + 1))
       SEMGREP_ARGS+=("--include=${_semgrep_file##*/}")
-      _semgrep_dir="./${_semgrep_file%/*}"
-      # A repo-root file has no directory component ("./x.ts" strips to "./").
-      [ "$_semgrep_dir" = "./" ] && _semgrep_dir="."
+      # A repo-root file has no slash at all, so "%/*" returns it unchanged and
+      # the old comment's assumption (`"./x.ts" strips to "./"`) never held:
+      # the target became the FILE path dressed as a directory ("./x.ts").
+      # Strip only when a slash is present; otherwise the target is the repo
+      # root, spelled ".". Scanning "." widens the scan to the whole tree, which
+      # is the safe side (see the note above) and is what a root-level staged
+      # file requires in order to be analysed at all.
+      case "$_semgrep_file" in
+        */*) _semgrep_dir="./${_semgrep_file%/*}" ;;
+        *)   _semgrep_dir="." ;;
+      esac
+      # #558: dedup must match WHOLE lines. The previous `case "$SEEN" in
+      # *"$_semgrep_dir"*)` was an unanchored substring test: once
+      # ./fastdl/tests was recorded, the parent ./fastdl matched it and was
+      # never added as a target, so a staged fastdl/a.py contributed an
+      # --include= with no directory to scan it in. Nothing errored and nothing
+      # was reported -- the file was simply not analysed, which for a security
+      # gate is the worst outcome: a silent net loss that looks like a pass.
+      # Sibling prefixes (src/api vs src/app) collapsed the same way.
       case "$SEMGREP_DIRS_SEEN" in
-        *"$_semgrep_dir"*) : ;;
+        *$'\n'"$_semgrep_dir"$'\n'*) : ;;
         *) SEMGREP_ARGS+=("$_semgrep_dir"); SEMGREP_DIRS_SEEN="$SEMGREP_DIRS_SEEN$_semgrep_dir"$'\n' ;;
       esac
     done <<EOF
@@ -91,6 +127,8 @@ EOF
       echo "     Install node (https://nodejs.org); without it SAST findings cannot be classified"
       echo "     ⏭️  SKIPPED - SAST (node not installed)"
       GATE_10_STATUS="SKIP"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_10_REASON="tool_not_installed"
     else
 
@@ -109,9 +147,41 @@ EOF
     # code is demoted to "did the tool itself run". --error stays OFF: it would
     # add nothing the JSON does not already provide, and keeping it off leaves
     # failure exit codes unambiguous for the #475 diagnostics path.
-    SEMGREP_STDOUT_FILE=$(mktemp)
-    SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
-    SEMGREP_EXIT=$?
+    # #559: bound the run. Without a timeout, a wedged semgrep blocks the
+    # invocation for as long as its process lives; the fail-closed verdict logic
+    # below is correct but unreachable, so the hook hangs instead of judging.
+    # A gate that can wedge an interactive `git commit` gets bypassed with
+    # --no-verify, which is worse than any verdict it could have produced.
+    # `-k` after the primary signal: pysemgrep spinning in a syscall ignores
+    # SIGTERM, and the shipped 0.29 code used the same `-k 10` shape.
+    SEMGREP_TIMEOUT_S="${XP_GATE_SEMGREP_TIMEOUT:-180}"
+    SEMGREP_TIMED_OUT=false
+    if command -v timeout >/dev/null 2>&1; then
+      SEMGREP_STDOUT_FILE=$(mktemp)
+      SEMGREP_OUTPUT=$(timeout -k 10 "$SEMGREP_TIMEOUT_S" \
+        "$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check \
+        "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
+      SEMGREP_EXIT=$?
+      # 124 = timeout's own "I gave up" code. 137 = 128+SIGKILL, which is what
+      # `timeout -k` returns when the child ignored SIGTERM and had to be
+      # killed -- measured with a semgrep stand-in that traps TERM. Both mean
+      # "bounded, no verdict", so both must be reported as a timeout; checking
+      # only 124 told the user their semgrep was unparseable when in fact the
+      # scan had been cut off.
+      case "$SEMGREP_EXIT" in
+        124|137) SEMGREP_TIMED_OUT=true ;;
+      esac
+    else
+      # No `timeout` on this platform (stock macOS). Say so: an unbounded run
+      # nobody mentioned is exactly how #559 stayed invisible for a whole
+      # release. The scan still runs -- refusing to scan would be a worse
+      # trade -- but the unbounded window is now stated.
+      echo "     ⚠️  'timeout' command not available — semgrep runs UNBOUNDED (install coreutils or set up gtimeout)"
+      SEMGREP_STDOUT_FILE=$(mktemp)
+      SEMGREP_OUTPUT=$("$SEMGREP_CMD" scan --config=p/security-audit --json --disable-version-check \
+        "${SEMGREP_ARGS[@]}" 2>&1 >"$SEMGREP_STDOUT_FILE")
+      SEMGREP_EXIT=$?
+    fi
 
     # One node pass over the JSON: first line = verdict counts, remaining lines =
     # finding details. The severity vocabulary is the UNION of the two scales
@@ -153,7 +223,18 @@ console.log("");});
     if [ "$V_PARSE" != "OK" ] || [ -z "$V_RESULTS" ] || [ -z "$V_ERRORS" ] || [ -z "$V_BLOCKING" ] || [ -z "$V_WARNINGS" ]; then
       # Unparseable output: nothing the exit code claims can be trusted (#518).
       # Fail closed — SKIP with diagnostics, never a PASS.
-      echo "     ⚠️  semgrep output unparseable or verdict fields missing (exit code ${SEMGREP_EXIT}) — cannot determine verdict"
+      #
+      # #559: name a timeout as a timeout. The generic "unparseable" message
+      # would be true but useless here -- it points at the JSON parser when the
+      # real problem is that the scan was cut off. Same verdict (SKIP), but a
+      # diagnosis the reader can act on.
+      if [ "$SEMGREP_TIMED_OUT" = true ]; then
+        echo "     ⏱️  semgrep exceeded ${SEMGREP_TIMEOUT_S}s and was killed — no verdict is possible"
+        echo "     This is NOT a finding and NOT a clean scan. Raise XP_GATE_SEMGREP_TIMEOUT"
+        echo "     if the repo legitimately takes longer; investigate if semgrep itself is wedged."
+      else
+        echo "     ⚠️  semgrep output unparseable or verdict fields missing (exit code ${SEMGREP_EXIT}) — cannot determine verdict"
+      fi
       if [ -n "$SEMGREP_OUTPUT" ]; then
         echo "     ── what semgrep reported on stderr ──"
         printf '%s\n' "$SEMGREP_OUTPUT" | tail -10 | sed 's/^/     /'
@@ -162,9 +243,19 @@ console.log("");});
         echo "     ── what semgrep wrote to stdout (tail) ──"
         printf '%s\n' "$SEMGREP_STDOUT_TAIL" | sed 's/^/     /'
       fi
-      echo "     ⏭️  SKIPPED - SAST (semgrep output unparseable)"
-      GATE_10_STATUS="SKIP"
-      GATE_10_REASON="output_unparseable"
+      if [ "$SEMGREP_TIMED_OUT" = true ]; then
+        echo "     ⏭️  SKIPPED - SAST (semgrep timed out after ${SEMGREP_TIMEOUT_S}s)"
+        GATE_10_STATUS="SKIP"
+        # Consumed by the sourcing parent (pre-commit report JSON), not here.
+        # shellcheck disable=SC2034
+        GATE_10_REASON="semgrep_timeout"
+      else
+        echo "     ⏭️  SKIPPED - SAST (semgrep output unparseable)"
+        GATE_10_STATUS="SKIP"
+        # Consumed by the sourcing parent (pre-commit report JSON), not here.
+        # shellcheck disable=SC2034
+        GATE_10_REASON="output_unparseable"
+      fi
     elif [ "$V_RESULTS" -eq 0 ] && { [ "$V_ERRORS" -gt 0 ] || [ "$SEMGREP_EXIT" -ne 0 ]; }; then
       # Nothing was scanned to a verdict: semgrep either failed outright
       # (nonzero exit) or completed but reported scan errors for every input
@@ -178,6 +269,8 @@ console.log("");});
       fi
       echo "     ⏭️  SKIPPED - SAST (semgrep runtime error)"
       GATE_10_STATUS="SKIP"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_10_REASON="semgrep_runtime_error"
     elif [ "$V_BLOCKING" -gt 0 ]; then
       echo ""
@@ -192,9 +285,13 @@ console.log("");});
       echo "$FINDING_DETAILS"
       echo "  Run 'semgrep scan --config=p/security-audit' to review all findings."
       GATE_10_STATUS="FAIL"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_10_SCANNED_FILES=$SEMGREP_FILE_COUNT
       exit 1
     else
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_10_SCANNED_FILES=$SEMGREP_FILE_COUNT
       echo ""
       echo "     ✅ PASSED - No blocking vulnerabilities (files scanned: $SEMGREP_FILE_COUNT)"

package/hooks/gate-3.sh

@@ -8,11 +8,15 @@
  2>&1 echo "→ Gate 3: Cyclomatic complexity..."
 GATE_3_START=$(gate_start_ms)
 # #537: every non-run records WHY so the report can say why a gate is SKIP.
+# Consumed by the sourcing parent (pre-commit report JSON), not here.
+# shellcheck disable=SC2034
 GATE_3_REASON=""
 
 if [ "$PROJECT_LANG" = "documentation-only" ]; then
   echo "⏭️  SKIPPED - Complexity (documentation project)."
   GATE_3_STATUS="SKIP"
+  # Consumed by the sourcing parent (pre-commit report JSON), not here.
+  # shellcheck disable=SC2034
   GATE_3_REASON="documentation_project"
 
 elif [ "$PROJECT_LANG" = "powershell" ]; then
@@ -21,6 +25,8 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
   GATE_3_STATUS="SKIP"
   # #537: a PowerShell-primary repo was invisible to this dimension while the
   # score implied full coverage — say exactly why nothing ran.
+  # Consumed by the sourcing parent (pre-commit report JSON), not here.
+  # shellcheck disable=SC2034
   GATE_3_REASON="no_powershell_tool"
   
 else
@@ -159,7 +165,10 @@ else
         # empty stdin — the verdict comes back empty and Gate 3 passes on zero
         # rows (measured while wiring #544: same input passed or blocked
         # depending only on where the prefix sat).
+        # Consumed by evaluate_ccn_ratchet in the sourced lib, not here.
+        # shellcheck disable=SC2034
         CCN_WARN_THRESHOLD="$CCN_THRESHOLD"
+        # shellcheck disable=SC2034
         CCN_BLOCK_THRESHOLD=$((CCN_THRESHOLD * 2))
         RATCHET_VERDICT=$(printf '%s\n' "$CC_CSV" | evaluate_ccn_ratchet ".ccn-baseline.json")
         CC_VIOLATIONS=$(printf '%s\n' "$RATCHET_VERDICT" | grep -c '^BLOCK ' || true)
@@ -205,6 +214,8 @@ else
                                                  END { exit(found ? 0 : 1) }'; then
         echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
         GATE_3_STATUS="WARN"
+        # Consumed by the sourcing parent (pre-commit report JSON), not here.
+        # shellcheck disable=SC2034
         GATE_3_REASON="lizard_output_unparsable"
       elif [ "$CC_WARNINGS" -gt 0 ]; then
         echo "$CC_OUTPUT"
@@ -212,6 +223,8 @@ else
         echo "❌ BLOCKED - $CC_WARNINGS functions with CCN > $CCN_THRESHOLD found."
         echo "Refactor high-complexity functions to keep below $CCN_THRESHOLD complexity."
         GATE_3_STATUS="BLOCK"
+        # Consumed by the sourcing parent (pre-commit report JSON), not here.
+        # shellcheck disable=SC2034
         GATE_3_REASON="ccn_over_threshold"
         exit 1
       else
@@ -222,6 +235,8 @@ else
     else
       echo "⏭️  SKIPPED - Complexity (no source files to check)."
       GATE_3_STATUS="SKIP"
+      # Consumed by the sourcing parent (pre-commit report JSON), not here.
+      # shellcheck disable=SC2034
       GATE_3_REASON="no_source_files_changed"
     fi
   else
@@ -229,6 +244,8 @@ else
     echo "   Install with: pip install --user lizard"
     echo "   Gate 3: Complexity check (WARN, tool not available)"
     GATE_3_STATUS="WARN"
+    # Consumed by the sourcing parent (pre-commit report JSON), not here.
+    # shellcheck disable=SC2034
     GATE_3_REASON="tool_not_installed"
   fi
 fi

package/hooks/gate-4.sh

@@ -56,11 +56,15 @@ GATE_4_START=$(gate_start_ms)
 GATE_4_STATUS=""
 # #537: every non-run records WHY (no files / tool missing / unsupported lang)
 # so the quality report can distinguish "not applicable" from "not covered".
+# Consumed by the sourcing parent, not here (see #548).
+# shellcheck disable=SC2034
 GATE_4_REASON=""
 
 if [ "$PROJECT_LANG" = "documentation-only" ]; then
   echo "⏭️  SKIPPED - Principles check (documentation project)."
   GATE_4_STATUS="SKIP"
+  # Consumed by the sourcing parent, not here (see #548).
+  # shellcheck disable=SC2034
   GATE_4_REASON="documentation_project"
   
 else
@@ -156,6 +160,8 @@ else
           echo "⚠️  Warning: Principles checker execution failed"
           echo "⏭️  SKIPPED - Principles check (execution issue)"
           GATE_4_STATUS="SKIP"
+          # Consumed by the sourcing parent, not here (see #548).
+          # shellcheck disable=SC2034
           GATE_4_REASON="checker_execution_error"
           rm -f "$PRINCIPLES_JSON"
         else
@@ -191,17 +197,23 @@ else
         echo "ℹ️  npx/tsx not available - skipping principles check"
         echo "⏭️  SKIPPED - Principles check (no Node.js/tsx)"
         GATE_4_STATUS="SKIP"
+        # Consumed by the sourcing parent, not here (see #548).
+        # shellcheck disable=SC2034
         GATE_4_REASON="tool_not_installed"
       fi
     else
       echo "ℹ️  Principles checker not found in project - skipping"
       echo "⏭️  SKIPPED - Principles check (checker not in project)"
       GATE_4_STATUS="SKIP"
+      # Consumed by the sourcing parent, not here (see #548).
+      # shellcheck disable=SC2034
       GATE_4_REASON="checker_not_found"
     fi
   else
     echo "⏭️  SKIPPED - Principles check (no matching source files changed)"
     GATE_4_STATUS="SKIP"
+    # Consumed by the sourcing parent, not here (see #548).
+    # shellcheck disable=SC2034
     GATE_4_REASON="no_matching_files_changed"
   fi
 fi

package/hooks/gate-7.sh

@@ -12,11 +12,15 @@ GATE_7_START=$(gate_start_ms)
 IAC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E "\.(tf|yaml|yml)$|Dockerfile" || true)
 # #536: scanned_files makes a trivial PASS (nothing to scan) auditable in the
 # quality report instead of reading like a covered security check.
+# Consumed by the sourcing parent, not here (see #548).
+# shellcheck disable=SC2034
 GATE_7_SCANNED_FILES=0
 if [ -z "$IAC_FILES" ]; then
   echo "✅ PASSED - No IaC files detected in changes."
   GATE_7_STATUS="PASS"
 else
+  # Consumed by the sourcing parent, not here (see #548).
+  # shellcheck disable=SC2034
   GATE_7_SCANNED_FILES=$(printf '%s\n' "$IAC_FILES" | sed -n '/./p' | wc -l | tr -d '[:space:]')
   # Run IaC adapter. Resolution follows the documented 3-tier convention
   # (adapter-common.sh): global ~/.config/xp-gate/adapters -> project

package/hooks/hook-module-resolution.sh

@@ -7,12 +7,22 @@
 # is its shell projection. Editing it by hand makes the hook disagree with
 # doctor.js, which reads the JS module directly — the exact divergence
 # #495/#500 were about.
+#
+# Every HOOK_* constant below is read by the sourcing parent, not by this
+# file. A linter checking this file alone cannot see that consumer, so each
+# declaration carries a scoped directive with the reason stated at the site
+# (#548 -- the same false SC2034 used to block consumer repos that vendor
+# these hook modules). The directives are generated, not hand-added.
 
 # Probe file used to pick the gate tier.
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_GATE_PROBE="gate-3.sh"
 
 # ADAPTER_DIR cascade, highest priority first.
 # Each entry is "tier_id|base_var|probe_file".
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_ADAPTER_DIR_TIERS=(
   'global|GLOBAL_ADAPTER_DIR|adapter-common.sh'
   'project|PROJECT_GITHOOKS|adapter-common.sh'
@@ -21,6 +31,8 @@ HOOK_ADAPTER_DIR_TIERS=(
 
 # Adapter resolution tiers, highest priority first.
 # Each entry is "tier_id|base_var|template" with {name} as the basename.
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_ADAPTER_TIERS=(
   'adapter_flat|ADAPTER_DIR|{name}.sh'
   'adapter_nested|ADAPTER_DIR|adapters/{name}.sh'
@@ -32,6 +44,8 @@ HOOK_ADAPTER_TIERS=(
 # Semantics differ from adapter tiers: each entry names the DIRECTORY that
 # would hold the gate probe, so a match yields the directory (GATE_DIR), not
 # the probe file itself. Entry format: "tier_id|base_var|(empty suffix)".
+# Consumed by the sourcing parent, not here.
+# shellcheck disable=SC2034
 HOOK_GATE_TIERS=(
   'gate_adapter_dir|ADAPTER_DIR|'
   'gate_project|PROJECT_GITHOOKS|'

package/hooks/lib/coverage-total.sh

@@ -70,7 +70,7 @@ enforce_python_coverage() {
   fi
 
   if [ -n "$COVERAGE_PERCENT" ]; then
-    if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+    if [ "$COVERAGE_PERCENT" -lt "${COVERAGE_THRESHOLD:-80}" ]; then
       # #399: a subset run (smart test selection) measures only the tested
       # files, so its global total is meaningless as a verdict — the full
       # suite may well be >=80% even when the subset is not. Warn exactly as