@boyingliu01/xp-gate 0.30.2 → 0.30.4

package/hooks/pre-commit

@@ -1,4 +1,20 @@
 #!/bin/bash
+# Line-ending self-check (#546). Must stay on the first executable line: if this
+# file is ever rewritten with CRLF, bash needs to reach this check before the
+# parser chokes somewhere far away and blames an innocent line. `tr` also
+# strips the \r from this very line, so the check runs even when everything
+# around it is broken.
+if tr -d '\r' < "$0" | sed -n '2p' | tr -d '\r' | grep -q 'Line-ending self-check'; then
+  if [ "$(tr -cd '\r' < "$0" | wc -c | tr -d '[:space:]')" -gt 0 ]; then
+    echo "======================================================================" >&2
+    echo "FATAL: hook has CRLF line endings — bash cannot parse it (#546)." >&2
+    echo "  file: $0" >&2
+    echo "  fix : tr -d '\\r' < \"$0\" > \"$0.tmp\" && mv \"$0.tmp\" \"$0\" && chmod +x \"$0\"" >&2
+    echo "Or re-sync the installed copy: xp-gate doctor --sync-hooks" >&2
+    echo "======================================================================" >&2
+    exit 1
+  fi
+fi
 # OpenCode Quality Gates - Pre-Commit Hook - 12 numbered gates (Gate 0–11)
 # 
 # DESIGN PRINCIPLE: Tool unavailable = SKIP (graceful degradation), tool available + check fails = BLOCK
@@ -41,6 +57,41 @@ fi
 # shellcheck source=/dev/null
 . "$HOOK_RESOLUTION_SH"
 
+# --- Coverage threshold: ONE resolver, one number (#555) --------------------
+# The threshold used to exist three times with two different values: the report
+# printed a literal 80, coverage-total.sh compared against a literal 80, and the
+# generic block branch echoed "below 80% threshold" — while the repo's own
+# pyproject declared fail_under. CI honours the declared value, so a commit at
+# 81% passed the hook (judged against 80) and failed CI (82). The report was the
+# worst of the three: it quoted a threshold as though it were the enforced one,
+# and a plausible wrong number is harder to notice than a visible gap.
+#
+# Resolve from the repo's own declaration, in the order the tools themselves
+# use: pyproject [tool.coverage.report] fail_under, then .coveragerc. A repo
+# declaring neither keeps the historical 80.
+_resolve_coverage_threshold() {
+  _rct_value=""
+  _rct_src="default"
+  if [ -f pyproject.toml ]; then
+    _rct_value=$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['tool']['coverage']['report']['fail_under'])" 2>/dev/null || true)
+    [ -n "$_rct_value" ] && _rct_src="pyproject.toml [tool.coverage.report] fail_under"
+    if [ -z "$_rct_value" ]; then
+      _rct_value=$(grep -oE '^[[:space:]]*fail_under[[:space:]]*=[[:space:]]*[0-9]+' pyproject.toml 2>/dev/null | grep -oE '[0-9]+' | head -1 || true)
+      [ -n "$_rct_value" ] && _rct_src="pyproject.toml fail_under (text scan)"
+    fi
+  fi
+  if [ -z "$_rct_value" ] && [ -f .coveragerc ]; then
+    _rct_value=$(grep -oE '^[[:space:]]*fail_under[[:space:]]*=[[:space:]]*[0-9]+' .coveragerc 2>/dev/null | grep -oE '[0-9]+' | head -1 || true)
+    [ -n "$_rct_value" ] && _rct_src=".coveragerc fail_under"
+  fi
+  case "$_rct_value" in
+    ''|*[!0-9]*) _rct_value="80"; _rct_src="default (no fail_under declared)" ;;
+  esac
+  COVERAGE_THRESHOLD_SOURCE="$_rct_src"
+  printf '%s' "$_rct_value"
+}
+COVERAGE_THRESHOLD="$(_resolve_coverage_threshold)"
+
 # Look up one tier's directory variable by name without eval-ing arbitrary input:
 # the base names are a closed set baked into the generated file.
 _hook_tier_base() {
@@ -1238,7 +1289,7 @@ fi
 GATE_1_START=$(gate_start_ms)
 GATE_1_STATUS="PASS"
 GATE_1_DETAIL=""
-if ! any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|mm|dart|sh)$" "\.ya?ml$" "\.json$" "Dockerfile" "\.tf$"; then
+if ! any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|mm|dart|sh|ps1|psm1)$" "\.ya?ml$" "\.json$" "Dockerfile" "\.tf$"; then
   echo "✅ PASSED - No code files changed, skipping lint."
   GATE_1_STATUS="SKIP"
   GATE_1_DETAIL="no_matching_files"
@@ -1764,6 +1815,58 @@ else
   fi
     ;;
 
+    powershell)
+      # #547 finding 2: PowerShell had no arm here, so it fell into the generic
+      # `*)` branch, where a non-zero analysis verdict printed a non-blocking
+      # line and GATE_1_STATUS stayed PASS. The java arm's XP_G1_REASON
+      # protocol applies verbatim: 0 = pass, 1 = block, 2 = unusable
+      # (fail-closed), 3 = WARN with a reason that STAYS in the scoring
+      # denominator so a skip is visible in retro instead of vanishing.
+      POWERSHELL_ADAPTER=$(resolve_adapter_path "powershell")
+      if [ -z "$POWERSHELL_ADAPTER" ]; then
+        echo "⚠️  WARN - PowerShell adapter not found (code quality NOT verified)"
+        GATE_1_STATUS="WARN"
+        GATE_1_DETAIL="powershell: adapter missing"
+      else
+        PS_G1_EXIT=0
+        # Subshell: reasons cross as `XP_G1_REASON: ...` stdout lines, exactly
+        # as in the java arm — an export inside the adapter cannot reach us.
+        PS_G1_OUTPUT=$(source "$POWERSHELL_ADAPTER" 2>/dev/null; run_static_analysis 2>&1) || PS_G1_EXIT=$?
+        PS_G1_REASON=$(printf '%s\n' "$PS_G1_OUTPUT" | sed -n 's/^XP_G1_REASON: //p' | head -1)
+        if [ -n "$PS_G1_REASON" ]; then
+          PS_G1_OUTPUT=$(printf '%s\n' "$PS_G1_OUTPUT" | grep -v '^XP_G1_REASON: ')
+        fi
+        [ -n "$PS_G1_OUTPUT" ] && printf '%s\n' "$PS_G1_OUTPUT" | head -40
+        case "$PS_G1_EXIT" in
+          0)
+            echo "✅ PASSED - PowerShell code quality (PSScriptAnalyzer)."
+            ;;
+          1)
+            echo "❌ BLOCKED - PSScriptAnalyzer violations (fix or add suppressions)"
+            GATE_1_STATUS="BLOCK"
+            GATE_1_DETAIL="powershell: PSScriptAnalyzer findings"
+            exit 1
+            ;;
+          2)
+            echo "❌ BLOCKED - PowerShell static analysis unusable (fail-closed): ${PS_G1_REASON:-unknown}"
+            GATE_1_STATUS="BLOCK"
+            GATE_1_DETAIL="powershell: ${PS_G1_REASON:-unusable}"
+            exit 1
+            ;;
+          3)
+            echo "⚠️  WARN - PowerShell code quality NOT verified: ${PS_G1_REASON:-engine unavailable}"
+            GATE_1_STATUS="WARN"
+            GATE_1_DETAIL="powershell: ${PS_G1_REASON:-engine unavailable}"
+            ;;
+          *)
+            echo "⚠️  WARN - PowerShell code quality NOT verified (unexpected verdict $PS_G1_EXIT)"
+            GATE_1_STATUS="WARN"
+            GATE_1_DETAIL="powershell: unexpected verdict $PS_G1_EXIT"
+            ;;
+        esac
+      fi
+      ;;
+
     *)
       # Route to appropriate adapter for other languages
       ADAPTER_FILE=$(resolve_adapter_path "$CURRENT_LANG")
@@ -2711,11 +2814,18 @@ else
                 PY_TARGET_COUNT=$(printf '%s\n' "$PY_TARGETS" | grep -c '.' || true)
                 echo "ℹ️  Python: selective run ($PY_STRATEGY) — $PY_TARGET_COUNT target(s):"
                 printf '%s\n' "$PY_TARGETS" | sed 's/^/     /'
-                # Subset run: keep --cov so data is collected, but drop the
-                # global threshold — subset coverage is meaningless globally.
+                # Subset run: keep --cov so data is collected, but the global
+                # threshold must be actively DISABLED, not merely omitted.
+                # Omitting --cov-fail-under does not work (#556): pytest-cov
+                # reads fail_under from pyproject on its own, so the floor
+                # stayed in force, a selective run at 23% exited 1, and the
+                # exit was escalated to a hard BLOCK -- printing "Partial
+                # coverage ... not full suite" immediately above "BLOCKED -
+                # Coverage check FAILED". --cov-fail-under=0 is the documented
+                # way to switch it off for one invocation.
                 PARTIAL_TEST_RUN=true
                 # shellcheck disable=SC2086
-                pytest $PY_XDIST_ARGS $PY_COV_SOURCE --tb=short $PY_TARGETS
+                pytest $PY_XDIST_ARGS $PY_COV_SOURCE --cov-fail-under=0 --tb=short $PY_TARGETS
                 COV_EXIT=$((COV_EXIT || $?))
               fi
             fi
@@ -2731,7 +2841,7 @@ else
             go test -coverprofile=coverage.out ./... 2>/dev/null
             TOTAL_COVERAGE=$(go tool cover -func=coverage.out 2>/dev/null | grep "^total:" | awk '{print substr($3, 1, length($3)-1)}')
             if [ -n "$TOTAL_COVERAGE" ] && (( $(echo "$TOTAL_COVERAGE < 80" | bc -l 2>/dev/null || echo "0") )); then
-              echo "❌ BLOCKED - Go coverage $TOTAL_COVERAGE% below 80% threshold"
+              echo "❌ BLOCKED - Go coverage $TOTAL_COVERAGE% below ${COVERAGE_THRESHOLD}% threshold"
               exit 1
             fi
             echo "Go coverage: $TOTAL_COVERAGE%"
@@ -2789,14 +2899,14 @@ else
           } catch(e) { console.log('parse_error'); }
         " 2>/dev/null)
         if [ "$COVERAGE_PERCENT" != "parse_error" ] && [ -n "$COVERAGE_PERCENT" ]; then
-          if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+          if [ "$COVERAGE_PERCENT" -lt "$COVERAGE_THRESHOLD" ]; then
             # Only a subset test run (smart selection) leaves partial coverage data;
             # a full suite run must block on <80% even when many test files changed.
             if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
               echo "⚠️  Partial coverage ${COVERAGE_PERCENT}% (subset test run, not full suite)."
               echo "    Run 'npx vitest run --coverage' for full coverage check."
             else
-              echo "❌ BLOCKED - TypeScript coverage ${COVERAGE_PERCENT}% below 80% threshold"
+              echo "❌ BLOCKED - TypeScript coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
               exit 1
             fi
           else
@@ -2860,7 +2970,7 @@ else
               echo "⚠️  Partial coverage ${COVERAGE_ROUNDED}% (subset test run, not full suite)."
               echo "    Run the full test suite for a complete Java coverage check."
             else
-              echo "❌ BLOCKED - Java coverage ${COVERAGE_ROUNDED}% below 80% threshold"
+              echo "❌ BLOCKED - Java coverage ${COVERAGE_ROUNDED}% below ${COVERAGE_THRESHOLD}% threshold"
               exit 1
             fi
           else
@@ -2886,8 +2996,8 @@ else
       if [ -f "coverage/lcov.info" ]; then
         COVERAGE_PERCENT=$(parse_lcov_coverage "coverage/lcov.info" 2>/dev/null) || COVERAGE_PERCENT="0"
         if [ "$COVERAGE_PERCENT" != "0" ] && [ -n "$COVERAGE_PERCENT" ]; then
-          if [ "$COVERAGE_PERCENT" -lt 80 ]; then
-            echo "❌ BLOCKED - Flutter/Dart coverage ${COVERAGE_PERCENT}% below 80% threshold"
+          if [ "$COVERAGE_PERCENT" -lt "$COVERAGE_THRESHOLD" ]; then
+            echo "❌ BLOCKED - Flutter/Dart coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
             exit 1
           fi
           echo "Flutter/Dart coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
@@ -2926,7 +3036,7 @@ else
           COVERAGE_STATUS=${COVERAGE_RESULT%%|*}
           COVERAGE_PERCENT=${COVERAGE_RESULT#*|}
           if [ "$COVERAGE_STATUS" = "below" ]; then
-            echo "❌ BLOCKED - PowerShell coverage ${COVERAGE_PERCENT}% below 80% threshold"
+            echo "❌ BLOCKED - PowerShell coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
             exit 1
           fi
           echo "PowerShell coverage: ${COVERAGE_PERCENT}% ✅ (≥ 80%)"
@@ -2963,14 +3073,14 @@ else
         fi
       fi
       if [ -n "$COVERAGE_PERCENT" ] && [ "$COVERAGE_PERCENT" != "parse_error" ] && [ "$COVERAGE_PERCENT" -gt 0 ]; then
-        if [ "$COVERAGE_PERCENT" -lt 80 ]; then
+        if [ "$COVERAGE_PERCENT" -lt "$COVERAGE_THRESHOLD" ]; then
           # Only a subset test run (smart selection) warns — the full suite may
           # still reach ≥80%; a full suite run must block.
           if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
             echo "⚠️  Partial coverage ${COVERAGE_PERCENT}% (subset test run, not full suite)."
             echo "    Run the full test suite for a complete ${CURRENT_LANG} coverage check."
           else
-            echo "❌ BLOCKED - ${CURRENT_LANG} coverage ${COVERAGE_PERCENT}% below 80% threshold"
+            echo "❌ BLOCKED - ${CURRENT_LANG} coverage ${COVERAGE_PERCENT}% below ${COVERAGE_THRESHOLD}% threshold"
             exit 1
           fi
         else
@@ -3019,10 +3129,15 @@ else
             }
           } catch(e) { console.log('parse_error'); }
         " 2>/dev/null)
+        # NOTE (#555): the 80 below is deliberately NOT $COVERAGE_THRESHOLD.
+        # That one is the project-level floor a repo declares in fail_under;
+        # this is the bar a single NEW file must clear to justify existing at
+        # all. Tying them would mean a repo with fail_under=82 could not add a
+        # file at 81% even while the project sits well above its floor.
         if [ "$FILE_COV" = "no_data" ] || [ "$FILE_COV" = "parse_error" ]; then
           echo "     ⚠️  $new_file — no coverage data (file may be excluded or not exercised)"
         elif [ "$FILE_COV" -lt 80 ]; then
-          echo "     ❌ $new_file — ${FILE_COV}% coverage (below 80% threshold)"
+          echo "     ❌ $new_file — ${FILE_COV}% coverage (below 80% per-new-file threshold)"
           NEW_FILE_COV_FAIL=true
         else
           echo "     ✅ $new_file — ${FILE_COV}% coverage"
@@ -3036,8 +3151,13 @@ else
       fi
     fi
   fi
+  # Only reached on the non-docs-only path. Assigning PASS outside the if/else
+  # overwrote the docs-only SKIP a few hundred lines above and reported
+  # "Tests + Coverage: PASS (coverage: N/A)" for a commit where no test ran
+  # (#554) -- a SKIP promoted to PASS inflates the pass rate and hides that the
+  # gate never executed.
+  GATE_5_STATUS="PASS"
 fi
-GATE_5_STATUS="PASS"
 record_gate_audit "gate-5" "tests-coverage" "$GATE_5_STATUS" "0" "$GATE_5_START" "${GATE_5_DETAIL:-}"
 
 # ============================================================================
@@ -3582,7 +3702,7 @@ echo ""
 # v0.14.3+ (Issue #312): Skip if no code files changed
 # v0.18.5 (Issue #397): Fix gate status variable collision — SAST now sets GATE_10_STATUS
 # ============================================================================
-if any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|dart|sh)$"; then
+if any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|dart|sh|ps1|psm1)$"; then
   if [ -f "$GATE_DIR/gate-10.sh" ]; then
     source "$GATE_DIR/gate-10.sh"
   else
@@ -3885,7 +4005,8 @@ generate_quality_report() {
     "gate5_tests": {
       "name": "Tests + Coverage",
       "status": "${GATE_5_STATUS:-PASS}",
-      "thresholds": { "lines": 80, "functions": 80, "branches": 70, "statements": 80 },
+      "thresholds": { "lines": ${COVERAGE_THRESHOLD}, "functions": null, "branches": null, "statements": null },
+      "threshold_source": "${COVERAGE_THRESHOLD_SOURCE}",
       "actual": { "coverage": "${COV_PCT}" },
       "failedTests": $FAILED_TESTS_JSON
     },

package/hooks/pre-push

@@ -1,4 +1,20 @@
 #!/bin/bash
+# Line-ending self-check (#546). Must stay on the first executable line: if this
+# file is ever rewritten with CRLF, bash needs to reach this check before the
+# parser chokes somewhere far away and blames an innocent line. `tr` also
+# strips the \r from this very line, so the check runs even when everything
+# around it is broken.
+if tr -d '\r' < "$0" | sed -n '2p' | tr -d '\r' | grep -q 'Line-ending self-check'; then
+  if [ "$(tr -cd '\r' < "$0" | wc -c | tr -d '[:space:]')" -gt 0 ]; then
+    echo "======================================================================" >&2
+    echo "FATAL: hook has CRLF line endings — bash cannot parse it (#546)." >&2
+    echo "  file: $0" >&2
+    echo "  fix : tr -d '\\r' < \"$0\" > \"$0.tmp\" && mv \"$0.tmp\" \"$0\" && chmod +x \"$0\"" >&2
+    echo "Or re-sync the installed copy: xp-gate doctor --sync-hooks" >&2
+    echo "======================================================================" >&2
+    exit 1
+  fi
+fi
 # Pre-push Hook — 8 gates: Gate 10 (Build Integrity) + M/M-Python/M-Go/M-Java/M-Kotlin (Mutation)
 # + M2 (Mock Density, WARNING) + ML (Mock Layering) + UI (UI Sprint Gates) + MW (Code Walkthrough) + S (Sprint Flow)
 #
@@ -31,11 +47,28 @@ write_pre_push_report() {
   commit_hash=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
   verdict=$([ "$exit_code" -eq 0 ] && echo "PASS" || echo "BLOCKED")
   mkdir -p "$reports_dir"
+  # #544: the survivor detail is a JSON document, so it cannot be interpolated
+  # into this heredoc — a single quote in a path would break the Python source.
+  # Hand it to the child through the environment and let Python parse it, then
+  # store it serialised back into the `details` string domain (every value there
+  # is a string; the journal has broken before over mixed types).
+  export XP_GATE_M_SURVIVORS_JSON="${M_SURVIVORS_JSON:-}"
   python3 - <<PY 2>/dev/null || true
 import json
+import os
 from pathlib import Path
 pushed_files = '''${PUSHED_FILES:-}'''.splitlines()
 passed = 1 if '$verdict' == 'PASS' else 0
+# Absent stays absent: no key at all when nothing was measured, so a reader can
+# tell "not measured" from "measured: zero survivors" (#544).
+try:
+    _survivors_raw = os.environ.get('XP_GATE_M_SURVIVORS_JSON', '').strip()
+    survivors_detail = json.loads(_survivors_raw) if _survivors_raw else None
+except (ValueError, TypeError):
+    survivors_detail = None
+_m_details = {'skip_reason': '${GATE_M_SKIP_REASON:-}', 'duration_ms': '${M_DURATION_MS:-0}', 'mutation_score': '${M_SCORE:-}'}
+if survivors_detail is not None:
+    _m_details['survivors'] = json.dumps(survivors_detail, sort_keys=True)
 report = {
   'timestamp': '$timestamp',
   'trigger': 'pre-push',
@@ -51,15 +84,20 @@ report = {
   'gates': [
     {'id': 'MP', 'name': 'Gate-Script Mirror Parity', 'status': '${GATE_MP_STATUS:-SKIP}', 'details': {'duration_ms': '${MP_DURATION_MS:-0}'}},
     {'id': '10', 'name': 'Build Integrity', 'status': '${GATE_10_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M', 'name': 'Mutation Testing', 'status': '${GATE_M_STATUS:-SKIP}', 'details': {'skip_reason': '${GATE_M_SKIP_REASON:-}', 'duration_ms': '${M_DURATION_MS:-0}', 'mutation_score': '${M_SCORE:-}'}},
-    {'id': 'M-Python', 'name': 'Mutation Testing (Python)', 'status': '${GATE_M_PYTHON_STATUS:-SKIP}', 'details': {}},
+    {'id': 'M', 'name': 'Mutation Testing', 'status': '${GATE_M_STATUS:-SKIP}', 'details': _m_details},
+    # #557 follow-up: this line read GATE_M_PYTHON_STATUS while the code assigns
+    # GATE_M_PY_STATUS, so the field always fell back to its SKIP default -- the
+    # "never write the real state" bug #557 set out to fix, still present for
+    # this one gate. The skip reason now travels with it, so a retro reader can
+    # tell "no Python here" from "timed out" from "mutmut missing".
+    {'id': 'M-Python', 'name': 'Mutation Testing (Python)', 'status': '${GATE_M_PY_STATUS:-SKIP}', 'details': {'skip_reason': '${GATE_M_PY_SKIP_REASON:-}'}},
     {'id': 'M-Go', 'name': 'Mutation Testing (Go)', 'status': '${GATE_M_GO_STATUS:-SKIP}', 'details': {}},
     {'id': 'M-Java', 'name': 'Mutation Testing (Java)', 'status': '${GATE_M_JAVA_STATUS:-SKIP}', 'details': {}},
     {'id': 'M-Kotlin', 'name': 'Mutation Testing (Kotlin)', 'status': '${GATE_M_KOTLIN_STATUS:-SKIP}', 'details': {}},
     {'id': 'M2', 'name': 'Mock Density (WARNING only)', 'status': '${GATE_M2_STATUS:-SKIP}', 'details': {}},
     {'id': 'ML', 'name': 'Mock Layering', 'status': '${GATE_M3_STATUS:-SKIP}', 'details': {}},
     {'id': 'UI', 'name': 'UI Sprint Gates', 'status': '${GATE_UI_STATUS:-SKIP}', 'details': {}},
-    {'id': 'MW', 'name': 'Code Walkthrough', 'status': '${GATE_DELPHI_STATUS:-SKIP}', 'details': {'remote': '$REMOTE', 'url': '$URL'}},
+    {'id': 'MW', 'name': 'Code Walkthrough', 'status': '${GATE_DELPHI_STATUS:-SKIP}', 'details': {'remote': '$REMOTE', 'url': '$URL', 'skip_reason': '${GATE_DELPHI_SKIP_REASON:-}'}},
     {'id': 'S', 'name': 'Sprint Flow Enforcement', 'status': '${GATE_S_STATUS:-SKIP}', 'details': {}}
   ],
   'warnings': [],
@@ -220,6 +258,10 @@ if [ -f "$MP_ROOT/scripts/check-hook-mirror.sh" ]; then
   fi
 else
   echo "⚠️ Gate MP: check-hook-mirror.sh not found. SKIP — Gate MP."
+  echo "   Gate MP did not run; this push was not checked for mirror drift."
+  GATE_MP_STATUS="SKIP"
+  GATE_MP_SKIP_REASON="mirror_script_not_found"
+  GATES_SKIPPED="${GATES_SKIPPED:-}Gate MP (mirror parity: script not found)|"
   MP_DURATION_MS=0
 fi
 echo ""
@@ -433,6 +475,15 @@ else
         # It is printed by gate-m.ts; take the last percentage it reported.
         M_SCORE=$(sed -n 's/.*[Mm]utation score[: ]*\([0-9][0-9]*\(\.[0-9][0-9]*\)\?\)%.*/\1/p' "$MUTATION_OUTPUT" 2>/dev/null | tail -1)
 
+        # #544: per-file survivor detail, so retro can answer "which module has
+        # the most surviving mutants". gate-m.ts emits one
+        # GATE_M_SURVIVORS_JSON= line; it is ABSENT when no report was produced,
+        # and absent must stay absent. An empty value means "not measured"; a
+        # written zero would mean "measured, no survivors". Only the former is
+        # ever true when the line is missing -- conflating the two is the whole
+        # of #544.
+        M_SURVIVORS_JSON=$(printf '%s\n' "$MUTATION_OUTPUT" | sed -n 's/^GATE_M_SURVIVORS_JSON=//p' | tail -1)
+
         case $MUTATION_EXIT in
           0)
             echo "✅ Gate M: PASS"
@@ -491,6 +542,13 @@ PY_SOURCE_FILES=$(echo "$PY_FILES" | grep -v '/venv/' | grep -v '/\.venv/' || tr
 
 if [ -z "$PY_SOURCE_FILES" ]; then
   echo "📚 No changed Python source files. SKIP — Gate M (Python)."
+  # #557: this outermost branch was the only Gate M (Python) path that assigned
+  # no status, while Gate M (TypeScript) records a reason on every path. Without
+  # it, "no Python in this push" and "the tool is missing" look identical in the
+  # journals, which is the gap #404 P0 spent effort closing for the TS gate.
+  GATE_M_PY_STATUS="SKIP"
+  GATE_M_PY_SKIP_REASON="no_python_source_files"
+  GATES_SKIPPED="${GATES_SKIPPED:-}Gate M Python (no changed Python source files)|"
 else
   PYTHON_FILE_LIST=$(echo "$PY_SOURCE_FILES" | tr '\n' ',' | sed 's/,$//')
   echo "🐍 Changed Python files: $PYTHON_FILE_LIST"
@@ -504,6 +562,7 @@ else
       case $MUTATION_EXIT in
         0)
           echo "✅ Gate M (Python): PASS"
+          GATE_M_PY_STATUS="PASS"
           ;;
         1)
           echo ""
@@ -519,16 +578,28 @@ else
         124)
           cat "$MUTATION_OUTPUT"
           echo "⏱ Gate M (Python): TIMEOUT (120s). Allowing push with warning."
+          # A timeout means the mutation score was never measured. Saying
+          # nothing here let the closing banner claim success for a gate that
+          # started work and could not finish (#557).
+          GATE_M_PY_STATUS="TIMEOUT"
+          GATE_M_PY_SKIP_REASON="timeout_120s"
+          GATES_SKIPPED="${GATES_SKIPPED:-}Gate M Python (TIMEOUT — score never measured)|"
           ;;
         *)
           cat "$MUTATION_OUTPUT"
           echo "⚠ Gate M (Python): Unexpected exit code $MUTATION_EXIT. Allowing push with warning."
+          GATE_M_PY_STATUS="ERROR"
+          GATE_M_PY_SKIP_REASON="unexpected_exit_${MUTATION_EXIT}"
+          GATES_SKIPPED="${GATES_SKIPPED:-}Gate M Python (error, exit ${MUTATION_EXIT} — score never measured)|"
           ;;
       esac
 
       rm -f "$MUTATION_OUTPUT"
     else
       echo "⚠ Gate M script not found. SKIP — Gate M (Python)."
+      GATE_M_PY_STATUS="SKIP"
+      GATE_M_PY_SKIP_REASON="gate_m_script_not_found"
+      GATES_SKIPPED="${GATES_SKIPPED:-}Gate M Python (gate-m.ts not found)|"
     fi
   else
     echo "⚠ mutmut not installed. SKIP — Gate M (Python)."
@@ -929,11 +1000,51 @@ if [[ "$XP_GATE_SKIP_UI_GATES" == "1" ]]; then
   AUDIT_ENTRY="{\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"branch\":\"$CURRENT_BRANCH\",\"commit\":\"$(git rev-parse HEAD)\",\"user\":\"$(git config user.name || echo 'unknown')\",\"reason\":\"$XP_GATE_BYPASS_REASON\",\"bypass_type\":\"ui-gates\"}"
   echo "$AUDIT_ENTRY" >> .audit-log.jsonl
 else
-    # Detect UI changes in pushed files
-    UI_DETECTION=$(echo "$PUSHED_FILES" | npx -y tsx src/npm-package/lib/ui-detector.ts --push-mode --from-stdin 2>/dev/null) || true
-    
-    IS_UI_SPRINT=$(echo "$UI_DETECTION" | jq -r '.isUiSprint' 2>/dev/null || echo "false")
-    
+    # Detect UI changes in pushed files.
+    #
+    # stderr is kept out of the captured value but its ABSENCE is no longer
+    # treated as a clean "no UI here" answer (#553). jq -r prints the empty
+    # string and exits 0 on empty input, so the old `|| echo "false"` fallback
+    # was unreachable; an empty verdict became "", which is not "true", which
+    # silently took the "No UI changes detected — skipping" branch. A push whose
+    # only change was src/ui/streamlit_app.py was therefore told there was
+    # nothing to review — the failure Gate UI exists to prevent, inverted.
+    UI_DETECTION=$(echo "$PUSHED_FILES" | npx -y tsx src/npm-package/lib/ui-detector.ts --push-mode --from-stdin 2>/dev/null)
+    UI_DETECT_EXIT=$?
+
+    if [ "$UI_DETECT_EXIT" -eq 0 ] && [ -n "$UI_DETECTION" ]; then
+      IS_UI_SPRINT=$(echo "$UI_DETECTION" | jq -r 'if type == "object" then (.isUiSprint | tostring) else "unknown" end' 2>/dev/null)
+    else
+      IS_UI_SPRINT=""
+    fi
+    # Three answers, not two. "" (detector missing, crashed, or emitted nothing)
+    # is "unknown", and unknown must never read as "no UI".
+    if [ -z "$IS_UI_SPRINT" ] || [ "$IS_UI_SPRINT" = "null" ]; then
+      IS_UI_SPRINT="unknown"
+    fi
+
+    if [ "$IS_UI_SPRINT" = "unknown" ]; then
+      # A missing detector must not disable UI review. Fall back to a path
+      # check over the same file list: a cheap, conservative substitute for a
+      # verdict we do not have.
+      UI_PATH_HITS=$(echo "$PUSHED_FILES" | grep -Ei '(^|/)(src/ui|ui|components|pages|views|screens)/|[.](tsx|jsx|vue|svelte|css|scss|sass|less)$' || true)
+      if [ -n "$UI_PATH_HITS" ]; then
+        echo ""
+        echo "❌ Gate UI: could not evaluate the UI verdict (detector unavailable or produced no verdict, exit ${UI_DETECT_EXIT})."
+        echo "   This push touches UI-looking paths:"
+        echo "$UI_PATH_HITS" | sed 's/^/     /'
+        echo ""
+        echo "   The gate cannot claim there is nothing to review when it never got an answer."
+        echo "   Fix: install the detector (npx -y tsx must be able to load src/npm-package/lib/ui-detector.ts),"
+        echo "   or run the review explicitly: xp-gate ui-review"
+        echo "   To accept the risk for this push: XP_GATE_SKIP_UI_GATES=1 XP_GATE_BYPASS_REASON=\"<why>\""
+        echo ""
+        exit 1
+      fi
+      echo "ℹ️  Gate UI: detector unavailable (exit ${UI_DETECT_EXIT}) and no UI-looking paths in this push — nothing to review."
+      IS_UI_SPRINT="false"
+    fi
+
     if [[ "$IS_UI_SPRINT" == "true" ]]; then
       UI_RESULT_FILE=".ui-gate-result.json"
       MISSING_RESULTS=()
@@ -986,6 +1097,15 @@ else
 # ============================================================================
 RESULT_FILE=".code-walkthrough-result.json"
 MW_SKIPPED=0
+# Journal status (#557 follow-up). The journal already read GATE_DELPHI_STATUS
+# but nothing ever assigned it, so Gate MW reported its SKIP default in every
+# report -- including pushes where the walkthrough was in fact verified. The
+# closing banner told the truth while the machine-readable journal did not, which
+# is the half-fix #557 was about.
+GATE_DELPHI_STATUS="SKIP"
+# Consumed by the journal heredoc (sourced/inherited boundary).
+# shellcheck disable=SC2034
+GATE_DELPHI_SKIP_REASON="not_run"
 
 # Skipped on main/master by design, exactly like Gate ML and Gate UI above.
 # Work is already walkthrough-reviewed on the feature branch before it lands, so
@@ -995,6 +1115,9 @@ MW_SKIPPED=0
 # documented this skip; the code did not implement it (drift fixed here).
 if [ "$CURRENT_BRANCH" = "main" ] || [ "$CURRENT_BRANCH" = "master" ]; then
   MW_SKIPPED=1
+  # Consumed by the journal heredoc (sourced/inherited boundary).
+  # shellcheck disable=SC2034
+  GATE_DELPHI_SKIP_REASON="main_branch_push"
   echo ""
   echo "   ℹ️  Gate MW skipped (pushing to ${CURRENT_BRANCH} — pre-reviewed via branch walkthrough)"
   echo ""
@@ -1064,13 +1187,31 @@ if ! VALIDATION_ERROR=$(node "$MW_VALIDATOR" "$RESULT_FILE" "$EXPECTED_COMMIT" "
   echo ""
   exit 1
 fi
+
+# The validator passed: record that the walkthrough was actually verified.
+# Consumed by the journal heredoc (sourced/inherited boundary).
+# shellcheck disable=SC2034
+GATE_DELPHI_STATUS="PASS"
+# shellcheck disable=SC2034
+GATE_DELPHI_SKIP_REASON=""
 fi
 
 # ============================================================================
-# ALL CHECKS PASSED
+# Closing banner. States what actually happened (#557): a gate that skipped is
+# named. The heading used to read "ALL CHECKS PASSED" unconditionally while Gate
+# MP and Gate M (Python) skipped on a typical push without recording why, so a
+# reviewer skimming the log had no signal that mutation testing never ran.
 # ============================================================================
 echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+# Trim the trailing separator and turn it into a displayable list.
+SKIPPED_DISPLAY=$(printf '%s' "${GATES_SKIPPED:-}" | sed 's/|$//' | sed 's/|/ , /g')
+if [ -n "$SKIPPED_DISPLAY" ]; then
+  echo "   ⚠️  NO BLOCKING FAILURES — but not every gate ran:"
+  echo "$SKIPPED_DISPLAY" | tr ',' '\n' | sed '/^[[:space:]]*$/d' | sed 's/^[[:space:]]*/     - /'
+else
+  echo "   ✅ ALL CHECKS PASSED"
+fi
 # Say what actually happened. Printing "VERIFIED" on a skipped gate would be a
 # claim the hook cannot support — the same dishonesty (evidence asserting an
 # unperformed check) that Gate MW exists to prevent.

package/hooks/sprint-gate.sh

@@ -181,6 +181,65 @@ read_verdict() {
   json_extract "$APPROVED_FILE" '.verdict // ""' || echo ""
 }
 
+# --- Helper: sprint age in days, or empty if unknown ---
+# Reads status + started_at from sprint-state.json. #551: the gate judged only
+# `phase` and the delphi verdict, so a state file left at status=in_progress
+# reported "sprint phase 6 validated" on unrelated commits for as long as
+# nobody fixed it. An advancing sprint and an abandoned one were
+# indistinguishable -- worse than SKIP, because SKIP is honest and PASS lies.
+read_sprint_status() {
+  if [ ! -f "$SPRINT_STATE_JSON" ] || [ "$JSON_PARSER" = "none" ]; then
+    echo ""
+    return
+  fi
+  json_validate "$SPRINT_STATE_JSON" || { echo ""; return; }
+  json_extract "$SPRINT_STATE_JSON" '.status // ""' 2>/dev/null || echo ""
+}
+
+read_sprint_age_days() {
+  if [ ! -f "$SPRINT_STATE_JSON" ] || [ "$JSON_PARSER" = "none" ]; then
+    echo ""
+    return
+  fi
+  json_validate "$SPRINT_STATE_JSON" || { echo ""; return; }
+  local started
+  started=$(json_extract "$SPRINT_STATE_JSON" '.started_at // ""' 2>/dev/null || echo "")
+  # Older state files may carry updated_at only; either is the last sign of life.
+  if [ -z "$started" ] || [ "$started" = "null" ]; then
+    started=$(json_extract "$SPRINT_STATE_JSON" '.updated_at // ""' 2>/dev/null || echo "")
+  fi
+  if [ -z "$started" ] || [ "$started" = "null" ]; then
+    echo ""
+    return
+  fi
+  # Portable ISO-8601 -> epoch. GNU date first, BSD date second, node last; if
+  # all fail the age is unknown and the caller must not invent one.
+  local epoch=""
+  epoch=$(date -u -d "$started" +%s 2>/dev/null || true)
+  if [ -z "$epoch" ]; then
+    epoch=$(date -u -j -f "%Y-%m-%dT%H:%M:%SZ" "$started" +%s 2>/dev/null || true)
+  fi
+  if [ -z "$epoch" ] && command -v node >/dev/null 2>&1; then
+    epoch=$(node -e "const t=Date.parse(process.argv[1]);if(Number.isFinite(t))process.stdout.write(String(Math.floor(t/1000)))" "$started" 2>/dev/null || true)
+  fi
+  if [ -z "$epoch" ]; then
+    echo ""
+    return
+  fi
+  local now
+  now=$(date -u +%s)
+  local age=$(( (now - epoch) / 86400 ))
+  [ "$age" -lt 0 ] && age=0
+  echo "$age"
+}
+
+# Threshold in days beyond which an in_progress sprint is considered abandoned.
+# Configurable because the right number is project-specific: a weekly cadence
+# wants 14, a monthly one wants more. Default 14 = two full weeks without
+# progress: enough that a sprint paused over a holiday is not called dead, tight
+# enough that the reported 12-day case is caught within two days of it firing.
+SPRINT_STALE_DAYS="${SPRINT_STALE_DAYS:-14}"
+
 # --- Pre-commit mode ---
 if [ "$MODE" = "pre-commit" ]; then
   PHASE=$(read_phase)
@@ -222,8 +281,28 @@ if [ "$MODE" = "pre-commit" ]; then
       exit 1
     fi
 
-    # All checks passed
-    echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated\"}"
+    # #551: staleness. A sprint left at status=in_progress past the threshold is
+    # abandoned, not validated -- reporting PASS for it means the gate cannot
+    # distinguish an advancing sprint from a forgotten one, and it injects
+    # ancient phase_history into every unrelated commit's audit trail. SKIP is
+    # the honest answer: the gate declines to certify a sprint nobody is
+    # driving, without blocking work that has nothing to do with it.
+    SPRINT_STATUS=$(read_sprint_status)
+    SPRINT_AGE_DAYS=$(read_sprint_age_days)
+    if [ "$SPRINT_STATUS" = "in_progress" ] && [ -n "$SPRINT_AGE_DAYS" ] \
+       && [ "$SPRINT_AGE_DAYS" -ge "$SPRINT_STALE_DAYS" ] 2>/dev/null; then
+      echo "{\"decision\":\"skip\",\"reason\":\"STALE SPRINT: status=in_progress for ${SPRINT_AGE_DAYS} days (threshold ${SPRINT_STALE_DAYS}) — not certifying it. Finish it (sprint-flow close) or clear .sprint-state/sprint-state.json\"}"
+      exit 0
+    fi
+
+    # All checks passed. Name the age so "validated" is not an unconditional
+    # claim: a 29-day-old sprint under a 30-day threshold is a very different
+    # situation from one opened today, and the log should say which it is.
+    if [ -n "$SPRINT_AGE_DAYS" ]; then
+      echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint open ${SPRINT_AGE_DAYS} day(s), staleness threshold ${SPRINT_STALE_DAYS})\"}"
+    else
+      echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint age unknown — started_at unreadable)\"}"
+    fi
     exit 0
   fi