@boyingliu01/xp-gate 0.31.1 → 0.31.2

package/hooks/pre-push

@@ -1,20 +1,29 @@
 #!/bin/bash
-# Line-ending self-check (#546). Must stay on the first executable line: if this
-# file is ever rewritten with CRLF, bash needs to reach this check before the
-# parser chokes somewhere far away and blames an innocent line. `tr` also
-# strips the \r from this very line, so the check runs even when everything
-# around it is broken.
-if tr -d '\r' < "$0" | sed -n '2p' | tr -d '\r' | grep -q 'Line-ending self-check'; then
-  if [ "$(tr -cd '\r' < "$0" | wc -c | tr -d '[:space:]')" -gt 0 ]; then
-    echo "======================================================================" >&2
-    echo "FATAL: hook has CRLF line endings — bash cannot parse it (#546)." >&2
-    echo "  file: $0" >&2
-    echo "  fix : tr -d '\\r' < \"$0\" > \"$0.tmp\" && mv \"$0.tmp\" \"$0\" && chmod +x \"$0\"" >&2
-    echo "Or re-sync the installed copy: xp-gate doctor --sync-hooks" >&2
-    echo "======================================================================" >&2
-    exit 1
-  fi
-fi
+_LE_CR=$(tr -cd '\r' < "$0" | wc -c | tr -d '[:space:]'); test "${_LE_CR:-0}" -eq 0 || { printf '%s\n' "======================================================================" "FATAL: hook has CRLF line endings -- bash cannot parse it (#546)." "  file: $0" "  fix : tr -d '\\r' < \"$0\" > \"$0.tmp\" && mv \"$0.tmp\" \"$0\" && chmod +x \"$0\"" "Or re-sync the installed copy: xp-gate doctor --sync-hooks" "======================================================================" >&2; exit 1; }
+#
+# The line above is the #546 line-ending self-check. It MUST stay on the first
+# executable line, as a SINGLE physical line, using no construct whose keyword
+# needs a line boundary. All three are load-bearing:
+#
+#  * A CRLF rewrite puts \r at the end of EVERY line. Any construct whose
+#    keywords must match across lines -- if/then/fi, case/esac, for/do/done --
+#    then fails to PARSE and none of it runs. The original #546 implementation
+#    was a nested if/fi spanning 11 lines: it could not survive the very
+#    condition it detects. On a CRLF copy bash reported
+#        line 76: syntax error near unexpected token `$'{\r''
+#    blaming an innocent function far below -- which is exactly the failure #546
+#    set out to prevent. It looked correct locally only because that bash build
+#    deferred the error past the first command.
+#  * Even on one line, `if ... then ... fi` ends in `fi\r`, and `then\r` / `fi\r`
+#    are ordinary words to the tokenizer. So the check uses only
+#    `test ... || { ...; exit 1; }`: the `{` already follows `; `, so a trailing
+#    \r on the line cannot change how it tokenizes.
+#  * The CR count is byte-wise (`tr -cd`). `grep -c $'\r'` reports 0 matches
+#    through the Git-Bash/MSYS layer even on files that carry CR bytes, which is
+#    what made earlier attempts at this fixture look green while CI stayed red.
+#
+# Verified: an LF copy runs through (0 CR bytes); a CRLF copy prints the FATAL
+# diagnosis and exits 1 with no syntax error.
 # Pre-push Hook — 8 gates: Gate 10 (Build Integrity) + M/M-Python/M-Go/M-Java/M-Kotlin (Mutation)
 # + M2 (Mock Density, WARNING) + ML (Mock Layering) + UI (UI Sprint Gates) + MW (Code Walkthrough) + S (Sprint Flow)
 #
@@ -53,58 +62,144 @@ write_pre_push_report() {
   # store it serialised back into the `details` string domain (every value there
   # is a string; the journal has broken before over mixed types).
   export XP_GATE_M_SURVIVORS_JSON="${M_SURVIVORS_JSON:-}"
-  python3 - <<PY 2>/dev/null || true
-import json
-import os
-from pathlib import Path
-pushed_files = '''${PUSHED_FILES:-}'''.splitlines()
-passed = 1 if '$verdict' == 'PASS' else 0
-# Absent stays absent: no key at all when nothing was measured, so a reader can
-# tell "not measured" from "measured: zero survivors" (#544).
-try:
-    _survivors_raw = os.environ.get('XP_GATE_M_SURVIVORS_JSON', '').strip()
-    survivors_detail = json.loads(_survivors_raw) if _survivors_raw else None
-except (ValueError, TypeError):
-    survivors_detail = None
-_m_details = {'skip_reason': '${GATE_M_SKIP_REASON:-}', 'duration_ms': '${M_DURATION_MS:-0}', 'mutation_score': '${M_SCORE:-}'}
-if survivors_detail is not None:
-    _m_details['survivors'] = json.dumps(survivors_detail, sort_keys=True)
-report = {
-  'timestamp': '$timestamp',
-  'trigger': 'pre-push',
-  'branch': '$CURRENT_BRANCH',
-  'commit': '$commit_hash',
-  'changed_files': [f for f in pushed_files if f],
-  'overall': {
-    'score': '10.0/10' if '$verdict' == 'PASS' else '0.0/10',
-    'gates_passed': passed,
-    'gates_total': 8,
-    'verdict': '$verdict',
-  },
-  'gates': [
-    {'id': 'MP', 'name': 'Gate-Script Mirror Parity', 'status': '${GATE_MP_STATUS:-SKIP}', 'details': {'duration_ms': '${MP_DURATION_MS:-0}'}},
-    {'id': '10', 'name': 'Build Integrity', 'status': '${GATE_10_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M', 'name': 'Mutation Testing', 'status': '${GATE_M_STATUS:-SKIP}', 'details': _m_details},
-    # #557 follow-up: this line read GATE_M_PYTHON_STATUS while the code assigns
-    # GATE_M_PY_STATUS, so the field always fell back to its SKIP default -- the
-    # "never write the real state" bug #557 set out to fix, still present for
-    # this one gate. The skip reason now travels with it, so a retro reader can
-    # tell "no Python here" from "timed out" from "mutmut missing".
-    {'id': 'M-Python', 'name': 'Mutation Testing (Python)', 'status': '${GATE_M_PY_STATUS:-SKIP}', 'details': {'skip_reason': '${GATE_M_PY_SKIP_REASON:-}'}},
-    {'id': 'M-Go', 'name': 'Mutation Testing (Go)', 'status': '${GATE_M_GO_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M-Java', 'name': 'Mutation Testing (Java)', 'status': '${GATE_M_JAVA_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M-Kotlin', 'name': 'Mutation Testing (Kotlin)', 'status': '${GATE_M_KOTLIN_STATUS:-SKIP}', 'details': {}},
-    {'id': 'M2', 'name': 'Mock Density (WARNING only)', 'status': '${GATE_M2_STATUS:-SKIP}', 'details': {}},
-    {'id': 'ML', 'name': 'Mock Layering', 'status': '${GATE_M3_STATUS:-SKIP}', 'details': {}},
-    {'id': 'UI', 'name': 'UI Sprint Gates', 'status': '${GATE_UI_STATUS:-SKIP}', 'details': {}},
-    {'id': 'MW', 'name': 'Code Walkthrough', 'status': '${GATE_DELPHI_STATUS:-SKIP}', 'details': {'remote': '$REMOTE', 'url': '$URL', 'skip_reason': '${GATE_DELPHI_SKIP_REASON:-}'}},
-    {'id': 'S', 'name': 'Sprint Flow Enforcement', 'status': '${GATE_S_STATUS:-SKIP}', 'details': {}}
-  ],
-  'warnings': [],
-  'errors': [] if '$verdict' == 'PASS' else ['pre-push hook exited with code $exit_code'],
-}
-Path('$report_file').write_text(json.dumps(report, indent=2) + '\n')
-PY
+  # #597: resolve a WORKING interpreter instead of assuming `python3`.
+  #
+  # Measured on Windows Git Bash: `python3` resolves to the Microsoft Store
+  # execution-alias stub at
+  #     /c/Users/think/AppData/Local/Microsoft/WindowsApps/python3
+  # which exits non-zero and prints nothing (`python3 --version` is empty). The
+  # old `python3 - <<PY 2>/dev/null || true` then swallowed the failure, so:
+  #   - the JSON journal was never written;
+  #   - bash went on to execute the heredoc BODY as shell commands, producing
+  #       python3: line 56: None: command not found
+  #       python3: line 56: verdict: command not found
+  # A `|| true` around a whole script body cannot distinguish "python missing"
+  # from "script failed", and the journal is the only audit trail a push leaves.
+  #
+  # `python` is the real interpreter on Windows (3.12.x) while `python3` is the
+  # stub; on Linux `python3` is real and `python` may be absent. Probe both and
+  # require the candidate to actually report a version.
+  local py_bin=""
+  for _candidate in python3 python py; do
+    if command -v "$_candidate" >/dev/null 2>&1 && \
+       "$_candidate" --version >/dev/null 2>&1; then
+      py_bin="$_candidate"
+      break
+    fi
+  done
+  if [ -z "$py_bin" ]; then
+    echo "⚠️  Gate M journal: no working Python interpreter found (tried python3, python, py) — report NOT written for $report_file." >&2
+    return 0
+  fi
+  # #577: the scoring rule lives in its own module so it can be tested directly.
+  # Install layout: <hooks dir>/lib/prepush-score.py, with the deprecated copy
+  # under <hooks dir>/hooks/lib/ for older installs.
+  local score_lib=""
+  for _cand in \
+    "$(dirname "${BASH_SOURCE[0]}")/lib/prepush-score.py" \
+    "$(dirname "${BASH_SOURCE[0]}")/hooks/lib/prepush-score.py" \
+    ../githooks/lib/prepush-score.py; do
+    if [ -f "$_cand" ]; then
+      score_lib="$_cand"
+      break
+    fi
+  done
+  if [ -z "$score_lib" ]; then
+    # #569 follow-up: a missing scorer used to only warn, and the journal then
+    # carried `score: null, gates_run: null` — a document that LOOKS written but
+    # answers none of the questions it exists for. The score rule lives in
+    # prepush-score.py and nowhere else, so "no scorer" means the summary was
+    # never computed, not that the run had nothing to summarise. Fail closed.
+    echo "❌ Gate M journal: prepush-score.py not found — cannot compute the score for $report_file." >&2
+    echo "   Expected it beside the hook (lib/prepush-score.py) or under hooks/lib/. Reinstall with: xp-gate doctor --sync-hooks" >&2
+    return 1
+  fi
+  # No blanket `|| true`: a failing interpreter must be visible. The journal is
+  # advisory, so still return 0, but say so instead of dying silently.
+  #
+  # #597: the Python body goes to a TEMP FILE, not a `<<PY` heredoc.
+  #
+  # This function runs from the EXIT trap, i.e. AFTER the main body's
+  #     while read local_ref local_sha remote_ref remote_sha; do ...
+  # loop has consumed the hook's stdin. A heredoc is read from stdin, so by then
+  # `python - <<PY` receives NOTHING — bash discards the body and executes its
+  # lines as commands instead:
+  #     .git/hooks/pre-push: line 92: None: command not found
+  #     .git/hooks/pre-push: line 92: verdict: command not found
+  # The old form (`python3 - <<PY 2>/dev/null || true`) hid all of it, so the
+  # JSON journal was silently never written on any platform. Writing the script
+  # to a file removes the stdin dependency entirely.
+  local py_script py_rc
+  py_script="$(mktemp)" || {
+    echo "⚠️  Gate M journal: could not create a temp file — report NOT written for $report_file." >&2
+    return 0
+  }
+  # Values are injected here (they are expanded by bash before Python parses the
+  # file), exactly as the heredoc did.
+  {
+    printf '%s\n' \
+      'import json' \
+      'import os' \
+      'from pathlib import Path'
+    printf '%s\n' "pushed_files = '''${PUSHED_FILES:-}'''.splitlines()"
+    printf '%s\n' "passed = 1 if '$verdict' == 'PASS' else 0"
+    printf '%s\n' 'try:'
+    printf '%s\n' "    _survivors_raw = os.environ.get('XP_GATE_M_SURVIVORS_JSON', '').strip()"
+    printf '%s\n' '    survivors_detail = json.loads(_survivors_raw) if _survivors_raw else None'
+    printf '%s\n' 'except (ValueError, TypeError):'
+    printf '%s\n' '    survivors_detail = None'
+    printf '%s\n' "_m_details = {'skip_reason': '${GATE_M_SKIP_REASON:-}', 'duration_ms': '${M_DURATION_MS:-0}', 'mutation_score': '${M_SCORE:-}'}"
+    printf '%s\n' 'if survivors_detail is not None:'
+    printf '%s\n' "    _m_details['survivors'] = json.dumps(survivors_detail, sort_keys=True)"
+    printf '%s\n' 'report = {'
+    printf '%s\n' "  'timestamp': '$timestamp',"
+    printf '%s\n' "  'trigger': 'pre-push',"
+    printf '%s\n' "  'branch': '$CURRENT_BRANCH',"
+    printf '%s\n' "  'commit': '$commit_hash',"
+    printf '%s\n' "  'changed_files': [f for f in pushed_files if f],"
+    printf '%s\n' "  'overall': {"
+    printf '%s\n' "    'score': None,"
+    printf '%s\n' "    'score_scope': None,"
+    printf '%s\n' "    'gates_passed': None,"
+    printf '%s\n' "    'gates_total': None,"
+    printf '%s\n' "    'verdict': '$verdict',"
+    printf '%s\n' "  },"
+    printf '%s\n' "  'gates': ["
+    printf '%s\n' "    {'id': 'MP', 'name': 'Gate-Script Mirror Parity', 'status': '${GATE_MP_STATUS:-SKIP}', 'details': {'duration_ms': '${MP_DURATION_MS:-0}'}},"
+    printf '%s\n' "    {'id': '10', 'name': 'Build Integrity', 'status': '${GATE_10_STATUS:-SKIP}', 'details': {}},"
+    printf '%s\n' "    {'id': 'M', 'name': 'Mutation Testing', 'status': '${GATE_M_STATUS:-SKIP}', 'details': _m_details},"
+    printf '%s\n' "    {'id': 'M-Python', 'name': 'Mutation Testing (Python)', 'status': '${GATE_M_PY_STATUS:-SKIP}', 'details': {'skip_reason': '${GATE_M_PY_SKIP_REASON:-}'}},"
+    printf '%s\n' "    {'id': 'M-Go', 'name': 'Mutation Testing (Go)', 'status': '${GATE_M_GO_STATUS:-SKIP}', 'details': {}},"
+    printf '%s\n' "    {'id': 'M-Java', 'name': 'Mutation Testing (Java)', 'status': '${GATE_M_JAVA_STATUS:-SKIP}', 'details': {}},"
+    printf '%s\n' "    {'id': 'M-Kotlin', 'name': 'Mutation Testing (Kotlin)', 'status': '${GATE_M_KOTLIN_STATUS:-SKIP}', 'details': {}},"
+    printf '%s\n' "    {'id': 'M2', 'name': 'Mock Density (WARNING only)', 'status': '${GATE_M2_STATUS:-SKIP}', 'details': {}},"
+    printf '%s\n' "    {'id': 'ML', 'name': 'Mock Layering', 'status': '${GATE_M3_STATUS:-SKIP}', 'details': {}},"
+    printf '%s\n' "    {'id': 'UI', 'name': 'UI Sprint Gates', 'status': '${GATE_UI_STATUS:-SKIP}', 'details': {}},"
+    printf '%s\n' "    {'id': 'MW', 'name': 'Code Walkthrough', 'status': '${GATE_DELPHI_STATUS:-SKIP}', 'details': {'remote': '$REMOTE', 'url': '$URL', 'skip_reason': '${GATE_DELPHI_SKIP_REASON:-}'}},"
+    printf '%s\n' "    {'id': 'S', 'name': 'Sprint Flow Enforcement', 'status': '${GATE_S_STATUS:-SKIP}', 'details': {}}"
+    printf '%s\n' "  ],"
+    printf '%s\n' "  'warnings': [],"
+    printf '%s\n' "  'errors': [] if '$verdict' == 'PASS' else ['pre-push hook exited with code $exit_code'],"
+    printf '%s\n' '}'
+    printf '%s\n' "Path('$report_file').write_text(json.dumps(report, indent=2) + '\n')"
+  } > "$py_script"
+
+  "$py_bin" "$py_script"
+  py_rc=$?
+  rm -f "$py_script"
+  if [ "$py_rc" -ne 0 ]; then
+    echo "⚠️  Gate M journal: $py_bin exited $py_rc — the push's audit record at $report_file is missing." >&2
+    return 0
+  fi
+
+  # #577: the score rule is NOT re-derived here. It lives in
+  # githooks/lib/prepush-score.py as a real module with a real interface, so the
+  # rule can be exercised directly by tests instead of being asserted through a
+  # copied-and-pasted implementation. It refuses to emit a number when the gates
+  # that ran cannot summarise the report (none ran, or fewer than half did).
+  if ! "$py_bin" "$score_lib" --report "$report_file"; then
+    echo "⚠️  Gate M journal: could not score $report_file — score left unset." >&2
+  fi
 }
 
 _pre_push_report_on_exit() {
@@ -992,8 +1087,16 @@ echo "   GATE UI: UI SPRINT QUALITY GATES"
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
 if [[ "$XP_GATE_SKIP_UI_GATES" == "1" ]]; then
-  if [[ -z "$XP_GATE_BYPASS_REASON" || ${#XP_GATE_BYPASS_REASON// /} -lt 10 ]]; then
+  # #578: this guard used `${#XP_GATE_BYPASS_REASON// /}`, which stacks "length"
+  # and "substitution" — bash rejects it with `bad substitution` for the whole
+  # condition line, so NEITHER branch ran. The bypass therefore skipped Gate UI
+  # with an empty or one-character reason, and the audit entry below was lost
+  # too. Strip the whitespace into a variable first, then take its length: two
+  # ordinary expansions, each of them valid on its own.
+  XP_GATE_BYPASS_REASON_COMPACT="${XP_GATE_BYPASS_REASON//[[:space:]]/}"
+  if [[ -z "$XP_GATE_BYPASS_REASON" || ${#XP_GATE_BYPASS_REASON_COMPACT} -lt 10 ]]; then
     echo "❌ XP_GATE_BYPASS_REASON required (min 10 non-whitespace chars)"
+    echo "   got: ${#XP_GATE_BYPASS_REASON_COMPACT} non-whitespace character(s)"
     exit 1
   fi
   echo "⚠️  UI Gate BYPASSED — reason: $XP_GATE_BYPASS_REASON"
@@ -1175,7 +1278,12 @@ if [ ! -f "$MW_VALIDATOR" ]; then
 fi
 
 CURRENT_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-if ! VALIDATION_ERROR=$(node "$MW_VALIDATOR" "$RESULT_FILE" "$EXPECTED_COMMIT" "$CURRENT_BRANCH" "$CURRENT_TIME" 2>&1); then
+# The 5th argument names the repository whose `.delphi-config.json` BINDS the
+# evidence (#574). It is passed explicitly instead of letting the validator
+# infer it from cwd: the gate's subject is the repo being pushed, and a cwd-
+# derived lookup would bind xp-gate's own config whenever the suite runs here.
+MW_PROJECT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || echo "")
+if ! VALIDATION_ERROR=$(node "$MW_VALIDATOR" "$RESULT_FILE" "$EXPECTED_COMMIT" "$CURRENT_BRANCH" "$CURRENT_TIME" "$MW_PROJECT_ROOT" 2>&1); then
   echo ""
   echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
   echo "   ❌ RESULT FILE OUTDATED - PUSH BLOCKED"
@@ -1204,11 +1312,21 @@ fi
 # ============================================================================
 echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-# Trim the trailing separator and turn it into a displayable list.
-SKIPPED_DISPLAY=$(printf '%s' "${GATES_SKIPPED:-}" | sed 's/|$//' | sed 's/|/ , /g')
-if [ -n "$SKIPPED_DISPLAY" ]; then
+# Turn the recorded skips into a displayable list.
+#
+# Split on the SEPARATOR (`|`), never on anything that can occur inside a reason.
+# The previous form replaced `|` with " , " and then split on `,`, so a reason
+# that merely contained a comma was torn in two and its second half printed as
+# its own gate:
+#     Gate MP: script not found, parity NOT verified
+#       - Gate MP: script not found
+#       - parity NOT verified      <-- invented gate, and the real entry lost
+#                                      the half that said what was verified (#572)
+# A trailing separator is dropped, and blank segments are skipped.
+SKIPPED_LIST=$(printf '%s' "${GATES_SKIPPED:-}" | tr '|' '\n' | sed '/^[[:space:]]*$/d')
+if [ -n "$SKIPPED_LIST" ]; then
   echo "   ⚠️  NO BLOCKING FAILURES — but not every gate ran:"
-  echo "$SKIPPED_DISPLAY" | tr ',' '\n' | sed '/^[[:space:]]*$/d' | sed 's/^[[:space:]]*/     - /'
+  printf '%s\n' "$SKIPPED_LIST" | sed 's/^[[:space:]]*/     - /'
 else
   echo "   ✅ ALL CHECKS PASSED"
 fi

package/hooks/sprint-gate.sh

@@ -35,6 +35,17 @@
 #   - JSON parser fallback chain: jq → Node.js → explicit degradation message
 #
 # OUTPUT: JSON to stdout — {"decision":"allow|deny|skip",...}
+#
+# #584: every `allow` also carries `"allow_reason"`, because `allow` alone was
+# ambiguous. It meant three different things and pre-commit mapped all of them to
+# Gate 11 PASS:
+#
+#   checks-passed      the sprint was actually validated      -> PASS is honest
+#   phase-not-reached  the sprint has not reached this gate's phase
+#   no-json-parser     nothing could be read at all
+#
+# The last two examine nothing, so reporting them as PASS inflated the score.
+# `checks-passed` is the only reason that licenses a PASS.
 # EXIT: 0 = pass/skip, 1 = block
 
 set -euo pipefail
@@ -264,7 +275,7 @@ if [ "$MODE" = "pre-commit" ]; then
 
     # If no JSON parser available, warn but allow (graceful degradation)
     if [ "$JSON_PARSER" = "none" ]; then
-      echo '{"decision":"allow","warning":"neither jq nor node available, cannot verify delphi-review verdict. Install jq or node for full protection."}'
+      echo '{"decision":"allow","allow_reason":"no-json-parser","warning":"neither jq nor node available, cannot verify delphi-review verdict. Install jq or node for full protection."}'
       exit 0
     fi
 
@@ -299,7 +310,7 @@ if [ "$MODE" = "pre-commit" ]; then
     # claim: a 29-day-old sprint under a 30-day threshold is a very different
     # situation from one opened today, and the log should say which it is.
     if [ -n "$SPRINT_AGE_DAYS" ]; then
-      echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint open ${SPRINT_AGE_DAYS} day(s), staleness threshold ${SPRINT_STALE_DAYS})\"}"
+      echo "{\"decision\":\"allow\",\"allow_reason\":\"checks-passed\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint open ${SPRINT_AGE_DAYS} day(s), staleness threshold ${SPRINT_STALE_DAYS})\"}"
     else
       echo "{\"decision\":\"allow\",\"message\":\"delphi-review APPROVED, sprint phase ${PHASE} validated (sprint age unknown — started_at unreadable)\"}"
     fi
@@ -307,7 +318,7 @@ if [ "$MODE" = "pre-commit" ]; then
   fi
 
   # Phase < 1 (pre-PLAN) — no delphi enforcement needed
-  echo "{\"decision\":\"allow\",\"reason\":\"sprint phase ${PHASE} (pre-PLAN), no delphi enforcement required\"}"
+  echo "{\"decision\":\"allow\",\"allow_reason\":\"phase-not-reached\",\"reason\":\"sprint phase ${PHASE} (pre-PLAN), no delphi enforcement required\"}"
   exit 0
 fi
 

package/lib/__tests__/check-alignment-cli.test.mjs

@@ -57,10 +57,27 @@ describe('check-alignment CLI injection surface (#392-#6)', () => {
 describe('check-alignment runner output integrity', () => {
   it('emits a complete parseable JSON document with --json', () => {
     const spec = join(here, 'test-alignment.test.ts');
-    const result = spawnSync(process.execPath, [RUNNER, '--spec', spec, '--json'], {
-      encoding: 'utf8',
-    });
+    // Run the runner under the SAME loader the CLI uses. `check-alignment-runner.cjs`
+    // does `require('./test-alignment.ts')`, and plain `node` only tolerates that
+    // from Node 22.6+ (type stripping). CI pins Node 20.x, where it throws
+    // "Unknown file extension" — the runner printed nothing, and the empty string
+    // surfaced as "Unexpected end of JSON input", which reads exactly like the
+    // truncation this test guards against (#586). bin/xp-gate.js has always loaded
+    // this file through tsx; the test was the only caller that did not.
+    const result = spawnSync(
+      process.execPath,
+      [join(here, '..', '..', '..', '..', 'node_modules', 'tsx', 'dist', 'cli.mjs'), RUNNER, '--spec', spec, '--json'],
+      { encoding: 'utf8' }
+    );
     expect(result.error).toBeUndefined();
+    // An EMPTY stdout also parses to "Unexpected end of JSON input", which is
+    // indistinguishable from the truncation this test exists for. Report what the
+    // runner actually did first, so a crash is not mistaken for a truncation.
+    expect(
+      result.stdout,
+      `runner produced no stdout at all (status=${result.status}, ` +
+        `stderr=${JSON.stringify(result.stderr)}) — that is a crash, not a truncation`
+    ).not.toBe('');
     // The whole stdout stream must be one valid JSON document. A process.exit()
     // immediately after console.log would truncate it on some platforms.
     const parsed = JSON.parse(result.stdout);

package/lib/__tests__/check-alignment-reasons.test.mjs

@@ -0,0 +1,91 @@
+/**
+ * @test REQ-599
+ * @intent `check-alignment` printed only its status and counters when it blocked:
+ *
+ *             Status: BLOCKED
+ *             Score: 0
+ *             Misaligned: 0
+ *
+ *         Those two lines contradict each other — zero misaligned tests, yet
+ *         blocked — and the actual reason was in `report.errors`, which the
+ *         runner never printed at all. A gate that blocks without saying why is
+ *         not actionable, and the standard response to an unactionable red (by any
+ *         name: --no-verify, deleting the check) is exactly how dead gates get
+ *         built. This is a recurrence of #57.
+ *
+ *         These cases pin that a non-PASS verdict always explains itself, and
+ *         that a non-PASS verdict carrying NO reason is reported as the producer
+ *         bug it is rather than printed as an empty list.
+ * @covers AC-599-09
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { spawnSync } from 'child_process';
+import { fileURLToPath } from 'url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const RUNNER = join(here, '..', 'check-alignment-runner.cjs');
+const TSX = join(here, '..', '..', '..', '..', 'node_modules', 'tsx', 'dist', 'cli.mjs');
+
+const source = readFileSync(RUNNER, 'utf8');
+
+describe('check-alignment explains a non-PASS verdict (#573)', () => {
+  it('anti-vacuity: the runner does read report.errors at all', () => {
+    // Before the fix this exact grep returned nothing, which is the whole issue.
+    expect(source).toMatch(/report\.errors|\.errors\b/);
+  });
+
+  it('the human-readable path prints a reasons block', () => {
+    // Not just "mentions errors somewhere": the non-JSON branch must render them.
+    expect(source).toMatch(/Reasons:/);
+  });
+
+  it('a missing reason is reported as a producer bug, not printed as empty', () => {
+    // A non-PASS verdict with no entries in report.errors is a defect in whoever
+    // produced the report. Saying so is different from printing nothing.
+    expect(source).toMatch(/none recorded|no reasons|producer/i);
+  });
+
+  it('the reasons are printed only when the verdict is not PASS', () => {
+    // Printing "Reasons:" on a PASS run would train readers to ignore it.
+    const idx = source.indexOf('Reasons:');
+    expect(idx).toBeGreaterThan(-1);
+    // The rendering must sit inside a non-PASS guard.
+    expect(source).toMatch(/alignment_status\s*!==\s*['"]PASS['"]/);
+  });
+});
+
+describe('check-alignment reasons survive the real CLI surface (#573)', () => {
+  it('--json still emits report.errors so a machine can read the reason', () => {
+    const spec = join(here, 'test-alignment.test.ts');
+    const result = spawnSync(process.execPath, [TSX, RUNNER, '--spec', spec, '--json'], {
+      encoding: 'utf8',
+      timeout: 120000,
+    });
+    expect(result.error).toBeUndefined();
+    expect(result.stdout).not.toBe('');
+    const parsed = JSON.parse(result.stdout);
+    // The field must exist on every report, PASS or not, so a consumer never has
+    // to distinguish "absent" from "empty".
+    expect(parsed).toHaveProperty('errors');
+    expect(Array.isArray(parsed.errors)).toBe(true);
+  }, 180000);
+
+  it('the human-readable path names the status and still lists no phantom reasons on PASS', () => {
+    const spec = join(here, 'test-alignment.test.ts');
+    const result = spawnSync(process.execPath, [TSX, RUNNER, '--spec', spec], {
+      encoding: 'utf8',
+      timeout: 120000,
+    });
+    expect(result.error).toBeUndefined();
+    // Whatever the verdict, the status line is always there.
+    expect(result.stdout).toMatch(/Status:/);
+
+    const blocked = /Status:\s*(?!PASS)/.test(result.stdout);
+    if (!blocked) {
+      // A passing run must not print a reasons block.
+      expect(result.stdout).not.toMatch(/Reasons:/);
+    }
+  }, 180000);
+});

package/lib/__tests__/doctor-delphi.test.js

@@ -206,6 +206,52 @@ describe('doctor delphi (#414 REQ-3/REQ-6)', () => {
     expect(code).toBe(0);
   });
 
+  // #574: `scripts/check_delphi_local_models.py` encoded the local-only seat
+  // rule but nothing ever called it, so the guard existed only in its own
+  // docstring. The doctor now reports the same verdict, which is what gives the
+  // rule a caller. The rule stays a WARN: a deliberately hosted seat is legal,
+  // and the HARD enforcement is Gate MW's evidence-to-config binding.
+  it('#574 hosted (non local-*) seats are reported as a WARN, not a failure', async () => {
+    healthyHome();
+    const configPath = writeConfig(path.join(tmpHome, '.delphi-config.json'));
+    const logs = [];
+    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    logSpy.mockRestore();
+    const output = logs.join('\n');
+    expect(code).toBe(0);
+    expect(output).toMatch(/local-model guard/i);
+    expect(output).toMatch(/model-a|model-b|model-c/);
+  });
+
+  it('#574 three local-* seats PASS the local-model guard', async () => {
+    healthyHome();
+    const configPath = path.join(tmpHome, '.delphi-config.json');
+    fs.writeFileSync(configPath, JSON.stringify({
+      active_profile: 'local',
+      profiles: {
+        local: {
+          providers: { gw: { base_url: 'https://gw.example/v1', api_key: 'k' } },
+          experts: {
+            architecture: { provider: 'gw', model: 'local-deepseek-v4-flash' },
+            technical: { provider: 'gw', model: 'local-qwen3.8-flash' },
+            feasibility: { provider: 'gw', model: 'local-qwen3.8-27b' },
+          },
+        },
+      },
+    }));
+    const logs = [];
+    const logSpy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({ projectDir: tmpHome, configPath, npmLatest: null });
+    logSpy.mockRestore();
+    const output = logs.join('\n');
+    expect(code).toBe(0);
+    expect(output).toMatch(/local-model guard/i);
+    expect(output).toMatch(/all 3 seats are local-\*/i);
+  });
+
   // R1 FC-07: the switch shipping off is the platform default, not a defect —
   // only enabled-but-underprovisioned is a real FAIL.
   it('DSH with subagentModelSelection absent is SKIP, not FAIL', async () => {

package/lib/__tests__/doctor-exec-retry.test.js

@@ -67,16 +67,26 @@ describe('execWithTimeout empty-stream retry (#525 follow-up)', () => {
     return require(doctorPath).execWithTimeout;
   }
 
-  it('AC-DOCTOR-RETRY-01: retries an exit-0 empty-stdout probe and keeps its own timeout', async () => {
-    stub = stubExec([
-      (cb) => cb(null, '', ''),            // the lost-stream failure mode
-      (cb) => cb(null, 'v24.19.0\n', ''),  // the same probe, stream intact
-    ]);
-    const execWithTimeout = freshDoctor();
-    const result = await execWithTimeout('node --version', { stdio: ['ignore', 'pipe', 'pipe'] });
-    expect(stub.calls.length).toBe(2);
-    expect(result).toEqual({ stdout: 'v24.19.0', stderr: '' });
-  });
+  // Windows-only by construction, as a whole: the RETRY it asserts does not exist
+  // off win32. The retry compensates for cmd.exe returning exit 0 with an EMPTY
+  // stream; elsewhere the first empty probe is final, so `result` comes back null
+  // and there is nothing to retry. Asserting the attempt count alone is not enough
+  // — measured under a faked `process.platform = 'linux'`, the count assertion
+  // passed while `result` failed with "expected null to deeply equal { stdout:
+  // 'v24.19.0' }". The premise of the whole case is win32 (#586).
+  it.skipIf(process.platform !== 'win32')(
+    'AC-DOCTOR-RETRY-01: retries an exit-0 empty-stdout probe and keeps its own timeout',
+    async () => {
+      stub = stubExec([
+        (cb) => cb(null, '', ''),            // the lost-stream failure mode
+        (cb) => cb(null, 'v24.19.0\n', ''),  // the same probe, stream intact
+      ]);
+      const execWithTimeout = freshDoctor();
+      const result = await execWithTimeout('node --version', { stdio: ['ignore', 'pipe', 'pipe'] });
+      expect(stub.calls.length).toBe(2);
+      expect(result).toEqual({ stdout: 'v24.19.0', stderr: '' });
+    }
+  );
 
   it('AC-DOCTOR-RETRY-01: returns null after exhausting attempts on a persistently empty probe', async () => {
     stub = stubExec([