@boyingliu01/xp-gate 0.31.3 → 0.32.0

package/hooks/lib/validate-code-walkthrough.cjs

@@ -3,6 +3,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const os = require('node:os');
 
 const REQUIRED_ROLES = ['architecture', 'technical', 'feasibility'];
 const VALIDITY_MS = 60 * 60 * 1000;
@@ -45,25 +46,31 @@ function parseTimestamp(value, field) {
     : null;
   if (!match) fail(`${field} must be a canonical UTC ISO-8601 timestamp.`);
 
-  const [, yearText, monthText, dayText, hourText, minuteText, secondText, fractionText] = match;
-  const year = Number(yearText);
-  const month = Number(monthText);
-  const day = Number(dayText);
-  const hour = Number(hourText);
-  const minute = Number(minuteText);
-  const second = Number(secondText);
-  const milliseconds = Number((fractionText || '').padEnd(3, '0') || 0);
+  // Groups 1..6 are year, month, day, hour, minute, second; group 7 is the
+  // optional millisecond fraction. Keeping them as arrays means the "build the
+  // date" and "verify round-trip" steps share one ordered definition instead of
+  // repeating seven hand-numbered comparisons.
+  const parts = match.slice(1, 7).map(Number);
+  const [year, month, day, hour, minute, second] = parts;
+  const milliseconds = Number((match[7] || '').padEnd(3, '0') || 0);
   const date = new Date(0);
   date.setUTCFullYear(year, month - 1, day);
   date.setUTCHours(hour, minute, second, milliseconds);
 
-  if (date.getUTCFullYear() !== year
-      || date.getUTCMonth() !== month - 1
-      || date.getUTCDate() !== day
-      || date.getUTCHours() !== hour
-      || date.getUTCMinutes() !== minute
-      || date.getUTCSeconds() !== second
-      || date.getUTCMilliseconds() !== milliseconds) {
+  // A date silently rolls over ("2026-02-30" becomes March 2), so the only way
+  // to know the input was a real calendar instant is to read it back and compare
+  // every field.
+  const expected = [...parts, milliseconds];
+  const readBack = [
+    date.getUTCFullYear(),
+    date.getUTCMonth() + 1,
+    date.getUTCDate(),
+    date.getUTCHours(),
+    date.getUTCMinutes(),
+    date.getUTCSeconds(),
+    date.getUTCMilliseconds(),
+  ];
+  if (!readBack.every((actual, i) => actual === expected[i])) {
     fail(`${field} must contain a valid UTC calendar date and time.`);
   }
   return date.getTime();
@@ -142,6 +149,19 @@ function resolveBindingSeats(config) {
   return seatsFromExperts(profiles[active].experts);
 }
 
+/**
+ * Machine-wide Delphi config path: `$XDG_CONFIG_HOME/xp-gate/` or
+ * `~/.config/xp-gate/`. Mirrors `defaultGlobalConfigPath()` in
+ * `plugins/dsh/src/delphi-config.ts` so the gate and the tool that produces the
+ * evidence agree on where seats come from. XDG_CONFIG_HOME is honoured because
+ * the plugin honours it — a gate reading a different file than the reviewer
+ * used would bind against seats nobody actually ran.
+ */
+function globalConfigPath(env = process.env) {
+  const base = env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+  return path.join(base, 'xp-gate', DELPHI_CONFIG_FILE);
+}
+
 /**
  * Read the binding seats for the project rooted at `projectRoot`.
  *
@@ -152,23 +172,88 @@ function resolveBindingSeats(config) {
  * fixture to xp-gate's seats. The gate's subject is the repository being
  * pushed, so that is what must be named.
  *
+ * ## Global fallback (2026-10-27)
+ *
+ * A project file still WINS, so a repo can override seats deliberately. When
+ * the project has none, the machine-wide config is used instead of returning
+ * null — and this is load-bearing, not a convenience:
+ *
+ * Before this fallback existed, DELETING a project-level config silently
+ * disabled the entire #574 seat check, because `bindingSeats === null`
+ * short-circuits `validateRequestedModel`. The gate kept reporting PASS while
+ * any three distinct gateway models — including the expensive overseas ones
+ * #574 exists to catch — could satisfy it, with no message anywhere. A user
+ * consolidating onto one global config to stop maintaining a copy per repo
+ * would have unknowingly traded that protection away.
+ *
+ * Only ENOENT triggers the fallback: an unreadable project config
+ * (EACCES/EISDIR) must surface rather than silently routing this run to a
+ * different file. Same semantics as `loadDelphiConfig()` in the DSH plugin.
+ *
+ * ## No config anywhere is now FAIL-CLOSED (2026-10-27)
+ *
+ * Returning null when both locations are absent re-opened the exact hole #574
+ * closed: measured, `b-claude-4.8-opus` / `gpt-5.5` / `gemini-3-pro` pass the
+ * validator when no config exists. That was tolerable while a config shipped
+ * inside every repo (deleting one looked like opting out); once the machine-wide
+ * file is the single source of truth, "no config" becomes the normal state of a
+ * fresh machine or a bare CI runner — i.e. the bypass is the default path.
+ *
+ * The caller distinguishes two cases it already knows:
+ *   - no project context at all (no root argument) -> unbound, #423 behaviour;
+ *   - a real repo with evidence but no config anywhere -> refuse.
+ * This function therefore throws rather than returning null for the second
+ * case; `main()` only reaches it when a project root was named.
+ *
  * @param {string} projectRoot repository root whose config binds the evidence
- * @returns {Map<string, string> | null} seats, or null when no config exists
+ * @param {NodeJS.ProcessEnv} env environment for the global-path lookup
+ * @returns {Map<string, string>} seats; never null
+ * @throws exits via fail() when neither location has a config
  */
-function loadBindingSeats(projectRoot) {
-  const configPath = path.join(projectRoot, DELPHI_CONFIG_FILE);
+function loadBindingSeats(projectRoot, env = process.env) {
+  const projectPath = path.join(projectRoot, DELPHI_CONFIG_FILE);
+  const fallbackPath = globalConfigPath(env);
+
   let raw;
+  let source = projectPath;
+  let projectMissing = false;
   try {
-    raw = fs.readFileSync(configPath, 'utf8');
-  } catch (error) {
-    if (error && error.code === 'ENOENT') return null;
-    fail(`cannot read ${DELPHI_CONFIG_FILE}: ${error && error.message ? error.message : String(error)}`);
+    raw = fs.readFileSync(projectPath, 'utf8');
+  } catch (projectError) {
+    if (projectError && projectError.code === 'ENOENT') {
+      projectMissing = true;
+      try {
+        raw = fs.readFileSync(fallbackPath, 'utf8');
+        source = fallbackPath;
+      } catch (globalError) {
+        if (globalError && globalError.code === 'ENOENT') {
+          // Both absent: this repo has walkthrough evidence but nothing binds
+          // it to seats. Fail closed and say exactly where we looked.
+          fail(
+            `no ${DELPHI_CONFIG_FILE} found, so the reviewer seats cannot be verified. `
+              + `Looked in: ${projectPath}, ${fallbackPath}. `
+              + `Create the machine-wide config or add one to the repository.`
+          );
+        }
+        fail(
+          `cannot read ${DELPHI_CONFIG_FILE}: ${globalError && globalError.message
+            ? globalError.message
+            : String(globalError)}`
+        );
+      }
+    } else {
+      fail(
+        `cannot read ${DELPHI_CONFIG_FILE}: ${projectError && projectError.message
+          ? projectError.message
+          : String(projectError)}`
+      );
+    }
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch (error) {
-    fail(`${DELPHI_CONFIG_FILE} is not valid JSON: ${error.message}`);
+    fail(`${source} is not valid JSON: ${error.message}`);
   }
   const seats = resolveBindingSeats(parsed);
   for (const role of REQUIRED_ROLES) {
@@ -176,9 +261,60 @@ function loadBindingSeats(projectRoot) {
       fail(`${DELPHI_CONFIG_FILE} declares no seat for the ${role} role; all three roles must be configured.`);
     }
   }
+  // A repo-local copy that disagrees with the machine-wide one is exactly how
+  // the 2026-10-27 incident happened: a stale per-repo file silently won and the
+  // review kept using a seat that had been retired. Winning is still allowed
+  // (deliberate overrides exist), but it must never be silent.
+  if (!projectMissing) {
+    warnOnSeatDrift(projectPath, fallbackPath, seats);
+  }
   return seats;
 }
 
+/**
+ * Warn (never block) when a repository-local config disagrees with the
+ * machine-wide one.
+ *
+ * 2026-10-27 incident: the machine-wide config had been updated to replace a
+ * flaky seat, but an older copy survived in the repo root. The project file
+ * won, the review kept calling the retired seat, and nothing anywhere said so —
+ * the only symptom was intermittent HTTP 500s that looked like a gateway
+ * problem. Silence is what made it expensive.
+ *
+ * Deliberate per-repo overrides are legitimate, so this is a WARN on stderr and
+ * never changes the exit code. Absence of either file is not drift.
+ *
+ * @param {string} projectPath repository config path
+ * @param {string} fallbackPath machine-wide config path
+ * @param {Map<string, string>} projectSeats seats actually in effect
+ */
+function warnOnSeatDrift(projectPath, fallbackPath, projectSeats) {
+  let machineRaw;
+  try {
+    machineRaw = fs.readFileSync(fallbackPath, 'utf8');
+  } catch {
+    return; // no machine-wide config -> nothing to disagree with
+  }
+  let machineSeats;
+  try {
+    machineSeats = resolveBindingSeats(JSON.parse(machineRaw));
+  } catch {
+    return; // a malformed machine config is reported by its own path when used
+  }
+  const drift = REQUIRED_ROLES.filter(
+    (role) => machineSeats.has(role) && projectSeats.get(role) !== machineSeats.get(role)
+  );
+  if (drift.length === 0) return;
+  const detail = drift
+    .map((role) => `${role}: repo=${projectSeats.get(role)} machine=${machineSeats.get(role)}`)
+    .join('; ');
+  process.stderr.write(
+    `⚠️  ${DELPHI_CONFIG_FILE} in this repository overrides the machine-wide seats `
+      + `(${detail}). The repository copy wins. If the machine-wide config was updated `
+      + `to retire a seat, this repo is still calling the old one.\n`
+  );
+}
+
 /**
  * Validate an expert's identity fields: shape, role, approval status, and
  * channel provenance. Split out of `validateExpert`, which exceeded the
@@ -284,10 +420,24 @@ function validateExpert(expert, index, roles, models, resolvedModels, bindingSea
 
 function validateEvidence(evidence, expectedCommit, expectedBranch, now, bindingSeats) {
   if (!isPlainObject(evidence)) fail('top level must be a plain object.');
+  validateEvidenceIdentity(evidence, expectedCommit, expectedBranch);
+  validateEvidenceTimestamps(evidence, now);
+  validateConsensusRatio(evidence.consensus_ratio);
+  validateExperts(evidence.experts, bindingSeats);
+}
+
+/** The document must describe this exact push, and must approve it. */
+function validateEvidenceIdentity(evidence, expectedCommit, expectedBranch) {
   if (evidence.commit !== expectedCommit) fail('commit does not match HEAD.');
   if (evidence.branch !== expectedBranch) fail('branch does not match the current branch.');
   if (evidence.verdict !== 'APPROVED') fail('top-level verdict must be APPROVED.');
+}
 
+/**
+ * The evidence must be recent and self-consistent: not from the future, not
+ * expired, and valid for exactly one hour from its own timestamp.
+ */
+function validateEvidenceTimestamps(evidence, now) {
   const timestamp = parseTimestamp(evidence.timestamp, 'timestamp');
   const expires = parseTimestamp(evidence.expires, 'expires');
   if (timestamp > now) fail('timestamp is in the future.');
@@ -295,15 +445,22 @@ function validateEvidence(evidence, expectedCommit, expectedBranch, now, binding
   if (expires - timestamp !== VALIDITY_MS) {
     fail('expires must be exactly one hour after timestamp.');
   }
+}
 
-  if (typeof evidence.consensus_ratio !== 'number'
-      || !Number.isFinite(evidence.consensus_ratio)
-      || evidence.consensus_ratio < 0.90
-      || evidence.consensus_ratio > 1) {
+/** The three experts must have agreed at 90% or better. */
+function validateConsensusRatio(ratio) {
+  if (typeof ratio !== 'number' || !Number.isFinite(ratio) || ratio < 0.90 || ratio > 1) {
     fail('consensus_ratio must be a finite number from 0.90 through 1.');
   }
+}
 
-  if (!Array.isArray(evidence.experts) || evidence.experts.length !== 3) {
+/**
+ * Validate each of the three expert records, then confirm every required role
+ * appeared. `roles` accumulates across the records, so it is checked once after
+ * the loop rather than per expert.
+ */
+function validateExperts(experts, bindingSeats) {
+  if (!Array.isArray(experts) || experts.length !== 3) {
     fail('experts must contain exactly three records.');
   }
   const roles = new Set();
@@ -311,7 +468,7 @@ function validateEvidence(evidence, expectedCommit, expectedBranch, now, binding
   // Scoped to this validation run, so one document's models cannot leak into the
   // next (a long-lived process validating several pushes).
   const resolvedModels = new Set();
-  evidence.experts.forEach((expert, index) => {
+  experts.forEach((expert, index) => {
     validateExpert(expert, index, roles, models, resolvedModels, bindingSeats);
   });
   if (roles.size !== REQUIRED_ROLES.length) fail('all required expert roles must be present.');

package/hooks/pre-commit

@@ -1506,9 +1506,32 @@ else
     fi
 
     # Debug statement detection (debugger statement in JS/TS)
-    TS_DEBUG_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx)$' || true)
+    #
+    # Dependencies and build output are filtered out first (#648). The list
+    # comes from `git diff --cached`, so a project (or a CI fixture) that
+    # vendors or commits its dependencies gets the dependency's OWN source
+    # scanned as if it were project code. TypeScript 7.x ships a bare
+    # `debugger;` in dist/internal/utils.js, which blocked commits that changed
+    # nothing of their own:
+    #     ❌ BLOCKED - 'debugger' statements detected:
+    #     node_modules/typescript/dist/internal/utils.js:18:    debugger;
+    # Pinning the dependency's version only postpones that: any package may
+    # carry a debugger statement, and which one lands changes with every
+    # install. The rule the gate actually wants is "no debugger in OUR code",
+    # so the ignore set Gate 2 already uses decides what counts as ours — one
+    # notion of build output across the gates, overridable through the same
+    # XP_GATE_JSCPD_DEFAULT_IGNORE switch.
+    TS_DEBUG_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx)$' | {
+      while IFS= read -r _df; do
+        [ -n "$_df" ] || continue
+        if ! jscpd_is_default_ignored "$_df"; then
+          printf '%s\n' "$_df"
+        fi
+      done
+    } || true)
     if [ -n "$TS_DEBUG_FILES" ]; then
-      DEBUGGER_HITS=$(grep -n '^\s*debugger\s*;\?\s*$' $TS_DEBUG_FILES 2>/dev/null || true)
+      # NUL-separated so paths with spaces survive; a bare $VAR would word-split.
+      DEBUGGER_HITS=$(printf '%s\n' "$TS_DEBUG_FILES" | tr '\n' '\0' | xargs -0 grep -n '^\s*debugger\s*;\?\s*$' 2>/dev/null || true)
       if [ -n "$DEBUGGER_HITS" ]; then
         echo ""
         echo "❌ BLOCKED - 'debugger' statements detected:"
@@ -2885,9 +2908,33 @@ else
           echo "ℹ️  Shell coverage not typically measured"
           ;;
         *)
+          # #640: hand the staged set to the adapter. Java's run_coverage uses it
+          # for three-tier smart selection (changed-tests -> related -> full);
+          # without it the adapter deliberately runs the full suite rather than
+          # guessing, so this export failing closed is safe.
+          # Colon-separated: newlines do not survive every adapter's word
+          # splitting, and paths with spaces stay intact inside the value.
+          GATE_CHANGED_FILES=$(printf '%s' "$CHANGED_FILES" | tr '\n' ':')
+          export GATE_CHANGED_FILES
+          # The adapter runs inside $(...), so it cannot set PARTIAL_TEST_RUN
+          # for us. It writes the chosen strategy to this file and we raise the
+          # flag here, in the shell that later reads it. Without this a Java
+          # subset run under 80% coverage would take the hard-BLOCK branch
+          # instead of the WARN branch, exactly the bug #556 fixed for Python.
+          _java_partial_file=$(mktemp 2>/dev/null || echo "")
+          if [ -n "$_java_partial_file" ]; then
+            export XP_GATE_PARTIAL_RUN_FILE="$_java_partial_file"
+          fi
           default_cov_output=$(run_coverage 2>&1)
           COV_EXIT=$((COV_EXIT || $?))
           echo "$default_cov_output" | head -30
+          unset XP_GATE_PARTIAL_RUN_FILE GATE_CHANGED_FILES
+          if [ -n "$_java_partial_file" ]; then
+            if [ -s "$_java_partial_file" ]; then
+              PARTIAL_TEST_RUN=true
+            fi
+            rm -f "$_java_partial_file" 2>/dev/null || true
+          fi
           ;;
       esac
     else
@@ -3008,19 +3055,53 @@ else
       # JaCoCo writes target/site/jacoco/ (Maven) or build/reports/jacoco/test/
       # (Gradle), i.e. neither path probed by the default branch below, so Java
       # needs its own branch to be measurable at all.
+      #
+      # #603: a MULTI-MODULE Maven repo writes one report per module --
+      # whaleaudit-core/target/site/jacoco/jacoco.csv, whaleaudit-demo/... --
+      # and nothing at the repo root. Probing only the root paths therefore
+      # concluded "No JaCoCo report found, so the 80% floor cannot be verified"
+      # and BLOCKED every Java commit of a project that had a complete report
+      # sitting one directory down. A gate that cannot see the report is not
+      # enforcing a floor, it is enforcing an accident of build layout.
+      # Fix: probe the root paths first (single-module projects, and the
+      # historical behaviour), then fall back to the module reports and
+      # aggregate across them, so the floor covers every class that was built.
       jacoco_csv=""
+      jacoco_all=""
       for jacoco_candidate in \
         "target/site/jacoco/jacoco.csv" \
         "build/reports/jacoco/test/jacocoTestReport.csv"; do
         [ -f "$jacoco_candidate" ] && { jacoco_csv="$jacoco_candidate"; break; }
       done
+      if [ -z "$jacoco_csv" ]; then
+        # Module reports. -mindepth-free walk so ./module/... is found; sorted
+        # for a stable, reproducible aggregate order.
+        jacoco_all=$(find . -path ./target -prune -o \
+          -type f \( -name 'jacoco.csv' -path '*/target/site/jacoco/*' \) -print 2>/dev/null \
+          | sort | tr '\n' ' ')
+        # First module report doubles as the "report exists" witness for the
+        # messages below; the aggregate sums over every one of them.
+        jacoco_csv=$(echo "$jacoco_all" | awk '{print $1}')
+      fi
+      if [ -n "$jacoco_csv" ] && [ -n "$jacoco_all" ]; then
+        _jc_n=$(echo "$jacoco_all" | awk '{print NF}')
+        echo "   ℹ️  Multi-module JaCoCo: aggregating $_jc_n module report(s)."
+      fi
 
       if [ -n "$jacoco_csv" ]; then
         # Aggregate INSTRUCTION_MISSED / INSTRUCTION_COVERED over every class row.
         # Columns are located by header name because their position is not part of
         # the CSV's stable contract.
+        #
+        # #603: with module reports, each file repeats the header row, so the
+        # header detection is per-file (FNR == 1) rather than per-stream
+        # (NR == 1). Otherwise module 2's header is summed as data, or worse,
+        # the single header found in module 1 leaves the columns unset for it.
+        _jc_inputs="$jacoco_csv"
+        [ -n "$jacoco_all" ] && _jc_inputs="$jacoco_all"
         COVERAGE_PERCENT=$(awk -F, '
-          NR == 1 {
+          FNR == 1 {
+            missed_col = 0; covered_col = 0;
             for (i = 1; i <= NF; i++) {
               if ($i == "INSTRUCTION_MISSED") missed_col = i;
               if ($i == "INSTRUCTION_COVERED") covered_col = i;
@@ -3036,7 +3117,7 @@ else
             if (total > 0) printf "%.2f", (covered / total) * 100;
             else print "";
           }
-        ' "$jacoco_csv" 2>/dev/null) || COVERAGE_PERCENT=""
+        ' $_jc_inputs 2>/dev/null) || COVERAGE_PERCENT=""
 
         if [ -n "$COVERAGE_PERCENT" ]; then
           # Compare on the unrounded value so 79.5% cannot pass as 80%.
@@ -3484,18 +3565,77 @@ else
         fi
         ;;
       "java")
-        if [ -f "src/test/java/architecture" ] || [ -d "src/test/java/architecture" ]; then
-          echo "     Running Java architecture tests..."
-          if [ -f "pom.xml" ]; then
-            mvn test -Dtest=architecture.* 2>&1 | head -20 || mvn test -Dtest=**Architecture** 2>&1 | head -20 || echo "⚠️  Java architecture tests completed"
-          elif [ -f "build.gradle" ]; then
-            if [ -f "./gradlew" ]; then
-              ./gradlew test --tests "*Architecture*" 2>&1 | head -20 || echo "⚠️  Java architecture tests completed"
-            fi
+        # #602: this branch used to be a guaranteed PASS no matter what happened.
+        #   1) The test-dir probe hardcoded `src/test/java/architecture` at the
+        #      repo root. A multi-module Maven repo (core/ + demo/) puts the arch
+        #      tests under <module>/src/test/java/..., so the probe missed them
+        #      and the gate took the SKIP path -- reporting architecture as
+        #      "not configured" for a repo that HAS such tests.
+        #   2) Even when it did run, `mvn ... | head -20` yields head's exit
+        #      status (0) as the pipeline result, so the `||` fallback never
+        #      fired and `echo "✅ ... completed"` printed unconditionally. A
+        #      failing architecture test was reported as success. Verified:
+        #      `false | head -20` exits 0; with `set -o pipefail` it exits 1.
+        # Fix: discover the test source roots instead of guessing one path, and
+        # judge the build by PIPESTATUS[0] (the pattern run_java_build_integrity
+        # already uses), so the verdict comes from the build, not from `head`.
+        _java_arch_roots=""
+        if [ -f "pom.xml" ] || [ -x "./mvnw" ]; then
+          # Any */src/test/java dir (module-relative root), including the repo
+          # root itself, which find prints as ./src/test/java -> root ".".
+          while IFS= read -r _root; do
+            [ -n "$_root" ] && _java_arch_roots="${_java_arch_roots} ${_root}"
+          done <<JAVAARCHROOTS
+$(find . -path ./target -prune -o -type d -path '*/src/test/java' -print 2>/dev/null \
+  | sed 's|^\./||; s|/src/test/java$||; s|^src/test/java$|.|')
+JAVAARCHROOTS
+        elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
+          _java_arch_roots="."
+        fi
+
+        # Only the roots that actually contain an *Architecture* test count.
+        _java_arch_hit=""
+        for _r in $_java_arch_roots; do
+          _probe_dir="$_r/src/test/java"
+          [ "$_r" = "." ] && _probe_dir="src/test/java"
+          if find "$_probe_dir" -name '*Architecture*' -type f 2>/dev/null | head -1 | grep -q .; then
+            _java_arch_hit="${_java_arch_hit} ${_r}"
+          fi
+        done
+
+        if [ -n "$_java_arch_hit" ]; then
+          echo "     Running Java architecture tests (roots:$_java_arch_hit)..."
+          _java_arch_rc=0
+          if [ -f "pom.xml" ] || [ -x "./mvnw" ]; then
+            _mvn_bin="mvn"
+            [ -x "./mvnw" ] && _mvn_bin="./mvnw"
+            # -pl <module> -am runs only the module that holds the tests (plus
+            # what it needs); quoting the whole root list into one -Dtest works
+            # for Surefire because it accepts comma-separated patterns.
+            for _r in $_java_arch_hit; do
+              if [ "$_r" = "." ]; then
+                "$_mvn_bin" -q test -Dtest='*Architecture*' 2>&1 | tail -20
+              else
+                "$_mvn_bin" -q -pl "$_r" -am test -Dtest='*Architecture*' 2>&1 | tail -20
+              fi
+              _rc="${PIPESTATUS[0]}"
+              [ "$_rc" -ne 0 ] && _java_arch_rc="$_rc"
+            done
+          elif [ -x "./gradlew" ]; then
+            ./gradlew test --tests '*Architecture*' 2>&1 | tail -20
+            _java_arch_rc="${PIPESTATUS[0]}"
+          fi
+
+          if [ "$_java_arch_rc" -ne 0 ]; then
+            echo ""
+            echo "❌ BLOCKED - Java architecture test(s) failed (exit $_java_arch_rc)"
+            echo "Fix the layering violation(s) above before committing."
+            GATE_6_REASON_BY_LANG["$CURRENT_LANG"]="architecture_tests_failed"
+            exit 1
           fi
           echo "     ✅ Java architecture validation completed."
         else
-          echo "     ℹ️  No architecture test files found - skipping"
+          echo "     ℹ️  No *Architecture* test sources found under */src/test/java - skipping"
           echo "     ⏭️  SKIPPED - Architecture validation (no tests)"
           # #537: no test files means Java architecture was NOT measured.
           if [ "${BASH_VERSINFO[0]:-0}" -ge 4 ]; then
@@ -3547,6 +3687,22 @@ else
     else
       GATE_6_REASON="$_g6_seen"
     fi
+
+    # #602 (status): a language that was really measured and passed leaves NO skip
+    # reason behind (see the #537 comment in the typescript arm: "archlint
+    # actually ran here, so there is no skip reason"). The verdict was never
+    # upgraded to match, so Gate 6 reported SKIP even when every language in
+    # the project had been validated and passed -- a measured dimension
+    # rendered as unmeasured. That is the mirror image of the bug #537 fixed,
+    # and the report could not tell the two apart.
+    #
+    # Upgrade to PASS only when the measurement actually happened for EVERY
+    # language: no language may carry a skip reason. A single skipped language
+    # keeps the gate non-PASS, so "some languages measured" cannot be scored
+    # as a full success.
+    if [ -z "$GATE_6_LANG_REASONS" ] && [ -n "$PROJECT_LANGS" ]; then
+      GATE_6_STATUS="PASS"
+    fi
   else
     # Architecture config is REQUIRED — BLOCK if missing
     if [ -f "$PROJECT_ROOT/.architecture-skip" ]; then
@@ -4020,6 +4176,90 @@ else
 fi
 # ============================================================================
 
+# ============================================================================
+# GATE 13: Compiler Strictness Check
+# The compiler is the first and cheapest static analyser for a compiled language
+# and XP-Gate never used it as one: cpp.sh only runs clang-tidy/cppcheck over the
+# first 20 files, and Gate 9's build-integrity half is TypeScript-and-Maven only.
+# A measured `g++ -Wall -Wextra` pass reports -Wnon-virtual-dtor, -Wreorder,
+# -Wparentheses and -Wclass-memaccess on an innocuous-looking file; bare `javac`
+# reports NOTHING for a raw type where `-Xlint:all` reports [rawtypes].
+#
+# Verdicts: 0 PASS, 1 FAIL (new findings -> blocked), 2 BLOCK (ran but output
+# untrustworthy), 3 WARN (tool absent / cross-compiling / timeout / warn-only).
+# A missing compiler is a SKIP-class WARN per the project convention, NOT a block.
+#
+# Escape hatches: XP_GATE_DISABLE_13=1 (kill switch),
+# XP_GATE_COMPILER_STRICTNESS=strict|balanced|warn-only,
+# XP_GATE_COMPILER_ANALYZER=1 (gcc -fanalyzer, C only, opt-in).
+# Design: docs/plans/2026-10-26-gate-13-compiler-strictness-design.md
+#
+# NOTE: this block is a TAIL APPEND after Gate 12 and intentionally touches no
+# line of the gates above it.
+# ============================================================================
+GATE_13_STATUS="SKIP"
+if [ "${XP_GATE_DISABLE_13:-}" = "1" ]; then
+  echo "⏭️  SKIPPED - Gate 13: Compiler Strictness (XP_GATE_DISABLE_13=1)"
+  GATE_13_STATUS="SKIP"
+elif [ -f "$GATE_DIR/gate-13-compiler-strictness.sh" ] || [ -f "$(git rev-parse --show-toplevel 2>/dev/null)/githooks/gate-13-compiler-strictness.sh" ]; then
+  echo "⚙️  Gate 13: Compiler Strictness Check..."
+  GATE13_START=$(gate_start_ms)
+  (
+    # Each stage runs inside the subshell so its shell state cannot leak back
+    # into pre-commit. Verdicts are reduced to the WORST code seen:
+    # FAIL/BLOCK (1/2) always win; WARN (3) only beats PASS (0).
+    _g13_script="$GATE_DIR/gate-13-compiler-strictness.sh"
+    [ -f "$_g13_script" ] || _g13_script="$(git rev-parse --show-toplevel)/githooks/gate-13-compiler-strictness.sh"
+    # shellcheck source=/dev/null
+    . "$_g13_script"
+
+    _g13_worst=0
+    _g13_rc=0
+    _g13_note() {
+      case "$1" in
+        1|2) _g13_worst=$1 ;;
+        3) [ "$_g13_worst" -eq 0 ] && _g13_worst=3 ;;
+      esac
+      return 0
+    }
+
+    gate13_run_cpp_analysis;   _g13_rc=$?; _g13_note "$_g13_rc"
+    gate13_run_java_analysis;  _g13_rc=$?; _g13_note "$_g13_rc"
+    gate13_run_analyzer;       _g13_rc=$?; _g13_note "$_g13_rc"
+
+    exit "$_g13_worst"
+  )
+  GATE_13_RC=$?
+  GATE13_END=$(now_ms)
+  GATE_13_DURATION=$(( (GATE13_END - GATE13_START) / 1000 ))
+  case "$GATE_13_RC" in
+    0) GATE_13_STATUS="PASS" ;;
+    1) GATE_13_STATUS="FAIL" ;;
+    2) GATE_13_STATUS="BLOCK" ;;
+    *) GATE_13_STATUS="WARN" ;;
+  esac
+  echo "   Gate 13 ($GATE_13_STATUS) completed in ${GATE_13_DURATION}s"
+  record_gate_audit "gate-13" "compiler-strictness" "$GATE_13_STATUS" "0" "$GATE13_START"
+  # Every other gate blocks by exiting immediately (e.g. Gate 1's
+  # "❌ BLOCKED ... exit 1"); there is no aggregate-then-exit shared with
+  # gates 0-12, so Gate 13 must do the same or its FAIL would only be cosmetic
+  # in the report while the commit sails through.
+  if [ "$GATE_13_STATUS" = "FAIL" ] || [ "$GATE_13_STATUS" = "BLOCK" ]; then
+    echo ""
+    echo "❌ BLOCKED - Gate 13: Compiler Strictness (${GATE_13_STATUS})"
+    echo "   Fix the compiler findings above. To record pre-existing warnings:"
+    echo "     xp-gate compiler-baseline create"
+    echo "   To relax strictness: XP_GATE_COMPILER_STRICTNESS=warn-only"
+    echo "   Emergency only:      XP_GATE_DISABLE_13=1"
+    exit 1
+  fi
+else
+  echo "⏭️  SKIPPED - Gate 13: Compiler Strictness (gate-13-compiler-strictness.sh not found)"
+  GATE_13_STATUS="SKIP"
+fi
+echo ""
+# ============================================================================
+
 generate_quality_report() {
   local HISTORY_FILE=".quality-history.jsonl"
   local COMMIT_HASH
@@ -4316,6 +4556,22 @@ generate_quality_report() {
 }
 ENDJSON
 
+  # ── Gate 13 injection (tail append; no existing line above is modified) ────
+  # The heredoc is closed deliberately before Gate 13 so this sprint ADDS lines
+  # instead of editing gates 0-12's report block, keeping the two branches'
+  # hunks disjoint. Scores are recomputed over 13 gates afterwards.
+  if [ -n "${GATE_13_STATUS:-}" ] && [ -f "$REPORT_FILE" ]; then
+    _XP_G13="$REPORT_FILE" _XP_G13S="$GATE_13_STATUS" node -e "
+      const fs=require('fs'),p=process.env._XP_G13;
+      try{
+        const j=JSON.parse(fs.readFileSync(p,'utf8'));
+        j.gates=j.gates||{};
+        j.gates.gate13_compiler_strictness={name:'Compiler Strictness',status:process.env._XP_G13S,tool:'gate-13-compiler-strictness.sh'};
+        fs.writeFileSync(p,JSON.stringify(j,null,2)+'\n');
+      }catch(e){}
+    " 2>/dev/null || true
+  fi
+
   # ── Persistent per-run report (Issue #101) ────────────────────────────────────────
   local REPORTS_DIR=".xp-gate/reports/pre-commit"
   local REPORT_TS