@boyingliu01/xp-gate 0.32.0 → 0.32.1

package/gate-3.sh

@@ -329,12 +329,26 @@ else
     #              is reverted at the next publish, so grading it cannot be acted
     #              on (doctorDelphi CCN=106 blocked every src/npm-package commit,
     #              on HEAD too — no baseline entry could ever exist for it).
-    #   test       __tests__/, *.test.*, *_test.{py,go}, *Test(s).java — recorded
-    #              in the report's test bucket, never in the baseline.
+    #   test       test dirs (tests/, test/, __tests__/), *.test.*, test_*.py,
+    #              *_test.{py,go}, *Test(s).java — recorded in the report's test
+    #              bucket, never in the baseline.
     # Both prefixes and the test pattern mirror ccn-report.cjs so the gate and
     # the writer cannot drift apart again (pinned by __tests__/gate-3-*.bats).
+    #
+    # #634: pytest's default is `python_files = test_*.py` under a `tests/`
+    # root. The previous pattern only knew the SUFFIX form `_test.{py,go}` and
+    # `*.test.*`, so a pytest-laid-out project had every test module graded as
+    # production source: test-helper complexity was reported as source debt and
+    # the ratchet could block on files the baseline deliberately never records
+    # (bucket === 'test').
+    #   `(^|/)(tests?)/`   — a tests/ or test/ directory anywhere in the tree
+    #   `(^|/)test_[^/]*\.py$` — pytest default filenames at any depth
+    # Both are anchored with (^|/) so `latest/`, `contest/`, `attest/` and
+    # `my_test_dir/` are NOT caught (a leading `_?test_.*\.py$` would have
+    # swallowed `src/my_test_dir/bar.py`).
+    # Must stay equivalent to TEST_PATH in scripts/ccn-report.cjs.
     CC_FILES=$(echo "$CC_FILES" | grep -vE \
-      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests__?/|\.test\.[cm]?[jt]sx?$|_test\.(py|go)$|Test(s)?\.java$' || true)
+      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests?__/|(^|/)(tests?)/|\.test\.[cm]?[jt]sx?$|(^|/)test_[^/]*\.py$|_test\.(py|go)$|Test(s)?\.java$' || true)
 
     if [ -n "$CC_FILES" ]; then
       echo "Checking complexity for source files..."

package/hooks/gate-3.sh

@@ -329,12 +329,26 @@ else
     #              is reverted at the next publish, so grading it cannot be acted
     #              on (doctorDelphi CCN=106 blocked every src/npm-package commit,
     #              on HEAD too — no baseline entry could ever exist for it).
-    #   test       __tests__/, *.test.*, *_test.{py,go}, *Test(s).java — recorded
-    #              in the report's test bucket, never in the baseline.
+    #   test       test dirs (tests/, test/, __tests__/), *.test.*, test_*.py,
+    #              *_test.{py,go}, *Test(s).java — recorded in the report's test
+    #              bucket, never in the baseline.
     # Both prefixes and the test pattern mirror ccn-report.cjs so the gate and
     # the writer cannot drift apart again (pinned by __tests__/gate-3-*.bats).
+    #
+    # #634: pytest's default is `python_files = test_*.py` under a `tests/`
+    # root. The previous pattern only knew the SUFFIX form `_test.{py,go}` and
+    # `*.test.*`, so a pytest-laid-out project had every test module graded as
+    # production source: test-helper complexity was reported as source debt and
+    # the ratchet could block on files the baseline deliberately never records
+    # (bucket === 'test').
+    #   `(^|/)(tests?)/`   — a tests/ or test/ directory anywhere in the tree
+    #   `(^|/)test_[^/]*\.py$` — pytest default filenames at any depth
+    # Both are anchored with (^|/) so `latest/`, `contest/`, `attest/` and
+    # `my_test_dir/` are NOT caught (a leading `_?test_.*\.py$` would have
+    # swallowed `src/my_test_dir/bar.py`).
+    # Must stay equivalent to TEST_PATH in scripts/ccn-report.cjs.
     CC_FILES=$(echo "$CC_FILES" | grep -vE \
-      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests__?/|\.test\.[cm]?[jt]sx?$|_test\.(py|go)$|Test(s)?\.java$' || true)
+      '^"?src/npm-package/|^"?plugins/[^/]+/src/|(^|/)__tests?__/|(^|/)(tests?)/|\.test\.[cm]?[jt]sx?$|(^|/)test_[^/]*\.py$|_test\.(py|go)$|Test(s)?\.java$' || true)
 
     if [ -n "$CC_FILES" ]; then
       echo "Checking complexity for source files..."

package/hooks/lib/jscpd-run.sh

@@ -26,6 +26,55 @@
 # than before the fix.
 JSCPD_DEFAULT_IGNORE_PATTERNS='(^|/)(node_modules|dist|build|target|coverage|out|\.next|\.nuxt|vendor)/|\.log$|\.txt$|\.(ya?ml)$|golden|baseline\.json$|evidence'
 
+# The BUILD-OUTPUT half of the set above, alone (#649).
+#
+# The combined set answers "is this worth comparing for duplication", which is a
+# question only Gate 2 asks. Filtering file list inputs with the whole set also
+# drops *.yaml, *.yml, *.txt and *.log -- and those are perfectly real project
+# files everywhere else. Doing that broke a live test on the first attempt:
+# `YAML staged files activate lint and IaC but skip SAST` expects a staged
+# infra/deployment.yaml to count as a code change, and whole-set filtering made
+# the hook announce "No code files changed, skipping lint" for a commit that
+# added a deployment manifest.
+#
+# So the two notions are separated here rather than shared:
+#
+#   BUILD OUTPUT (this)  - a directory tree that is generated or vendored:
+#                          not our code for ANY gate. Used to filter file lists.
+#   NON-REFACTORABLE (the combined set) - files whose duplication is data shape:
+#                          still project files, just not duplication candidates.
+#                          Gate 2 only.
+#
+# Same directory names, one definition; a directory added to the build-output
+# list reaches every gate at once, which is the point of #649.
+# Directory names that are generated or vendored in any mainstream toolchain.
+#
+# The second group (caches, virtualenvs, Python bytecode) is here because the
+# first version of this list did not have it and the same class of bug was one
+# `git add -A` away: __pycache__ is written by CPython itself and .pytest_cache
+# by pytest, so a Python project that commits its workspace stages .pyc-adjacent
+# artefacts and every scanner would read them as source. None of these can hold
+# hand-written project code.
+#
+# NOT included on purpose: bin/ and obj/ (real source trees in plenty of
+# projects -- e.g. cmd/bin layout, C# projects where obj/ IS output but bin/ is
+# often committed scripts) and .venv/venv (genuinely ambiguous: some projects
+# keep a small committed venv for reproducibility). Adding a name here removes
+# it from EVERY gate at once, so the list stays the names that are unambiguous.
+JSCPD_BUILD_OUTPUT_PATTERNS='(^|/)(node_modules|dist|build|target|coverage|out|\.next|\.nuxt|vendor|__pycache__|\.pytest_cache|\.mypy_cache|\.ruff_cache|\.tox|\.turbo|\.cache)/'
+
+# Is this path inside a dependency tree or a build-output directory?
+#
+# XP_GATE_JSCPD_DEFAULT_IGNORE=0 still disables it, so the escape hatch keeps
+# covering "some project really does want its vendor/ tree linted".
+jscpd_is_build_output() {
+  local _path="$1"
+  if [ "${XP_GATE_JSCPD_DEFAULT_IGNORE:-1}" = "0" ]; then
+    return 1
+  fi
+  printf '%s\n' "$_path" | grep -qE "$JSCPD_BUILD_OUTPUT_PATTERNS"
+}
+
 # Human-readable form, printed by the gate so the baseline is auditable (#591
 # point 3). Silence about the default is the same defect as silence about a
 # skipped gate: the user cannot answer "what did it scan".
@@ -55,6 +104,49 @@ jscpd_is_default_ignored() {
   printf '%s\n' "$_path" | grep -qE "$JSCPD_DEFAULT_IGNORE_PATTERNS"
 }
 
+# Drop dependency and build-output paths from a newline-separated file list on
+# stdin, echoing what remains (#649).
+#
+# Every scanner that builds its own list from `git diff --cached` used to
+# re-derive the exclusions by hand, and they drifted. The test-pairing check
+# excluded node_modules/.next/.nuxt/dist/build/.turbo/.cache but not vendor,
+# target, coverage or out -- so a staged `vendor/x.ts` was reported as a new
+# source file with no test. Six more sites had no exclusions at all. The one
+# place that got a shared ignore set (Gate 2) is the one that stopped having
+# this bug.
+#
+# This is the shared answer: callers pipe their staged list through it and stop
+# maintaining their own list. It reads stdin and writes stdout so it composes
+# with whatever selection the caller already did:
+#
+#     NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A \
+#       | filter_project_paths | grep -E '\.(ts|tsx)$' || true)
+#
+# Deliberately a filter, not a generator: a caller that needs a different git
+# query (only-added, only-modified) keeps it, and only the exclusion rule is
+# shared. Fail-open on empty input so `|| true` pipelines stay quiet.
+#
+# ON THE COUPLING (Delphi round 1, MC-01/FC-01): yes, this makes Gate 2's
+# ignore set load-bearing for every gate. Widening it now widens what every
+# scanner skips. That risk is accepted deliberately, and the alternative is
+# worse: the bug this fixes WAS a set of per-scanner definitions that drifted
+# apart, so N independent sets would reproduce it N times. The guard against
+# silent widening is that every change to the set lands in one reviewable
+# place, and #649's tests pin the boundary cases (vendor/target/coverage/out
+# ignored; src/lib/docs kept). If a gate ever needs a genuinely different
+# notion of "our code", introduce a second named set HERE rather than letting a
+# caller edit this one.
+filter_project_paths() {
+  local _fp
+  while IFS= read -r _fp || [ -n "$_fp" ]; do
+    [ -n "$_fp" ] || continue
+    if ! jscpd_is_build_output "$_fp"; then
+      printf '%s\n' "$_fp"
+    fi
+  done
+  return 0
+}
+
 # Echo the jscpd config the gate should pass, or nothing when the project has
 # none.
 #

package/hooks/pre-commit

@@ -710,48 +710,37 @@ if [ "$is_protected" = "true" ]; then
       esac
     done
 
-    # Doc-only changes: no source code files
+    # Doc-only / build-tooling-only changes need no VERSION bump.
+    #
+    # #624 defect 2: the split used to test ONLY `has_source`, which is true for
+    # any .py/.ts/... path INCLUDING `scripts/*`. So a commit that touched
+    # nothing but build tooling still fell into the version-check branch and was
+    # blocked. `has_real_source` is exactly "production source that needs a bump"
+    # — it was computed a few lines up but never consulted here. It must decide.
     if [ "$has_source" = "false" ]; then
       echo "✅ PASSED - Gate 0: Version Consistency Check (doc-only changes)"
+    elif [ "$has_real_source" = "false" ]; then
+      echo "✅ PASSED - Gate 0: Version Consistency Check (build-tooling-only changes)"
     else
-      # Check for bypass: commit message prefix (read from COMMIT_EDITMSG during pre-commit hook)
-      COMMIT_MSG=$(cat "$(git rev-parse --git-dir)/COMMIT_EDITMSG" 2>/dev/null | head -1 || echo "")
-      if echo "$COMMIT_MSG" | grep -qE '^\[skip-version-check\]'; then
-        if echo "$COMMIT_MSG" | grep -qE '^\[skip-version-check\].*(chore:|docs:|release:)'; then
-          if [ "$has_real_source" = "false" ]; then
-            echo "✅ PASSED - Gate 0: Version Consistency Check (bypass: chore/docs/release)"
-          else
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  VERSION CONSISTENCY CHECK (Gate 0)
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-Branch: $CURRENT_BRANCH
-ERROR: [skip-version-check] bypass used but production source files detected.
-
-Bypass only allows build-tooling changes (adapters/, scripts/, hooks/).
-Production source files require VERSION/CHANGELOG update.
-
-Files: $(echo "$STAGED_FILES" | tr '\n' ', ' | sed 's/,$//')
-"
-            exit 1
-          fi
-        else
-          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  VERSION CONSISTENCY CHECK (Gate 0)
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-Branch: $CURRENT_BRANCH
-ERROR: [skip-version-check] bypass prefix invalid.
-
-Allowed prefixes: chore:, docs:, release:
-Example: [skip-version-check] chore: update dependencies
-"
-          exit 1
-        fi
-      else
-        echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+      # Production source on a protected branch without VERSION/CHANGELOG.
+      #
+      # #624 defect 1: this branch used to offer a `[skip-version-check]` message
+      # prefix as a bypass, read from `.git/COMMIT_EDITMSG`. That cannot work:
+      # git runs pre-commit BEFORE it builds the message, so the file does not
+      # exist yet (`-m`, `-F` and the interactive editor path all measured on
+      # git 2.54), and the hook gets no arguments. What the old code read was the
+      # PREVIOUS commit's message, so the prefix never matched — the documented
+      # recipe silently could not clear the gate, and --no-verify was the only
+      # way through. Rather than keep a bypass whose input this hook structurally
+      # cannot see, the escape hatch is the one that actually works and is
+      # already documented in CHANGELOG: the SKIP_VERSION_CHECK=1 environment
+      # variable (handled earlier in this Gate 0 block).
+      echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
   VERSION CONSISTENCY CHECK (Gate 0)
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Branch: $CURRENT_BRANCH
-ERROR: Committing to a protected branch without VERSION/CHANGELOG update.
+ERROR: Committing production source to a protected branch without a
+VERSION/CHANGELOG update.
 
 This bypasses the ship workflow and causes version drift.
 Before committing:
@@ -759,18 +748,19 @@ Before committing:
   2. Add entry to CHANGELOG.md
   3. Run: node scripts/sync-version.cjs
 
-Or use the bypass prefix — the commit message FIRST LINE must START with:
-  [skip-version-check] chore: <description>
-Allowed types: chore: docs: release:. The bypass only permits build
-tooling changes (adapters/, scripts/, hooks/); production source files
-still require a VERSION/CHANGELOG update.
+Build-tooling-only changes (adapters/, scripts/, hooks/) need NO version bump
+and pass this gate automatically — no marker required.
+
+If you genuinely must land production source without a version bump, the
+supported escape hatch is the env var (a message prefix cannot work here
+because pre-commit runs before git builds the message):
+  SKIP_VERSION_CHECK=1 git commit ...
 
 Staged files: $(echo "$STAGED_FILES" | tr '\n' ', ' | sed 's/,$//')
 "
-        GATE_0_STATUS="BLOCK"
-        record_gate_audit "gate-0" "version-consistency" "$GATE_0_STATUS" "1" "$GATE_0_START"
-        exit 1
-      fi
+      GATE_0_STATUS="BLOCK"
+      record_gate_audit "gate-0" "version-consistency" "$GATE_0_STATUS" "1" "$GATE_0_START"
+      exit 1
     fi
   fi
   fi  # closes SKIP_VERSION_CHECK if/else
@@ -809,7 +799,44 @@ echo ""
 MIRROR_PATH_FILTER='^src/npm-package/'
 DASHBOARD_PATH_FILTER='^dashboard/'
 RAW_CHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
-CHANGED_FILES=$(printf '%s\n' "$RAW_CHANGED_FILES" | grep -v "$MIRROR_PATH_FILTER" | grep -v "$DASHBOARD_PATH_FILTER" || true)
+
+# Dependencies and build output are not project code (#649).
+#
+# `git diff --cached` knows nothing about .gitignore: anything that reaches the
+# index is listed. A project that vendors its dependencies, a CI fixture that
+# commits after `npm install`, an accidental `git add -A`, or a monorepo's
+# nested `packages/*/node_modules` therefore hands every downstream scanner a
+# list containing third-party source, and each scanner judges it as the
+# project's own.
+#
+# This has already cost two outages, one language branch at a time: #595 (Gate 1
+# PowerShell arm blocked every commit once Playwright's node_modules was
+# scanned for Write-Host) and #648 (Gate 1 JS/TS arm blocked on the bare
+# `debugger;` in node_modules/typescript/dist/internal/utils.js). Both were
+# fixed at the single site that happened to fail, so the next branch re-broke
+# the same way. The filter belongs HERE, at the one place the list is built, so
+# a scanner added tomorrow is safe by default instead of by memory.
+#
+# The exclusion itself is the shared build-output list from jscpd-run.sh
+# (jscpd_is_build_output), so the directory names have one definition across the
+# gates. Deliberately NOT the full Gate 2 ignore set: that one also drops
+# *.yaml/*.yml/*.txt/*.log because repetition there is data shape rather than a
+# refactoring target, and using it here would make a commit that only adds
+# infra/deployment.yaml look like "No code files changed" -- skipping the IaC
+# and lint gates that exist to scan exactly that file. The XP_GATE_JSCPD_DEFAULT_IGNORE=0
+# escape hatch still applies.
+#
+# RAW_CHANGED_FILES stays unfiltered on purpose: it is the only truthful answer
+# to "did the user stage anything at all", and a future "you accidentally
+# committed dependencies" warning needs to see what this filter removed.
+CHANGED_FILES=$(printf '%s\n' "$RAW_CHANGED_FILES" \
+  | grep -v "$MIRROR_PATH_FILTER" | grep -v "$DASHBOARD_PATH_FILTER" \
+  | {
+      while IFS= read -r _cf; do
+        [ -n "$_cf" ] || continue
+        jscpd_is_build_output "$_cf" || printf '%s\n' "$_cf"
+      done
+    } || true)
 
 # REQ-F2: one commit-level docs-only verdict, computed once and reused by the
 # heavy gates (2/5/9/12). Light gates never consult it — a secret in a README
@@ -844,7 +871,22 @@ any_changed_files_match() {
   local pattern
 
   for pattern in "$@"; do
-    if printf '%s\n' "$CHANGED_FILES" | grep -qE -- "$pattern"; then
+    # Here-string, not `printf | grep -q`. Under the `set -o pipefail` above,
+    # `grep -q` exits the moment it matches, the writer takes SIGPIPE, and the
+    # pipeline reports 141 -- so the `if` reads "no match" even though grep DID
+    # match. Whether that happens depends on whether the list fits in the pipe
+    # buffer, which is why it showed up as a size-dependent, flaky SKIP.
+    #
+    # It was not theoretical: in the Cross-Platform CI first-commit fixture the
+    # staged list is long enough to trip it, and Gate 1 announced "No code files
+    # changed, skipping lint" for a commit that had staged 19 shell scripts --
+    # while Gate 2, reading the same variable, happily scanned them and reported
+    # duplicates. The hook log carried the fingerprint the whole time:
+    # `line 847: printf: Broken pipe`.
+    #
+    # A here-string has no writer process to be killed, so the match cannot be
+    # lost. Same reason `run_tsx` and the coverage probes avoid `| head`.
+    if grep -qE -- "$pattern" <<< "$CHANGED_FILES"; then
       return 0
     fi
   done
@@ -1524,7 +1566,7 @@ else
     TS_DEBUG_FILES=$(echo "$CHANGED_FILES" | grep -E '\.(ts|tsx|js|jsx)$' | {
       while IFS= read -r _df; do
         [ -n "$_df" ] || continue
-        if ! jscpd_is_default_ignored "$_df"; then
+        if ! jscpd_is_build_output "$_df"; then
           printf '%s\n' "$_df"
         fi
       done
@@ -2212,7 +2254,10 @@ else
   fi
 
   # --- BLOCK path: New .ts/.tsx files without corresponding tests ---
-  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v 'node_modules/' | grep -v '\.next/' | grep -v '\.nuxt/' | grep -v 'dist/' | grep -v 'build/' | grep -v '.turbo/' | grep -v '.cache/' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
+  # Exclusions come from filter_project_paths (#649). The hand-maintained list
+  # this replaced omitted vendor/target/coverage/out, so a staged vendor/x.ts
+  # was reported as new source with no test.
+  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
 
   # Strip PROJECT_SUBDIR prefix from new-TS-file paths ONLY when the hook
   # actually cd'd into the subdirectory (IN_PROJECT_SUBDIR=1; single-language
@@ -2297,10 +2342,12 @@ else
   fi
 
   # --- WARNING path: Modified files (any lang) + New non-TS files ---
+  # filter_project_paths strips dependencies and build output (#649); without
+  # it a staged vendor/ or target/ module is reported as source needing a test.
   WARNING_SOURCE_FILES=$(
     {
-      git diff --cached --name-only --diff-filter=M | grep -E '\.(ts|tsx|py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
-      git diff --cached --name-only --diff-filter=A | grep -E '\.(py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
+      git diff --cached --name-only --diff-filter=M | filter_project_paths | grep -E '\.(ts|tsx|py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
+      git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(py|go|java|kt|kts|cpp|cc|cxx|c|swift|dart|rb|rs)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__'
     } | sort -u || true
   )
 
@@ -2423,7 +2470,7 @@ else
   # Gate 5b: Mock Density ADVISORY Scan (pure bash — no npx tsx overhead)
   # 30% = ADVISORY, 50% = suggests @mock-justified. Does NOT block commit.
   # ========================================================================
-  CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(test|spec)\.(ts|tsx|js|jsx|cjs|mjs|py|go)$' || true)
+  CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM | filter_project_paths | grep -E '\.(test|spec)\.(ts|tsx|js|jsx|cjs|mjs|py|go)$' || true)
 
   # Nested plugin sub-projects (plugins/<name>/) own their own vitest config and
   # are excluded from the root suite (`vitest.config.ts` excludes `plugins/**`,
@@ -2571,7 +2618,7 @@ else
           CHANGED_TEST_FILE_COUNT=$(echo "$SELECTED_TEST_FILES" | grep -c '.' || true)
           
           # Also get changed source files (non-test) for related-test lookup
-          CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(ts|tsx|js|jsx)$' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__tests__' | grep -v '\.d\.ts$' | grep -v '__snapshots__' || true)
+          CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM | filter_project_paths | grep -E '\.(ts|tsx|js|jsx)$' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__tests__' | grep -v '\.d\.ts$' | grep -v '__snapshots__' || true)
           # Nested plugin sub-projects are excluded from the root suite; their
           # sources must not drive root-vitest related-test lookup either (it
           # would resolve to plugin-local paths vitest cannot collect).
@@ -2807,9 +2854,14 @@ else
             #   full -> unchanged behavior: whole suite + real threshold.
             #   skip -> nothing test-relevant changed; no pytest at all.
             PY_CHANGED_TEST_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null \
+              | filter_project_paths \
               | grep -E '(^|/)test_[^/]*\.py$|_test\.py$' || true)
             PY_CHANGED_SRC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null \
+              | filter_project_paths \
               | grep -E '\.py$' | grep -vE '(^|/)test_[^/]*\.py$|_test\.py$' || true)
+            # NOT filtered on purpose: this list answers "did a requirements
+            # file change", which is a property of the whole commit including
+            # paths under a vendor/ tree that filter_project_paths removes.
             PY_CHANGED_ALL=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)
             # `grep -c '.'` prints its own zero AND exits 1 on an empty list
             # (#493), so the count is derived with `|| true` + wc -l instead.
@@ -3363,7 +3415,7 @@ else
   # New files must have ≥80% coverage individually.
   # ============================================================================
   if has_project_lang "typescript" && [ -f "coverage/coverage-summary.json" ]; then
-    NEW_SOURCE_FILES=$(git diff --cached --name-only --diff-filter=A | grep -E '\.(ts|tsx)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v '\.d\.ts$' || true)
+    NEW_SOURCE_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(ts|tsx)$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -v '\.d\.ts$' || true)
     if [ -n "$NEW_SOURCE_FILES" ]; then
       echo ""
       echo "   └─ Per-file coverage check for new files:"
@@ -3764,8 +3816,11 @@ else
     # governed by Mirror Parity in CI, which compares content rather than
     # re-linting it. (See the same exclusion in adapters/powershell.sh.)
     MIRROR_EXCLUDE="$MIRROR_PATH_FILTER"
-    NEW_FILES=$(git diff --cached --name-only --diff-filter=A | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
-    MODIFIED_FILES=$(git diff --cached --name-only --diff-filter=M | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
+    # filter_project_paths also removes dependencies and build output (#649):
+    # a staged node_modules/ or dist/ file is not budgetable project code, and
+    # entering it in the Boy Scout baseline would budget a path nobody edits.
+    NEW_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
+    MODIFIED_FILES=$(git diff --cached --name-only --diff-filter=M | filter_project_paths | grep -v "$MIRROR_EXCLUDE" | grep -v "$DASHBOARD_PATH_FILTER" | tr '\n' ' ')
     
     if [ -z "$NEW_FILES" ] && [ -z "$MODIFIED_FILES" ]; then
       echo "     ✅ No new or modified files to check."

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-28T17:43:58.740Z",
+  "checked_at": "2026-10-29T23:47:25.119Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.32.0",
+  "version": "0.32.1",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.32.0",
+  "version": "0.32.1",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.32.0",
+  "version": "0.32.1",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.32.0",
+  "version": "0.32.1",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-28
-**Commit:** 0f58c300
+**Generated:** 2026-10-29
+**Commit:** 101a0ff3
 **Branch:** main
-**Version:** 0.32.0.0
+**Version:** 0.32.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.