@boyingliu01/xp-gate 0.32.1 → 0.32.3

package/lib/__tests__/gate-audit.test.ts

@@ -13,6 +13,12 @@ import {
   rotateIfNeeded,
   parseCliOptions,
   getCommitHash,
+  resolveCommitHash,
+  stageAuditEntry,
+  flushPendingAudit,
+  sanitizeDurationMs,
+  computeAnomalies,
+  AUDIT_ANOMALY_SINCE,
   type GateAuditEntry,
 } from '../gate-audit';
 
@@ -293,4 +299,142 @@ describe('gate-audit', () => {
       expect(existsSync(`${logPath}.4`)).toBe(false);
     });
   });
+  describe('pre-commit staging + post-commit flush (commit attribution)', () => {
+    const NL = String.fromCharCode(10);
+    const repo = () => {
+      const r = join(TEST_DIR, 'attr');
+      mkdirSync(r, { recursive: true });
+      return r;
+    };
+
+    it('@covers AUDIT-001-07 resolveCommitHash prefers an explicit --commit-hash', () => {
+      expect(resolveCommitHash({ 'commit-hash': 'deadbeef' }, () => 'PARENT')).toBe('deadbeef');
+    });
+
+    it('@covers AUDIT-001-07 resolveCommitHash falls back to HEAD when no explicit hash', () => {
+      expect(resolveCommitHash({}, () => 'HEADHASH')).toBe('HEADHASH');
+    });
+
+    it('@covers AUDIT-001-08 flushPendingAudit stamps staged entries with the real commit', () => {
+      const r = repo();
+      stageAuditEntry(makeEntry({ repo_path: r, gate_id: 'gate-1', commit_hash: '' }), r);
+      stageAuditEntry(makeEntry({ repo_path: r, gate_id: 'gate-2', commit_hash: '' }), r);
+      const logPath = join(r, '.xp-gate', 'audit.jsonl');
+      expect(existsSync(logPath)).toBe(false);
+
+      const n = flushPendingAudit(r, 'REAL_COMMIT_SHA');
+      expect(n).toBe(2);
+
+      const entries = readFileSync(logPath, 'utf8').trim().split(NL).map((l) => JSON.parse(l));
+      expect(entries.map((e) => e.gate_id)).toEqual(['gate-1', 'gate-2']);
+      expect(entries.every((e) => e.commit_hash === 'REAL_COMMIT_SHA')).toBe(true);
+      expect(existsSync(join(r, '.xp-gate', 'audit.pending.jsonl'))).toBe(false);
+    });
+
+    it('@covers AUDIT-001-08 flush is idempotent and a no-op with nothing staged', () => {
+      const r = repo();
+      expect(flushPendingAudit(r, 'X')).toBe(0);
+      expect(existsSync(join(r, '.xp-gate', 'audit.jsonl'))).toBe(false);
+    });
+
+    it('@covers AUDIT-001-08 a blank commit hash never invents one', () => {
+      const r = repo();
+      stageAuditEntry(makeEntry({ repo_path: r, gate_id: 'gate-9', commit_hash: '' }), r);
+      expect(flushPendingAudit(r, '')).toBe(1);
+      const e = JSON.parse(readFileSync(join(r, '.xp-gate', 'audit.jsonl'), 'utf8').trim());
+      expect(e.commit_hash).toBe('');
+    });
+
+    it('@covers AUDIT-001-08 a torn pending line is dropped, not fatal', () => {
+      const r = repo();
+      mkdirSync(join(r, '.xp-gate'), { recursive: true });
+      const pp = join(r, '.xp-gate', 'audit.pending.jsonl');
+      const good = JSON.stringify(makeEntry({ repo_path: r, gate_id: 'gate-3', commit_hash: '' }));
+      writeFileSync(pp, good + NL + '{ broken' + NL, 'utf8');
+      expect(flushPendingAudit(r, 'SHA')).toBe(1);
+      const entries = readFileSync(join(r, '.xp-gate', 'audit.jsonl'), 'utf8').trim().split(NL);
+      expect(entries.length).toBe(1);
+    });
+  });
+
+  describe('sanitizeDurationMs (writer-side epoch guard, REQ-B backstop)', () => {
+    it('@covers AUDIT-001-09 keeps a plausible duration untouched', () => {
+      expect(sanitizeDurationMs(1234)).toEqual({ duration_ms: 1234 });
+      expect(sanitizeDurationMs(0)).toEqual({ duration_ms: 0 });
+    });
+
+    it('@covers AUDIT-001-09 null stays null with no reason', () => {
+      expect(sanitizeDurationMs(null)).toEqual({ duration_ms: null });
+    });
+
+    it('@covers AUDIT-001-09 an epoch-sized duration is rejected, not stored as a number', () => {
+      // end - 0 == Date.now() ~= 1.7e12 — the classic poisoned-start bug.
+      const r = sanitizeDurationMs(1750000000000);
+      expect(r.duration_ms).toBeNull();
+      expect(r.duration_reason).toBe('poisoned_start_ms');
+    });
+
+    it('@covers AUDIT-001-09 negative or NaN durations are rejected', () => {
+      expect(sanitizeDurationMs(-5).duration_reason).toBe('poisoned_start_ms');
+      expect(sanitizeDurationMs(Number.NaN).duration_reason).toBe('poisoned_start_ms');
+    });
+  });
+
+  describe('computeAnomalies (CI ledger gate, P0-2)', () => {
+    const NL = String.fromCharCode(10);
+    const repo = () => {
+      const r = join(TEST_DIR, 'anom');
+      mkdirSync(r, { recursive: true });
+      return r;
+    };
+    const write = (r: string, rows: Partial<GateAuditEntry>[]) => {
+      mkdirSync(join(r, '.xp-gate'), { recursive: true });
+      const lines = rows.map((x) => JSON.stringify(makeEntry({ repo_path: r, ...x }))).join(NL);
+      writeFileSync(join(r, '.xp-gate', 'audit.jsonl'), lines + NL, 'utf8');
+    };
+
+    it('@covers AUDIT-001-10 a clean ledger has zero anomalies', () => {
+      const r = repo();
+      write(r, [{ gate_id: 'gate-1', commit_hash: 'abc', duration_ms: 100 }]);
+      const a = computeAnomalies(r);
+      expect(a.total).toBe(0);
+      expect(a.scanned).toBe(1);
+    });
+
+    it('@covers AUDIT-001-10 epoch duration + blank commit are both counted', () => {
+      const r = repo();
+      write(r, [
+        { gate_id: 'gate-1', commit_hash: 'abc', duration_ms: 1750000000000 },
+        { gate_id: 'gate-2', commit_hash: '', duration_ms: 100 },
+        { gate_id: 'gate-3', commit_hash: 'unknown', duration_ms: 100 },
+        { gate_id: 'gate-4', commit_hash: 'def', duration_ms: 50 },
+      ]);
+      const a = computeAnomalies(r);
+      expect(a.implausible_duration).toBe(1);
+      expect(a.missing_commit).toBe(2);
+      expect(a.total).toBe(3);
+    });
+
+    it('@covers AUDIT-001-10 null+reason is honest, not an anomaly', () => {
+      const r = repo();
+      write(r, [{ gate_id: 'gate-1', commit_hash: 'abc', duration_ms: null, duration_reason: 'poisoned_start_ms' }]);
+      const a = computeAnomalies(r);
+      expect(a.null_with_reason).toBe(1);
+      expect(a.total).toBe(0);
+    });
+
+    it('@covers AUDIT-001-10 since-scope ignores grandfathered anomalies', () => {
+      const r = repo();
+      write(r, [
+        { gate_id: 'gate-1', commit_hash: '', duration_ms: 1750000000000, timestamp: '2020-01-01T00:00:00.000Z' },
+        { gate_id: 'gate-2', commit_hash: 'abc', duration_ms: 100, timestamp: '2030-01-01T00:00:00.000Z' },
+      ]);
+      const all = computeAnomalies(r);
+      expect(all.total).toBe(2); // old row: 1 implausible + 1 missing commit
+      const scoped = computeAnomalies(r, AUDIT_ANOMALY_SINCE);
+      expect(scoped.total).toBe(0);
+      expect(scoped.scanned).toBe(1);
+    });
+  });
+
 });

package/lib/__tests__/shared-utils.test.js

@@ -87,4 +87,26 @@ describe('shared-utils', () => {
       expect(fs.existsSync(path.join(destDir, 'lib', 'now-ms.sh'))).toBe(true);
     });
   });
+  describe('copyHooks ships post-commit (audit flush + bypass detection)', () => {
+    it('@covers gate-script deployment: copyHooks installs post-commit, not just pre-commit/pre-push/post-merge', () => {
+      // Regression: post-commit was absent from both the ship list and copyHooks,
+      // so the audit-attribution flush and --no-verify bypass detection that live
+      // in post-commit never executed for any installed user.
+      const pkgRoot = path.join(tmpRoot, 'node_modules', '@boyingliu01', 'xp-gate');
+      const hooksSrc = path.join(pkgRoot, 'hooks');
+      fs.mkdirSync(hooksSrc, { recursive: true });
+      for (const h of ['pre-commit', 'pre-push', 'post-commit', 'post-merge']) {
+        fs.writeFileSync(path.join(hooksSrc, h), `# ${h}`);
+      }
+      const destDir = path.join(tmpRoot, 'dest-hooks');
+      fs.mkdirSync(destDir, { recursive: true });
+
+      const { copyHooks } = require('../shared-utils');
+      copyHooks(pkgRoot, destDir);
+
+      expect(fs.existsSync(path.join(destDir, 'post-commit'))).toBe(true);
+      expect(fs.existsSync(path.join(destDir, 'pre-commit'))).toBe(true);
+    });
+  });
+
 });

package/lib/doctor.js

@@ -676,6 +676,59 @@ function readPair(repoFile, installedFile) {
  * @param {{repoRoot?: string, repoHooks?: string, installedAdapters?: string}} [ctx]
  * @returns {{checks: Array<{name: string, status: string, detail: string}>, issues: number}}
  */
+/**
+ * Audit ledger health (P0): surface gate-telemetry anomalies so `doctor` warns
+ * before they silently poison per-commit analysis. Mirrors gate-audit.ts's
+ * computeAnomalies (kept in sync deliberately — doctor is CommonJS and cannot
+ * import the .ts module). Grandfathers everything before AUDIT_LEDGER_SINCE;
+ * only NEW implausible durations or unattributed commits count as issues.
+ */
+const AUDIT_LEDGER_SINCE = '2026-10-30T00:00:00.000Z';
+const AUDIT_MAX_PLAUSIBLE_MS = 6 * 60 * 60 * 1000;
+
+function diagnoseAuditLedger(ctx = {}) {
+  const checks = [];
+  let issues = 0;
+  const repoRoot = ctx.repoRoot || process.cwd();
+  const logPath = path.join(repoRoot, '.xp-gate', 'audit.jsonl');
+  if (!fs.existsSync(logPath)) {
+    checks.push({ name: 'Audit ledger', status: 'SKIP', detail: 'no .xp-gate/audit.jsonl' });
+    return { checks, issues };
+  }
+  let entries;
+  try {
+    entries = fs.readFileSync(logPath, 'utf8').split(/\r?\n/).filter((l) => l.trim()).map((l) => JSON.parse(l));
+  } catch (err) {
+    checks.push({ name: 'Audit ledger', status: 'WARN', detail: `unreadable: ${err.message}` });
+    return { checks, issues };
+  }
+  let implausible = 0;
+  let missingCommit = 0;
+  let considered = 0;
+  for (const e of entries) {
+    if (typeof e.timestamp === 'string' && e.timestamp < AUDIT_LEDGER_SINCE) continue;
+    considered += 1;
+    if (typeof e.duration_ms === 'number'
+      && (!Number.isFinite(e.duration_ms) || e.duration_ms < 0 || e.duration_ms > AUDIT_MAX_PLAUSIBLE_MS)) {
+      implausible += 1;
+    }
+    if (!e.commit_hash || e.commit_hash === 'unknown') missingCommit += 1;
+  }
+  const total = implausible + missingCommit;
+  if (total > 0) {
+    checks.push({
+      name: 'Audit ledger',
+      status: 'WARN',
+      detail: `${total} anomal${total === 1 ? 'y' : 'ies'} since ${AUDIT_LEDGER_SINCE} (${implausible} implausible duration, ${missingCommit} unattributed) — run: xp-gate audit --check`,
+    });
+    // WARN, not FAIL: telemetry integrity is not a blocking gate, but it must
+    // be visible. Kept at 0 issues so it never inflates the FAIL count.
+  } else {
+    checks.push({ name: 'Audit ledger', status: 'PASS', detail: `${considered} entr${considered === 1 ? 'y' : 'ies'} clean since ${AUDIT_LEDGER_SINCE}` });
+  }
+  return { checks, issues };
+}
+
 function diagnoseModuleDrift(ctx = {}) {
   const checks = [];
   let issues = 0;
@@ -1547,7 +1600,11 @@ async function diagnoseAsync(refreshEnv = false) {
     // hook files and live in a different directory (#495).
     const moduleDrift = diagnoseModuleDrift();
     checks.push(...moduleDrift.checks);
-    return drift.issues + moduleDrift.issues;
+    // Audit-ledger health (P0): telemetry anomalies are not hook drift, but
+    // they ride the same repo-scoped group and must be surfaced by doctor.
+    const ledger = diagnoseAuditLedger();
+    checks.push(...ledger.checks);
+    return drift.issues + moduleDrift.issues + ledger.issues;
   });
 
   // Wait for ALL parallel groups
@@ -3225,6 +3282,7 @@ module.exports = {
   diagnoseHookDrift,
   syncGlobalHooksFromRepo,
   diagnoseModuleDrift,
+  diagnoseAuditLedger,
   syncModulesFromRepo,
   resolveExecutedModuleDirs,
   executedModulePath,

package/lib/gate-audit.ts

@@ -14,6 +14,7 @@ import {
   renameSync,
   statSync,
   chmodSync,
+  rmSync,
 } from 'fs';
 import { join } from 'path';
 
@@ -23,6 +24,7 @@ const AUDIT_DIR = '.xp-gate';
 const AUDIT_FILE = 'audit.jsonl';
 const MAX_FILE_BYTES = 10 * 1024 * 1024; // 10 MB
 const MAX_ARCHIVES = 3;
+const MAX_PLAUSIBLE_DURATION_MS = 6 * 60 * 60 * 1000; // 6h — no single gate runs longer
 
 // ── Types ────────────────────────────────────────────────────────────────────
 
@@ -85,6 +87,75 @@ export function appendAuditEntry(
   }
 }
 
+// ── Pre-commit staging ───────────────────────────────────────────────────────
+// Pre-commit cannot know the commit it is about to create (HEAD is still the
+// parent there), so per-gate entries are staged to a sidecar and stamped with
+// the real commit by post-commit. Fallback safety: `flushPendingAudit` also
+// runs at the START of the next pre-commit, so if post-commit never fired
+// (hooks skipped, exception) the entries still land, attributed by `git log -1`
+// at that later point — slightly late but never lost, never misattributed to
+// the wrong commit when post-commit does run.
+
+const PENDING_SUFFIX = 'audit.pending.jsonl';
+
+function pendingPath(repoRoot: string): string {
+  return join(repoRoot, AUDIT_DIR, PENDING_SUFFIX);
+}
+
+/** Stage one entry for the not-yet-created commit. Never throws. */
+export function stageAuditEntry(entry: GateAuditEntry, repoRoot: string = process.cwd()): void {
+  try {
+    const dir = join(repoRoot, AUDIT_DIR);
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    appendFileSync(pendingPath(repoRoot), JSON.stringify(entry) + '\n', 'utf8');
+  } catch (err) {
+    console.error('[xp-gate audit] Failed to stage entry:', (err as Error).message);
+  }
+}
+
+/**
+ * Move staged entries into audit.jsonl, stamped with the real commit hash.
+ * Idempotent and safe to call when nothing is staged. A blank/absent hash
+ * leaves `commit_hash` exactly as staged so a wrong commit is never invented.
+ */
+export function flushPendingAudit(
+  repoRoot: string = process.cwd(),
+  commitHash: string = '',
+): number {
+  const p = pendingPath(repoRoot);
+  if (!existsSync(p)) return 0;
+  let flushed = 0;
+  try {
+    const raw = readFileSync(p, 'utf8');
+    const lines = raw.split('\n').filter((l) => l.trim());
+    for (const line of lines) {
+      let entry: GateAuditEntry;
+      try {
+        entry = JSON.parse(line) as GateAuditEntry;
+      } catch {
+        // A torn line (interrupted mid-write) is dropped rather than crashing
+        // the hook that is trying to flush a previous run's leftovers.
+        continue;
+      }
+      if (commitHash) entry.commit_hash = commitHash;
+      appendAuditEntry(entry, repoRoot);
+      flushed++;
+    }
+    rmSyncSafe(p);
+  } catch (err) {
+    console.error('[xp-gate audit] Failed to flush pending entries:', (err as Error).message);
+  }
+  return flushed;
+}
+
+function rmSyncSafe(p: string): void {
+  try {
+    rmSync(p, { force: true });
+  } catch {
+    /* best effort */
+  }
+}
+
 /**
  * Read the last N entries from the audit log.
  */
@@ -152,7 +223,10 @@ function aggregateByGate(entries: GateAuditEntry[]): Map<string, { total: number
   const buckets = new Map<string, { total: number; passed: number; ms: number; issues: number; anomaly_count: number }>();
 
   for (const e of entries) {
-    const b = buckets.get(e.gate_id) ?? { total: 0, passed: 0, ms: 0, issues: 0, anomaly_count: 0 };
+    // Tolerate malformed/legacy rows: a missing gate_id would otherwise create
+    // an `undefined` bucket key (and crash the sort comparing it to a string).
+    const gateId = typeof e.gate_id === 'string' && e.gate_id ? e.gate_id : 'unknown';
+    const b = buckets.get(gateId) ?? { total: 0, passed: 0, ms: 0, issues: 0, anomaly_count: 0 };
     b.total += 1;
     if (e.passed) b.passed += 1;
     // Issue #370: exclude anomalous durations from ms aggregation. REQ-B: a
@@ -163,8 +237,10 @@ function aggregateByGate(entries: GateAuditEntry[]): Map<string, { total: number
     } else if (typeof e.duration_ms === 'number') {
       b.ms += e.duration_ms;
     }
-    b.issues += e.issues_found;
-    buckets.set(e.gate_id, b);
+    // A malformed/legacy row with a non-numeric issues_found must not turn
+    // the whole gate's average into NaN.
+    b.issues += Number.isFinite(e.issues_found) ? e.issues_found : 0;
+    buckets.set(gateId, b);
   }
 
   return buckets;
@@ -202,6 +278,70 @@ export function computeStats(
   return results;
 }
 
+export interface AuditAnomalies {
+  /** Entries with an explicit duration_anomaly flag (Issue #370). */
+  flagged: number;
+  /** Entries with a null duration + reason (REQ-B unmeasurable). */
+  null_with_reason: number;
+  /** Entries persisting a provably-impossible duration (>6h / negative). */
+  implausible_duration: number;
+  /** Entries with no commit attribution (the off-by-one bug's fingerprints). */
+  missing_commit: number;
+  /** Sum of the above — the number CI should treat as "must be 0". */
+  total: number;
+  /** Running counter of entries scanned. */
+  scanned: number;
+}
+
+/**
+ * Count audit-health problems so CI can fail when the ledger is untrustworthy.
+ *
+ * These are exactly the artefacts of the two telemetry bugs we fixed: epoch
+ * durations (implausible_duration) and misattributed/blank commits
+ * (missing_commit). A clean ledger returns total=0.
+ *
+ * `since` (ISO-8601) scopes the check to entries at/after that instant. Both
+ * bugs predate the fix and left ~900 historical rows in the ledger; a CI gate
+ * that counted them would be permanently red. Scoping by the fix date turns
+ * the gate into "no NEW anomalies", which is exactly what we can enforce.
+ */
+export function computeAnomalies(repoRoot: string = process.cwd(), since?: string): AuditAnomalies {
+  const logPath = join(repoRoot, AUDIT_DIR, AUDIT_FILE);
+  const entries = parseAuditEntries(logPath);
+  let flagged = 0;
+  let null_with_reason = 0;
+  let implausible = 0;
+  let missingCommit = 0;
+  let considered = 0;
+  for (const e of entries) {
+    if (since && typeof e.timestamp === 'string' && e.timestamp < since) continue;
+    considered += 1;
+    if (e.duration_anomaly === true) flagged += 1;
+    if (e.duration_ms === null && e.duration_reason) null_with_reason += 1;
+    if (typeof e.duration_ms === 'number'
+      && (!Number.isFinite(e.duration_ms) || e.duration_ms < 0 || e.duration_ms > MAX_PLAUSIBLE_DURATION_MS)) {
+      implausible += 1;
+    }
+    if (!e.commit_hash || e.commit_hash === 'unknown') missingCommit += 1;
+  }
+  return {
+    flagged,
+    null_with_reason,
+    implausible_duration: implausible,
+    missing_commit: missingCommit,
+    total: implausible + missingCommit,
+    scanned: considered,
+  };
+}
+
+/**
+ * Entries at/after this instant are expected to be clean. It is the date the
+ * two telemetry bugs were fixed; anything older is grandfathered because it
+ * cannot be re-measured. Keep in sync with the fix commit if you regenerate.
+ */
+export const AUDIT_ANOMALY_SINCE = '2026-10-30T00:00:00.000Z';
+
+
 /**
  * Rotate the audit log if it exceeds MAX_FILE_BYTES.
  * Renames current file to .1, shifts existing archives.
@@ -250,24 +390,48 @@ function runCli(): void {
 
   if (command === 'record') {
     const opts = parseCliOptions(args.slice(1));
+    // Writer-side backstop: never persist an implausible duration (epoch-sized
+    // `end - 0`, unit error). Any caller-supplied reason wins; otherwise a
+    // rejected number is recorded as null + poisoned_start_ms.
+    const rawDuration = opts['duration-ms'] === 'null' ? null : parseInt(opts['duration-ms'] || '0', 10);
+    const durationCheck = sanitizeDurationMs(rawDuration);
+    const durationReason = opts['duration-reason'] || durationCheck.duration_reason;
     const entry: GateAuditEntry = {
       timestamp: new Date().toISOString(),
       gate_id: opts['gate-id'] || 'unknown',
       gate_name: opts['gate-name'] || 'unknown',
       passed: opts['passed'] === 'true',
       issues_found: parseInt(opts['issues-found'] || '0', 10),
-      duration_ms: opts['duration-ms'] === 'null' ? null : parseInt(opts['duration-ms'] || '0', 10),
+      duration_ms: durationCheck.duration_ms,
       trigger: (opts['trigger'] as 'commit' | 'push' | 'manual') || 'manual',
       repo_path: process.cwd(),
-      commit_hash: getCommitHash(),
+      // Pre-commit runs BEFORE the commit object exists, so `git rev-parse HEAD`
+      // here resolves the PARENT. resolveCommitHash lets an explicit
+      // --commit-hash win and falls back to HEAD otherwise.
+      commit_hash: resolveCommitHash(opts),
       // Issue #370: only set when explicitly flagged (omit field otherwise)
       ...(opts['duration-anomaly'] === 'true' ? { duration_anomaly: true } : {}),
       // REQ-B: why the duration is null — never guess a number for it.
-      ...(opts['duration-reason'] ? { duration_reason: opts['duration-reason'] as 'poisoned_start_ms' | 'clock_skew' } : {}),
+      ...(durationReason ? { duration_reason: durationReason as 'poisoned_start_ms' | 'clock_skew' } : {}),
       // #507: only set when provided (omit field otherwise)
       ...(opts['detail'] ? { detail: opts['detail'] } : {}),
     };
-    appendAuditEntry(entry);
+    // Pre-commit (trigger=commit) is staging for a commit that does not exist
+    // yet: park it in the pending sidecar so post-commit can stamp the real
+    // hash. Its commit_hash is deliberately blank until then — stamping the
+    // parent here is exactly the off-by-one we are removing.
+    if (entry.trigger === 'commit' && !opts['commit-hash']) {
+      entry.commit_hash = '';
+      stageAuditEntry(entry);
+    } else {
+      appendAuditEntry(entry);
+    }
+  } else if (command === 'flush-pending') {
+    // Called by post-commit with the now-real HEAD.
+    const opts = parseCliOptions(args.slice(1));
+    const n = flushPendingAudit(process.cwd(), opts['commit-hash'] || '');
+    // Quiet by default (hooks are noisy enough); --report prints the count.
+    if (opts['report'] === 'true') console.log(`flushed ${n}`);
   } else {
     console.error(`Unknown audit command: ${command}`);
     process.exit(1);
@@ -297,3 +461,47 @@ export function getCommitHash(): string {
     return 'unknown';
   }
 }
+
+/**
+ * Which commit a gate entry belongs to.
+ *
+ * Pre-commit fires BEFORE the commit object exists, so `git rev-parse HEAD`
+ * there returns the PARENT. If the hook let that stand, every gate entry would
+ * be filed under the previous commit — the newest commit would look like it
+ * "ran no gates", and any per-commit battery analysis silently mixes one
+ * commit's timings into another's. An explicit `--commit-hash` (from a caller
+ * that knows the subject, e.g. post-commit) always wins; otherwise HEAD is the
+ * subject (push/manual) and the resolver is used.
+ *
+ * `headResolver` is injectable so the precedence can be tested without a repo.
+ */
+export function resolveCommitHash(
+  opts: Record<string, string>,
+  headResolver: () => string = getCommitHash,
+): string {
+  const explicit = (opts['commit-hash'] || '').trim();
+  if (explicit) return explicit;
+  return headResolver();
+}
+
+// ── Duration sanity (last line of defence) ───────────────────────────────────
+// The shell side sanitizes start_ms before computing the delta
+// (githooks/lib/audit-sanitize.sh, REQ-B). This is the writer-side backstop:
+// if any caller path ever hands us a duration that is provably not a real
+// gate runtime, refuse to persist it as a number. An epoch-sized value (the
+// old bug produced `end - 0 = now`, ~1.7e12) or anything absurdly large would
+// otherwise poison every average and p90 downstream and looks exactly like a
+// "78-hour gate". Precision matters less than honesty: a rejected duration is
+// null with a reason, never a fabricated number.
+
+export function sanitizeDurationMs(
+  raw: number | null,
+): { duration_ms: number | null; duration_reason?: 'poisoned_start_ms' } {
+  if (raw === null) return { duration_ms: null };
+  if (!Number.isFinite(raw) || raw < 0 || raw > MAX_PLAUSIBLE_DURATION_MS) {
+    // >6h or negative can only come from a poisoned start_ms (epoch-sized
+    // value, unit error) — mark it, don't guess a number.
+    return { duration_ms: null, duration_reason: 'poisoned_start_ms' };
+  }
+  return { duration_ms: raw };
+}

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-29T23:47:25.119Z",
+  "checked_at": "2026-10-30T11:58:38.831Z",
   "source": "network"
 }

package/lib/shared-utils.js

@@ -34,7 +34,10 @@ function readXpGateConfig() {
 }
 
 function copyHooks(srcDir, destDir) {
-  ['pre-commit', 'pre-push', 'post-merge'].forEach(hook => {
+  // post-commit carries the audit-attribution flush and --no-verify detection.
+  // It was absent here, so neither ever ran for installed users (the source
+  // existed but no installer copied it).
+  ['pre-commit', 'pre-push', 'post-commit', 'post-merge'].forEach(hook => {
     const src = path.join(srcDir, 'hooks', hook);
     const dest = path.join(destDir, hook);
     if (fs.existsSync(src)) {

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-29
-**Commit:** 101a0ff3
+**Generated:** 2026-10-30
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.1.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-29
-**Commit:** 101a0ff3
+**Generated:** 2026-10-30
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.1.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.32.1",
+  "version": "0.32.3",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.32.1",
+  "version": "0.32.3",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-29
-**Commit:** 101a0ff3
+**Generated:** 2026-10-30
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.1.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-29
-**Commit:** 101a0ff3
+**Generated:** 2026-10-30
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.1.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.