@boyingliu01/xp-gate 0.32.2 → 0.32.3

package/lib/gate-audit.ts

@@ -14,6 +14,7 @@ import {
   renameSync,
   statSync,
   chmodSync,
+  rmSync,
 } from 'fs';
 import { join } from 'path';
 
@@ -23,6 +24,7 @@ const AUDIT_DIR = '.xp-gate';
 const AUDIT_FILE = 'audit.jsonl';
 const MAX_FILE_BYTES = 10 * 1024 * 1024; // 10 MB
 const MAX_ARCHIVES = 3;
+const MAX_PLAUSIBLE_DURATION_MS = 6 * 60 * 60 * 1000; // 6h — no single gate runs longer
 
 // ── Types ────────────────────────────────────────────────────────────────────
 
@@ -85,6 +87,75 @@ export function appendAuditEntry(
   }
 }
 
+// ── Pre-commit staging ───────────────────────────────────────────────────────
+// Pre-commit cannot know the commit it is about to create (HEAD is still the
+// parent there), so per-gate entries are staged to a sidecar and stamped with
+// the real commit by post-commit. Fallback safety: `flushPendingAudit` also
+// runs at the START of the next pre-commit, so if post-commit never fired
+// (hooks skipped, exception) the entries still land, attributed by `git log -1`
+// at that later point — slightly late but never lost, never misattributed to
+// the wrong commit when post-commit does run.
+
+const PENDING_SUFFIX = 'audit.pending.jsonl';
+
+function pendingPath(repoRoot: string): string {
+  return join(repoRoot, AUDIT_DIR, PENDING_SUFFIX);
+}
+
+/** Stage one entry for the not-yet-created commit. Never throws. */
+export function stageAuditEntry(entry: GateAuditEntry, repoRoot: string = process.cwd()): void {
+  try {
+    const dir = join(repoRoot, AUDIT_DIR);
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    appendFileSync(pendingPath(repoRoot), JSON.stringify(entry) + '\n', 'utf8');
+  } catch (err) {
+    console.error('[xp-gate audit] Failed to stage entry:', (err as Error).message);
+  }
+}
+
+/**
+ * Move staged entries into audit.jsonl, stamped with the real commit hash.
+ * Idempotent and safe to call when nothing is staged. A blank/absent hash
+ * leaves `commit_hash` exactly as staged so a wrong commit is never invented.
+ */
+export function flushPendingAudit(
+  repoRoot: string = process.cwd(),
+  commitHash: string = '',
+): number {
+  const p = pendingPath(repoRoot);
+  if (!existsSync(p)) return 0;
+  let flushed = 0;
+  try {
+    const raw = readFileSync(p, 'utf8');
+    const lines = raw.split('\n').filter((l) => l.trim());
+    for (const line of lines) {
+      let entry: GateAuditEntry;
+      try {
+        entry = JSON.parse(line) as GateAuditEntry;
+      } catch {
+        // A torn line (interrupted mid-write) is dropped rather than crashing
+        // the hook that is trying to flush a previous run's leftovers.
+        continue;
+      }
+      if (commitHash) entry.commit_hash = commitHash;
+      appendAuditEntry(entry, repoRoot);
+      flushed++;
+    }
+    rmSyncSafe(p);
+  } catch (err) {
+    console.error('[xp-gate audit] Failed to flush pending entries:', (err as Error).message);
+  }
+  return flushed;
+}
+
+function rmSyncSafe(p: string): void {
+  try {
+    rmSync(p, { force: true });
+  } catch {
+    /* best effort */
+  }
+}
+
 /**
  * Read the last N entries from the audit log.
  */
@@ -152,7 +223,10 @@ function aggregateByGate(entries: GateAuditEntry[]): Map<string, { total: number
   const buckets = new Map<string, { total: number; passed: number; ms: number; issues: number; anomaly_count: number }>();
 
   for (const e of entries) {
-    const b = buckets.get(e.gate_id) ?? { total: 0, passed: 0, ms: 0, issues: 0, anomaly_count: 0 };
+    // Tolerate malformed/legacy rows: a missing gate_id would otherwise create
+    // an `undefined` bucket key (and crash the sort comparing it to a string).
+    const gateId = typeof e.gate_id === 'string' && e.gate_id ? e.gate_id : 'unknown';
+    const b = buckets.get(gateId) ?? { total: 0, passed: 0, ms: 0, issues: 0, anomaly_count: 0 };
     b.total += 1;
     if (e.passed) b.passed += 1;
     // Issue #370: exclude anomalous durations from ms aggregation. REQ-B: a
@@ -163,8 +237,10 @@ function aggregateByGate(entries: GateAuditEntry[]): Map<string, { total: number
     } else if (typeof e.duration_ms === 'number') {
       b.ms += e.duration_ms;
     }
-    b.issues += e.issues_found;
-    buckets.set(e.gate_id, b);
+    // A malformed/legacy row with a non-numeric issues_found must not turn
+    // the whole gate's average into NaN.
+    b.issues += Number.isFinite(e.issues_found) ? e.issues_found : 0;
+    buckets.set(gateId, b);
   }
 
   return buckets;
@@ -202,6 +278,70 @@ export function computeStats(
   return results;
 }
 
+export interface AuditAnomalies {
+  /** Entries with an explicit duration_anomaly flag (Issue #370). */
+  flagged: number;
+  /** Entries with a null duration + reason (REQ-B unmeasurable). */
+  null_with_reason: number;
+  /** Entries persisting a provably-impossible duration (>6h / negative). */
+  implausible_duration: number;
+  /** Entries with no commit attribution (the off-by-one bug's fingerprints). */
+  missing_commit: number;
+  /** Sum of the above — the number CI should treat as "must be 0". */
+  total: number;
+  /** Running counter of entries scanned. */
+  scanned: number;
+}
+
+/**
+ * Count audit-health problems so CI can fail when the ledger is untrustworthy.
+ *
+ * These are exactly the artefacts of the two telemetry bugs we fixed: epoch
+ * durations (implausible_duration) and misattributed/blank commits
+ * (missing_commit). A clean ledger returns total=0.
+ *
+ * `since` (ISO-8601) scopes the check to entries at/after that instant. Both
+ * bugs predate the fix and left ~900 historical rows in the ledger; a CI gate
+ * that counted them would be permanently red. Scoping by the fix date turns
+ * the gate into "no NEW anomalies", which is exactly what we can enforce.
+ */
+export function computeAnomalies(repoRoot: string = process.cwd(), since?: string): AuditAnomalies {
+  const logPath = join(repoRoot, AUDIT_DIR, AUDIT_FILE);
+  const entries = parseAuditEntries(logPath);
+  let flagged = 0;
+  let null_with_reason = 0;
+  let implausible = 0;
+  let missingCommit = 0;
+  let considered = 0;
+  for (const e of entries) {
+    if (since && typeof e.timestamp === 'string' && e.timestamp < since) continue;
+    considered += 1;
+    if (e.duration_anomaly === true) flagged += 1;
+    if (e.duration_ms === null && e.duration_reason) null_with_reason += 1;
+    if (typeof e.duration_ms === 'number'
+      && (!Number.isFinite(e.duration_ms) || e.duration_ms < 0 || e.duration_ms > MAX_PLAUSIBLE_DURATION_MS)) {
+      implausible += 1;
+    }
+    if (!e.commit_hash || e.commit_hash === 'unknown') missingCommit += 1;
+  }
+  return {
+    flagged,
+    null_with_reason,
+    implausible_duration: implausible,
+    missing_commit: missingCommit,
+    total: implausible + missingCommit,
+    scanned: considered,
+  };
+}
+
+/**
+ * Entries at/after this instant are expected to be clean. It is the date the
+ * two telemetry bugs were fixed; anything older is grandfathered because it
+ * cannot be re-measured. Keep in sync with the fix commit if you regenerate.
+ */
+export const AUDIT_ANOMALY_SINCE = '2026-10-30T00:00:00.000Z';
+
+
 /**
  * Rotate the audit log if it exceeds MAX_FILE_BYTES.
  * Renames current file to .1, shifts existing archives.
@@ -250,24 +390,48 @@ function runCli(): void {
 
   if (command === 'record') {
     const opts = parseCliOptions(args.slice(1));
+    // Writer-side backstop: never persist an implausible duration (epoch-sized
+    // `end - 0`, unit error). Any caller-supplied reason wins; otherwise a
+    // rejected number is recorded as null + poisoned_start_ms.
+    const rawDuration = opts['duration-ms'] === 'null' ? null : parseInt(opts['duration-ms'] || '0', 10);
+    const durationCheck = sanitizeDurationMs(rawDuration);
+    const durationReason = opts['duration-reason'] || durationCheck.duration_reason;
     const entry: GateAuditEntry = {
       timestamp: new Date().toISOString(),
       gate_id: opts['gate-id'] || 'unknown',
       gate_name: opts['gate-name'] || 'unknown',
       passed: opts['passed'] === 'true',
       issues_found: parseInt(opts['issues-found'] || '0', 10),
-      duration_ms: opts['duration-ms'] === 'null' ? null : parseInt(opts['duration-ms'] || '0', 10),
+      duration_ms: durationCheck.duration_ms,
       trigger: (opts['trigger'] as 'commit' | 'push' | 'manual') || 'manual',
       repo_path: process.cwd(),
-      commit_hash: getCommitHash(),
+      // Pre-commit runs BEFORE the commit object exists, so `git rev-parse HEAD`
+      // here resolves the PARENT. resolveCommitHash lets an explicit
+      // --commit-hash win and falls back to HEAD otherwise.
+      commit_hash: resolveCommitHash(opts),
       // Issue #370: only set when explicitly flagged (omit field otherwise)
       ...(opts['duration-anomaly'] === 'true' ? { duration_anomaly: true } : {}),
       // REQ-B: why the duration is null — never guess a number for it.
-      ...(opts['duration-reason'] ? { duration_reason: opts['duration-reason'] as 'poisoned_start_ms' | 'clock_skew' } : {}),
+      ...(durationReason ? { duration_reason: durationReason as 'poisoned_start_ms' | 'clock_skew' } : {}),
       // #507: only set when provided (omit field otherwise)
       ...(opts['detail'] ? { detail: opts['detail'] } : {}),
     };
-    appendAuditEntry(entry);
+    // Pre-commit (trigger=commit) is staging for a commit that does not exist
+    // yet: park it in the pending sidecar so post-commit can stamp the real
+    // hash. Its commit_hash is deliberately blank until then — stamping the
+    // parent here is exactly the off-by-one we are removing.
+    if (entry.trigger === 'commit' && !opts['commit-hash']) {
+      entry.commit_hash = '';
+      stageAuditEntry(entry);
+    } else {
+      appendAuditEntry(entry);
+    }
+  } else if (command === 'flush-pending') {
+    // Called by post-commit with the now-real HEAD.
+    const opts = parseCliOptions(args.slice(1));
+    const n = flushPendingAudit(process.cwd(), opts['commit-hash'] || '');
+    // Quiet by default (hooks are noisy enough); --report prints the count.
+    if (opts['report'] === 'true') console.log(`flushed ${n}`);
   } else {
     console.error(`Unknown audit command: ${command}`);
     process.exit(1);
@@ -297,3 +461,47 @@ export function getCommitHash(): string {
     return 'unknown';
   }
 }
+
+/**
+ * Which commit a gate entry belongs to.
+ *
+ * Pre-commit fires BEFORE the commit object exists, so `git rev-parse HEAD`
+ * there returns the PARENT. If the hook let that stand, every gate entry would
+ * be filed under the previous commit — the newest commit would look like it
+ * "ran no gates", and any per-commit battery analysis silently mixes one
+ * commit's timings into another's. An explicit `--commit-hash` (from a caller
+ * that knows the subject, e.g. post-commit) always wins; otherwise HEAD is the
+ * subject (push/manual) and the resolver is used.
+ *
+ * `headResolver` is injectable so the precedence can be tested without a repo.
+ */
+export function resolveCommitHash(
+  opts: Record<string, string>,
+  headResolver: () => string = getCommitHash,
+): string {
+  const explicit = (opts['commit-hash'] || '').trim();
+  if (explicit) return explicit;
+  return headResolver();
+}
+
+// ── Duration sanity (last line of defence) ───────────────────────────────────
+// The shell side sanitizes start_ms before computing the delta
+// (githooks/lib/audit-sanitize.sh, REQ-B). This is the writer-side backstop:
+// if any caller path ever hands us a duration that is provably not a real
+// gate runtime, refuse to persist it as a number. An epoch-sized value (the
+// old bug produced `end - 0 = now`, ~1.7e12) or anything absurdly large would
+// otherwise poison every average and p90 downstream and looks exactly like a
+// "78-hour gate". Precision matters less than honesty: a rejected duration is
+// null with a reason, never a fabricated number.
+
+export function sanitizeDurationMs(
+  raw: number | null,
+): { duration_ms: number | null; duration_reason?: 'poisoned_start_ms' } {
+  if (raw === null) return { duration_ms: null };
+  if (!Number.isFinite(raw) || raw < 0 || raw > MAX_PLAUSIBLE_DURATION_MS) {
+    // >6h or negative can only come from a poisoned start_ms (epoch-sized
+    // value, unit error) — mark it, don't guess a number.
+    return { duration_ms: null, duration_reason: 'poisoned_start_ms' };
+  }
+  return { duration_ms: raw };
+}

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T08:22:09.989Z",
+  "checked_at": "2026-10-30T11:58:38.831Z",
   "source": "network"
 }

package/lib/shared-utils.js

@@ -34,7 +34,10 @@ function readXpGateConfig() {
 }
 
 function copyHooks(srcDir, destDir) {
-  ['pre-commit', 'pre-push', 'post-merge'].forEach(hook => {
+  // post-commit carries the audit-attribution flush and --no-verify detection.
+  // It was absent here, so neither ever ran for installed users (the source
+  // existed but no installer copied it).
+  ['pre-commit', 'pre-push', 'post-commit', 'post-merge'].forEach(hook => {
     const src = path.join(srcDir, 'hooks', hook);
     const dest = path.join(destDir, hook);
     if (fs.existsSync(src)) {

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.32.2",
+  "version": "0.32.3",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.32.2",
+  "version": "0.32.3",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/sprint-flow/references/phase-3-build.md

@@ -236,6 +236,27 @@ Without these events, the Harness can only infer changes from file diffs and has
 
 ---
 
+## 工具调用效率自检（P2 硬性 — 2026-10-30 诊断）
+
+> BUILD 阶段是工具调用最密集的阶段，也是"等待时间长"的主要来源。依据
+> `docs/plans/2026-10-30-dev-speed-diagnosis.md`：工具延迟占总耗时 58%，其中 32.7% 的
+> shell 调用是纯读取/搜索、calls/step 仅 1.03、`job_output` 阻塞 66.5 h。以下四条在 BUILD
+> 期间是硬性自检项，不满足不得宣称 REQ 完成。
+
+| ❌ 低效做法 | ✅ 正确做法 |
+|------------|------------|
+| `cat` / `Get-Content` / `sed -n` / `head` 读文件 | 用 `read` 原生工具（毫秒级，可并发） |
+| `grep` / `rg` / `Select-String` / `findstr` 搜内容 | 用 `grep` 原生工具 |
+| `find` / `ls` / `Get-ChildItem` 找文件 | 用 `glob` 原生工具 |
+| 一个一个发独立调用（改完再想下一个） | 多个互不依赖的调用放进**同一步**并发发出 |
+| 用 `job_output wait:true` / `sleep` 反复阻塞等长任务 | `run_in_background` + 完成通知，需要时短超时取一次 |
+| 打包/发布/插件改动只靠 CI 发现契约破坏 | 先写契约测试（`plugins/dsh/src/contract.test.ts` 范式），本地先红 |
+
+**验收目标**：纯读取 shell 占比 <5%（现 32.7%）；calls/step ≥2.0（现 1.03）；`job_output`
+调用数下降 ≥50%。这三项在 `xp-gate retro` 的 activity 统计里可复查。
+
+---
+
 ## Blind Review — Read-Only Subagent Convention (v0.18.0+, 证据型标准步骤)
 
 **Purpose**: Code review by an isolated subagent with read-only tool access. Replaces the former `freeze/unfreeze` mechanism.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.32.2",
+  "version": "0.32.3",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/scripts/copy-client.cjs

@@ -29,4 +29,9 @@ fs.mkdirSync(path.dirname(OUT), { recursive: true });
 fs.copyFileSync(SRC, OUT);
 
 const rel = (p) => path.relative(PLUGIN_ROOT, p).split(path.sep).join('/');
-console.log(`[client] ${rel(SRC)} -> ${rel(OUT)}`);
+// stderr, not stdout: this runs from `prepack`, and npm's `pack --json` contract
+// is that stdout carries the JSON blob and nothing else. A single console.log here
+// made `npm pack --dry-run --json | jq ...` fail with "Invalid numeric literal"
+// and took the whole publish job down. `prepack.cjs` already logs to stderr for
+// the same reason; match it.
+console.error(`[client] ${rel(SRC)} -> ${rel(OUT)}`);

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/sprint-flow/references/phase-3-build.md

@@ -236,6 +236,27 @@ Without these events, the Harness can only infer changes from file diffs and has
 
 ---
 
+## 工具调用效率自检（P2 硬性 — 2026-10-30 诊断）
+
+> BUILD 阶段是工具调用最密集的阶段，也是"等待时间长"的主要来源。依据
+> `docs/plans/2026-10-30-dev-speed-diagnosis.md`：工具延迟占总耗时 58%，其中 32.7% 的
+> shell 调用是纯读取/搜索、calls/step 仅 1.03、`job_output` 阻塞 66.5 h。以下四条在 BUILD
+> 期间是硬性自检项，不满足不得宣称 REQ 完成。
+
+| ❌ 低效做法 | ✅ 正确做法 |
+|------------|------------|
+| `cat` / `Get-Content` / `sed -n` / `head` 读文件 | 用 `read` 原生工具（毫秒级，可并发） |
+| `grep` / `rg` / `Select-String` / `findstr` 搜内容 | 用 `grep` 原生工具 |
+| `find` / `ls` / `Get-ChildItem` 找文件 | 用 `glob` 原生工具 |
+| 一个一个发独立调用（改完再想下一个） | 多个互不依赖的调用放进**同一步**并发发出 |
+| 用 `job_output wait:true` / `sleep` 反复阻塞等长任务 | `run_in_background` + 完成通知，需要时短超时取一次 |
+| 打包/发布/插件改动只靠 CI 发现契约破坏 | 先写契约测试（`plugins/dsh/src/contract.test.ts` 范式），本地先红 |
+
+**验收目标**：纯读取 shell 占比 <5%（现 32.7%）；calls/step ≥2.0（现 1.03）；`job_output`
+调用数下降 ≥50%。这三项在 `xp-gate retro` 的 activity 统计里可复查。
+
+---
+
 ## Blind Review — Read-Only Subagent Convention (v0.18.0+, 证据型标准步骤)
 
 **Purpose**: Code review by an isolated subagent with read-only tool access. Replaces the former `freeze/unfreeze` mechanism.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/src/contract.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest"
-import { readFileSync } from "node:fs"
+import { readFileSync, readdirSync } from "node:fs"
 import { join, resolve } from "node:path"
 import { fileURLToPath } from "node:url"
 
@@ -95,4 +95,28 @@ describe("packaging contract", () => {
     // A report with no explicit verdict must not be counted toward consensus.
     expect(core).toContain("INVALID_NO_VERDICT")
   })
+
+  /**
+   * @test REQ-DSH-019 prepack scripts keep stdout clean for `npm pack --json`
+   * @intent 发布流水线用 `npm pack --dry-run --json | jq ...` 量 tarball 大小。
+   *         `prepack` 里任何一句 console.log 都会混进那个 JSON 流，jq 报
+   *         "Invalid numeric literal" 并以 exit 5 结束——0.32.2 的 dsh 插件正是
+   *         因此没发出去，而 create-release 依赖三个 publish job，于是 tag 与
+   *         release 一起被跳过。日志一律走 stderr。
+   * @covers AC-DSH-019-01
+   */
+  it("prepack-time scripts log to stderr, never stdout", () => {
+    const scriptsDir = join(PKG_ROOT, "scripts")
+    const files = readdirSync(scriptsDir).filter((f) => f.endsWith(".cjs"))
+    expect(files.length, "no prepack scripts found").toBeGreaterThan(0)
+
+    for (const f of files) {
+      const source = readFileSync(join(scriptsDir, f), "utf8")
+      // Strip comments so an explanatory "console.log" in prose does not fail it.
+      const code = source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "")
+      expect(code, `${f} writes to stdout and would corrupt npm pack --json`).not.toMatch(
+        /console\.log\s*\(/,
+      )
+    }
+  })
 })

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.32.2",
+  "version": "0.32.3",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/sprint-flow/references/phase-3-build.md

@@ -236,6 +236,27 @@ Without these events, the Harness can only infer changes from file diffs and has
 
 ---
 
+## 工具调用效率自检（P2 硬性 — 2026-10-30 诊断）
+
+> BUILD 阶段是工具调用最密集的阶段，也是"等待时间长"的主要来源。依据
+> `docs/plans/2026-10-30-dev-speed-diagnosis.md`：工具延迟占总耗时 58%，其中 32.7% 的
+> shell 调用是纯读取/搜索、calls/step 仅 1.03、`job_output` 阻塞 66.5 h。以下四条在 BUILD
+> 期间是硬性自检项，不满足不得宣称 REQ 完成。
+
+| ❌ 低效做法 | ✅ 正确做法 |
+|------------|------------|
+| `cat` / `Get-Content` / `sed -n` / `head` 读文件 | 用 `read` 原生工具（毫秒级，可并发） |
+| `grep` / `rg` / `Select-String` / `findstr` 搜内容 | 用 `grep` 原生工具 |
+| `find` / `ls` / `Get-ChildItem` 找文件 | 用 `glob` 原生工具 |
+| 一个一个发独立调用（改完再想下一个） | 多个互不依赖的调用放进**同一步**并发发出 |
+| 用 `job_output wait:true` / `sleep` 反复阻塞等长任务 | `run_in_background` + 完成通知，需要时短超时取一次 |
+| 打包/发布/插件改动只靠 CI 发现契约破坏 | 先写契约测试（`plugins/dsh/src/contract.test.ts` 范式），本地先红 |
+
+**验收目标**：纯读取 shell 占比 <5%（现 32.7%）；calls/step ≥2.0（现 1.03）；`job_output`
+调用数下降 ≥50%。这三项在 `xp-gate retro` 的 activity 统计里可复查。
+
+---
+
 ## Blind Review — Read-Only Subagent Convention (v0.18.0+, 证据型标准步骤)
 
 **Purpose**: Code review by an isolated subagent with read-only tool access. Replaces the former `freeze/unfreeze` mechanism.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.32.2",
+  "version": "0.32.3",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** e5ca7d9d
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.32.3.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.