@boyingliu01/xp-gate 0.32.2 → 0.33.0

package/bin/xp-gate.js

@@ -295,9 +295,9 @@ const COMMANDS = {
     usage: 'xp-gate baseline <create|show|reset|diff>'
   },
   'check': {
-    description: 'Run quality gates (--list, --all, --gates <ids>, or <gate-id>)',
+    description: 'Run quality gates (--list, --all, --gates <ids>, --changed --brief, or <gate-id>)',
     run: subargs => check(subargs).then(code => process.exit(code)),
-    usage: 'xp-gate check <file_or_directory|gate_number> [--gates gates] [--all] [--list]'
+    usage: 'xp-gate check <file_or_directory|gate_number> [--gates gates] [--all] [--changed --brief] [--list]'
   },
   'principles': {
     description: 'Run Clean Code + SOLID principles checker (Gate 4 standalone)',
@@ -545,19 +545,59 @@ function handleAuditTail(args, auditPath) {
 
 function handleAuditStats(auditPath) {
   try {
-    const { computeStats } = require(auditPath);
+    const { computeStats, computeAnomalies } = require(auditPath);
     const stats = computeStats();
     if (stats.length === 0) {
       console.log('No audit data found.');
       return;
     }
     printStatsTable(stats);
+    printAnomalies(computeAnomalies());
   } catch (err) {
     console.error('Error computing stats:', err.message);
     process.exit(1);
   }
 }
 
+/**
+ * Print the audit-health summary. `total` is the ledger-integrity number CI
+ * gates on (xp-gate audit --check); the components explain where it comes from.
+ */
+function printAnomalies(a, since) {
+  console.log('');
+  console.log('Audit health (anomalies):');
+  if (since) console.log(`  scope                : entries since ${since}`);
+  console.log(`  entries scanned      : ${a.scanned}`);
+  console.log(`  implausible duration : ${a.implausible_duration}  (epoch/negative — the REQ-B bug)`);
+  console.log(`  missing commit       : ${a.missing_commit}  (blank/unknown attribution — the off-by-one bug)`);
+  console.log(`  duration_anomaly flag: ${a.flagged}`);
+  console.log(`  null + reason        : ${a.null_with_reason}  (honest unmeasurable, NOT counted as anomaly)`);
+  console.log(`  ── total anomalies   : ${a.total}`);
+}
+
+/**
+ * CI gate: exit 1 when the audit ledger carries anomalies (implausible
+ * durations or unattributed commits). This turns both telemetry bugs into a
+ * build failure instead of something a human has to notice in a chart.
+ */
+function handleAuditCheck(auditPath) {
+  try {
+    const { computeAnomalies, AUDIT_ANOMALY_SINCE } = require(auditPath);
+    // Scope to entries after the fix: historical anomalies are grandfathered
+    // (they cannot be re-measured). A future epoch/blank row fails the build.
+    const a = computeAnomalies(process.cwd(), AUDIT_ANOMALY_SINCE);
+    printAnomalies(a, AUDIT_ANOMALY_SINCE);
+    if (a.total > 0) {
+      console.error(`FAIL: ${a.total} audit anomal${a.total === 1 ? 'y' : 'ies'} found since ${AUDIT_ANOMALY_SINCE} (must be 0).`);
+      process.exit(1);
+    }
+    console.log('OK: no new audit anomalies.');
+  } catch (err) {
+    console.error('Error checking audit health:', err.message);
+    process.exit(1);
+  }
+}
+
 function handleAuditRecord(args, auditPath) {
   try {
     const { appendAuditEntry } = require(auditPath);
@@ -600,6 +640,11 @@ function handleAudit(args) {
     return;
   }
 
+  if (args.includes('--check')) {
+    handleAuditCheck(auditPath);
+    return;
+  }
+
   if (args[0] === 'record') {
     handleAuditRecord(args, auditPath);
     return;
@@ -609,7 +654,8 @@ function handleAudit(args) {
   console.error('Usage:');
   console.error('  xp-gate audit record --gate-id X --gate-name Y --passed true/false --issues-found N --duration-ms N --trigger commit');
   console.error('  xp-gate audit --tail [N]     (default: 20)');
-  console.error('  xp-gate audit --stats');
+  console.error('  xp-gate audit --stats        (per-gate stats + anomaly summary)');
+  console.error('  xp-gate audit --check        (exit 1 if the ledger has anomalies)');
   process.exit(1);
 }
 

package/gate-4.sh

@@ -107,6 +107,14 @@ else
     if [ -n "$PRINCIPLES_DIR" ]; then
       echo "Checking Clean Code + SOLID principles..."
 
+      # #581/#582 class: run_tsx drives a NATIVE node/tsx binary. A POSIX
+      # path like $HOME/.config/... reaches it as the wrong drive prefix and
+      # the checker is "not found", which the exit>=2 branch then reported
+      # as SKIPPED. Convert once here so both invocations agree.
+      if declare -F to_native_path >/dev/null 2>&1; then
+        PRINCIPLES_DIR="$(to_native_path "$PRINCIPLES_DIR")"
+      fi
+
       # AC-507-04-02: say what a Java commit is actually covered for, instead
       # of implying a full 15-rule check (#507). Printed before the run so it
       # appears on both the PASS and the FAIL path.

package/hooks/gate-4.sh

@@ -107,6 +107,14 @@ else
     if [ -n "$PRINCIPLES_DIR" ]; then
       echo "Checking Clean Code + SOLID principles..."
 
+      # #581/#582 class: run_tsx drives a NATIVE node/tsx binary. A POSIX
+      # path like $HOME/.config/... reaches it as the wrong drive prefix and
+      # the checker is "not found", which the exit>=2 branch then reported
+      # as SKIPPED. Convert once here so both invocations agree.
+      if declare -F to_native_path >/dev/null 2>&1; then
+        PRINCIPLES_DIR="$(to_native_path "$PRINCIPLES_DIR")"
+      fi
+
       # AC-507-04-02: say what a Java commit is actually covered for, instead
       # of implying a full 15-rule check (#507). Printed before the run so it
       # appears on both the PASS and the FAIL path.

package/hooks/post-commit

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# ============================================================================
+# XP-Gate Post-Commit Hook
+#
+# Two jobs, both only possible AFTER the commit object exists:
+#
+# 1. Audit flush (#audit-attribution). Pre-commit cannot know the commit it is
+#    about to create — `git rev-parse HEAD` there is the PARENT, so per-gate
+#    audit entries used to be filed under the previous commit (the newest
+#    commit looked like it "ran no gates", and per-commit battery stats mixed
+#    two commits' timings). Pre-commit now STAGES entries in
+#    .xp-gate/audit.pending.jsonl; this hook flushes them stamped with the real
+#    HEAD. Pre-commit also flushes leftovers at its own start as a safety net,
+#    so a missed post-commit never loses data.
+#
+# 2. Bypass detection (D8 Layer 2). Detects `git commit --no-verify`:
+#    - pre-commit writes .git/xp-gate-precommit-marker on a successful run
+#    - if the marker is absent here, pre-commit was bypassed (or crashed)
+#    - bypass events go to .xp-gate/bypass-audit.jsonl for later enforcement
+#
+# Git semantics: post-commit cannot block the commit (git limitation). It only
+# records. ============================================================================
+
+set -e
+
+git_dir="$(git rev-parse --git-dir 2>/dev/null)"
+if [ -z "$git_dir" ]; then
+  exit 0
+fi
+
+toplevel="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+head_commit="$(git rev-parse HEAD 2>/dev/null || true)"
+
+# ── 1. Flush staged audit entries with the real commit hash ──────────────────
+# Only when this repo actually carries the audit module (the xp-gate checkout).
+# A consumer repo has no src/npm-package; there pre-commit's record call is a
+# no-op, so nothing is ever staged and there is nothing to flush.
+if [ -n "$toplevel" ] && [ -n "$head_commit" ] \
+   && [ -f "$toplevel/src/npm-package/lib/gate-audit.ts" ]; then
+  _pending="$toplevel/.xp-gate/audit.pending.jsonl"
+  if [ -f "$toplevel/node_modules/tsx/dist/cli.mjs" ] && command -v node >/dev/null 2>&1; then
+    _flush() {
+      node "$toplevel/node_modules/tsx/dist/cli.mjs" \
+        "$toplevel/src/npm-package/lib/gate-audit.ts" flush-pending \
+        --commit-hash "$head_commit" --report true 2>/dev/null || echo 0
+    }
+  elif command -v npx >/dev/null 2>&1; then
+    _flush() {
+      ( cd "$toplevel" && npx --no-install tsx src/npm-package/lib/gate-audit.ts \
+          flush-pending --commit-hash "$head_commit" --report true 2>/dev/null ) || echo 0
+    }
+  fi
+  # Bounded drain: the last gate's recorder is fire-and-forget (`& disown` in
+  # pre-commit), so post-commit can start before it has written its line. Keep
+  # flushing until two consecutive passes find nothing, capped so a slow node
+  # start never stalls the commit. Usually the first pass suffices.
+  _passes=0
+  _empty=0
+  while [ "$_passes" -lt 6 ] && [ "$_empty" -lt 2 ]; do
+    _n="$(_flush)"
+    _passes=$((_passes + 1))
+    case "$_n" in ''|*[!0-9]*) _n=0 ;; esac
+    if [ "$_n" -gt 0 ]; then _empty=0; else _empty=$((_empty + 1)); fi
+    [ "$_empty" -lt 2 ] && sleep 0.05
+  done
+fi
+
+# ── 2. Bypass detection ─────────────────────────────────────────────────────
+marker="$git_dir/xp-gate-precommit-marker"
+
+if [ ! -f "$marker" ]; then
+  if [ -n "$head_commit" ]; then
+    mkdir -p .xp-gate
+    printf '{"commit":"%s","timestamp":"%s","type":"precommit_bypass","branch":"%s"}\n' \
+      "$head_commit" "$(date -Iseconds)" \
+      "$(git rev-parse --abbrev-ref HEAD 2>/dev/null)" >> .xp-gate/bypass-audit.jsonl
+  fi
+else
+  rm -f "$marker"
+fi
+
+exit 0

package/hooks/pre-commit

@@ -344,6 +344,25 @@ file_exists_in_subdir() {
 AUDIT_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT_FOR_AUDIT="$(git rev-parse --show-toplevel 2>/dev/null || echo "$AUDIT_SCRIPT_DIR/../..")"
 
+# Audit attribution safety net: if a previous commit's post-commit never fired
+# (hooks skipped, crash, or an earlier --no-verify), its staged entries are
+# still in .xp-gate/audit.pending.jsonl. Flush them now, stamped with the commit
+# they actually belong to (`git log -1`), so they land under a real commit
+# instead of accumulating or being stamped with THIS run's hash later. Runs
+# before any gate so the flush is never counted in this commit's timings.
+# Best-effort and silent: audit must never affect the commit's outcome.
+if [ -f "$PROJECT_ROOT_FOR_AUDIT/.xp-gate/audit.pending.jsonl" ] \
+   && [ -f "$PROJECT_ROOT_FOR_AUDIT/src/npm-package/lib/gate-audit.ts" ]; then
+  _audit_prev_hash="$(git log -1 --format=%H 2>/dev/null || true)"
+  if [ -n "$_audit_prev_hash" ] && [ -f "$PROJECT_ROOT_FOR_AUDIT/node_modules/tsx/dist/cli.mjs" ] \
+     && command -v node >/dev/null 2>&1; then
+    node "$PROJECT_ROOT_FOR_AUDIT/node_modules/tsx/dist/cli.mjs" \
+      "$PROJECT_ROOT_FOR_AUDIT/src/npm-package/lib/gate-audit.ts" flush-pending \
+      --commit-hash "$_audit_prev_hash" >/dev/null 2>&1 || true
+  fi
+  unset _audit_prev_hash
+fi
+
 # Issue #535: a failed `source` used to print one stderr line and keep going,
 # so a missing lib silently removed gate logic from the run while every gate
 # still reported PASS. Fail closed instead: abort with FATAL when the file is

package/hooks/pre-push

@@ -184,7 +184,20 @@ write_pre_push_report() {
     printf '%s\n' "Path('$report_file').write_text(json.dumps(report, indent=2) + '\n')"
   } > "$py_script"
 
-  "$py_bin" "$py_script"
+  # Native Python cannot open mktemp's POSIX path (/tmp/...) on Windows: it
+  # resolves the leading slash against the current drive and reports a file
+  # that "does not exist", which the caller then billed as "Gate M journal
+  # missing" on every push. Convert when a converter is available.
+  local py_script_native="$py_script"
+  if command -v cygpath >/dev/null 2>&1; then
+    # MSYS/Git-Bash: mktemp hands back /tmp/..., which is a MOUNT, not /<drive>/.
+    # Native python.exe resolves the leading slash against the current drive and
+    # reports "can't open file", which the caller then billed as "Gate M journal
+    # missing" on every push. cygpath knows the mount table; the helper library
+    # is not sourced yet at this point, so it cannot be used here.
+    py_script_native="$(cygpath -w "$py_script" 2>/dev/null || printf '%s' "$py_script")"
+  fi
+  "$py_bin" "$py_script_native"
   py_rc=$?
   rm -f "$py_script"
   if [ "$py_rc" -ne 0 ]; then
@@ -197,7 +210,13 @@ write_pre_push_report() {
   # rule can be exercised directly by tests instead of being asserted through a
   # copied-and-pasted implementation. It refuses to emit a number when the gates
   # that ran cannot summarise the report (none ran, or fewer than half did).
-  if ! "$py_bin" "$score_lib" --report "$report_file"; then
+  # Same MSYS/native-path boundary as the journal body above: $score_lib is a
+  # POSIX path ($HOME/.config/...) and native python.exe cannot open it.
+  local score_lib_native="$score_lib"
+  if command -v cygpath >/dev/null 2>&1; then
+    score_lib_native="$(cygpath -w "$score_lib" 2>/dev/null || printf '%s' "$score_lib")"
+  fi
+  if ! "$py_bin" "$score_lib_native" --report "$report_file"; then
     echo "⚠️  Gate M journal: could not score $report_file — score left unset." >&2
   fi
 }

package/lib/__tests__/check-changed-brief.test.js

@@ -0,0 +1,63 @@
+/**
+ * @test check-changed-brief
+ * @intent Prove `xp-gate check --changed --brief` scopes to the current diff, prints one honest verdict per gate, and never reports a gate as PASS when it did not run
+ * @covers AC-DSH-019
+ */
+const { fileExtension, printBriefSummary } = require('../check.js');
+
+describe('check --changed --brief helpers', () => {
+  describe('fileExtension', () => {
+    it('returns the lowercased extension without the dot', () => {
+      expect(fileExtension('src/a/B.TS')).toBe('ts');
+      expect(fileExtension('x/y/z.mjs')).toBe('mjs');
+    });
+
+    it('returns empty string for a path without an extension', () => {
+      expect(fileExtension('Makefile')).toBe('');
+      expect(fileExtension('docs/README')).toBe('');
+    });
+  });
+
+  describe('printBriefSummary', () => {
+    function capture(fn) {
+      const lines = [];
+      const spy = vi.spyOn(console, 'log').mockImplementation((...a) => lines.push(a.join(' ')));
+      const ret = fn();
+      spy.mockRestore();
+      return { out: lines.join('\n'), ret };
+    }
+
+    it('reports one PASS line per passing gate and returns 0 failures', () => {
+      const { out, ret } = capture(() =>
+        printBriefSummary(['a.ts'], ['a.ts'], [{ id: '3', code: 0 }, { id: '4', code: 0 }], 12),
+      );
+      expect(out).toMatch(/Gate 3 Complexity\s+PASS/);
+      expect(out).toMatch(/Gate 4 Principles\s+PASS/);
+      expect(out).toMatch(/✅ clear/);
+      expect(ret).toBe(0);
+    });
+
+    it('reports BLOCK and counts failures when a gate fails', () => {
+      const { out, ret } = capture(() =>
+        printBriefSummary(['a.ts'], ['a.ts'], [{ id: '3', code: 0 }, { id: '4', code: 1 }], 12),
+      );
+      expect(out).toMatch(/Gate 4 Principles\s+BLOCK/);
+      expect(out).toMatch(/❌ 1 blocking/);
+      expect(ret).toBe(1);
+    });
+
+    it('never prints PASS for a gate that did not run (NOT_RUN -> SKIP)', () => {
+      const { out, ret } = capture(() =>
+        printBriefSummary(['a.ts'], ['a.ts'], [{ id: '3', code: 'NOT_RUN' }], 5),
+      );
+      expect(out).toMatch(/Gate 3 Complexity\s+SKIP/);
+      expect(out).not.toMatch(/Gate 3 Complexity\s+PASS/);
+      expect(ret).toBe(0);
+    });
+
+    it('states docs/config-only diffs apply no blocking source gate', () => {
+      const { out } = capture(() => printBriefSummary(['README.md'], [], [], 3));
+      expect(out).toMatch(/No source files changed/);
+    });
+  });
+});

package/lib/__tests__/doctor-audit-ledger.test.js

@@ -0,0 +1,61 @@
+/**
+ * @test REQ-AUDIT-ATTRIBUTION xp-gate doctor surfaces gate-telemetry anomalies
+ * @intent The two audit bugs (epoch-sized durations, commits attributed to their
+ *         parent) leave fingerprints in .xp-gate/audit.jsonl. CI cannot see a
+ *         gitignored ledger, so doctor must warn locally on NEW anomalies while
+ *         grandfathering the historical rows that cannot be re-measured.
+ * @covers AUDIT-001-11
+ */
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+// doctor.js is CommonJS; import the whole module namespace.
+const doctor = require('../doctor.js');
+
+function repoWithLedger(rows) {
+  const root = mkdtempSync(join(tmpdir(), 'xp-gate-ledger-'));
+  mkdirSync(join(root, '.xp-gate'), { recursive: true });
+  const nl = String.fromCharCode(10);
+  writeFileSync(join(root, '.xp-gate', 'audit.jsonl'), rows.map((r) => JSON.stringify(r)).join(nl) + nl);
+  return root;
+}
+
+describe('doctor audit-ledger health (P0 telemetry)', () => {
+  it('@covers AUDIT-001-11 a fresh clean ledger passes', () => {
+    const future = '2030-01-01T00:00:00.000Z';
+    const root = repoWithLedger([
+      { timestamp: future, gate_id: 'gate-1', duration_ms: 100, commit_hash: 'abc', passed: true, issues_found: 0 },
+    ]);
+    const { checks, issues } = doctor.diagnoseAuditLedger({ repoRoot: root });
+    expect(issues).toBe(0);
+    expect(checks[0].status).toBe('PASS');
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  it('@covers AUDIT-001-11 new epoch/blank-commit rows raise a WARN, grandfather old ones', () => {
+    const future = '2030-01-01T00:00:00.000Z';
+    const old = '2020-01-01T00:00:00.000Z';
+    const root = repoWithLedger([
+      // grandfathered — both anomalies, but before the fix date
+      { timestamp: old, gate_id: 'gate-1', duration_ms: 1750000000000, commit_hash: '', passed: true, issues_found: 0 },
+      // NEW anomalies — must be counted
+      { timestamp: future, gate_id: 'gate-2', duration_ms: 1750000000000, commit_hash: 'abc', passed: true, issues_found: 0 },
+      { timestamp: future, gate_id: 'gate-3', duration_ms: 100, commit_hash: '', passed: true, issues_found: 0 },
+    ]);
+    const { checks, issues } = doctor.diagnoseAuditLedger({ repoRoot: root });
+    expect(issues).toBe(0); // WARN, not a blocking issue count
+    expect(checks[0].status).toBe('WARN');
+    expect(checks[0].detail).toContain('2 anomalies');
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  it('@covers AUDIT-001-11 no ledger is a SKIP, not a failure', () => {
+    const root = mkdtempSync(join(tmpdir(), 'xp-gate-ledger-empty-'));
+    const { checks, issues } = doctor.diagnoseAuditLedger({ repoRoot: root });
+    expect(issues).toBe(0);
+    expect(checks[0].status).toBe('SKIP');
+    rmSync(root, { recursive: true, force: true });
+  });
+});

package/lib/__tests__/gate-audit.test.ts

@@ -13,6 +13,12 @@ import {
   rotateIfNeeded,
   parseCliOptions,
   getCommitHash,
+  resolveCommitHash,
+  stageAuditEntry,
+  flushPendingAudit,
+  sanitizeDurationMs,
+  computeAnomalies,
+  AUDIT_ANOMALY_SINCE,
   type GateAuditEntry,
 } from '../gate-audit';
 
@@ -293,4 +299,142 @@ describe('gate-audit', () => {
       expect(existsSync(`${logPath}.4`)).toBe(false);
     });
   });
+  describe('pre-commit staging + post-commit flush (commit attribution)', () => {
+    const NL = String.fromCharCode(10);
+    const repo = () => {
+      const r = join(TEST_DIR, 'attr');
+      mkdirSync(r, { recursive: true });
+      return r;
+    };
+
+    it('@covers AUDIT-001-07 resolveCommitHash prefers an explicit --commit-hash', () => {
+      expect(resolveCommitHash({ 'commit-hash': 'deadbeef' }, () => 'PARENT')).toBe('deadbeef');
+    });
+
+    it('@covers AUDIT-001-07 resolveCommitHash falls back to HEAD when no explicit hash', () => {
+      expect(resolveCommitHash({}, () => 'HEADHASH')).toBe('HEADHASH');
+    });
+
+    it('@covers AUDIT-001-08 flushPendingAudit stamps staged entries with the real commit', () => {
+      const r = repo();
+      stageAuditEntry(makeEntry({ repo_path: r, gate_id: 'gate-1', commit_hash: '' }), r);
+      stageAuditEntry(makeEntry({ repo_path: r, gate_id: 'gate-2', commit_hash: '' }), r);
+      const logPath = join(r, '.xp-gate', 'audit.jsonl');
+      expect(existsSync(logPath)).toBe(false);
+
+      const n = flushPendingAudit(r, 'REAL_COMMIT_SHA');
+      expect(n).toBe(2);
+
+      const entries = readFileSync(logPath, 'utf8').trim().split(NL).map((l) => JSON.parse(l));
+      expect(entries.map((e) => e.gate_id)).toEqual(['gate-1', 'gate-2']);
+      expect(entries.every((e) => e.commit_hash === 'REAL_COMMIT_SHA')).toBe(true);
+      expect(existsSync(join(r, '.xp-gate', 'audit.pending.jsonl'))).toBe(false);
+    });
+
+    it('@covers AUDIT-001-08 flush is idempotent and a no-op with nothing staged', () => {
+      const r = repo();
+      expect(flushPendingAudit(r, 'X')).toBe(0);
+      expect(existsSync(join(r, '.xp-gate', 'audit.jsonl'))).toBe(false);
+    });
+
+    it('@covers AUDIT-001-08 a blank commit hash never invents one', () => {
+      const r = repo();
+      stageAuditEntry(makeEntry({ repo_path: r, gate_id: 'gate-9', commit_hash: '' }), r);
+      expect(flushPendingAudit(r, '')).toBe(1);
+      const e = JSON.parse(readFileSync(join(r, '.xp-gate', 'audit.jsonl'), 'utf8').trim());
+      expect(e.commit_hash).toBe('');
+    });
+
+    it('@covers AUDIT-001-08 a torn pending line is dropped, not fatal', () => {
+      const r = repo();
+      mkdirSync(join(r, '.xp-gate'), { recursive: true });
+      const pp = join(r, '.xp-gate', 'audit.pending.jsonl');
+      const good = JSON.stringify(makeEntry({ repo_path: r, gate_id: 'gate-3', commit_hash: '' }));
+      writeFileSync(pp, good + NL + '{ broken' + NL, 'utf8');
+      expect(flushPendingAudit(r, 'SHA')).toBe(1);
+      const entries = readFileSync(join(r, '.xp-gate', 'audit.jsonl'), 'utf8').trim().split(NL);
+      expect(entries.length).toBe(1);
+    });
+  });
+
+  describe('sanitizeDurationMs (writer-side epoch guard, REQ-B backstop)', () => {
+    it('@covers AUDIT-001-09 keeps a plausible duration untouched', () => {
+      expect(sanitizeDurationMs(1234)).toEqual({ duration_ms: 1234 });
+      expect(sanitizeDurationMs(0)).toEqual({ duration_ms: 0 });
+    });
+
+    it('@covers AUDIT-001-09 null stays null with no reason', () => {
+      expect(sanitizeDurationMs(null)).toEqual({ duration_ms: null });
+    });
+
+    it('@covers AUDIT-001-09 an epoch-sized duration is rejected, not stored as a number', () => {
+      // end - 0 == Date.now() ~= 1.7e12 — the classic poisoned-start bug.
+      const r = sanitizeDurationMs(1750000000000);
+      expect(r.duration_ms).toBeNull();
+      expect(r.duration_reason).toBe('poisoned_start_ms');
+    });
+
+    it('@covers AUDIT-001-09 negative or NaN durations are rejected', () => {
+      expect(sanitizeDurationMs(-5).duration_reason).toBe('poisoned_start_ms');
+      expect(sanitizeDurationMs(Number.NaN).duration_reason).toBe('poisoned_start_ms');
+    });
+  });
+
+  describe('computeAnomalies (CI ledger gate, P0-2)', () => {
+    const NL = String.fromCharCode(10);
+    const repo = () => {
+      const r = join(TEST_DIR, 'anom');
+      mkdirSync(r, { recursive: true });
+      return r;
+    };
+    const write = (r: string, rows: Partial<GateAuditEntry>[]) => {
+      mkdirSync(join(r, '.xp-gate'), { recursive: true });
+      const lines = rows.map((x) => JSON.stringify(makeEntry({ repo_path: r, ...x }))).join(NL);
+      writeFileSync(join(r, '.xp-gate', 'audit.jsonl'), lines + NL, 'utf8');
+    };
+
+    it('@covers AUDIT-001-10 a clean ledger has zero anomalies', () => {
+      const r = repo();
+      write(r, [{ gate_id: 'gate-1', commit_hash: 'abc', duration_ms: 100 }]);
+      const a = computeAnomalies(r);
+      expect(a.total).toBe(0);
+      expect(a.scanned).toBe(1);
+    });
+
+    it('@covers AUDIT-001-10 epoch duration + blank commit are both counted', () => {
+      const r = repo();
+      write(r, [
+        { gate_id: 'gate-1', commit_hash: 'abc', duration_ms: 1750000000000 },
+        { gate_id: 'gate-2', commit_hash: '', duration_ms: 100 },
+        { gate_id: 'gate-3', commit_hash: 'unknown', duration_ms: 100 },
+        { gate_id: 'gate-4', commit_hash: 'def', duration_ms: 50 },
+      ]);
+      const a = computeAnomalies(r);
+      expect(a.implausible_duration).toBe(1);
+      expect(a.missing_commit).toBe(2);
+      expect(a.total).toBe(3);
+    });
+
+    it('@covers AUDIT-001-10 null+reason is honest, not an anomaly', () => {
+      const r = repo();
+      write(r, [{ gate_id: 'gate-1', commit_hash: 'abc', duration_ms: null, duration_reason: 'poisoned_start_ms' }]);
+      const a = computeAnomalies(r);
+      expect(a.null_with_reason).toBe(1);
+      expect(a.total).toBe(0);
+    });
+
+    it('@covers AUDIT-001-10 since-scope ignores grandfathered anomalies', () => {
+      const r = repo();
+      write(r, [
+        { gate_id: 'gate-1', commit_hash: '', duration_ms: 1750000000000, timestamp: '2020-01-01T00:00:00.000Z' },
+        { gate_id: 'gate-2', commit_hash: 'abc', duration_ms: 100, timestamp: '2030-01-01T00:00:00.000Z' },
+      ]);
+      const all = computeAnomalies(r);
+      expect(all.total).toBe(2); // old row: 1 implausible + 1 missing commit
+      const scoped = computeAnomalies(r, AUDIT_ANOMALY_SINCE);
+      expect(scoped.total).toBe(0);
+      expect(scoped.scanned).toBe(1);
+    });
+  });
+
 });

package/lib/__tests__/shared-utils.test.js

@@ -87,4 +87,26 @@ describe('shared-utils', () => {
       expect(fs.existsSync(path.join(destDir, 'lib', 'now-ms.sh'))).toBe(true);
     });
   });
+  describe('copyHooks ships post-commit (audit flush + bypass detection)', () => {
+    it('@covers gate-script deployment: copyHooks installs post-commit, not just pre-commit/pre-push/post-merge', () => {
+      // Regression: post-commit was absent from both the ship list and copyHooks,
+      // so the audit-attribution flush and --no-verify bypass detection that live
+      // in post-commit never executed for any installed user.
+      const pkgRoot = path.join(tmpRoot, 'node_modules', '@boyingliu01', 'xp-gate');
+      const hooksSrc = path.join(pkgRoot, 'hooks');
+      fs.mkdirSync(hooksSrc, { recursive: true });
+      for (const h of ['pre-commit', 'pre-push', 'post-commit', 'post-merge']) {
+        fs.writeFileSync(path.join(hooksSrc, h), `# ${h}`);
+      }
+      const destDir = path.join(tmpRoot, 'dest-hooks');
+      fs.mkdirSync(destDir, { recursive: true });
+
+      const { copyHooks } = require('../shared-utils');
+      copyHooks(pkgRoot, destDir);
+
+      expect(fs.existsSync(path.join(destDir, 'post-commit'))).toBe(true);
+      expect(fs.existsSync(path.join(destDir, 'pre-commit'))).toBe(true);
+    });
+  });
+
 });