@boyingliu01/xp-gate 0.32.2 → 0.33.0

package/lib/check.js

@@ -13,13 +13,15 @@ function resolveGateToken(token) {
 }
 
 function parseCheckArgs(args) {
-  const flags = { all: false, list: false, gateIds: null };
+  const flags = { all: false, list: false, gateIds: null, changed: false, brief: false };
   const posArgs = [];
   let i = 0;
   while (i < args.length) {
     const arg = args[i];
     if (arg === '--all') { flags.all = true; i++; }
     else if (arg === '--list') { flags.list = true; i++; }
+    else if (arg === '--changed') { flags.changed = true; i++; }
+    else if (arg === '--brief') { flags.brief = true; i++; }
     else if (arg === '--gates' && i + 1 < args.length) {
       flags.gateIds = args[i + 1].split(',').map(s => s.trim()).filter(Boolean);
       i += 2;
@@ -45,6 +47,7 @@ async function check(args) {
   const opts = parseCheckArgs(args);
 
   if (opts.list) return listGates();
+  if (opts.changed) return runChangedBrief();
   if (opts.gateNumber && !opts.all && !opts.gateIds) return runGate(opts.gateNumber, opts.pathArg);
   if (opts.all) return checkAllGates(opts.pathArg);
   if (opts.gateIds && opts.gateIds.length > 0) return runGatesByIds(opts.gateIds, opts.pathArg);
@@ -55,6 +58,7 @@ async function check(args) {
     console.error('Options:');
     console.error('  --gates <ids>    Run specific gates (comma-separated IDs or aliases, e.g. "version,4,secrets")');
     console.error('  --all             Run all invokable gates');
+    console.error('  --changed --brief Fast: run only the gates the current diff can trip, one-screen summary');
     console.error('  --list            List all available gates');
     console.error('');
     console.error('Available Gates:');
@@ -68,6 +72,7 @@ async function check(args) {
     console.error('  xp-gate check secrets                           # Run Gate 8 via alias');
     console.error('  xp-gate check . --gates version,4,secrets       # Run gates 0, 4, and 8');
     console.error('  xp-gate check . --all                           # Run all invokable gates');
+    console.error('  xp-gate check . --changed --brief               # Fast: only what this diff trips');
     console.error('  xp-gate check --list                            # List available gates');
     return 1;
   }
@@ -212,6 +217,113 @@ async function runGatesByIds(gateIds, target) {
   return failures === 0 ? 0 : 1;
 }
 
+/**
+ * Fast "what will this commit trip?" view (P1-4, diagnosis 2026-10-30).
+ *
+ * `check . --all` runs the whole tree (minutes). During BUILD the developer only
+ * needs to know which blocking rules the CURRENT diff touches, in one screen and
+ * in seconds. This maps the diff to the gates that read changed files and runs
+ * only those, so the common case (docs / a couple of sources) returns fast.
+ *
+ * Honest by construction: prints only gate->verdict, never implying a gate ran
+ * when it was skipped. Gates not modelled here are listed as "commit-time".
+ */
+
+/** Extension of a path, lowercased, without the dot ('' when none). */
+function fileExtension(file) {
+  const m = /\.([a-z0-9]+)$/i.exec(file);
+  return m ? m[1].toLowerCase() : '';
+}
+
+/** Wall-clock budget for one `git diff` used by the --changed resolver. */
+const GIT_DIFF_TIMEOUT_MS = 10000;
+
+/**
+ * Run one git diff and split its stdout into file names. Returns null ONLY for a
+ * failed diff (not a git repo); any git error is caught and mapped to null so the
+ * caller can report "not a repository" instead of crashing on a null status.
+ */
+function gitChangedNames(spawnSync, args) {
+  try {
+    const res = spawnSync('git', args, { encoding: 'utf-8', timeout: GIT_DIFF_TIMEOUT_MS });
+    if (res.status !== 0 || typeof res.stdout !== 'string') return null;
+    return res.stdout.split('\n').map((f) => f.trim()).filter(Boolean);
+  } catch {
+    return null;
+  }
+}
+
+/** Diff scope mirrors pre-commit: staged first, then anything vs HEAD. */
+function readChangedFiles() {
+  const { spawnSync } = require('child_process');
+  const staged = gitChangedNames(spawnSync, ['diff', '--cached', '--name-only', '--diff-filter=ACM']);
+  if (staged === null) return null;
+  if (staged.length > 0) return staged;
+  const vsHead = gitChangedNames(spawnSync, ['diff', 'HEAD', '--name-only', '--diff-filter=ACM']);
+  return vsHead === null ? staged : vsHead;
+}
+
+/**
+ * Run the gates a diff can trip that are both diff-scoped and fast. Gate 2
+ * (jscpd) is excluded on purpose: it scans the whole tree and duplicate
+ * detection is a codebase-wide question, not a per-diff one. Gate 4 is handed the
+ * actual files — calling it with '.' examined 0 files and printed a vacuous
+ * "No violations found", the exact anti-pattern this project forbids.
+ */
+async function runBriefGates(sourceFiles) {
+  const results = [];
+  if (sourceFiles.length === 0) return results;
+  results.push({ id: '3', code: await runGate('3', '.', {}) });
+  const { principles } = require('./principles.js');
+  results.push({ id: '4', code: await principles(sourceFiles) });
+  return results;
+}
+
+const BRIEF_GATE_NAMES = { '2': 'Duplicates', '3': 'Complexity', '4': 'Principles' };
+const COMMIT_TIME_GATES = ['1 lint', '5 tests', '6 Boy Scout', '7 IaC', '8 secrets', '9 sast', '10 build', '11 sprint'];
+
+/** Print the one-screen summary; returns the number of blocking gates. */
+function printBriefSummary(changed, sourceFiles, results, ms) {
+  console.log('');
+  console.log(`━━━ xp-gate check --changed (${changed.length} file(s), ${sourceFiles.length} source) ━━━`);
+  if (sourceFiles.length === 0) {
+    console.log('  No source files changed — no blocking source gate applies (docs/config only).');
+  }
+  let failures = 0;
+  for (const r of results) {
+    let verdict;
+    if (r.code === 0) verdict = 'PASS';
+    else if (r.code === 'NOT_RUN') verdict = 'SKIP';
+    else { verdict = 'BLOCK'; failures += 1; }
+    console.log(`  Gate ${r.id} ${(BRIEF_GATE_NAMES[r.id] || r.id).padEnd(12)} ${verdict}`);
+  }
+  const rest = sourceFiles.length > 0 ? COMMIT_TIME_GATES.filter((g) => !/^(1 |5 |6 )/.test(g)) : COMMIT_TIME_GATES;
+  console.log(`  commit-time (not run here): ${rest.join(', ')}`);
+  console.log(`  ${failures === 0 ? '✅ clear' : `❌ ${failures} blocking`} — ${ms} ms`);
+  return failures;
+}
+
+async function runChangedBrief() {
+  const { SOURCE_FILE_EXTENSIONS } = require('./gate-runner.js');
+  const t0 = Date.now();
+
+  const changed = readChangedFiles();
+  if (changed === null) {
+    console.error('[xp-gate check --changed] not a git repository');
+    return 1;
+  }
+  if (changed.length === 0) {
+    console.log('[xp-gate check --changed] no staged/tracked changes — nothing to gate (0 files).');
+    return 0;
+  }
+
+  const srcExt = new Set(SOURCE_FILE_EXTENSIONS);
+  const sourceFiles = changed.filter((f) => srcExt.has(fileExtension(f)));
+  const results = await runBriefGates(sourceFiles);
+  const failures = printBriefSummary(changed, sourceFiles, results, Date.now() - t0);
+  return failures === 0 ? 0 : 1;
+}
+
 function listGates() {
   const { getAllGates } = require('./gate-runner.js');
   const allGates = getAllGates();
@@ -244,4 +356,4 @@ function listGates() {
   return 0;
 }
 
-module.exports = { check, checkAllGates, formatGateTally };
+module.exports = { check, checkAllGates, formatGateTally, runChangedBrief, fileExtension, printBriefSummary };

package/lib/doctor.js

@@ -676,6 +676,59 @@ function readPair(repoFile, installedFile) {
  * @param {{repoRoot?: string, repoHooks?: string, installedAdapters?: string}} [ctx]
  * @returns {{checks: Array<{name: string, status: string, detail: string}>, issues: number}}
  */
+/**
+ * Audit ledger health (P0): surface gate-telemetry anomalies so `doctor` warns
+ * before they silently poison per-commit analysis. Mirrors gate-audit.ts's
+ * computeAnomalies (kept in sync deliberately — doctor is CommonJS and cannot
+ * import the .ts module). Grandfathers everything before AUDIT_LEDGER_SINCE;
+ * only NEW implausible durations or unattributed commits count as issues.
+ */
+const AUDIT_LEDGER_SINCE = '2026-10-30T00:00:00.000Z';
+const AUDIT_MAX_PLAUSIBLE_MS = 6 * 60 * 60 * 1000;
+
+function diagnoseAuditLedger(ctx = {}) {
+  const checks = [];
+  let issues = 0;
+  const repoRoot = ctx.repoRoot || process.cwd();
+  const logPath = path.join(repoRoot, '.xp-gate', 'audit.jsonl');
+  if (!fs.existsSync(logPath)) {
+    checks.push({ name: 'Audit ledger', status: 'SKIP', detail: 'no .xp-gate/audit.jsonl' });
+    return { checks, issues };
+  }
+  let entries;
+  try {
+    entries = fs.readFileSync(logPath, 'utf8').split(/\r?\n/).filter((l) => l.trim()).map((l) => JSON.parse(l));
+  } catch (err) {
+    checks.push({ name: 'Audit ledger', status: 'WARN', detail: `unreadable: ${err.message}` });
+    return { checks, issues };
+  }
+  let implausible = 0;
+  let missingCommit = 0;
+  let considered = 0;
+  for (const e of entries) {
+    if (typeof e.timestamp === 'string' && e.timestamp < AUDIT_LEDGER_SINCE) continue;
+    considered += 1;
+    if (typeof e.duration_ms === 'number'
+      && (!Number.isFinite(e.duration_ms) || e.duration_ms < 0 || e.duration_ms > AUDIT_MAX_PLAUSIBLE_MS)) {
+      implausible += 1;
+    }
+    if (!e.commit_hash || e.commit_hash === 'unknown') missingCommit += 1;
+  }
+  const total = implausible + missingCommit;
+  if (total > 0) {
+    checks.push({
+      name: 'Audit ledger',
+      status: 'WARN',
+      detail: `${total} anomal${total === 1 ? 'y' : 'ies'} since ${AUDIT_LEDGER_SINCE} (${implausible} implausible duration, ${missingCommit} unattributed) — run: xp-gate audit --check`,
+    });
+    // WARN, not FAIL: telemetry integrity is not a blocking gate, but it must
+    // be visible. Kept at 0 issues so it never inflates the FAIL count.
+  } else {
+    checks.push({ name: 'Audit ledger', status: 'PASS', detail: `${considered} entr${considered === 1 ? 'y' : 'ies'} clean since ${AUDIT_LEDGER_SINCE}` });
+  }
+  return { checks, issues };
+}
+
 function diagnoseModuleDrift(ctx = {}) {
   const checks = [];
   let issues = 0;
@@ -1547,7 +1600,11 @@ async function diagnoseAsync(refreshEnv = false) {
     // hook files and live in a different directory (#495).
     const moduleDrift = diagnoseModuleDrift();
     checks.push(...moduleDrift.checks);
-    return drift.issues + moduleDrift.issues;
+    // Audit-ledger health (P0): telemetry anomalies are not hook drift, but
+    // they ride the same repo-scoped group and must be surfaced by doctor.
+    const ledger = diagnoseAuditLedger();
+    checks.push(...ledger.checks);
+    return drift.issues + moduleDrift.issues + ledger.issues;
   });
 
   // Wait for ALL parallel groups
@@ -3225,6 +3282,7 @@ module.exports = {
   diagnoseHookDrift,
   syncGlobalHooksFromRepo,
   diagnoseModuleDrift,
+  diagnoseAuditLedger,
   syncModulesFromRepo,
   resolveExecutedModuleDirs,
   executedModulePath,

package/lib/gate-audit.ts

@@ -14,6 +14,7 @@ import {
   renameSync,
   statSync,
   chmodSync,
+  rmSync,
 } from 'fs';
 import { join } from 'path';
 
@@ -23,6 +24,7 @@ const AUDIT_DIR = '.xp-gate';
 const AUDIT_FILE = 'audit.jsonl';
 const MAX_FILE_BYTES = 10 * 1024 * 1024; // 10 MB
 const MAX_ARCHIVES = 3;
+const MAX_PLAUSIBLE_DURATION_MS = 6 * 60 * 60 * 1000; // 6h — no single gate runs longer
 
 // ── Types ────────────────────────────────────────────────────────────────────
 
@@ -85,6 +87,75 @@ export function appendAuditEntry(
   }
 }
 
+// ── Pre-commit staging ───────────────────────────────────────────────────────
+// Pre-commit cannot know the commit it is about to create (HEAD is still the
+// parent there), so per-gate entries are staged to a sidecar and stamped with
+// the real commit by post-commit. Fallback safety: `flushPendingAudit` also
+// runs at the START of the next pre-commit, so if post-commit never fired
+// (hooks skipped, exception) the entries still land, attributed by `git log -1`
+// at that later point — slightly late but never lost, never misattributed to
+// the wrong commit when post-commit does run.
+
+const PENDING_SUFFIX = 'audit.pending.jsonl';
+
+function pendingPath(repoRoot: string): string {
+  return join(repoRoot, AUDIT_DIR, PENDING_SUFFIX);
+}
+
+/** Stage one entry for the not-yet-created commit. Never throws. */
+export function stageAuditEntry(entry: GateAuditEntry, repoRoot: string = process.cwd()): void {
+  try {
+    const dir = join(repoRoot, AUDIT_DIR);
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    appendFileSync(pendingPath(repoRoot), JSON.stringify(entry) + '\n', 'utf8');
+  } catch (err) {
+    console.error('[xp-gate audit] Failed to stage entry:', (err as Error).message);
+  }
+}
+
+/**
+ * Move staged entries into audit.jsonl, stamped with the real commit hash.
+ * Idempotent and safe to call when nothing is staged. A blank/absent hash
+ * leaves `commit_hash` exactly as staged so a wrong commit is never invented.
+ */
+export function flushPendingAudit(
+  repoRoot: string = process.cwd(),
+  commitHash: string = '',
+): number {
+  const p = pendingPath(repoRoot);
+  if (!existsSync(p)) return 0;
+  let flushed = 0;
+  try {
+    const raw = readFileSync(p, 'utf8');
+    const lines = raw.split('\n').filter((l) => l.trim());
+    for (const line of lines) {
+      let entry: GateAuditEntry;
+      try {
+        entry = JSON.parse(line) as GateAuditEntry;
+      } catch {
+        // A torn line (interrupted mid-write) is dropped rather than crashing
+        // the hook that is trying to flush a previous run's leftovers.
+        continue;
+      }
+      if (commitHash) entry.commit_hash = commitHash;
+      appendAuditEntry(entry, repoRoot);
+      flushed++;
+    }
+    rmSyncSafe(p);
+  } catch (err) {
+    console.error('[xp-gate audit] Failed to flush pending entries:', (err as Error).message);
+  }
+  return flushed;
+}
+
+function rmSyncSafe(p: string): void {
+  try {
+    rmSync(p, { force: true });
+  } catch {
+    /* best effort */
+  }
+}
+
 /**
  * Read the last N entries from the audit log.
  */
@@ -152,7 +223,10 @@ function aggregateByGate(entries: GateAuditEntry[]): Map<string, { total: number
   const buckets = new Map<string, { total: number; passed: number; ms: number; issues: number; anomaly_count: number }>();
 
   for (const e of entries) {
-    const b = buckets.get(e.gate_id) ?? { total: 0, passed: 0, ms: 0, issues: 0, anomaly_count: 0 };
+    // Tolerate malformed/legacy rows: a missing gate_id would otherwise create
+    // an `undefined` bucket key (and crash the sort comparing it to a string).
+    const gateId = typeof e.gate_id === 'string' && e.gate_id ? e.gate_id : 'unknown';
+    const b = buckets.get(gateId) ?? { total: 0, passed: 0, ms: 0, issues: 0, anomaly_count: 0 };
     b.total += 1;
     if (e.passed) b.passed += 1;
     // Issue #370: exclude anomalous durations from ms aggregation. REQ-B: a
@@ -163,8 +237,10 @@ function aggregateByGate(entries: GateAuditEntry[]): Map<string, { total: number
     } else if (typeof e.duration_ms === 'number') {
       b.ms += e.duration_ms;
     }
-    b.issues += e.issues_found;
-    buckets.set(e.gate_id, b);
+    // A malformed/legacy row with a non-numeric issues_found must not turn
+    // the whole gate's average into NaN.
+    b.issues += Number.isFinite(e.issues_found) ? e.issues_found : 0;
+    buckets.set(gateId, b);
   }
 
   return buckets;
@@ -202,6 +278,70 @@ export function computeStats(
   return results;
 }
 
+export interface AuditAnomalies {
+  /** Entries with an explicit duration_anomaly flag (Issue #370). */
+  flagged: number;
+  /** Entries with a null duration + reason (REQ-B unmeasurable). */
+  null_with_reason: number;
+  /** Entries persisting a provably-impossible duration (>6h / negative). */
+  implausible_duration: number;
+  /** Entries with no commit attribution (the off-by-one bug's fingerprints). */
+  missing_commit: number;
+  /** Sum of the above — the number CI should treat as "must be 0". */
+  total: number;
+  /** Running counter of entries scanned. */
+  scanned: number;
+}
+
+/**
+ * Count audit-health problems so CI can fail when the ledger is untrustworthy.
+ *
+ * These are exactly the artefacts of the two telemetry bugs we fixed: epoch
+ * durations (implausible_duration) and misattributed/blank commits
+ * (missing_commit). A clean ledger returns total=0.
+ *
+ * `since` (ISO-8601) scopes the check to entries at/after that instant. Both
+ * bugs predate the fix and left ~900 historical rows in the ledger; a CI gate
+ * that counted them would be permanently red. Scoping by the fix date turns
+ * the gate into "no NEW anomalies", which is exactly what we can enforce.
+ */
+export function computeAnomalies(repoRoot: string = process.cwd(), since?: string): AuditAnomalies {
+  const logPath = join(repoRoot, AUDIT_DIR, AUDIT_FILE);
+  const entries = parseAuditEntries(logPath);
+  let flagged = 0;
+  let null_with_reason = 0;
+  let implausible = 0;
+  let missingCommit = 0;
+  let considered = 0;
+  for (const e of entries) {
+    if (since && typeof e.timestamp === 'string' && e.timestamp < since) continue;
+    considered += 1;
+    if (e.duration_anomaly === true) flagged += 1;
+    if (e.duration_ms === null && e.duration_reason) null_with_reason += 1;
+    if (typeof e.duration_ms === 'number'
+      && (!Number.isFinite(e.duration_ms) || e.duration_ms < 0 || e.duration_ms > MAX_PLAUSIBLE_DURATION_MS)) {
+      implausible += 1;
+    }
+    if (!e.commit_hash || e.commit_hash === 'unknown') missingCommit += 1;
+  }
+  return {
+    flagged,
+    null_with_reason,
+    implausible_duration: implausible,
+    missing_commit: missingCommit,
+    total: implausible + missingCommit,
+    scanned: considered,
+  };
+}
+
+/**
+ * Entries at/after this instant are expected to be clean. It is the date the
+ * two telemetry bugs were fixed; anything older is grandfathered because it
+ * cannot be re-measured. Keep in sync with the fix commit if you regenerate.
+ */
+export const AUDIT_ANOMALY_SINCE = '2026-10-30T00:00:00.000Z';
+
+
 /**
  * Rotate the audit log if it exceeds MAX_FILE_BYTES.
  * Renames current file to .1, shifts existing archives.
@@ -250,24 +390,48 @@ function runCli(): void {
 
   if (command === 'record') {
     const opts = parseCliOptions(args.slice(1));
+    // Writer-side backstop: never persist an implausible duration (epoch-sized
+    // `end - 0`, unit error). Any caller-supplied reason wins; otherwise a
+    // rejected number is recorded as null + poisoned_start_ms.
+    const rawDuration = opts['duration-ms'] === 'null' ? null : parseInt(opts['duration-ms'] || '0', 10);
+    const durationCheck = sanitizeDurationMs(rawDuration);
+    const durationReason = opts['duration-reason'] || durationCheck.duration_reason;
     const entry: GateAuditEntry = {
       timestamp: new Date().toISOString(),
       gate_id: opts['gate-id'] || 'unknown',
       gate_name: opts['gate-name'] || 'unknown',
       passed: opts['passed'] === 'true',
       issues_found: parseInt(opts['issues-found'] || '0', 10),
-      duration_ms: opts['duration-ms'] === 'null' ? null : parseInt(opts['duration-ms'] || '0', 10),
+      duration_ms: durationCheck.duration_ms,
       trigger: (opts['trigger'] as 'commit' | 'push' | 'manual') || 'manual',
       repo_path: process.cwd(),
-      commit_hash: getCommitHash(),
+      // Pre-commit runs BEFORE the commit object exists, so `git rev-parse HEAD`
+      // here resolves the PARENT. resolveCommitHash lets an explicit
+      // --commit-hash win and falls back to HEAD otherwise.
+      commit_hash: resolveCommitHash(opts),
       // Issue #370: only set when explicitly flagged (omit field otherwise)
       ...(opts['duration-anomaly'] === 'true' ? { duration_anomaly: true } : {}),
       // REQ-B: why the duration is null — never guess a number for it.
-      ...(opts['duration-reason'] ? { duration_reason: opts['duration-reason'] as 'poisoned_start_ms' | 'clock_skew' } : {}),
+      ...(durationReason ? { duration_reason: durationReason as 'poisoned_start_ms' | 'clock_skew' } : {}),
       // #507: only set when provided (omit field otherwise)
       ...(opts['detail'] ? { detail: opts['detail'] } : {}),
     };
-    appendAuditEntry(entry);
+    // Pre-commit (trigger=commit) is staging for a commit that does not exist
+    // yet: park it in the pending sidecar so post-commit can stamp the real
+    // hash. Its commit_hash is deliberately blank until then — stamping the
+    // parent here is exactly the off-by-one we are removing.
+    if (entry.trigger === 'commit' && !opts['commit-hash']) {
+      entry.commit_hash = '';
+      stageAuditEntry(entry);
+    } else {
+      appendAuditEntry(entry);
+    }
+  } else if (command === 'flush-pending') {
+    // Called by post-commit with the now-real HEAD.
+    const opts = parseCliOptions(args.slice(1));
+    const n = flushPendingAudit(process.cwd(), opts['commit-hash'] || '');
+    // Quiet by default (hooks are noisy enough); --report prints the count.
+    if (opts['report'] === 'true') console.log(`flushed ${n}`);
   } else {
     console.error(`Unknown audit command: ${command}`);
     process.exit(1);
@@ -297,3 +461,47 @@ export function getCommitHash(): string {
     return 'unknown';
   }
 }
+
+/**
+ * Which commit a gate entry belongs to.
+ *
+ * Pre-commit fires BEFORE the commit object exists, so `git rev-parse HEAD`
+ * there returns the PARENT. If the hook let that stand, every gate entry would
+ * be filed under the previous commit — the newest commit would look like it
+ * "ran no gates", and any per-commit battery analysis silently mixes one
+ * commit's timings into another's. An explicit `--commit-hash` (from a caller
+ * that knows the subject, e.g. post-commit) always wins; otherwise HEAD is the
+ * subject (push/manual) and the resolver is used.
+ *
+ * `headResolver` is injectable so the precedence can be tested without a repo.
+ */
+export function resolveCommitHash(
+  opts: Record<string, string>,
+  headResolver: () => string = getCommitHash,
+): string {
+  const explicit = (opts['commit-hash'] || '').trim();
+  if (explicit) return explicit;
+  return headResolver();
+}
+
+// ── Duration sanity (last line of defence) ───────────────────────────────────
+// The shell side sanitizes start_ms before computing the delta
+// (githooks/lib/audit-sanitize.sh, REQ-B). This is the writer-side backstop:
+// if any caller path ever hands us a duration that is provably not a real
+// gate runtime, refuse to persist it as a number. An epoch-sized value (the
+// old bug produced `end - 0 = now`, ~1.7e12) or anything absurdly large would
+// otherwise poison every average and p90 downstream and looks exactly like a
+// "78-hour gate". Precision matters less than honesty: a rejected duration is
+// null with a reason, never a fabricated number.
+
+export function sanitizeDurationMs(
+  raw: number | null,
+): { duration_ms: number | null; duration_reason?: 'poisoned_start_ms' } {
+  if (raw === null) return { duration_ms: null };
+  if (!Number.isFinite(raw) || raw < 0 || raw > MAX_PLAUSIBLE_DURATION_MS) {
+    // >6h or negative can only come from a poisoned start_ms (epoch-sized
+    // value, unit error) — mark it, don't guess a number.
+    return { duration_ms: null, duration_reason: 'poisoned_start_ms' };
+  }
+  return { duration_ms: raw };
+}

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T08:22:09.989Z",
+  "checked_at": "2026-10-30T12:14:24.278Z",
   "source": "network"
 }

package/lib/shared-utils.js

@@ -34,7 +34,10 @@ function readXpGateConfig() {
 }
 
 function copyHooks(srcDir, destDir) {
-  ['pre-commit', 'pre-push', 'post-merge'].forEach(hook => {
+  // post-commit carries the audit-attribution flush and --no-verify detection.
+  // It was absent here, so neither ever ran for installed users (the source
+  // existed but no installer copied it).
+  ['pre-commit', 'pre-push', 'post-commit', 'post-merge'].forEach(hook => {
     const src = path.join(srcDir, 'hooks', hook);
     const dest = path.join(destDir, hook);
     if (fs.existsSync(src)) {

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** 3c5e9aaf
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.33.0.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** 3c5e9aaf
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.33.0.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** 3c5e9aaf
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.33.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 78786c3f
+**Commit:** 3c5e9aaf
 **Branch:** main
-**Version:** 0.32.2.0
+**Version:** 0.33.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.