@boyingliu01/xp-gate 0.33.1 → 0.33.2

package/gate-3.sh

@@ -172,8 +172,19 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                   const entries = baseline.functions || baseline.entries || baseline;
                   if (Array.isArray(entries)) {
                     for (const e of entries) {
-                      if (!e || !e.file || !e.name) continue;
-                      known.set(norm(e.file) + "::" + e.name, Number(e.ccn) || 0);
+                      // #632: accept the key the baseline WRITER actually emits.
+                      // tools/Update-ComplexityBaseline.ps1 (the tool this gate
+                      // points at in its own fix-it message) writes "function",
+                      // while this reader only knew "name" -- so every entry was
+                      // dropped, "known" stayed empty, and every function above
+                      // the threshold became a brand-new function. The ratchet
+                      // could never pass. Both spellings are read: this is a
+                      // reader, and the writer vocabulary is not ours to
+                      // redefine from here.
+                      if (!e || !e.file) continue;
+                      const fnName = e.name || e.function;
+                      if (!fnName) continue;
+                      known.set(norm(e.file) + "::" + fnName, Number(e.ccn) || 0);
                     }
                   }
                   // The measurement emits ABSOLUTE paths (pwsh resolved them), while
@@ -529,13 +540,43 @@ else
       # this, a crashing or mis-invoked lizard yields 0 warnings and the gate
       # reports PASSED on zero analysed functions -- the same silent-success
       # failure this issue is about.
+      #
+      # #666: "no rows" has TWO causes and they must not share a verdict. A
+      # module of pure constants legitimately has zero functions, and lizard
+      # emits no row for it at all (measured: `lizard pure_data.py --csv` prints
+      # nothing and exits 0). That was reported as `lizard_output_unparsable`
+      # /WARN, which is the message for a BROKEN lizard -- so a healthy run on a
+      # data-only diff was indistinguishable from a tooling fault. The two are
+      # separated by a POSITIVE probe: ask lizard to describe a fixture known to
+      # contain a function. If it produces rows, lizard works and the input
+      # simply had no functions (SKIP, `no_functions_in_input`); if it does not,
+      # the tool really is broken (WARN, `lizard_output_unparsable`).
       if ! printf '%s\n' "$CC_CSV_FLAT" | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { found = 1; exit }
                                                  END { exit(found ? 0 : 1) }'; then
-        echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
-        GATE_3_STATUS="WARN"
-        # Consumed by the sourcing parent (pre-commit report JSON), not here.
-        # shellcheck disable=SC2034
-        GATE_3_REASON="lizard_output_unparsable"
+        _lizard_probe_dir=$(mktemp -d 2>/dev/null || echo "${TMPDIR:-/tmp}")
+        _lizard_probe_file="$_lizard_probe_dir/xp-gate-lizard-probe.py"
+        printf 'def _xp_gate_probe(x):\n    if x:\n        return 1\n    return 0\n' > "$_lizard_probe_file" 2>/dev/null
+        _lizard_probe_rows=0
+        if [ -f "$_lizard_probe_file" ]; then
+          _lizard_probe_rows=$(printf '%s\n' "$_lizard_probe_file" \
+            | lizard_batches --csv 2>/dev/null \
+            | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { c++ } END { print c + 0 }')
+        fi
+        rm -rf "$_lizard_probe_dir" 2>/dev/null || true
+        if [ "${_lizard_probe_rows:-0}" -gt 0 ]; then
+          echo "⏭️  SKIPPED - Complexity: the changed source files define no functions (pure data module)."
+          echo "   Verified: lizard parsed a probe fixture normally, so this is an empty result set, not a broken tool."
+          GATE_3_STATUS="SKIP"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="no_functions_in_input"
+        else
+          echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
+          GATE_3_STATUS="WARN"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="lizard_output_unparsable"
+        fi
       elif [ "$CC_WARNINGS" -gt 0 ]; then
         echo "$CC_OUTPUT"
         echo ""

package/gate-8.sh

@@ -59,10 +59,24 @@ fi
 # revisions and reports "0 commits scanned" on a pre-commit run -- so a staged
 # secret was never seen and Gate 8 always passed. `git --staged` scans
 # `git diff --cached`, which is exactly the pre-commit payload (#449).
+#
+# #616: `--all` is a different question, and the index is the wrong place to ask
+# it. Under `xp-gate check . --all` the user asked "is the whole tree clean", the
+# index is usually empty, `git --staged` legitimately found nothing, and that
+# nothing was counted as PASSED -- a secret sitting in a tracked file was
+# invisible to the one command meant to find it. The runner already exports
+# GATE_SCOPE (#589); this fragment just has to read it. `dir --no-git` scans the
+# filesystem so tracked-but-unmodified files are covered.
 GITLEAKS_REPORT="${TMPDIR:-/tmp}/gitleaks-report.json"
 rm -f "$GITLEAKS_REPORT"
-GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --staged --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
-GITLEAKS_EXIT=$?
+if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+  echo "     Scope: --all (scanning the working tree, not the index)"
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD dir --no-git --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
+  GITLEAKS_EXIT=$?
+else
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --staged --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
+  GITLEAKS_EXIT=$?
+fi
 
 if [ "$GITLEAKS_EXIT" -eq 0 ]; then
   # Decide SKIP from the REPORT ARTIFACT, not from log wording. Parsing stdout
@@ -183,7 +197,22 @@ fi
 # if-condition (errexit-exempt); a non-zero hook exit lands in the else branch.
 if command -v detect-secrets-hook >/dev/null 2>&1 && [ -f ".secrets.baseline" ]; then
   DS_TMP="$(dirname "$(mktemp -u)")/ds-output.$$"
-  if git diff --cached --name-only --diff-filter=ACM -z \
+  # #616: same scope split as the gitleaks call above. Under `--all` the index is
+  # usually empty, so piping `git diff --cached -z` into xargs fed the hook zero
+  # files and it reported success without reading anything.
+  if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+    if git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline > "$DS_TMP" 2>&1; then
+      echo "     ✅ detect-secrets PASSED - no new secrets beyond baseline (scope: --all)."
+    else
+      cat "$DS_TMP"
+      echo ""
+      echo "     ❌ BLOCKED - detect-secrets found secrets not in .secrets.baseline."
+      echo "   If these are false positives, regenerate the baseline (cross-platform):"
+      echo "     detect-secrets scan --update .secrets.baseline && git add .secrets.baseline"
+      rm -f "$DS_TMP"
+      exit 1
+    fi
+  elif git diff --cached --name-only --diff-filter=ACM -z \
       | xargs -0 detect-secrets-hook --baseline .secrets.baseline > "$DS_TMP" 2>&1; then
     echo "     ✅ detect-secrets PASSED - no new secrets beyond baseline."
   else

package/gate-9.sh

@@ -32,8 +32,20 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
   GATE_9_STATUS="WARN"
 else
-  # Get staged files filtered to Semgrep-supported languages
-  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  # Get staged files filtered to Semgrep-supported languages.
+  #
+  # #616: under `--all` the index is usually empty, so the staged diff yielded no
+  # files and the gate reported SKIPPED -- "no supported language files changed"
+  # -- for a run whose whole purpose was to scan the tree. Same fail-open shape
+  # #589 fixed in Gate 3, one layer down: the CLI says the tree was checked and
+  # the fragment checks a diff that does not exist. The runner exports GATE_SCOPE;
+  # read it and enumerate tracked files instead.
+  if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+    echo "     Scope: --all (scanning tracked files, not the index)"
+    SEMGREP_FILES=$(git ls-files 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  else
+    SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  fi
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"

package/gates/gate-7.ts

@@ -27,16 +27,13 @@ export function runGate7(input: GateInput): GateOutput {
     return { status: 'PASS', messages, exitCode: 0 };
   }
 
-  // Check for IaC adapter script (bash path for pre-commit context)
-  const adapterPath = findIaCAdapter(cwd);
-  if (!adapterPath) {
-    messages.push('ℹ️  SKIP - IaC adapter not found');
-    messages.push('⏭️  SKIPPED - IaC security (no IaC adapter found)');
-    recordAudit('gate-7', 'iac-security', 'SKIP', 0, startMs);
-    return { status: 'SKIP', messages, exitCode: 0 };
-  }
-
-  // Run checkov if available (preferred tool)
+  // checkov is the PREFERRED engine (see the module header and the fallback
+  // message below), so it is tried FIRST. #650: the adapter lookup used to run
+  // before this and SKIP the gate whenever a consumer project had no vendored
+  // `githooks/adapters/iac.sh` -- even with checkov installed and on PATH. A
+  // security gate that skips because an optional helper script is absent, while
+  // the real scanner is available, reports "nothing to check" about code that was
+  // never checked. The bash adapter is the FALLBACK, so it is consulted after.
   const checkov = isToolAvailable('checkov', cwd);
   if (checkov.available) {
     return runCheckov(checkov.path, checkov.via, iacFiles, cwd, startMs, messages);
@@ -46,6 +43,30 @@ export function runGate7(input: GateInput): GateOutput {
   messages.push('⚠️  checkov not installed — falling back to bash IaC adapter');
   messages.push('   Install: pip install checkov');
 
+  return runBashAdapter(iacFiles, cwd, startMs, messages);
+}
+
+/**
+ * Fallback path: hand the IaC files to the project's bash adapter.
+ *
+ * Extracted from `runGate7` so the primary (checkov) path stays readable and the
+ * entry point stays inside the long-function limit. A missing adapter is a SKIP,
+ * never a PASS: no scan ran, so there is no evidence to report as clean.
+ */
+function runBashAdapter(
+  iacFiles: string[],
+  cwd: string,
+  startMs: number,
+  messages: string[]
+): GateOutput {
+  const adapterPath = findIaCAdapter(cwd);
+  if (!adapterPath) {
+    messages.push('ℹ️  SKIP - IaC adapter not found');
+    messages.push('⏭️  SKIPPED - IaC security (no IaC adapter found)');
+    recordAudit('gate-7', 'iac-security', 'SKIP', 0, startMs);
+    return { status: 'SKIP', messages, exitCode: 0 };
+  }
+
   const result = runTool('bash', [adapterPath, ...iacFiles], { cwd });
   const combinedOutput = result.stdout + result.stderr;
 

package/hooks/gate-3.sh

@@ -172,8 +172,19 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                   const entries = baseline.functions || baseline.entries || baseline;
                   if (Array.isArray(entries)) {
                     for (const e of entries) {
-                      if (!e || !e.file || !e.name) continue;
-                      known.set(norm(e.file) + "::" + e.name, Number(e.ccn) || 0);
+                      // #632: accept the key the baseline WRITER actually emits.
+                      // tools/Update-ComplexityBaseline.ps1 (the tool this gate
+                      // points at in its own fix-it message) writes "function",
+                      // while this reader only knew "name" -- so every entry was
+                      // dropped, "known" stayed empty, and every function above
+                      // the threshold became a brand-new function. The ratchet
+                      // could never pass. Both spellings are read: this is a
+                      // reader, and the writer vocabulary is not ours to
+                      // redefine from here.
+                      if (!e || !e.file) continue;
+                      const fnName = e.name || e.function;
+                      if (!fnName) continue;
+                      known.set(norm(e.file) + "::" + fnName, Number(e.ccn) || 0);
                     }
                   }
                   // The measurement emits ABSOLUTE paths (pwsh resolved them), while
@@ -529,13 +540,43 @@ else
       # this, a crashing or mis-invoked lizard yields 0 warnings and the gate
       # reports PASSED on zero analysed functions -- the same silent-success
       # failure this issue is about.
+      #
+      # #666: "no rows" has TWO causes and they must not share a verdict. A
+      # module of pure constants legitimately has zero functions, and lizard
+      # emits no row for it at all (measured: `lizard pure_data.py --csv` prints
+      # nothing and exits 0). That was reported as `lizard_output_unparsable`
+      # /WARN, which is the message for a BROKEN lizard -- so a healthy run on a
+      # data-only diff was indistinguishable from a tooling fault. The two are
+      # separated by a POSITIVE probe: ask lizard to describe a fixture known to
+      # contain a function. If it produces rows, lizard works and the input
+      # simply had no functions (SKIP, `no_functions_in_input`); if it does not,
+      # the tool really is broken (WARN, `lizard_output_unparsable`).
       if ! printf '%s\n' "$CC_CSV_FLAT" | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { found = 1; exit }
                                                  END { exit(found ? 0 : 1) }'; then
-        echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
-        GATE_3_STATUS="WARN"
-        # Consumed by the sourcing parent (pre-commit report JSON), not here.
-        # shellcheck disable=SC2034
-        GATE_3_REASON="lizard_output_unparsable"
+        _lizard_probe_dir=$(mktemp -d 2>/dev/null || echo "${TMPDIR:-/tmp}")
+        _lizard_probe_file="$_lizard_probe_dir/xp-gate-lizard-probe.py"
+        printf 'def _xp_gate_probe(x):\n    if x:\n        return 1\n    return 0\n' > "$_lizard_probe_file" 2>/dev/null
+        _lizard_probe_rows=0
+        if [ -f "$_lizard_probe_file" ]; then
+          _lizard_probe_rows=$(printf '%s\n' "$_lizard_probe_file" \
+            | lizard_batches --csv 2>/dev/null \
+            | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { c++ } END { print c + 0 }')
+        fi
+        rm -rf "$_lizard_probe_dir" 2>/dev/null || true
+        if [ "${_lizard_probe_rows:-0}" -gt 0 ]; then
+          echo "⏭️  SKIPPED - Complexity: the changed source files define no functions (pure data module)."
+          echo "   Verified: lizard parsed a probe fixture normally, so this is an empty result set, not a broken tool."
+          GATE_3_STATUS="SKIP"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="no_functions_in_input"
+        else
+          echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
+          GATE_3_STATUS="WARN"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="lizard_output_unparsable"
+        fi
       elif [ "$CC_WARNINGS" -gt 0 ]; then
         echo "$CC_OUTPUT"
         echo ""

package/hooks/gate-8.sh

@@ -59,10 +59,24 @@ fi
 # revisions and reports "0 commits scanned" on a pre-commit run -- so a staged
 # secret was never seen and Gate 8 always passed. `git --staged` scans
 # `git diff --cached`, which is exactly the pre-commit payload (#449).
+#
+# #616: `--all` is a different question, and the index is the wrong place to ask
+# it. Under `xp-gate check . --all` the user asked "is the whole tree clean", the
+# index is usually empty, `git --staged` legitimately found nothing, and that
+# nothing was counted as PASSED -- a secret sitting in a tracked file was
+# invisible to the one command meant to find it. The runner already exports
+# GATE_SCOPE (#589); this fragment just has to read it. `dir --no-git` scans the
+# filesystem so tracked-but-unmodified files are covered.
 GITLEAKS_REPORT="${TMPDIR:-/tmp}/gitleaks-report.json"
 rm -f "$GITLEAKS_REPORT"
-GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --staged --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
-GITLEAKS_EXIT=$?
+if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+  echo "     Scope: --all (scanning the working tree, not the index)"
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD dir --no-git --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
+  GITLEAKS_EXIT=$?
+else
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --staged --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
+  GITLEAKS_EXIT=$?
+fi
 
 if [ "$GITLEAKS_EXIT" -eq 0 ]; then
   # Decide SKIP from the REPORT ARTIFACT, not from log wording. Parsing stdout
@@ -183,7 +197,22 @@ fi
 # if-condition (errexit-exempt); a non-zero hook exit lands in the else branch.
 if command -v detect-secrets-hook >/dev/null 2>&1 && [ -f ".secrets.baseline" ]; then
   DS_TMP="$(dirname "$(mktemp -u)")/ds-output.$$"
-  if git diff --cached --name-only --diff-filter=ACM -z \
+  # #616: same scope split as the gitleaks call above. Under `--all` the index is
+  # usually empty, so piping `git diff --cached -z` into xargs fed the hook zero
+  # files and it reported success without reading anything.
+  if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+    if git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline > "$DS_TMP" 2>&1; then
+      echo "     ✅ detect-secrets PASSED - no new secrets beyond baseline (scope: --all)."
+    else
+      cat "$DS_TMP"
+      echo ""
+      echo "     ❌ BLOCKED - detect-secrets found secrets not in .secrets.baseline."
+      echo "   If these are false positives, regenerate the baseline (cross-platform):"
+      echo "     detect-secrets scan --update .secrets.baseline && git add .secrets.baseline"
+      rm -f "$DS_TMP"
+      exit 1
+    fi
+  elif git diff --cached --name-only --diff-filter=ACM -z \
       | xargs -0 detect-secrets-hook --baseline .secrets.baseline > "$DS_TMP" 2>&1; then
     echo "     ✅ detect-secrets PASSED - no new secrets beyond baseline."
   else

package/hooks/gate-9.sh

@@ -32,8 +32,20 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
   GATE_9_STATUS="WARN"
 else
-  # Get staged files filtered to Semgrep-supported languages
-  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  # Get staged files filtered to Semgrep-supported languages.
+  #
+  # #616: under `--all` the index is usually empty, so the staged diff yielded no
+  # files and the gate reported SKIPPED -- "no supported language files changed"
+  # -- for a run whose whole purpose was to scan the tree. Same fail-open shape
+  # #589 fixed in Gate 3, one layer down: the CLI says the tree was checked and
+  # the fragment checks a diff that does not exist. The runner exports GATE_SCOPE;
+  # read it and enumerate tracked files instead.
+  if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+    echo "     Scope: --all (scanning tracked files, not the index)"
+    SEMGREP_FILES=$(git ls-files 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  else
+    SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  fi
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"

package/hooks/pre-commit

@@ -3495,6 +3495,29 @@ else
     GATE_5_STATUS="PASS"
   fi
 fi
+
+# #665: a subset run is exempt from the GLOBAL coverage floor by design (#473),
+# but the exemption was never published, so the persisted report showed
+# `actual.coverage = 29` beside `thresholds.lines = 82` with `status = PASS` and
+# `reason = ""`. The verdict was correct; the RECORD was unreadable, and a record
+# is all `xp-gate audit` and the tech-debt trackers (#636, #638) ever see. Two
+# opposite situations -- "coverage really was 29% and the gate passed it" and
+# "a subset run, global floor not applicable" -- rendered identically.
+#
+# Derived from PARTIAL_TEST_RUN at ONE place instead of being set by hand at each
+# of the six branches that mark a partial run: a reason written at one call site
+# and forgotten at another is the drift that produced the empty reason here.
+if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
+  GATE_5_COVERAGE_APPLIES_TO="subset"
+  # Never overwrite a reason the branch itself recorded (docs_only_change,
+  # no_code_files_changed, ...) -- those explain a different verdict.
+  if [ -z "${GATE_5_DETAIL:-}" ] && [ "$GATE_5_STATUS" = "PASS" ]; then
+    GATE_5_DETAIL="partial_test_run_coverage_not_applicable"
+  fi
+else
+  GATE_5_COVERAGE_APPLIES_TO="project"
+fi
+
 record_gate_audit "gate-5" "tests-coverage" "$GATE_5_STATUS" "0" "$GATE_5_START" "${GATE_5_DETAIL:-}"
 
 # ============================================================================
@@ -3619,7 +3642,26 @@ else
         if [ -f "arch-go.yaml" ] || [ -f "arch-go.yml" ]; then
           if require_tool "arch-go" "Gate 6" "go install github.com/arch-go/arch-go@latest"; then
             echo "     Running arch-go for Go..."
+            # #630: #602 replaced the vacuous Java arm with a status-based verdict,
+            # but the Go arm kept the identical fail-open shape: it piped arch-go
+            # output into `head` and then printed "Go architecture validation
+            # completed" unconditionally. A pipeline's status is `head`'s -- 0 for
+            # ANY non-empty output -- so every arch-go result, contract violations
+            # included, printed "completed" and the commit landed. A gate that
+            # cannot fail is not a gate. Capture the checker's own status and
+            # block on it, as the Python arm above and run_java_build_integrity do.
             arch-go check 2>&1 | head -20
+            # The pipeline's own status is head's, so the checker's verdict has
+            # to come from PIPESTATUS[0] (#630). This is the same reading #602
+            # installed for Java via run_java_build_integrity.
+            _go_arch_rc="${PIPESTATUS[0]}"
+            if [ "$_go_arch_rc" -ne 0 ]; then
+              echo ""
+              echo "❌ BLOCKED - Go architecture contract violations (arch-go, exit $_go_arch_rc)"
+              echo "Fix the layering violation(s) above before committing."
+              GATE_6_REASON_BY_LANG["$CURRENT_LANG"]="architecture_tests_failed"
+              exit 1
+            fi
             echo "     ✅ Go architecture validation completed."
           else
             echo "     ❌ BLOCKED - arch-go not installed"
@@ -4583,7 +4625,7 @@ generate_quality_report() {
       "reason": "${GATE_5_DETAIL:-}",
       "thresholds": { "lines": ${COVERAGE_THRESHOLD}, "functions": null, "branches": null, "statements": null },
       "threshold_source": "${COVERAGE_THRESHOLD_SOURCE}",
-      "actual": { "coverage": "${COV_PCT}" },
+      "actual": { "coverage": "${COV_PCT}", "applies_to": "${GATE_5_COVERAGE_APPLIES_TO:-project}" },
       "failedTests": $FAILED_TESTS_JSON
     },
     "gate6_arch_boyscout": {
@@ -4681,7 +4723,14 @@ ENDJSON
   printf "  %-45s %s\n" "Gate 2: Duplicate Code" "${GATE_2_STATUS:-SKIP}"
   printf "  %-45s %s (warnings: ${CC_WARNINGS:-0})\n" "Gate 3: Complexity" "${GATE_3_STATUS:-SKIP}"
   printf "  %-45s %s (warnings: ${WARNING_COUNT:-0})\n" "Gate 4: Principles" "${GATE_4_STATUS:-SKIP}"
-  printf "  %-45s %s (coverage: ${COV_PCT}%%)\n" "Gate 5: Tests + Coverage" "${GATE_5_STATUS:-SKIP}"
+  # #665: a subset run's percentage describes a SUBSET, not the project, and the
+  # global floor was not applied. Printing the bare number next to a PASS reads as
+  # "29% passed an 82% floor". Say which population the number came from.
+  if [ "${GATE_5_COVERAGE_APPLIES_TO:-project}" = "subset" ]; then
+    printf "  %-45s %s (coverage: ${COV_PCT}%%, subset run -- global floor not checked)\n" "Gate 5: Tests + Coverage" "${GATE_5_STATUS:-SKIP}"
+  else
+    printf "  %-45s %s (coverage: ${COV_PCT}%%)\n" "Gate 5: Tests + Coverage" "${GATE_5_STATUS:-SKIP}"
+  fi
   printf "  %-45s %s\n" "Gate 6: Architecture + Boy Scout" "${GATE_6_STATUS:-SKIP}"
   printf "  %-45s %s\n" "Gate 7: IaC Security" "${GATE_7_STATUS:-SKIP}"
   printf "  %-45s %s\n" "Gate 8: Secret Scanning" "${GATE_8_STATUS:-SKIP}"

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T12:42:58.890Z",
+  "checked_at": "2026-10-30T13:23:44.380Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.33.1",
+  "version": "0.33.2",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.33.1",
+  "version": "0.33.2",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.33.1",
+  "version": "0.33.2",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.33.1",
+  "version": "0.33.2",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.33.1",
+  "version": "0.33.2",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e713c2d1
+**Commit:** b45021b6
 **Branch:** main
-**Version:** 0.33.1.0
+**Version:** 0.33.2.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.