@boyingliu01/xp-gate 0.34.0 → 0.35.0

package/lib/uninstall.js

@@ -8,10 +8,41 @@ const {
   TEMPLATE_DIR,
   GLOBAL_HOOKS_DIR,
   GLOBAL_ADAPTERS_DIR,
+  GLOBAL_MODULES_DIR,
 } = require('./shared-paths.js');
 
 const BACKUP_DIR = path.join(CONFIG_DIR, '.uninstall-backup');
 
+/**
+ * Skill directory roots the CLI installs into, per platform (mirror of the
+ * installers in install-skill.js). Read at call time so a test can point HOME at a
+ * throwaway tree.
+ */
+function globalSkillRoots() {
+  return [
+    path.join(HOME_DIR(), '.qoder', 'skills'),
+    path.join(HOME_DIR(), '.config', 'opencode', 'skills'),
+    path.join(HOME_DIR(), '.claude', 'skills'),
+  ];
+}
+
+/**
+ * Directories inside ~/.config/xp-gate/ that `setup-global` creates and that
+ * `uninstall` used to leave behind (#663).
+ */
+const GLOBAL_INSTALL_RESIDUE = [
+  { key: 'modules', label: 'modules/' },
+  { key: 'node_modules', label: 'node_modules/' },
+  { key: 'package.json', label: 'package.json' },
+  { key: 'package-lock.json', label: 'package-lock.json' },
+  { key: 'xp-gate.json', label: 'xp-gate.json' },
+];
+
+/** User DATA that must survive an uninstall, and must be reported as retained. */
+const GLOBAL_USER_DATA = [
+  { key: '.delphi-config.json', label: '.delphi-config.json (your Delphi expert config)' },
+];
+
 /**
  * Signature strings used to verify file ownership.
  * Each hook/adapter file contains a unique marker string.
@@ -276,6 +307,44 @@ function buildPlan(mode) {
         critical: true
       });
     }
+
+    // #663: `setup-global` also writes modules/, a node_modules/ tree, a
+    // package.json + package-lock.json and the xp-gate.json manifest. None of them
+    // were in the plan, so uninstall printed "Uninstall complete" over an
+    // installation that was still ~1000 files on disk. The residue is not
+    // cosmetic: a leftover node_modules/ makes the NEXT setup-global skip its own
+    // install and reuse a stale dependency tree, and a leftover xp-gate.json
+    // carries the previous version's manifest/lastInit into `doctor`, which then
+    // reports it as the current installation.
+    const configDir = CONFIG_DIR;
+    for (const item of GLOBAL_INSTALL_RESIDUE) {
+      const target = path.join(configDir, item.key);
+      if (fs.existsSync(target)) {
+        const isDir = fs.statSync(target).isDirectory();
+        plan.push({
+          type: isDir ? 'dir' : 'file',
+          path: target,
+          label: `~/.config/xp-gate/${item.label}`,
+          critical: false
+        });
+      }
+    }
+
+    // User data is deliberately NOT deleted. Reporting it is the second half of
+    // the fix: leaving it behind silently is how a user ends up with a stray
+    // config they cannot attribute.
+    for (const item of GLOBAL_USER_DATA) {
+      const target = path.join(configDir, item.key);
+      if (fs.existsSync(target)) {
+        plan.push({
+          type: 'retain',
+          retain: true,
+          path: target,
+          label: item.label,
+          critical: false
+        });
+      }
+    }
   }
 
   // Template dir is common to both modes
@@ -318,6 +387,30 @@ function removeFile(item, config) {
  */
 function removeDir(item) {
   if (!fs.existsSync(item.path)) return false;
+
+  // #664: the global `core.hooksPath` is a SHARED directory -- `git lfs install`
+  // writes its own hooks into it -- so a blind recursive delete of a hooks dir
+  // removes another tool's working files. Classify first; when foreign content is
+  // present, delete only xp-gate's own entries and say what was kept.
+  //
+  // Restricted to directories that ARE a hooks dir. The template dir and the
+  // adapters dir are wholly xp-gate-owned (the template legitimately contains an
+  // `adapters/` subdir, which would otherwise be read as foreign), so only a path
+  // that looks like a hooks root gets the conservative treatment.
+  const isHooksDir = /(^|[\/])hooks$/.test(item.path) || item.label.includes('hooks/');
+  const removal = isHooksDir ? planHooksDirRemoval(item.path) : { action: 'remove-all' };
+  if (removal.action === 'remove-owned-only') {
+    for (const name of removal.owned) {
+      fs.rmSync(path.join(item.path, name), { recursive: true, force: true });
+    }
+    try { fs.rmdirSync(item.path); } catch { /* non-empty: foreign files remain */ }
+    const sources = removal.foreign.map((f) => (f.source ? `${f.name} (${f.source})` : f.name));
+    console.log(`  Removed xp-gate hooks from ${item.label}`);
+    console.log(`  ⚠️  Kept ${removal.foreign.length} file(s) that are not xp-gate's: ${sources.join(', ')}`);
+    console.log('     The global core.hooksPath is a shared directory; other tools (e.g. git lfs) install here.');
+    return true;
+  }
+
   fs.rmSync(item.path, { recursive: true, force: true });
   console.log(`  Removed ${item.label}`);
   return true;
@@ -528,4 +621,135 @@ async function uninstall(args) {
   return 0;
 }
 
-module.exports = { uninstall, isXpGateFile, SIGNATURES };
+/**
+ * Decide which installed skill directories an uninstall may remove (#663).
+ *
+ * `uninstall` never touched skills at all, so 12 of them stayed in
+ * ~/.qoder/skills/ and ~/.config/opencode/skills/ after `uninstall --global`, and
+ * the next `init` treated them as already installed.
+ *
+ * Safety rule from the issue: only remove a directory whose content still matches
+ * the bundled copy. A user's edits are not residue, and deleting them is a far
+ * worse outcome than leaving a stale skill behind -- the user can always delete a
+ * leftover, but cannot recover an edit we removed.
+ *
+ * Returns [{ path, label }] for the directories that are safe to delete.
+ */
+function planSkillRemovals(skillNames, installedRoot, bundledRoot) {
+  const removals = [];
+  if (!Array.isArray(skillNames)) return removals;
+
+  for (const name of skillNames) {
+    if (typeof name !== 'string' || !name) continue;
+    const installedDir = path.join(installedRoot, name);
+    const bundledDir = path.join(bundledRoot, name);
+    if (!fs.existsSync(installedDir)) continue;
+    // No bundled copy to compare against -> cannot prove it is untouched, so keep it.
+    if (!fs.existsSync(bundledDir)) continue;
+    if (directoryContentMatches(installedDir, bundledDir)) {
+      removals.push({ path: installedDir, label: `${installedRoot}/${name}/` });
+    }
+  }
+  return removals;
+}
+
+/**
+ * True when two directory trees hold the same files with the same bytes.
+ * Skips `.git` and node_modules, which are never part of a skill bundle.
+ */
+function directoryContentMatches(a, b) {
+  const filesA = listFilesRelative(a);
+  const filesB = listFilesRelative(b);
+  if (filesA.length !== filesB.length) return false;
+  for (let i = 0; i < filesA.length; i++) {
+    if (filesA[i] !== filesB[i]) return false;
+    try {
+      if (!fs.readFileSync(path.join(a, filesA[i])).equals(fs.readFileSync(path.join(b, filesB[i])))) {
+        return false;
+      }
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+
+/** Sorted relative file paths under a directory. */
+function listFilesRelative(root) {
+  const out = [];
+  const walk = (dir, prefix) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name === '.git' || entry.name === 'node_modules') continue;
+      const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        walk(path.join(dir, entry.name), rel);
+      } else {
+        out.push(rel);
+      }
+    }
+  };
+  walk(root, '');
+  return out.sort();
+}
+
+/**
+ * Decide how a hooks directory may be removed (#664).
+ *
+ * `uninstall` did `rmSync(GLOBAL_HOOKS_DIR, {recursive: true})`. The global
+ * `core.hooksPath` is a SHARED directory: `git lfs install` writes its own hooks
+ * there, and a recursive delete took them with it. The user then had a broken
+ * git-lfs setup and no idea which command caused it — deleting another tool's
+ * working files is a worse outcome than leaving residue the user can see.
+ *
+ * Returns:
+ *   { action: 'remove-all', foreign: [] }        — only xp-gate content, safe
+ *   { action: 'remove-owned-only', foreign }     — foreign files present, keep them
+ *   { action: 'absent', foreign: [] }            — nothing to do
+ */
+function planHooksDirRemoval(hooksDir) {
+  if (!fs.existsSync(hooksDir)) return { action: 'absent', foreign: [] };
+
+  const foreign = [];
+  const owned = [];
+  let entries;
+  try {
+    entries = fs.readdirSync(hooksDir, { withFileTypes: true });
+  } catch {
+    // Unreadable is not "empty": report it as foreign so nothing is deleted blind.
+    return { action: 'remove-owned-only', foreign: [{ name: hooksDir, source: null }] };
+  }
+
+  for (const entry of entries) {
+    const name = entry.name;
+    // xp-gate's own hook entry points and support files.
+    if (OWNED_HOOK_NAMES.includes(name) || name.endsWith('.sh') || name === 'lib') {
+      owned.push(name);
+    } else {
+      foreign.push({ name, source: foreignHookSource(path.join(hooksDir, name)) });
+    }
+  }
+
+  return foreign.length > 0
+    ? { action: 'remove-owned-only', foreign, owned }
+    : { action: 'remove-all', foreign: [], owned };
+}
+
+/** Hook entry points xp-gate installs. */
+const OWNED_HOOK_NAMES = ['pre-commit', 'pre-push', 'post-merge'];
+
+/** 'git-lfs' when the file proves it, else null. Content-based: see doctor.js. */
+function foreignHookSource(filePath) {
+  try {
+    return /\bgit\s+lfs\b/.test(fs.readFileSync(filePath, 'utf8')) ? 'git-lfs' : null;
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { uninstall, isXpGateFile, SIGNATURES, buildPlan, planSkillRemovals, planHooksDirRemoval };

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/principles/rules/solid/dip.ts

@@ -21,19 +21,80 @@ function shouldSkipInstantiation(className: string): boolean {
   return false;
 }
 
+/**
+ * Composition-root markers (#627): a class whose JOB is to construct and wire
+ * concrete implementations. `new` there is dependency injection working, not being
+ * bypassed -- measured on a real 178-file Java repo, all 29 `solid.dip` warnings
+ * landed on 9 such wiring points.
+ *
+ * Matched against the class body text rather than a parsed AST because the rule
+ * consumes whatever each language adapter emits as "class code", and those shapes
+ * differ. These markers are conventions with low ambiguity, which is what makes a
+ * text test acceptable here.
+ */
+const COMPOSITION_ROOT_MARKERS: RegExp[] = [
+  // Spring / Quarkus / Micronaut configuration and bean producers.
+  /@Configuration\b/, /@Bean\b/, /@Provides\b/, /@Produces\b/, /@Factory\b/,
+  // DI module definitions (Dagger / Guice / Spring Java Config).
+  /@Module\b/, /extends\s+AbstractModule\b/, /implements\s+Module\b/,
+  // Framework lifecycle entry points: the framework built the object, so wiring
+  // belongs in these methods.
+  /\bvoid\s+init\s*\(/, /\bvoid\s+initialize\s*\(/, /\bvoid\s+afterPropertiesSet\s*\(/,
+  /\bvoid\s+onCreate\s*\(/,
+];
+
+/** A static factory method -- the class is an assembler by construction. */
+const STATIC_FACTORY_METHOD = /\bstatic\s+[\w<>\[\],.?\s]+\s+\w+\s*\(/;
+
+/**
+ * True when this class body is a composition root.
+ *
+ * A class whose name ends in Factory is already handled by
+ * shouldSkipInstantiation for its PRODUCT names; this covers the assEMBLER itself,
+ * e.g. `PlanCollectorFactory.assemble()` which news eight collaborators.
+ */
+function isCompositionRoot(code: string, className?: string): boolean {
+  if (className && /(?:Factory|Assembler|Module|Config|Configuration|Provider)$/.test(className)) {
+    return true;
+  }
+  if (COMPOSITION_ROOT_MARKERS.some((marker) => marker.test(code))) return true;
+  return STATIC_FACTORY_METHOD.test(code);
+}
+
 /** `new Foo(` -> `Foo`. */
 function classNameFromNewMatch(match: string): string {
   return match.replace(/new\s+/, '').replace(/\s*\(/, '');
 }
 
-/** Violations for one class body: each `new X(` that is not exempt. */
+/**
+ * Violations for one class body: each `new X(` that is not exempt.
+ *
+ * #626: every violation used to carry the CLASS DECLARATION line, because the
+ * adapter only reports where the class starts and the match itself carried no
+ * position. A 200-line class with one instantiation on line 187 therefore pointed
+ * the developer at line 1 -- the message named the right file and the wrong place,
+ * which is the least useful combination: it looks actionable and is not.
+ *
+ * The offset of each match within the class body is now added to the class's
+ * starting line, so the reported line is the `new` expression itself. Multi-line
+ * matches count their newlines, since a match may span `new Foo(\n  arg,\n)`.
+ *
+ * `classBodyStartLine` is the line the adapter says the class begins on; when the
+ * adapter cannot say (0), the violation keeps 0 rather than inventing line 1 --
+ * a placeholder 1 would look like a real location.
+ */
 function instantiationViolations(
-  code: string, line: number, file: string, severity: Severity,
+  code: string, classBodyStartLine: number, file: string, severity: Severity,
 ): Violation[] {
   const violations: Violation[] = [];
-  for (const match of code.match(/new\s+(\w+)\s*\(/g) || []) {
-    const className = classNameFromNewMatch(match);
+  const newPattern = /new\s+(\w+)\s*\(/g;
+  let match: RegExpExecArray | null;
+  while ((match = newPattern.exec(code)) !== null) {
+    const className = classNameFromNewMatch(match[0]);
     if (shouldSkipInstantiation(className)) continue;
+    // Offset -> line: count the newlines between the class start and this match.
+    const linesIntoBody = (code.slice(0, match.index).match(/\n/g) || []).length;
+    const line = classBodyStartLine > 0 ? classBodyStartLine + linesIntoBody : 0;
     violations.push({
       file,
       line,
@@ -45,21 +106,40 @@ function instantiationViolations(
   return violations;
 }
 
+/** Rule severity from the active config, defaulting to warning. */
+function configuredSeverity(): Severity {
+  const settings = getActiveConfig().rules['solid']['dip'];
+  return (settings.severity as Severity) ?? 'warning';
+}
+
+/**
+ * Violations contributed by ONE extracted class.
+ *
+ * Split out of `dipRule.check` to keep that function inside the CCN ratchet: the
+ * #627 composition-root test and the #626 line arithmetic each added a branch, and
+ * the ratchet is there to force exactly this trade rather than a baseline refresh.
+ */
+function classViolations(
+  clsAny: unknown, file: string, severity: Severity,
+): Violation[] {
+  const cls = clsAny as { code?: string; line?: number; name?: string };
+  if (!cls.code) return [];
+  // #627: a composition root's `new` is the inversion working, not bypassed.
+  // Skipping the whole class body is right here: when the class IS the wiring
+  // point, every instantiation in it is wiring.
+  if (isCompositionRoot(cls.code, cls.name)) return [];
+  return instantiationViolations(cls.code, cls.line || 0, file, severity);
+}
+
 export const dipRule: Rule = {
   id: 'solid.dip',
   name: 'Dependency Inversion Principle Rule',
   threshold: 0,
   severity: 'warning',
   check: (file: string, adapter: import('../../types').Adapter): Violation[] => {
-    const settings = getActiveConfig().rules['solid']['dip'];
-    const severity = (settings.severity as Severity) ?? 'warning';
-
-    const violations: Violation[] = [];
-    for (const clsAny of adapter.extractClasses() || []) {
-      const cls = clsAny as { code?: string; line?: number };
-      if (!cls.code) continue;
-      violations.push(...instantiationViolations(cls.code, cls.line || 0, file, severity));
-    }
-    return violations;
+    const severity = configuredSeverity();
+    return (adapter.extractClasses() || []).flatMap((clsAny) =>
+      classViolations(clsAny, file, severity),
+    );
   }
 };

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 6ac15e8c
+**Commit:** c8a73b2a
 **Branch:** main
-**Version:** 0.34.0.0
+**Version:** 0.35.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.