@boyingliu01/xp-gate 0.34.1 → 0.35.1

package/scripts/__tests__/sync-package-content-isolation.test.js

@@ -0,0 +1,73 @@
+/**
+ * @test REQ-645
+ * @intent `sync-package-content.test.js` used the REAL repository root as the
+ *        spawn cwd:
+ *
+ *          const WORKTREE_PATH = path.resolve(__dirname, '..', '..', '..', '..');
+ *
+ *        Four levels up from `src/npm-package/scripts/__tests__/` is the repo
+ *        root, not a temp dir. The tests then ran the real sync script with
+ *        `cwd: WORKTREE_PATH`, so the script's writes landed in the repository
+ *        instead of a sandbox. CI's Gate 5 failed at `vitest-worktree-guard`:
+ *
+ *          Work tree polluted by the test run — 1 path(s) the run introduced:
+ *              M src/npm-package/mock-policy/gate-m3.ts
+ *
+ *        The reason this is easy to miss: the pollution is CONDITIONAL. The
+ *        script's writes are idempotent, so when the mirror already matches the
+ *        source nothing changes and the run looks clean. It only dirties the tree
+ *        when the checked-out commit happens to carry a stale mirror — which is
+ *        exactly when CI is checking out a commit that the fix was supposed to
+ *        validate. So it presents as "flaky, just re-run it", and re-running
+ *        hides the cause while leaving the latent defect in place.
+ *
+ *        The guard catching it is good, but it catches the CONSEQUENCE. This file
+ *        pins the CAUSE: a test may not write into the repository.
+ * @covers AC-670-54, AC-670-55
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..', '..', '..');
+const TEST_FILE = path.join(
+  REPO_ROOT, 'src', 'npm-package', 'scripts', '__tests__', 'sync-package-content.test.js',
+);
+
+function readSuite() {
+  return fs.readFileSync(TEST_FILE, 'utf8');
+}
+
+describe('sync-package-content tests must not write into the repository (#645)', () => {
+  it('AC-670-54: no test uses the repo root as a spawn cwd', () => {
+    const source = readSuite();
+    // The exact offending expression. `path.resolve(__dirname, '..' x4)` from the
+    // test file IS the repo root -- there is no temp dir anywhere in that chain.
+    const offenders = source
+      .split('\n')
+      .map((line, i) => ({ line: line.trim(), n: i + 1 }))
+      .filter((x) => /WORKTREE_PATH\s*=\s*path\.resolve\(__dirname/.test(x.line));
+    expect(
+      offenders,
+      `tests still anchor on the real repo root:\n${offenders.map((o) => `  :${o.n} ${o.line}`).join('\n')}`,
+    ).toEqual([]);
+  });
+
+  it('AC-670-55: the sync tests run against a temp worktree, not the checkout', () => {
+    const source = readSuite();
+    // Whatever the variable is called, the cwd handed to a spawned sync must be
+    // one the test CREATED. mkdtemp is the only way to guarantee that: a path
+    // built from __dirname is by construction inside the repository.
+    expect(source, 'suite must create a throwaway worktree').toMatch(/mkdtemp/);
+    // Every spawnSync `cwd:` must point at that temp root, never at the checkout.
+    const cwdLines = source
+      .split('\n')
+      .filter((line) => /^\s*cwd:\s*/.test(line))
+      .map((line) => line.trim());
+    expect(cwdLines.length, 'expected at least one spawn cwd').toBeGreaterThan(0);
+    for (const line of cwdLines) {
+      expect(line, `spawn cwd escapes the sandbox: ${line}`).not.toMatch(/cwd:\s*REPO_ROOT/);
+    }
+  });
+});

package/scripts/__tests__/sync-package-content.test.js

@@ -27,6 +27,37 @@ function writeDoc(filePath, content) {
   fs.writeFileSync(filePath, content, 'utf8');
 }
 
+/**
+ * Copy the canonical source trees a sync run READS into `destRoot` (#645).
+ *
+ * The sync script mirrors githooks/, skills/, plugins/ and every src/ module into
+ * the package. Seeding the whole of `src/` except the package itself keeps this
+ * list from rotting: syncModules() gains a module, this helper needs no edit.
+ * Only reads from the real checkout -- nothing is ever written back to it.
+ */
+function seedCanonicalSources(realRoot, destRoot) {
+  const real = realRoot || path.resolve(__dirname, '..', '..', '..', '..');
+  const dest = destRoot;
+  for (const tree of ['githooks', 'skills', 'plugins']) {
+    const from = path.join(real, tree);
+    if (fs.existsSync(from)) fs.cpSync(from, path.join(dest, tree), { recursive: true });
+  }
+  const srcRoot = path.join(real, 'src');
+  for (const name of fs.readdirSync(srcRoot)) {
+    // The package itself is the DESTINATION of the sync, not a canonical source;
+    // copying it would let the test compare a mirror against a stale mirror.
+    if (name === 'npm-package') continue;
+    const from = path.join(srcRoot, name);
+    if (fs.statSync(from).isDirectory()) {
+      fs.cpSync(from, path.join(dest, 'src', name), { recursive: true });
+    }
+  }
+  fs.mkdirSync(path.join(dest, 'src', 'npm-package', 'scripts'), { recursive: true });
+  for (const rel of ['scripts/sync-package-content.js', 'package.json']) {
+    fs.copyFileSync(path.join(srcRoot, 'npm-package', rel), path.join(dest, 'src', 'npm-package', rel));
+  }
+}
+
 describe('checkDocsDrift', () => {
   let tempDir;
   let preCommitPath;
@@ -269,12 +300,56 @@ describe('syncGateScripts', () => {
  * @covers AC-450-01, AC-450-02, AC-450-03, AC-450-04
  */
 describe('syncHooks', () => {
-  const WORKTREE_PATH = path.resolve(__dirname, '..', '..', '..', '..');
+  // #645: run the sync against a THROWAWAY worktree, never the checkout.
+  //
+  // This block used to spawn the real sync script with
+  //     cwd: path.resolve(__dirname, '..', '..', '..', '..')
+  // -- four levels up from src/npm-package/scripts/__tests__ is the REPOSITORY
+  // ROOT, not a temp dir -- so the script's writes landed in the repo and CI's
+  // Gate 5 failed at vitest-worktree-guard with
+  //     Work tree polluted by the test run: M src/npm-package/mock-policy/gate-m3.ts
+  //
+  // The pollution was CONDITIONAL (the writes are idempotent, so it only dirties
+  // the tree when the checked-out commit carries a stale mirror), which made it
+  // look flaky and encouraged "just re-run it" -- hiding the cause. The guard
+  // catches the consequence; a temp cwd removes the cause.
+  const REAL_REPO_ROOT = path.resolve(__dirname, '..', '..', '..', '..');
+  const TMP_WORKTREE = fs.mkdtempSync(path.join(os.tmpdir(), 'xp-gate-sync-hooks-'));
+  const WORKTREE_PATH = TMP_WORKTREE;
   const PKG_ROOT = path.join(WORKTREE_PATH, 'src', 'npm-package');
   const HOOKS_DIR = path.join(PKG_ROOT, 'hooks');
   const syncScript = path.join(WORKTREE_PATH, 'src', 'npm-package', 'scripts', 'sync-package-content.js');
   const nodeExe = process.execPath;
 
+  /**
+   * Lay out just enough of the repo shape inside the temp root for the sync script
+   * to read its canonical sources and write its mirrors. Copies only the trees the
+   * script touches: githooks/ (the hook source of truth) and the packages it
+   * mirrors into. The REAL checkout is only ever READ.
+   */
+  function seedTempWorktree() {
+    seedCanonicalSources(REAL_REPO_ROOT, WORKTREE_PATH);
+    fs.mkdirSync(path.join(PKG_ROOT, 'scripts'), { recursive: true });
+    fs.copyFileSync(
+      path.join(REAL_REPO_ROOT, 'src', 'npm-package', 'scripts', 'sync-package-content.js'),
+      syncScript,
+    );
+    // The script resolves its package root relative to its own location, so it
+    // must sit at <temp>/src/npm-package/scripts/ exactly as in the real tree.
+    fs.copyFileSync(
+      path.join(REAL_REPO_ROOT, 'src', 'npm-package', 'package.json'),
+      path.join(PKG_ROOT, 'package.json'),
+    );
+  }
+
+  beforeAll(() => {
+    seedTempWorktree();
+  });
+
+  afterAll(() => {
+    fs.rmSync(TMP_WORKTREE, { recursive: true, force: true });
+  });
+
   // Ensure hooks are re-synced once before tests run; share the result.
   let syncOk = false;
   beforeAll(() => {
@@ -473,9 +548,41 @@ describe('checkAdapterDrift', () => {
 const { spawnSync } = require('child_process');
 
 describe('sync-package-content subprocess invocation', () => {
-  const WORKTREE_PATH = path.resolve(__dirname, '..', '..', '..', '..');
+  // #645: same rule as the syncHooks block above -- a test may not write into the
+  // repository. `path.resolve(__dirname, '..', '..', '..', '..')` IS the repo root,
+  // so spawning the sync script with it as cwd copied mirrors over the checkout and
+  // CI's Gate 5 failed at vitest-worktree-guard.
+  //
+  // This block additionally DELETES package directories to prove the sync
+  // recreates them, which is precisely the operation that must never touch a real
+  // checkout. Everything therefore runs inside a throwaway tree seeded from the
+  // real sources (read-only).
+  const REAL_REPO_ROOT = path.resolve(__dirname, '..', '..', '..', '..');
+  const TMP_WORKTREE = fs.mkdtempSync(path.join(os.tmpdir(), 'xp-gate-sync-sub-'));
+  const WORKTREE_PATH = TMP_WORKTREE;
   const PKG_ROOT = path.join(WORKTREE_PATH, 'src', 'npm-package');
   const REPO_ROOT = path.join(WORKTREE_PATH);
+
+  function seedTempWorktree() {
+    seedCanonicalSources(REAL_REPO_ROOT, WORKTREE_PATH);
+    fs.mkdirSync(path.join(PKG_ROOT, 'scripts'), { recursive: true });
+    fs.copyFileSync(
+      path.join(REAL_REPO_ROOT, 'src', 'npm-package', 'scripts', 'sync-package-content.js'),
+      path.join(PKG_ROOT, 'scripts', 'sync-package-content.js'),
+    );
+    fs.copyFileSync(
+      path.join(REAL_REPO_ROOT, 'src', 'npm-package', 'package.json'),
+      path.join(PKG_ROOT, 'package.json'),
+    );
+  }
+
+  beforeAll(() => {
+    seedTempWorktree();
+  });
+
+  afterAll(() => {
+    fs.rmSync(TMP_WORKTREE, { recursive: true, force: true });
+  });
   const CORE_SKILLS = [
     'admin-template-guidelines',
     'delphi-review',

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e583bcfb
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.34.1.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e583bcfb
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.34.1.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** e583bcfb
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.34.1.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.