@boyingliu01/xp-gate 0.35.0 → 0.35.1

package/bin/xp-gate.js

@@ -350,6 +350,14 @@ const COMMANDS = {
     },
     usage: 'xp-gate retro [--days N] [--all] [--json] [--sprint <id>]'
   },
+  'rework': {
+    description: 'Report rework: first-pass rate, rounds before landing, top blocking reasons (#651)',
+    run: subargs => {
+      const { main } = require('../lib/rework.js');
+      process.exit(main(subargs));
+    },
+    usage: 'xp-gate rework [--top N] [--dir <path>] [--json]'
+  },
   'crap': {
     description: 'Rank functions by CRAP score (complexity x weak coverage) — advisory, never blocks (#404)',
     run: subargs => {

package/hooks/pre-commit

@@ -627,6 +627,98 @@ record_gate_audit() {
   disown 2>/dev/null || true
 }
 
+# ── #651: journal a blocking exit ──────────────────────────────────────────
+#
+# Failure was invisible in this repo's own history: audit.jsonl had 8,258 records
+# and essentially zero gate FAILs, because pre-commit has ~76 `exit 1` blocking
+# paths and record_gate_audit() is only reached AFTER a gate settles. The moment a
+# gate FAILs and exits, the record that would have said so is never written — so
+# `xp-gate retro` and `sprint-status --rework-check` computed rework over a
+# denominator with no failures in it, and rework trended to zero by construction.
+#
+# The trap catches the failure on its way OUT rather than adding a record call to
+# all 76 branches, which would rot the first time someone adds branch 77.
+_BLOCKING_RECORDED=""
+_record_blocking_exit() {
+  local rc=$?
+  # 0 = success, nothing to journal.
+  [ "$rc" -eq 0 ] && return 0
+  # One record per run. Without the latch, a gate that already recorded and then
+  # exited non-zero would be counted twice, halving the reported first-pass rate.
+  [ -n "$_BLOCKING_RECORDED" ] && return 0
+  _BLOCKING_RECORDED="1"
+
+  # Identify the gate that was running. Status vars are NO*-gradeable: any of
+  # FAIL/BLOCK means this gate is the reason. Latest failing gate wins, which is
+  # the one that actually called exit.
+  local _bg_id="" _bg_name="" _bg_status="" _bg_detail=""
+  local _i _st_var _st
+  for _i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13; do
+    _st_var="GATE_${_i}_STATUS"
+    _st="${!_st_var:-}"
+    case "$_st" in
+      FAIL|BLOCK)
+        # Latest failing gate wins: it is the one that actually called exit.
+        _bg_id="$_i"
+        _bg_status="$_st"
+        ;;
+    esac
+  done
+  local _bg_detail_var="GATE_${_bg_id}_DETAIL"
+  _bg_detail="${!_bg_detail_var:-}"
+
+  # Gate names for the journal. Deliberately short: this runs during shutdown.
+  case "$_bg_id" in
+    0)  _bg_name="Version Consistency" ;;
+    1)  _bg_name="Code Quality" ;;
+    2)  _bg_name="Duplicate Code" ;;
+    3)  _bg_name="Cyclomatic Complexity" ;;
+    4)  _bg_name="Principles" ;;
+    5)  _bg_name="Tests + Coverage" ;;
+    6)  _bg_name="Architecture + Boy Scout" ;;
+    7)  _bg_name="IaC Security" ;;
+    8)  _bg_name="Secret Scanning" ;;
+    9)  _bg_name="Build Integrity" ;;
+    10) _bg_name="SAST Security" ;;
+    11) _bg_name="Sprint Flow" ;;
+    12) _bg_name="File Hygiene" ;;
+    13) _bg_name="Compiler Strictness" ;;
+    *)  _bg_name="unknown" ;;
+  esac
+  [ -n "$_bg_id" ] || _bg_id="unknown"
+
+  # The reason must reach the journal or "top-N failing rules" cannot exist.
+  # Prefer the gate's own detail (it carries the rule/threshold), else the status.
+  local _bg_reason="${_bg_detail:-gate_exit_${rc}}"
+
+  local _bg_start_var="GATE_${_bg_id}_START"
+  local _bg_start="${!_bg_start_var:-}"
+  local _bg_dur="null"
+  if [ -n "$_bg_start" ]; then
+    local _bg_end
+    _bg_end=$(now_ms 2>/dev/null || echo "")
+    if [ -n "$_bg_end" ]; then
+      _bg_dur=$((_bg_end - _bg_start))
+      [ "$_bg_dur" -ge 0 ] 2>/dev/null || _bg_dur="null"
+    fi
+  fi
+
+  # Fire-and-forget, and never let journaling change the exit code.
+  {
+    run_tsx "${PROJECT_ROOT_FOR_AUDIT}/src/npm-package/lib/gate-audit.ts" record \
+      --gate-id "$_bg_id" \
+      --gate-name "$_bg_name" \
+      --passed false \
+      --issues-found 1 \
+      --duration-ms "$_bg_dur" \
+      --trigger commit \
+      --failure-reason "$_bg_reason" \
+      2>/dev/null
+  } >/dev/null 2>&1 || true
+  return 0
+}
+trap _record_blocking_exit EXIT
+
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo "   QUALITY GATES - PRE-COMMIT CHECK"
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

package/lib/__tests__/rework.test.js

@@ -0,0 +1,127 @@
+/**
+ * @test REQ-651 rework
+ * @intent #651 asks for a command that turns the gate journal into the three
+ *        numbers rework management actually needs:
+ *
+ *          1. first-pass rate     -- how often a round clears the gates on try 1
+ *          2. rework round stats  -- median / mean / worst rounds per landing
+ *          3. top-N failing rules -- which rule_id blocks most often
+ *
+ *        Without (3) the only thing you can do is "try harder". With it, the
+ *        answer to "why is development slow" becomes a ranked list.
+ *
+ *        Two data hazards decide the design:
+ *
+ *        - Before #651 the journal contained NO failures, so every derived rate
+ *          was 100% by construction. A command that reports "first-pass rate: 100%"
+ *          from an empty failure set is worse than no command: it manufactures
+ *          confidence. So an input with zero FAIL records must report that the
+ *          figure is NOT MEASURABLE, not that it is perfect.
+ *
+ *        - ~401 historical records carry epoch-sized `duration_ms` (flagged
+ *          `duration_anomaly`). Any duration aggregate must exclude them rather
+ *          than average them in -- one of them once produced "average 430 million
+ *          seconds".
+ *
+ *        These tests exercise the pure aggregation function, so the numbers are
+ *        pinned independently of file layout.
+ * @covers AC-670-59, AC-670-60, AC-670-61, AC-670-62
+ */
+'use strict';
+
+const { computeReworkStats } = require('../rework');
+
+/** One journal record, defaulting to a pass. */
+function rec(overrides) {
+  return {
+    timestamp: '2026-10-30T10:00:00.000Z',
+    gate_id: '1',
+    gate_name: 'Code Quality',
+    passed: true,
+    issues_found: 0,
+    duration_ms: 1000,
+    trigger: 'commit',
+    ...overrides,
+  };
+}
+
+describe('computeReworkStats (#651)', () => {
+  it('AC-670-59: reports an unmeasurable first-pass rate when the journal has no failures', () => {
+    // This is exactly the pre-#651 journal: thousands of passes, zero fails.
+    const entries = Array.from({ length: 50 }, () => rec());
+    const stats = computeReworkStats(entries);
+    // A rate derived from an empty failure set is not 100% -- it is unknown.
+    expect(stats.firstPassRate).toBeNull();
+    expect(stats.measurable).toBe(false);
+    expect(stats.reason).toMatch(/no failure/i);
+  });
+
+  it('AC-670-60: counts failing rules and ranks them, so the worst rule is actionable', () => {
+    const entries = [
+      rec({ passed: false, failure_reason: 'long-function' }),
+      rec({ passed: false, failure_reason: 'long-function' }),
+      rec({ passed: false, failure_reason: 'long-function' }),
+      rec({ passed: false, failure_reason: 'tests_failed' }),
+      rec(),
+      rec(),
+    ];
+    const stats = computeReworkStats(entries);
+    expect(stats.measurable).toBe(true);
+    expect(stats.topFailures[0]).toEqual({ reason: 'long-function', count: 3 });
+    expect(stats.topFailures[1]).toEqual({ reason: 'tests_failed', count: 1 });
+    // 4 failures out of 6 attempts -> 33% first-pass.
+    expect(stats.firstPassRate).toBeCloseTo(33.3, 1);
+  });
+
+  it('AC-670-61: excludes anomaly-flagged durations instead of averaging them in', () => {
+    // A real epoch-sized value from the corpus; averaging it in produced
+    // "average 430 million seconds" on gate-1.
+    const entries = [
+      rec({ duration_ms: 1000 }),
+      rec({ duration_ms: 3000 }),
+      rec({ duration_ms: 1784536915891, duration_anomaly: true }),
+    ];
+    const stats = computeReworkStats(entries);
+    expect(stats.duration).not.toBeNull();
+    // Median over the two sane values (1000, 3000) is 2000, not ~5.9e11.
+    expect(stats.duration.medianMs).toBe(2000);
+    expect(stats.duration.samples).toBe(2);
+    expect(stats.duration.excludedAnomalies).toBe(1);
+  });
+
+  it('AC-670-62: a failure with no reason is bucketed, never silently dropped', () => {
+    const entries = [
+      rec({ passed: false }),                              // no failure_reason
+      rec({ passed: false, failure_reason: '' }),          // empty
+      rec({ passed: false, failure_reason: 'short-circuit' }),
+    ];
+    const stats = computeReworkStats(entries);
+    // Dropping unlabelled failures would understate the failure count and push
+    // the first-pass rate UP -- the optimistic direction is the dangerous one.
+    expect(stats.failures).toBe(3);
+    const unattributed = stats.topFailures.find((f) => /unattributed|unknown/i.test(f.reason));
+    expect(unattributed, 'unlabelled failures must appear in the ranking').toBeDefined();
+    expect(unattributed.count).toBe(2);
+  });
+});
+
+describe('rework duration sampling (#651)', () => {
+  it('AC-670-61: an UNFLAGGED epoch-sized duration is still excluded', () => {
+    // Measured on the real journal: 391 records carry duration_anomaly, but 6
+    // more epoch-sized values do not. Trusting the flag alone left the mean at
+    // 1.3e9 ms -- the "average 430 million seconds" artifact returning through
+    // the back door. Plausibility must be checked independently of the flag.
+    const entries = [
+      rec({ duration_ms: 2000 }),
+      rec({ duration_ms: 4000 }),
+      rec({ duration_ms: 1785001784992 }), // no duration_anomaly flag
+    ];
+    const stats = computeReworkStats(entries);
+    expect(stats.duration).not.toBeNull();
+    expect(stats.duration.medianMs).toBe(3000);
+    expect(stats.duration.samples).toBe(2);
+    // Excluded count covers BOTH flagged and implausible, or the sample size
+    // looks closer to the record count than it really is.
+    expect(stats.duration.excludedAnomalies).toBe(1);
+  });
+});

package/lib/gate-audit.ts

@@ -41,6 +41,12 @@ export interface GateAuditEntry {
   duration_anomaly?: boolean; // Issue #370: set when duration_ms > max_duration_ms
   duration_reason?: 'poisoned_start_ms' | 'clock_skew'; // REQ-B: why duration_ms is null
   detail?: string; // #507: optional gate-specific payload (e.g. effective CCN threshold)
+  /**
+   * #651: WHY the gate blocked. Without this the journal can only answer "how
+   * many failed", never "which rule fails most" — and the second question is the
+   * one that drives fixes. Only meaningful when passed=false.
+   */
+  failure_reason?: string;
 }
 
 // ── Public API ───────────────────────────────────────────────────────────────
@@ -415,6 +421,8 @@ function runCli(): void {
       ...(durationReason ? { duration_reason: durationReason as 'poisoned_start_ms' | 'clock_skew' } : {}),
       // #507: only set when provided (omit field otherwise)
       ...(opts['detail'] ? { detail: opts['detail'] } : {}),
+      // #651: only set when provided, so successful records stay byte-identical.
+      ...(opts['failure-reason'] ? { failure_reason: String(opts['failure-reason']).slice(0, 300) } : {}),
     };
     // Pre-commit (trigger=commit) is staging for a commit that does not exist
     // yet: park it in the pending sidecar so post-commit can stamp the real

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T15:31:30.899Z",
+  "checked_at": "2026-10-30T15:51:17.008Z",
   "source": "network"
 }

package/lib/rework.js

@@ -0,0 +1,262 @@
+/**
+ * `xp-gate rework` — what the gate journal says about rework (#651).
+ *
+ * `xp-gate retro` already answers "how much did we ship". This answers the
+ * narrower and more actionable question: how often does a round of work clear
+ * the gates on the first attempt, and which rule stops it most.
+ *
+ * The reason this needs a dedicated command rather than a `retro` line: before
+ * #651 the journal contained NO failure records at all, so a naive rework rate
+ * computed from it returned 100% every time. A metric that reads "perfect" when
+ * it is actually unmeasured is worse than no metric -- it manufactures
+ * confidence. So `measurable: false` is a first-class outcome here.
+ *
+ * No runtime dependencies: this ships inside the zero-install package.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const AUDIT_DIR = '.xp-gate';
+const AUDIT_FILE = 'audit.jsonl';
+const PENDING_FILE = 'audit.pending.jsonl';
+
+/** Bucket name for failures the journal cannot attribute to a rule. */
+const UNATTRIBUTED = 'unattributed';
+
+/**
+ * Read every journal record under `repoRoot`, oldest first.
+ *
+ * Malformed lines are skipped rather than thrown on: the journal is append-only
+ * and a single truncated write must not take the whole report down.
+ *
+ * @param {string} [repoRoot]
+ * @returns {Array<object>}
+ */
+function readJournal(repoRoot = process.cwd()) {
+  const dir = path.join(repoRoot, AUDIT_DIR);
+  const entries = [];
+  for (const file of [AUDIT_FILE, PENDING_FILE]) {
+    const full = path.join(dir, file);
+    let raw;
+    try {
+      raw = fs.readFileSync(full, 'utf8');
+    } catch {
+      continue;
+    }
+    for (const line of raw.split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const parsed = JSON.parse(line);
+        if (parsed && typeof parsed === 'object') entries.push(parsed);
+      } catch {
+        /* truncated/garbled line -- skip, do not fail the report */
+      }
+    }
+  }
+  return entries;
+}
+
+/** Median of a numeric array (0 for an empty array). */
+function median(values) {
+  if (values.length === 0) return 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const mid = Math.floor(sorted.length / 2);
+  return sorted.length % 2 === 0 ? (sorted[mid - 1] + sorted[mid]) / 2 : sorted[mid];
+}
+
+/** Mean of a numeric array (0 for an empty array). */
+function mean(values) {
+  if (values.length === 0) return 0;
+  return values.reduce((a, b) => a + b, 0) / values.length;
+}
+
+/**
+ * Group a flat record list into rework rounds.
+ *
+ * The journal is a flat stream of gate executions with no round identifier, so a
+ * round is reconstructed the only way the data allows: a run of FAIL records
+ * terminated by the next PASS. That is exactly "how many attempts before this
+ * landed", which is the definition rework needs. A trailing run of failures with
+ * no resolving pass is a round that has not landed yet, and is counted as
+ * `unresolved` rather than being dropped.
+ *
+ * @param {Array<object>} entries
+ */
+function groupRounds(entries) {
+  const rounds = [];
+  let current = 0;
+  for (const entry of entries) {
+    if (entry.passed) {
+      if (current > 0) rounds.push(current);
+      current = 0;
+      continue;
+    }
+    current += 1;
+  }
+  return { resolved: rounds, unresolved: current };
+}
+
+/**
+ * Aggregate the journal into rework metrics.
+ *
+ * @param {Array<object>} entries journal records
+ * @returns {object} see AC-670-59..62
+ */
+function computeReworkStats(entries) {
+  const list = Array.isArray(entries) ? entries : [];
+  const totals = list.length;
+  const failures = list.filter((e) => e.passed === false).length;
+  const passes = totals - failures;
+
+  // ── Failures by reason ────────────────────────────────────────────────────
+  // Unlabelled failures are bucketed, never dropped: dropping them would lower
+  // the failure count and push the first-pass rate UP, which is the optimistic
+  // direction and therefore the dangerous one.
+  const byReason = new Map();
+  for (const entry of list) {
+    if (entry.passed !== false) continue;
+    const raw = typeof entry.failure_reason === 'string' ? entry.failure_reason.trim() : '';
+    const key = raw === '' ? UNATTRIBUTED : raw;
+    byReason.set(key, (byReason.get(key) || 0) + 1);
+  }
+  const topFailures = [...byReason.entries()]
+    .map(([reason, count]) => ({ reason, count }))
+    .sort((a, b) => b.count - a.count || a.reason.localeCompare(b.reason));
+
+  // ── Durations ─────────────────────────────────────────────────────────────
+  // Two independent guards, because the flag alone is not enough:
+  //
+  //  1. honour `duration_anomaly` -- the writer's own verdict;
+  //  2. reject implausible magnitudes. Measured on the real journal: 391 records
+  //     carry the flag, but 6 MORE epoch-sized values (up to 1.78e12) do not,
+  //     so trusting the flag alone left the mean at 1.3e9 ms -- the very
+  //     "average 430 million seconds" artifact this is supposed to kill.
+  //
+  // The ceiling is deliberately generous (1 hour): a real gate run that long is
+  // pathological but conceivable, while an epoch stamp is ~1.78e12 and cannot be
+  // mistaken for anything else.
+  const MAX_PLAUSIBLE_DURATION_MS = 60 * 60 * 1000;
+  const isPlausible = (e) => typeof e.duration_ms === 'number'
+    && Number.isFinite(e.duration_ms)
+    && e.duration_ms >= 0
+    && e.duration_ms <= MAX_PLAUSIBLE_DURATION_MS
+    && e.duration_anomaly !== true;
+  const sane = list.filter(isPlausible);
+  const duration = sane.length > 0
+    ? {
+      medianMs: median(sane.map((e) => e.duration_ms)),
+      meanMs: Math.round(mean(sane.map((e) => e.duration_ms))),
+      samples: sane.length,
+      // Every record that did NOT contribute -- flagged or implausible. Reporting
+      // only the flagged count would understate the exclusion and make the
+      // sample size look closer to the record count than it is.
+      excludedAnomalies: list.filter((e) => typeof e.duration_ms === 'number' && !isPlausible(e)).length,
+    }
+    : null;
+
+  // ── Rounds ────────────────────────────────────────────────────────────────
+  const rounds = groupRounds(list);
+  const reworkRounds = rounds.resolved;
+
+  // ── First-pass rate ───────────────────────────────────────────────────────
+  // Undefined without failures. A rate over an empty failure set is not 100%.
+  const measurable = failures > 0;
+  const firstPassRate = measurable ? Math.round((passes / totals) * 1000) / 10 : null;
+
+  return {
+    measurable,
+    reason: measurable ? null : 'no failure records in the journal -- first-pass rate is not measurable (pre-#651 journals only recorded passes)',
+    totalRecords: totals,
+    passes,
+    failures,
+    firstPassRate,
+    rounds: {
+      resolved: reworkRounds.length,
+      unresolved: rounds.unresolved > 0,
+      medianRework: median(reworkRounds),
+      meanRework: Math.round(mean(reworkRounds) * 100) / 100,
+      worstRework: reworkRounds.length > 0 ? Math.max(...reworkRounds) : 0,
+    },
+    topFailures,
+    duration,
+  };
+}
+
+/** Render a stats object for the terminal. */
+function formatReworkReport(stats, { limit = 10 } = {}) {
+  const lines = [];
+  lines.push('');
+  lines.push('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+  lines.push('   REWORK REPORT');
+  lines.push('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+  lines.push('');
+  lines.push(`  Journal records: ${stats.totalRecords}  (${stats.passes} pass, ${stats.failures} fail)`);
+
+  if (!stats.measurable) {
+    // Say WHY, and say it loudly: a silent 100% would be a lie.
+    lines.push('');
+    lines.push('  ⚠️  First-pass rate: NOT MEASURABLE');
+    lines.push(`     ${stats.reason}`);
+  } else {
+    lines.push(`  First-pass rate: ${stats.firstPassRate}%`);
+  }
+
+  if (stats.rounds.resolved > 0) {
+    lines.push('');
+    lines.push(`  Rework rounds (failures before a landing): ${stats.rounds.resolved}`);
+    lines.push(`     median ${stats.rounds.medianRework} / mean ${stats.rounds.meanRework} / worst ${stats.rounds.worstRework}`);
+    if (stats.rounds.unresolved) {
+      lines.push('     (a trailing run of failures has not landed yet)');
+    }
+  }
+
+  if (stats.topFailures.length > 0) {
+    lines.push('');
+    lines.push(`  Top ${limit} blocking reasons:`);
+    for (const { reason, count } of stats.topFailures.slice(0, limit)) {
+      lines.push(`     ${String(count).padStart(5)}  ${reason}`);
+    }
+  }
+
+  if (stats.duration) {
+    lines.push('');
+    lines.push(`  Gate duration: median ${stats.duration.medianMs} ms / mean ${stats.duration.meanMs} ms (${stats.duration.samples} samples`);
+    lines.push(`                 ${stats.duration.excludedAnomalies} anomaly record(s) excluded)`);
+  }
+
+  lines.push('');
+  return lines.join('\n');
+}
+
+/**
+ * CLI entry.
+ * @param {string[]} argv args after `rework`
+ */
+function main(argv = []) {
+  const repoRootIdx = argv.indexOf('--dir');
+  const repoRoot = repoRootIdx !== -1 && argv[repoRootIdx + 1] ? argv[repoRootIdx + 1] : process.cwd();
+  const limitIdx = argv.indexOf('--top');
+  const limit = limitIdx !== -1 && argv[limitIdx + 1] ? parseInt(argv[limitIdx + 1], 10) : 10;
+
+  const stats = computeReworkStats(readJournal(repoRoot));
+  if (argv.includes('--json')) {
+    process.stdout.write(`${JSON.stringify(stats, null, 2)}\n`);
+    return 0;
+  }
+  process.stdout.write(`${formatReworkReport(stats, { limit })}\n`);
+  return 0;
+}
+
+module.exports = {
+  readJournal,
+  computeReworkStats,
+  formatReworkReport,
+  main,
+  UNATTRIBUTED,
+};
+
+if (require.main === module) {
+  process.exitCode = main(process.argv.slice(2));
+}

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/scripts/__tests__/sync-package-content-isolation.test.js

@@ -0,0 +1,73 @@
+/**
+ * @test REQ-645
+ * @intent `sync-package-content.test.js` used the REAL repository root as the
+ *        spawn cwd:
+ *
+ *          const WORKTREE_PATH = path.resolve(__dirname, '..', '..', '..', '..');
+ *
+ *        Four levels up from `src/npm-package/scripts/__tests__/` is the repo
+ *        root, not a temp dir. The tests then ran the real sync script with
+ *        `cwd: WORKTREE_PATH`, so the script's writes landed in the repository
+ *        instead of a sandbox. CI's Gate 5 failed at `vitest-worktree-guard`:
+ *
+ *          Work tree polluted by the test run — 1 path(s) the run introduced:
+ *              M src/npm-package/mock-policy/gate-m3.ts
+ *
+ *        The reason this is easy to miss: the pollution is CONDITIONAL. The
+ *        script's writes are idempotent, so when the mirror already matches the
+ *        source nothing changes and the run looks clean. It only dirties the tree
+ *        when the checked-out commit happens to carry a stale mirror — which is
+ *        exactly when CI is checking out a commit that the fix was supposed to
+ *        validate. So it presents as "flaky, just re-run it", and re-running
+ *        hides the cause while leaving the latent defect in place.
+ *
+ *        The guard catching it is good, but it catches the CONSEQUENCE. This file
+ *        pins the CAUSE: a test may not write into the repository.
+ * @covers AC-670-54, AC-670-55
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..', '..', '..');
+const TEST_FILE = path.join(
+  REPO_ROOT, 'src', 'npm-package', 'scripts', '__tests__', 'sync-package-content.test.js',
+);
+
+function readSuite() {
+  return fs.readFileSync(TEST_FILE, 'utf8');
+}
+
+describe('sync-package-content tests must not write into the repository (#645)', () => {
+  it('AC-670-54: no test uses the repo root as a spawn cwd', () => {
+    const source = readSuite();
+    // The exact offending expression. `path.resolve(__dirname, '..' x4)` from the
+    // test file IS the repo root -- there is no temp dir anywhere in that chain.
+    const offenders = source
+      .split('\n')
+      .map((line, i) => ({ line: line.trim(), n: i + 1 }))
+      .filter((x) => /WORKTREE_PATH\s*=\s*path\.resolve\(__dirname/.test(x.line));
+    expect(
+      offenders,
+      `tests still anchor on the real repo root:\n${offenders.map((o) => `  :${o.n} ${o.line}`).join('\n')}`,
+    ).toEqual([]);
+  });
+
+  it('AC-670-55: the sync tests run against a temp worktree, not the checkout', () => {
+    const source = readSuite();
+    // Whatever the variable is called, the cwd handed to a spawned sync must be
+    // one the test CREATED. mkdtemp is the only way to guarantee that: a path
+    // built from __dirname is by construction inside the repository.
+    expect(source, 'suite must create a throwaway worktree').toMatch(/mkdtemp/);
+    // Every spawnSync `cwd:` must point at that temp root, never at the checkout.
+    const cwdLines = source
+      .split('\n')
+      .filter((line) => /^\s*cwd:\s*/.test(line))
+      .map((line) => line.trim());
+    expect(cwdLines.length, 'expected at least one spawn cwd').toBeGreaterThan(0);
+    for (const line of cwdLines) {
+      expect(line, `spawn cwd escapes the sandbox: ${line}`).not.toMatch(/cwd:\s*REPO_ROOT/);
+    }
+  });
+});

package/scripts/__tests__/sync-package-content.test.js

@@ -27,6 +27,37 @@ function writeDoc(filePath, content) {
   fs.writeFileSync(filePath, content, 'utf8');
 }
 
+/**
+ * Copy the canonical source trees a sync run READS into `destRoot` (#645).
+ *
+ * The sync script mirrors githooks/, skills/, plugins/ and every src/ module into
+ * the package. Seeding the whole of `src/` except the package itself keeps this
+ * list from rotting: syncModules() gains a module, this helper needs no edit.
+ * Only reads from the real checkout -- nothing is ever written back to it.
+ */
+function seedCanonicalSources(realRoot, destRoot) {
+  const real = realRoot || path.resolve(__dirname, '..', '..', '..', '..');
+  const dest = destRoot;
+  for (const tree of ['githooks', 'skills', 'plugins']) {
+    const from = path.join(real, tree);
+    if (fs.existsSync(from)) fs.cpSync(from, path.join(dest, tree), { recursive: true });
+  }
+  const srcRoot = path.join(real, 'src');
+  for (const name of fs.readdirSync(srcRoot)) {
+    // The package itself is the DESTINATION of the sync, not a canonical source;
+    // copying it would let the test compare a mirror against a stale mirror.
+    if (name === 'npm-package') continue;
+    const from = path.join(srcRoot, name);
+    if (fs.statSync(from).isDirectory()) {
+      fs.cpSync(from, path.join(dest, 'src', name), { recursive: true });
+    }
+  }
+  fs.mkdirSync(path.join(dest, 'src', 'npm-package', 'scripts'), { recursive: true });
+  for (const rel of ['scripts/sync-package-content.js', 'package.json']) {
+    fs.copyFileSync(path.join(srcRoot, 'npm-package', rel), path.join(dest, 'src', 'npm-package', rel));
+  }
+}
+
 describe('checkDocsDrift', () => {
   let tempDir;
   let preCommitPath;
@@ -269,12 +300,56 @@ describe('syncGateScripts', () => {
  * @covers AC-450-01, AC-450-02, AC-450-03, AC-450-04
  */
 describe('syncHooks', () => {
-  const WORKTREE_PATH = path.resolve(__dirname, '..', '..', '..', '..');
+  // #645: run the sync against a THROWAWAY worktree, never the checkout.
+  //
+  // This block used to spawn the real sync script with
+  //     cwd: path.resolve(__dirname, '..', '..', '..', '..')
+  // -- four levels up from src/npm-package/scripts/__tests__ is the REPOSITORY
+  // ROOT, not a temp dir -- so the script's writes landed in the repo and CI's
+  // Gate 5 failed at vitest-worktree-guard with
+  //     Work tree polluted by the test run: M src/npm-package/mock-policy/gate-m3.ts
+  //
+  // The pollution was CONDITIONAL (the writes are idempotent, so it only dirties
+  // the tree when the checked-out commit carries a stale mirror), which made it
+  // look flaky and encouraged "just re-run it" -- hiding the cause. The guard
+  // catches the consequence; a temp cwd removes the cause.
+  const REAL_REPO_ROOT = path.resolve(__dirname, '..', '..', '..', '..');
+  const TMP_WORKTREE = fs.mkdtempSync(path.join(os.tmpdir(), 'xp-gate-sync-hooks-'));
+  const WORKTREE_PATH = TMP_WORKTREE;
   const PKG_ROOT = path.join(WORKTREE_PATH, 'src', 'npm-package');
   const HOOKS_DIR = path.join(PKG_ROOT, 'hooks');
   const syncScript = path.join(WORKTREE_PATH, 'src', 'npm-package', 'scripts', 'sync-package-content.js');
   const nodeExe = process.execPath;
 
+  /**
+   * Lay out just enough of the repo shape inside the temp root for the sync script
+   * to read its canonical sources and write its mirrors. Copies only the trees the
+   * script touches: githooks/ (the hook source of truth) and the packages it
+   * mirrors into. The REAL checkout is only ever READ.
+   */
+  function seedTempWorktree() {
+    seedCanonicalSources(REAL_REPO_ROOT, WORKTREE_PATH);
+    fs.mkdirSync(path.join(PKG_ROOT, 'scripts'), { recursive: true });
+    fs.copyFileSync(
+      path.join(REAL_REPO_ROOT, 'src', 'npm-package', 'scripts', 'sync-package-content.js'),
+      syncScript,
+    );
+    // The script resolves its package root relative to its own location, so it
+    // must sit at <temp>/src/npm-package/scripts/ exactly as in the real tree.
+    fs.copyFileSync(
+      path.join(REAL_REPO_ROOT, 'src', 'npm-package', 'package.json'),
+      path.join(PKG_ROOT, 'package.json'),
+    );
+  }
+
+  beforeAll(() => {
+    seedTempWorktree();
+  });
+
+  afterAll(() => {
+    fs.rmSync(TMP_WORKTREE, { recursive: true, force: true });
+  });
+
   // Ensure hooks are re-synced once before tests run; share the result.
   let syncOk = false;
   beforeAll(() => {
@@ -473,9 +548,41 @@ describe('checkAdapterDrift', () => {
 const { spawnSync } = require('child_process');
 
 describe('sync-package-content subprocess invocation', () => {
-  const WORKTREE_PATH = path.resolve(__dirname, '..', '..', '..', '..');
+  // #645: same rule as the syncHooks block above -- a test may not write into the
+  // repository. `path.resolve(__dirname, '..', '..', '..', '..')` IS the repo root,
+  // so spawning the sync script with it as cwd copied mirrors over the checkout and
+  // CI's Gate 5 failed at vitest-worktree-guard.
+  //
+  // This block additionally DELETES package directories to prove the sync
+  // recreates them, which is precisely the operation that must never touch a real
+  // checkout. Everything therefore runs inside a throwaway tree seeded from the
+  // real sources (read-only).
+  const REAL_REPO_ROOT = path.resolve(__dirname, '..', '..', '..', '..');
+  const TMP_WORKTREE = fs.mkdtempSync(path.join(os.tmpdir(), 'xp-gate-sync-sub-'));
+  const WORKTREE_PATH = TMP_WORKTREE;
   const PKG_ROOT = path.join(WORKTREE_PATH, 'src', 'npm-package');
   const REPO_ROOT = path.join(WORKTREE_PATH);
+
+  function seedTempWorktree() {
+    seedCanonicalSources(REAL_REPO_ROOT, WORKTREE_PATH);
+    fs.mkdirSync(path.join(PKG_ROOT, 'scripts'), { recursive: true });
+    fs.copyFileSync(
+      path.join(REAL_REPO_ROOT, 'src', 'npm-package', 'scripts', 'sync-package-content.js'),
+      path.join(PKG_ROOT, 'scripts', 'sync-package-content.js'),
+    );
+    fs.copyFileSync(
+      path.join(REAL_REPO_ROOT, 'src', 'npm-package', 'package.json'),
+      path.join(PKG_ROOT, 'package.json'),
+    );
+  }
+
+  beforeAll(() => {
+    seedTempWorktree();
+  });
+
+  afterAll(() => {
+    fs.rmSync(TMP_WORKTREE, { recursive: true, force: true });
+  });
   const CORE_SKILLS = [
     'admin-template-guidelines',
     'delphi-review',

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** c8a73b2a
+**Commit:** 2ce96f13
 **Branch:** main
-**Version:** 0.35.0.0
+**Version:** 0.35.1.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.