@boyingliu01/xp-gate 0.35.16 → 0.35.17

package/hooks/pre-commit

@@ -2659,7 +2659,13 @@ else
   # Exclusions come from filter_project_paths (#649). The hand-maintained list
   # this replaced omitted vendor/target/coverage/out, so a staged vendor/x.ts
   # was reported as new source with no test.
-  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
+  #
+  # Byte-identical mirrors under src/npm-package/ are excluded the same way
+  # lint (#494) and Boy Scout (#649) already exclude them. A mirror cannot
+  # carry its own test: the next resync overwrites the directory, so the
+  # requirement is structurally unsatisfiable and blocked every commit that
+  # added a file to a mirrored module. The canonical source keeps its test.
+  NEW_TS_FILES=$(git diff --cached --name-only --diff-filter=A | filter_project_paths | grep -Ev "$MIRROR_PATH_FILTER" | grep -E '\.(ts|tsx)$' | grep -v '\.d\.ts$' | grep -v '__tests__' | grep -v '\.test\.' | grep -v '\.spec\.' | grep -v '__snapshots__' | grep -Ev '(^|/)vitest\.config\.' | grep -Ev '(^|/)vite\.config\.' | grep -Ev '(^|/)jest\.config\.' | grep -Ev '(^|/)tsconfig\.' | grep -Ev '(^|/)eslint\.' | grep -Ev '(^|/)prettier\.' | grep -Ev '(^|/)tailwind\.' || true)
 
   # Strip PROJECT_SUBDIR prefix from new-TS-file paths ONLY when the hook
   # actually cd'd into the subdirectory (IN_PROJECT_SUBDIR=1; single-language

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-31T05:05:10.442Z",
+  "checked_at": "2026-10-31T07:40:57.523Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/mutation/runners/mutmut-runner.ts

@@ -1,5 +1,5 @@
 // @no-test-required: mutmut wrapper — tested via gate-m integration + pre-push Gate M
-import { spawn, execSync } from 'child_process';
+import { spawn, execSync, type ChildProcess } from 'child_process';
 import { writeFileSync, unlinkSync, readFileSync, existsSync } from 'fs';
 import { join, dirname } from 'path';
 import type {
@@ -24,6 +24,87 @@ type MutmutRoute = 'native' | 'wsl' | 'unavailable' | 'unresolved';
  * - Results stored in SQLite; `mutmut results` outputs per-mutant status lines
  * - `mutmut run` stdout shows emoji progress: 🎉 N 🫥 N ⏰ N 🤔 N 🙁 N
  */
+/**
+ * Wire a child process's stdout/stderr into one accumulating callback.
+ *
+ * Extracted from `runMutmut`: the two listeners were six lines of pure
+ * accumulation inside an already-long Promise body, and their nesting was part
+ * of what made that method exceed both the length and the nesting budget.
+ */
+function collectOutput(
+  child: ChildProcess,
+  onChunk: (chunk: string, isStderr: boolean) => void,
+): void {
+  child.stdout?.on('data', (data: Buffer) => onChunk(data.toString(), false));
+  child.stderr?.on('data', (data: Buffer) => onChunk(data.toString(), true));
+}
+
+/** How long a SIGTERMed mutmut gets before it is killed outright. */
+const ESCALATION_DELAY_MS = 5000;
+
+/** Where the pre-run copy of pyproject.toml lives. */
+function pyprojectBackupPath(pyprojectPath: string): string {
+  return `${pyprojectPath}.xp-gate-backup`;
+}
+
+/**
+ * Put pyproject.toml back the way it was, or remove the one we generated.
+ *
+ * Cleanup is best-effort by design: the mutation run's own result is what the
+ * caller acts on, and failing here would replace a usable outcome with an
+ * exception raised from a `finally`. Extracted from `run` because the nested
+ * try/if/if/else was what pushed that method to 5 nesting levels.
+ */
+function restorePyproject(pyprojectPath: string, hadExisting: boolean): void {
+  const backupPath = pyprojectBackupPath(pyprojectPath);
+  try {
+    if (hadExisting && existsSync(backupPath)) {
+      writeFileSync(pyprojectPath, readFileSync(backupPath, 'utf-8'), { encoding: 'utf-8' });
+      unlinkSync(backupPath);
+    } else if (!hadExisting && existsSync(pyprojectPath)) {
+      unlinkSync(pyprojectPath);
+    }
+  } catch {
+    // Best effort cleanup
+  }
+}
+
+/** The tracker shape `settleTracker` returns; only the timeout path uses these. */
+interface SettleTracker {
+  didTimeOut: () => boolean;
+  markTimedOut: () => void;
+  settle: (outcome: MutationRunOutcome) => void;
+  isSettled: () => boolean;
+}
+
+/**
+ * Arm the run timeout, escalating SIGTERM to SIGKILL once.
+ *
+ * Extracted from `runMutmut` for the same reason as `collectOutput`: the
+ * two-step kill sequence is twelve lines of policy that pushed the method past
+ * both budgets. The escalation timer id is handed back through `setEscalation`
+ * so the caller's `cancelTimers` closure can still reach it.
+ *
+ * @returns the primary timer id, to be cleared by the caller.
+ */
+function armTimeout(
+  child: ChildProcess,
+  timeoutMs: number,
+  tracker: SettleTracker,
+  setEscalation: (id: NodeJS.Timeout) => void,
+): NodeJS.Timeout {
+  const escalationMs = ESCALATION_DELAY_MS;
+  return setTimeout(() => {
+    tracker.markTimedOut();
+    child.kill('SIGTERM');
+    if (tracker.isSettled()) return;
+    // SIGTERM may be ignored; escalate once.
+    setEscalation(setTimeout(() => {
+      if (!tracker.isSettled()) child.kill('SIGKILL');
+    }, escalationMs));
+  }, timeoutMs);
+}
+
 export class MutmutRunner implements MutationRunner {
   readonly name = 'mutmut';
   readonly extensions = ['py'];
@@ -72,33 +153,35 @@ export class MutmutRunner implements MutationRunner {
     const sourceDirs = this.extractUniqueDirs(options.files);
 
     const pyprojectPath = join(options.cwd, 'pyproject.toml');
-    const backupPath = join(options.cwd, 'pyproject.toml.xp-gate-backup');
-    let hadExisting = false;
+    const hadExisting = this.backupPyproject(pyprojectPath);
 
     try {
-      if (existsSync(pyprojectPath)) {
-        hadExisting = true;
-        const existing = readFileSync(pyprojectPath, 'utf-8');
-        writeFileSync(backupPath, existing, { encoding: 'utf-8' });
-      }
       this.writeMutmutConfig(pyprojectPath, sourceDirs);
-
       return await this.runMutmut(options);
     } finally {
-      try {
-        if (hadExisting && existsSync(backupPath)) {
-          const backup = readFileSync(backupPath, 'utf-8');
-          writeFileSync(pyprojectPath, backup, { encoding: 'utf-8' });
-          unlinkSync(backupPath);
-        } else if (!hadExisting && existsSync(pyprojectPath)) {
-          unlinkSync(pyprojectPath);
-        }
-      } catch {
-        // Best effort cleanup
-      }
+      restorePyproject(pyprojectPath, hadExisting);
     }
   }
 
+  /**
+   * Copy an existing pyproject.toml aside so `run` can put it back.
+   * @returns whether a file was there to back up.
+   */
+  private backupPyproject(pyprojectPath: string): boolean {
+    if (!existsSync(pyprojectPath)) return false;
+    const backupPath = pyprojectBackupPath(pyprojectPath);
+    try {
+      writeFileSync(backupPath, readFileSync(pyprojectPath, 'utf-8'), { encoding: 'utf-8' });
+    } catch (err) {
+      // Failing here must be loud: without a backup, `restorePyproject` would
+      // silently leave this repo's pyproject.toml overwritten by a generated one.
+      throw new Error(
+        `Could not back up ${pyprojectPath} before writing a mutmut config: ${(err as Error).message}`,
+      );
+    }
+    return true;
+  }
+
   /**
    * Build the terminal-outcome handler for one `mutmut run`.
    *
@@ -173,39 +256,17 @@ export class MutmutRunner implements MutationRunner {
 
       const tracker = this.settleTracker(resolve, cancelTimers);
 
-      const timeoutId = setTimeout(() => {
-        tracker.markTimedOut();
-        child.kill('SIGTERM');
-        if (tracker.isSettled()) return;
-        // SIGTERM may be ignored; escalate once, and let the retry live in a
-        // variable so `cancelTimers` can reach it.
-        escalationId = setTimeout(() => {
-          if (!tracker.isSettled()) child.kill('SIGKILL');
-        }, 5000);
-      }, options.timeoutMs);
-
-      child.stdout?.on('data', (data: Buffer) => {
-        stdout += data.toString();
+      const timeoutId = armTimeout(child, options.timeoutMs, tracker, (id) => {
+        escalationId = id;
       });
 
-      child.stderr?.on('data', (data: Buffer) => {
-        stderr += data.toString();
+      collectOutput(child, (chunk, isErr) => {
+        if (isErr) stderr += chunk;
+        else stdout += chunk;
       });
 
       child.on('close', (code) => {
-        // A null exit code means the process was killed ("timed out" when we did
-        // it, "unknown" otherwise); there is no report to parse either way.
-        if (code === null) {
-          tracker.settle({ report: null, timedOut: tracker.didTimeOut() });
-          return;
-        }
-
-        tracker.settle({
-          // Parse results from mutmut run stdout (v3.x emoji progress)
-          report: this.parseEmojiProgress(stdout),
-          timedOut: tracker.didTimeOut(),
-          error: code !== 0 ? stderr || stdout : undefined,
-        });
+        tracker.settle(this.outcomeFor(code, stdout, stderr, tracker));
       });
 
       child.on('error', (err) => {
@@ -214,6 +275,29 @@ export class MutmutRunner implements MutationRunner {
     });
   }
 
+  /**
+   * Turn one `mutmut run` exit into the outcome the caller expects.
+   *
+   * Extracted from `runMutmut`'s close handler to bring that method back under
+   * the length and nesting budgets. A null exit code means the process was
+   * killed -- "timed out" when we did it, "unknown" otherwise -- and there is no
+   * report to parse either way.
+   */
+  private outcomeFor(
+    code: number | null,
+    stdout: string,
+    stderr: string,
+    tracker: SettleTracker,
+  ): MutationRunOutcome {
+    if (code === null) return { report: null, timedOut: tracker.didTimeOut() };
+    return {
+      // Parse results from mutmut run stdout (v3.x emoji progress)
+      report: this.parseEmojiProgress(stdout),
+      timedOut: tracker.didTimeOut(),
+      error: code !== 0 ? stderr || stdout : undefined,
+    };
+  }
+
   private toWslPath(path: string): string | null {
     const match = path.match(/^([A-Za-z]):[\\/](.*)$/);
     if (!match) return null;
@@ -300,28 +384,39 @@ export class MutmutRunner implements MutationRunner {
   }
 
   private writeMutmutConfig(pyprojectPath: string, sourceDirs: string[]): void {
-    const sourcePaths = sourceDirs.map((d) => `"${d}"`).join(', ');
-    const sourcePathsLine = `source_paths = [${sourcePaths}]`;
-
-    let content = '';
-    if (existsSync(pyprojectPath)) {
-      content = readFileSync(pyprojectPath, 'utf-8');
-      if (content.includes('[tool.mutmut]')) {
-        const sourcePathsRegex = /source_paths\s*=\s*\[.*?\]/;
-        if (sourcePathsRegex.test(content)) {
-          content = content.replace(sourcePathsRegex, sourcePathsLine);
-        } else {
-          content = content.replace(
-            '[tool.mutmut]',
-            `[tool.mutmut]\n${sourcePathsLine}`,
-          );
-        }
-      } else {
-        content = content.trimEnd() + `\n\n[tool.mutmut]\n${sourcePathsLine}\n`;
-      }
-    } else {
-      content = `[tool.mutmut]\n${sourcePathsLine}\n`;
+    const sourcePathsLine = `source_paths = [${sourceDirs.map((d) => `"${d}"`).join(', ')}]`;
+    try {
+      // Read here so the content builder stays pure: it then has no I/O to
+      // fail on, and the one place that can fail is the one that explains why.
+      const existing = existsSync(pyprojectPath) ? readFileSync(pyprojectPath, 'utf-8') : null;
+      writeFileSync(pyprojectPath, mutmutConfigContent(existing, sourcePathsLine), {
+        encoding: 'utf-8',
+      });
+    } catch (err) {
+      // A missing or half-written pyproject.toml would make mutmut scan the wrong
+      // tree, so surface the path instead of letting a bare fs error escape.
+      throw new Error(`Could not write mutmut config to ${pyprojectPath}: ${(err as Error).message}`);
     }
-    writeFileSync(pyprojectPath, content, { encoding: 'utf-8' });
   }
 }
+
+/**
+ * pyproject.toml content with `[tool.mutmut] source_paths` set as requested.
+ *
+ * Pure by design: the caller reads the existing file and passes it in, so this
+ * function has no I/O that could fail partway through. Three shapes have to be
+ * preserved -- an existing `source_paths` is rewritten in place, a bare
+ * `[tool.mutmut]` table gets the key added, and a file without the table gets
+ * one appended (a fresh file passes `null`).
+ *
+ * @param existing current file content, or null when the file does not exist.
+ */
+function mutmutConfigContent(existing: string | null, sourcePathsLine: string): string {
+  if (existing === null) return `[tool.mutmut]\n${sourcePathsLine}\n`;
+  if (!existing.includes('[tool.mutmut]')) {
+    return existing.trimEnd() + `\n\n[tool.mutmut]\n${sourcePathsLine}\n`;
+  }
+  const sourcePathsRegex = /source_paths\s*=\s*\[.*?\]/;
+  if (sourcePathsRegex.test(existing)) return existing.replace(sourcePathsRegex, sourcePathsLine);
+  return existing.replace('[tool.mutmut]', `[tool.mutmut]\n${sourcePathsLine}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.16",
+  "version": "0.35.17",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.16",
+  "version": "0.35.17",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.16",
+  "version": "0.35.17",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.16",
+  "version": "0.35.17",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.16",
+  "version": "0.35.17",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/principles/adapters/import-clause.ts

@@ -0,0 +1,57 @@
+/**
+ * Import-clause parsing for the TypeScript adapter's `imports` getter.
+ *
+ * Extracted from `typescript.ts` so that one function does not have to carry
+ * both the parsing rules and the usage-scoring loop: together they pushed the
+ * getter past the 50-line budget and to 5 nesting levels. Splitting also lets
+ * the clause grammar be tested without reading a file.
+ */
+
+/** One symbol bound by an import statement. */
+export interface ImportBinding {
+  name: string;
+  type?: string;
+}
+
+/** A plain identifier -- these are the only names an import can bind. */
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
+
+/**
+ * Parse the clause between `import` and `from` into the symbols it binds.
+ *
+ * Covers the four shapes TypeScript allows: a default binding, a named brace
+ * list (with per-member `type` and `as` renames), and a namespace binding.
+ *
+ * @param clause text between `import` / `import type` and `from`
+ * @param isTypeOnly whether the whole statement was `import type ...`
+ */
+export function parseImportClause(clause: string, isTypeOnly: boolean): ImportBinding[] {
+  const bindings: ImportBinding[] = [];
+  const marker = isTypeOnly ? 'type' : undefined;
+  const push = (name: string, type?: string): void => {
+    if (IDENTIFIER.test(name)) bindings.push({ name, ...(type ? { type } : {}) });
+  };
+
+  // default import
+  const def = /^(\w+)/.exec(clause);
+  if (def) push(def[1], marker);
+
+  // named imports { a, b as c }
+  const braces = /\{([\s\S]*?)\}/.exec(clause);
+  if (braces) {
+    for (const raw of braces[1].split(',')) {
+      const part = raw.trim();
+      if (!part) continue;
+      const asMatch = /\bas\s+(\w+)\s*$/.exec(part);
+      const local = asMatch ? asMatch[1] : part.replace(/^type\s+/, '').trim();
+      const memberTypeOnly = /^type\s+/.test(part);
+      push(local, isTypeOnly || memberTypeOnly ? 'type' : undefined);
+    }
+  }
+
+  // namespace import * as ns
+  const ns = /\*\s+as\s+(\w+)/.exec(clause);
+  if (ns) push(ns[1], marker);
+
+  return bindings;
+}

package/principles/adapters/member-scan.ts

@@ -0,0 +1,73 @@
+/**
+ * Class-member scanning for the TypeScript adapter.
+ *
+ * Extracted from `typescript.ts` to keep that file inside its line budget, and
+ * because this is the piece that was wrong: counting members by looking at the
+ * character BEFORE a name reported every call site inside a method body as a
+ * member. `{ helper(1); }` and `{ async run() { ... }` differ in what follows the
+ * name, not in what precedes it -- so depth is what separates them.
+ */
+
+/** Words that look like `name(` but are control flow, never members. */
+const CONTROL_KEYWORDS = new Set([
+  'if', 'for', 'while', 'switch', 'catch', 'return', 'typeof', 'new',
+]);
+
+/** Class body members live one level in: the body string starts AT its `{`. */
+const MEMBER_DEPTH = 1;
+
+/**
+ * Names of the members declared directly in a class body.
+ *
+ * Depth-aware rather than prefix-aware: a member declaration sits at brace
+ * depth 1 of the body, and a call inside a method sits deeper. Nesting is
+ * tracked over the MASKED body, so braces inside strings and comments cannot
+ * shift the depth -- prose in a JSDoc line like
+ * "three separate events (close / error / timeout)" otherwise reads as
+ * `events(` and is counted as a method, as is `unknown` from `(): unknown {`.
+ *
+ * Arrow-function properties (`handler = () => {}`) carry no `name(` shape and
+ * are not counted; they were not counted before either.
+ */
+export function countTopLevelMembers(body: string): string[] {
+  const names: string[] = [];
+  let depth = 0;
+  for (let i = 0; i < body.length; i += 1) {
+    const c = body[i];
+    if (c === '{') { depth += 1; continue; }
+    if (c === '}') { depth -= 1; continue; }
+    if (depth !== MEMBER_DEPTH || c !== '(') continue;
+    const name = memberNameBefore(body, i);
+    if (name && !CONTROL_KEYWORDS.has(name.value)) names.push(name.value);
+  }
+  return names;
+}
+
+/**
+ * The identifier immediately before the `(` at `parenIndex`, skipping modifiers
+ * (`public`, `static`, `async`, `readonly`, `get`, `set`, `*`).
+ *
+ * @returns the name and its offset, or null when no identifier precedes the paren.
+ */
+function memberNameBefore(
+  body: string,
+  parenIndex: number,
+): { value: string; index: number } | null {
+  let end = parenIndex;
+  while (end > 0 && /\s/.test(body[end - 1])) end -= 1;
+  let start = end;
+  while (start > 0 && /[\w$]/.test(body[start - 1])) start -= 1;
+  if (start === end) return null;
+  return { value: body.substring(start, end), index: start };
+}
+
+/**
+ * Claim a `name@offset` key once, so overlapping extraction shapes cannot
+ * double-count the same declaration.
+ */
+export function claimMember(seen: Set<string>, name: string, nameIndex: number): boolean {
+  const key = `${name}@${nameIndex}`;
+  if (seen.has(key)) return false;
+  seen.add(key);
+  return true;
+}

package/principles/adapters/position-analysis.ts

@@ -0,0 +1,43 @@
+/**
+ * Position analysis for TypeScript's regex-based extraction.
+ *
+ * The extraction regexes match `name(` for both a method DECLARATION and a CALL.
+ * This module answers which one it is, keeping `typescript.ts` inside its line
+ * budget and giving the rule a place to be tested directly.
+ */
+
+/**
+ * Characters that can only precede a CALL, never a declaration.
+ *
+ * `.` covers member calls (`this.c()`, `obj.method()`), `(` a call used as an
+ * argument (`if (existsSync(p))`), `,` a call in a list (`foo(a, bar(b))`), and
+ * the operators cover a call in a condition or expression
+ * (`hadExisting && existsSync(p)`, `x = read(p)`, `!isReady(q)`). No member
+ * declaration begins with any of them.
+ *
+ * Deliberately NOT included: `{`, `;`, `}` and plain whitespace. Those precede
+ * BOTH shapes -- `{ helper(1); }` is a call, `{ run(): void {` is a declaration
+ * -- so using them makes the answer depend on formatting. Depth is what
+ * separates those two, which is why extractClasses counts by brace depth.
+ */
+const CALL_PRECEDERS = new Set([
+  '.', '(', ',',
+  '&', '|', '=', '!', '?', ':', '+', '-', '*', '/', '<', '>', '[',
+]);
+
+/**
+ * Is the identifier starting at `nameIndex` a call rather than a declaration?
+ *
+ * Without this check `if (existsSync(p))` was extracted as a method named
+ * `existsSync` -- the extraction regex's lookbehind permits `(` before the name
+ * -- which then borrowed the enclosing block's brace as a "body" and reported a
+ * phantom `missing-error-handling` warning that no edit could clear. It also
+ * inflated `extractClasses().methodCount` with the names of whatever the class
+ * body happened to call (66 reported for a class declaring 30).
+ */
+export function isCallPosition(masked: string, nameIndex: number): boolean {
+  let i = nameIndex - 1;
+  while (i >= 0 && /\s/.test(masked[i])) i -= 1;
+  return i >= 0 && CALL_PRECEDERS.has(masked[i]);
+}
+

package/principles/adapters/quote-state.ts

@@ -0,0 +1,80 @@
+/**
+ * Character-level quote and delimiter tracking for TypeScript source scanning.
+ *
+ * The param-list and brace scanners all need "is this delimiter inside a string
+ * or template?" before they can act on it. That logic is identical for every
+ * caller, so it lives here instead of being repeated -- and it keeps
+ * `typescript.ts` inside the 1050-line budget.
+ */
+
+export interface QuoteState {
+  inSingle: boolean;
+  inDouble: boolean;
+  inTemplate: boolean;
+}
+
+export function newQuoteState(): QuoteState {
+  return { inSingle: false, inDouble: false, inTemplate: false };
+}
+
+export function inQuotedState(state: QuoteState): boolean {
+  return state.inSingle || state.inDouble || state.inTemplate;
+}
+
+/** The three quote kinds tracked by QuoteState, with the flag that marks each. */
+const QUOTE_KINDS: ReadonlyArray<{ quote: string; flag: 'inSingle' | 'inDouble' | 'inTemplate' }> = [
+  { quote: "'", flag: 'inSingle' },
+  { quote: '"', flag: 'inDouble' },
+  { quote: '`', flag: 'inTemplate' },
+];
+
+/**
+ * Advance one character of quote tracking.
+ *
+ * Extracted because `countParams` and `readParenGroup` carried the same
+ * six-branch block verbatim (#602): both must ignore delimiters that appear
+ * inside a string, and neither may treat an escape as a closing quote.
+ *
+ * Table-driven (#620): all three quote kinds behave identically -- an escape
+ * skips two characters, the matching quote closes the literal -- so they are one
+ * rule applied to a list rather than three copies of it.
+ *
+ * @returns the number of characters consumed (2 when the next char is escaped).
+ */
+export function advanceQuoteState(src: string, i: number, state: QuoteState): number {
+  const c = src[i];
+
+  for (const kind of QUOTE_KINDS) {
+    if (!state[kind.flag]) continue;
+    if (c === '\\') return 2;
+    if (c === kind.quote) state[kind.flag] = false;
+    return 1;
+  }
+
+  // Not inside any literal: open the one this character starts, if any.
+  const opener = QUOTE_KINDS.find(kind => kind.quote === c);
+  if (opener) state[opener.flag] = true;
+  return 1;
+}
+
+/** Opening delimiters that raise the generic/bracket depth in a param list. */
+const DEPTH_OPENERS = new Set(['(', '[', '{', '<']);
+/** Closing delimiters that lower it. */
+const DEPTH_CLOSERS = new Set([')', ']', '}', '>']);
+
+/**
+ * Adjust `depth` for one delimiter.
+ * @returns true when the character was a delimiter (so it cannot also be a
+ *          separator), false otherwise.
+ */
+export function applyDelimiter(c: string, depth: { value: number }): boolean {
+  if (DEPTH_OPENERS.has(c)) { depth.value++; return true; }
+  if (DEPTH_CLOSERS.has(c)) { depth.value--; return true; }
+  return false;
+}
+
+/** True when the character opens a quote/template the scanners must skip. */
+export function isQuote(c: string): boolean {
+  return c === "'" || c === '"' || c === '`';
+}
+

package/principles/adapters/typescript.ts

@@ -1,5 +1,11 @@
 import { BaseAdapter } from './base';
 import { Adapter } from '../types';
+import { isCallPosition } from './position-analysis';
+import { claimMember, countTopLevelMembers } from './member-scan';
+import { parseImportClause } from './import-clause';
+import {
+  type QuoteState, newQuoteState, inQuotedState, advanceQuoteState, applyDelimiter, isQuote,
+} from './quote-state';
 
 /** IO-ish callees that the missing-error-handling rule cares about. */
 const IO_CALLEES = [
@@ -181,77 +187,6 @@ function lineOf(src: string, index: number): number {
 }
 
 /** The three quoted states shared by the parameter/paren scanners. */
-interface QuoteState {
-  inSingle: boolean;
-  inDouble: boolean;
-  inTemplate: boolean;
-}
-
-function newQuoteState(): QuoteState {
-  return { inSingle: false, inDouble: false, inTemplate: false };
-}
-
-function inQuotedState(state: QuoteState): boolean {
-  return state.inSingle || state.inDouble || state.inTemplate;
-}
-
-/** The three quote kinds tracked by QuoteState, with the flag that marks each. */
-const QUOTE_KINDS: ReadonlyArray<{ quote: string; flag: 'inSingle' | 'inDouble' | 'inTemplate' }> = [
-  { quote: "'", flag: 'inSingle' },
-  { quote: '"', flag: 'inDouble' },
-  { quote: '`', flag: 'inTemplate' },
-];
-
-/**
- * Advance one character of quote tracking.
- *
- * Extracted because `countParams` and `readParenGroup` carried the same
- * six-branch block verbatim (#602): both must ignore delimiters that appear
- * inside a string, and neither may treat an escape as a closing quote.
- *
- * Table-driven (#620): all three quote kinds behave identically -- an escape
- * skips two characters, the matching quote closes the literal -- so they are one
- * rule applied to a list rather than three copies of it.
- *
- * @returns the number of characters consumed (2 when the next char is escaped).
- */
-function advanceQuoteState(src: string, i: number, state: QuoteState): number {
-  const c = src[i];
-
-  for (const kind of QUOTE_KINDS) {
-    if (!state[kind.flag]) continue;
-    if (c === '\\') return 2;
-    if (c === kind.quote) state[kind.flag] = false;
-    return 1;
-  }
-
-  // Not inside any literal: open the one this character starts, if any.
-  const opener = QUOTE_KINDS.find(kind => kind.quote === c);
-  if (opener) state[opener.flag] = true;
-  return 1;
-}
-
-/** Opening delimiters that raise the generic/bracket depth in a param list. */
-const DEPTH_OPENERS = new Set(['(', '[', '{', '<']);
-/** Closing delimiters that lower it. */
-const DEPTH_CLOSERS = new Set([')', ']', '}', '>']);
-
-/**
- * Adjust `depth` for one delimiter.
- * @returns true when the character was a delimiter (so it cannot also be a
- *          separator), false otherwise.
- */
-function applyDelimiter(c: string, depth: { value: number }): boolean {
-  if (DEPTH_OPENERS.has(c)) { depth.value++; return true; }
-  if (DEPTH_CLOSERS.has(c)) { depth.value--; return true; }
-  return false;
-}
-
-/** True when the character opens a quote/template the scanners must skip. */
-function isQuote(c: string): boolean {
-  return c === "'" || c === '"' || c === '`';
-}
-
 /** Count top-level, comma-separated parameters in a raw parameter list. */
 function countParams(rawList: string): number {
   const trimmed = rawList.trim();
@@ -726,37 +661,13 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
     const importRe = /^[ \t]*import\s+(?:type\s+)?([\s\S]*?)\s+from\s+['"][^'"]+['"]/gm;
     const importSpans: Array<[number, number]> = [];
     let m: RegExpExecArray | null;
-    const idRe = /^[A-Za-z_$][\w$]*$/;
 
     while ((m = importRe.exec(src)) !== null) {
-      const clause = m[1].trim();
       const line = lineOf(src, m.index);
       const isTypeOnly = /^import\s+type\b/.test(m[0]);
-      const push = (name: string, type?: string) => {
-        if (idRe.test(name)) entries.push({ name, line, used: false, ...(type ? { type } : {}) });
-      };
-
-      // default import
-      const def = /^(\w+)/.exec(clause);
-      if (def) push(def[1], isTypeOnly ? 'type' : undefined);
-
-      // named imports { a, b as c }
-      const braces = /\{([\s\S]*?)\}/.exec(clause);
-      if (braces) {
-        for (const raw of braces[1].split(',')) {
-          const part = raw.trim();
-          if (!part) continue;
-          const asMatch = /\bas\s+(\w+)\s*$/.exec(part);
-          const local = asMatch ? asMatch[1] : part.replace(/^type\s+/, '').trim();
-          const memberTypeOnly = /^type\s+/.test(part);
-          push(local, isTypeOnly || memberTypeOnly ? 'type' : undefined);
-        }
+      for (const binding of parseImportClause(m[1].trim(), isTypeOnly)) {
+        entries.push({ ...binding, line, used: false });
       }
-
-      // namespace import * as ns
-      const ns = /\*\s+as\s+(\w+)/.exec(clause);
-      if (ns) push(ns[1], isTypeOnly ? 'type' : undefined);
-
       importSpans.push([m.index, m.index + m[0].length]);
     }
 
@@ -831,7 +742,9 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       length: hasBraces ? Math.max(1, endLine - startLine + 1) : 1,
       paramCount: countParams(inner),
       nestingDepth: hasBraces ? maxNesting(maskLiterals(body)) : 0,
-      hasTryCatch: /\btry\s*\{/.test(masked.substring(bodyOpen, bodyEnd)),
+      // The RAW body: `on('error', ...)` needs its string literal intact, and
+      // masking blanks string bodies. try/catch is a keyword and is unaffected.
+      hasTryCatch: hasErrorHandling(body),
       ioOperations: ioOperationsIn(masked.substring(bodyOpen, bodyEnd)),
       code: body,
     };
@@ -853,13 +766,6 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
   }
 
   /** Claim a `name@offset` key once, so overlapping shapes cannot double-count. */
-  private claim(seen: Set<string>, name: string, nameIndex: number): boolean {
-    const key = `${name}@${nameIndex}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  }
-
   /** `function name(...)` declarations, including export / async / generators. */
   private collectFunctionDecls(seen: Set<string>, found: FunctionMetrics[]): void {
     const masked = this.maskedSource;
@@ -871,7 +777,7 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       if (parenIndex === -1) continue;
       const bodyOpen = findBodyBrace(masked, parenIndex);
       if (bodyOpen === -1) continue;
-      if (!this.claim(seen, m[1], nameIndex)) continue;
+      if (!claimMember(seen, m[1], nameIndex)) continue;
       found.push(this.buildFunction(m[1], 'function', nameIndex, parenIndex, bodyOpen));
     }
   }
@@ -892,10 +798,11 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       // parameter list or a type annotation, which corrupted the reported span.
       const parenIndex = m.index + m[0].length - 1;
       const nameIndex = parenIndex - m[1].length;
+      if (isCallPosition(masked, nameIndex)) continue;
       // Only treat as a method when a body brace follows the parameter list.
       const bodyOpen = findBodyBrace(masked, parenIndex);
       if (bodyOpen === -1) continue;
-      if (!this.claim(seen, m[1], nameIndex)) continue;
+      if (!claimMember(seen, m[1], nameIndex)) continue;
       found.push(this.buildFunction(m[1], 'method', nameIndex, parenIndex, bodyOpen));
     }
   }
@@ -909,7 +816,7 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       const arrow = this.parseArrowAt(m, arrowRe.lastIndex);
       if (!arrow) continue;
       const nameIndex = m.index + m[0].length - m[1].length;
-      if (!this.claim(seen, m[1], nameIndex)) continue;
+      if (!claimMember(seen, m[1], nameIndex)) continue;
       found.push(this.buildArrowMetrics(m[1], nameIndex, arrow));
     }
   }
@@ -1003,14 +910,19 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       if (bodyOpen === -1) continue;
       const bodyEnd = findBlockEnd(masked, bodyOpen);
       const body = src.substring(bodyOpen, bodyEnd);
-
-      // Count method-ish members. Not anchored to line start: minified /
-      // single-line class bodies (`m1() {} m2() {}`) are valid TS and must count.
-      // `(?<![\w$.])` avoids matching call sites like `foo.bar(`.
-      const memberRe = /(?<![\w$.])(?:public\s+|private\s+|protected\s+|static\s+|async\s+|readonly\s+|get\s+|set\s+|\*\s*)*(\w+)\s*\(/g;
-      const methods = [...body.matchAll(memberRe)]
-        .map(x => x[1])
-        .filter(n => !['if', 'for', 'while', 'switch', 'catch', 'return', 'typeof', 'new'].includes(n));
+      // Members are counted on the MASKED body: the prose in a JSDoc line like
+      // "three separate events (close / error / timeout)" reads as `events(` and
+      // was counted as a method, as did `unknown` from a `(): unknown {` return
+      // type. Masking blanks comments and string bodies, so only real code has
+      // braces and parens left.
+      const maskedBody = masked.substring(bodyOpen, bodyEnd);
+
+      // Count members declared at the class body's TOP brace depth. A call
+      // inside a method body sits one level deeper, which is the only signal
+      // that separates `{ helper(1); }` from `{ async run() { ... }`.
+      // Earlier attempts compared the preceding character and reported 66
+      // methods for a class declaring 30 -- every call site counted once.
+      const methods = countTopLevelMembers(maskedBody);
 
       results.push({
         name,
@@ -1065,3 +977,32 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
     return exportMatches;
   }
 }
+
+
+/**
+ * Does this function handle failures?
+ *
+ * `try`/`catch` is one way, and for a function that owns a child process it is
+ * not the idiomatic one: Node reports spawn failures through an `'error'`
+ * event, and a `try` around `spawn()` would never see them. Treating the event
+ * listener as unhandled reported `runMutmut` for having "I/O without error
+ * handling" while it was in fact the only handler for that failure mode --
+ * a warning no correct edit could clear, which is how a rule loses its meaning.
+ *
+ * `'error'` is matched as a QUOTED argument (`on('error', ...)`) so that a
+ * string that merely contains the word does not qualify.
+ */
+function hasErrorHandling(body: string): boolean {
+  return TRY_BLOCK.test(body) || ERROR_LISTENER.test(body);
+}
+
+/**
+ * The two handler shapes, as module-level constants.
+ *
+ * ccn-report locates a function body by counting brackets on its lines; a regex
+ * literal INSIDE the body makes that extent ambiguous, and the row comes back
+ * "CCN could not be span-verified" -- a Gate 3 block. Brackets and braces in the
+ * patterns are written as character classes for the same reason.
+ */
+const TRY_BLOCK = /\btry\s*[{]/;
+const ERROR_LISTENER = /\bon\s*[(]\s*['"]error['"]\s*,/;

package/principles/rules/clean-code/god-class.ts

@@ -15,25 +15,26 @@ export const godClassRule: Rule = {
       code?: string;
       line: number;
       name: string;
+      /** Method count when the adapter parsed the class structurally. */
+      methodCount?: number;
     }
-    
+
     interface TypedAdapter {
       extractClasses?: () => ClassObject[] | undefined;
     }
-    
+
     const typedAdapter = adapter as TypedAdapter;
     const classes = typedAdapter.extractClasses?.() || [];
-    
+
     for (const cls of classes) {
-      const methodMatches = cls.code?.match(/(get|set)\s+\w+\s*\(|\w+\s*\([^)]*\)\s*{/g) || [];
-      
-      const methodCount = methodMatches.filter((m: string) => {
-        if (m.startsWith('get ') || m.startsWith('set ')) {
-          return false;
-        }
-        return true;
-      }).length;
-      
+      // Prefer the adapter's structural count. The regex fallback below cannot
+      // see methods whose signature spans lines or carries a return type, so on
+      // `TypeScriptAdapter` (66 methods) it counted 0 while `solid.srp` read the
+      // adapter's own figure and reported it -- the same class, two different
+      // answers, and the wrong one was silent. A count the adapter already
+      // computed must not be recomputed by guessing at source text.
+      const methodCount = cls.methodCount ?? countMethodsByRegex(cls.code);
+
       if (methodCount > (settings.threshold ?? 0)) {
         violations.push({
           file,
@@ -46,7 +47,29 @@ export const godClassRule: Rule = {
         });
       }
     }
-    
+
     return violations;
   }
-};
+};
+
+/**
+ * Source-text method matcher.
+ *
+ * Kept at module scope on purpose: ccn-report locates a function body by counting
+ * brackets on its lines, so a regex literal inside the body makes the extent
+ * ambiguous and the row comes back "CCN could not be span-verified".
+ */
+const METHOD_PATTERN = /(?:get|set)\s+\w+\s*[(]|\w+\s*[(][^)]*[)]\s*[{]/g;
+
+/** A matched accessor keyword pair rather than a real method. */
+const ACCESSOR_PATTERN = /^(?:get|set)\s/;
+
+/**
+ * Count methods by matching source text. Only used when the adapter does not
+ * report `methodCount` (Java, C++ and other regex-backed adapters), so the
+ * getter/setter exclusion stays meaningful.
+ */
+function countMethodsByRegex(code: string | undefined): number {
+  const methodMatches = code?.match(METHOD_PATTERN) ?? [];
+  return methodMatches.filter((m: string) => !ACCESSOR_PATTERN.test(m)).length;
+}

package/principles/rules/solid/dip.ts

@@ -1,8 +1,14 @@
 import { Rule, Violation, Severity } from '../../types';
 import { getActiveConfig } from '../../config';
 
+// Value objects, not collaborators. Every entry here is a type that ordinary
+// code CONSTRUCTS from data it already has, and that has no injectable
+// alternative: you cannot pass in a Date/Map/RegExp factory any more usefully
+// than you can pass in the number 1. Constructing one is not the inversion being
+// bypassed, so reporting it teaches the wrong lesson (#676).
 const DEFAULT_EXCLUDED_CLASSES = [
-  'Date', 'Map', 'Set', 'Error', 'Array', 'Object', 'Promise'
+  'Date', 'Map', 'Set', 'Error', 'Array', 'Object', 'Promise',
+  'RegExp', 'Number', 'String', 'Boolean', 'BigInt', 'Symbol', 'WeakMap', 'WeakSet',
 ];
 
 /**
@@ -10,9 +16,16 @@ const DEFAULT_EXCLUDED_CLASSES = [
  *
  * A module-load snapshot was #457: a project's `.principlesrc` override was
  * parsed but never consulted.
+ *
+ * The config entry EXTENDS the built-in value-object list rather than replacing
+ * it (#676). Replacing meant a project that added one name silently lost every
+ * default exemption -- `.principlesrc` here lists 7 entries, so `new RegExp()`
+ * was reported even though the default list would have excused it. A project
+ * cannot reasonably be expected to restate the built-ins it never knew about.
  */
 function excludedClasses(): (string | number)[] {
-  return getActiveConfig().rules['solid']['dip'].exclude ?? DEFAULT_EXCLUDED_CLASSES;
+  const configured = getActiveConfig().rules['solid']['dip'].exclude ?? [];
+  return [...new Set([...DEFAULT_EXCLUDED_CLASSES, ...configured])];
 }
 
 function shouldSkipInstantiation(className: string): boolean {

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-31
-**Commit:** 3aa988e7
+**Commit:** 26a741de
 **Branch:** main
-**Version:** 0.35.16.0
+**Version:** 0.35.17.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.