@boyingliu01/xp-gate 0.35.18 → 0.35.19

package/adapters/gate-3.sh

@@ -172,8 +172,19 @@ elif [ "$PROJECT_LANG" = "powershell" ]; then
                   const entries = baseline.functions || baseline.entries || baseline;
                   if (Array.isArray(entries)) {
                     for (const e of entries) {
-                      if (!e || !e.file || !e.name) continue;
-                      known.set(norm(e.file) + "::" + e.name, Number(e.ccn) || 0);
+                      // #632: accept the key the baseline WRITER actually emits.
+                      // tools/Update-ComplexityBaseline.ps1 (the tool this gate
+                      // points at in its own fix-it message) writes "function",
+                      // while this reader only knew "name" -- so every entry was
+                      // dropped, "known" stayed empty, and every function above
+                      // the threshold became a brand-new function. The ratchet
+                      // could never pass. Both spellings are read: this is a
+                      // reader, and the writer vocabulary is not ours to
+                      // redefine from here.
+                      if (!e || !e.file) continue;
+                      const fnName = e.name || e.function;
+                      if (!fnName) continue;
+                      known.set(norm(e.file) + "::" + fnName, Number(e.ccn) || 0);
                     }
                   }
                   // The measurement emits ABSOLUTE paths (pwsh resolved them), while
@@ -450,6 +461,52 @@ else
           GATE_3_DETAIL="mode=ratchet verifier=MISSING"
           exit 1
         fi
+        RATCHET_LIB="$GATE_DIR/lib/ccn-ratchet.sh"
+        [ -f "$RATCHET_LIB" ] || RATCHET_LIB="$(git rev-parse --show-toplevel 2>/dev/null)/githooks/lib/ccn-ratchet.sh"
+        # #617: grade exactly the population the baseline was written from.
+        #
+        # The comment below has always said so, but only as a comment: a repo whose
+        # baseline came from a narrower scan (a Java-only ccn-report, say) had its
+        # vendored minified JS graded anyway, and --csv-verified then disagreed with
+        # lizard on single-line code and fail-closed with "could not be
+        # span-verified". That BLOCK has no repair: the file has no baseline entry
+        # to ratchet, so there is nothing the user could add to clear it.
+        #
+        # The population filter runs BEFORE verification on purpose. Domain
+        # restriction is decidable from the path alone, so asking the expensive
+        # span re-derivation about a file that will not be graded anyway only
+        # manufactures failures for code the ratchet never claims to cover.
+        if [ -f "$RATCHET_LIB" ]; then
+          # shellcheck source=/dev/null
+          . "$RATCHET_LIB" 2>/dev/null || true
+          if declare -F ccn_file_in_population >/dev/null 2>&1; then
+            _cc_pop_kept=""
+            _cc_pop_skipped=""
+            while IFS= read -r _cc_row; do
+              [ -n "$_cc_row" ] || continue
+              _cc_row_path=$(printf '%s' "$_cc_row" | awk -F, '{print $1}')
+              if ccn_file_in_population ".ccn-baseline.json" "$_cc_row_path"; then
+                _cc_pop_kept="${_cc_pop_kept}${_cc_row}
+"
+              else
+                _cc_pop_skipped="${_cc_pop_skipped}${_cc_row_path}
+"
+              fi
+            done <<CC_POP_EOF
+$CC_CSV
+CC_POP_EOF
+            CC_CSV=$(printf '%s' "$_cc_pop_kept")
+            if [ -n "$_cc_pop_skipped" ]; then
+              _cc_pop_skip_n=$(printf '%s' "$_cc_pop_skipped" | grep -c . || true)
+              echo "ℹ️  Gate 3: ${_cc_pop_skip_n:-0} file(s) outside the baseline population — not graded, not ratcheted:"
+              printf '%s' "$_cc_pop_skipped" | sed 's/^/     /' | sed -n '1,5p'
+              if [ "${_cc_pop_skip_n:-0}" -gt 5 ]; then
+                echo "     ... and $((_cc_pop_skip_n - 5)) more"
+              fi
+              echo "     (declare or widen the population in .ccn-baseline.json to grade them)"
+            fi
+          fi
+        fi
         if [ -f "$CC_REPORT" ] && command -v node >/dev/null 2>&1; then
           _cc_verify_failed=0
           CC_CSV_VERIFIED=$(printf '%s\n' "$CC_CSV" | node "$CC_REPORT" --csv-verified batch --root "$(git rev-parse --show-toplevel 2>/dev/null)") || _cc_verify_failed=1
@@ -460,8 +517,6 @@ else
           fi
           CC_CSV="$CC_CSV_VERIFIED"
         fi
-        RATCHET_LIB="$GATE_DIR/lib/ccn-ratchet.sh"
-        [ -f "$RATCHET_LIB" ] || RATCHET_LIB="$(git rev-parse --show-toplevel 2>/dev/null)/githooks/lib/ccn-ratchet.sh"
         # Fail closed when the ratchet library is missing. Sourcing a nonexistent
         # file only prints "No such file or directory" and leaves
         # evaluate_ccn_ratchet undefined; the verdict then came back empty, every
@@ -529,13 +584,43 @@ else
       # this, a crashing or mis-invoked lizard yields 0 warnings and the gate
       # reports PASSED on zero analysed functions -- the same silent-success
       # failure this issue is about.
+      #
+      # #666: "no rows" has TWO causes and they must not share a verdict. A
+      # module of pure constants legitimately has zero functions, and lizard
+      # emits no row for it at all (measured: `lizard pure_data.py --csv` prints
+      # nothing and exits 0). That was reported as `lizard_output_unparsable`
+      # /WARN, which is the message for a BROKEN lizard -- so a healthy run on a
+      # data-only diff was indistinguishable from a tooling fault. The two are
+      # separated by a POSITIVE probe: ask lizard to describe a fixture known to
+      # contain a function. If it produces rows, lizard works and the input
+      # simply had no functions (SKIP, `no_functions_in_input`); if it does not,
+      # the tool really is broken (WARN, `lizard_output_unparsable`).
       if ! printf '%s\n' "$CC_CSV_FLAT" | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { found = 1; exit }
                                                  END { exit(found ? 0 : 1) }'; then
-        echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
-        GATE_3_STATUS="WARN"
-        # Consumed by the sourcing parent (pre-commit report JSON), not here.
-        # shellcheck disable=SC2034
-        GATE_3_REASON="lizard_output_unparsable"
+        _lizard_probe_dir=$(mktemp -d 2>/dev/null || echo "${TMPDIR:-/tmp}")
+        _lizard_probe_file="$_lizard_probe_dir/xp-gate-lizard-probe.py"
+        printf 'def _xp_gate_probe(x):\n    if x:\n        return 1\n    return 0\n' > "$_lizard_probe_file" 2>/dev/null
+        _lizard_probe_rows=0
+        if [ -f "$_lizard_probe_file" ]; then
+          _lizard_probe_rows=$(printf '%s\n' "$_lizard_probe_file" \
+            | lizard_batches --csv 2>/dev/null \
+            | awk -F, 'NF > 1 && $2 ~ /^[0-9]+$/ { c++ } END { print c + 0 }')
+        fi
+        rm -rf "$_lizard_probe_dir" 2>/dev/null || true
+        if [ "${_lizard_probe_rows:-0}" -gt 0 ]; then
+          echo "⏭️  SKIPPED - Complexity: the changed source files define no functions (pure data module)."
+          echo "   Verified: lizard parsed a probe fixture normally, so this is an empty result set, not a broken tool."
+          GATE_3_STATUS="SKIP"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="no_functions_in_input"
+        else
+          echo "⚠️  WARN - lizard produced no parsable results; complexity not verified"
+          GATE_3_STATUS="WARN"
+          # Consumed by the sourcing parent (pre-commit report JSON), not here.
+          # shellcheck disable=SC2034
+          GATE_3_REASON="lizard_output_unparsable"
+        fi
       elif [ "$CC_WARNINGS" -gt 0 ]; then
         echo "$CC_OUTPUT"
         echo ""

package/adapters/gate-4.sh

@@ -46,7 +46,14 @@ java_coverage_note() {
     esac
   done
   [ -n "$_has_java" ] || return 0
-  echo "ℹ️  Java rule coverage: $JAVA_COVERAGE_EFFECTIVE/$JAVA_COVERAGE_TOTAL rules effective (inert on Java: $JAVA_COVERAGE_INERT -- see docs/java-principles-coverage.md)"
+  # #628: `docs/` is not in the npm package's `files` list, so pointing a user at
+  # `docs/java-principles-coverage.md` was a dead path in every installed project --
+  # the note told them to read a file that does not exist on their machine. Cite the
+  # upstream URL instead, and keep the local path only when the doc is actually
+  # present (i.e. when running inside this repo).
+  local _where="https://github.com/boyingliu01/xp-gate/blob/main/docs/java-principles-coverage.md"
+  [ -f "docs/java-principles-coverage.md" ] && _where="docs/java-principles-coverage.md"
+  echo "ℹ️  Java rule coverage: $JAVA_COVERAGE_EFFECTIVE/$JAVA_COVERAGE_TOTAL rules effective (inert on Java: $JAVA_COVERAGE_INERT -- see $_where)"
 }
 
  2>&1 echo ""
@@ -165,42 +172,30 @@ else
         rm -f "$PRINCIPLES_STDERR"
 
         if [ "$PRINCIPLES_EXIT" -ge 2 ]; then
-          # Fail-closed (#661), same rule as Gate 8 (#499): a gate that cannot run
-          # must not report success.
+          # #661: exit>=2 means the checker did not RUN (crash, module not found,
+          # bad invocation). This used to record SKIP, and pre-commit treats SKIP
+          # as non-blocking, so a tool failure was absorbed into the green light --
+          # the reproduction printed a module-not-found stack trace and then
+          # "✅ PASSED - Principles checker (no errors found)".
           #
-          # This branch used to settle on SKIP, which the caller reads as
-          # non-blocking -- so a checker that crashed on startup
-          # (`Cannot find module 'C:\c\Users\...'`, the POSIX-path-to-native-node
-          # bug) still printed "PASSED - Principles checker (no errors found)".
-          # The path conversion fixed that one cause; any other way of breaking
-          # the launch (missing tsx, corrupt module, OOM) lands here too, and all
-          # of them would have been absorbed into a green light.
+          # The distinction the gate must keep:
+          #   - tool NOT INSTALLED  -> SKIP is honest; nothing is being claimed.
+          #   - tool PRESENT, CRASH -> WARN. Not a pass (nothing was checked) and
+          #     not a silent skip (the user must know their code went unaudited).
           #
-          # SKIP stays reserved for "language not applicable / tool not
-          # installed", which is not what this is: the checker exists and failed.
-          echo ""
-          echo "❌ BLOCKED - Principles checker failed to execute (exit $PRINCIPLES_EXIT)"
-          echo "This is a tool fault, NOT a clean result. A gate that cannot run must not pass."
-          echo "  Fix the checker, or set PRINCIPLES_SKIP_TOOL_FAULT=1 to downgrade to a warning."
-          echo "  (downgrade is audit-logged and never allowed on main/master)"
-          GATE_4_STATUS="FAIL"
+          # WARN rather than FAIL on purpose: the commit itself is not necessarily
+          # bad, the TOOL is broken, and blocking every commit until node/tsx is
+          # repaired would blame the change for an environment fault. What must
+          # never happen is the green light.
+          echo "⚠️  Principles checker did not run (exit ${PRINCIPLES_EXIT}) — this code is NOT verified."
+          echo "     Gate 4 cannot claim a pass for a check that never executed."
+          echo "     Fix the checker invocation above (or run 'npx xp-gate check principles .')."
+          echo "⏭️  WARN - Principles check (checker execution error)"
+          GATE_4_STATUS="WARN"
+          # Consumed by the sourcing parent, not here (see #548).
           # shellcheck disable=SC2034
           GATE_4_REASON="checker_execution_error"
           rm -f "$PRINCIPLES_JSON"
-          if [ "${PRINCIPLES_SKIP_TOOL_FAULT:-0}" = "1" ]; then
-            echo "⚠️  ESCAPE VALVE: PRINCIPLES_SKIP_TOOL_FAULT=1 — downgrading to SKIP"
-            # Same asymmetry as Gate 5a: a downgrade is tolerable on a feature
-            # branch, never on main/master, where it would green-light the trunk.
-            _g4_branch="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)"
-            if [ "$_g4_branch" = "main" ] || [ "$_g4_branch" = "master" ]; then
-              echo "❌ ESCAPE VALVE BLOCKED: PRINCIPLES_SKIP_TOOL_FAULT not allowed on $_g4_branch"
-              GATE_4_STATUS="FAIL"
-              exit 1
-            fi
-            GATE_4_STATUS="SKIP"
-          else
-            exit 1
-          fi
         else
           # Check severity levels. The reporter emits JSON.stringify(out, null, 2),
           # i.e. `"severity": "warning"` WITH a space; tolerate any whitespace so a

package/adapters/gate-8.sh

@@ -59,10 +59,24 @@ fi
 # revisions and reports "0 commits scanned" on a pre-commit run -- so a staged
 # secret was never seen and Gate 8 always passed. `git --staged` scans
 # `git diff --cached`, which is exactly the pre-commit payload (#449).
+#
+# #616: `--all` is a different question, and the index is the wrong place to ask
+# it. Under `xp-gate check . --all` the user asked "is the whole tree clean", the
+# index is usually empty, `git --staged` legitimately found nothing, and that
+# nothing was counted as PASSED -- a secret sitting in a tracked file was
+# invisible to the one command meant to find it. The runner already exports
+# GATE_SCOPE (#589); this fragment just has to read it. `dir --no-git` scans the
+# filesystem so tracked-but-unmodified files are covered.
 GITLEAKS_REPORT="${TMPDIR:-/tmp}/gitleaks-report.json"
 rm -f "$GITLEAKS_REPORT"
-GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --staged --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
-GITLEAKS_EXIT=$?
+if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+  echo "     Scope: --all (scanning the working tree, not the index)"
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD dir --no-git --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
+  GITLEAKS_EXIT=$?
+else
+  GITLEAKS_OUTPUT=$($GITLEAKS_CMD git --staged --redact --no-banner $GITLEAKS_CONFIG --report-format=json --report-path="$GITLEAKS_REPORT" 2>&1)
+  GITLEAKS_EXIT=$?
+fi
 
 if [ "$GITLEAKS_EXIT" -eq 0 ]; then
   # Decide SKIP from the REPORT ARTIFACT, not from log wording. Parsing stdout
@@ -183,7 +197,22 @@ fi
 # if-condition (errexit-exempt); a non-zero hook exit lands in the else branch.
 if command -v detect-secrets-hook >/dev/null 2>&1 && [ -f ".secrets.baseline" ]; then
   DS_TMP="$(dirname "$(mktemp -u)")/ds-output.$$"
-  if git diff --cached --name-only --diff-filter=ACM -z \
+  # #616: same scope split as the gitleaks call above. Under `--all` the index is
+  # usually empty, so piping `git diff --cached -z` into xargs fed the hook zero
+  # files and it reported success without reading anything.
+  if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+    if git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline > "$DS_TMP" 2>&1; then
+      echo "     ✅ detect-secrets PASSED - no new secrets beyond baseline (scope: --all)."
+    else
+      cat "$DS_TMP"
+      echo ""
+      echo "     ❌ BLOCKED - detect-secrets found secrets not in .secrets.baseline."
+      echo "   If these are false positives, regenerate the baseline (cross-platform):"
+      echo "     detect-secrets scan --update .secrets.baseline && git add .secrets.baseline"
+      rm -f "$DS_TMP"
+      exit 1
+    fi
+  elif git diff --cached --name-only --diff-filter=ACM -z \
       | xargs -0 detect-secrets-hook --baseline .secrets.baseline > "$DS_TMP" 2>&1; then
     echo "     ✅ detect-secrets PASSED - no new secrets beyond baseline."
   else

package/adapters/gate-9.sh

@@ -32,8 +32,20 @@ if [ -z "$SEMGREP_CMD" ]; then
   echo "     Gate 9: SAST Security (WARN, semgrep not installed)"
   GATE_9_STATUS="WARN"
 else
-  # Get staged files filtered to Semgrep-supported languages
-  SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  # Get staged files filtered to Semgrep-supported languages.
+  #
+  # #616: under `--all` the index is usually empty, so the staged diff yielded no
+  # files and the gate reported SKIPPED -- "no supported language files changed"
+  # -- for a run whose whole purpose was to scan the tree. Same fail-open shape
+  # #589 fixed in Gate 3, one layer down: the CLI says the tree was checked and
+  # the fragment checks a diff that does not exist. The runner exports GATE_SCOPE;
+  # read it and enumerate tracked files instead.
+  if [ "${GATE_SCOPE:-diff}" = "all" ]; then
+    echo "     Scope: --all (scanning tracked files, not the index)"
+    SEMGREP_FILES=$(git ls-files 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  else
+    SEMGREP_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E '\.(ts|tsx|js|jsx|py|go|java|c|cpp|cs|rb|php|scala|swift)$' || true)
+  fi
 
   if [ -z "$SEMGREP_FILES" ]; then
     echo "     ⏭️  SKIPPED - SAST (no supported language files changed)"

package/lib/__tests__/doctor-delphi.test.js

@@ -337,3 +337,117 @@ describe('doctor delphi (#414 REQ-3/REQ-6)', () => {
     }
   });
 });
+
+// ── #684: the documented global-config fallback ──────────────────────────────
+// SKILL.md tells users to keep ONE machine-level config at
+// `~/.config/xp-gate/.delphi-config.json` and carry no repo-local copy. The
+// runner resolves that fallback, so a review works; the doctor did not, and
+// reported FAIL on a layout its own documentation recommends. Worse, the FAIL
+// detail told the user to copy the example into the project — which manufactures
+// exactly the drifted duplicate that #541 added a shadow warning for.
+//
+// The distinction this batch pins: "no config anywhere" is still a FAIL
+// (that is a genuinely broken install); "no project config but a valid global
+// one" is not.
+describe('doctor delphi #684 global config fallback', () => {
+  let tmpDirs;
+  let tmpHome;
+  let originalHome;
+
+  beforeEach(() => {
+    tmpDirs = makeTempDirs(['doctor-684-home']);
+    tmpHome = tmpDirs['doctor-684-home'];
+    originalHome = process.env.HOME;
+    process.env.HOME = tmpHome;
+    fs.mkdirSync(path.join(tmpHome, '.qoder'), { recursive: true });
+    resetLibModules(vi, LIB_MODULES);
+    muteConsole(vi);
+  });
+
+  afterEach(() => {
+    if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
+    removeTempDirs(tmpDirs);
+    vi.restoreAllMocks();
+  });
+
+  // Local copy: the suite above keeps its own writeConfig inside its describe
+  // scope, so this block cannot reach it.
+  function writeConfig(configPath) {
+    fs.writeFileSync(configPath, JSON.stringify({
+      active_profile: 'default',
+      profiles: {
+        default: {
+          providers: {
+            gw: { base_url: 'https://gw.example/v1', api_key: 'k' },
+          },
+          experts: {
+            architecture: { provider: 'gw', model: 'model-a' },
+            technical: { provider: 'gw', model: 'model-b' },
+            feasibility: { provider: 'gw', model: 'model-c' },
+          },
+        },
+      },
+    }));
+    return configPath;
+  }
+
+  function writeGlobalConfig() {
+    const dir = path.join(tmpHome, '.config', 'xp-gate');
+    fs.mkdirSync(dir, { recursive: true });
+    return writeConfig(path.join(dir, '.delphi-config.json'));
+  }
+
+  function captureLogs() {
+    const logs = [];
+    const spy = vi.spyOn(console, 'log').mockImplementation((...args) => logs.push(args.join(' ')));
+    return { logs, restore: () => spy.mockRestore() };
+  }
+
+  it('AC-684-01: a valid global config with no project copy PASSes instead of failing', async () => {
+    const globalPath = writeGlobalConfig();
+    const project = path.join(tmpHome, 'a-project-with-no-config');
+    fs.mkdirSync(project, { recursive: true });
+    const { logs, restore } = captureLogs();
+    const { doctorDelphi } = require('../doctor');
+    await doctorDelphi({ projectDir: project, globalConfigPath: globalPath, npmLatest: null });
+    restore();
+    const cfgLine = logs.find((l) => l.includes('Delphi config'));
+    expect(cfgLine).toBeDefined();
+    expect(cfgLine).not.toMatch(/FAIL/);
+    expect(cfgLine).toMatch(/global/i);
+  });
+
+  it('AC-684-02: no config in either scope still FAILs (fallback must not mask a broken install)', async () => {
+    const project = path.join(tmpHome, 'bare-project');
+    fs.mkdirSync(project, { recursive: true });
+    const { logs, restore } = captureLogs();
+    const { doctorDelphi } = require('../doctor');
+    const code = await doctorDelphi({
+      projectDir: project,
+      globalConfigPath: path.join(tmpHome, 'no-such-global.json'),
+      npmLatest: null,
+    });
+    restore();
+    expect(code).toBe(1);
+    // The rendered line carries a ✗ marker, not the literal word FAIL.
+    const cfgLine = logs.find((l) => l.includes('Delphi config (.delphi-config.json)'));
+    expect(cfgLine).toBeDefined();
+    expect(cfgLine).toContain('✗');
+    expect(cfgLine).toMatch(/not found/);
+  });
+
+  it('AC-684-03: a project config still wins over the global one', async () => {
+    const globalPath = writeGlobalConfig();
+    const project = path.join(tmpHome, 'project-with-own-config');
+    fs.mkdirSync(project, { recursive: true });
+    const localPath = writeConfig(path.join(project, '.delphi-config.json'));
+    const { logs, restore } = captureLogs();
+    const { doctorDelphi } = require('../doctor');
+    await doctorDelphi({ projectDir: project, globalConfigPath: globalPath, npmLatest: null });
+    restore();
+    const cfgLine = logs.find((l) => l.includes('Delphi config'));
+    expect(cfgLine).toBeDefined();
+    expect(cfgLine).toContain(localPath);
+    expect(cfgLine).not.toMatch(/global/i);
+  });
+});

package/lib/__tests__/doctor-tui-skill-freshness.test.js

@@ -294,3 +294,77 @@ describe('doctor-tui installed skills enumerate the filesystem (#635)', () => {
     expect(row.status).toBe('PASS');
   });
 });
+
+// ── #681: equal version is not proof of equal content ────────────────────────
+// The freshness check short-circuits on `compareSemver(...) === 0` and answers
+// "Up to date" without ever reading the bodies. A skill that gained a whole
+// chapter without a version bump therefore reported healthy while the installed
+// copy was ~20k characters behind — and `update-skill` agreed with it.
+//
+// The version number is a claim the publisher makes; the content is the fact.
+// When the claim says "same" the fact still has to be checked.
+describe('doctor-tui skill freshness #681 equal version, different content', () => {
+  let tmpHome;
+  let originalHome;
+  const bundledSkillsDir = path.join(__dirname, '..', '..', 'skills');
+
+  beforeEach(() => {
+    originalHome = process.env.HOME;
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-fresh681-'));
+    process.env.HOME = tmpHome;
+    vi.resetModules();
+    delete require.cache[require.resolve('../doctor-tui')];
+    delete require.cache[require.resolve('../shared-paths')];
+  });
+
+  afterEach(() => {
+    process.env.HOME = originalHome;
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+    vi.restoreAllMocks();
+  });
+
+  function installSkill(name, content) {
+    const dir = path.join(tmpHome, '.config', 'opencode', 'skills', name);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'SKILL.md'), content);
+  }
+
+  function runFreshness(name) {
+    const { diagnoseInstalledSkills } = require('../doctor-tui');
+    const checks = [];
+    const issues = diagnoseInstalledSkills({ installedSkills: { [name]: {} } }, checks);
+    return { issues, check: checks.find((c) => c.name === `Skill: ${name}`) };
+  }
+
+  it('AC-681-01: same version but a missing chapter is WARN, not "Up to date"', () => {
+    const bundled = fs.readFileSync(path.join(bundledSkillsDir, 'delphi-review', 'SKILL.md'), 'utf8');
+    // Keep the frontmatter (version included), drop a large slice of the body.
+    const idx = bundled.indexOf('\n---', 4);
+    const head = bundled.slice(0, idx + 4);
+    const body = bundled.slice(idx + 4);
+    const truncated = head + body.slice(0, Math.floor(body.length / 2));
+    installSkill('delphi-review', truncated);
+
+    const { issues, check } = runFreshness('delphi-review');
+    expect(check).toBeDefined();
+    expect(check.detail).not.toMatch(/Up to date/);
+    expect(check.status).toBe('WARN');
+    expect(issues).toBe(1);
+  });
+
+  it('AC-681-02: same version and same content is still "Up to date" (no false alarm)', () => {
+    const bundled = fs.readFileSync(path.join(bundledSkillsDir, 'delphi-review', 'SKILL.md'), 'utf8');
+    installSkill('delphi-review', bundled);
+    const { issues, check } = runFreshness('delphi-review');
+    expect(check.detail).toMatch(/Up to date/);
+    expect(issues).toBe(0);
+  });
+
+  it('AC-681-03: line endings alone still do not count as a difference', () => {
+    const bundled = fs.readFileSync(path.join(bundledSkillsDir, 'delphi-review', 'SKILL.md'), 'utf8');
+    installSkill('delphi-review', bundled.replace(/\r\n/g, '\n').replace(/\n/g, '\r\n'));
+    const { issues, check } = runFreshness('delphi-review');
+    expect(check.detail).toMatch(/Up to date/);
+    expect(issues).toBe(0);
+  });
+});

package/lib/__tests__/update-skill.test.js

@@ -288,3 +288,80 @@ describe('update-skill', () => {
     });
   });
 });
+
+// ── #682: `--all` must enumerate what is on disk, not the config registry ────
+// `xp-gate init` / `setup-global` deploy skills to disk but never write
+// `config.installedSkills`, so `--all` iterated an always-empty object: it
+// printed "Updating all skills..." and exited 0 having touched nothing. doctor
+// solved the identical problem in #635 by enumerating the filesystem; this
+// block pins the same contract for update-skill, plus the honesty requirement
+// that a run which updates nothing must not look like a successful one.
+describe('update-skill #682 filesystem enumeration', () => {
+  let tmpHome;
+  let originalHome;
+  let installSkillMock;
+  let logSpy;
+  let errorSpy;
+
+  beforeEach(() => {
+    originalHome = process.env.HOME;
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'xpgate-up682-'));
+    process.env.HOME = tmpHome;
+    vi.resetModules();
+    delete require.cache[require.resolve('../update-skill')];
+    delete require.cache[require.resolve('../install-skill.js')];
+    installSkillMock = vi.fn().mockResolvedValue(0);
+    const p = require.resolve('../install-skill.js');
+    require.cache[p] = { id: p, filename: p, loaded: true, exports: { installSkill: installSkillMock } };
+    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    process.env.HOME = originalHome;
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+    delete require.cache[require.resolve('../install-skill.js')];
+    delete require.cache[require.resolve('../update-skill')];
+    vi.restoreAllMocks();
+  });
+
+  function deploySkill(platform, name) {
+    const dir = path.join(tmpHome, '.config', platform, 'skills', name);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'SKILL.md'), 'old content');
+    return dir;
+  }
+
+  it('AC-682-01: --all updates skills found on disk even when config.installedSkills is absent', async () => {
+    deploySkill('opencode', 'sprint-flow');
+    deploySkill('opencode', 'delphi-review');
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+    expect(code).toBe(0);
+    const names = installSkillMock.mock.calls.map((c) => c[0]);
+    expect(names).toContain('sprint-flow');
+    expect(names).toContain('delphi-review');
+  });
+
+  it('AC-682-02: --all does not update the same skill twice for the same platform', async () => {
+    deploySkill('opencode', 'sprint-flow');
+    fs.mkdirSync(path.join(tmpHome, '.config', 'xp-gate'), { recursive: true });
+    fs.writeFileSync(
+      path.join(tmpHome, '.config', 'xp-gate', 'xp-gate.json'),
+      JSON.stringify({ installedSkills: { 'sprint-flow': { version: '1.0.0' } } })
+    );
+    const { updateSkill } = require('../update-skill');
+    await updateSkill(null, { all: true });
+    const sprintCalls = installSkillMock.mock.calls.filter((c) => c[0] === 'sprint-flow');
+    expect(sprintCalls.length).toBe(1);
+  });
+
+  it('AC-682-03: --all with nothing installed says so instead of silently succeeding', async () => {
+    const { updateSkill } = require('../update-skill');
+    const code = await updateSkill(null, { all: true });
+    const said = [...logSpy.mock.calls, ...errorSpy.mock.calls].map((c) => c.join(' ')).join('\n');
+    expect(said).toMatch(/nothing to update|no skills installed|not installed/i);
+    expect(installSkillMock).not.toHaveBeenCalled();
+    expect(code).toBe(0);
+  });
+});

package/lib/doctor-tui.js

@@ -280,8 +280,29 @@ function diagnoseSkillsInDir(skillNames, userSkillsDir, bundledSkillsDir, checks
         });
         issues++;
       } else {
-        // cmp >= 0: installed version is same or newer than bundled
-        checks.push({ name: label(name), status: 'PASS', detail: 'Up to date' });
+        // cmp >= 0: installed version is same or newer than bundled.
+        //
+        // #681: an EQUAL version is a claim, not a fact. A skill that gained a
+        // whole chapter without a version bump reported "Up to date" while the
+        // installed copy was ~20k characters behind, and `update-skill` agreed.
+        // So when the versions tie, still compare the bodies — and do NOT
+        // prescribe `update-skill` on a difference: the installed copy may be
+        // NEWER than main (the same asymmetry the versionless branch below
+        // already respects), so the advice is "compare manually".
+        const sameBody = sameContentIgnoringLineEndings(
+          withoutVersionLine(bundledContent),
+          withoutVersionLine(userContent)
+        );
+        if (!sameBody) {
+          checks.push({
+            name: label(name),
+            status: 'WARN',
+            detail: `Content differs at the same version ${userVersion} — the version was not bumped when the skill changed; compare manually before running update-skill`,
+          });
+          issues++;
+        } else {
+          checks.push({ name: label(name), status: 'PASS', detail: 'Up to date' });
+        }
       }
     } else {
       // No version in at least one file — compare content, but not byte-for-byte:

package/lib/doctor.js

@@ -3394,9 +3394,26 @@ async function doctorDelphi(options = {}) {
 
   // 5. Config ping: parseable, three distinct callable models. A duplicate
   // model here is a review that will BLOCK later — say so now.
-  const cfgPath = configPath || path.join(process.cwd(), '.delphi-config.json');
+  //
+  // #684: resolve the SAME way the runner does. A project-local config wins; a
+  // machine-level one under XDG_CONFIG_HOME (or ~/.config) is the documented
+  // fallback, and a review keeps working on it. Checking only `cwd` reported
+  // FAIL on the layout SKILL.md recommends and told the user to copy the example
+  // into the project — manufacturing the drifted duplicate #541 warns about.
+  //
+  // An explicit `configPath` is an ANSWER, not a hint: a caller that names a
+  // file means that file, so it disables the fallback. Otherwise a test (or a
+  // caller) pinning an absent path silently reads the developer's real global
+  // config and reports PASS — the same vacuous-pass shape this batch is fixing.
+  const projectCfgPath = configPath
+    || path.join(options.projectDir || process.cwd(), '.delphi-config.json');
+  const usingGlobalConfig = !configPath
+    && !fs.existsSync(projectCfgPath)
+    && fs.existsSync(globalConfigPath);
+  const cfgPath = usingGlobalConfig ? globalConfigPath : projectCfgPath;
+  const cfgLabel = 'Delphi config (.delphi-config.json)';
   if (!fs.existsSync(cfgPath)) {
-    add('Delphi config (.delphi-config.json)', 'FAIL',
+    add(cfgLabel, 'FAIL',
       `${cfgPath} not found (copy .delphi-config.json.example from the skill directory)`);
   } else {
     try {
@@ -3404,7 +3421,7 @@ async function doctorDelphi(options = {}) {
       const profileName = raw.active_profile || 'default';
       const profile = raw.profiles && raw.profiles[profileName];
       if (!profile) {
-        add('Delphi config (.delphi-config.json)', 'FAIL', `profile "${profileName}" not found`);
+        add(cfgLabel, 'FAIL', `profile "${profileName}" not found`);
       } else {
         const experts = profile.experts || {};
         const models = roles.map((r) => experts[r] && experts[r].model);
@@ -3422,10 +3439,14 @@ async function doctorDelphi(options = {}) {
           if (missingRoles.length > 0) problems.push(`missing experts: ${missingRoles.join(', ')}`);
           if (duplicates.length > 0) problems.push(`duplicate models: ${[...new Set(duplicates)].join(', ')}`);
           if (badProviders.length > 0) problems.push(`unusable provider binding: ${badProviders.join(', ')}`);
-          add('Delphi config (.delphi-config.json)', 'FAIL', problems.join('; '));
+          add(cfgLabel, 'FAIL', problems.join('; '));
         } else {
-          add('Delphi config (.delphi-config.json)', 'PASS',
-            `profile "${profileName}": ${models.join(' / ')}`);
+          // Always name the file that was actually read. Without it a user with
+          // both scopes present cannot tell which one the review will use — the
+          // exact ambiguity that made #684 hard to see.
+          const scopeNote = usingGlobalConfig ? ` [global: ${cfgPath}]` : ` [project: ${cfgPath}]`;
+          add(cfgLabel, 'PASS',
+            `profile "${profileName}": ${models.join(' / ')}${scopeNote}`);
           // #574: non-local seats are reported, not blocked. The local-only rule
           // is an operator preference (the 2026-10-03 quota burn), so doctor
           // surfaces the cost exposure without failing a deliberately hosted
@@ -3483,7 +3504,7 @@ async function doctorDelphi(options = {}) {
         }
       }
     } catch (err) {
-      add('Delphi config (.delphi-config.json)', 'FAIL', `unparseable: ${err.message}`);
+      add(cfgLabel, 'FAIL', `unparseable: ${err.message}`);
     }
   }
 

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-31T16:53:19.066Z",
+  "checked_at": "2026-11-01T15:38:49.220Z",
   "source": "network"
 }

package/lib/update-skill.js

@@ -7,6 +7,57 @@ const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir();
 
 const CONFIG_DIR = path.join(HOME, '.config', 'xp-gate');
 
+/**
+ * The skill names that are actually deployed on this machine.
+ *
+ * `xp-gate init` / `setup-global` copy skills onto disk but never write
+ * `config.installedSkills`, so the config registry is empty on a fully
+ * deployed machine. Iterating it made `update-skill --all` print
+ * "Updating all skills..." and exit 0 having touched nothing (#682) -- the
+ * same defect #635 fixed for `doctor`, with the same fix: ask the filesystem.
+ *
+ * The explicit registry is still unioned in, so a skill that is merely
+ * registered (or was installed on a platform this scan cannot see) keeps
+ * working for callers that rely on it.
+ *
+ * @returns {string[]} de-duplicated skill names, in a stable order
+ */
+function installedSkillNames() {
+  const names = new Set();
+  const config = getConfig();
+  for (const name of Object.keys(config.installedSkills || {})) names.add(name);
+
+  let platforms = [];
+  try {
+    platforms = Object.keys(require('./detect-deps.js').PLATFORM_PROFILES);
+  } catch {
+    // detect-deps unavailable: fall back to the registry only rather than
+    // reporting "nothing installed" for a machine that has skills on disk.
+    platforms = [];
+  }
+  const detect = require('./detect-deps.js');
+  for (const platform of platforms) {
+    let dir;
+    try {
+      dir = detect.getSkillsDirs(platform)[0];
+    } catch {
+      continue;
+    }
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      // A skill is `<dir>/<name>/SKILL.md` — the shape install-skill writes.
+      if (fs.existsSync(path.join(dir, entry.name, 'SKILL.md'))) names.add(entry.name);
+    }
+  }
+  return [...names].sort();
+}
+
 function handleCheckMode() {
   console.log('Checking for updates...');
   const config = getConfig();
@@ -19,11 +70,16 @@ function handleCheckMode() {
 }
 
 async function handleAllMode(verbose) {
-  const config = getConfig();
-  const skills = config.installedSkills || {};
+  const names = installedSkillNames();
   console.log('Updating all skills...');
+  // #635/#682: an empty run must say so. Exiting 0 after "Updating all skills..."
+  // with no further output reads as success, and was how this stayed broken.
+  if (names.length === 0) {
+    console.log('No skills installed — nothing to update.');
+    return 0;
+  }
   let hasErrors = false;
-  for (const skillName of Object.keys(skills)) {
+  for (const skillName of names) {
     try {
       await updateSingleSkill(skillName, verbose);
     } catch (err) {

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.18",
+  "version": "0.35.19",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.18",
+  "version": "0.35.19",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.18",
+  "version": "0.35.19",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.18",
+  "version": "0.35.19",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.18",
+  "version": "0.35.19",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/scripts/sync-package-content.js

@@ -205,7 +205,38 @@ function syncAdapters() {
   if (gateFiles.length > 0) {
     console.error(`[sync] gate scripts: ${gateFiles.join(', ')}`);
   }
-  return copied + gateFiles.length;
+
+  // #683: `githooks/adapters/` carries a handful of the same gate scripts,
+  // because `resolveGateScript()` falls back to `<adapterDir>/gate-<n>.sh` in a
+  // TS-less install, and #532 requires the gate-9 verdict block to stay
+  // byte-identical across those copies. Four of them had silently lagged the
+  // canonical gates (gate-3.sh by 4953 bytes, missing the #632 fix). Nothing
+  // failed only because the package-root copy is written later and wins.
+  //
+  // Re-mirror them here so the invariant is maintained, not merely observed.
+  // The names are taken FROM the adapters directory: this only refreshes copies
+  // that already exist, it never adds a gate script to `adapters/` that was not
+  // deliberately placed there.
+  const adaptersRoot = path.join(githooksDir, 'adapters');
+  let refreshed = 0;
+  let adaptersNames = [];
+  try {
+    adaptersNames = fs.readdirSync(adaptersRoot);
+  } catch {
+    adaptersNames = [];
+  }
+  for (const f of adaptersNames) {
+    const isGateScript = f.endsWith('.sh') && (f.startsWith('gate-') || f === 'sprint-gate.sh');
+    const canonical = path.join(githooksDir, f);
+    if (!isGateScript || !fs.existsSync(canonical)) continue;
+    const mirror = path.join(adaptersRoot, f);
+    const a = fs.readFileSync(canonical);
+    if (fs.existsSync(mirror) && fs.readFileSync(mirror).equals(a)) continue;
+    fs.copyFileSync(canonical, mirror);
+    console.error(`[sync] refreshed stale adapter gate mirror: ${f}`);
+    refreshed += 1;
+  }
+  return copied + gateFiles.length + refreshed;
 }
 
 function syncHooks() {

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-01
+**Commit:** effea31d
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.19.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.