@boyingliu01/xp-gate 0.35.18 → 0.35.20

package/lib/sprint-status.js

@@ -221,32 +221,65 @@ function jsonMode(state) {
 const FIX_RE = /^(fix(\(.+\))?:)|\b(fix|bugfix|hotfix|patch|修复)\b/i;
 
 /**
- * Count fix commits in a git repo since a given date (#369).
- * Scans all branches (--all) per Round 1 repo-wide decision.
+ * Git env with every repo-redirecting variable stripped, so `cwd` is the only
+ * thing that decides which repository is inspected.
+ */
+function cleanGitEnv() {
+  const gitEnv = { ...process.env };
+  for (const name of [
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_CONFIG', 'GIT_CONFIG_PARAMETERS',
+    'GIT_CONFIG_COUNT', 'GIT_OBJECT_DIRECTORY', 'GIT_DIR', 'GIT_WORK_TREE',
+    'GIT_IMPLICIT_WORK_TREE', 'GIT_GRAFT_FILE', 'GIT_INDEX_FILE',
+    'GIT_NO_REPLACE_OBJECTS', 'GIT_REPLACE_REF_BASE', 'GIT_PREFIX',
+    'GIT_SHALLOW_FILE', 'GIT_COMMON_DIR',
+  ]) {
+    delete gitEnv[name];
+  }
+  return gitEnv;
+}
+
+/**
+ * Commit counts for a sprint's own time window: start → completion (#704).
+ *
+ * The old signature took only a lower bound, and the caller passed
+ * `completed_at` — by definition the moment the sprint ENDED. Every sprint
+ * commit happened before it, so `git log --since <completed_at>` returned an
+ * empty set and the rework rate was structurally 0. The interval that matters
+ * is "sprint start → sprint end", so both bounds are now explicit and neither
+ * can drift away from the other.
+ *
+ * Returns BOTH numbers from a single `git log` call: the rate is `fix / total`,
+ * and `total` was previously read from `state.metrics.total_sprint_commits`,
+ * which nothing ever wrote — it was always 0, then floored to 1 by
+ * `Math.max(total, 1)`, which is what turned "no data" into a confident 0%.
+ *
+ * `total === 0` is a meaningful answer (nothing to measure in the window) and is
+ * reported as such rather than being dressed up as 0% rework.
+ *
  * @param {string} repoDir - Repository root
- * @param {string} sinceDate - ISO 8601 date string
- * @returns {number} Count of fix commits
+ * @param {string|undefined} sinceDate - Sprint start (ISO 8601); omitted = unbounded
+ * @param {string|undefined} untilDate - Sprint completion (ISO 8601); omitted = unbounded
+ * @returns {{fix: number, total: number}} counts within the window
  */
-function getFixCommitCount(repoDir, sinceDate) {
+function getWindowCommitCounts(repoDir, sinceDate, untilDate) {
+  const empty = { fix: 0, total: 0 };
+  if (!sinceDate) return empty;
   try {
-    const gitEnv = { ...process.env };
-    for (const name of [
-      'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_CONFIG', 'GIT_CONFIG_PARAMETERS',
-      'GIT_CONFIG_COUNT', 'GIT_OBJECT_DIRECTORY', 'GIT_DIR', 'GIT_WORK_TREE',
-      'GIT_IMPLICIT_WORK_TREE', 'GIT_GRAFT_FILE', 'GIT_INDEX_FILE',
-      'GIT_NO_REPLACE_OBJECTS', 'GIT_REPLACE_REF_BASE', 'GIT_PREFIX',
-      'GIT_SHALLOW_FILE', 'GIT_COMMON_DIR',
-    ]) {
-      delete gitEnv[name];
-    }
-    const out = execFileSync(
-      'git',
-      ['log', '--all', '--since', sinceDate, '--pretty=format:%s'],
-      { cwd: repoDir, env: gitEnv, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
-    );
-    return out.split('\n').filter(l => l.trim() && FIX_RE.test(l.trim())).length;
+    const args = ['log', '--all'];
+    // --since/--until compare committer dates; missing or unparsable values are
+    // ignored by git, which would silently widen the window back to "everything".
+    // So only pass a bound that is actually a valid timestamp.
+    if (!Number.isNaN(new Date(sinceDate).getTime())) args.push('--since', sinceDate);
+    if (untilDate && !Number.isNaN(new Date(untilDate).getTime())) args.push('--until', untilDate);
+    args.push('--pretty=format:%s');
+
+    const out = execFileSync('git', args, {
+      cwd: repoDir, env: cleanGitEnv(), encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const subjects = out.split('\n').map(l => l.trim()).filter(Boolean);
+    return { fix: subjects.filter(s => FIX_RE.test(s)).length, total: subjects.length };
   } catch {
-    return 0;
+    return empty;
   }
 }
 
@@ -302,13 +335,37 @@ async function handleReworkCheck(searchDir, windowDays) {
   console.log('─'.repeat(60));
 
   let hasAlert = false;
+  let hasUnmeasurable = false;
   for (const { id, state, file } of inWindow) {
-    const totalCommits = state.metrics.total_sprint_commits || 0;
-    const fixCommits = getFixCommitCount(searchDir, state.metrics.completed_at);
-    const rate = fixCommits / Math.max(totalCommits, 1);
+    // #704: the window is the sprint itself (start → completion), and both
+    // counts come from one `git log` over that window. Previously the total was
+    // read from a field nothing wrote, and the `--since` bound was the END of
+    // the sprint, so both numbers were structurally 0 and the rate could only
+    // ever be 0 — while the summary line still said "within acceptable rate".
+    const { fix: fixCommits, total: totalCommits } = getWindowCommitCounts(
+      searchDir,
+      state.started_at,
+      state.metrics.completed_at,
+    );
+
+    // No commits in the window means the rate is undefined, not zero. Reporting
+    // 0.0% here would rebuild the same false reassurance one level down, so the
+    // sprint is surfaced as unmeasurable and never counts as "within threshold".
+    if (totalCommits === 0) {
+      hasUnmeasurable = true;
+      console.log(`  ${id}: 0 fix / 0 total commits — NOT MEASURABLE (no commits in sprint window)`);
+      continue;
+    }
+
+    const rate = fixCommits / totalCommits;
 
-    // Write rework_rate back to the source file
+    // Persist what was actually measured. The previous code wrote the rate
+    // unconditionally, which meant a transposed 0 could overwrite a value a
+    // human had already corrected; now the denominator is persisted alongside
+    // it so the next run can be checked against its own evidence.
     state.metrics.rework_rate = rate;
+    state.metrics.total_sprint_commits = totalCommits;
+    state.metrics.fix_sprint_commits = fixCommits;
     try {
       fs.writeFileSync(file, JSON.stringify(state, null, 2));
     } catch { /* non-fatal */ }
@@ -324,6 +381,10 @@ async function handleReworkCheck(searchDir, windowDays) {
   console.log('─'.repeat(60));
   if (hasAlert) {
     console.log('⚠️  Rework rate alert: one or more sprints exceed 30% threshold');
+  } else if (hasUnmeasurable) {
+    // "All sprints within acceptable rate" would be a claim about sprints that
+    // were never measured. Say which is which instead of picking the cheerful one.
+    console.log('⚠️  Some sprints could not be measured (no commits in window) — not certified as within threshold');
   } else {
     console.log('All sprints within acceptable rework rate (≤30%)');
   }
@@ -493,4 +554,8 @@ module.exports = {
   jsonMode,
   isStale,
   handleSprintStatus,
+  // Exported for #704: the rework-rate arithmetic was only reachable through
+  // the CLI, so the only way to test it was to shell out and parse console
+  // output. A function nobody can call directly is a function nobody can pin.
+  handleReworkCheck,
 };

package/lib/test-alignment.ts

@@ -73,8 +73,42 @@ export interface TestMap {
   tests: TestCase[];
   totalTests: number;
   totalAssertions: number;
+  /**
+   * Test files whose extension has no parser (#702).
+   *
+   * These used to be dropped on the floor: the file was read, its extension
+   * taken, and then no branch matched. A pure-Java project therefore reported
+   * `totalTests: 0` and computed its alignment score over an empty set, with
+   * nothing distinguishing "no tests" from "tests I could not read". Callers
+   * must surface this instead of treating the map as complete.
+   */
+  unsupportedFiles: string[];
 }
 
+/**
+ * Test-file extensions that this module can parse (#702).
+ *
+ * Listed explicitly rather than implied by the presence of an `if` branch,
+ * because that is exactly how `.java` disappeared: an if/else chain with a
+ * missing arm looks identical to a complete one at the call site. This list is
+ * the contract the branches are checked against.
+ */
+export const SUPPORTED_TEST_EXTENSIONS: readonly string[] = [
+  '.ts', '.tsx', '.js', '.jsx', '.py', '.go', '.java',
+];
+
+/**
+ * Test-file extensions this module deliberately does NOT parse, but recognises
+ * as tests (#702).
+ *
+ * Being on this list means "report it", not "ignore it". The distinction
+ * matters: before, both "not a test file" and "a test file I cannot read"
+ * produced the same silent skip.
+ */
+export const UNSUPPORTED_TEST_EXTENSIONS: readonly string[] = [
+  '.kt', '.kts', '.cs', '.rb', '.rs', '.swift', '.php', '.scala',
+];
+
 export type IssueType =
   | 'MISSING_REQUIREMENT_TEST'
   | 'UNCOVERED_ACCEPTANCE_CRITERIA'
@@ -211,7 +245,13 @@ function extractAllTags(text: string, tag: string): string[] {
 }
 
 function countAssertions(content: string): number {
-  // Count common assertion patterns
+  // Count common assertion patterns.
+  //
+  // #702: the JUnit 5 family was absent, so a parsed Java test would have been
+  // recorded as zero-assertion — the same "detector that never fires" shape as
+  // the missing branch itself. A test with assertions that reports 0 is worse
+  // than no test at all: it drags the coverage dimension down without any hint
+  // that the number is unmeasured.
   const patterns = [
     /expect\(/g,
     /assert\./g,
@@ -220,6 +260,12 @@ function countAssertions(content: string): number {
     /expect\./g,
     /toEqual\(/g,
     /toBe\(/g,
+    // JUnit 5 / Jupiter assertions (Java, Kotlin). Matched by the assert-prefix
+    // family rather than an enumeration of every overload, so assertAll,
+    // assertThat, assertThrows, assertDoesNotThrow etc. are all counted.
+    /\bassert[A-Z]\w*\s*\(/g,
+    // AssertJ fluent style, common in the same test suites.
+    /\bassertThat\s*\(/g,
   ];
   let count = 0;
   for (const pattern of patterns) {
@@ -387,6 +433,23 @@ function extractGoTestBody(content: string, funcIndex: number): string {
   return extractCallbackBody(content, braceIdx);
 }
 
+/**
+ * Body of a Java test method, from its opening brace (#702).
+ *
+ * Assertions are counted against the per-test body, not the whole file, for the
+ * same reason as the Go/Python paths: a file-level count multiplies assertions
+ * by the number of tests in the file (#392-#1).
+ *
+ * Java has no multi-line lambda-less ambiguity here — a method body is the
+ * brace-delimited block that follows the parameter list — so the same brace
+ * scan used for Go is sufficient.
+ */
+function extractJavaTestBody(content: string, methodIndex: number): string {
+  const braceIdx = content.indexOf('{', methodIndex);
+  if (braceIdx === -1) return '';
+  return extractCallbackBody(content, braceIdx);
+}
+
 function pushTestWithCovers(
   tests: TestCase[],
   testPath: string,
@@ -423,6 +486,7 @@ function pushTestWithCovers(
 export function parseTestFiles(testPaths: string[]): TestMap {
   const tests: TestCase[] = [];
   const totalAssertionsObj = { value: 0 };
+  const unsupportedFiles: string[] = [];
 
   for (const testPath of testPaths) {
     if (!fs.existsSync(testPath)) continue;
@@ -470,6 +534,48 @@ export function parseTestFiles(testPaths: string[]): TestMap {
         const body = extractGoTestBody(content, funcStart);
         pushTestWithCovers(tests, testPath, m[3]!, m[2]!, intentMatch?.[1]?.trim(), content, body, totalAssertionsObj);
       }
+    } else if (ext === '.java') {
+      // #702: JUnit 5 annotations are matched against the Javadoc block that
+      // precedes the method, because that is where this project's @test/@intent
+      // contract lives.
+      //
+      // Two phases rather than one regex, because the Javadoc may sit above the
+      // class declaration (`class Foo { @Test void a() {...} }`) or directly
+      // above the method. Scanning forward from the end of each Javadoc for the
+      // first `@Test` and then for the method name handles both without the
+      // fragile "skip N tokens" shape that a single expression needs.
+      const javaDocPattern = /\/\*\*([\s\S]*?)\*\//g;
+      let docMatch: RegExpExecArray | null;
+      while ((docMatch = javaDocPattern.exec(content)) !== null) {
+        const docBlock = docMatch[1]!;
+        const reqMatch = docBlock.match(/@test\s+(REQ-[A-Z0-9]+-[A-Z0-9]+)/);
+        // Without a requirement tag this is not an annotated test in this
+        // project's sense; skip it rather than inventing a TestCase.
+        if (!reqMatch) continue;
+
+        const afterDoc = docMatch.index + docMatch[0].length;
+        const rest = content.slice(afterDoc);
+        const testAnnotation = rest.match(/@Test\b/);
+        if (!testAnnotation) continue;
+
+        // Method name = the identifier right before the first `(` after @Test.
+        const afterAnnotation = rest.slice(testAnnotation.index! + '@Test'.length);
+        const nameMatch = afterAnnotation.match(/\b(\w+)\s*\(/);
+        if (!nameMatch) continue;
+
+        const intentMatch = docBlock.match(/@intent\s+(.+)/);
+        const methodStart = afterDoc + testAnnotation.index! + afterAnnotation.indexOf(nameMatch[1]!);
+        const body = extractJavaTestBody(content, methodStart);
+        pushTestWithCovers(
+          tests, testPath, nameMatch[1]!, reqMatch[1]!, intentMatch?.[1]?.trim(),
+          content, body, totalAssertionsObj,
+        );
+      }
+    } else if (UNSUPPORTED_TEST_EXTENSIONS.includes(ext)) {
+      // Recognised as a test file, but no parser exists. Recording it is the
+      // whole point: previously this arm did not exist, so the file vanished
+      // and the caller could not tell "no tests" from "tests I could not read".
+      unsupportedFiles.push(testPath);
     }
   }
 
@@ -477,6 +583,7 @@ export function parseTestFiles(testPaths: string[]): TestMap {
     tests,
     totalTests: tests.length,
     totalAssertions: totalAssertionsObj.value,
+    unsupportedFiles,
   };
 }
 
@@ -702,6 +809,31 @@ export function writeReport(report: TestAlignmentReportFile, outputPath: string)
 // Orchestrator: runFullAlignment()
 // ============================================================================
 
+/**
+ * Whether a file name looks like a test file (#702).
+ *
+ * There were TWO silent gates, and fixing only the parser would have left the
+ * outer one closed: this walker previously matched only
+ * `\.(test|spec)\.(ts|tsx|js|jsx|py|go)$`. A JUnit file is conventionally
+ * `ProbeTest.java` — no `.test.` infix at all — so it was excluded before
+ * parseTestFiles ever saw it, and no amount of parser work could help.
+ *
+ * Two accepted shapes:
+ *  - the JS/Python convention:  `<name>.test.<ext>` / `<name>.spec.<ext>`
+ *  - the Java/C#/Kotlin convention: `*Test.<ext>` / `*Tests.<ext>` / `*Spec.<ext>`
+ *
+ * Both are matched against the same extension lists as the parser, so a file
+ * can never be collected but unparseable, or parseable but never collected.
+ */
+function isTestFileName(name: string): boolean {
+  const ext = path.extname(name);
+  const knownExt = SUPPORTED_TEST_EXTENSIONS.includes(ext) || UNSUPPORTED_TEST_EXTENSIONS.includes(ext);
+  if (!knownExt) return false;
+  if (/\.(test|spec)\.[^.]+$/.test(name)) return true;
+  // Java convention: the class name carries the marker, not the file name infix.
+  return /(?:Test|Tests|Spec)\.[^.]+$/.test(name);
+}
+
 export interface AlignmentOptions {
   specPath: string;
   testDirs?: string[];
@@ -743,7 +875,7 @@ export function runFullAlignment(options: AlignmentOptions): TestAlignmentReport
           const fullPath = path.join(d, entry.name);
           if (entry.isDirectory() && entry.name !== 'node_modules') {
             walkDir(fullPath);
-          } else if (entry.isFile() && /\.(test|spec)\.(ts|tsx|js|jsx|py|go)$/.test(entry.name)) {
+          } else if (entry.isFile() && isTestFileName(entry.name)) {
             testFiles.push(fullPath);
           }
         }
@@ -759,9 +891,23 @@ export function runFullAlignment(options: AlignmentOptions): TestAlignmentReport
   const alignmentReport = verifyAlignment(spec, testMap);
   const score = calculateScore(alignmentReport.issues, alignmentReport.coverage, testMap);
 
+  // #702: files that were recognised as tests but could not be parsed must not
+  // leave the report looking complete. Without this, `totalTests: 0` from a
+  // pure-Java project is indistinguishable from "this project has no tests",
+  // and the score is computed over an empty set while the status reads "ran".
+  const unsupportedErrors = testMap.unsupportedFiles.map(
+    file => `Test file not parsed (no parser for ${path.extname(file)}): ${file}`,
+  );
+  // A project whose ONLY test files are unparsed is the worst case: the report
+  // would otherwise be a confident verdict about nothing at all.
+  const noParsedTestsAtAll = testMap.totalTests === 0 && testMap.unsupportedFiles.length > 0;
+  // Unparsed files make the score untrustworthy even when it happens to be
+  // high, so they block PASS rather than merely being annotated.
+  const canPass = score >= 80 && testMap.unsupportedFiles.length === 0;
+
   const report: TestAlignmentReportFile = {
-    alignment_status: score >= 80 ? 'PASS' : 'FAIL',
-    phase: score >= 80 ? 2 : 1,
+    alignment_status: canPass ? 'PASS' : 'FAIL',
+    phase: canPass ? 2 : 1,
     score,
     head_commit: headCommit || 'unknown',
     spec_hash: specHash,
@@ -771,8 +917,8 @@ export function runFullAlignment(options: AlignmentOptions): TestAlignmentReport
       spec_requirement: issue.requirementId || 'unknown',
       gap: issue.message,
     })),
-    anti_pattern_detected: false,
-    errors: [],
+    anti_pattern_detected: noParsedTestsAtAll,
+    errors: unsupportedErrors,
   };
 
   // Step 5: Write output. A failure is recorded on `report.errors` by writeReport

package/lib/update-skill.js

@@ -7,6 +7,57 @@ const HOME = process.env.HOME || process.env.USERPROFILE || os.homedir();
 
 const CONFIG_DIR = path.join(HOME, '.config', 'xp-gate');
 
+/**
+ * The skill names that are actually deployed on this machine.
+ *
+ * `xp-gate init` / `setup-global` copy skills onto disk but never write
+ * `config.installedSkills`, so the config registry is empty on a fully
+ * deployed machine. Iterating it made `update-skill --all` print
+ * "Updating all skills..." and exit 0 having touched nothing (#682) -- the
+ * same defect #635 fixed for `doctor`, with the same fix: ask the filesystem.
+ *
+ * The explicit registry is still unioned in, so a skill that is merely
+ * registered (or was installed on a platform this scan cannot see) keeps
+ * working for callers that rely on it.
+ *
+ * @returns {string[]} de-duplicated skill names, in a stable order
+ */
+function installedSkillNames() {
+  const names = new Set();
+  const config = getConfig();
+  for (const name of Object.keys(config.installedSkills || {})) names.add(name);
+
+  let platforms = [];
+  try {
+    platforms = Object.keys(require('./detect-deps.js').PLATFORM_PROFILES);
+  } catch {
+    // detect-deps unavailable: fall back to the registry only rather than
+    // reporting "nothing installed" for a machine that has skills on disk.
+    platforms = [];
+  }
+  const detect = require('./detect-deps.js');
+  for (const platform of platforms) {
+    let dir;
+    try {
+      dir = detect.getSkillsDirs(platform)[0];
+    } catch {
+      continue;
+    }
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      // A skill is `<dir>/<name>/SKILL.md` — the shape install-skill writes.
+      if (fs.existsSync(path.join(dir, entry.name, 'SKILL.md'))) names.add(entry.name);
+    }
+  }
+  return [...names].sort();
+}
+
 function handleCheckMode() {
   console.log('Checking for updates...');
   const config = getConfig();
@@ -19,11 +70,16 @@ function handleCheckMode() {
 }
 
 async function handleAllMode(verbose) {
-  const config = getConfig();
-  const skills = config.installedSkills || {};
+  const names = installedSkillNames();
   console.log('Updating all skills...');
+  // #635/#682: an empty run must say so. Exiting 0 after "Updating all skills..."
+  // with no further output reads as success, and was how this stayed broken.
+  if (names.length === 0) {
+    console.log('No skills installed — nothing to update.');
+    return 0;
+  }
   let hasErrors = false;
-  for (const skillName of Object.keys(skills)) {
+  for (const skillName of names) {
     try {
       await updateSingleSkill(skillName, verbose);
     } catch (err) {

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-02
+**Commit:** 60545e49
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.20.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-02
+**Commit:** 60545e49
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.20.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.18",
+  "version": "0.35.20",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.18",
+  "version": "0.35.20",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-02
+**Commit:** 60545e49
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.20.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-02
+**Commit:** 60545e49
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.20.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-31
-**Commit:** 97e3c2ec
+**Generated:** 2026-11-02
+**Commit:** 60545e49
 **Branch:** main
-**Version:** 0.35.18.0
+**Version:** 0.35.20.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/lib/index.d.ts

@@ -33,6 +33,30 @@ export declare const inject: string[];
  * let it through, and a false negative would reject a perfectly valid reference.
  */
 export declare function findPlaceholderName(value: string): string | undefined;
+/**
+ * The running plugin's version, read from its own package.json (#709).
+ *
+ * Delphi's tool result used to carry no version at all, which made "the fix did
+ * not take effect" indistinguishable from "the fix was never made". That cost a
+ * real investigation: four design reviews returned verdicts without a single
+ * line of expert reasoning, the design was rewritten twice on the assumption it
+ * must be wrong, and the same reviews reached 100% consensus on round two once
+ * the reasoning was readable. Nothing was wrong with the design.
+ *
+ * Read rather than injected so dev runs and packed installs report the same
+ * thing, and so a stale load is visible as an old number instead of silence.
+ * Falls back to "unknown" rather than throwing: a version banner must never be
+ * the reason a review fails to start.
+ */
+export declare function pluginVersion(): string;
+/**
+ * The provider/seats banner that closes every Delphi tool result (#709).
+ *
+ * Extracted from the inline template so the version claim has exactly one
+ * definition — and so it can be asserted against package.json instead of being
+ * pinned to a literal that silently starts lying at the next release.
+ */
+export declare function formatPluginFooter(provider: string, described: string): string;
 /**
  * Runtime schema for the keys above.
  *

package/plugins/dsh/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM;;;GAA6C,CAAA;AAElG,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAkQlD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKrE;AA8ID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CAgC9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA0BlD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,MAAM;;;GAA6C,CAAA;AAElG,eAAO,MAAM,IAAI,iBAAiB,CAAA;AAGlC,eAAO,MAAM,MAAM,UAA+B,CAAA;AAkQlD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKrE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9E;AA8ID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4BjB,CAAA;AAEF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,OAAY,GAAG,IAAI,CAgC9D"}

package/plugins/dsh/lib/index.js

@@ -1,4 +1,5 @@
 import { writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { defineTool } from "@deepseek-ai/dsh-tools";
@@ -274,6 +275,41 @@ export function findPlaceholderName(value) {
     const envStyle = /\{env:([A-Za-z_][A-Za-z0-9_]*)\}/.exec(value);
     return envStyle ? envStyle[1] : undefined;
 }
+/**
+ * The running plugin's version, read from its own package.json (#709).
+ *
+ * Delphi's tool result used to carry no version at all, which made "the fix did
+ * not take effect" indistinguishable from "the fix was never made". That cost a
+ * real investigation: four design reviews returned verdicts without a single
+ * line of expert reasoning, the design was rewritten twice on the assumption it
+ * must be wrong, and the same reviews reached 100% consensus on round two once
+ * the reasoning was readable. Nothing was wrong with the design.
+ *
+ * Read rather than injected so dev runs and packed installs report the same
+ * thing, and so a stale load is visible as an old number instead of silence.
+ * Falls back to "unknown" rather than throwing: a version banner must never be
+ * the reason a review fails to start.
+ */
+export function pluginVersion() {
+    try {
+        const require_ = createRequire(import.meta.url);
+        const pkg = require_("../package.json");
+        return typeof pkg.version === "string" && pkg.version !== "" ? pkg.version : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+/**
+ * The provider/seats banner that closes every Delphi tool result (#709).
+ *
+ * Extracted from the inline template so the version claim has exactly one
+ * definition — and so it can be asserted against package.json instead of being
+ * pinned to a literal that silently starts lying at the next release.
+ */
+export function formatPluginFooter(provider, described) {
+    return `Provider: ${provider} | plugin: ${pluginVersion()}\nSeats: ${described}`;
+}
 async function runDelphiReview(subject, request) {
     const { addressed, cwd, resolveApiKey, signal, writeEvidence } = request;
     try {
@@ -282,7 +318,7 @@ async function runDelphiReview(subject, request) {
         const suffix = writeEvidence && cfg !== undefined
             ? await writeWalkthroughEvidence(cwd, cfg, outcome)
             : "";
-        return `${formatOutcome(outcome)}\n\nProvider: ${provider}\nSeats: ${described}${suffix}`;
+        return `${formatOutcome(outcome)}\n\n${formatPluginFooter(provider, described)}${suffix}`;
     }
     catch (e) {
         // Config problems are the common failure; report them as guidance

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.18",
+  "version": "0.35.20",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",