@boyingliu01/xp-gate 0.35.22 → 0.35.24

package/adapter-common.sh

@@ -104,41 +104,30 @@ detect_project_lang() {
   fi
 }
 
-route_to_adapter() {
-  local action="$1"
-  local lang
-  lang=$(detect_project_lang)
-  
-  local adapter_file=""
-
-  # 3-tier resolution matching pre-commit ADAPTER_DIR logic
-  # Tier 1: Global flat layout (~/.config/xp-gate/adapters/lang.sh)
-  if [ -f "$HOME/.config/xp-gate/adapters/${lang}.sh" ]; then
-    adapter_file="$HOME/.config/xp-gate/adapters/${lang}.sh"
-  # Tier 2: Project nested layout (githooks/adapters/lang.sh)
-  elif [ -f "githooks/adapters/${lang}.sh" ]; then
-    adapter_file="githooks/adapters/${lang}.sh"
-  elif [ -f "./githooks/adapters/${lang}.sh" ]; then
-    adapter_file="./githooks/adapters/${lang}.sh"
-  fi
-
-  if [ -n "$adapter_file" ]; then
-    # shellcheck source=./githooks/adapters/lang.sh
-    source "$adapter_file"
-    
-    # Execute the requested action
-    case "$action" in
-      "static_analysis") run_static_analysis ;;
-      "lint") run_lint ;;
-      "tests") run_tests ;;
-      "coverage") run_coverage ;;
-      *) return 1 ;;
-    esac
-  else
-    echo "No adapter found for language: $lang (searched: ~/.config/xp-gate/adapters/, githooks/adapters/)"
-    return 1
-  fi
-}
+# ---------------------------------------------------------------------------
+# REMOVED in #688: route_to_adapter()
+#
+# It was a dispatcher with zero production callers. pre-commit sources an
+# adapter and calls `run_static_analysis` / `run_lint` / `run_tests` /
+# `run_coverage` directly; nothing ever went through this function, so its
+# `case "$action"` enumeration was dead too -- including the "add an
+# `architecture` arm and it'll work" assumption in #688, which would have been
+# a no-op.
+#
+# Its two never-invoked dependants are gone with it: `run_architecture()` in
+# adapters/python.sh and adapters/go.sh. Gate 6 already implements both checks
+# INLINE in pre-commit, and does it better than the adapter versions did:
+#   * Python: detects 4 config carriers (.import-linter.yml /
+#     import_linter_config.yml / .importlinter / pyproject [tool.importlinter]),
+#     where the adapter checked 2, and BLOCKs when lint-imports is missing
+#     instead of `require_tool ... || return 0` silently passing.
+#   * Go: reads the checker's own exit status via PIPESTATUS[0] (#630), where a
+#     `arch-go check | head` pipeline would have reported head's status.
+# Wiring the adapter version back in would therefore have been a regression,
+# so the dead code was deleted instead of connected.
+#
+# tests: githooks/__tests__/issue-688-dead-dispatcher-removed.test.bats
+# ---------------------------------------------------------------------------
 
 check_if_tool_available() {
   local tool_name="$1"

package/adapters/go.sh

@@ -43,17 +43,12 @@ run_lint() {
   return $?
 }
 
-run_architecture() {
-  if ! require_tool arch-go "arch-go (Go architecture checker)" 2>/dev/null; then
-    echo "⚠ arch-go not available, installing..."
-    go install github.com/arch-go/arch-go@latest 2>/dev/null
-    require_tool arch-go "arch-go" || return 0
-  fi
-
-  echo "Running Go architecture checks (arch-go)..."
-  arch-go check
-  return $?
-}
+# REMOVED in #688: run_architecture()
+# Never invoked -- its only would-be caller, route_to_adapter(), had no callers
+# either. Gate 6 implements arch-go in pre-commit (grep "arch-go"), and reads
+# the checker's own exit status via PIPESTATUS[0] (#630) instead of letting a
+# `| head` pipeline report head's. See githooks/adapter-common.sh for the full
+# rationale.
 
 run_tests() {
   require_tool go "Go SDK" || return 1

package/adapters/kotlin.sh

@@ -14,30 +14,75 @@ run_static_analysis() {
   local build_system
   build_system=$(_detect_kotlin_build)
 
+  # (#706) A failed BUILD must not swallow a lint tool that works on its own.
+  #
+  # This used to `return 1` the moment Gradle/Maven failed to compile, so detekt
+  # -- which reads .kt sources directly and needs no build at all -- never ran.
+  # Measured on a machine whose Gradle cannot resolve the Kotlin plugin
+  # (`Failed to query the value of property 'buildFlowServiceProperty'`): the
+  # hook reported "SKIPPED - Code quality (tools unavailable or failed)" while
+  # `detekt --input .` on the same file reported two real findings. The gate
+  # blamed the toolchain for a verdict the toolchain never got to deliver.
+  #
+  # So: record the compilation failure, still run the standalone lint tool, and
+  # let the caller decide. The failure is reported, never hidden.
+  local build_failed=0
   if [ "$build_system" = "maven" ]; then
     mvn compile -q 2>&1 | grep -i "error\|fail" | sed -n '1,5p; 5q'
     if [ ${PIPESTATUS[0]} -ne 0 ]; then
       echo "❌ Maven compilation failed"
-      return 1
+      build_failed=1
     fi
   elif [ "$build_system" = "gradle" ]; then
     gradle compileKotlin --quiet 2>&1 | grep -i "error\|fail" | sed -n '1,5p; 5q'
     if [ ${PIPESTATUS[0]} -ne 0 ]; then
       echo "❌ Gradle compilation failed"
-      return 1
+      build_failed=1
     fi
   fi
 
+  # Standalone analyzers run regardless of the build outcome: their verdict does
+  # not depend on the build having succeeded.
+  #
+  # ktlint and detekt are tried in preference order, but a tool that is PRESENT
+  # and produces NOTHING is not the same as a tool that reached a verdict. An
+  # `elif` chain made the first present tool authoritative: a broken ktlint (or a
+  # shim on PATH, or ktlint 1.x refusing a `**/*.kt` glob) reported "No files
+  # matched" and detekt -- which works -- was never consulted. Measured here:
+  # `command -v ktlint` succeeded while `ktlint **/*.kt` matched zero files, so
+  # the real analyzer never ran.
+  local lint_rc=0 linted=0 ktlint_out=""
   if command -v ktlint &>/dev/null; then
-    ktlint "**/*.kt" 2>&1 | sed -n '1,20p; 20q'
-    return $?
-  elif command -v detekt &>/dev/null; then
+    ktlint_out=$(ktlint "**/*.kt" 2>&1)
+    lint_rc=$?
+    printf '%s\n' "$ktlint_out" | sed -n '1,20p'
+    # Only an EXECUTED ktlint counts as having delivered a verdict. Three ways it
+    # can fail to: the binary cannot run (127/126), it reports "No files matched"
+    # (ktlint 1.8.0 no longer resolves `**/*.kt`), or it printed nothing at all.
+    # In every one of those cases detekt should speak instead of ktlint's silence
+    # being read as "clean".
+    if [ "$lint_rc" -ne 127 ] && [ "$lint_rc" -ne 126 ] \
+       && [ -n "$ktlint_out" ] \
+       && ! printf '%s\n' "$ktlint_out" | grep -q 'No files matched'; then
+      linted=1
+    fi
+  fi
+  if [ "$linted" -eq 0 ] && command -v detekt &>/dev/null; then
     detekt --input . 2>&1 | sed -n '1,20p; 20q'
-    return $?
-  else
+    lint_rc=${PIPESTATUS[0]}
+    linted=1
+  fi
+  if [ "$linted" -eq 0 ]; then
     echo "No Kotlin lint tools (ktlint/detekt)"
-    return 0
+    # A missing lint tool is a SKIP, not a pass -- but it must not manufacture a
+    # failure either. Only the build result decides in that case.
+    [ "$build_failed" -eq 0 ] && return 0
+    return 1
   fi
+
+  # A lint finding is a finding whether or not the build also failed.
+  [ "$lint_rc" -ne 0 ] && return "$lint_rc"
+  return "$build_failed"
 }
 
 run_lint() {

package/adapters/python.sh

@@ -180,17 +180,12 @@ run_lint() {
   fi
 }
 
-run_architecture() {
-  if [ ! -f ".import-linter.yml" ] && [ ! -f "import_linter_config.yml" ]; then
-    return 0
-  fi
-
-  require_tool lint-imports "import-linter" || return 0
-
-  echo "Running Python architecture checks (import-linter)..."
-  lint-imports
-  return $?
-}
+# REMOVED in #688: run_architecture()
+# Never invoked -- its only would-be caller, route_to_adapter(), had no callers
+# either. Gate 6 implements import-linter in pre-commit (grep "import-linter"),
+# and more thoroughly: it detects 4 config carriers instead of the 2 checked
+# here, and BLOCKs on a missing lint-imports rather than `|| return 0` passing.
+# See githooks/adapter-common.sh for the full rationale.
 
 run_tests() {
   require_tool pytest "pytest" || return 1

package/gate-13-compiler-strictness.sh

@@ -525,7 +525,21 @@ gate13_javac_args() {
 gate13_count_lint_findings() {
   local src="${1:-}"
   [ -n "$src" ] || src=$(cat)
-  printf '%s\n' "$src" | awk '
+  # (#701) Pin the locale to C for this awk, on purpose. In a UTF-8 locale gawk
+  # refuses to let `.` span bytes that are not valid UTF-8, and a Maven build on a
+  # zh_CN Windows box writes its reactor summary in GBK (stdout.encoding=GBK), so a
+  # module name such as "验证程序" arrives as d1 e9 d6 a4 b3 cc d0 f2 -- invalid
+  # UTF-8. The #673 exclusion rule (`/^\[INFO\].*\[jar\].../`) then fails to match
+  # and the line falls through to the open-category rule as a phantom finding.
+  # Measured (#701): the same input counts 0 under LC_ALL=C and 1 under
+  # LC_ALL=C.UTF-8, i.e. the verdict depended on the caller's environment rather
+  # than on the build. C locale makes `.` byte-oriented, so the match no longer
+  # depends on whether the module name happens to be ASCII.
+  #
+  # This costs nothing in matching power: every marker below (packaging types,
+  # `[category]`, `warning:`) is ASCII, and the localised unchecked/unsafe
+  # wordings are matched as byte sequences, which C locale handles exactly.
+  printf '%s\n' "$src" | LC_ALL=C awk '
     BEGIN { n = 0 }
     # (#673) Maven 3.9.7+ reactor summary appends the packaging type per module:
     #     [INFO] whaleaudit-core  [jar]

package/hooks/adapter-common.sh

@@ -104,41 +104,30 @@ detect_project_lang() {
   fi
 }
 
-route_to_adapter() {
-  local action="$1"
-  local lang
-  lang=$(detect_project_lang)
-  
-  local adapter_file=""
-
-  # 3-tier resolution matching pre-commit ADAPTER_DIR logic
-  # Tier 1: Global flat layout (~/.config/xp-gate/adapters/lang.sh)
-  if [ -f "$HOME/.config/xp-gate/adapters/${lang}.sh" ]; then
-    adapter_file="$HOME/.config/xp-gate/adapters/${lang}.sh"
-  # Tier 2: Project nested layout (githooks/adapters/lang.sh)
-  elif [ -f "githooks/adapters/${lang}.sh" ]; then
-    adapter_file="githooks/adapters/${lang}.sh"
-  elif [ -f "./githooks/adapters/${lang}.sh" ]; then
-    adapter_file="./githooks/adapters/${lang}.sh"
-  fi
-
-  if [ -n "$adapter_file" ]; then
-    # shellcheck source=./githooks/adapters/lang.sh
-    source "$adapter_file"
-    
-    # Execute the requested action
-    case "$action" in
-      "static_analysis") run_static_analysis ;;
-      "lint") run_lint ;;
-      "tests") run_tests ;;
-      "coverage") run_coverage ;;
-      *) return 1 ;;
-    esac
-  else
-    echo "No adapter found for language: $lang (searched: ~/.config/xp-gate/adapters/, githooks/adapters/)"
-    return 1
-  fi
-}
+# ---------------------------------------------------------------------------
+# REMOVED in #688: route_to_adapter()
+#
+# It was a dispatcher with zero production callers. pre-commit sources an
+# adapter and calls `run_static_analysis` / `run_lint` / `run_tests` /
+# `run_coverage` directly; nothing ever went through this function, so its
+# `case "$action"` enumeration was dead too -- including the "add an
+# `architecture` arm and it'll work" assumption in #688, which would have been
+# a no-op.
+#
+# Its two never-invoked dependants are gone with it: `run_architecture()` in
+# adapters/python.sh and adapters/go.sh. Gate 6 already implements both checks
+# INLINE in pre-commit, and does it better than the adapter versions did:
+#   * Python: detects 4 config carriers (.import-linter.yml /
+#     import_linter_config.yml / .importlinter / pyproject [tool.importlinter]),
+#     where the adapter checked 2, and BLOCKs when lint-imports is missing
+#     instead of `require_tool ... || return 0` silently passing.
+#   * Go: reads the checker's own exit status via PIPESTATUS[0] (#630), where a
+#     `arch-go check | head` pipeline would have reported head's status.
+# Wiring the adapter version back in would therefore have been a regression,
+# so the dead code was deleted instead of connected.
+#
+# tests: githooks/__tests__/issue-688-dead-dispatcher-removed.test.bats
+# ---------------------------------------------------------------------------
 
 check_if_tool_available() {
   local tool_name="$1"

package/hooks/gate-13-compiler-strictness.sh

@@ -525,7 +525,21 @@ gate13_javac_args() {
 gate13_count_lint_findings() {
   local src="${1:-}"
   [ -n "$src" ] || src=$(cat)
-  printf '%s\n' "$src" | awk '
+  # (#701) Pin the locale to C for this awk, on purpose. In a UTF-8 locale gawk
+  # refuses to let `.` span bytes that are not valid UTF-8, and a Maven build on a
+  # zh_CN Windows box writes its reactor summary in GBK (stdout.encoding=GBK), so a
+  # module name such as "验证程序" arrives as d1 e9 d6 a4 b3 cc d0 f2 -- invalid
+  # UTF-8. The #673 exclusion rule (`/^\[INFO\].*\[jar\].../`) then fails to match
+  # and the line falls through to the open-category rule as a phantom finding.
+  # Measured (#701): the same input counts 0 under LC_ALL=C and 1 under
+  # LC_ALL=C.UTF-8, i.e. the verdict depended on the caller's environment rather
+  # than on the build. C locale makes `.` byte-oriented, so the match no longer
+  # depends on whether the module name happens to be ASCII.
+  #
+  # This costs nothing in matching power: every marker below (packaging types,
+  # `[category]`, `warning:`) is ASCII, and the localised unchecked/unsafe
+  # wordings are matched as byte sequences, which C locale handles exactly.
+  printf '%s\n' "$src" | LC_ALL=C awk '
     BEGIN { n = 0 }
     # (#673) Maven 3.9.7+ reactor summary appends the packaging type per module:
     #     [INFO] whaleaudit-core  [jar]

package/hooks/pre-commit

@@ -2237,15 +2237,22 @@ else
       ADAPTER_FILE=$(resolve_adapter_path "$CURRENT_LANG")
       if [ -n "$ADAPTER_FILE" ] && source "$ADAPTER_FILE" 2>/dev/null; then
         echo "Running static analysis for $CURRENT_LANG..."
+        # (#706) Capture the ADAPTER's verdict, not `head`'s.
+        #
+        # `run_static_analysis | head -30` makes `$?` the exit status of `head`,
+        # which is 0 whenever it manages to read anything -- so ANALYSIS_EXIT was
+        # always 0 and the "tools unavailable or failed" branch below was dead
+        # code. Measured: an adapter returning 1 through this pipe still produced
+        # PASSED. PIPESTATUS[0] carries the adapter's real status.
         run_static_analysis | head -30 2>/dev/null
-        ANALYSIS_EXIT=$?
+        ANALYSIS_EXIT=${PIPESTATUS[0]}
         if [ "$ANALYSIS_EXIT" -ne 0 ]; then
           echo "⚠️  Static analysis had issues (may be non-blocking)"
         fi
-    
+
         echo "Running lint check for $CURRENT_LANG..."
         run_lint | head -30 2>/dev/null
-        LINT_EXIT=$?
+        LINT_EXIT=${PIPESTATUS[0]}
         if [ "$LINT_EXIT" -ne 0 ]; then
           echo "ℹ️  Lint check had issues (may be non-blocking)"
         fi
@@ -3692,10 +3699,40 @@ else
         if [ "${PARTIAL_TEST_RUN:-false}" = "true" ]; then
           echo "⚠️  No JaCoCo report found (subset test run) — not blocking."
         else
+          # (#703) Diagnose BEFORE advising. The old message sent every user to
+          # `mvn verify`; on a build path containing non-ASCII characters that
+          # command is a dead end. Measured on a zh_CN Windows box at
+          # D:\projects\SQL审计工具: the JaCoCo agent never writes jacoco.exec, it
+          # does not throw, and Maven reports BUILD SUCCESS with
+          #   [INFO] Skipping JaCoCo execution due to missing execution data file.
+          # so `mvn verify` "fixes" nothing and the user loops. Splitting the
+          # diagnosis out lets each case get an action that can actually work.
           echo "❌ BLOCKED - No JaCoCo report found, so the ${COVERAGE_THRESHOLD:-80}% Java coverage"
-          echo "   floor cannot be verified. Run 'mvn verify' or 'gradle jacocoTestReport'"
-          echo "   so that target/site/jacoco/jacoco.csv exists (see also: JaCoCo detection"
-          echo "   in adapters/java.sh)."
+          echo "   floor cannot be verified."
+          # The distinguishing symptom is the jacoco.exec execution data file, not
+          # a missing report: a report that failed to be GENERATED and an agent
+          # that never WROTE are different problems with different fixes.
+          echo "   Likely cause: the JaCoCo agent did not write its execution data file"
+          echo "   (target/jacoco.exec), which is what 'Skipping JaCoCo execution due to"
+          echo "   missing execution data file' in the Maven log means."
+          # A non-ASCII working directory is the one common cause where the usual
+          # advice actively does not work, so it must be called out by name rather
+          # than left for the user to discover by trying.
+          case "$PWD" in
+            *[!-~]*)
+              echo "   ⚠️  This build path contains non-ASCII characters: ${PWD}"
+              echo "   ⚠️  Re-running 'mvn verify' will NOT help on this path — JaCoCo"
+              echo "       silently skips writing execution data there. Build through an"
+              echo "       ASCII-only directory instead (e.g. a junction to the same tree,"
+              echo "       entered with cmd's 'pushd'/'cd /d' — Git Bash's cd resolves the"
+              echo "       junction back to the non-ASCII path, so it does not help)."
+              ;;
+            *)
+              echo "   To produce it, run 'mvn verify' or 'gradle jacocoTestReport' so that"
+              echo "   target/site/jacoco/jacoco.csv exists (see also: JaCoCo detection"
+              echo "   in adapters/java.sh)."
+              ;;
+          esac
           exit 1
         fi
       fi
@@ -4539,6 +4576,91 @@ resolve_build_integrity_timeout() {
   esac
 }
 
+# (#708) A Java build failure has one overwhelmingly common cause that the gate
+# used to say nothing about: the wrong JDK. The real reason is buried in the last
+# 20 lines of Maven output, while the gate's own verdict line was only
+# "❌ Java build failed (exit 1)".
+#
+# Measured: a pom with <maven.compiler.release>8</maven.compiler.release> built
+# with JDK 8 fails with "无效的标记: --release" (invalid flag: --release) — a
+# message that points at the compiler ARGUMENTS and at the project CONFIG while
+# actually pointing at the JDK on PATH. Getting from that message to "change the
+# JDK" takes one inference, and the gate's verdict line supplied no premise for
+# it. The person debugging this suspected the release setting, then the plugin
+# version, then .mvn/jvm.config — all wrong; the fix was a different JDK.
+#
+# So: on failure, print what JDK actually ran, what the project asks for, and —
+# when the output carries the tell — state the conclusion instead of the symptom.
+# Diagnostics must never change the verdict; this only adds lines.
+java_bi_report_jdk_context() {
+  local build_out="$1"
+  local java_version="" java_home_val="${JAVA_HOME:-}"
+  # `java -version` writes to stderr on every JDK. Take the version line verbatim
+  # rather than parsing it: this is a diagnostic, and the raw line is what a
+  # person would paste into a bug report.
+  if command -v java >/dev/null 2>&1; then
+    java_version=$(java -version 2>&1 | sed -n '1p')
+  fi
+  if [ -n "$java_version" ]; then
+    echo "     JDK in use: ${java_version}"
+  else
+    echo "     JDK in use: (java not on PATH)"
+  fi
+  if [ -n "$java_home_val" ]; then
+    echo "     JAVA_HOME: ${java_home_val}"
+  else
+    echo "     JAVA_HOME: (unset)"
+  fi
+
+  # What the project requires. Maven declares it three ways; Gradle declares it in
+  # its build script. Report whichever exists — the comparison is the user's, but
+  # only if both halves are visible.
+  local declared=""
+  if [ -f "pom.xml" ]; then
+    local mvn_release mvn_source
+    mvn_release=$(grep -o '<maven\.compiler\.release>[[:space:]]*[0-9][0-9]*' pom.xml 2>/dev/null \
+      | sed 's/.*>[[:space:]]*//' | head -1)
+    mvn_source=$(grep -o '<maven\.compiler\.source>[[:space:]]*[0-9][0-9]*' pom.xml 2>/dev/null \
+      | sed 's/.*>[[:space:]]*//' | head -1)
+    if [ -n "$mvn_release" ]; then
+      declared="maven.compiler.release=${mvn_release}"
+    elif [ -n "$mvn_source" ]; then
+      declared="maven.compiler.source=${mvn_source}"
+    fi
+  fi
+  if [ -z "$declared" ] && [ -f "build.gradle" ]; then
+    local g_compat
+    g_compat=$(grep -o "sourceCompatibility[[:space:]]*=[[:space:]]*['\"]\{0,1\}[0-9][0-9]*" build.gradle 2>/dev/null \
+      | sed "s/.*[=][[:space:]]*['\"]\{0,1\}//" | head -1)
+    [ -n "$g_compat" ] && declared="sourceCompatibility=${g_compat}"
+  fi
+  if [ -z "$declared" ] && [ -f "build.gradle.kts" ]; then
+    local k_compat
+    k_compat=$(grep -o 'sourceCompatibility[[:space:]]*=[[:space:]]*JavaVersion\.VERSION_[0-9_]*' build.gradle.kts 2>/dev/null \
+      | sed 's/.*VERSION_//' | tr '_' '.' | head -1)
+    [ -n "$k_compat" ] && declared="sourceCompatibility=${k_compat}"
+  fi
+
+  if [ -n "$declared" ]; then
+    echo "     Project requires: ${declared}"
+  else
+    echo "     Project requires: (no JDK floor declared in pom.xml/build.gradle)"
+  fi
+
+  # The tell. `--release` only exists from JDK 9, so its rejection is a direct
+  # statement about the JDK, not about the pom. Saying so converts a search into
+  # a fix.
+  case "$build_out" in
+    *--release*)
+      if printf '%s' "$build_out" | grep -qiE 'invalid flag|无效的标记|illegal option|unrecognized|unknown option'; then
+        echo "     💡 The build passed '--release' to javac and the JDK rejected it."
+        echo "        '--release' requires JDK 9 or newer; the JDK above is older than that."
+        echo "        Switch to a JDK >= 9 (or remove the release/source setting if it is not intended)."
+      fi
+      ;;
+  esac
+}
+
 run_java_build_integrity() {
   local timeout_s build_bin
   # Wrapper first: mvnw pins the project's own Maven version.
@@ -4553,12 +4675,17 @@ run_java_build_integrity() {
   fi
 
   timeout_s=$(resolve_build_integrity_timeout)
+  # (#708) Keep the output: the failure branch has to read it to tell a wrong-JDK
+  # failure from any other one. Displayed through `tail -20` exactly as before, so
+  # the visible build log is unchanged.
+  local bi_out
   if command -v timeout >/dev/null 2>&1; then
-    timeout "$timeout_s" "$build_bin" -q -DskipTests compile 2>&1 | tail -20
+    bi_out=$(timeout "$timeout_s" "$build_bin" -q -DskipTests compile 2>&1)
   else
-    "$build_bin" -q -DskipTests compile 2>&1 | tail -20
+    bi_out=$("$build_bin" -q -DskipTests compile 2>&1)
   fi
-  local rc="${PIPESTATUS[0]}"
+  local rc=$?
+  printf '%s\n' "$bi_out" | tail -20
   if [ "$rc" -eq 0 ]; then
     echo "     ✅ Java build integrity verified (mvn -q -DskipTests compile)."
     return 0
@@ -4569,6 +4696,7 @@ run_java_build_integrity() {
     return 3
   fi
   echo "     ❌ Java build failed (exit $rc)"
+  java_bi_report_jdk_context "$bi_out"
   return 2
 }
 

package/lib/__tests__/doctor-delphi.test.js

@@ -403,7 +403,7 @@ describe('doctor delphi #684 global config fallback', () => {
     return { logs, restore: () => spy.mockRestore() };
   }
 
-  it('AC-684-01: a valid global config with no project copy PASSes instead of failing', async () => {
+  it('AC-721-01: a valid global config with no project copy PASSes instead of failing', async () => {
     const globalPath = writeGlobalConfig();
     const project = path.join(tmpHome, 'a-project-with-no-config');
     fs.mkdirSync(project, { recursive: true });
@@ -417,7 +417,7 @@ describe('doctor delphi #684 global config fallback', () => {
     expect(cfgLine).toMatch(/global/i);
   });
 
-  it('AC-684-02: no config in either scope still FAILs (fallback must not mask a broken install)', async () => {
+  it('AC-721-02: no config in either scope still FAILs (fallback must not mask a broken install)', async () => {
     const project = path.join(tmpHome, 'bare-project');
     fs.mkdirSync(project, { recursive: true });
     const { logs, restore } = captureLogs();
@@ -436,7 +436,7 @@ describe('doctor delphi #684 global config fallback', () => {
     expect(cfgLine).toMatch(/not found/);
   });
 
-  it('AC-684-03: a project config still wins over the global one', async () => {
+  it('AC-721-03: a project config still wins over the global one', async () => {
     const globalPath = writeGlobalConfig();
     const project = path.join(tmpHome, 'project-with-own-config');
     fs.mkdirSync(project, { recursive: true });

package/lib/__tests__/doctor-tui-skill-freshness.test.js

@@ -336,7 +336,7 @@ describe('doctor-tui skill freshness #681 equal version, different content', ()
     return { issues, check: checks.find((c) => c.name === `Skill: ${name}`) };
   }
 
-  it('AC-681-01: same version but a missing chapter is WARN, not "Up to date"', () => {
+  it('AC-718-01: same version but a missing chapter is WARN, not "Up to date"', () => {
     const bundled = fs.readFileSync(path.join(bundledSkillsDir, 'delphi-review', 'SKILL.md'), 'utf8');
     // Keep the frontmatter (version included), drop a large slice of the body.
     const idx = bundled.indexOf('\n---', 4);
@@ -352,7 +352,7 @@ describe('doctor-tui skill freshness #681 equal version, different content', ()
     expect(issues).toBe(1);
   });
 
-  it('AC-681-02: same version and same content is still "Up to date" (no false alarm)', () => {
+  it('AC-718-02: same version and same content is still "Up to date" (no false alarm)', () => {
     const bundled = fs.readFileSync(path.join(bundledSkillsDir, 'delphi-review', 'SKILL.md'), 'utf8');
     installSkill('delphi-review', bundled);
     const { issues, check } = runFreshness('delphi-review');
@@ -360,7 +360,7 @@ describe('doctor-tui skill freshness #681 equal version, different content', ()
     expect(issues).toBe(0);
   });
 
-  it('AC-681-03: line endings alone still do not count as a difference', () => {
+  it('AC-718-03: line endings alone still do not count as a difference', () => {
     const bundled = fs.readFileSync(path.join(bundledSkillsDir, 'delphi-review', 'SKILL.md'), 'utf8');
     installSkill('delphi-review', bundled.replace(/\r\n/g, '\n').replace(/\n/g, '\r\n'));
     const { issues, check } = runFreshness('delphi-review');