@boyingliu01/xp-gate 0.35.4 → 0.35.6

package/bin/xp-gate.js

@@ -277,7 +277,7 @@ const COMMANDS = {
       }
       return doctor(subargs).then(code => process.exit(code));
     },
-    usage: 'xp-gate doctor [--fix [--install-tools] | --sync-hooks [--force] | --refresh-env] | --json | --format json  (the two machine-readable modes print one JSON document and refuse --fix/--sync-hooks; --refresh-env is read-only so it combines with them)'
+    usage: 'xp-gate doctor [--fix [--install-tools] | --sync-hooks [--force] | --refresh-env | --brief] | --json | --format json  (--brief is a read-only one-shot fact dump and refuses --fix/--sync-hooks/--install-tools/--force; the two machine-readable modes print one JSON document and refuse --fix/--sync-hooks; --refresh-env is read-only so it combines with them)'
   },
   'ui-review': {
     description: 'Run UI review for non-sprint developers (generates .ui-gate-result.json)',

package/gates/test-layers.ts

@@ -20,8 +20,23 @@ export interface TestLayerReport {
   layer1: {
     pairedSources: number;
     unpairedSources: string[];
+    /**
+     * Sources the pairing convention does not describe (#642).
+     *
+     * Reported apart from `unpairedSources` because the two call for opposite
+     * responses: an unpaired source needs a test, whereas an out-of-scope source
+     * (a shell script covered by BATS) needs the convention widened. Counting it
+     * as "unpaired" would ask the reader to write a .test.ts for `pre-commit`.
+     */
+    outOfScopeSources: string[];
     pairRate: number;
   };
+  /** Test suites that live outside src/ -- BATS and other shell-level suites (#642). */
+  shellSuites: {
+    total: number;
+    bats: number;
+    files: string[];
+  };
   layer2: {
     integrationFiles: number;
   };
@@ -175,6 +190,8 @@ interface LayerCounts {
   integrationTests: string[];
   e2eTests: string[];
   unpairedSources: string[];
+  outOfScopeSources: string[];
+  shellSuites: string[];
   pairedCount: number;
 }
 
@@ -189,15 +206,24 @@ function appendPairingLines(messages: string[], counts: LayerCounts, totalNeedin
   messages.push('  Layer 1 (Unit Pairing):');
   messages.push(`    Paired:    ${counts.pairedCount}/${totalNeedingTests} (${pairRate}%)`);
 
-  const unpaired = counts.unpairedSources;
-  if (unpaired.length === 0 || unpaired.length > UNPAIRED_DISPLAY_LIMIT) {
-    if (unpaired.length > 0) {
-      messages.push(`    Unpaired:  ${unpaired.length} files (showing first 10)`);
-      unpaired.slice(0, UNPAIRED_DISPLAY_LIMIT).forEach(f => messages.push(`      - ${f}`));
-    }
+  appendUnpairedLines(messages, counts.unpairedSources);
+
+  // Out-of-scope sources get their own line: folding them into the unpaired list
+  // would ask the reader to write a module test for a shell script (#642).
+  if (counts.outOfScopeSources.length > 0) {
+    messages.push(`    Not pair-able (shell/other): ${counts.outOfScopeSources.length}`);
+  }
+}
+
+/** Unpaired list, kept short enough not to bury the summary above it (#620). */
+function appendUnpairedLines(messages: string[], unpaired: string[]): void {
+  if (unpaired.length === 0) return;
+  if (unpaired.length <= UNPAIRED_DISPLAY_LIMIT) {
+    messages.push(`    Unpaired:  ${unpaired.join(', ')}`);
     return;
   }
-  messages.push(`    Unpaired:  ${unpaired.join(', ')}`);
+  messages.push(`    Unpaired:  ${unpaired.length} files (showing first 10)`);
+  unpaired.slice(0, UNPAIRED_DISPLAY_LIMIT).forEach(f => messages.push(`      - ${f}`));
 }
 
 /** Format the console block for one analysis. */
@@ -207,10 +233,14 @@ function buildLayerMessages(counts: LayerCounts, totalNeedingTests: number): str
     '━━━ Test Layer Analytics ━━━',
     '',
     `  Sources:     ${counts.sourceFiles.length} files`,
-    `  Tests:       ${counts.testFiles.length} total`,
+    `  Tests:       ${counts.testFiles.length + counts.shellSuites.length} total`,
     `    Unit:      ${counts.unitTests.length}`,
-    `    Integra:   ${counts.integrationTests.length}`,
+    `    Integra:   ${counts.integrationTests.length + counts.shellSuites.length}`,
     `    E2E:       ${counts.e2eTests.length}`,
+    // Printed separately rather than folded into "Integra": whether a suite is
+    // BATS or a TS integration test is a fact about the repo that the reader is
+    // here to learn, and a shell suite is never counted as a unit test (#642).
+    `    Shell:     ${counts.shellSuites.length}`,
     '',
   ];
 
@@ -236,13 +266,21 @@ function buildLayerMessages(counts: LayerCounts, totalNeedingTests: number): str
 function computePairing(
   sourceFiles: string[],
   allFiles: string[],
-): { unpairedSources: string[]; pairedCount: number } {
+): { unpairedSources: string[]; outOfScopeSources: string[]; pairedCount: number } {
   const allSourceRelative = allFiles.map(f => path.join('src', f));
   const unpairedSources: string[] = [];
+  const outOfScopeSources: string[] = [];
   let pairedCount = 0;
 
   for (const source of sourceFiles) {
     if (isExempt(path.basename(source))) continue;
+    // A source the convention does not describe is not "unpaired" -- nobody was
+    // ever asked to pair it. Reporting it as unpaired would send the reader to
+    // write a module test for a shell script (#642).
+    if (isPairingOutOfScope(source)) {
+      outOfScopeSources.push(source);
+      continue;
+    }
     if (findExpectedTest(path.join('src', source), allSourceRelative)) {
       pairedCount++;
     } else {
@@ -250,7 +288,95 @@ function computePairing(
     }
   }
 
-  return { unpairedSources, pairedCount };
+  return { unpairedSources, outOfScopeSources, pairedCount };
+}
+
+/**
+ * Directories that hold test suites but are not under `src/` (#642).
+ *
+ * `test-layers` used to scan only `<repo>/src`, so this repository's 166 BATS
+ * suites were invisible: the report said "Integration: 0" about a repo whose
+ * hook tests spawn real git, real shell adapters and real processes. A metric
+ * that omits 37% of the suites cannot be used to judge the test strategy.
+ */
+const SHELL_SUITE_DIRS = [
+  'githooks/__tests__',
+  'scripts/__tests__',
+  'tests',
+  'test',
+];
+
+/** A shell-level test suite: BATS or a bare .test.cjs/.test.mjs. */
+function isShellSuite(normalized: string): boolean {
+  return /\.test\.bats$/.test(normalized)
+    || /\.test\.(cjs|mjs)$/.test(normalized)
+    || /\/__tests__\/[^/]+\.bats$/.test(normalized);
+}
+
+/**
+ * Find test suites outside `src/` (#642).
+ *
+ * Bounded to the conventional test directories rather than walking the whole
+ * repo: node_modules and build output would otherwise dominate, and a suite that
+ * is not under one of these roots is not discoverable by the runner either.
+ */
+function listDirNames(abs: string): string[] {
+  try {
+    // Explicit encoding: without it readdirSync may hand back Buffer entries.
+    // The array check covers stubbed/mocked fs implementations too -- a suite
+    // that exercises the "directory missing" path must not crash the scanner.
+    const listing = fs.readdirSync(abs, { encoding: 'utf8' });
+    return Array.isArray(listing) ? listing : [];
+  } catch {
+    return [];
+  }
+}
+
+/** Suites under one shell-test root, as repo-relative forward-slash paths. */
+function suitesInDir(root: string, rel: string): string[] {
+  const prefix = rel.split(path.sep).join('/');
+  return listDirNames(path.join(root, rel))
+    .map(name => `${prefix}/${name}`)
+    .filter(isShellSuite);
+}
+
+export function discoverShellSuites(cwd?: string): string[] {
+  const root = cwd || process.cwd();
+  const found = SHELL_SUITE_DIRS.flatMap(rel => suitesInDir(root, rel));
+  // Sorted so the report is stable across filesystems with differing readdir order.
+  return found.sort();
+}
+
+/**
+ * Files the `.test.ts` pairing convention does not apply to (#642).
+ *
+ * Shell scripts are exercised by BATS suites, not by a neighbouring module
+ * test. Listing them separately keeps the pair rate about the language whose
+ * convention it actually describes.
+ */
+function isPairingOutOfScope(filePath: string): boolean {
+  return /\.(sh|bash|bats)$/.test(filePath) || !/\.(ts|tsx|js|jsx|mjs|cjs|py|go|java|kt)$/.test(filePath);
+}
+
+/** The summary block; shell suites are added to the test total (#642). */
+function buildSummary(counts: LayerCounts, shellOutsideSrc: string[]): TestLayerReport['summary'] {
+  return {
+    totalSources: counts.sourceFiles.length,
+    totalTests: counts.testFiles.length + shellOutsideSrc.length,
+    unitTests: counts.unitTests.length,
+    integrationTests: counts.integrationTests.length,
+    e2eTests: counts.e2eTests.length,
+  };
+}
+
+/**
+ * Shell-level suites that the src/ scan did not already pick up (#642).
+ *
+ * Keeping these out of the count made "Integration: 0" a statement about the
+ * scanner rather than about the repository.
+ */
+function shellSuitesOutside(testFiles: string[], dir: string): string[] {
+  return discoverShellSuites(dir).filter(f => !testFiles.includes(f));
 }
 
 /**
@@ -264,7 +390,8 @@ export function analyzeTestLayers(cwd?: string): TestLayerReport {
   const testFiles = allFiles.filter(f => isTestFile(f));
   const byLayer = (layer: string): string[] => testFiles.filter(f => classifyTestLayer(f) === layer);
 
-  const { unpairedSources, pairedCount } = computePairing(sourceFiles, allFiles);
+  const { unpairedSources, outOfScopeSources, pairedCount } = computePairing(sourceFiles, allFiles);
+  const shellOutsideSrc = shellSuitesOutside(testFiles, dir);
 
   const counts: LayerCounts = {
     sourceFiles,
@@ -273,23 +400,25 @@ export function analyzeTestLayers(cwd?: string): TestLayerReport {
     integrationTests: byLayer('integration'),
     e2eTests: byLayer('e2e'),
     unpairedSources,
+    outOfScopeSources,
+    shellSuites: shellOutsideSrc,
     pairedCount,
   };
-  const totalNeedingTests = sourceFiles.filter(f => !isExempt(path.basename(f))).length;
+  const totalNeedingTests = sourceFiles.filter(f => !isExempt(path.basename(f)) && !isPairingOutOfScope(f)).length;
 
   return {
-    summary: {
-      totalSources: sourceFiles.length,
-      totalTests: testFiles.length,
-      unitTests: counts.unitTests.length,
-      integrationTests: counts.integrationTests.length,
-      e2eTests: counts.e2eTests.length,
-    },
+    summary: buildSummary(counts, shellOutsideSrc),
     layer1: {
       pairedSources: pairedCount,
       unpairedSources,
+      outOfScopeSources,
       pairRate: totalNeedingTests > 0 ? Math.round((pairedCount / totalNeedingTests) * 100) : 100,
     },
+    shellSuites: {
+      total: shellOutsideSrc.length,
+      bats: shellOutsideSrc.filter(f => f.endsWith('.test.bats') || f.endsWith('.bats')).length,
+      files: shellOutsideSrc,
+    },
     layer2: {
       integrationFiles: counts.integrationTests.length,
     },

package/lib/__tests__/check-single-file.test.js

@@ -0,0 +1,63 @@
+/**
+ * @test REQ-653 `check --gates` 单文件自检必须真的跑起来，且 < 2 秒
+ * @intent #653 要求提供一条"提交前自检"的快速路径，目标是让模型在写完代码后立刻
+ *         自查，而不是等一轮完整 pre-commit（Gate 5 单项就 32.5s）。
+ *
+ *         实现过程中挖出两个真 bug，它们都属于同一类：**工具没跑起来，却被报成
+ *         "你的代码有问题"**。
+ *
+ *         1. `xp-gate check <file>` 把文件路径直接当成 spawnSync 的 `cwd`。cwd 必须是
+ *            目录，指向文件时 spawnSync 返回裸 ENOENT，上层打印
+ *            "Gate 3: failed to run npx tsx" 然后计作 FAIL。
+ *         2. Windows 上曾用 `shell: true` 解析 npx.cmd，但 node 把 argv 拼成一整条
+ *            未转义的命令行（DEP0190），路径里有反斜杠或空格就会变形；改调 npx.cmd
+ *            本身又撞上 CVE-2024-27980 的 EINVAL 加固。
+ *
+ *         两个修复都要求"文件路径能跑通"，而不是"错误信息更好看"。所以断言打在
+ *         真实的 passed 计数与退出码上。
+ * @covers AC-653-04, AC-653-05
+ */
+'use strict';
+
+const { execFileSync } = require('node:child_process');
+const path = require('node:path');
+const fs = require('node:fs');
+
+const CLI = path.join(__dirname, '..', '..', 'bin', 'xp-gate.js');
+const REPO = path.join(__dirname, '..', '..', '..', '..');
+
+function runCheck(relPath) {
+  const started = Date.now();
+  let stdout = '';
+  let status = 0;
+  try {
+    stdout = execFileSync(process.execPath, [CLI, 'check', relPath, '--gates', 'principles'], {
+      cwd: REPO,
+      encoding: 'utf8',
+      timeout: 120000,
+    });
+  } catch (err) {
+    stdout = `${err.stdout || ''}${err.stderr || ''}`;
+    status = err.status || 1;
+  }
+  return { stdout, status, elapsed: Date.now() - started };
+}
+
+describe('check --gates 单文件自检 (#653)', () => {
+  it('AC-653-04: 传文件路径时 gate 真的执行，而不是报 spawn 失败', () => {
+    const target = 'src/npm-package/lib/doctor-brief.js';
+    expect(fs.existsSync(path.join(REPO, target))).toBe(true);
+    const { stdout } = runCheck(target);
+    // The pre-fix symptom was exactly this string followed by a FAIL verdict.
+    expect(stdout).not.toMatch(/failed to run npx tsx/);
+    expect(stdout).not.toMatch(/ENOENT|EINVAL/);
+    expect(stdout).toMatch(/principles/i);
+  });
+
+  it('AC-653-05: 单文件自检在 2 秒内给出结论', () => {
+    const { elapsed } = runCheck('src/npm-package/lib/doctor-brief.js');
+    // #653's whole value proposition: self-check before committing beats waiting
+    // for a 3-minute pre-commit. A slow "fast path" is not a fast path.
+    expect(elapsed).toBeLessThan(2000);
+  });
+});

package/lib/__tests__/doctor-brief.test.js

@@ -0,0 +1,59 @@
+/**
+ * @test REQ-653 `doctor --brief` 必须一条命令给出全部环境事实
+ * @intent 一个会话里 32.7% 的 shell 调用是纯探测（`where gcc`、`Test-Path`、
+ *         逐文件 `Get-Content`、版本探测），每次 16s 上下。这类探测的共同点是
+ *         **答案几乎不变**，却要为每个问题付一次往返。
+ *
+ *         `--brief` 的目标不是"少打印"，而是"一次问完"：模型拿到一屏结构化事实后
+ *         不需要再探任何东西。所以验收标准是**覆盖率**，不是行数——90% 的常见
+ *         探测问题必须能在这一屏里找到答案。
+ *
+ *         一个容易做错的地方：`--brief` 必须是**纯读取**。用户会因为"快"而频繁调用它，
+ *         若它顺手修了什么（比如 `--fix` 的行为），频繁调用的代价就从延迟变成了状态。
+ * @covers AC-653-01, AC-653-02, AC-653-03
+ */
+'use strict';
+
+const { buildBriefReport, BRIEF_FACTS } = require('../doctor-brief');
+
+describe('doctor --brief (#653)', () => {
+  it('AC-653-01: 覆盖常见环境探测——语言工具链、hooks、门禁、覆盖率', () => {
+    const report = buildBriefReport({ cwd: process.cwd() });
+    const keys = Object.keys(report.facts);
+    // Each of these replaces a class of exploratory probe that used to cost a
+    // round trip. If one is missing, models go back to probing for it manually.
+    for (const required of ['hooks', 'language', 'adapters', 'coverage', 'gateState']) {
+      expect(keys).toContain(required);
+    }
+    expect(BRIEF_FACTS.length).toBeGreaterThanOrEqual(5);
+  });
+
+  it('AC-653-02: 输出必须是可直接消费的结构，不是需要再解析的散文', () => {
+    const report = buildBriefReport({ cwd: process.cwd() });
+    // A model that has to regex a sentence has not saved a round trip.
+    expect(typeof report.facts.hooks.effectivePath).toBe('string');
+    expect(Array.isArray(report.facts.language.detected)).toBe(true);
+    expect(typeof report.facts.coverage.found).toBe('boolean');
+    // One-line summary for humans, but the structure carries the facts.
+    expect(typeof report.summary).toBe('string');
+    expect(report.summary.split('\n').length).toBeLessThanOrEqual(3);
+  });
+
+  it('AC-653-03: --brief 纯读取，不修改任何状态', () => {
+    const { execFileSync } = require('node:child_process');
+    const fs = require('node:fs');
+    const path = require('node:path');
+    const before = fs.readdirSync(process.cwd()).sort().join('\n');
+    try {
+      execFileSync(process.execPath, [
+        path.join(__dirname, '..', '..', 'bin', 'xp-gate.js'), 'doctor', '--brief', '--json',
+      ], { cwd: process.cwd(), encoding: 'utf8', timeout: 120000 });
+    } catch {
+      // Exit code is not the assertion here; mutation is.
+    }
+    const after = fs.readdirSync(process.cwd()).sort().join('\n');
+    // The real cost of a --fix sneaking in is not one bad run: users call --brief
+    // often BECAUSE it is cheap, so an unintended write compounds every session.
+    expect(after).toBe(before);
+  });
+});

package/lib/doctor-brief.js

@@ -0,0 +1,159 @@
+/**
+ * `xp-gate doctor --brief` — one command that answers every common environment
+ * probe (#653).
+ *
+ * Why this exists: 32.7% of shell calls in a working session were pure probing
+ * (`where gcc`, `Test-Path`, per-file `Get-Content`, version checks), at ~16s
+ * each. The common thread is that the answers barely change, yet every question
+ * costs a full round trip. The fix is not to print less — it is to ask once.
+ *
+ * Two rules this module holds itself to:
+ *
+ * 1. **Read-only.** `--brief` is meant to be called often precisely because it is
+ *    cheap. Anything that writes would make frequent calling compound state
+ *    changes instead of only latency.
+ * 2. **Structured first, summary second.** A model that has to regex a sentence
+ *    has not saved a round trip. `facts` carries the data; `summary` is a
+ *    convenience for humans and nothing depends on it.
+ *
+ * No runtime dependencies: this ships inside the zero-install package.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+/** The fact groups `--brief` promises. Tests pin this list; adding a group here
+ *  without teaching the model to use it only adds output, so keep it deliberate. */
+const BRIEF_FACTS = ['hooks', 'language', 'adapters', 'coverage', 'gateState'];
+
+/** Run a command, returning trimmed stdout or null. Never throws. */
+function tryExec(cmd, args, cwd) {
+  try {
+    const out = execFileSync(cmd, args, {
+      cwd,
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return out.trim();
+  } catch {
+    return null;
+  }
+}
+
+/** Which hooks actually execute, and where they live. */
+function readHooks(cwd) {
+  const hooksPath = tryExec('git', ['config', '--get', 'core.hooksPath'], cwd);
+  const effective = hooksPath || '.git/hooks';
+  const dir = path.isAbsolute(effective) ? effective : path.join(cwd, effective);
+  let installed = [];
+  try {
+    installed = fs.readdirSync(dir).filter((name) => !name.endsWith('.sample'));
+  } catch {
+    installed = [];
+  }
+  return {
+    hooksPath: hooksPath || null,
+    effectivePath: dir,
+    installed,
+    // #451: when core.hooksPath is set, the repo copy is NOT what runs.
+    globalOverride: Boolean(hooksPath),
+  };
+}
+
+/** Project language markers, cheapest signal first. */
+const LANGUAGE_MARKERS = [
+  ['typescript', ['tsconfig.json']],
+  ['python', ['pyproject.toml', 'setup.py', 'requirements.txt']],
+  ['go', ['go.mod']],
+  ['java', ['pom.xml', 'build.gradle', 'build.gradle.kts']],
+  ['kotlin', ['build.gradle.kts']],
+  ['dart', ['pubspec.yaml']],
+  ['rust', ['Cargo.toml']],
+];
+
+function detectLanguages(cwd) {
+  const found = [];
+  for (const [lang, markers] of LANGUAGE_MARKERS) {
+    if (markers.some((m) => fs.existsSync(path.join(cwd, m)))) found.push(lang);
+  }
+  return { detected: found, primary: found[0] || null };
+}
+
+/** Which adapters are reachable via the documented 3-tier resolution. */
+function detectAdapters(cwd) {
+  const tiers = [
+    path.join(process.env.HOME || process.env.USERPROFILE || '', '.config', 'xp-gate', 'adapters'),
+    path.join(cwd, 'githooks', 'adapters'),
+  ];
+  const seen = new Set();
+  const sources = [];
+  for (const dir of tiers) {
+    let names = [];
+    try {
+      names = fs.readdirSync(dir).filter((n) => n.endsWith('.sh'));
+    } catch {
+      continue;
+    }
+    for (const n of names) seen.add(n);
+    sources.push({ dir, count: names.length });
+  }
+  return { count: seen.size, sources };
+}
+
+/** Where coverage would come from, if anywhere. */
+const COVERAGE_CANDIDATES = [
+  'coverage/coverage-final.json',
+  'coverage/lcov.info',
+  'target/site/jacoco/jacoco.xml',
+  'build/reports/jacoco/test/jacocoTestReport.xml',
+];
+
+function detectCoverage(cwd) {
+  const hits = COVERAGE_CANDIDATES.filter((rel) => fs.existsSync(path.join(cwd, rel)));
+  return { found: hits.length > 0, files: hits };
+}
+
+/** Last gate artifact, so callers stop re-reading `.xp-gate/` by hand. */
+function readGateState(cwd) {
+  const artifact = path.join(cwd, '.xp-gate', 'quality-status', 'main.json');
+  try {
+    const parsed = JSON.parse(fs.readFileSync(artifact, 'utf8'));
+    return {
+      artifact,
+      commit: parsed.commit || null,
+      gates: Object.keys(parsed).filter((k) => k.startsWith('gate')).length,
+    };
+  } catch {
+    // No artifact is a fact worth stating, not an error: "never run" and
+    // "failed to read" would otherwise be indistinguishable.
+    return { artifact, commit: null, gates: 0 };
+  }
+}
+
+/**
+ * Build the brief report.
+ *
+ * @param {{cwd?: string}} opts
+ * @returns {{facts: object, summary: string}}
+ */
+function buildBriefReport(opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  const facts = {
+    hooks: readHooks(cwd),
+    language: detectLanguages(cwd),
+    adapters: detectAdapters(cwd),
+    coverage: detectCoverage(cwd),
+    gateState: readGateState(cwd),
+  };
+  const summary = [
+    `lang=${facts.language.primary || 'unknown'} adapters=${facts.adapters.count} ` +
+      `coverage=${facts.coverage.found ? 'yes' : 'no'} hooks=${facts.hooks.globalOverride ? 'global' : 'local'}`,
+    `hooksPath=${facts.hooks.effectivePath}`,
+  ].join('\n');
+  return { facts, summary };
+}
+
+module.exports = { BRIEF_FACTS, buildBriefReport };

package/lib/doctor.js

@@ -2873,7 +2873,7 @@ function diagnoseLanguageTools() {
 // #488: an unrecognised flag used to be silently ignored — the npm release
 // that predates --sync-hooks made "doctor --sync-hooks" a silent no-op and the
 // user believed a sync had happened. Fail loudly instead.
-const KNOWN_FLAGS = ['--fix', '--sync-hooks', '--force', '--install-tools', '--json', '--format', '--refresh-env'];
+const KNOWN_FLAGS = ['--fix', '--sync-hooks', '--force', '--install-tools', '--json', '--format', '--refresh-env', '--brief'];
 
 /**
  * The accepted flag surface of `doctor`, as a pure function.
@@ -2931,11 +2931,31 @@ function doctorFlagContract(args) {
     errors.push('--install-tools is only read by --fix, and it is the only flag that installs toolchains onto this machine');
     errors.push('Pass --fix --install-tools, or drop --install-tools');
   }
-  return { errors, fixMode, syncHooks, force, installToolsFlag, jsonMode, refreshEnv };
+  // #653: --brief exists to collapse a class of exploratory probes (`where gcc`,
+  // Test-Path, per-file reads) into one cheap read. It is read-only by contract:
+  // users call it often precisely because it is cheap, so a write smuggled in
+  // would compound state changes instead of only latency.
+  const briefFlag = args.includes('--brief');
+  if (briefFlag && (fixMode || syncHooks || installToolsFlag || force)) {
+    errors.push('--brief is a read-only fact dump and cannot be combined with --fix, --sync-hooks, --install-tools or --force');
+  }
+  return { errors, fixMode, syncHooks, force, installToolsFlag, jsonMode, refreshEnv, briefFlag };
 }
 
 async function doctor(args) {
-  const { errors, fixMode, syncHooks, force, installToolsFlag, jsonMode, refreshEnv } = doctorFlagContract(args);
+  const { errors, fixMode, syncHooks, force, installToolsFlag, jsonMode, refreshEnv, briefFlag } = doctorFlagContract(args);
+  if (briefFlag && errors.length === 0) {
+    // Answers the whole "what is this machine set up like" question in one shot.
+    const { buildBriefReport } = require('./doctor-brief');
+    const report = buildBriefReport({ cwd: process.cwd() });
+    if (jsonMode) {
+      process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    } else {
+      process.stdout.write(`${report.summary}\n`);
+    }
+    process.exitCode = 0;
+    return;
+  }
   if (errors.length > 0) {
     for (const error of errors) console.error(error);
     return 1;

package/lib/gate-runner.js

@@ -320,8 +320,49 @@ const GATE_NOT_RUN = 'NOT_RUN';
  * Finds the .ts entry point, spawns tsx with --run flag.
  * Falls back to bash script if TypeScript module not found.
  */
+/**
+ * Resolve the working directory for a gate run.
+ *
+ * `targetPath` is documented as "file or directory" (that is what
+ * `xp-gate check <file>` passes), but spawnSync's `cwd` must be a directory.
+ * Resolving a FILE path into cwd made spawnSync fail with a bare ENOENT that read
+ * as "Gate 3 failed to run npx tsx" — a tool failure reported under the label of a
+ * code verdict. The file's own directory is the meaningful cwd in that case.
+ */
+function resolveGateCwd(targetPath) {
+  if (!targetPath) return process.cwd();
+  const resolved = path.resolve(targetPath);
+  try {
+    if (fs.statSync(resolved).isFile()) return path.dirname(resolved);
+  } catch {
+    // Nonexistent path: leave it for the gate itself to report.
+  }
+  return resolved;
+}
+
+/**
+ * Resolve how to invoke npx without a shell.
+ *
+ * `shell: true` on Windows looked like the right fix for resolving npx.cmd, but
+ * node passes the argv to CreateProcess as one concatenated string without
+ * escaping (DEP0190) — so any entry path with a backslash or space produced a
+ * malformed command line and spawnSync failed with a bare ENOENT. The gate then
+ * reported FAIL while nothing had actually run: a tool failure wearing the verdict
+ * "your code is broken".
+ *
+ * Calling npx.cmd directly is not the fix either: since the CVE-2024-27980
+ * hardening, node refuses .cmd/.bat from spawnSync without a shell and returns
+ * EINVAL. Running npx's own cli.js with the current node binary sidesteps both —
+ * plain argv, no shell, no batch wrapper.
+ */
+function resolveNpxInvocation(args) {
+  const npxCli = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npx-cli.js');
+  if (fs.existsSync(npxCli)) return [process.execPath, [npxCli, ...args]];
+  return ['npx', args];
+}
+
 function runTsGate(gateModule, targetPath, opts = {}) {
-  const targetCwd = targetPath ? path.resolve(targetPath) : process.cwd();
+  const targetCwd = resolveGateCwd(targetPath);
   const entry = findTsGateEntry(gateModule);
   if (!entry) {
     // Fallback to bash script
@@ -344,10 +385,15 @@ function runTsGate(gateModule, targetPath, opts = {}) {
   // malformed argv, and reports a killed child (timeout, signal) as a null status.
   // All three mean "the gate did not report a verdict", which must not be read as
   // success: a gate that never ran is not a gate that passed.
+  //
+  // spawnSync reports a spawn failure (npx missing) on `error`, throws only on a
+  // malformed argv, and reports a killed child (timeout, signal) as a null status.
+  // All three mean "the gate did not report a verdict", which must not be read as
+  // success: a gate that never ran is not a gate that passed.
+  const [command, commandArgs] = resolveNpxInvocation(args);
   try {
-    const result = spawnSync('npx', args, {
+    const result = spawnSync(command, commandArgs, {
       stdio: 'inherit',
-      shell: process.platform === 'win32',
       cwd: targetCwd,
       timeout: TS_GATE_TIMEOUT_MS,
     });

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T17:29:35.279Z",
+  "checked_at": "2026-10-30T18:23:41.600Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.4",
+  "version": "0.35.6",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.4",
+  "version": "0.35.6",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/lib/delphi-run.d.ts

@@ -19,6 +19,5 @@ export interface ReviewOutcome {
  * plus whatever the caller says was addressed, then re-votes.
  */
 export declare function runReview(opts: DelphiOptions, subject: string, addressed?: string, signal?: AbortSignal): Promise<ReviewOutcome>;
-/** Human-readable transcript for the tool result. */
 export declare function formatOutcome(outcome: ReviewOutcome): string;
 //# sourceMappingURL=delphi-run.d.ts.map

package/plugins/dsh/lib/delphi-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delphi-run.d.ts","sourceRoot":"","sources":["../src/delphi-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAc,WAAW,EAAE,MAAM,aAAa,CAAA;AAoBzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AA0CD;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,SAAK,EACd,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,aAAa,CAAC,CA0CxB;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAiB5D"}
+{"version":3,"file":"delphi-run.d.ts","sourceRoot":"","sources":["../src/delphi-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,aAAa,EAA6B,WAAW,EAAE,MAAM,aAAa,CAAA;AAoBxF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AA0CD;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,SAAK,EACd,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,aAAa,CAAC,CA0CxB;AAoDD,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAe5D"}

package/plugins/dsh/lib/delphi-run.js

@@ -94,15 +94,65 @@ export async function runReview(opts, subject, addressed = "", signal) {
     };
 }
 /** Human-readable transcript for the tool result. */
+/**
+ * Reduce a seat's raw report to the part worth reading (#670).
+ *
+ * The seat was asked for `### Findings` / `### VERDICT` / `### CONFIDENCE`; the
+ * verdict and confidence are already on the tally line above, so repeating them
+ * here only makes the block longer. What the caller cannot get anywhere else is
+ * the Findings table, which is why the report is trimmed down to it.
+ */
+function findingsExcerpt(report) {
+    const text = report.trim();
+    if (text === "")
+        return "";
+    // Split on the section headings the prompt asks for; no regex escaping needed,
+    // which keeps this readable and avoids a silently-mangled character class.
+    const lines = text.split(/\r?\n/);
+    const start = lines.findIndex((line) => /^#{1,3}\s*Findings\s*$/i.test(line));
+    if (start === -1) {
+        // No Findings heading: keep everything before VERDICT rather than returning
+        // nothing on an unexpected format.
+        const stop = lines.findIndex((line) => /^#{1,3}\s*VERDICT/i.test(line));
+        return (stop === -1 ? lines : lines.slice(0, stop)).join("\n").trim();
+    }
+    let end = lines.length;
+    for (let i = start + 1; i < lines.length; i += 1) {
+        if (/^#{1,3}\s*[A-Z]/i.test(lines[i])) {
+            end = i;
+            break;
+        }
+    }
+    return lines.slice(start + 1, end).join("\n").trim();
+}
+/**
+ * One seat's tally line, plus its findings when this is the final round (#670).
+ *
+ * Only the final round expands: printing every round's full report would bury the
+ * conclusion under five historical copies, and what the caller needs is "what is
+ * still wrong", not a transcript.
+ */
+function verdictLines(v, expand) {
+    const model = v.resolvedModel ? `${v.requestedModel} -> ${v.resolvedModel}` : v.requestedModel;
+    const note = v.error ? ` (${v.error})` : "";
+    const lines = [`- [${v.role}] ${v.id} (${model}): ${v.verdict} confidence=${v.confidence}${note}`];
+    if (!expand)
+        return lines;
+    const excerpt = findingsExcerpt(v.report);
+    if (excerpt === "")
+        return lines;
+    for (const line of excerpt.split(/\r?\n/))
+        lines.push(`    ${line}`);
+    return lines;
+}
 export function formatOutcome(outcome) {
     const lines = [];
+    const lastRound = outcome.rounds.length;
     for (const r of outcome.rounds) {
         lines.push(`## Round ${r.round} — approvals ${r.approvals}/${r.validCount} valid`);
-        for (const v of r.verdicts) {
-            const model = v.resolvedModel ? `${v.requestedModel} -> ${v.resolvedModel}` : v.requestedModel;
-            const note = v.error ? ` (${v.error})` : "";
-            lines.push(`- [${v.role}] ${v.id} (${model}): ${v.verdict} confidence=${v.confidence}${note}`);
-        }
+        const expand = r.round === lastRound;
+        for (const v of r.verdicts)
+            lines.push(...verdictLines(v, expand));
         lines.push("");
     }
     lines.push(outcome.consensus

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.4",
+  "version": "0.35.6",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/src/delphi-findings.test.ts

@@ -0,0 +1,109 @@
+import { describe, it, expect } from "vitest"
+import { formatOutcome } from "./delphi-run.js"
+import type { ReviewOutcome } from "./delphi-run.js"
+
+/**
+ * @test REQ-670 delphi 报告必须回传专家意见正文
+ * @intent `formatOutcome` 只回传 verdict 与 confidence，把专家写的
+ *         `### Findings` 表格整块丢掉。调用方拿到的是一串 REQUEST_CHANGES
+ *         加上 0 条具体问题——评审消耗了真实模型调用，产出的却是不可行动的信息。
+ *
+ *         这个 bug 有个特殊之处：**数据一直都在**。`ExpertVerdict.report` 完整
+ *         保留了专家原文，只是呈现层从来没读过它。所以这不是"信息不足"，是
+ *         "攒了信息然后扔掉"——比前者更难发现，因为所有中间层看起来都是对的。
+ *
+ *         修复必须小心一个副作用：报告是多轮匿名评审，专家在后续轮次会看到
+ *         聚合票型。若把每轮全文都打印出来，输出会迅速膨胀到不可读（3 席 × 5 轮
+ *         × 300 字）。所以正文只在**最后一轮**展开，前面各轮仍只给票型——读者
+ *         需要的是"最终为什么不通过"，不是五份历史副本。
+ * @covers AC-670-66, AC-670-67
+ */
+
+const FINDINGS_REPORT =
+  "### Findings\n| ID | Severity | Description | Location | Fix |\n|---|---|---|---|---|\n" +
+  "| F1 | critical | exit code discarded | run.ts:42 | propagate it |\n" +
+  "\n### VERDICT\nREQUEST_CHANGES\n### CONFIDENCE\n9"
+
+const APPROVED_REPORT = "### Findings\nNONE\n\n### VERDICT\nAPPROVED\n### CONFIDENCE\n8"
+
+function verdict(id: string, role: string, report: string, verdictValue: string, confidence: number) {
+  return {
+    id,
+    role,
+    requestedModel: `m-${id}`,
+    resolvedModel: `res-${id}`,
+    verdict: verdictValue as "APPROVED" | "REQUEST_CHANGES",
+    confidence,
+    counted: true,
+    report,
+  }
+}
+
+function outcomeOf(rounds: Array<{ round: number; verdicts: ReturnType<typeof verdict>[] }>): ReviewOutcome {
+  const mapped = rounds.map((r) => ({
+    round: r.round,
+    approvals: r.verdicts.filter((v) => v.verdict === "APPROVED").length,
+    validCount: r.verdicts.length,
+    verdicts: r.verdicts,
+  }))
+  return {
+    rounds: mapped,
+    consensus: false,
+    finalRatio: 0,
+    totalRounds: mapped.length,
+  }
+}
+
+describe("formatOutcome 回传专家意见 (#670)", () => {
+  it("AC-670-66: 最终轮的专家意见正文必须出现在输出里", () => {
+    const out = outcomeOf([
+      {
+        round: 1,
+        verdicts: [
+          verdict("A", "architecture", FINDINGS_REPORT, "REQUEST_CHANGES", 9),
+          verdict("B", "technical", APPROVED_REPORT, "APPROVED", 8),
+        ],
+      },
+    ])
+    const text = formatOutcome(out)
+    // The whole point: a reviewer must be able to read what was wrong.
+    expect(text).toContain("exit code discarded")
+    expect(text).toContain("propagate it")
+    // The verdict/confidence are already on the tally line; the excerpt must not
+    // repeat them, or every seat's block doubles in size.
+    expect(text).not.toContain("### VERDICT")
+  })
+
+  it("AC-670-67: 中间轮次只给票型，不重复整段正文（否则输出不可读）", () => {
+    const out = outcomeOf([
+      {
+        round: 1,
+        verdicts: [verdict("A", "architecture", FINDINGS_REPORT, "REQUEST_CHANGES", 9)],
+      },
+      {
+        round: 2,
+        verdicts: [verdict("A", "architecture", APPROVED_REPORT, "APPROVED", 8)],
+      },
+    ])
+    const text = formatOutcome(out)
+    // The final round approved with NONE, so the earlier rejection's findings are
+    // historical and must not be expanded -- otherwise the reader sees a problem
+    // that was already resolved as if it were still open.
+    const occurrences = text.split("exit code discarded").length - 1
+    expect(occurrences).toBe(0)
+    // But the earlier round's tally line is still there: history is not erased.
+    expect(text).toContain("## Round 1")
+    expect(text).toContain("REQUEST_CHANGES")
+  })
+
+  it("AC-670-66: 报告无 Findings 标题时仍保留正文，而不是整块丢弃", () => {
+    // The original bug's shape was "unrecognized format -> print nothing". A
+    // fallback that also prints nothing would reproduce it under a new input.
+    const freeform = "The suffix resets $? so every gate reads as passing.\n\n### VERDICT\nREQUEST_CHANGES\n### CONFIDENCE\n9"
+    const out = outcomeOf([
+      { round: 1, verdicts: [verdict("A", "architecture", freeform, "REQUEST_CHANGES", 9)] },
+    ])
+    const text = formatOutcome(out)
+    expect(text).toContain("resets $?")
+  })
+})

package/plugins/dsh/src/delphi-run.ts

@@ -11,7 +11,7 @@
 import { TOOL_ABORTED } from "@deepseek-ai/dsh-tools"
 import { HarnessError } from "@deepseek-ai/dsh-llm"
 
-import type { DelphiOptions, ExpertSeat, RoundResult } from "./delphi.js"
+import type { DelphiOptions, ExpertSeat, ExpertVerdict, RoundResult } from "./delphi.js"
 import { runRound } from "./delphi.js"
 
 /**
@@ -132,15 +132,62 @@ export async function runReview(
 }
 
 /** Human-readable transcript for the tool result. */
+/**
+ * Reduce a seat's raw report to the part worth reading (#670).
+ *
+ * The seat was asked for `### Findings` / `### VERDICT` / `### CONFIDENCE`; the
+ * verdict and confidence are already on the tally line above, so repeating them
+ * here only makes the block longer. What the caller cannot get anywhere else is
+ * the Findings table, which is why the report is trimmed down to it.
+ */
+function findingsExcerpt(report: string): string {
+  const text = report.trim()
+  if (text === "") return ""
+  // Split on the section headings the prompt asks for; no regex escaping needed,
+  // which keeps this readable and avoids a silently-mangled character class.
+  const lines = text.split(/\r?\n/)
+  const start = lines.findIndex((line) => /^#{1,3}\s*Findings\s*$/i.test(line))
+  if (start === -1) {
+    // No Findings heading: keep everything before VERDICT rather than returning
+    // nothing on an unexpected format.
+    const stop = lines.findIndex((line) => /^#{1,3}\s*VERDICT/i.test(line))
+    return (stop === -1 ? lines : lines.slice(0, stop)).join("\n").trim()
+  }
+  let end = lines.length
+  for (let i = start + 1; i < lines.length; i += 1) {
+    if (/^#{1,3}\s*[A-Z]/i.test(lines[i])) {
+      end = i
+      break
+    }
+  }
+  return lines.slice(start + 1, end).join("\n").trim()
+}
+
+/**
+ * One seat's tally line, plus its findings when this is the final round (#670).
+ *
+ * Only the final round expands: printing every round's full report would bury the
+ * conclusion under five historical copies, and what the caller needs is "what is
+ * still wrong", not a transcript.
+ */
+function verdictLines(v: ExpertVerdict, expand: boolean): string[] {
+  const model = v.resolvedModel ? `${v.requestedModel} -> ${v.resolvedModel}` : v.requestedModel
+  const note = v.error ? ` (${v.error})` : ""
+  const lines = [`- [${v.role}] ${v.id} (${model}): ${v.verdict} confidence=${v.confidence}${note}`]
+  if (!expand) return lines
+  const excerpt = findingsExcerpt(v.report)
+  if (excerpt === "") return lines
+  for (const line of excerpt.split(/\r?\n/)) lines.push(`    ${line}`)
+  return lines
+}
+
 export function formatOutcome(outcome: ReviewOutcome): string {
   const lines: string[] = []
+  const lastRound = outcome.rounds.length
   for (const r of outcome.rounds) {
     lines.push(`## Round ${r.round} — approvals ${r.approvals}/${r.validCount} valid`)
-    for (const v of r.verdicts) {
-      const model = v.resolvedModel ? `${v.requestedModel} -> ${v.resolvedModel}` : v.requestedModel
-      const note = v.error ? ` (${v.error})` : ""
-      lines.push(`- [${v.role}] ${v.id} (${model}): ${v.verdict} confidence=${v.confidence}${note}`)
-    }
+    const expand = r.round === lastRound
+    for (const v of r.verdicts) lines.push(...verdictLines(v, expand))
     lines.push("")
   }
   lines.push(

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.4",
+  "version": "0.35.6",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.4",
+  "version": "0.35.6",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** aefe7f40
+**Commit:** 35df3831
 **Branch:** main
-**Version:** 0.35.4.0
+**Version:** 0.35.6.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.