@boyingliu01/xp-gate 0.35.6 → 0.35.7

package/bin/xp-gate.js

@@ -365,6 +365,21 @@ const COMMANDS = {
     },
     usage: 'xp-gate gate-coverage [--json] [--debt] [--strict] [--branch <name>]'
   },
+  'gate-rules': {
+    description: 'Print the gate limits that can block a commit, generated from the files that define them (#652)',
+    run: subargs => {
+      const { collectGateRules, renderGateRules } = require('../lib/gate-rules.js');
+      const rules = collectGateRules({ cwd: process.cwd() });
+      if (subargs.includes('--json')) {
+        process.stdout.write(`${JSON.stringify(rules, null, 2)}\n`);
+        return;
+      }
+      // Generated, never hand-copied: a checklist that drifts from the config it
+      // describes teaches the wrong rule and then contradicts it at commit time.
+      process.stdout.write(`${renderGateRules(rules)}\n`);
+    },
+    usage: 'xp-gate gate-rules [--json]'
+  },
   'rework': {
     description: 'Report rework: first-pass rate, rounds before landing, top blocking reasons (#651)',
     run: subargs => {
@@ -673,15 +688,60 @@ function handleAudit(args) {
     return;
   }
 
+  // #668: pre-existing assertion debt, so it can be cleared in batches instead of
+  // being discovered one unrelated commit at a time.
+  if (args[0] === 'assertions') {
+    handleAuditAssertions(args);
+    return;
+  }
+
   console.error('Error: Unknown audit subcommand or missing flag');
   console.error('Usage:');
   console.error('  xp-gate audit record --gate-id X --gate-name Y --passed true/false --issues-found N --duration-ms N --trigger commit');
   console.error('  xp-gate audit --tail [N]     (default: 20)');
   console.error('  xp-gate audit --stats        (per-gate stats + anomaly summary)');
   console.error('  xp-gate audit --check        (exit 1 if the ledger has anomalies)');
+  console.error('  xp-gate audit assertions     (list pre-existing assertion debt across the repo; --json)');
   process.exit(1);
 }
 
+/**
+ * `xp-gate audit assertions` (#668) — list pre-existing vacuous assertions.
+ *
+ * Gate 5d only inspects files in the diff, so standing debt surfaces during
+ * unrelated commits and reads as if that change introduced it. This makes the debt
+ * a work queue instead of a series of false accusations.
+ *
+ * Advisory: always exits 0. A debt list that fails builds becomes a number people
+ * learn to ignore.
+ */
+function handleAuditAssertions(args) {
+  const { scanForAssertionDebt, summarizeDebt } = require(path.join(__dirname, '..', 'lib', 'assertion-debt.js'));
+  const results = scanForAssertionDebt({ cwd: process.cwd() });
+  const summary = summarizeDebt(results);
+  if (args.includes('--json')) {
+    process.stdout.write(`${JSON.stringify({ summary, files: results }, null, 2)}\n`);
+    return;
+  }
+  if (summary.total === 0) {
+    console.log('✅ No pre-existing assertion debt found.');
+    return;
+  }
+  console.log(`Found ${summary.total} pre-existing assertion issue(s) in ${summary.files} file(s):`);
+  console.log(`  tautological   ${summary.byKind.tautological}`);
+  console.log(`  swallowed-error ${summary.byKind['swallowed-error']}`);
+  console.log('');
+  for (const entry of results) {
+    console.log(`${entry.file}  (${entry.findings.length})`);
+    for (const finding of entry.findings) {
+      console.log(`  ${finding.line}: [${finding.kind}] ${finding.text}`);
+    }
+  }
+  console.log('');
+  console.log('These predate the current diff and would be reported as "introduced by this change"');
+  console.log('if the file is touched. See skills/test-driven-development/testing-anti-patterns.md');
+}
+
 function printAuditTable(entries) {
   console.log('');
   console.log('Recent Audit Entries:');

package/hooks/lib/assertion-quality.sh

@@ -178,6 +178,53 @@ classify_swallowed_errors() {
   grep -nE 'catch([[:space:]]*\([^)]*\))?[[:space:]]*\{[[:space:]]*\}' || true
 }
 
+# #668: is the flagged line part of THIS change, or merely carried in by the file?
+#
+# Gate 5d runs over whole files, so a file that was edited anywhere gets all of its
+# assertions re-examined. Pre-existing debt then blocks an unrelated commit and
+# reads as "this change introduced it". The author who fixed `writeReport()`'s error
+# handling was stopped by four `expect(true).toBe(true)` lines that had been there
+# for months.
+#
+# The cost is not the one false block. It is that the noise teaches people to add
+# `@assertion-justified` rather than fix the test -- a gate that trains people to
+# annotate past it is worse than no gate.
+#
+# Args: $1 = file path, $2 = line number, $3 = added-line ranges ("start-end start-end")
+# Returns 0 when the line is inside an added hunk (i.e. genuinely introduced here).
+assertion_line_is_new() {
+  local _aq_file="$1" _aq_line="$2" _aq_ranges="$3"
+  local _aq_range _aq_start _aq_end
+  for _aq_range in $_aq_ranges; do
+    _aq_start="${_aq_range%%-*}"
+    _aq_end="${_aq_range##*-}"
+    if [ "$_aq_line" -ge "$_aq_start" ] 2>/dev/null && [ "$_aq_line" -le "$_aq_end" ] 2>/dev/null; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Emit "start-end" for each added hunk in the staged diff of $1.
+# Empty output means the file has no added lines at all, in which case every finding
+# is pre-existing by construction.
+staged_added_line_ranges() {
+  local _aq_file="$1"
+  git diff --cached -U0 -- "$_aq_file" 2>/dev/null \
+    | awk '
+        /^@@/ {
+          # @@ -a,b +c,d @@ -- the +side is the new-file line numbering.
+          if (match($0, /\+[0-9]+(,[0-9]+)?/)) {
+            spec = substr($0, RSTART + 1, RLENGTH - 1)
+            n = split(spec, parts, ",")
+            start = parts[1] + 0
+            count = (n > 1) ? parts[2] + 0 : 1
+            if (count > 0) printf "%d-%d ", start, start + count - 1
+          }
+        }
+      ' || true
+}
+
 # Anti-patterns 3-5 (WARNING tier): weak-only assertions, mock-echo assertions, and
 # call-order over-verification. These can be legitimate, so each is reported but
 # never blocks.

package/hooks/pre-commit

@@ -2395,17 +2395,63 @@ else
             _tauto=$(printf '%s\n' "$_tf_content" | classify_tautological_assertions || true)
             _swallow=$(printf '%s\n' "$_tf_content" | classify_swallowed_errors || true)
             _weak=$(printf '%s\n' "$_tf_content" | classify_weak_assertions || true)
+            # #668: split the findings into "added by this change" and
+            # "pre-existing". Gate 5d examines whole files, so editing a file
+            # anywhere re-examines all of its assertions; presenting standing debt
+            # under an unrelated commit is a false attribution, and false
+            # attribution is what drives people to @assertion-justified instead of
+            # a real fix.
+            _new_ranges=$(staged_added_line_ranges "$_tf" 2>/dev/null || true)
             if [ -n "$_tauto" ]; then
-              echo "❌ BLOCKED - tautological assertion(s) in $_tf (cannot fail):"
-              printf '%s\n' "$_tauto" | sed 's/^/     /'
-              echo "     See skills/test-driven-development/testing-anti-patterns.md"
-              GATE_5_FOCUS_BLOCKED=$((GATE_5_FOCUS_BLOCKED + 1))
+              _tauto_new=""
+              _tauto_old=""
+              while IFS= read -r _tline; do
+                [ -n "$_tline" ] || continue
+                _tnum="${_tline%%:*}"
+                if assertion_line_is_new "$_tf" "$_tnum" "$_new_ranges"; then
+                  _tauto_new="${_tauto_new}${_tline}"$'\n'
+                else
+                  _tauto_old="${_tauto_old}${_tline}"$'\n'
+                fi
+              done <<< "$_tauto"
+              if [ -n "$_tauto_new" ]; then
+                echo "❌ BLOCKED - tautological assertion(s) added by this change in $_tf (cannot fail):"
+                printf '%s' "$_tauto_new" | sed 's/^/     /'
+                echo "     See skills/test-driven-development/testing-anti-patterns.md"
+                GATE_5_FOCUS_BLOCKED=$((GATE_5_FOCUS_BLOCKED + 1))
+              fi
+              if [ -n "$_tauto_old" ]; then
+                echo "⚠️  WARN - PRE-EXISTING tautological assertion(s) in $_tf (NOT introduced by this change):"
+                printf '%s' "$_tauto_old" | sed 's/^/     /'
+                echo "     These predate this commit. Two options:"
+                echo "       fix them now (see 'xp-gate audit assertions'), or"
+                echo "       leave them - they are not blocking you."
+              fi
             fi
             if [ -n "$_swallow" ]; then
-              echo "❌ BLOCKED - empty catch in $_tf swallows the failure it guards:"
-              printf '%s\n' "$_swallow" | sed 's/^/     /'
-              echo "     See skills/test-driven-development/testing-anti-patterns.md"
-              GATE_5_FOCUS_BLOCKED=$((GATE_5_FOCUS_BLOCKED + 1))
+              # Same #668 split as the tautology branch above.
+              _sw_new=""
+              _sw_old=""
+              while IFS= read -r _sline; do
+                [ -n "$_sline" ] || continue
+                _snum="${_sline%%:*}"
+                if assertion_line_is_new "$_tf" "$_snum" "$_new_ranges"; then
+                  _sw_new="${_sw_new}${_sline}"$'\n'
+                else
+                  _sw_old="${_sw_old}${_sline}"$'\n'
+                fi
+              done <<< "$_swallow"
+              if [ -n "$_sw_new" ]; then
+                echo "❌ BLOCKED - empty catch added by this change in $_tf swallows the failure it guards:"
+                printf '%s' "$_sw_new" | sed 's/^/     /'
+                echo "     See skills/test-driven-development/testing-anti-patterns.md"
+                GATE_5_FOCUS_BLOCKED=$((GATE_5_FOCUS_BLOCKED + 1))
+              fi
+              if [ -n "$_sw_old" ]; then
+                echo "⚠️  WARN - PRE-EXISTING empty catch(es) in $_tf (NOT introduced by this change):"
+                printf '%s' "$_sw_old" | sed 's/^/     /'
+                echo "     These predate this commit; see 'xp-gate audit assertions'."
+              fi
             fi
             if [ -n "$_weak" ]; then
               echo "⚠️  WARN - test block(s) in $_tf assert only weak properties:"

package/lib/__tests__/assertion-debt.test.js

@@ -0,0 +1,99 @@
+/**
+ * @test REQ-668 `xp-gate audit assertions` 必须让存量断言债务可见
+ * @intent Gate 5d 只检查 **diff 范围内** 的文件。这是有意的——全仓扫描每次提交都跑
+ *         太慢——但它有个昂贵的副作用：存量债务会在 **无关改动** 时突然阻断，
+ *         制造错误的因果归因。原作者改了 `writeReport()` 的错误处理，却被
+ *         `test-alignment.test.ts` 里 4 处既有的 `expect(true).toBe(true)` 拦下。
+ *
+ *         这个副作用最坏的后果不是那一次误阻断，而是它改变修复者的行为：归因噪音
+ *         让人以为"先绕过再说"，于是倾向加 `@assertion-justified` 而不是真修掉。
+ *         一个让人更愿意豁免的门禁，比没有门禁更糟。
+ *
+ *         所以 `audit assertions` 的价值在于把"存量"变成可批处理的工作队列，
+ *         而不是让人在无关提交里逐个撞见。
+ * @covers AC-668-01, AC-668-02, AC-668-03
+ */
+'use strict';
+
+const { scanForAssertionDebt, summarizeDebt } = require('../assertion-debt');
+
+describe('xp-gate audit assertions (#668)', () => {
+  it('AC-668-01: 列出全仓存量问题，按文件分组', () => {
+    const results = scanForAssertionDebt({ cwd: process.cwd() });
+    expect(Array.isArray(results)).toBe(true);
+    // Grouped by file so a batch fixer can work one file at a time.
+    for (const entry of results) {
+      expect(typeof entry.file).toBe('string');
+      expect(Array.isArray(entry.findings)).toBe(true);
+      for (const f of entry.findings) {
+        expect(typeof f.line).toBe('number');
+        expect(['tautological', 'swallowed-error']).toContain(f.kind);
+        expect(typeof f.text).toBe('string');
+      }
+    }
+  });
+
+  it('AC-668-02: 识别两类确定性 vacuous 形态', () => {
+    // These are the two shapes Gate 5d blocks. Both are the ABSENCE of an assertion
+    // wearing assertion syntax, which is why they are the ones worth a debt list.
+    const fixture = [
+      'test("a", () => {',
+      '  expect(true).toBe(true);',
+      '  try { go(); } catch {}',
+      '});',
+      'test("b", () => {',
+      '  expect(x).toBe(1);',
+      '});',
+    ].join('\n');
+    const findings = scanForAssertionDebt({ source: fixture, file: 'fixture.test.ts' });
+    const flat = findings.flatMap((f) => f.findings);
+    expect(flat.some((f) => f.kind === 'tautological')).toBe(true);
+    expect(flat.some((f) => f.kind === 'swallowed-error')).toBe(true);
+    // A real assertion must not be reported -- a debt list that flags `expect(x).toBe(1)`
+    // is a list nobody finishes.
+    const realLine = flat.find((f) => f.text.includes('expect(x).toBe(1)'));
+    expect(realLine).toBeUndefined();
+  });
+
+  it('AC-668-03: 摘要给出可批次清零的数量，而非只是行数', () => {
+    const fixture = ['expect(true).toBe(true);', 'expect(1).toBe(1);', 'try { x(); } catch {}'].join('\n');
+    const results = scanForAssertionDebt({ source: fixture, file: 'a.test.ts' });
+    const summary = summarizeDebt(results);
+    expect(summary.files).toBe(1);
+    expect(summary.total).toBe(3);
+    // Two tautologies and one empty catch: the split matters because they are fixed
+    // by different edits (rewrite the assertion vs. handle the error).
+    expect(summary.byKind.tautological).toBe(2);
+    expect(summary.byKind['swallowed-error']).toBe(1);
+  });
+});
+
+/**
+ * @test REQ-668 fixture 不能被当作存量债务
+ * @intent 这条测试防的是一个**修债务反而删掉测试覆盖**的失败模式。
+ *
+ *         测试 Gate 5d 分类器的那批 .bats / .test.ts 文件必然包含
+ *         `'expect(true).toBe(true);'` —— 那是被校验的**输入**，不是断言。
+ *         若它们被列进"去修掉"的清单，执行清单的人会删掉钉住分类器行为的字符串，
+ *         于是债务清单本身成了覆盖率的破坏者。
+ *
+ *         反例同样重要：真正的裸断言 `expect(true).toBe(true);` 必须仍然被报出来。
+ *         只做"少报"很容易，难的是**同时**不误报也不漏报。
+ * @covers AC-668-04
+ */
+describe('fixture 与真实断言的区分 (#668)', () => {
+  it('AC-668-04: 带引号的 fixture 不报，裸断言照报', () => {
+    const { classifyLine } = require('../assertion-debt');
+    // Real code: must be reported.
+    expect(classifyLine('expect(true).toBe(true);')).toBe('tautological');
+    expect(classifyLine('    expect(1).toBe(1);')).toBe('tautological');
+    expect(classifyLine('try { x(); } catch {}')).toBe('swallowed-error');
+    // Fixture inputs: must not be reported.
+    expect(classifyLine("'    expect(true).toBe(true);',")).toBeNull();
+    expect(classifyLine('const s = "expect(true).toBe(true)";')).toBeNull();
+    // Neither is debt.
+    expect(classifyLine('// expect(true).toBe(true);')).toBeNull();
+    expect(classifyLine('expect(x).toBe(1);')).toBeNull();
+    expect(classifyLine('expect(value).toBeTruthy();')).toBeNull();
+  });
+});

package/lib/__tests__/gate-rules.test.js

@@ -0,0 +1,58 @@
+/**
+ * @test REQ-652 BUILD 阶段的门禁清单必须从真相源生成，而非手抄
+ * @intent #652 的实证是：BUILD 阶段生成代码时，模型对 Boy Scout / CCN / jscpd /
+ *         archlint 完全不可知——不是"知道却不遵守"，是**根本不知道规则存在**。
+ *         后果是 27% 的门禁失败属于静态规则违规，即唯一 100% 可在生成前规避的类别。
+ *
+ *         补一页手写的阈值表能解决今天的问题，但会制造明天的问题：`.principlesrc`
+ *         里 `long-function` 是 50、`deep-nesting` 是 4，一旦有人调成 60/5，那一页
+ *         手抄的表就开始说谎。**一个说谎的自检清单比没有清单更糟**——它会让人按错的
+ *         规则写代码，然后在提交时被告知另一套。
+ *
+ *         所以这个清单必须从配置文件生成。真相源有几个就在几个里读，不复制。
+ * @covers AC-652-01, AC-652-02, AC-652-03
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { collectGateRules } = require('../gate-rules');
+
+const REPO = path.join(__dirname, '..', '..', '..', '..');
+
+describe('BUILD 阶段门禁清单 (#652)', () => {
+  it('AC-652-01: 从 .principlesrc 读出真实阈值，不是写死的数字', () => {
+    const rules = collectGateRules({ cwd: REPO });
+    const longFn = rules.find((r) => r.id === 'clean-code.long-function');
+    const nesting = rules.find((r) => r.id === 'clean-code.deep-nesting');
+    expect(longFn).toBeDefined();
+    expect(nesting).toBeDefined();
+    // The value must come from the config file. Reading .principlesrc here keeps the
+    // test honest: if the config changes and the generator does not follow, this fails.
+    const cfg = JSON.parse(fs.readFileSync(path.join(REPO, '.principlesrc'), 'utf8'));
+    expect(longFn.threshold).toBe(cfg.rules['clean-code']['long-function'].threshold);
+    expect(nesting.threshold).toBe(cfg.rules['clean-code']['deep-nesting'].threshold);
+  });
+
+  it('AC-652-02: 覆盖会阻断提交的每一类规则，而不只是 principles', () => {
+    const rules = collectGateRules({ cwd: REPO });
+    const sources = new Set(rules.map((r) => r.source));
+    // #652 named exactly these four as absent from BUILD docs.
+    for (const required of ['principles', 'ccn', 'jscpd', 'boy-scout']) {
+      expect(sources).toContain(required);
+    }
+  });
+
+  it('AC-652-03: 生成结果可渲染成一份自检清单，含阈值与出处', () => {
+    const rules = collectGateRules({ cwd: REPO });
+    for (const rule of rules) {
+      expect(typeof rule.id).toBe('string');
+      expect(typeof rule.source).toBe('string');
+      // Without the evidence pointer, "the threshold is 50" cannot be checked or
+      // argued with -- it is indistinguishable from a guess.
+      expect(typeof rule.evidence).toBe('string');
+      expect(rule.evidence).not.toBe('');
+      expect(['block', 'warn', 'info']).toContain(rule.severity);
+    }
+  });
+});

package/lib/assertion-debt.js

@@ -0,0 +1,173 @@
+/**
+ * `xp-gate audit assertions` — make pre-existing assertion debt visible (#668).
+ *
+ * Gate 5d deliberately checks only the files in the diff: a full-repo scan on
+ * every commit is too slow. That has an expensive side effect. Pre-existing debt
+ * blocks unrelated changes — the author who fixed `writeReport()`'s error handling
+ * was stopped by four long-standing `expect(true).toBe(true)` lines in a file they
+ * had merely touched — and the block reads as "this change introduced a problem".
+ *
+ * The worst consequence is not that one false attribution. It is what it does to
+ * behaviour: noise in the attribution makes people reach for
+ * `@assertion-justified` instead of fixing the test. A gate that teaches people to
+ * annotate their way past it is worse than no gate. Hence a batch work queue.
+ *
+ * Scope: only the two shapes Gate 5d BLOCKS (tautological, empty catch). Weak-only
+ * assertions and mock echoes WARN there because each can be legitimate; putting them
+ * in a "debt to clear" list would invent work.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/** Directories that never contain hand-written assertions worth auditing. */
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  'coverage',
+  '.stryker-tmp',
+  '.agent-tmp',
+  // Build output mirrored from src/ — listing it again would double-count debt and
+  // send a batch fixer to a file that regenerates.
+  '.xp-gate',
+]);
+
+/** Test-file patterns across the ecosystems XP-Gate supports. */
+function isTestFile(name) {
+  return (
+    /\.(test|spec)\.[cm]?[jt]sx?$/.test(name) ||
+    /(^|\/)(__tests__)\//.test(name) ||
+    /\.test\.bats$/.test(name) ||
+    /^test_.*\.py$/.test(name) ||
+    /_test\.(go|rs|py)$/.test(name)
+  );
+}
+
+/**
+ * Tautological assertions: the assertion cannot fail.
+ *
+ * Mirrors `classify_tautological_assertions` in githooks/lib/assertion-quality.sh.
+ * The two implementations must agree, because a debt list that disagrees with the
+ * gate it exists to serve sends people to fix lines that are not blocking and miss
+ * the ones that are.
+ */
+const TAUTOLOGY_PATTERNS = [
+  // (a) identical literal on both sides.
+  {
+    re: /expect\s*\(\s*(true|false|null|undefined|-?\d+|"[^"]*"|'[^']*')\s*\)\s*\.\s*to(?:Be|Equal|StrictEqual)\s*\(\s*\1\s*\)/,
+  },
+  // (b) a literal tested against the truthiness it already has.
+  { re: /expect\s*\(\s*(?:true|1|-1|"[^"]+"|'[^']+')\s*\)\s*\.\s*toBeTruthy\s*\(/ },
+  { re: /expect\s*\(\s*(?:false|0|null|undefined|""|'')\s*\)\s*\.\s*toBeFalsy\s*\(/ },
+];
+
+/** An empty catch body: the failure it guards is discarded. */
+const EMPTY_CATCH_RE = /catch\s*(?:\([^)]*\))?\s*\{\s*\}/;
+
+/**
+ * Is this line a fixture rather than a real assertion?
+ *
+ * A `.bats` test that exercises the Gate 5d classifier necessarily contains
+ * `'expect(true).toBe(true);'` as a quoted INPUT. Reporting it as debt would send a
+ * batch fixer to delete the very strings that pin the classifier — turning the
+ * "fix debt" instruction into an instruction to remove test coverage.
+ *
+ * The distinguishing feature is quoting: in a fixture the shape is wrapped in
+ * quotes and usually sits inside a list/assignment, where a real assertion is bare
+ * executable code.
+ */
+function isFixtureLine(trimmed) {
+  // A leading quote before the assertion shape: `'expect(...)...'` or "expect(...)".
+  if (/^['"`]/.test(trimmed)) return true;
+  // Assertion shape appearing inside a quoted string on the line.
+  if (/['"][^'"`]*expect\s*\(/.test(trimmed)) return true;
+  return false;
+}
+
+/** Classify one source line, or null when it is fine. */
+function classifyLine(text) {
+  const trimmed = text.trim();
+  if (trimmed === '') return null;
+  // A commented-out assertion is not an assertion.
+  if (/^(\/\/|\*|\/\*|#)/.test(trimmed)) return null;
+  if (isFixtureLine(trimmed)) return null;
+  for (const { re } of TAUTOLOGY_PATTERNS) {
+    if (re.test(trimmed)) return 'tautological';
+  }
+  if (EMPTY_CATCH_RE.test(trimmed)) return 'swallowed-error';
+  return null;
+}
+
+/** Find debt in one file's text. */
+function scanSource(text, file) {
+  const findings = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const kind = classifyLine(lines[i]);
+    if (kind) findings.push({ line: i + 1, kind, text: lines[i].trim() });
+  }
+  return findings.length > 0 ? [{ file, findings }] : [];
+}
+
+/** Walk the tree collecting test files, bounded to avoid node_modules. */
+function listTestFiles(root, out = []) {
+  let entries;
+  try {
+    entries = fs.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  if (!Array.isArray(entries)) return out;
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue;
+      listTestFiles(path.join(root, entry.name), out);
+      continue;
+    }
+    if (isTestFile(entry.name)) out.push(path.join(root, entry.name));
+  }
+  return out;
+}
+
+/**
+ * Scan for assertion debt.
+ *
+ * @param {{cwd?: string, source?: string, file?: string}} opts
+ * @returns {Array<{file: string, findings: Array<{line: number, kind: string, text: string}>}>}
+ */
+function scanForAssertionDebt(opts = {}) {
+  if (typeof opts.source === 'string') {
+    return scanSource(opts.source, opts.file || '<inline>');
+  }
+  const root = opts.cwd || process.cwd();
+  const results = [];
+  for (const abs of listTestFiles(root)) {
+    let text;
+    try {
+      text = fs.readFileSync(abs, 'utf8');
+    } catch {
+      continue;
+    }
+    const rel = path.relative(root, abs).split(path.sep).join('/');
+    results.push(...scanSource(text, rel));
+  }
+  return results.sort((a, b) => b.findings.length - a.findings.length || a.file.localeCompare(b.file));
+}
+
+/** Totals for a debt run: per-kind counts plus the file count to batch over. */
+function summarizeDebt(results) {
+  const byKind = { tautological: 0, 'swallowed-error': 0 };
+  let total = 0;
+  for (const entry of results) {
+    for (const finding of entry.findings) {
+      byKind[finding.kind] = (byKind[finding.kind] || 0) + 1;
+      total += 1;
+    }
+  }
+  return { files: results.length, total, byKind };
+}
+
+module.exports = { classifyLine, scanForAssertionDebt, summarizeDebt, isTestFile };

package/lib/gate-rules.js

@@ -0,0 +1,149 @@
+/**
+ * Collect the gate thresholds that actually block a commit, from the files that
+ * define them (#652).
+ *
+ * Why generated rather than hand-written: BUILD-phase docs used to say "there are
+ * gates 0-11" without saying what the numbers are. The numbers live in
+ * `.principlesrc`, `jscpd.conf.json`, `.ccn-baseline.json` and the hook itself. A
+ * hand-copied table is correct on the day it is written and wrong on the day
+ * someone tunes a threshold — and a self-check list that lies is worse than none,
+ * because it teaches the wrong rule and then contradicts it at commit time.
+ *
+ * Every rule therefore carries an `evidence` pointer, so "the limit is 50" can be
+ * checked or argued with instead of being indistinguishable from a guess.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/** Read and parse a JSON file, or null when absent/unreadable. */
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Normalise severity spellings.
+ *
+ * The config files and the hook do not agree: `.principlesrc` says `warning`,
+ * Gate 3's boundary is `warn`, and both mean the same thing. Carrying two spellings
+ * into one list would make it look like two different severities exist.
+ */
+function normaliseSeverity(value) {
+  if (value === 'warning') return 'warn';
+  if (value === 'block' || value === 'warn' || value === 'info') return value;
+  return 'warn';
+}
+
+/** Flatten `.principlesrc` rules into entries with source + evidence. */
+function principlesRules(cwd) {
+  const file = path.join(cwd, '.principlesrc');
+  const cfg = readJson(file);
+  if (!cfg || !cfg.rules) return [];
+  const out = [];
+  for (const group of Object.keys(cfg.rules)) {
+    for (const [name, rule] of Object.entries(cfg.rules[group] || {})) {
+      out.push({
+        id: `${group}.${name}`,
+        source: 'principles',
+        severity: normaliseSeverity(rule.severity),
+        // Not every rule is threshold-shaped (e.g. unused-imports); report the
+        // one that exists rather than inventing a 0.
+        threshold: typeof rule.threshold === 'number' ? rule.threshold : null,
+        evidence: '.principlesrc',
+      });
+    }
+  }
+  return out;
+}
+
+/**
+ * Gate 2's duplicate-code rule.
+ *
+ * `githooks/pre-commit` prints "jscpd found duplicated code (warning, not blocking
+ * by default)" -- this gate reports, it does not block. The BUILD-phase doc used to
+ * claim "jscpd similarity >5% BLOCK", which sent people to refactor for a verdict
+ * that never fires. A generated list must record what the hook does, not what the
+ * old prose said.
+ */
+function jscpdRules(cwd) {
+  const cfg = readJson(path.join(cwd, 'jscpd.conf.json'));
+  // jscpd itself has no similarity threshold in this project's config and the hook
+  // never compares a percentage. Reporting null says "no limit declared" instead of
+  // inventing a number the hook does not enforce.
+  const threshold = cfg && typeof cfg.threshold === 'number' ? cfg.threshold : null;
+  return [
+    {
+      id: 'duplication.jscpd',
+      source: 'jscpd',
+      severity: 'info',
+      threshold,
+      evidence: 'githooks/pre-commit (Gate 2, advisory)',
+    },
+  ];
+}
+
+/** Gate 3 warn/block boundaries, which the hook itself owns. */
+function ccnRules(cwd) {
+  return [
+    { id: 'ccn.warn', source: 'ccn', severity: 'warn', threshold: 5, evidence: 'githooks/pre-commit (Gate 3)' },
+    { id: 'ccn.block', source: 'ccn', severity: 'block', threshold: 10, evidence: 'githooks/pre-commit (Gate 3)' },
+  ];
+}
+
+/** Boy Scout's structural limits, read from wherever they are configured. */
+function boyScoutRules(cwd) {
+  const out = [
+    {
+      id: 'boy-scout.new-file',
+      source: 'boy-scout',
+      severity: 'block',
+      threshold: 0,
+      evidence: 'src/principles/boy-scout.ts',
+    },
+  ];
+  // The per-function line and nesting limits are principles rules; when
+  // .principlesrc exists they are already listed by principlesRules, so only add
+  // here when it does not (so the BUILD list never silently loses them).
+  const cfg = readJson(path.join(cwd, '.principlesrc'));
+  if (!cfg || !cfg.rules || !cfg.rules['clean-code']) {
+    out.push(
+      { id: 'clean-code.long-function', source: 'boy-scout', severity: 'warn', threshold: 50, evidence: 'defaults' },
+      { id: 'clean-code.deep-nesting', source: 'boy-scout', severity: 'warn', threshold: 4, evidence: 'defaults' },
+    );
+  }
+  return out;
+}
+
+/**
+ * Collect every rule that can block or warn a commit.
+ *
+ * @param {{cwd?: string}} opts
+ * @returns {Array<{id: string, source: string, severity: string, threshold: number|null, evidence: string}>}
+ */
+function collectGateRules(opts = {}) {
+  const cwd = opts.cwd || process.cwd();
+  const rules = [...principlesRules(cwd), ...jscpdRules(cwd), ...ccnRules(cwd), ...boyScoutRules(cwd)];
+  // Stable order: blocking first, then warn/info, so a reader stops at what hurts.
+  const rank = { block: 0, warn: 1, info: 2 };
+  return rules.sort(
+    (a, b) => (rank[a.severity] ?? 3) - (rank[b.severity] ?? 3) || a.id.localeCompare(b.id),
+  );
+}
+
+/** Render the checklist as markdown with an evidence column. */
+function renderGateRules(rules) {
+  const lines = ['| Rule | Severity | Limit | Evidence |', '|---|---|---|---|'];
+  for (const rule of rules) {
+    lines.push(
+      `| \`${rule.id}\` | ${rule.severity} | ${rule.threshold === null ? '—' : rule.threshold} | \`${rule.evidence}\` |`,
+    );
+  }
+  return lines.join('\n');
+}
+
+module.exports = { collectGateRules, renderGateRules };

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T18:23:41.600Z",
+  "checked_at": "2026-10-30T18:41:08.730Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.6",
+  "version": "0.35.7",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.6",
+  "version": "0.35.7",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/sprint-flow/references/phase-3-build.md

@@ -34,12 +34,25 @@
 |---|------|------------------------------|----------|
 | 1 | **Gate 3 CCN** | 单函数圈复杂度 **>10 BLOCK**、**>5 WARN** | 拆函数 / 早返回 / 抽策略表；`xp-gate check 3 <file>` |
 | 2 | **Gate 6 Boy Scout** | **新文件 0 warning**；修改文件 warning 数不得高于 `.warnings-baseline.json`；**单函数 ≤50 行**；**嵌套 ≤4 层** | 新文件当"零容忍"写；改动前 `xp-gate check 6` 看基线 |
-| 3 | **Gate 2 重复代码** | jscpd 相似度 **>5% BLOCK** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
+| 3 | **Gate 2 重复代码** | jscpd 报告重复**仅提示，不阻断** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
 | 4 | **Gate 4 Principles** | 14 条 Clean Code/SOLID 规则，任一 error/warning 即拦（按 `.principlesrc`） | `xp-gate check 4 <file>`；避免超长参数表、空 catch、`as any` |
 | 5 | **Gate 1 Lint** | 适配器 lint 任一 error | 提交前跑一次项目 lint；不要留未用变量/导入 |
 | 6 | **Gate 5 测试** | 测试全绿 + 覆盖率 ≥80%（新 .ts/.tsx 无测试直接 BLOCK） | 新代码先写测试（TDD）；`npx vitest run <file>` |
 | 7 | **mirror/sync 纪律** | 改 `githooks/` 或 `skills/` 后必须 `node src/npm-package/scripts/sync-package-content.js --fix` 且 `bash scripts/check-hook-mirror.sh` 报 PASS | 忘了同步会在 pre-push 的 mirror 校验被打回 |
 
+**权威清单用 `xp-gate gate-rules` 现取，不要背上面这张表。** 上表是手抄的,阈值真正定义在
+`.principlesrc`、`jscpd.conf.json` 和 `githooks/pre-commit` 里。`xp-gate gate-rules` 从那些
+文件生成一份带**出处**的清单:
+
+```bash
+xp-gate gate-rules          # markdown 表:规则 / 严重度 / 阈值 / 出处
+xp-gate gate-rules --json   # 机器可读
+```
+
+为什么必须生成而不是手写:这张表原本写"jscpd 相似度 >5% BLOCK",而 Gate 2 实际只是提示、
+从不阻断——有人会去为一个永不触发的裁定重构代码。**一个说谎的自检清单比没有清单更糟**,
+它会让人按错误规则写,然后在提交时被告知另一套。改阈值时只需改配置,清单自动跟上。
+
 **一条命令抢先看**：`xp-gate check . --changed --brief` 只跑"本次 diff 会触发的门禁"，
 一屏出 PASS/SKIP/BLOCK，目标 <5 s。把它放在 ralph-loop 每个 REQ 的 step 0，先看红不红，
 再决定是否继续写——而不是写到一半才被 `git commit` 拦下。

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.6",
+  "version": "0.35.7",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/sprint-flow/references/phase-3-build.md

@@ -34,12 +34,25 @@
 |---|------|------------------------------|----------|
 | 1 | **Gate 3 CCN** | 单函数圈复杂度 **>10 BLOCK**、**>5 WARN** | 拆函数 / 早返回 / 抽策略表；`xp-gate check 3 <file>` |
 | 2 | **Gate 6 Boy Scout** | **新文件 0 warning**；修改文件 warning 数不得高于 `.warnings-baseline.json`；**单函数 ≤50 行**；**嵌套 ≤4 层** | 新文件当"零容忍"写；改动前 `xp-gate check 6` 看基线 |
-| 3 | **Gate 2 重复代码** | jscpd 相似度 **>5% BLOCK** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
+| 3 | **Gate 2 重复代码** | jscpd 报告重复**仅提示，不阻断** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
 | 4 | **Gate 4 Principles** | 14 条 Clean Code/SOLID 规则，任一 error/warning 即拦（按 `.principlesrc`） | `xp-gate check 4 <file>`；避免超长参数表、空 catch、`as any` |
 | 5 | **Gate 1 Lint** | 适配器 lint 任一 error | 提交前跑一次项目 lint；不要留未用变量/导入 |
 | 6 | **Gate 5 测试** | 测试全绿 + 覆盖率 ≥80%（新 .ts/.tsx 无测试直接 BLOCK） | 新代码先写测试（TDD）；`npx vitest run <file>` |
 | 7 | **mirror/sync 纪律** | 改 `githooks/` 或 `skills/` 后必须 `node src/npm-package/scripts/sync-package-content.js --fix` 且 `bash scripts/check-hook-mirror.sh` 报 PASS | 忘了同步会在 pre-push 的 mirror 校验被打回 |
 
+**权威清单用 `xp-gate gate-rules` 现取，不要背上面这张表。** 上表是手抄的,阈值真正定义在
+`.principlesrc`、`jscpd.conf.json` 和 `githooks/pre-commit` 里。`xp-gate gate-rules` 从那些
+文件生成一份带**出处**的清单:
+
+```bash
+xp-gate gate-rules          # markdown 表:规则 / 严重度 / 阈值 / 出处
+xp-gate gate-rules --json   # 机器可读
+```
+
+为什么必须生成而不是手写:这张表原本写"jscpd 相似度 >5% BLOCK",而 Gate 2 实际只是提示、
+从不阻断——有人会去为一个永不触发的裁定重构代码。**一个说谎的自检清单比没有清单更糟**,
+它会让人按错误规则写,然后在提交时被告知另一套。改阈值时只需改配置,清单自动跟上。
+
 **一条命令抢先看**：`xp-gate check . --changed --brief` 只跑"本次 diff 会触发的门禁"，
 一屏出 PASS/SKIP/BLOCK，目标 <5 s。把它放在 ralph-loop 每个 REQ 的 step 0，先看红不红，
 再决定是否继续写——而不是写到一半才被 `git commit` 拦下。

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.6",
+  "version": "0.35.7",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/sprint-flow/references/phase-3-build.md

@@ -34,12 +34,25 @@
 |---|------|------------------------------|----------|
 | 1 | **Gate 3 CCN** | 单函数圈复杂度 **>10 BLOCK**、**>5 WARN** | 拆函数 / 早返回 / 抽策略表；`xp-gate check 3 <file>` |
 | 2 | **Gate 6 Boy Scout** | **新文件 0 warning**；修改文件 warning 数不得高于 `.warnings-baseline.json`；**单函数 ≤50 行**；**嵌套 ≤4 层** | 新文件当"零容忍"写；改动前 `xp-gate check 6` 看基线 |
-| 3 | **Gate 2 重复代码** | jscpd 相似度 **>5% BLOCK** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
+| 3 | **Gate 2 重复代码** | jscpd 报告重复**仅提示，不阻断** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
 | 4 | **Gate 4 Principles** | 14 条 Clean Code/SOLID 规则，任一 error/warning 即拦（按 `.principlesrc`） | `xp-gate check 4 <file>`；避免超长参数表、空 catch、`as any` |
 | 5 | **Gate 1 Lint** | 适配器 lint 任一 error | 提交前跑一次项目 lint；不要留未用变量/导入 |
 | 6 | **Gate 5 测试** | 测试全绿 + 覆盖率 ≥80%（新 .ts/.tsx 无测试直接 BLOCK） | 新代码先写测试（TDD）；`npx vitest run <file>` |
 | 7 | **mirror/sync 纪律** | 改 `githooks/` 或 `skills/` 后必须 `node src/npm-package/scripts/sync-package-content.js --fix` 且 `bash scripts/check-hook-mirror.sh` 报 PASS | 忘了同步会在 pre-push 的 mirror 校验被打回 |
 
+**权威清单用 `xp-gate gate-rules` 现取，不要背上面这张表。** 上表是手抄的,阈值真正定义在
+`.principlesrc`、`jscpd.conf.json` 和 `githooks/pre-commit` 里。`xp-gate gate-rules` 从那些
+文件生成一份带**出处**的清单:
+
+```bash
+xp-gate gate-rules          # markdown 表:规则 / 严重度 / 阈值 / 出处
+xp-gate gate-rules --json   # 机器可读
+```
+
+为什么必须生成而不是手写:这张表原本写"jscpd 相似度 >5% BLOCK",而 Gate 2 实际只是提示、
+从不阻断——有人会去为一个永不触发的裁定重构代码。**一个说谎的自检清单比没有清单更糟**,
+它会让人按错误规则写,然后在提交时被告知另一套。改阈值时只需改配置,清单自动跟上。
+
 **一条命令抢先看**：`xp-gate check . --changed --brief` 只跑"本次 diff 会触发的门禁"，
 一屏出 PASS/SKIP/BLOCK，目标 <5 s。把它放在 ralph-loop 每个 REQ 的 step 0，先看红不红，
 再决定是否继续写——而不是写到一半才被 `git commit` 拦下。

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.6",
+  "version": "0.35.7",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/sprint-flow/references/phase-3-build.md

@@ -34,12 +34,25 @@
 |---|------|------------------------------|----------|
 | 1 | **Gate 3 CCN** | 单函数圈复杂度 **>10 BLOCK**、**>5 WARN** | 拆函数 / 早返回 / 抽策略表；`xp-gate check 3 <file>` |
 | 2 | **Gate 6 Boy Scout** | **新文件 0 warning**；修改文件 warning 数不得高于 `.warnings-baseline.json`；**单函数 ≤50 行**；**嵌套 ≤4 层** | 新文件当"零容忍"写；改动前 `xp-gate check 6` 看基线 |
-| 3 | **Gate 2 重复代码** | jscpd 相似度 **>5% BLOCK** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
+| 3 | **Gate 2 重复代码** | jscpd 报告重复**仅提示，不阻断** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
 | 4 | **Gate 4 Principles** | 14 条 Clean Code/SOLID 规则，任一 error/warning 即拦（按 `.principlesrc`） | `xp-gate check 4 <file>`；避免超长参数表、空 catch、`as any` |
 | 5 | **Gate 1 Lint** | 适配器 lint 任一 error | 提交前跑一次项目 lint；不要留未用变量/导入 |
 | 6 | **Gate 5 测试** | 测试全绿 + 覆盖率 ≥80%（新 .ts/.tsx 无测试直接 BLOCK） | 新代码先写测试（TDD）；`npx vitest run <file>` |
 | 7 | **mirror/sync 纪律** | 改 `githooks/` 或 `skills/` 后必须 `node src/npm-package/scripts/sync-package-content.js --fix` 且 `bash scripts/check-hook-mirror.sh` 报 PASS | 忘了同步会在 pre-push 的 mirror 校验被打回 |
 
+**权威清单用 `xp-gate gate-rules` 现取，不要背上面这张表。** 上表是手抄的,阈值真正定义在
+`.principlesrc`、`jscpd.conf.json` 和 `githooks/pre-commit` 里。`xp-gate gate-rules` 从那些
+文件生成一份带**出处**的清单:
+
+```bash
+xp-gate gate-rules          # markdown 表:规则 / 严重度 / 阈值 / 出处
+xp-gate gate-rules --json   # 机器可读
+```
+
+为什么必须生成而不是手写:这张表原本写"jscpd 相似度 >5% BLOCK",而 Gate 2 实际只是提示、
+从不阻断——有人会去为一个永不触发的裁定重构代码。**一个说谎的自检清单比没有清单更糟**,
+它会让人按错误规则写,然后在提交时被告知另一套。改阈值时只需改配置,清单自动跟上。
+
 **一条命令抢先看**：`xp-gate check . --changed --brief` 只跑"本次 diff 会触发的门禁"，
 一屏出 PASS/SKIP/BLOCK，目标 <5 s。把它放在 ralph-loop 每个 REQ 的 step 0，先看红不红，
 再决定是否继续写——而不是写到一半才被 `git commit` 拦下。

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** 35df3831
+**Commit:** 9f8b24d8
 **Branch:** main
-**Version:** 0.35.6.0
+**Version:** 0.35.7.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.