@boyingliu01/xp-gate 0.35.8 → 0.35.10

package/lib/__tests__/coverage-threshold.test.js

@@ -0,0 +1,80 @@
+/**
+ * @test REQ-605 覆盖率阈值必须只有一个真相源，且"未声明"与"声明为默认"可区分
+ * @intent #605 指出阈值散落在 4+ 处。实测这里的问题比"散落"严重：同一个覆盖率
+ *         概念有**两条独立的闸门，读同样的数字，却给出不同的门槛**。
+ *
+ *           githooks/pre-commit      ${COVERAGE_THRESHOLD:-80}   —— 平面 80%
+ *           vitest.config.ts         lines 60 / statements 60
+ *                                    functions 81 / branches 79
+ *
+ *         而 vitest 侧那条的注释自己写着"这些数字是实测下限，不是 80% 目标"。
+ *         也就是说两条闸门对"这个仓库的覆盖率该是多少"给出了互相矛盾的答案，
+ *         而谁都没错——它们各自是本地合理决定的总和。
+ *
+ *         **"散落"本身不是问题，"同一问题有多个互相矛盾的答案"才是。** 所以这里
+ *         不追求"把所有阈值塞进一个文件"，而是保证：给定一个阈值概念，解析结果的
+ *         (值, 来源) 是唯一确定且可解释的。
+ *
+ *         第二条要求是 #561 的教训：``COVERAGE_THRESHOLD:-80`` 让"没声明"和"声明
+ *         为 80"在行为上完全相同，于是文档说 80%、实际生效 60% 时没有任何东西会报警。
+ *         来源必须能让调用方区分这两种情况，否则"有效画像"还是一句空话。
+ * @covers AC-605-01, AC-605-02, AC-605-03
+ */
+'use strict';
+
+const { resolveCoverageThreshold, describeThreshold } = require('../coverage-threshold');
+
+describe('覆盖率阈值单一真相源 (#605)', () => {
+  it('AC-605-01: 未声明时标注为 implicit，并给出实际生效值', () => {
+    const r = resolveCoverageThreshold({});
+    expect(r.value).toBe(80);
+    expect(r.source).toBe('implicit');
+    expect(r.declared).toBe(false);
+  });
+
+  it('AC-605-02: 显式声明为同一个值时必须能与未声明区分', () => {
+    // The #561 failure shape: `:-80` made "nobody said" and "someone said 80"
+    // identical, so a doc claiming 80% while the live config said 60% raised no
+    // alarm anywhere. Same number, different meaning, must stay distinguishable.
+    const impl = resolveCoverageThreshold({});
+    const expl = resolveCoverageThreshold({ vitest: { lines: 80 } });
+    expect(impl.value).toBe(expl.value);
+    expect(impl.source).not.toBe(expl.source);
+    expect(expl.declared).toBe(true);
+    expect(expl.source).toBe('vitest.config.ts');
+  });
+
+  it('AC-605-03: 两条闸门矛盾时必须报告冲突，而不是静默取一个', () => {
+    // Measured state: vitest declares lines 60 while pre-commit defaults to 80.
+    // Picking either silently is how a repo ends up "enforcing 80%" in a doc and
+    // 60% in reality. Reporting the conflict is the only honest answer.
+    const r = resolveCoverageThreshold({
+      vitest: { lines: 60, statements: 60, functions: 81, branches: 79 },
+      preCommit: 80,
+    });
+    expect(r.conflict).toBeTruthy();
+    expect(r.conflict.hook).toBe(80);
+    expect(r.conflict.vitest).toBe(60);
+  });
+
+  it('AC-605-03: 两条闸门一致时不算冲突', () => {
+    const r = resolveCoverageThreshold({ vitest: { lines: 80 }, preCommit: 80 });
+    expect(r.conflict).toBeFalsy();
+  });
+
+  it('AC-605-02: 冲突时两端数值都可单独查询，便于决定改哪边', () => {
+    // The live state: `npx vitest run` goes green at 60% locally, then the commit
+    // is blocked at 80%. That ordering is the worst one -- it reads as "my change
+    // is fine" right up until it is rejected. Reporting both numbers lets the
+    // reader see which declaration to move.
+    const r = resolveCoverageThreshold({ vitest: { lines: 60 }, preCommit: 80 });
+    expect(r.conflict.hook).toBe(80);
+    expect(r.conflict.vitest).toBe(60);
+    expect(describeThreshold(r)).toContain('CONFLICT');
+  });
+
+  it('AC-605-01: describeThreshold 让来源可被人类核对', () => {
+    expect(describeThreshold(resolveCoverageThreshold({}))).toContain('implicit');
+    expect(describeThreshold(resolveCoverageThreshold({ vitest: { lines: 75 } }))).toContain('vitest.config.ts');
+  });
+});

package/lib/__tests__/debt-classify.test.js

@@ -0,0 +1,78 @@
+/**
+ * @test REQ-638 Boy Scout 债务必须按"可修性"分级，而不是报一个总数
+ * @intent #638 追踪单把 Gate 6 的债务记作「139 条预算告警 / 14 文件」，并归类为
+ *         "可清零"。实测这 139 条并不构成同一类问题：
+ *
+ *           magic-numbers            122 条（INFO 级 —— 按 .principlesrc 设计就不阻断）
+ *           missing-error-handling    79 条（可修，且值得修）
+ *           long-function             27 条（可修，需重构）
+ *           deep-nesting              22 条（可修）
+ *           solid.* / 其它              11 条
+ *
+ *           （合计 261 > 139，因为部分文件在 baseline 里已过期。）
+ *
+ *         **把 INFO 级规则算进"债务"会制造一个永远清不完的数字**：magic-numbers
+ *         在测试里几乎是不可避免的（超时值、端口、状态码），它被设计成 INFO 正是因为
+ *         不该逼人去改。混在一起统计的后果是"债务 139 条"这个数字既不能指导行动，
+ *         也不能衡量进展——修掉 79 条 missing-error-handling 后，数字只从 139 掉到 60，
+ *         看起来像只完成了 57%，实际已经清空了最值得清的那一类。
+ *
+ *         所以分级的价值不是"更好看"，而是让"还剩多少真正要修"变成可回答的问题。
+ * @covers AC-638-01, AC-638-02, AC-638-03
+ */
+'use strict';
+
+const { classifyDebt, summarizeDebtByFixability, INFO_ONLY_RULES } = require('../debt-classify');
+
+describe('Boy Scout 债务分级 (#638)', () => {
+  it('AC-638-01: INFO 级规则不计入"需要修"的债务', () => {
+    // .principlesrc marks magic-numbers as severity=info. A rule that never blocks
+    // anything is not a debt to clear; counting it makes the number unchaseable.
+    expect(INFO_ONLY_RULES).toContain('clean-code.magic-numbers');
+    const buckets = summarizeDebtByFixability([
+      { file: 'a.ts', rule: 'clean-code.magic-numbers', count: 122 },
+      { file: 'b.ts', rule: 'clean-code.missing-error-handling', count: 79 },
+    ]);
+    expect(buckets.actionable).toBe(79);
+    expect(buckets.informational).toBe(122);
+  });
+
+  it('AC-638-02: 可修类别各自独立计数，因为修法不同', () => {
+    // "Fix the debt" is four different jobs: add try/catch, split a function,
+    // flatten nesting, split a class. Collapsing them hides which job is left.
+    const buckets = summarizeDebtByFixability([
+      { file: 'a.ts', rule: 'clean-code.missing-error-handling', count: 79 },
+      { file: 'a.ts', rule: 'clean-code.long-function', count: 27 },
+      { file: 'b.ts', rule: 'clean-code.deep-nesting', count: 22 },
+      { file: 'b.ts', rule: 'solid.srp', count: 5 },
+    ]);
+    expect(buckets.byRule['clean-code.missing-error-handling']).toBe(79);
+    expect(buckets.byRule['clean-code.long-function']).toBe(27);
+    expect(buckets.byRule['clean-code.deep-nesting']).toBe(22);
+    expect(buckets.byRule['solid.srp']).toBe(5);
+    expect(buckets.actionable).toBe(133);
+  });
+
+  it('AC-638-03: 分级对未知规则保守处理——算作可修，不算作噪音', () => {
+    // A rule added to the analyzer must not silently become "informational" just
+    // because this module has not heard of it. Defaulting to actionable over-reports
+    // work; defaulting to info under-reports debt, which is the failure that lets
+    // real problems hide behind a green dashboard.
+    const buckets = summarizeDebtByFixability([
+      { file: 'a.ts', rule: 'clean-code.brand-new-rule', count: 3 },
+    ]);
+    expect(buckets.actionable).toBe(3);
+    expect(buckets.informational).toBe(0);
+    expect(buckets.byRule['clean-code.brand-new-rule']).toBe(3);
+  });
+
+  it('AC-638-03: 单条 finding 数组也能分级', () => {
+    const rows = classifyDebt([
+      { file: 'a.ts', rule: 'clean-code.magic-numbers' },
+      { file: 'a.ts', rule: 'clean-code.long-function' },
+    ]);
+    expect(rows).toHaveLength(2);
+    expect(rows[0].fixability).toBe('informational');
+    expect(rows[1].fixability).toBe('actionable');
+  });
+});

package/lib/coverage-threshold.js

@@ -0,0 +1,88 @@
+/**
+ * Coverage-threshold resolution with an explicit provenance field (#605).
+ *
+ * #605 asks for a single machine-readable test profile because thresholds are
+ * scattered across 4+ files. Measured, the scattering is not the damaging part —
+ * the damaging part is that the same concept has two live gates that read the same
+ * number and disagree:
+ *
+ *   githooks/pre-commit   ${COVERAGE_THRESHOLD:-80}         flat 80%
+ *   vitest.config.ts      lines 60 / statements 60
+ *                         functions 81 / branches 79
+ *
+ * The vitest block documents itself as "the measured floor, not the 80% target",
+ * so both are locally reasonable. The repo-wide consequence is that nobody can
+ * answer "what coverage does this repo require" without reading two files.
+ *
+ * This module does not try to collapse every threshold into one file. It makes the
+ * answer to that one question unique and explainable: given what each source
+ * declares, produce (value, source, declared) and report a conflict rather than
+ * silently preferring one side.
+ *
+ * The `declared` flag exists because of #561: `:-80` made "nobody declared a
+ * threshold" and "someone declared 80" indistinguishable, so a doc claiming 80%
+ * while the live config said 60% raised no alarm anywhere.
+ */
+'use strict';
+
+/** What the hook assumes when no config declares a coverage floor. */
+const IMPLICIT_COVERAGE_FLOOR = 80;
+
+/**
+ * Resolve the coverage floor from the sources that actually declare one.
+ *
+ * @param {object} [sources]
+ * @param {{lines?: number, statements?: number, functions?: number, branches?: number}} [sources.vitest]
+ * @param {number} [sources.preCommit]
+ * @returns {{value: number, source: string, declared: boolean, conflict?: {hook: number, vitest: number, detail: string}}}
+ */
+function resolveCoverageThreshold(sources) {
+  const src = sources || {};
+  const vitestLines = src.vitest && typeof src.vitest.lines === 'number' ? src.vitest.lines : null;
+  const hookValue = typeof src.preCommit === 'number' ? src.preCommit : null;
+
+  const conflict = detectConflict(vitestLines, hookValue);
+
+  if (vitestLines !== null) {
+    return {
+      value: vitestLines,
+      source: 'vitest.config.ts',
+      declared: true,
+      ...(conflict ? { conflict } : {}),
+    };
+  }
+
+  if (hookValue !== null) {
+    return { value: hookValue, source: 'pre-commit', declared: true, ...(conflict ? { conflict } : {}) };
+  }
+
+  // Nothing declared: the hook's fallback applies. `declared: false` is the whole
+  // point -- a caller must be able to tell "80 because someone chose 80" from
+  // "80 because nobody said anything".
+  return { value: IMPLICIT_COVERAGE_FLOOR, source: 'implicit', declared: false, ...(conflict ? { conflict } : {}) };
+}
+
+/**
+ * Two live gates disagreeing about the same number is a defect, not a preference.
+ * Reported, never resolved silently.
+ */
+function detectConflict(vitestLines, hookValue) {
+  if (vitestLines === null || hookValue === null) return null;
+  if (vitestLines === hookValue) return null;
+  return {
+    hook: hookValue,
+    vitest: vitestLines,
+    detail: `pre-commit enforces ${hookValue}% while vitest.config.ts enforces ${vitestLines}%`,
+  };
+}
+
+/** One-line, human-checkable rendering of a resolved threshold. */
+function describeThreshold(resolved) {
+  if (!resolved) return 'coverage threshold: unknown';
+  const parts = [`coverage threshold: ${resolved.value}%`, `source: ${resolved.source}`];
+  if (!resolved.declared) parts.push('not declared by any config — this is the hook fallback');
+  if (resolved.conflict) parts.push(`CONFLICT — ${resolved.conflict.detail}`);
+  return parts.join(' | ');
+}
+
+module.exports = { resolveCoverageThreshold, describeThreshold, IMPLICIT_COVERAGE_FLOOR };

package/lib/debt-classify.js

@@ -0,0 +1,86 @@
+/**
+ * Classify Boy Scout / principles debt by whether it is worth fixing (#638).
+ *
+ * The tracker reported Gate 6 as "139 warnings / 14 files — clearable". Measured,
+ * those warnings are not one kind of problem:
+ *
+ *   magic-numbers            122   INFO — `.principlesrc` sets severity=info, so it
+ *                                  never blocks. Almost unavoidable in tests
+ *                                  (timeouts, ports, status codes) and deliberately
+ *                                  not worth forcing people to edit.
+ *   missing-error-handling    79   actionable
+ *   long-function             27   actionable
+ *   deep-nesting              22   actionable
+ *   solid.* + misc            11   actionable
+ *
+ * Mixing them makes the headline number un-actionable: clearing every
+ * missing-error-handling drops the total from 139 to 60, which reads like 57% done
+ * when the most valuable category is actually empty. A number that cannot express
+ * progress cannot direct work.
+ *
+ * So this module splits debt into "actionable" and "informational", and keeps the
+ * actionable rules separate because each is a different job — add a try/catch, split
+ * a function, flatten nesting, split a class.
+ */
+'use strict';
+
+/**
+ * Rules whose configured severity is `info`.
+ *
+ * These still appear in analyzer output, but `.principlesrc` marks them info
+ * precisely so they never block. Listing them as debt would make the debt number
+ * permanently non-zero.
+ */
+const INFO_ONLY_RULES = [
+  'clean-code.magic-numbers',
+  'clean-code.unused-imports',
+  'clean-code.many-exports',
+  'solid.ocp',
+];
+
+function isInformational(rule) {
+  return INFO_ONLY_RULES.includes(rule);
+}
+
+/**
+ * Annotate individual findings with `fixability`.
+ *
+ * Unknown rules default to `actionable` on purpose. A new analyzer rule that this
+ * module has not heard of must not silently become noise — over-reporting work is
+ * recoverable, under-reporting debt is the failure mode that lets real problems hide
+ * behind a green dashboard.
+ *
+ * @param {Array<{file: string, rule: string}>} findings
+ * @returns {Array<{file: string, rule: string, fixability: 'actionable'|'informational'}>}
+ */
+function classifyDebt(findings) {
+  if (!Array.isArray(findings)) return [];
+  return findings.map((f) => ({
+    ...f,
+    fixability: isInformational(f.rule) ? 'informational' : 'actionable',
+  }));
+}
+
+/**
+ * Totals per fixability class, plus a per-rule breakdown of the actionable part.
+ *
+ * @param {Array<{file: string, rule: string, count?: number}>} rows
+ * @returns {{actionable: number, informational: number, byRule: Record<string, number>}}
+ */
+function summarizeDebtByFixability(rows) {
+  const byRule = {};
+  let actionable = 0;
+  let informational = 0;
+  for (const row of Array.isArray(rows) ? rows : []) {
+    const count = typeof row.count === 'number' ? row.count : 1;
+    if (isInformational(row.rule)) {
+      informational += count;
+      continue;
+    }
+    actionable += count;
+    byRule[row.rule] = (byRule[row.rule] || 0) + count;
+  }
+  return { actionable, informational, byRule };
+}
+
+module.exports = { classifyDebt, summarizeDebtByFixability, INFO_ONLY_RULES, isInformational };

package/lib/gate-coverage.js

@@ -151,14 +151,8 @@ function buildCoverageRows(artifact, ctx) {
     };
 
     if (!entry) {
-      // Not in the artifact at all. This is NOT "passed" and NOT "by design":
-      // the gate produced no verdict, so the only honest label is SKIP + why.
-      // `hookOnly` here means "the artifact is generated by a git hook, so its
-      // absence means no commit has run it yet" -- not "it can never run".
       row.status = STATUS.SKIP;
-      row.reason = spec.hookOnly
-        ? 'no result recorded — runs via git commit'
-        : 'no result recorded — not run in the last report';
+      row.reason = missingGateReason(spec);
       return row;
     }
 
@@ -183,7 +177,7 @@ function buildCoverageRows(artifact, ctx) {
       return {
         ...row,
         status: STATUS.DEBT,
-        debt: `${context.boyScout.warnings} warning(s) / ${context.boyScout.files} file(s)`,
+        debt: describeBoyScoutDebt(context.boyScout),
         evidence: 'warnings baseline (see .warnings-baseline.json)',
       };
     }
@@ -191,6 +185,92 @@ function buildCoverageRows(artifact, ctx) {
   });
 }
 
+/**
+ * Why a gate produced no verdict.
+ *
+ * Not in the artifact at all. This is NOT "passed" and NOT "by design": the gate
+ * produced no verdict, so the only honest label is SKIP + why. `hookOnly` here means
+ * "the artifact is generated by a git hook, so its absence means no commit has run
+ * it yet" -- not "it can never run".
+ */
+function missingGateReason(spec) {
+  return spec.hookOnly
+    ? 'no result recorded — runs via git commit'
+    : 'no result recorded — not run in the last report';
+}
+
+/**
+ * Resolve the coverage floor from both gates and report disagreement (#605).
+ *
+ * Read from source rather than cached: both files are small, and a stale threshold
+ * report is worse than none -- it would assert the gates agree when they need not.
+ * Either side absent degrades to "unknown", never to "no conflict".
+ */
+function readCoverageThresholdConflict(repoRoot) {
+  try {
+    const { resolveCoverageThreshold } = require('./coverage-threshold.js');
+    const sources = {};
+    const vitest = readVitestThresholds(repoRoot);
+    if (vitest) sources.vitest = vitest;
+    const hookFloor = readHookCoverageFloor(repoRoot);
+    if (hookFloor !== null) sources.preCommit = hookFloor;
+    const resolved = resolveCoverageThreshold(sources);
+    if (!vitest && hookFloor === null) return { ...resolved, sources: 'none readable' };
+    return resolved;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `thresholds: { lines: N, ... }` from vitest.config.ts, or null when absent.
+ *
+ * Comments are stripped first. The file documents the #561 failure by quoting the
+ * old bad shape (`thresholds: { global: {...} }`) in prose, and a naive match reads
+ * that quote as the live config -- reporting a threshold the repo does not use,
+ * which is exactly the class of error #605 exists to stop.
+ */
+function readVitestThresholds(repoRoot) {
+  try {
+    const raw = fs.readFileSync(path.join(repoRoot, 'vitest.config.ts'), 'utf8');
+    const code = raw.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+    const block = code.match(/thresholds:\s*\{([\s\S]*?)\}/);
+    if (!block) return null;
+    const out = {};
+    for (const m of block[1].matchAll(/(lines|statements|functions|branches)\s*:\s*(\d+)/g)) {
+      out[m[1]] = Number(m[2]);
+    }
+    return Object.keys(out).length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The flat floor the pre-commit hook applies, or null when it applies none. */
+function readHookCoverageFloor(repoRoot) {
+  try {
+    const raw = fs.readFileSync(path.join(repoRoot, 'githooks', 'pre-commit'), 'utf8');
+    if (!/COVERAGE_THRESHOLD/.test(raw)) return null;
+    const m = raw.match(/COVERAGE_THRESHOLD:-?(\d+)/) || raw.match(/COVERAGE_THRESHOLD=(\d+)/);
+    return m ? Number(m[1]) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Describe Boy Scout debt by how much of it is worth fixing (#638).
+ *
+ * `magic-numbers` is severity=info and accounts for roughly half the raw count, so a
+ * single total is un-actionable: clearing every real finding barely moves it, and a
+ * number that cannot express progress cannot direct work.
+ */
+function describeBoyScoutDebt(boyScout) {
+  const breakdown = boyScout.breakdown;
+  if (!breakdown) return `${boyScout.warnings} warning(s) / ${boyScout.files} file(s)`;
+  return `${breakdown.actionable} actionable / ${breakdown.informational} informational (${boyScout.files} file(s))`;
+}
+
 /** Render rows as the human-readable overview. */
 function renderGateCoverage(rows, opts) {
   const options = opts || {};
@@ -212,6 +292,16 @@ function renderGateCoverage(rows, opts) {
     lines.push('     Numbers below describe that commit, NOT the working tree.');
   }
 
+  if (options.coverageThreshold && options.coverageThreshold.conflict) {
+    // #605: two live gates enforcing different numbers for the same thing. Reported
+    // here rather than resolved silently -- picking one side is how a repo ends up
+    // documented at 80% and enforced at 60%.
+    lines.push('');
+    lines.push(`  ⚠️  COVERAGE THRESHOLD CONFLICT — ${options.coverageThreshold.conflict.detail}`);
+    lines.push('     Both gates read the same number and disagree. Fix the declarations,');
+    lines.push('     not the reporting.');
+  }
+
   lines.push('');
   lines.push(`  ${counts.PASS} PASS / ${counts.DEBT} DEBT / ${counts.SKIP} SKIP / ${counts.FAIL} FAIL`);
   if (counts.SKIP > 0) {
@@ -256,8 +346,61 @@ function readBoyScoutDebt(repoRoot) {
       const value = baseline[key];
       warnings += typeof value === 'number' ? value : (value && value.totalWarnings) || 0;
     }
-    return { files: files.length, warnings };
+    return { files: files.length, warnings, breakdown: readDebtBreakdown(repoRoot, files) };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Rule-level breakdown of the Boy Scout debt (#638).
+ *
+ * The baseline stores only `totalWarnings` per file, so the split cannot be derived
+ * from it. It also must not be recomputed on every `gate-coverage` call: analysing
+ * 17 files through the principles engine costs ~90s, and a report command that takes
+ * a minute and a half stops being run.
+ *
+ * Hence a cache keyed on the baseline file's mtime+size: any commit that changes the
+ * debt changes the baseline, which invalidates the cache. A stale split is worse
+ * than no split, because it would report progress that did not happen.
+ */
+function readDebtBreakdown(repoRoot, files) {
+  try {
+    const { summarizeDebtByFixability } = require('./debt-classify.js');
+    const baselinePath = path.join(repoRoot, '.warnings-baseline.json');
+    const stat = fs.statSync(baselinePath);
+    const cachePath = path.join(repoRoot, '.xp-gate', 'debt-breakdown.json');
+    const cacheKey = `${stat.mtimeMs}:${stat.size}`;
+    try {
+      const cached = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
+      if (cached && cached.key === cacheKey && cached.breakdown) return cached.breakdown;
+    } catch {
+      // No usable cache -- fall through and recompute.
+    }
+    const { execFileSync } = require('node:child_process');
+    const targets = files.filter((f) => !f.includes('/src/npm-package/'));
+    const raw = execFileSync(
+      process.execPath,
+      [path.join(repoRoot, 'node_modules', 'tsx', 'dist', 'cli.mjs'),
+       path.join(repoRoot, 'src', 'principles', 'index.ts'),
+       '--files', targets.join(' '), '--format', 'json'],
+      { cwd: repoRoot, encoding: 'utf8', timeout: 180000 },
+    );
+    const parsed = JSON.parse(raw);
+    const rows = Object.entries(parsed.ruleResults || {}).map(([rule, v]) => ({
+      rule,
+      count: v.violationCount || 0,
+    }));
+    const breakdown = summarizeDebtByFixability(rows);
+    try {
+      fs.mkdirSync(path.dirname(cachePath), { recursive: true });
+      fs.writeFileSync(cachePath, JSON.stringify({ key: cacheKey, breakdown }));
+    } catch {
+      // A cache write failure must not break the report.
+    }
+    return breakdown;
   } catch {
+    // Degrade to the plain total rather than failing the whole report.
     return null;
   }
 }
@@ -278,6 +421,7 @@ function main(argv, deps) {
     headCommit,
     boyScout: readBoyScoutDebt(repoRoot),
   });
+  const coverageThreshold = readCoverageThresholdConflict(repoRoot);
 
   if (args.includes('--json')) {
     process.stdout.write(`${JSON.stringify({
@@ -287,6 +431,7 @@ function main(argv, deps) {
       headCommit: headCommit || null,
       artifactFile: file,
       summary: rows.reduce((acc, r) => { acc[r.status] = (acc[r.status] || 0) + 1; return acc; }, {}),
+      coverageThreshold,
       gates: rows,
     }, null, 2)}\n`);
     return exitCodeFor(rows, { strict: args.includes('--strict') });
@@ -299,6 +444,7 @@ function main(argv, deps) {
     stale,
     headCommit,
     artifactCommit: artifact ? artifact.commit : null,
+    coverageThreshold,
   })}\n`);
   return exitCodeFor(rows, { strict: args.includes('--strict') });
 }

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T19:20:46.439Z",
+  "checked_at": "2026-10-30T19:59:34.778Z",
   "source": "network"
 }

package/mock-policy/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MOCK-POLICY KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Mock layering policy enforcement — Gate M3 of pre-push hook. Ensures integration tests use real implementations for internal dependencies, mock external dependencies, and annotate pending mocks with removal plans. Combines project scope scanning, mock decision engine, and per-file validation into a single pipeline.

package/mutation/AGENTS.md

@@ -1,9 +1,9 @@
 # SRC/MUTATION KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 **Gate M** (incremental mutation testing) + **Gate M2** helpers (test-layer detection used by `src/mock-policy/`). Pre-push quality gate. TypeScript-only; uses Stryker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.35.8",
+  "version": "0.35.10",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.8",
+  "version": "0.35.10",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/dsh-plugin-xp-gate",
-  "version": "0.35.8",
+  "version": "0.35.10",
   "description": "XP-Gate deterministic quality gates + AI workflow skills as a DeepSeek Harness (DSH) native plugin: gate-check / gate-principles / gate-arch tools + 12 SKILL.md skills",
   "type": "module",
   "main": "./lib/index.js",

package/plugins/dsh/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/dsh/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/dsh/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/opencode-plugin",
-  "version": "0.35.8",
+  "version": "0.35.10",
   "type": "module",
   "main": "index.ts",
   "description": "XP-Gate quality gates + AI workflow skills + Sprint Flow TUI sidebar for OpenCode",

package/plugins/opencode/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/opencode/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/opencode/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/qoder/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.35.8",
+  "version": "0.35.10",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Qoder. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/qoder/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/qoder/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/qoder/skills/sprint-flow/references/phase-3-build.md

@@ -34,12 +34,25 @@
 |---|------|------------------------------|----------|
 | 1 | **Gate 3 CCN** | 单函数圈复杂度 **>10 BLOCK**、**>5 WARN** | 拆函数 / 早返回 / 抽策略表；`xp-gate check 3 <file>` |
 | 2 | **Gate 6 Boy Scout** | **新文件 0 warning**；修改文件 warning 数不得高于 `.warnings-baseline.json`；**单函数 ≤50 行**；**嵌套 ≤4 层** | 新文件当"零容忍"写；改动前 `xp-gate check 6` 看基线 |
-| 3 | **Gate 2 重复代码** | jscpd 相似度 **>5% BLOCK** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
+| 3 | **Gate 2 重复代码** | jscpd 报告重复**仅提示，不阻断** | 抽公共函数，别复制粘贴；`xp-gate check 2 <dir>` |
 | 4 | **Gate 4 Principles** | 14 条 Clean Code/SOLID 规则，任一 error/warning 即拦（按 `.principlesrc`） | `xp-gate check 4 <file>`；避免超长参数表、空 catch、`as any` |
 | 5 | **Gate 1 Lint** | 适配器 lint 任一 error | 提交前跑一次项目 lint；不要留未用变量/导入 |
 | 6 | **Gate 5 测试** | 测试全绿 + 覆盖率 ≥80%（新 .ts/.tsx 无测试直接 BLOCK） | 新代码先写测试（TDD）；`npx vitest run <file>` |
 | 7 | **mirror/sync 纪律** | 改 `githooks/` 或 `skills/` 后必须 `node src/npm-package/scripts/sync-package-content.js --fix` 且 `bash scripts/check-hook-mirror.sh` 报 PASS | 忘了同步会在 pre-push 的 mirror 校验被打回 |
 
+**权威清单用 `xp-gate gate-rules` 现取，不要背上面这张表。** 上表是手抄的,阈值真正定义在
+`.principlesrc`、`jscpd.conf.json` 和 `githooks/pre-commit` 里。`xp-gate gate-rules` 从那些
+文件生成一份带**出处**的清单:
+
+```bash
+xp-gate gate-rules          # markdown 表:规则 / 严重度 / 阈值 / 出处
+xp-gate gate-rules --json   # 机器可读
+```
+
+为什么必须生成而不是手写:这张表原本写"jscpd 相似度 >5% BLOCK",而 Gate 2 实际只是提示、
+从不阻断——有人会去为一个永不触发的裁定重构代码。**一个说谎的自检清单比没有清单更糟**,
+它会让人按错误规则写,然后在提交时被告知另一套。改阈值时只需改配置,清单自动跟上。
+
 **一条命令抢先看**：`xp-gate check . --changed --brief` 只跑"本次 diff 会触发的门禁"，
 一屏出 PASS/SKIP/BLOCK，目标 <5 s。把它放在 ralph-loop 每个 REQ 的 step 0，先看红不红，
 再决定是否继续写——而不是写到一半才被 `git commit` 拦下。

package/plugins/qoder/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/principles/AGENTS.md

@@ -1,9 +1,9 @@
 # PRINCIPLES CHECKER MODULE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Clean Code & SOLID principles checker — **Gate 4** of pre-commit. 14 rules × 9 language adapters, SARIF 2.1.0 output. Houses the **Boy Scout Rule** enforcement engine (Gate 6) and warning-baseline storage.

package/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
 **Generated:** 2026-10-30
-**Commit:** b3549c25
+**Commit:** 6c9bcb78
 **Branch:** main
-**Version:** 0.35.8.0
+**Version:** 0.35.10.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.