@ccoalm/ccl-skills 0.1.0 → 0.2.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_impact_chain_source_refuted.sh

@@ -0,0 +1,176 @@
+#!/usr/bin/env bash
+# 043：`source-refuted` 证据类的冻结验收用例（specs/043-evidence-class-source-refuted/frozen-acceptance.md）。
+#
+# A-F 在闸被触碰之前冻结；G/H 由独立评审与挑战各指出一处滥用路径后补入（**加严**，
+# 不是放宽）。通过条件是全部命中——任何一条不符即本轮
+# 未完成，**不得**以"主要目标达成"结案，也不得为让 A 变绿而放宽 B–F。
+#
+# 全部确定性，不调模型。每用例一条分支，互不影响本地未提交改动。
+set -u
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd -P)"
+GATE="$ROOT/skills/skill-extraction-workflow/scripts/impact-chain-gate.rb"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT INT TERM
+fails=0
+fail() { echo "FAIL: $*" >&2; fails=$((fails+1)); }
+ok()   { echo "  ok   $*"; }
+
+REPO="$TMP/repo"
+git clone -q "$ROOT" "$REPO"
+git -C "$REPO" config user.email test@example.invalid
+git -C "$REPO" config user.name "Test User"
+
+OWNER_REF="skills/product-rd-workflow/SKILL.md"
+REGISTER="skills/skill-extraction-workflow/references/source-register.md"
+ZLOSS="specs/043-evidence-class-source-refuted/zero-loss-fixture.md"
+
+# 种子：给 owner 的 reference 加一段可被后续用例整段删掉的文本（保证净字节 < 0），
+# 以及一份非空的零损失义务对照 fixture。
+WITHDRAWN_TEXT='A fixture claim that a later case withdraws wholesale; it is long enough that removing it makes the owner package shrink by a clear margin.'
+mkdir -p "$REPO/$(dirname "$ZLOSS")"
+printf '# 零损失义务对照\n\n被撤回的原文（逐字）：\n\n> %s\n\n| before 义务 | 去向 |\n| --- | --- |\n| 该段承载的义务 | survives-verbatim: 同文件上一段 |\n' "$WITHDRAWN_TEXT" > "$REPO/$ZLOSS"
+printf '\n%s\n' "$WITHDRAWN_TEXT" >> "$REPO/$OWNER_REF"
+printf '\n<!-- fixture-withdrawable-start -->\nA fixture claim that a later case withdraws wholesale; it is long enough that removing it makes the owner package shrink by a clear margin, which is what the net-bytes floor checks.\n<!-- fixture-withdrawable-end -->\n' >> "$REPO/$OWNER_REF"
+git -C "$REPO" add -A >/dev/null
+git -C "$REPO" commit -qm "seed fixtures for source-refuted cases"
+git -C "$REPO" branch fixture-base HEAD
+
+new_case() { git -C "$REPO" switch -q -C "$1" fixture-base; git -C "$REPO" branch --set-upstream-to=fixture-base "$1" >/dev/null 2>&1; }
+commit_case() { git -C "$REPO" add -A >/dev/null; git -C "$REPO" commit -qm "$1"; }
+run_gate() { set +e; OUT="$(env -u CCL_SKILL_BASE_REF ruby "$GATE" "$REPO" 2>&1)"; RC=$?; set -e 2>/dev/null || true; }
+add_row() { printf '%s\n' "$1" >> "$REPO/$REGISTER"; }
+withdraw_fixture() {  # **纯删除**：只删那一行，不加任何内容。说明文字进 reference。
+  python3 - "$REPO/$OWNER_REF" "$WITHDRAWN_TEXT" <<'PYX'
+import io,sys
+p, txt = sys.argv[1], sys.argv[2]
+s = io.open(p, encoding='utf-8').read()
+io.open(p, 'w', encoding='utf-8').write(s.replace("\n" + txt + "\n", "\n", 1))
+PYX
+}
+
+SRC="https://example.invalid/primary-source-that-refutes-the-claim"
+FIRING="firing-path: file:skills/product-rd-workflow/SKILL.md#must survive verbatim above"
+FIRING_F="firing-path: file:skills/product-rd-workflow/SKILL.md#must record a RED-baseline row before it lands"
+
+# ---- A：合规撤回 —— 有类时必须绿，无类时必须红 ----
+new_case case-a; withdraw_fixture
+add_row "| A fixture claim is refuted by its primary source and is withdrawn wholesale | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#零损失义务对照\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case A: compliant source-refuted withdrawal"; run_gate
+# A 的期望值在裁决后由绿改红：该类不再顶起 RED 底线（见 frozen-acceptance.md 的裁决记录）。
+# 合规撤回现在仍然被拦——它要么配一条 RED 行，要么由具名风险 owner 人工放行。
+[ "$RC" != "0" ] && ok "A 合规撤回 -> 仍红（该类不顶底线，撤回需人工放行）" || fail "A 不得自动放行"
+
+# ---- B：真行为变更披该标签 —— 任何时候都必须红 ----
+new_case case-b
+printf '\n- Every fixture change must obtain approval before it lands.\n' >> "$REPO/$OWNER_REF"
+add_row "| A newly added normative rule wearing the withdrawal label | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#零损失义务对照\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case B: real behaviour change wearing the label"; run_gate
+[ "$RC" != "0" ] && ok "B 真行为变更披标签 -> 仍红" || fail "B 不得通过（净增却用撤回类）"
+
+# ---- C：缺一手源 URL —— 必须红 ----
+new_case case-c; withdraw_fixture
+add_row "| A withdrawal whose row cites no refuting source | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#零损失义务对照\`; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case C: missing refuting source"; run_gate
+[ "$RC" != "0" ] && ok "C 缺一手源 -> 仍红" || fail "C 不得通过（无源即无据）"
+
+# ---- D：缺零损失指针 —— 必须红 ----
+new_case case-d; withdraw_fixture
+add_row "| A withdrawal whose row carries no zero-loss map | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case D: missing zero-loss pointer"; run_gate
+[ "$RC" != "0" ] && ok "D 缺零损失指针 -> 仍红" || fail "D 不得通过（义务保全无对照）"
+
+# ---- E：observed-failure: yes —— 必须红 ----
+new_case case-e; withdraw_fixture
+add_row "| A withdrawal self-declaring an observed failure | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: yes | \`updated\` | zero-loss: \`$ZLOSS#零损失义务对照\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case E: observed-failure yes"; run_gate
+[ "$RC" != "0" ] && ok "E observed-failure: yes -> 仍红" || fail "E 不得通过（分类语义不得自选）"
+
+# ---- F：既有类不得回归 ----
+new_case case-f
+printf '\n- Every fixture delivery must record a RED-baseline row before it lands.\n' >> "$REPO/$OWNER_REF"
+add_row "| An ordinary behaviour-changing rule with a RED-baseline row | \`downstream-executor\` | behavioral-evidence: RED-baseline; observed-failure: yes; $FIRING_F | \`updated\` | \`product-rd-workflow/SKILL.md\` |"
+commit_case "case F: existing RED-baseline path"; run_gate
+if [ "$RC" = "0" ]; then ok "F 既有 RED-baseline 路径 -> 绿（无回归）"; else echo "--- F 完整输出 ---"; printf '%s\n' "$OUT"; fail "F 回归"; fi
+
+# ---- G：混合行 —— 同 owner 一条合规撤回 + 一条真行为变更的 semantic-control。必须红 ----
+#      独立评审 REVIEW-1：any? 顶起底线时，真行为变更会搭便车。
+new_case case-g; withdraw_fixture
+printf '\n- Every unrelated fixture delivery must obtain approval before it lands. zzmixedrule\n' >> "$REPO/$OWNER_REF"
+add_row "| A compliant withdrawal alongside an unrelated change | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#零损失义务对照\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+add_row "| An unrelated behaviour change riding along on a stable-control label | \`downstream-executor\` | behavioral-evidence: semantic-control; observed-failure: no; firing-path: file:skills/product-rd-workflow/SKILL.md#must obtain approval before it lands | \`updated\` | \`product-rd-workflow/SKILL.md\` |"
+commit_case "case G: mixed rows"; run_gate
+[ "$RC" != "0" ] && ok "G 混合行 -> 仍红" || fail "G 不得通过（真行为变更搭撤回的便车）"
+
+# ---- H：抵消式新增 + 假锚点 —— 必须红 ----
+#      独立挑战 CHALLENGE-1：删无关文字凑净负、加一条新规则、指针写不存在的锚。
+new_case case-h; withdraw_fixture
+printf '\n- Every smuggled fixture rule must be rejected by the withdrawal class. zzsmuggled\n' >> "$REPO/$OWNER_REF"
+add_row "| A smuggled rule hidden behind an offsetting deletion | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`README.md#no-such-anchor-exists-here\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case H: offset addition with bogus anchor"; run_gate
+[ "$RC" != "0" ] && ok "H 抵消式新增 + 假锚点 -> 仍红" || fail "H 不得通过（新增规范行 / 锚点不解析）"
+
+# ---- I：脚本改动、零删除 —— 必须红（旧代理谓词看不见脚本）----
+new_case case-i
+printf '\n# fixture: an added shell line that changes behaviour without matching any prose predicate\n' >> "$REPO/skills/product-rd-workflow/scripts/check-agent-contract-coverage.sh"
+add_row "| A script change wearing the withdrawal label with nothing deleted | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#零损失义务对照\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case I: script change, no deletion"; run_gate
+[ "$RC" != "0" ] && ok "I 脚本改动零删除 -> 仍红" || fail "I 不得通过（非 .md、且无删除）"
+
+# ---- J：`Always` 规则、零删除 —— 必须红（旧谓词故意排除 always）----
+new_case case-j
+printf '\n- Always authenticate fixture requests before dispatch.\n' >> "$REPO/$OWNER_REF"
+add_row "| An Always-phrased rule wearing the withdrawal label with nothing deleted | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#零损失义务对照\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case J: Always rule, no deletion"; run_gate
+[ "$RC" != "0" ] && ok "J Always 规则零删除 -> 仍红" || fail "J 不得通过（有新增行）"
+
+# ---- K：改权限 + 一次真删除 —— 必须红 ----
+#      独立评审：chmod 在 --name-status 里显示为 M、在 --numstat 里记 0/0。
+new_case case-k; withdraw_fixture
+chmod 755 "$REPO/skills/product-rd-workflow/references/adr-convention.md"
+add_row "| A mode change riding along with a genuine deletion | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#零损失义务对照\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case K: chmod plus deletion"; run_gate
+[ "$RC" != "0" ] && ok "K 改权限 + 删除 -> 仍红" || fail "K 不得通过（mode 变更未被 numstat 反映）"
+
+# ---- L：指针路径穿越出仓 —— 必须红 ----
+new_case case-l; withdraw_fixture
+add_row "| A withdrawal whose zero-loss pointer escapes the repository | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`../../../etc/hosts#localhost\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case L: traversal pointer"; run_gate
+[ "$RC" != "0" ] && ok "L 指针穿越出仓 -> 仍红" || fail "L 不得通过（路径逃出仓库）"
+
+# ---- M：锚点是存在但无意义的单字符子串 —— 必须红 ----
+new_case case-m; withdraw_fixture
+add_row "| A withdrawal whose anchor is a bare existing substring | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#a\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case M: one-character substring anchor"; run_gate
+[ "$RC" != "0" ] && ok "M 单字符子串锚 -> 仍红" || fail "M 不得通过（锚点未落在标题上）"
+
+# ---- N：锚点是存在但不相干的整词 —— 必须红 ----
+new_case case-n; withdraw_fixture
+add_row "| A withdrawal whose anchor is an unrelated existing word | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#survives-verbatim\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case N: unrelated existing substring anchor"; run_gate
+[ "$RC" != "0" ] && ok "N 不相干整词锚 -> 仍红" || fail "N 不得通过（锚点未落在标题上）"
+
+# ---- O：既有 semantic-control 路径不得回归（配对 RED 行）----
+new_case case-o
+printf '\n- Every fixture control rule must be recorded before it lands. zzsemctl\n' >> "$REPO/$OWNER_REF"
+add_row "| An unchanged control alongside a RED-baseline row | \`downstream-executor\` | behavioral-evidence: semantic-control; observed-failure: no; firing-path: file:skills/product-rd-workflow/SKILL.md#must be recorded before it lands | \`updated\` | \`product-rd-workflow/SKILL.md\` |"
+add_row "| The behaviour change the control accompanies | \`downstream-executor\` | behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/SKILL.md#must be recorded before it lands | \`updated\` | \`product-rd-workflow/SKILL.md\` |"
+commit_case "case O: semantic-control beside RED-baseline"; run_gate
+[ "$RC" = "0" ] && ok "O semantic-control + RED-baseline -> 绿（无回归）" || { echo "--- O ---"; printf '%s\n' "$OUT" | tail -3; fail "O 既有路径回归"; }
+
+# ---- P：对照表没有逐字交代被删内容 —— 必须红 ----
+new_case case-p; withdraw_fixture
+python3 - "$REPO/$ZLOSS" <<'PYP'
+import io,sys
+p=sys.argv[1]
+io.open(p,'w',encoding='utf-8').write("# 零损失义务对照\n\n| before 义务 | 去向 |\n| --- | --- |\n| 某条义务 | survives-verbatim: 别处 |\n")
+PYP
+add_row "| A withdrawal whose map does not quote what was removed | \`downstream-executor\` | behavioral-evidence: source-refuted; observed-failure: no | \`updated\` | zero-loss: \`$ZLOSS#零损失义务对照\`; refuting source: $SRC; \`product-rd-workflow/SKILL.md\` |"
+commit_case "case P: map does not account for deleted text"; run_gate
+[ "$RC" != "0" ] && ok "P 对照表未逐字交代被删内容 -> 仍红" || fail "P 不得通过（删了什么没抄出来）"
+
+echo
+if [ "$fails" = "0" ]; then
+  echo "all frozen cases behaved as specified"
+else
+  echo "frozen cases did not all behave as specified"
+  exit 1
+fi

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_regression_runner_lanes.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# Lane-semantics regression for test_check_ccl_regressions.sh (036 challenge
+# P2): --heavy-only must run exactly the heavy_tests entries and no fast entry,
+# propagate a failing heavy suite, and end with its own token; --fast must run
+# exactly the fast_tests entries and no heavy entry. Runs the real runner
+# against a stub fixture tree via REGRESSION_SCRIPTS_DIR, so it proves the mode
+# dispatch in seconds without executing the real multi-minute suites. The stub
+# list is derived from the runner's own arrays, so a lane edit cannot drift the
+# fixture.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+RUNNER="$SCRIPT_DIR/test_check_ccl_regressions.sh"
+
+fail() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+
+extract_lane() {
+  # Bare entry tokens of one array block, comments stripped.
+  sed -n "/^${1}=(/,/^)/p" "$RUNNER" | sed -e '/^#/d' -e '/=($/d' -e '/^)$/d' \
+    -e 's/[[:space:]]*#.*$//' -e 's/^[[:space:]]*//' -e '/^$/d'
+}
+
+fast_lane="$(extract_lane fast_tests)"
+heavy_lane="$(extract_lane heavy_tests)"
+[ -n "$fast_lane" ] || fail "could not extract fast_tests from the runner"
+[ -n "$heavy_lane" ] || fail "could not extract heavy_tests from the runner"
+
+# Exactly-once contract at the array level (r4 challenge P2): a suite listed
+# twice in one lane, or in both lanes, would run twice in CI while every
+# per-mode comparison here still passed — reject it before building stubs.
+dup_fast="$(sort <<<"$fast_lane" | uniq -d)"
+[ -z "$dup_fast" ] || fail "duplicate entries inside fast_tests: $dup_fast"
+dup_heavy="$(sort <<<"$heavy_lane" | uniq -d)"
+[ -z "$dup_heavy" ] || fail "duplicate entries inside heavy_tests: $dup_heavy"
+overlap="$(comm -12 <(sort <<<"$fast_lane") <(sort <<<"$heavy_lane"))"
+[ -z "$overlap" ] || fail "entries registered in both lanes (would run twice per pipeline): $overlap"
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+FIX="$TMP/skills/skill-extraction-workflow/scripts"
+mkdir -p "$FIX"
+LOG="$TMP/ran.log"
+
+write_stub() {
+  local entry="$1"
+  local path="$FIX/$entry"
+  mkdir -p "$(dirname "$path")"
+  printf '#!/usr/bin/env bash\nprintf "%%s\\n" "%s" >> "%s"\n' "$entry" "$LOG" >"$path"
+}
+while IFS= read -r entry; do write_stub "$entry"; done <<<"$fast_lane"
+while IFS= read -r entry; do write_stub "$entry"; done <<<"$heavy_lane"
+
+run_mode() {
+  : >"$LOG"
+  REGRESSION_SCRIPTS_DIR="$FIX" bash "$RUNNER" "$1" >"$TMP/out.$2" 2>&1
+}
+
+# --heavy-only: exactly the heavy lane, its own token, no fast token.
+run_mode --heavy-only heavy || fail "--heavy-only exited nonzero on passing stubs"
+diff <(sort <<<"$heavy_lane") <(sort "$LOG") >/dev/null \
+  || fail "--heavy-only did not run exactly the heavy_tests entries"
+grep -q '^test_check_ccl_regressions_heavy_only_ok$' "$TMP/out.heavy" \
+  || fail "--heavy-only missing its completion token"
+if grep -q 'test_check_ccl_regressions_fast_ok\|test_check_ccl_regressions_full_ok' "$TMP/out.heavy"; then
+  fail "--heavy-only emitted a fast/full token"
+fi
+
+# --fast: exactly the fast lane, fast token, no heavy entry.
+run_mode --fast fast || fail "--fast exited nonzero on passing stubs"
+diff <(sort <<<"$fast_lane") <(sort "$LOG") >/dev/null \
+  || fail "--fast did not run exactly the fast_tests entries"
+grep -q '^test_check_ccl_regressions_fast_ok$' "$TMP/out.fast" \
+  || fail "--fast missing its completion token"
+
+# --full: both lanes, full token.
+run_mode --full full || fail "--full exited nonzero on passing stubs"
+diff <(sort <(printf '%s\n%s\n' "$fast_lane" "$heavy_lane")) <(sort "$LOG") >/dev/null \
+  || fail "--full did not run exactly fast_tests + heavy_tests"
+grep -q '^test_check_ccl_regressions_full_ok$' "$TMP/out.full" \
+  || fail "--full missing its completion token"
+
+# Failure propagation: a red heavy stub must fail --heavy-only.
+first_heavy="$(head -n 1 <<<"$heavy_lane")"
+printf '#!/usr/bin/env bash\nexit 1\n' >"$FIX/$first_heavy"
+if REGRESSION_SCRIPTS_DIR="$FIX" bash "$RUNNER" --heavy-only >"$TMP/out.red" 2>&1; then
+  fail "--heavy-only exited zero although a heavy stub failed"
+fi
+write_stub "$first_heavy"
+
+# Unregistered-sibling enforcement (036 challenge P1): an unregistered
+# test_*.sh must hard-fail every execution mode, independent of the
+# registration guard test staying registered.
+: >"$FIX/test_unregistered_probe.sh"
+if REGRESSION_SCRIPTS_DIR="$FIX" bash "$RUNNER" --fast >"$TMP/out.unreg" 2>&1; then
+  fail "--fast exited zero although an unregistered sibling test exists"
+fi
+grep -q 'test_unregistered_probe.sh' "$TMP/out.unreg" \
+  || fail "unregistered-sibling failure did not name the offending file"
+rm "$FIX/test_unregistered_probe.sh"
+
+echo "regression_runner_lanes_ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_validate_skill_root_depth.sh

@@ -39,7 +39,11 @@ printf 'not-frontmatter\n' > "$tmp/repo/skills/sample-skill/fixtures/SKILL.md"
 mkdir -p "$tmp/repo/vendor/thing"
 printf 'not-frontmatter\n' > "$tmp/repo/vendor/thing/SKILL.md"
 out="$(bash "$VALIDATE" "$tmp/repo" 2>&1)" || fail "repo-root run exited non-zero: $out"
-printf '%s\n' "$out" | grep -q 'validating 1 skill root(s)' \
+# Pure-bash substring match, not `printf | grep -q`: grep -q exits on its first
+# hit, the producer takes SIGPIPE, and under `set -o pipefail` the SUCCESS path
+# then reports failure. Timing-dependent, so it stayed latent until this lane
+# ran concurrently (specs/037-ci-intra-job-parallel/plan.md).
+[[ "$out" == *"validating 1 skill root(s)"* ]] \
   || fail "expected exactly 1 root (nested fixture must be excluded): $out"
 
 # (2) a tree with no SKILL.md still fails loudly (exit 2, no silent green).
@@ -47,7 +51,7 @@ mkdir -p "$tmp/empty/sub/deeper"
 if out="$(bash "$VALIDATE" "$tmp/empty" 2>&1)"; then
   fail "empty tree unexpectedly passed: $out"
 fi
-printf '%s\n' "$out" | grep -q 'no_skill_roots_found' \
+[[ "$out" == *no_skill_roots_found* ]] \
   || fail "empty tree missing loud no_skill_roots_found: $out"
 
 echo "PASS: validate-skill discovers skills/<name>/SKILL.md and stays loud on empty trees"

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/SKILL.md

@@ -43,9 +43,9 @@ Use this skill to decide whether a specialized or non-functional test belongs in
 - Every critical scenario needs at least one automated assertion at the lowest layer that can prove the risk, plus real-flow smoke only when cross-boundary behavior matters; built/installed deliverables need one smoke via the published entry path (`references/e2e-real-flow-testing.md`, Published Entry Path).
 - Happy-path tests are insufficient for high-risk workflows. Build a compact risk matrix and cover the triggered failure classes — the canonical failure-class list lives in `references/scenario-testing.md`.
 - Composite / multi-stage pipelines (a capability built from several modules, services, or model stages chained together) need acceptance at three layers, not just one: **module-level** (the changed stage's own correctness, errors, latency, fallback), **chain-level** (upstream/downstream input-output contracts, version pass-through, end-to-end recovery and rollback), and **product-level** (the user-visible outcome / acceptance baseline holds). A change to one sub-module cannot pass on its local metric alone if the end-to-end product result regresses; require an end-to-end check whenever the pipeline composition or a stage contract changes. Scope and the unchanged-contract refactor exemption: `references/scenario-testing.md`. (For AI/inference pipelines the component-vs-end-to-end split and "launch follows the product baseline, not the best component metric" rule are owned by `llm-inference-integration`; this rule is the stack-agnostic testing form.)
-- Maintain a frozen regression set of real past failures (every fixed bug / incident / confirmed bad case becomes a case) and run it on **every release**, not ad hoc — "we tested that once" is not regression coverage. Tier it so the gate stays affordable and complement it with a periodic adversarial pass over code considered "done" (tiering and adversarial-pass procedure: `references/ci-fixtures-and-flake-control.md`). For AI features, the online-bad-case → regression-set re-injection mechanics are owned by `llm-inference-integration`; this rule is the general gate that the regression suite is release-blocking.
+- Maintain a frozen regression set of real past failures (every fixed bug / incident / confirmed bad case becomes a case) and run it on **every release**, not ad hoc. Tier it so the gate stays affordable, plus a periodic adversarial pass over code considered "done" (tiering and adversarial-pass procedure: `references/ci-fixtures-and-flake-control.md`). For AI features, the online-bad-case → regression-set re-injection mechanics are owned by `llm-inference-integration`; the release-blocking gate stays here.
 - Use the repository's own test wrapper when it exists; it encodes env, codegen, fixture, timeout, and CI parity.
-- Use the right test double: stub to supply inputs, fake to emulate dependency behavior, and spy/mock to verify interaction only when the interaction is the contract; double the expensive/nondeterministic/unsafe/privileged/unavailable boundary and keep the rest real on isolated test-owned resources (`references/test-code-authoring-patterns.md` §5).
+- Use the right test double: stub to supply inputs, fake to emulate dependency behavior, and spy/mock to verify interaction only when the interaction is the contract; double the expensive/nondeterministic/unsafe/privileged/unavailable boundary and keep the rest real on isolated test-owned resources (`references/test-code-authoring-patterns.md` §5; external-provider recovery paths: `references/ci-fixtures-and-flake-control.md`, Fault-Injection Layers).
 - Use integration tests where mocks would hide contract, transaction, serialization, permission, data-shape, or runtime failures.
 - Use E2E only for critical user/caller workflows and release confidence, not every branch through the browser.
 - A passing test must assert the outcome. Clicking a button, calling an endpoint, or seeing status 200 is not enough. **Every property a test NAMES — in ANY name a reader or a runner sees: the function name, a docstring or comment, and equally an `it(...)`/`describe(...)` title, a Gherkin scenario name, a pytest parameter id, or a subtest/table-case label (`..._is_bijective`, `..._is_pinned`, "rejects out-of-range input") — is a claim, and each named property owes a killing mutation: the concrete implementation change that would make this test fail.**

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/ci-fixtures-and-flake-control.md

@@ -4,7 +4,7 @@
 
 Use layered gates:
 
-- Fast PR gate: format, compile/typecheck, lint/static checks, focused unit tests, deterministic codegen clean check.
+- Fast PR gate: format, compile/typecheck, lint/static checks, duplication and dead-code gates where configured, focused unit tests, deterministic codegen clean check.
 - Integration gate: DB/Redis/MQ/API/dependency adapter tests with stable local containers or provisioned CI infra.
 - Scenario gate: selected acceptance/risk scenarios mapped to unit, contract, integration, component, or E2E commands. Keep it small enough to diagnose failures quickly.
 - E2E/release gate: critical browser/API workflows and smoke tests in an isolated environment.
@@ -12,6 +12,8 @@ Use layered gates:
 
 Use the same command wrapper locally and in CI when feasible. If CI invokes a wrapper such as `scripts/run_tests.sh`, `scripts/dev.sh test`, `make test`, or service-local package commands, use that wrapper for local verification unless debugging a lower-level runner.
 
+Duplication and dead-code gates run with explicit configuration, not defaults: the copy-paste detector gets a minimum-token/line floor and exits non-zero, test code is excluded, and justified duplication is fenced by explicit inline ignore markers (an untracked "dedupe later" is how parallel implementations drift); an unused-export/dead-code gate runs beside it, and each finding axis gets exactly one owning tool so two gates do not contest the same class. Derived committed artifacts (generated notices, catalogs, indexes) get caught stale at the pre-commit hook — not discovered later as a test-lane failure the author no longer connects to the edit. Scope that hook's trigger to every input the generator reads, including the generator script itself. The recommended form is reject-and-instruct: the hook fails and prints the exact regeneration command, so the author reruns and stages deliberately. Auto-staging the regenerated output demands genuine atomicity over every state the hook reads or writes (staged-input identity, output worktree file, output index entry — an exclusive repository lock plus crash-safe rollback), which most hook tooling cannot guarantee; without that guarantee it silently commits or overwrites content the author did not select, so keep it out of the default path. Keep a freshness assertion over the committed tree in the test lane as the gate for everything hooks cannot see (deletions, uninstalled hooks, aborted or partial-commit drift): the hook is convenience; the test lane is the gate.
+
 ## Frozen Regression Set And Adversarial Passes
 
 Tier the frozen regression set so the gate stays affordable: deterministic frozen cases run in the blocking release gate; cases needing live infra / model calls / real indexes run in the release or pre-ramp gate with an explicit marker, owner, and timeout (do not stuff flaky live cases into the fast gate); human-review-only cases are release evidence, not mislabeled automated tests.
@@ -22,9 +24,19 @@ The proactive complement — the adversarial pass over code already considered "
 
 Use `test-data-and-determinism.md` as the canonical source for fixture shape, anonymization, data builders, golden-file normalization, and deterministic clocks/randomness/ordering.
 
+### Fault-Injection Layers For External-Provider Recovery Paths
+
+Recovery behavior against an external provider (a model API, payment/storage backend, streaming dependency) needs its fault permutations proven below the live layer. Layer the fixtures; prove each fault class at the most protocol-real layer that can still script it deterministically:
+
+- **Protocol-real fault server** (wire boundary): a scriptable in-test server speaking the provider's real HTTP/streaming protocol, where each accepted request consumes one scripted behavior from an explicit fault taxonomy — transport faults (connection reset, mid-stream disconnect, stall), protocol faults (malformed payload or stream event, wrong content type, truncated stream), and semantic faults (empty-but-successful response, rate limit, auth error, context/quota limits). The fixture stays policy-free: it never retries or interprets the policy under test, so the retry/backoff/error-mapping behavior the test observes is entirely the product's. When the product under test may retry or parallelize requests, arrival-order consumption misassigns faults to the wrong attempt — bind each scripted behavior to its intended attempt (correlation key or strict single-flight sequencing) and fail the test on unexpected, out-of-order, or unconsumed behaviors.
+- **Recorded replay** (adapter seam): reconstruct dependency responses from recorded real sessions and short-circuit the adapter, so scenario suites run keyless and deterministic. A recording cannot reconstruct every case — a thrown mid-stream error, a hang awaiting cancellation — so the replay format carries explicit override entries for those, not silent absence. Record from synthetic test accounts and non-production sessions — production or customer traffic is never a fixture source, since redaction cannot reliably scrub sensitive values from legitimate free-text fields; on top of that, capture through a schema allowlist with credentials and sensitive fields redacted before persistence (anonymization canon: `test-data-and-determinism.md`) and gate fixture commits on a secret/PII scan.
+- **Live credentialed e2e**: wiring sanity only, under the env-gated live-lane rules in Verification Report below — keyless environments skip visibly, the credentialed lane treats a missing secret as a preflight failure (never a skip), and it runs on synthetic/test-scoped credentials, tenants, and resources per those rules, never production ones.
+
+The live layer proves wiring and credentials, never the fault matrix.
+
 ## Flake Control
 
-- Replace sleeps with explicit conditions. When an assertion still depends on time, make the ORACLE a state whose existence proves the invariant — the helper process still alive, the record not yet written, the lock still held — rather than "finished within N seconds"; a wall-clock margin only holds while the runner is fast enough, so it turns into a red on a loaded runner and, worse, into a silent pass when the margin is generous. Where a fixture's own lifetime is what the assertion races (a sleeping helper, a TTL, a retention window), push that lifetime far past any plausible run so it stops being a deadline, and keep any wall-clock bound as a coarse backstop only. Sample process state, not just liveness: an unreaped zombie still answers `kill -0`, so "still running" and "already gone" both need the state check, and reap lag on a loaded runner needs a bounded grace period instead of an instantaneous sample.
+- Replace sleeps with explicit conditions. When an assertion still depends on time, make the ORACLE a state whose existence proves the invariant — the helper process still alive, the record not yet written, the lock still held — rather than "finished within N seconds"; a wall-clock margin only holds while the runner is fast enough, so it turns into a red on a loaded runner and, worse, into a silent pass when the margin is generous. Where a fixture's own lifetime is what the assertion races (a sleeping helper, a TTL, a retention window), push that lifetime far past any plausible run so it stops being a deadline, and keep any wall-clock bound as a coarse backstop only — far past, but never UNBOUNDED: the thing that normally ends such a helper is whatever the suite is testing, and when that reaper dies first (an aborted run, a cancelled job, a suspended host) the fixture's own lifetime becomes the only thing that will ever end it, so an infinite loop is how a test helper outlives the machine rather than the run. The suite also owns reaping what it started, and cannot delegate that to the component under test: a helper deliberately made signal-immune, or started in its own session/process group where a signal aimed at the suite cannot reach it, has no other reaper — trap the abort signals as well as EXIT, identify what to reap by something the run owns (its own private temp path, its recorded process groups) rather than by a shared name that would hit a concurrent lane, and prove ownership again at the moment of signalling because a pid or group id read earlier is a number the OS recycles. Assert at exit that nothing the run started is still alive: every case can pass while the process table is not clean, so a green suite is not the acceptance object here. Sample process state, not just liveness: an unreaped zombie still answers `kill -0`, so "still running" and "already gone" both need the state check, and reap lag on a loaded runner needs a bounded grace period instead of an instantaneous sample.
 - Isolate tests by namespace, temp directory, tenant, user, DB schema, or unique id.
 - Clean up with test cleanup hooks.
 - Avoid shared global state or reset it explicitly.
@@ -43,6 +55,11 @@ Use `test-data-and-determinism.md` as the canonical source for fixture shape, an
 - Use coverage to find untested risk, not as a target to hit.
 - High line coverage with weak assertions is not safety.
 - For high-risk pure logic, consider mutation testing or equivalent assertion-strength checks.
+- A failing coverage gate names exact locations: print every uncovered statement, branch path, and function as a clickable `path:line:col` (a custom reporter when the runner's built-in failure names only the file), and print nothing when green — a gate that names only the file forces the author to re-run coverage locally just to find the gap.
+- Enforce thresholds per file rather than repo-aggregate when the goal is stopping a well-covered big file from subsidizing a bare one; the threshold value stays the team's choice (floor-not-goal and cleanup exceptions: `test-code-authoring-patterns.md` §6).
+- A platform- or capability-conditional coverage exemption derives from the same probe that makes the corresponding suites skip, so the exemption is active exactly when those tests cannot run; a hand-maintained exemption list drifts into exempting files whose tests actually run. Guard the shared probe's common-mode failure: distinguish "capability genuinely absent" from "probe errored", and a CI lane that declares the capability treats an unavailable result as a failure, never as skip-plus-exemption.
+- When instrumented runs are slow, partition the suite across parallel coverage processes and merge reports; thresholds run once against the merged report, never inside a partition (a partition sees only its slice and would false-fail). The merge validates that every expected partition reported exactly once for the current run: use a run-scoped artifact directory (cleaning only that private directory) and bind every report and the expected-partition manifest to the same run identity (run id / commit / config), so a missing, stale, foreign, or duplicate partition artifact fails the run instead of silently shrinking or backfilling the report.
+- Perf/stress/high-cardinality diagnostic suites stay outside the coverage and PR gates by config-level include inventory — a separate runner config that enumerates them — not by runtime skip marks: an inventory is auditable; skip marks rot silently (skip semantics: Verification Report below).
 
 ## Local Evidence Selection
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/e2e-real-flow-testing.md

@@ -60,6 +60,7 @@ When the deliverable ships as a built or installed artifact — a package `bin`,
 - Prefer one happy path plus high-risk negative paths over many shallow click-throughs.
 - A click-through without assertions is not E2E evidence.
 - If a scenario can be proven with a stable API/contract/integration test and only needs one browser smoke for confidence, do not duplicate all permutations in the browser.
+- External-provider fault/recovery permutations (disconnects, malformed streams, rate limits) belong at the protocol-real fault-server and recorded-replay layers (`ci-fixtures-and-flake-control.md`, Fault-Injection Layers); the live credentialed e2e keeps one wiring sanity path, not the fault matrix.
 
 ## Failure Handling
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/test-code-authoring-patterns.md

@@ -90,7 +90,7 @@ def test_export_request_returns_signed_url_when_user_has_quota():
 | **Conditional Test Logic**（Meszaros） | 测试体内有 if/else/loop | 实际测的是什么不明 |
 | **Mystery Guest**（Meszaros 子项） | 依赖外部文件/数据但未声明 | 不可复现 |
 
-**用**：code review / 重构 / 排查 flaky test 时按这清单查。Slow Test 阈值只对**默认快速单测目标**（unit 层）严卡；integration / E2E / host-smoke / benchmark 测必有独立的更宽 budget，按 marker 分离（如 `@pytest.mark.integration` / Go `-short` 区分），不混入 unit 套时间预算。
+**用**：code review / 重构 / 排查 flaky test 时按这清单查。Slow Test 阈值只对**默认快速单测目标**（unit 层）严卡；integration / E2E / host-smoke / benchmark 测必有独立的更宽 budget，按 marker 分离（如 `@pytest.mark.integration` / Go `-short` 区分）或按 runner 配置级 include 清单隔成独立套（perf/stress 类车道优先用清单——清单可审计，运行时 skip 标记会静默腐烂，见 `ci-fixtures-and-flake-control.md` Coverage As Signal），不混入 unit 套时间预算。
 
 **不用**：写新测试时不必预先记住名字 — 用 §1 §2 §7 等正面规则反过来就避开了大半。
 
@@ -235,11 +235,11 @@ internal_helper_mock.parse.assert_called_once()  # 重构改 parse 就挂
 - **不把整库平均覆盖率作 PR gate**（个别 PR 不应承担整体覆盖率波动）
 
 **落地**：
-- CI floor：仓库整体 line ≥ X%
+- CI floor：仓库整体 line ≥ X%；要防"大文件覆盖率补贴裸文件"时改用 per-file 门（阈值团队定，见 `ci-fixtures-and-flake-control.md` Coverage As Signal）
 - **PR 覆盖率不可下降原则有例外**：删冗余测试 / 移除已废弃代码 / 合并重复 fixture 等清理类 PR 覆盖率下降允许，但 PR 描述必须给 **preservation proof row**：`deleted: <test path/name>; preserved scenario: <TC-ID or behavior statement>; replacement: <test path or "still covered by <existing test>">; oracle parity: <断言形状等价说明>; evidence: <command output / report ref>`。没 row = 当作场景失守 = 阻挡。Reviewer 用 row 验证：跑 replacement test 应能 catch 删掉的 mutant；equivalent assertion 不是"两个都跑过"，是"等价业务断言"
 - critical-path 模块单独定 ratchet（如 `<critical-module> line ≥ 90% 且 branch ≥ 80%`）— 模块名按 repo 实际填
 - 用 mutation testing 周期性检查（见 source-to-case-workflows §C.1）— 比追 100% line 更省力且更真实
-- coverage 报告 + uncovered lines 进 PR comment（不要靠开发者主动看）
+- coverage 报告 + uncovered lines 进 PR comment（不要靠开发者主动看）；覆盖门失败输出指名到可点击的 `path:line:col`（runner 内建只报文件名时加自定义 reporter，绿时静默）——只报文件名等于让作者本地重跑一遍才能找到缺口
 - 覆盖门下的 uncovered line **先当删除候选、再当补测候选**：门在正确地标记死代码/不可达分支时，补一个测试只是把死代码钉死；行覆盖是必要不充分——证明行跑过了，不证明功能按交付形态工作
 
 ---