@ccoalm/ccl-skills 0.1.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_r0_status.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Integration test for the R0 clean-vs-interim landing status in
+# check-ccl-skills.sh. Proves the FINAL success token is machine-distinguishable:
+#   - private alias audit ran clean  => r0_status=private-ok   + ccl_skill_check_clean_ok
+#   - no ALIAS_AUDIT_CMD (public fallback only) => r0_status=public-fallback + ccl_skill_check_interim_ok
+#   - private alias audit FAILED     => alias_audit_failed, non-zero, no success token
+#
+# Runs the real validator against THIS repo (the worktree root), toggling only
+# ALIAS_AUDIT_CMD. It never writes to the repo (the validator is read-only) and
+# never depends on a private alias profile: the "clean" case uses the harmless
+# `true` command as a stand-in private audit, the "fail" case uses `false`.
+# It mirrors the documented `check-ccl-skills.sh .` validation command (default
+# base-ref detection); do NOT export CCL_SKILL_BASE_REF here — it would pollute
+# the evidence-card detector's own base-less self-test fixtures.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+CHECK_SCRIPT="$SCRIPT_DIR/check-ccl-skills.sh"
+# scripts -> skill-extraction-workflow -> skills -> repo root
+ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd -P)"
+[ -f "$CHECK_SCRIPT" ] || { echo "FAIL: check script not found: $CHECK_SCRIPT" >&2; exit 1; }
+[ -d "$ROOT/skills" ] || { echo "FAIL: repo root has no skills/ dir: $ROOT" >&2; exit 1; }
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+assert_rc() { [ "$1" = "$2" ] || fail "expected rc=$2 got rc=$1${3:+ ($3)}"; }
+assert_contains() { case "$2" in *"$1"*) : ;; *) fail "expected output to contain: $1${3:+ ($3)}";; esac; }
+assert_not_contains() { case "$2" in *"$1"*) fail "expected output NOT to contain: $1${3:+ ($3)}";; *) : ;; esac; }
+assert_last_line() {
+  last_line="$(printf '%s\n' "$2" | tail -n 1)"
+  [ "$last_line" = "$1" ] || fail "expected final line to be: $1; got: $last_line${3:+ ($3)}"
+}
+
+# This is an integration smoke test over the full validator, not a unit test of
+# only the R0 branch: unrelated blocking gates may fail first. If a case below
+# fails before token assertions, inspect the full validator output before chasing
+# the R0 status logic.
+
+# Case 1: ALIAS_AUDIT_CMD unset + public fallback clean => interim, exit 0.
+set +e
+out="$(env -u ALIAS_AUDIT_CMD bash "$CHECK_SCRIPT" "$ROOT" 2>&1)"
+rc=$?
+set -e
+assert_rc "$rc" 0 "unset ALIAS_AUDIT_CMD with clean diff should pass"
+assert_contains "generic_r0_leak_scan_ok" "$out" "public fallback ran"
+assert_contains "alias_audit_unavailable" "$out" "private audit flagged unavailable"
+assert_contains "r0_status=public-fallback" "$out" "machine status token (interim)"
+assert_contains "ccl_skill_check_ok" "$out" "legacy compatibility token"
+assert_contains "ccl_skill_check_interim_ok" "$out" "final interim token"
+assert_not_contains "ccl_skill_check_clean_ok" "$out" "interim run must not claim clean landing"
+assert_last_line "ccl_skill_check_interim_ok" "$out" "interim token must remain the final line"
+
+# Case 2: private audit present and passing (`true`) => clean, exit 0.
+set +e
+out="$(env ALIAS_AUDIT_CMD='true' bash "$CHECK_SCRIPT" "$ROOT" 2>&1)"
+rc=$?
+set -e
+assert_rc "$rc" 0 "passing private audit should pass"
+assert_contains "alias_audit_ok" "$out" "private audit ran clean"
+assert_contains "r0_status=private-ok" "$out" "machine status token (clean)"
+assert_contains "ccl_skill_check_ok" "$out" "legacy compatibility token"
+assert_contains "ccl_skill_check_clean_ok" "$out" "final clean-landing token"
+assert_not_contains "ccl_skill_check_interim_ok" "$out" "clean run must not claim interim"
+assert_last_line "ccl_skill_check_clean_ok" "$out" "clean token must remain the final line"
+
+# Case 3: private audit present and failing (`false`) => block, non-zero, no success token.
+set +e
+out="$(env ALIAS_AUDIT_CMD='false' bash "$CHECK_SCRIPT" "$ROOT" 2>&1)"
+rc=$?
+set -e
+[ "$rc" -ne 0 ] || fail "failing private audit must produce a non-zero exit (got rc=0)"
+assert_contains "alias_audit_failed" "$out" "audit failure reported"
+assert_not_contains "ccl_skill_check_clean_ok" "$out" "failed audit must not emit clean token"
+assert_not_contains "ccl_skill_check_interim_ok" "$out" "failed audit must not emit interim token"
+
+echo "test_check_ccl_r0_status: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_register_pending_exclusion.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# Regression tests for the register-pending <-> clean-landing mutual exclusion in
+# check-ccl-skills.sh. The prose rule ("any `pending` row blocks a
+# complete/final claim"; an `interim` checkpoint is not complete either) had no
+# machine firing point, so a run could emit the clean-landing token while a changed
+# register row was still pending/interim — the blind spot the dual-track challenge
+# caught by hand. This test proves the token is now forced to interim in that case.
+#
+# Uses ALIAS_AUDIT_CMD=true as a stand-in passing private audit so R0 is private-ok
+# (r0_status=private-ok): that isolates the pending/interim downgrade from the
+# separate R0 interim path. Clones this repo so assertions are independent of the
+# outer worktree diff.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+CHECK_SCRIPT="$SCRIPT_DIR/check-ccl-skills.sh"
+PENDING_GATE="$SCRIPT_DIR/source-register-pending-status.rb"
+[ -f "$CHECK_SCRIPT" ] || { echo "FAIL: checker not found: $CHECK_SCRIPT" >&2; exit 1; }
+[ -f "$PENDING_GATE" ] || { echo "FAIL: pending-status gate not found: $PENDING_GATE" >&2; exit 1; }
+ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd -P)"
+
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/regpending.XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+assert_rc() { [ "$1" = "$2" ] || fail "expected rc=$2 got rc=$1${3:+ ($3)}"; }
+assert_contains() { case "$2" in *"$1"*) : ;; *) fail "expected output to contain: $1${3:+ ($3)}";; esac; }
+assert_not_contains() { case "$2" in *"$1"*) fail "expected output NOT to contain: $1${3:+ ($3)}";; *) : ;; esac; }
+assert_last_line() {
+  last_line="$(printf '%s\n' "$2" | tail -n 1)"
+  [ "$last_line" = "$1" ] || fail "expected final line to be: $1; got: $last_line${3:+ ($3)}"
+}
+
+REPO="$TMP/repo"
+git clone -q "$ROOT" "$REPO"
+git -C "$REPO" config user.email test@example.invalid
+git -C "$REPO" config user.name "Test User"
+git -C "$REPO" branch fixture-base HEAD
+REGISTER="$REPO/skills/skill-extraction-workflow/references/source-register.md"
+
+new_case() {
+  git -C "$REPO" switch -q -C "$1" fixture-base
+  git -C "$REPO" branch --set-upstream-to=fixture-base "$1" >/dev/null 2>&1
+}
+commit_case() { git -C "$REPO" add -A; git -C "$REPO" commit -qm "$1"; }
+# The first case retains the full-checker wiring assertion. Remaining cases test
+# the extracted parser directly so unrelated repository scans are not repeated.
+full_check_runs=0
+gate_runs=0
+run_full_check() {
+  full_check_runs=$((full_check_runs + 1))
+  set +e
+  out="$(env -u CCL_SKILL_BASE_REF ALIAS_AUDIT_CMD='true' bash "$CHECK_SCRIPT" "$REPO" 2>&1)"
+  rc=$?
+  set -e
+}
+run_gate() {
+  gate_runs=$((gate_runs + 1))
+  set +e
+  out="$(env -u CCL_SKILL_BASE_REF ruby "$PENDING_GATE" "$REPO" 2>&1)"
+  rc=$?
+  set -e
+}
+
+# Case 1: a `pending`-status row added to the register forces interim even with a
+# clean private R0 audit (this is the RED-baseline case: before the change the run
+# emitted ccl_skill_check_clean_ok).
+new_case case-pending
+printf '| Fixture pending item | `some-owner` | behavior not yet landed | `pending` | fixture evidence |\n' >> "$REGISTER"
+commit_case "add a pending register row"
+run_full_check
+assert_rc "$rc" 0 "a pending row is a downgrade, not a hard block"
+assert_contains "r0_status=private-ok" "$out" "private audit ran clean (isolates the pending downgrade)"
+assert_contains "register_nonterminal_status_added" "$out" "checker should name the pending-row cause"
+assert_not_contains "ccl_skill_check_clean_ok" "$out" "a pending row must block the clean-landing token"
+assert_contains "ccl_skill_check_interim_ok" "$out" "the run must be forced to interim"
+assert_last_line "ccl_skill_check_interim_ok" "$out" "interim token must be the final line"
+
+# Case 2: an `interim`-status row behaves the same (interim work is not complete).
+new_case case-interim
+printf '| Fixture interim item | `some-owner` | checkpoint only | `interim` | fixture evidence |\n' >> "$REGISTER"
+commit_case "add an interim register row"
+run_gate
+assert_rc "$rc" 0 "an interim row is a downgrade, not a hard block"
+assert_contains "register_nonterminal_status_added" "$out" "an interim status row must also fire"
+assert_last_line "1" "$out" "an interim row must request the final-token downgrade"
+
+# Case 3 (control): a terminal-status row (`updated`) added to the register keeps a
+# clean landing. This proves the gate targets the status column, not any occurrence
+# of the words, and does not spuriously downgrade normal ledger appends.
+new_case case-terminal
+printf '| Fixture terminal item | `some-owner` | behavior landed | `updated` | fixture evidence |\n' >> "$REGISTER"
+commit_case "add a terminal (updated) register row"
+run_gate
+assert_rc "$rc" 0 "a terminal row with clean R0 should pass"
+assert_not_contains "register_nonterminal_status_added" "$out" "a terminal-status row must not fire the pending gate"
+assert_last_line "0" "$out" "a terminal row must preserve the clean-token eligibility"
+
+# Case 4: a capitalized `Pending` status must NOT evade the downgrade (case-fold).
+new_case case-cap-pending
+printf '| Fixture cap item | `some-owner` | not landed | `Pending` | fixture evidence |\n' >> "$REGISTER"
+commit_case "add a capitalized Pending status row"
+run_gate
+assert_contains "register_nonterminal_status_added" "$out" "a capitalized Pending must still fire"
+assert_last_line "1" "$out" "capitalized Pending must request the downgrade"
+
+# Case 5: an INDENTED table row (leading whitespace before the pipe) must not evade.
+new_case case-indented
+printf ' | Fixture indented item | `some-owner` | not landed | `pending` | fixture evidence |\n' >> "$REGISTER"
+commit_case "add an indented pending row"
+run_gate
+assert_contains "register_nonterminal_status_added" "$out" "an indented pending row must still fire"
+assert_last_line "1" "$out" "an indented pending row must request the downgrade"
+
+# Case 6 (control): a non-terminal word in a NON-status cell must NOT force interim
+# — only the status column (index 3) counts. Here status is `updated`.
+new_case case-nonstatus-word
+printf '| `pending` fixture note | `some-owner` | behavior landed | `updated` | fixture evidence |\n' >> "$REGISTER"
+commit_case "add a row with pending in a non-status cell"
+run_gate
+assert_rc "$rc" 0 "a terminal-status row should pass"
+assert_not_contains "register_nonterminal_status_added" "$out" "pending in a non-status cell must NOT fire"
+assert_last_line "0" "$out" "pending outside status must preserve clean-token eligibility"
+
+# Case 7: a MALFORMED pending row (extra unescaped pipe -> wrong column count) must
+# still fail safe (force interim) rather than slip through as clean.
+new_case case-malformed-pending
+printf '| Fixture pending with raw | pipe | `some-owner` | not landed | `pending` | fixture evidence |\n' >> "$REGISTER"
+commit_case "add a malformed (extra-pipe) pending row"
+run_gate
+assert_contains "register_nonterminal_status_added" "$out" "a malformed pending row must still fire (fail safe)"
+assert_last_line "1" "$out" "a malformed pending row must request the downgrade"
+
+assert_rc "$full_check_runs" 1 "pending suite must retain exactly one full checker wiring case"
+assert_rc "$gate_runs" 6 "remaining pending parser cases must run the standalone gate"
+
+echo "test_check_ccl_register_pending_exclusion: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+# Aggregate deterministic shell regressions for check-ccl-skills wrappers.
+#
+# Default / local layer: --fast. CI has a changes-gated job that runs --full so
+# Makefile and CI both call this single entrypoint instead of copying test lists.
+#
+# Usage:
+#   bash skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh [--fast|--full]
+#
+# --fast runs the quick/mid wrapper regressions:
+#   - test_ai_coding_implementation_gates.sh
+#   - test_controlled_escalation_pins.sh
+#   - test_check_ccl_size_budget.sh
+#   - test_check_ccl_skill_catalog.sh
+#   - test_generic_r0_leak_scan.sh
+#   - test_check_ccl_route_drift.sh
+#   - test_check_sync_pointers.sh
+#   - test_check_ccl_register_pending_exclusion.sh
+#   - test_eval_routing_bank_grader_diagnostics.sh
+#   - test_eval_routing_bank_surface_binding.sh
+#   - test_eval_routing_prose_target.sh
+#   - test_validate_skill_credential_cwd.sh
+#   - test_validate_skill_root_depth.sh
+#   - test_regression_runner_registration.sh
+# --full runs --fast plus the heavy full-checker regressions:
+#   - test_check_ccl_r0_status.sh
+#   - test_check_ccl_source_register_lifecycle.sh
+#   - test_check_ccl_impact_chain_refscripts.sh
+#   - test_register_firing_path_wiring.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || { cd "$SCRIPT_DIR/../../.." && pwd -P; })"
+SCRIPTS_DIR="$REPO_ROOT/skills/skill-extraction-workflow/scripts"
+
+usage() {
+  cat <<'EOF'
+Usage: test_check_ccl_regressions.sh [--fast|--full]
+
+Runs deterministic shell regressions for check-ccl-skills wrapper behavior.
+Default is --fast to keep local `make test` light. GitLab CI runs --full from a
+changes-gated job for public deterministic regressions.
+
+Modes:
+  --fast  the quick/mid wrapper regressions (exact set = the fast_tests array below / the list above)
+  --full  fast layer plus R0 status and source-register lifecycle regressions
+  --list-unregistered  print sibling test_*.sh NOT in fast_tests/heavy_tests (one per
+          line) and exit 0; used by the registration guard test so a new test cannot
+          silently skip CI. REGRESSION_SCRIPTS_DIR overrides the scanned directory.
+EOF
+}
+
+mode="fast"
+case "${1:-}" in
+  ""|--fast) mode="fast" ;;
+  --full) mode="full" ;;
+  --list-unregistered) mode="list-unregistered" ;;
+  -h|--help) usage; exit 0 ;;
+  *) usage >&2; exit 2 ;;
+esac
+
+if [ "$#" -gt 1 ]; then
+  usage >&2
+  exit 2
+fi
+
+run_test() {
+  local test_name="$1"
+  local test_path="$SCRIPTS_DIR/$test_name"
+  local started_at ended_at rc
+  [ -f "$test_path" ] || { echo "FAIL: missing regression test: $test_path" >&2; exit 1; }
+  started_at="$(date +%s)"
+  if bash "$test_path"; then
+    rc=0
+  else
+    rc=$?
+  fi
+  ended_at="$(date +%s)"
+  echo "regression_test_timing: test=$test_name seconds=$((ended_at - started_at)) status=$rc"
+  return "$rc"
+}
+
+fast_tests=(
+  test_ai_coding_implementation_gates.sh
+  # Reproducible RED-baseline for the controlled-escalation pin family: parses
+  # family 8 out of the fixture above and proves each pin reds under its own
+  # applied deletion mutation in a throwaway copy (spec 031 review disposition).
+  test_controlled_escalation_pins.sh
+  test_check_ccl_size_budget.sh
+  test_check_ccl_skill_catalog.sh
+  test_check_mr_target_freshness.sh
+  test_generic_r0_leak_scan.sh
+  test_check_ccl_route_drift.sh
+  test_check_sync_pointers.sh
+  test_check_ccl_register_pending_exclusion.sh
+  test_register_firing_path_resolution.sh
+  # Merge-time containment for the gate's date dependency; the deep three-leg
+  # differential stays in the heavy suite, but a require-date regression must
+  # go RED in every `make test`, not only under --full.
+  test_impact_chain_gate_dateless_host.sh
+  test_eval_routing_bank_grader_diagnostics.sh
+  test_eval_routing_bank_surface_binding.sh
+  test_eval_routing_prose_target.sh
+  test_validate_skill_credential_cwd.sh
+  test_validate_skill_root_depth.sh
+  test_validate_skill_cross_refs.sh
+  test_git_identity_predicate_gate.sh
+  test_regression_runner_registration.sh
+  test_routing_pointer_integrity.sh
+  test_routing_bank_integrity.sh
+  test_governing_chain_diff.sh
+  # Owned by another skill package; run_test resolves it relative to SCRIPTS_DIR.
+  # Registered here because this runner is the repo's only regression lane —
+  # a skill-local test left unregistered is the false-green this file guards.
+  ../../testing-strategy/scripts/test_mutation_backup_recipe.sh
+)
+
+heavy_tests=(
+  test_check_ccl_r0_status.sh
+  test_check_ccl_source_register_lifecycle.sh
+  # Clones the whole repo once; impact-chain cases call the standalone gate and
+  # retain one full-checker wiring case. Still kept out of the pre-commit lane.
+  test_check_ccl_impact_chain_refscripts.sh
+  # Same reason: clones the repo and drives the full checker TWICE (~26s, the
+  # slowest entry the lane had). Its sibling
+  # `test_register_firing_path_resolution.sh` keeps the gate's behaviour in the
+  # fast lane; this one only proves the checker WIRING, which cannot drift from a
+  # local edit without also changing the checker. CI runs `--full`, so moving it
+  # here costs no enforcement — it only stops charging every pre-commit run for a
+  # repo clone, and stops a slow entry competing for the runner host.
+  test_register_firing_path_wiring.sh
+)
+
+# Registration self-audit: every sibling test_*.sh must appear in fast_tests or
+# heavy_tests, else CI silently skips it (a false-green — the class that let
+# test_validate_skill_credential_cwd.sh ship unrun). Compute the gap here so both
+# --list-unregistered (for the guard test) and the normal-run advisory share it.
+# REGRESSION_SCRIPTS_DIR overrides the scanned dir so the guard test can point at
+# a fixture. Bash 3.2-safe (string-set membership, no associative arrays).
+self_name="$(basename "$0")"
+audit_dir="${REGRESSION_SCRIPTS_DIR:-$SCRIPTS_DIR}"
+registered=" ${fast_tests[*]} ${heavy_tests[*]} "
+unregistered=""
+for audit_f in "$audit_dir"/test_*.sh; do
+  [ -e "$audit_f" ] || continue           # literal glob when no match
+  audit_b="$(basename "$audit_f")"
+  [ "$audit_b" = "$self_name" ] && continue   # the runner never registers itself
+  case "$registered" in *" $audit_b "*) continue ;; esac
+  unregistered="$unregistered $audit_b"
+done
+unregistered="${unregistered# }"
+
+if [ "$mode" = "list-unregistered" ]; then
+  [ -n "$unregistered" ] && printf '%s\n' $unregistered
+  exit 0
+fi
+
+for test_name in "${fast_tests[@]}"; do
+  run_test "$test_name"
+done
+
+if [ "$mode" = "full" ]; then
+  for test_name in "${heavy_tests[@]}"; do
+    run_test "$test_name"
+  done
+  echo "test_check_ccl_regressions_full_ok"
+else
+  echo "test_check_ccl_regressions_fast_ok"
+fi
+
+if [ -n "$unregistered" ]; then
+  echo "regression_runner_unregistered_tests_advisory: not in fast_tests/heavy_tests, CI will NOT run them:$unregistered" >&2
+fi