@ccoalm/ccl-skills 0.1.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_controlled_escalation_pins.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# Self-contained RED-baseline for the controlled-escalation pin family (family 8
+# in test_ai_coding_implementation_gates.sh). Review rounds ua4/ua5 (spec 031)
+# found that prose claims of mutation evidence are unverifiable from a bounded
+# review packet; this test makes the walk reproducible in CI and visible in the
+# diff: for EVERY family-8 pin, an applied deletion mutation in a throwaway copy
+# must red the fixture on that pin's own assertion (differential attribution —
+# the fixture exits at first failure, so every earlier assertion passed under
+# the mutant), with green unmutated controls before and after and a
+# tree-isolation probe proving the harness read the mutated copy, not the live
+# tree. The pin list is parsed from the fixture itself so a new pin cannot be
+# added without automatically entering this walk.
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+repo_root="$(cd "$script_dir/../../.." && pwd -P)"
+fixture_rel="skills/skill-extraction-workflow/scripts/test_ai_coding_implementation_gates.sh"
+ref_rel="skills/skill-extraction-workflow/references/source-to-skill-extraction.md"
+
+fail() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
+
+tmp_root="$(mktemp -d "${TMPDIR:-/tmp}/controlled-escalation-pins.XXXXXX")"
+trap 'rm -rf "$tmp_root"' EXIT
+# The fixture asserts only on files under skills/, and derives its repo root
+# from its own location three levels up — copying skills/ preserves both.
+cp -R "$repo_root/skills" "$tmp_root/skills"
+copy_fixture="$tmp_root/$fixture_rel"
+copy_ref="$tmp_root/$ref_rel"
+[[ -f "$copy_fixture" && -f "$copy_ref" ]] || fail "copy is missing the fixture or the reference"
+
+# Parse family-8 pins out of the fixture: each call is
+#   assert_in_section "$EXTRACTION_METHOD_REF" "$BLOCKED_VERIFICATION_SECTION" <quoted phrase> \
+#     "<label>"
+# The phrase may be single- or double-quoted (one pin contains an apostrophe).
+pins_file="$tmp_root/pins.tsv"
+python3 - "$repo_root/$fixture_rel" "$pins_file" <<'PY'
+import re, sys
+src, out = sys.argv[1], sys.argv[2]
+text = open(src).read()
+pattern = re.compile(
+    r'assert_in_section "\$EXTRACTION_METHOD_REF" "\$BLOCKED_VERIFICATION_SECTION" '
+    r"(?:'([^']+)'|\"([^\"]+)\") \\\n\s+\"([^\"]+)\"",
+)
+rows = []
+for m in pattern.finditer(text):
+    phrase = m.group(1) or m.group(2)
+    rows.append((phrase, m.group(3)))
+if len(rows) < 14:
+    sys.exit(f"parsed only {len(rows)} family-8 pins; parser or fixture drifted")
+with open(out, "w") as f:
+    for phrase, label in rows:
+        f.write(f"{phrase}\t{label}\n")
+print(len(rows))
+PY
+pin_count="$(wc -l < "$pins_file" | tr -d ' ')"
+# Parser-completeness check (round ua21 P2): the regex must account for EVERY
+# family-8 assertion in the fixture — a call whose syntax the regex does not
+# recognize would silently drop out of the walk. The raw call count is the
+# oracle the parse must match.
+raw_count="$(grep -c 'assert_in_section "\$EXTRACTION_METHOD_REF" "\$BLOCKED_VERIFICATION_SECTION"' "$repo_root/$fixture_rel")"
+[[ "$pin_count" == "$raw_count" ]] || fail "parser dropped family-8 assertions: parsed $pin_count of $raw_count calls"
+
+run_copy() { bash "$copy_fixture" 2>&1; }
+
+# Control: the unmutated copy is green, proving the harness reads the copy.
+control_out="$(run_copy)" || fail "pre-control not green: $control_out"
+
+pristine="$tmp_root/ref.pristine"
+cp "$copy_ref" "$pristine"
+
+while IFS=$'\t' read -r phrase label; do
+  count="$(python3 - "$pristine" "$phrase" <<'PY'
+import sys
+print(open(sys.argv[1]).read().count(sys.argv[2]))
+PY
+)"
+  [[ "$count" == "1" ]] || fail "pin phrase not unique in reference ($count hits): $phrase"
+  python3 - "$pristine" "$copy_ref" "$phrase" <<'PY'
+import sys
+src, dst, phrase = sys.argv[1], sys.argv[2], sys.argv[3]
+open(dst, "w").write(open(src).read().replace(phrase, "", 1))
+PY
+  if out="$(run_copy)"; then
+    fail "mutant stayed green (deleted: $phrase)"
+  fi
+  last="$(printf '%s\n' "$out" | tail -1)"
+  case "$last" in
+    *"$label"*) : ;;
+    *) fail "mutant red on the wrong assertion — expected [$label], got: $last" ;;
+  esac
+  cp "$pristine" "$copy_ref"
+done < "$pins_file"
+
+# Relocation probe (round ua8 P2): a deletion mutant cannot distinguish a
+# section-bound helper from a whole-file grep. Move the lead phrase OUT of the
+# Blocked Verification section to a decoy heading at the end of the file: a
+# whole-file search would stay green, a section-bound one must red on the
+# owning assertion.
+python3 - "$pristine" "$copy_ref" <<'PY'
+import sys
+src, dst = sys.argv[1], sys.argv[2]
+phrase = "Sandbox-denial triage precedes any escalation"
+text = open(src).read()
+assert text.count(phrase) == 1
+open(dst, "w").write(text.replace(phrase, "", 1) + "\n## Relocation decoy\n\n" + phrase + "\n")
+PY
+if out="$(run_copy)"; then
+  fail "relocation probe: section-bound assertion stayed green with the phrase outside its section"
+fi
+case "$(printf '%s\n' "$out" | tail -1)" in
+  *"controlled escalation (invariant: triage before escalation"*) : ;;
+  *) fail "relocation probe: red on the wrong assertion: $(printf '%s\n' "$out" | tail -1)" ;;
+esac
+cp "$pristine" "$copy_ref"
+
+# Reachability probe (round ua15 P2): family 8 also carries an
+# assert_same_bullet pin routing the entrypoint to the owning section; that pin
+# is not an assert_in_section call, so it gets its own applied mutation here —
+# strip the section anchor from the entrypoint bullet and require the fixture
+# to red on the reachability assertion.
+copy_skill="$tmp_root/skills/skill-extraction-workflow/SKILL.md"
+skill_pristine="$tmp_root/skill.pristine"
+cp "$copy_skill" "$skill_pristine"
+python3 - "$skill_pristine" "$copy_skill" <<'PY'
+import sys
+src, dst = sys.argv[1], sys.argv[2]
+anchor = "references/source-to-skill-extraction.md#blocked-verification-and-source-read-remediation"
+text = open(src).read()
+if anchor not in text:
+    sys.exit("entrypoint anchor not found; reachability probe cannot run")
+open(dst, "w").write(text.replace(anchor, "references/source-to-skill-extraction.md", 1))
+PY
+if out="$(run_copy)"; then
+  fail "reachability probe: fixture stayed green with the entrypoint route removed"
+fi
+case "$(printf '%s\n' "$out" | tail -1)" in
+  *"reachability: entrypoint routes to the Blocked Verification section"*) : ;;
+  *) fail "reachability probe: red on the wrong assertion: $(printf '%s\n' "$out" | tail -1)" ;;
+esac
+cp "$skill_pristine" "$copy_skill"
+
+# Post-control green, and tree isolation: a mutated copy reds while the live
+# tree's own fixture stays green.
+run_copy >/dev/null || fail "post-control not green"
+python3 - "$pristine" "$copy_ref" <<'PY'
+import sys
+src, dst = sys.argv[1], sys.argv[2]
+open(dst, "w").write(open(src).read().replace("Sandbox-denial triage precedes any escalation", "", 1))
+PY
+if run_copy >/dev/null; then fail "tree-isolation probe: mutated copy stayed green"; fi
+bash "$repo_root/$fixture_rel" >/dev/null || fail "tree-isolation probe: live tree fixture not green"
+cp "$pristine" "$copy_ref"
+
+echo "test_controlled_escalation_pins: ok ($pin_count applied mutations, each red on its owning assertion; controls green)"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_bank_grader_diagnostics.sh

@@ -0,0 +1,190 @@
+#!/usr/bin/env bash
+# Regression test for eval-routing-bank grader failure diagnostics. Uses a fake
+# claude earlier in PATH so this never invokes a real Claude CLI or account.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+EVAL_SCRIPT="$SCRIPT_DIR/eval-routing-bank.rb"
+[ -f "$EVAL_SCRIPT" ] || { echo "FAIL: eval script not found: $EVAL_SCRIPT" >&2; exit 1; }
+
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/eval-routing-bank-diagnostics.XXXXXX")"
+GRADER_PID_FILE="$TMP/grader.pid"
+export GRADER_PID_FILE
+cleanup() {
+  stray="$(cat "$GRADER_PID_FILE" 2>/dev/null || true)"
+  [ -z "$stray" ] || kill -KILL "$stray" 2>/dev/null || true
+  rm -rf "$TMP"
+}
+trap cleanup EXIT
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+assert_contains() { case "$2" in *"$1"*) : ;; *) fail "expected output to contain: $1${3:+ ($3)}";; esac; }
+
+REPO="$TMP/repo"
+FAKE_BIN="$TMP/bin"
+mkdir -p "$REPO/skills/testing-strategy" "$REPO/eval" "$FAKE_BIN"
+
+git -C "$TMP" init -q repo
+git -C "$REPO" config user.email test@example.invalid
+git -C "$REPO" config user.name "Test User"
+
+cat > "$REPO/skills/testing-strategy/SKILL.md" <<'EOF'
+---
+description: Use when choosing test layers and regression evidence.
+---
+# Testing Strategy
+EOF
+
+cat > "$REPO/eval/routing-tasks.jsonl" <<'EOF'
+{"id":"fake-claude-auth","utterance":"补一个回归测试","expected_skill":"testing-strategy","frozen_at_sha":""}
+EOF
+
+git -C "$REPO" add -A
+git -C "$REPO" commit -qm "fixture"
+
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+printf 'Not logged in · Please run /login\n'
+exit 1
+EOF
+chmod +x "$FAKE_BIN/claude"
+
+json_path="$TMP/report.json"
+# Deliberately generous timeout: this case exercises the grader-EXIT diagnostic,
+# not the timeout guard. A tight bound here only buys a load-sensitive red — the
+# fake grader exits immediately, so the guard has nothing to bound.
+set +e
+out="$(PATH="$FAKE_BIN:$PATH" ruby "$EVAL_SCRIPT" "$REPO" --json "$json_path" --timeout 60 2>&1)"
+rc=$?
+set -e
+
+[ "$rc" = 3 ] || fail "expected all-grader-errors rc=3, got rc=$rc; output: $out"
+assert_contains "Not logged in" "$out" "stdout diagnostic should appear in human output"
+[ -f "$json_path" ] || fail "expected JSON report to be written"
+json="$(ruby -rjson -e 'print JSON.parse(File.read(ARGV[0])).dig("results", 0, "error")' "$json_path")"
+assert_contains "Not logged in" "$json" "stdout diagnostic should appear in JSON error field"
+
+# A grader that outlives the hard timeout must be reported as a grader error, not
+# crash the eval. The guard closes the reader pipes to unblock them; a reader that
+# dies of that close gets re-raised by join and aborts the run (exit 1, no report).
+# The guard also has to BOUND the run and terminate the grader: a run that merely
+# reports the timeout after waiting out the grader would satisfy the diagnostics
+# below while the hang the guard exists to prevent still happened. The fake sleeps
+# far longer than the assertions allow, so "waited it out" cannot read as green.
+timeout_json="$TMP/report-timeout.json"
+timeout_log="$TMP/report-timeout.log"
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$$" >"$GRADER_PID_FILE"
+exec sleep 300
+EOF
+chmod +x "$FAKE_BIN/claude"
+
+timeout_started_at="$(date +%s)"
+set +e
+PATH="$FAKE_BIN:$PATH" ruby "$EVAL_SCRIPT" "$REPO" --json "$timeout_json" --timeout 1 >"$timeout_log" 2>&1 &
+eval_pid=$!
+# Independent watchdog: without it an unbounded guard would park this test for the
+# grader's whole lifetime instead of failing.
+eval_deadline="$(( timeout_started_at + 60 ))"
+eval_watchdog_fired=0
+while kill -0 "$eval_pid" 2>/dev/null; do
+  if [ "$(date +%s)" -ge "$eval_deadline" ]; then
+    eval_watchdog_fired=1
+    kill -KILL "$eval_pid" 2>/dev/null || true
+    break
+  fi
+  sleep 1
+done
+wait "$eval_pid"
+timeout_rc=$?
+set -e
+timeout_out="$(cat "$timeout_log" 2>/dev/null || true)"
+timeout_elapsed="$(( $(date +%s) - timeout_started_at ))"
+
+[ "$eval_watchdog_fired" = 0 ] || fail "a 1s grader timeout must bound the run; it was still going after ${timeout_elapsed}s (grader sleeps 300s); output: $timeout_out"
+[ "$timeout_rc" = 3 ] || fail "expected timed-out grader to report rc=3, got rc=$timeout_rc; output: $timeout_out"
+
+# The grader itself must be terminated, not merely abandoned mid-sleep.
+grader_pid="$(cat "$GRADER_PID_FILE" 2>/dev/null || true)"
+[ -n "$grader_pid" ] || fail "fixture did not record the grader pid; the termination assertion below would be vacuous"
+grader_gone=0
+grader_wait_deadline="$(( $(date +%s) + 10 ))"
+while :; do
+  if ! kill -0 "$grader_pid" 2>/dev/null; then grader_gone=1; break; fi
+  case "$(ps -o stat= -p "$grader_pid" 2>/dev/null || true)" in
+    *Z*) grader_gone=1; break ;;
+  esac
+  [ "$(date +%s)" -ge "$grader_wait_deadline" ] && break
+  sleep 1
+done
+[ "$grader_gone" = 1 ] || fail "a timed-out grader must be terminated, not left running (pid=$grader_pid)"
+case "$timeout_out" in
+  *"terminated with exception"*|*"stream closed in another thread"*)
+    fail "grader timeout must not surface a reader-thread crash; output: $timeout_out" ;;
+esac
+assert_contains "grader_timeout_1s" "$timeout_out" "timeout diagnostic should appear in human output"
+[ -f "$timeout_json" ] || fail "expected JSON report to be written for a timed-out grader"
+timeout_error="$(ruby -rjson -e 'print JSON.parse(File.read(ARGV[0])).dig("results", 0, "error")' "$timeout_json")"
+[ "$timeout_error" = "grader_timeout_1s" ] || fail "expected JSON error grader_timeout_1s, got: $timeout_error"
+
+# Malformed grader output is re-asked, never interpreted. A response whose
+# rationale carries an unescaped quote is invalid JSON; the parser refuses it and
+# the task is retried, so a one-off formatting slip still produces a measured
+# observation without anything reading a verdict out of broken text.
+retry_json="$TMP/report-retry-parse.json"
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+if [ -f "$GRADER_PID_FILE.parsed" ]; then
+  printf '%s\n' '{"selected_skill": "testing-strategy", "confidence": 0.9, "rationale_short": "second call"}'
+  exit 0
+fi
+: > "$GRADER_PID_FILE.parsed"
+printf '%s\n' '{"selected_skill": "testing-strategy", "confidence": 0.95, "rationale_short": "局部重构（"某文件"）"}'
+EOF
+chmod +x "$FAKE_BIN/claude"
+rm -f "$GRADER_PID_FILE.parsed"
+set +e
+retry_out="$(PATH="$FAKE_BIN:$PATH" ruby "$EVAL_SCRIPT" "$REPO" --json "$retry_json" --timeout 60 2>&1)"
+retry_rc=$?
+set -e
+[ "$retry_rc" = 0 ] || fail "one unparseable response must be retried, not recorded as unmeasured; rc=$retry_rc out=$retry_out"
+retry_status="$(ruby -rjson -e 'print JSON.parse(File.read(ARGV[0])).dig("results", 0, "status")' "$retry_json")"
+[ "$retry_status" = "PASS" ] || fail "expected the retried task to be graded, got: $retry_status"
+
+# Output that stays malformed must stay UNMEASURED. These are the shapes a repair
+# path would have read as a verdict: field-shaped prose that merely ends in a
+# brace, and an object cut off mid-string. Neither may ever become an observation.
+for shape in prose truncated; do
+  bad_json="$TMP/report-bad-$shape.json"
+  case "$shape" in
+    prose)     payload='grader note: "selected_skill": "testing-strategy" }' ;;
+    truncated) payload='{"selected_skill": "testing-strategy", "confidence": 0.9, "rationale_short": "cut off mid' ;;
+  esac
+  printf '#!/usr/bin/env bash\nprintf %%s %s\n' "'$payload'" > "$FAKE_BIN/claude"
+  chmod +x "$FAKE_BIN/claude"
+  set +e
+  bad_out="$(PATH="$FAKE_BIN:$PATH" ruby "$EVAL_SCRIPT" "$REPO" --json "$bad_json" --timeout 60 2>&1)"
+  bad_rc=$?
+  set -e
+  [ "$bad_rc" = 3 ] || fail "$shape output must stay unmeasured, not become a verdict; rc=$bad_rc out=$bad_out"
+  bad_status="$(ruby -rjson -e 'print JSON.parse(File.read(ARGV[0])).dig("results", 0, "status")' "$bad_json")"
+  [ "$bad_status" = "ERROR" ] || fail "expected $shape output to stay ERROR, got: $bad_status"
+done
+
+# A grader that hangs twice still reports the timeout rather than a verdict.
+twice_json="$TMP/report-timeout-twice.json"
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$$" >"$GRADER_PID_FILE"
+exec sleep 300
+EOF
+chmod +x "$FAKE_BIN/claude"
+set +e
+twice_out="$(PATH="$FAKE_BIN:$PATH" ruby "$EVAL_SCRIPT" "$REPO" --json "$twice_json" --timeout 1 2>&1)"
+twice_rc=$?
+set -e
+[ "$twice_rc" = 3 ] || fail "a grader that hangs on both attempts must stay unmeasured; rc=$twice_rc"
+assert_contains "grader_timeout_1s" "$twice_out" "a doubly-timed-out task should still report the timeout"
+
+echo "test_eval_routing_bank_grader_diagnostics: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_bank_surface_binding.sh

@@ -0,0 +1,178 @@
+#!/usr/bin/env bash
+# Regression test for eval-routing-bank's routing_surface self-identification:
+# every emitted report must name the exact surface it graded — the raw
+# description-line surface (byte-compatible with the binding wrapper's
+# surface_hash), a per-skill description-line hash map, the graded catalog
+# text's own hash (post desc-budget truncation), and the bank bytes — so a
+# round artifact can never be attributed to the wrong wording by operator
+# assertion alone. Uses a fake claude earlier in PATH; never invokes a real
+# Claude CLI or account. Grading semantics must be untouched.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+EVAL_SCRIPT="$SCRIPT_DIR/eval-routing-bank.rb"
+[ -f "$EVAL_SCRIPT" ] || { echo "FAIL: eval script not found: $EVAL_SCRIPT" >&2; exit 1; }
+
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/eval-routing-bank-surface.XXXXXX")"
+cleanup() { rm -rf "$TMP"; }
+trap cleanup EXIT
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+REPO="$TMP/repo"
+FAKE_BIN="$TMP/bin"
+mkdir -p "$REPO/skills/testing-strategy" "$REPO/skills/product-rd-workflow" "$REPO/eval" "$FAKE_BIN"
+
+git -C "$TMP" init -q repo
+git -C "$REPO" config user.email test@example.invalid
+git -C "$REPO" config user.name "Test User"
+
+cat > "$REPO/skills/testing-strategy/SKILL.md" <<'EOF'
+---
+description: Use when choosing test layers and regression evidence.
+---
+# Testing Strategy
+EOF
+
+cat > "$REPO/skills/product-rd-workflow/SKILL.md" <<'EOF'
+---
+description: Use as the product delivery entry router for features and specs.
+---
+# Product RD Workflow
+EOF
+
+cat > "$REPO/eval/routing-tasks.jsonl" <<'EOF'
+{"id":"surface-case","utterance":"补一个回归测试","expected_skill":"testing-strategy","frozen_at_sha":""}
+EOF
+
+git -C "$REPO" add -A
+git -C "$REPO" commit -qm "fixture"
+
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+cat >/dev/null
+printf '{"selected_skill": "testing-strategy", "confidence": 0.9, "rationale_short": "stub"}\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+
+report1="$TMP/report1.json"
+report2="$TMP/report2.json"
+set +e
+out1="$(PATH="$FAKE_BIN:$PATH" ruby "$EVAL_SCRIPT" "$REPO" --json "$report1" --timeout 60 2>&1)"
+rc1=$?
+out2="$(PATH="$FAKE_BIN:$PATH" ruby "$EVAL_SCRIPT" "$REPO" --json "$report2" --timeout 60 --desc-budget-chars 10 2>&1)"
+rc2=$?
+set -e
+[ "$rc1" = "0" ] || fail "plain arm exited $rc1: $out1"
+[ "$rc2" = "0" ] || fail "budget arm exited $rc2: $out2"
+
+REPO_DIR="$REPO" python3 - "$report1" "$report2" <<'PYEOF'
+import hashlib, json, os, sys, glob
+
+report1 = json.load(open(sys.argv[1]))
+report2 = json.load(open(sys.argv[2]))
+repo = os.environ["REPO_DIR"]
+
+def fail(msg):
+    print("FAIL: " + msg, file=sys.stderr)
+    sys.exit(1)
+
+rs1 = report1.get("routing_surface")
+if not isinstance(rs1, dict):
+    fail("report has no routing_surface object")
+
+# Grading semantics untouched: the stub grader's verdict still lands as PASS.
+if report1["results"][0]["status"] != "PASS":
+    fail("grading changed: expected PASS, got %r" % report1["results"][0]["status"])
+
+bank_bytes = open(os.path.join(repo, "eval", "routing-tasks.jsonl"), "rb").read()
+if rs1.get("bank_sha256") != hashlib.sha256(bank_bytes).hexdigest():
+    fail("bank_sha256 does not match the bank file bytes")
+
+# Recompute the wrapper-compatible surface: dir-name-tagged raw description
+# lines in sorted glob order (line bytes include the trailing newline, matching
+# `grep -m1 '^description:'` piped output), then the bank bytes.
+surface = b""
+expected_per_skill = {}
+for path in sorted(glob.glob(os.path.join(repo, "skills", "*", "SKILL.md"))):
+    name = os.path.basename(os.path.dirname(path))
+    line = None
+    with open(path, "rb") as f:
+        for l in f:
+            if l.startswith(b"description:"):
+                line = l
+                break
+    if line is None:
+        continue
+    surface += name.encode() + b"\t" + line
+    expected_per_skill[name] = hashlib.sha256(line).hexdigest()
+if rs1.get("descriptions_sha256") != hashlib.sha256(surface + bank_bytes).hexdigest():
+    fail("descriptions_sha256 does not match the wrapper-compatible surface bytes")
+
+per_skill = rs1.get("per_skill_description_line_sha256")
+if per_skill != expected_per_skill:
+    fail("per_skill_description_line_sha256 mismatch: got %r expected %r" % (per_skill, expected_per_skill))
+
+if not rs1.get("catalog_sha256"):
+    fail("catalog_sha256 missing or empty")
+
+rs2 = report2.get("routing_surface")
+if not isinstance(rs2, dict):
+    fail("budget-arm report has no routing_surface object")
+if rs2.get("catalog_sha256") == rs1.get("catalog_sha256"):
+    fail("desc-budget truncation must change catalog_sha256")
+if rs2.get("descriptions_sha256") != rs1.get("descriptions_sha256"):
+    fail("desc-budget truncation must NOT change the raw descriptions_sha256")
+print("surface binding assertions ok")
+PYEOF
+
+# The multiline-description differential (both review lanes' finding): editing a
+# `description: >-` CONTINUATION line changes what the grader sees but not the
+# raw first line, so descriptions_sha256 must stay UNCHANGED (the documented
+# raw-surface blind spot) while catalog_sha256 must CHANGE — which is exactly
+# why the graded-catalog binding is load-bearing on its own and the round
+# wrapper cross-checks it independently.
+mkdir -p "$REPO/skills/platform-observability"
+cat > "$REPO/skills/platform-observability/SKILL.md" <<'EOF'
+---
+description: >-
+  Use when wiring service logs and metrics.
+  Continuation line one for the multiline fixture.
+---
+# Platform Observability
+EOF
+
+report3="$TMP/report3.json"
+report4="$TMP/report4.json"
+set +e
+out3="$(PATH="$FAKE_BIN:$PATH" ruby "$EVAL_SCRIPT" "$REPO" --json "$report3" --timeout 60 2>&1)"
+rc3=$?
+set -e
+[ "$rc3" = "0" ] || fail "multiline baseline arm exited $rc3: $out3"
+
+perl -pi -e 's/Continuation line one for the multiline fixture\./Continuation line one, materially reworded\./' "$REPO/skills/platform-observability/SKILL.md"
+
+set +e
+out4="$(PATH="$FAKE_BIN:$PATH" ruby "$EVAL_SCRIPT" "$REPO" --json "$report4" --timeout 60 2>&1)"
+rc4=$?
+set -e
+[ "$rc4" = "0" ] || fail "multiline mutated arm exited $rc4: $out4"
+
+python3 - "$report3" "$report4" <<'PYEOF'
+import json, sys
+
+r3 = json.load(open(sys.argv[1]))["routing_surface"]
+r4 = json.load(open(sys.argv[2]))["routing_surface"]
+
+def fail(msg):
+    print("FAIL: " + msg, file=sys.stderr)
+    sys.exit(1)
+
+if r3["descriptions_sha256"] != r4["descriptions_sha256"]:
+    fail("editing a continuation line must NOT change the raw descriptions_sha256 (that blind spot is documented, not fixed here)")
+if r3["catalog_sha256"] == r4["catalog_sha256"]:
+    fail("editing a continuation line MUST change catalog_sha256 — the graded-catalog binding is load-bearing")
+print("multiline differential assertions ok")
+PYEOF
+
+echo "test_eval_routing_bank_surface_binding: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_prose_target.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Regression test for the prose_redirect_target ADVISORY in eval-routing.rb.
+#
+# A Skip redirect that names an "owner"/"reviewer" but resolves to no backticked
+# installed skill is an unresolvable prose dead-end — the exact class that let
+# grill-me's "→ the adversarial or delete-code review owner" slip past the gate
+# (the arrow regex captured bare "the" and dropped it as generic English). The
+# finding is ADVISORY: reported, NEVER blocks.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+EVAL="$SCRIPT_DIR/eval-routing.rb"
+[ -f "$EVAL" ] || { echo "FAIL: eval-routing.rb not found: $EVAL" >&2; exit 1; }
+command -v ruby >/dev/null 2>&1 || { echo "test_eval_routing_prose_target: SKIP (ruby unavailable)"; exit 0; }
+
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/proseadv.XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+# A resolvable owner: the clause carries a backticked installed skill -> must NOT fire.
+mkdir -p "$TMP/skills/resolvable"
+cat > "$TMP/skills/resolvable/SKILL.md" <<'EOF'
+---
+name: resolvable
+description: resolvable / aaa — fixture. Skip code review → `dead-end`'s review owner; done.
+---
+body
+EOF
+
+# The dead-end: prose owner, no backticked skill -> MUST fire.
+mkdir -p "$TMP/skills/dead-end"
+cat > "$TMP/skills/dead-end/SKILL.md" <<'EOF'
+---
+name: dead-end
+description: dead-end / bbb — fixture. Skip code review → the adversarial or delete-code review owner; tests → testing.
+---
+body
+EOF
+
+# A generic non-owner bare redirect (no owner/reviewer noun) -> must NOT fire.
+mkdir -p "$TMP/skills/generic"
+cat > "$TMP/skills/generic/SKILL.md" <<'EOF'
+---
+name: generic
+description: generic / ccc — fixture. Skip implementation → the relevant stack/dev skill; done.
+---
+body
+EOF
+
+# A CHAINED redirect: a prose owner FOLLOWED by a second arrow to a backticked
+# skill. The clause must stop at the second arrow, so the prose dead-end still
+# fires (a later backticked skill must not suppress an earlier prose target).
+mkdir -p "$TMP/skills/chained"
+cat > "$TMP/skills/chained/SKILL.md" <<'EOF'
+---
+name: chained
+description: chained / ddd — fixture. Skip review → the review owner → `dead-end`; done.
+---
+body
+EOF
+
+JSON="$TMP/out.json"
+set +e
+out="$(ruby "$EVAL" "$TMP" --json "$JSON" 2>&1)"; rc=$?
+set -e
+
+# (1) Advisory NEVER blocks.
+[ "$rc" -eq 0 ] || fail "prose advisory must not block (rc=$rc)\n$out"
+[ -f "$JSON" ] || fail "no JSON report written\n$out"
+
+# (2) Fires for the dead-end skill.
+grep -q '"type": "prose_redirect_target"' "$JSON" || fail "expected a prose_redirect_target finding\n$(cat "$JSON")"
+grep -q 'dead-end skip redirect' "$JSON" || fail "dead-end skill not named in the finding\n$(cat "$JSON")"
+
+# (3) Fires for the CHAINED prose owner even though a later arrow points at a
+# backticked skill (the clause must stop at the second arrow).
+grep -q 'chained skip redirect' "$JSON" || fail "chained prose dead-end not flagged (clause spilled past the next arrow?)\n$(cat "$JSON")"
+
+# (4) No false positive on the backticked-resolvable owner or the generic
+# non-owner redirect. Grep the whole report for each skill's detail text — in
+# pretty JSON "type" and "detail" are on SEPARATE lines, so a naive
+# `grep type | grep detail` would be vacuous and always pass.
+grep -q '"resolvable skip redirect' "$JSON" && fail "false positive: backticked-resolvable owner flagged\n$(cat "$JSON")"
+grep -q '"generic skip redirect' "$JSON" && fail "false positive: generic non-owner redirect flagged\n$(cat "$JSON")"
+
+echo "test_eval_routing_prose_target: ok"