@ccoalm/ccl-skills 0.1.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/vendored-contract-drift-checklist.md

@@ -0,0 +1,64 @@
+# Vendored Contract Drift Checklist
+
+Use this table before reporting a vendored external contract or conformance drift gate result.
+
+**Scope (what counts as an external contract/conformance artifact):** API/schema/protobuf/wire-format definitions, envelope/rule catalogs, validators, or conformance fixtures vendored from an upstream source. Exclude routine dependency lockfile or digest-pin checks only when they do not vendor that content; ambiguous vendored upstream artifacts default to in-scope.
+
+## Procedure
+
+1. Enumerate scope from authoritative committed catalog, local hash/digest manifest, CI config, build/provisioning scripts, and pinned tracked-file lists; lockfiles are enumeration input only after an external contract/conformance artifact is already in scope, never a standalone trigger. A local hash/digest manifest is enough to enumerate enrolled files for a self-contained local-drift layout, but it cannot prove omitted artifacts do not exist unless paired with an exhaustive root scan whose extra/missing set is empty. If authoritative non-manifest sources prove no contract/conformance artifact and no upstream marker, mark the gate `inapplicable` with evidence pointers. Heuristic or bounded artifact-like searches may find extra candidates but never prove absence. If a catalog/pin/source marker exists but cannot be resolved, mark it `inconclusive/non-pass`.
+2. Fill an applicability ledger in the format `row | status | evidence pointer`; every row below must be `pass`, `inconclusive`, `fail`, or `inapplicable` with evidence (`fail` records a defective gate, e.g. a RED mutation that does not trigger the expected failure). An omitted applicable row is non-pass.
+3. Aggregate only from the ledger: emit an explicit `pass`, `non-pass`, or `inapplicable` verdict first; scope labels are qualifiers, never standalone results. A row may be green only when its clean pass and required RED failure evidence are both recorded. When a vendored copy exists, `local verify` and `root enumeration` must be green, while `local verify scope` must be green or inapplicable with evidence that no sibling/source path is referenced; every other applicable row must also be green. `Inconclusive` is not green; one passing row is never the overall result. An aggregate with no applicable rows is non-pass unless Step 1 proved top-level inapplicability from authoritative absence evidence. If upstream rows are inapplicable, the aggregate must include both `local-drift only` and `upstream freshness unverified`. If upstream rows are applicable but inconclusive, the aggregate must say `upstream authenticity inconclusive` and the gate is non-pass. An unlabeled or comprehensive green is non-pass.
+4. For a self-contained local-drift verify with no upstream pin, no wrapper, and no semantic layer, use a short ledger: scope, local `verify`, local `verify` scope, root enumeration, semantic layer, recipe integrity, wrapper identity, sync/setup boundary, and RED cleanup. Mark upstream compare and pin authority inapplicable by construction with evidence. The sync/setup boundary is NOT inapplicable by construction — it still applies to every verify/review run (assert the run did not fetch/install/exec-beyond-the-canonical-script/delete); only its *separate sync gate* sub-part is inapplicable when no sync gate ran.
+
+## Row guidance
+
+- local `verify`: clean pass plus RED mutation failure;
+- local `verify` scope: if the recipe references a sibling/source path, run `verify` with that path deliberately absent and record that it still passes on the vendored copy; if it fails because the source path is missing, mark this row non-pass and route as a fail-closed gate defect, not drift. If no sibling/source path is referenced, mark this sub-check inapplicable with evidence. A pass proves local copy-vs-manifest drift only, not upstream authenticity;
+- root enumeration: derive candidate roots from an authoritative committed catalog, local hash/digest manifest, or pinned upstream tracked-file list; record included, excluded, missing, extra, and outside artifact-like path dispositions. A local manifest proves enrolled-file consistency only; if it is the only source, corroborate completeness from an independent committed catalog or pinned tracked-file list, OR from an exhaustive root scan whose extra/missing set is empty; otherwise mark completeness inconclusive/non-pass;
+- semantic layer: inspect artifacts under confirmed contract roots or catalog membership; record valid+invalid evidence for semantic artifacts, or per-artifact no-semantic notes that cite the artifact format/parser checked and why no schema/semantics apply;
+- upstream compare, when an actionable committed upstream pin exists: provision the pinned upstream ref/tag, never a copied local tree; prove clean pass, RED vendored-copy mutation failure, RED changed-upstream-ref failure, and RED compare-set membership failure;
+- pin authority, when an actionable committed upstream pin exists: use a signed upstream tag, upstream-hosted protected ref that the consumer cannot write, or a distinct-owner second source; otherwise mark upstream authenticity inconclusive;
+- recipe integrity: first determine from authoritative committed metadata whether a distinct canonical producer exists; if producer existence is unresolved, mark this row inconclusive/non-pass. When a distinct canonical producer exists, cite already-committed or out-of-band producer provenance proving `LC_ALL=C` byte-stable ordering, self-containment, and exit semantics; do not fetch during verify/review to establish it. `Local recipe only` may pass only when authoritative metadata explicitly states no external canonical producer exists, plus local `LC_ALL=C` byte-stable ordering, self-containment, exit semantics, digest clean pass, and RED script mutation failure; label the row `pass (local-recipe-only)` and do not claim cross-consumer recipe provenance. If provenance needs a fetch, route it through the separate sync gate;
+- wrapper integrity: prove the resolved verify entrypoint from traced invocation, resolved-command evidence, or static review evidence showing a single committed entrypoint with no CI/build wrapper indirection, then compare that entrypoint digest to the vendored canonical script digest. If entrypoint identity is unproven, mark this row inconclusive/non-pass. If the invoked entrypoint differs, treat a wrapper as present; prove wrapper digest clean+RED, prove it is network-free, exec-free (beyond invoking the canonical script), delete-free, and install-free, and prove it does not override canonical locale, `PATH`, `IFS`, shell options, or exit handling. Any fetch/toolchain bootstrap must route through the separate sync gate, never the verify-invoked wrapper;
+- sync/setup boundary (always applies to a verify/review run; only the separate-sync-gate sub-part is inapplicable when no sync gate ran): this verify/review procedure never authorizes fetch, install, toolchain exec, or deletes — assert that the run did none of these even on the local-only path. `verify`, recipe, and wrapper rows stay network-free, exec-free except for invoking the canonical script, and delete-free. A separate sync gate requires explicit human authorization for that run and must carry its own allowlist, out-of-band digest/signature, distinct-owner/protected provenance, no-unexpected-files check, and clean+RED evidence outside this verify checklist.
+- Cross-language conformance/parity fixtures: every language's suite loads the ONE shared external single-source fixture set (the vendored/pinned artifact), never per-language inline literals — a language's own literal can silently encode the very drift the suite exists to catch (a stale test using the wrong value as its own example passes against itself). The runner fails closed on fixture-schema mismatch in BOTH directions: unknown/extra key = untested upstream addition, missing key = silent coverage loss; neither is skipped or defaulted.
+- RED cleanup: confirm the audited working tree is clean before any RED step, perform RED mutations only in a disposable copy or scratch checkout, then confirm both scratch cleanup and audited working tree cleanliness before recording the aggregate result.
+
+## Ledger
+
+Aggregate rule: every result starts with `pass`, `non-pass`, or `inapplicable`; scope labels are qualifiers only. Green requires the local-drift row to be applicable+green and every other applicable row to be green. Any applicable `inconclusive`, `fail`, or non-pass row makes the overall gate non-pass. Zero applicable rows is non-pass unless Step 1 proved top-level inapplicability from authoritative absence evidence; then report the gate as `inapplicable`. If upstream compare and pin authority are inapplicable, the result must include `local-drift only; upstream freshness unverified`. If upstream rows are applicable but inconclusive, the result must include `upstream authenticity inconclusive` and is non-pass. An unlabeled or comprehensive green is non-pass.
+
+| row | status | evidence pointer |
+| --- | --- | --- |
+| scope | pass / inconclusive / inapplicable | committed catalog or pinned tracked-file list; local digest manifest needs exhaustive root scan with empty extra/missing set |
+| local verify | pass / inconclusive / fail | clean verify output; RED vendored-copy mutation failure |
+| local verify scope | pass / inconclusive / fail / inapplicable | source path absent run, or evidence recipe has no source path |
+| root enumeration | pass / inconclusive / fail | catalog or pinned list plus included/excluded/missing/extra disposition; manifest-only layout needs exhaustive root scan with empty extra/missing set |
+| semantic layer | pass / inconclusive / fail / inapplicable | valid+invalid semantic evidence, or no-semantic note naming the artifact's actual declared format/parser and why no parser/schema exists |
+| upstream compare | pass / inconclusive / fail / inapplicable | clean upstream check; RED vendored mutation; RED upstream-ref change; RED compare-set membership failure |
+| pin authority | pass / inconclusive / fail / inapplicable | signed tag, protected ref, or distinct-owner source |
+| recipe integrity | pass / inconclusive / fail | local digest clean+RED; producer proof or local-recipe-only label |
+| wrapper integrity | pass / inconclusive / fail / inapplicable | CI/command entrypoint; digest comparison; wrapper clean+RED if present |
+| sync boundary | pass / inconclusive / fail | verify/review did not fetch/install/exec-beyond-canonical-script/delete; separate sync authorization if a sync gate ran |
+| RED cleanup | pass / inconclusive / fail | scratch checkout used; audited working tree clean before and after |
+
+Minimal local-only example:
+
+| row | status | evidence pointer |
+| --- | --- | --- |
+| scope | pass | local digest manifest plus independent catalog covers vendored artifact |
+| local verify | pass | clean verify; RED artifact mutation fails verify |
+| local verify scope | inapplicable | recipe has no sibling/source path |
+| root enumeration | pass | local digest manifest plus independent catalog covers artifact file list |
+| semantic layer | inapplicable | no-semantic note: the vendored artifact is opaque digest content with no declared schema/parser (a semantic-bearing artifact would instead record valid+invalid fixture evidence) |
+| upstream compare | inapplicable | no upstream marker in committed metadata/build/CI |
+| pin authority | inapplicable | no upstream marker in committed metadata/build/CI |
+| recipe integrity | pass | authoritative metadata states no external canonical producer; local-recipe-only; local digest clean+RED; LC_ALL=C ordering, self-containment, and exit semantics proved |
+| wrapper integrity | pass | traced/resolved invocation proves committed local verify script entrypoint directly; digest matches local script; no wrapper |
+| sync boundary | pass | verify/review did not fetch/install/exec-beyond-canonical-script/delete; no separate sync gate used |
+| RED cleanup | pass | RED ran in scratch checkout; audited tree clean |
+
+Result: `pass` (local-drift only; upstream freshness unverified; local-recipe-only). Note the verdict starts with `pass` per the aggregate rule, and — because upstream compare and pin authority are inapplicable — includes `local-drift only` and `upstream freshness unverified`.
+
+If any applicable row lacks its clean evidence, or lacks required RED/negative evidence where a meaningful/safe RED applies (rows with no meaningful/safe RED instead record an explicit N/A rationale), mark that row `inconclusive` or non-pass; do not aggregate it as green. If a RED mutation does not trigger the expected failure, mark the row `fail` because the gate is defective.

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/references/verify-enforcement-mechanisms.md

@@ -0,0 +1,18 @@
+# Verify Enforcement Mechanisms
+
+Mechanics for the entry rule's enforcement-mechanism verification obligation in `SKILL.md` (Core Rules): the behavioral matrix's cells, the fail-open bypass set, and the port/mirror parity procedure. The obligations themselves — a matrix is required before a completion claim, scratch/synthetic targets only, parity-from-reading is hypothesis-grade — live in the entry; this file owns what goes in the matrix.
+
+## Behavioral Matrix Cells
+
+- **Blocked set**: one blocked case per externally observable deny condition (not only the easiest violation).
+- **Allowed set**: allowed cases proving legitimate operations are not collateral damage.
+- **Bypass set**: the paths environment variance opens — every swallowed-exception path (a catch that falls through to "allow" is fail-open; make it deny, degrade visibly, or prove the swallowed case is genuinely outside enforcement scope).
+- **Canonicalization/read edge cases**, derived from what the guard canonicalizes or reads: target path and cwd (not-yet-existing directories; at least one case where the raw path and the canonicalized path differ, e.g. under a symlinked root), and VCS metadata/state when the guard reads it (linked worktrees, detached/edge ref states).
+
+A case that cannot be exercised safely is recorded as a safe-unavailable gap with its residual risk, not silently skipped.
+
+## Port/Mirror Parity
+
+When the mechanism ports or mirrors an existing guard, the documented enforcement contract is the spec and the original's behavior is parity input: diff condition-by-condition, record each divergence as intentional-divergence or legacy-bug-closed — never silently inherit a bypass — and run the same matrix on both.
+
+For the sibling obligation when the *test* (not the guard) is ported to a sibling stack — input-fixture fidelity of the adversarial inputs themselves — see `test-code-authoring-patterns.md` §9.

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/scripts/AGENTS.md

@@ -0,0 +1,17 @@
+# skills/testing-strategy/scripts Agent Contract
+
+Scripts here support test strategy validation and harness checks.
+
+Rules:
+
+- Keep checks deterministic and explicit about what layer they prove.
+- Do not let log-only or smoke-only checks masquerade as assertion-based test
+  evidence.
+- Changes to status mapping, gate semantics, or report output require regression
+  tests.
+- Avoid live service dependencies in default script paths.
+
+Validation:
+
+- Run the touched script's `.test.sh` or focused pytest equivalent.
+- `bash skills/skill-extraction-workflow/scripts/check-ccl-skills.sh .`

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/scripts/client-terminal-ansi-check.py

@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""client-terminal-ansi-check.py — CB-1: terminal NO-HARDCODED-ANSI conformance.
+
+Flags literal ANSI/VT100 escape sequences written directly in SOURCE code, outside an
+allowlisted rendering/terminal-capability module. clig.dev (Output) and the terminfo model say
+escapes must go through a capability-aware layer that can degrade for `TERM=dumb`/non-TTY/NO_COLOR;
+a raw `\\x1b[31m` sprinkled through business code is the anti-pattern this catches.
+
+Language-agnostic: this is a BYTE/TEXT scan (no AST, no parser), so it is genuinely
+zero-dependency and works across Go/Rust/Python/JS/TS/Swift/Kotlin/etc. It scans only
+source-code extensions, so it does not flag golden/fixture files that legitimately embed ANSI.
+
+Matched escape-intro forms (a CSI `[` or OSC `]` introducer must follow the ESC):
+  \\x1b[ \\x1B[ \\033[ \\e[ \\u001b[ \\u{1b}[ and raw-ESC(0x1b)+[   (CSI) — plus the same six with
+  a `]` introducer (OSC, e.g. OSC-8 hyperlink / OSC-52 clipboard write).
+
+Determinism boundary (honest): deterministic for "a hardcoded CSI/OSC escape literal is PRESENT".
+It does NOT decide whether the escape is correctly gated behind a capability lib / NO_COLOR / isatty
+(semantic, agent-review), and it covers the CSI/OSC introducers only — other Fe sequences (charset
+`\\x1b(`, DCS `\\x1bP`, etc.) and ESC introducers reached through a variable are not matched. It also
+does NOT follow symlinked directories (os.walk default), so a violation behind a symlink is not
+scanned. A clean run therefore means "no matched hardcoded escape literals found in the walked,
+non-symlinked source tree outside the allowlist", NOT full conformance. Put your rendering/ANSI/
+terminal lib on the allowlist so its legitimate escape definitions are exempt.
+
+Allowlist: `--allow=<path-segment>` exempts files under a matching path COMPONENT (segment-anchored,
+not a raw substring — `--allow=render` exempts `render/…` but not `surrender.ts`); a multi-segment
+value (`src/render`) matches a contiguous run of segments. Use it for the one module that owns escape
+emission, e.g. `--allow=ansi --allow=render`.
+
+Comments are NOT excluded (comment syntax varies across the many languages this scans — `//`, `#`,
+`--`, `/* */`), so a hardcoded escape inside a comment is still flagged; move illustrative escapes
+into an allowlisted module or restructure them. Likewise a double-escaped TEXT literal such as
+`"\\e]"` (an escaped backslash, not a real ESC) is flagged — source-text scanning cannot tell it
+from `"\e]"`. Both are accepted residuals (advisory: a hit is "to verify"), not parser bugs.
+
+Exit: 0 no finding; 1 finding(s); 2 setup/inconclusive (missing path, unsupported file, scope with
+no source files, or an unreadable subtree — NEVER reported as clean).
+"""
+import os
+import re
+import sys
+
+SOURCE_EXT = {
+    ".go", ".rs", ".py", ".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts",
+    ".c", ".cc", ".cpp", ".h", ".hpp", ".swift", ".kt", ".kts", ".java",
+    ".rb", ".sh", ".bash", ".zsh", ".lua", ".dart",
+}
+
+# An introducer must follow the ESC, to avoid matching unrelated `\e`/`\033` text. Accept both
+# `[` (CSI: cursor/clear/color) AND `]` (OSC: hyperlink / OSC-52 clipboard write) — §6 of the
+# terminal skill treats OSC-8/OSC-52 as a security boundary, so a hardcoded OSC escape is in scope.
+ESCAPE_RE = re.compile(
+    r"\\x1[bB][\[\]]"          # \x1b[
+    r"|\\033[\[\]]"            # \033[
+    r"|\\e[\[\]]"              # \e[
+    r"|\\u001[bB][\[\]]"       # [
+    r"|\\u\{0*1[bB]\}[\[\]]"     # \u{1b}[
+    r"|\x1b[\[\]]"             # raw ESC byte (0x1b) + [
+)
+
+
+def _iter_src(paths, onerror=None):
+    for p in paths:
+        if os.path.isdir(p):
+            for root, _dirs, files in os.walk(p, onerror=onerror):
+                for f in files:
+                    if os.path.splitext(f)[1] in SOURCE_EXT:
+                        yield os.path.join(root, f)
+        elif os.path.splitext(p)[1] in SOURCE_EXT:
+            yield p
+
+
+def _allowed(path, allow):
+    # Segment-anchored: `--allow=render` matches a `render/` path component, NOT the substring inside
+    # `surrender.ts`. A multi-segment entry (`src/render`) matches as a contiguous run of segments.
+    segs = [s for s in re.split(r"[\\/]+", path) if s]
+    for a in allow:
+        parts = [p for p in re.split(r"[\\/]+", a) if p]
+        if not parts:
+            continue
+        for i in range(len(segs) - len(parts) + 1):
+            if segs[i:i + len(parts)] == parts:
+                return True
+    return False
+
+
+def _check_file(path):
+    try:
+        with open(path, encoding="utf-8") as fh:
+            lines = fh.readlines()
+    except (UnicodeDecodeError, OSError) as exc:
+        return None, f"{path}: {exc}"
+    findings = []
+    for i, line in enumerate(lines, 1):
+        if ESCAPE_RE.search(line):
+            findings.append(f"{path}:{i}: hardcoded ANSI/OSC escape literal")
+    return findings, None
+
+
+def main(argv):
+    allow = [a[len("--allow="):] for a in argv if a.startswith("--allow=")]
+    paths = [a for a in argv if not a.startswith("--allow=")]
+    if not paths:
+        print("usage: client-terminal-ansi-check.py <src-path> [...] [--allow=<substr>]...", file=sys.stderr)
+        return 2
+    walk_errs = []
+    for p in paths:
+        if not os.path.exists(p):
+            print(f"client-ansi: path not found: {p} — inconclusive", file=sys.stderr)
+            return 2
+        if os.path.isfile(p) and os.path.splitext(p)[1] not in SOURCE_EXT:
+            print(f"client-ansi: unsupported file type: {p} — inconclusive", file=sys.stderr)
+            return 2
+        if os.path.isdir(p) and not any(_iter_src([p], onerror=walk_errs.append)):
+            print(f"client-ansi: no source files under directory: {p} — inconclusive", file=sys.stderr)
+            return 2
+    files = list(_iter_src(paths, onerror=walk_errs.append))
+    if walk_errs:
+        print(f"client-ansi: cannot read part of scope ({walk_errs[0]}) — inconclusive", file=sys.stderr)
+        return 2
+    if not files:
+        print("client-ansi: no source files in scope — inconclusive", file=sys.stderr)
+        return 2
+    hits = 0
+    for f in files:
+        if _allowed(f, allow):
+            continue
+        res, err = _check_file(f)
+        if err is not None:
+            print(f"client-ansi: read error: {err} — inconclusive", file=sys.stderr)
+            return 2
+        for line in res:
+            print(f"client-ansi smell: {line}")
+            hits = 1
+    return hits
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/scripts/client-terminal-ansi-check.test.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Test harness for client-terminal-ansi-check.py (CB-1) — proves it catches hardcoded ANSI
+# escape literals across forms/languages, exempts the allowlisted rendering module, does not
+# false-positive on clean source, and is inconclusive (not clean) on bad scope.
+# Run: bash client-terminal-ansi-check.test.sh   (honors $TMPDIR; needs python3)
+set -euo pipefail
+
+here="$(cd "$(dirname "$0")" && pwd)"
+script="$here/client-terminal-ansi-check.py"
+command -v python3 >/dev/null 2>&1 || { echo "python3 required" >&2; exit 2; }
+base="${TMPDIR:-/tmp}"
+tmp="$(mktemp -d "${base%/}/cbansi.XXXXXX")"
+trap 'rm -rf "$tmp"' EXIT
+
+pass=0 fail=0
+assert_hit() { local desc="$1" want="$2"; shift 2
+  set +e; local out rc; out="$(python3 "$script" "$@" 2>/dev/null)"; rc=$?; set -e
+  if [ "$rc" = 1 ] && printf '%s' "$out" | grep -qF "$want"; then pass=$((pass+1)); echo "ok   - $desc"
+  else fail=$((fail+1)); echo "FAIL - $desc (rc=$rc, want '$want', out='$out')"; fi; }
+assert_exit() { local desc="$1" want="$2"; shift 2
+  set +e; python3 "$script" "$@" >/dev/null 2>&1; local rc=$?; set -e
+  if [ "$rc" = "$want" ]; then pass=$((pass+1)); echo "ok   - $desc"; else fail=$((fail+1)); echo "FAIL - $desc (want exit $want, got $rc)"; fi; }
+
+mkdir -p "$tmp/src" "$tmp/render" "$tmp/empty"
+# positive: each form on its own line, across languages
+cat > "$tmp/src/colors.go" <<'EOF'
+package x
+const a = "\x1b[31m"
+const b = "\033[0m"
+const c = "\e[1m"
+EOF
+cat > "$tmp/src/colors.ts" <<'EOF'
+const a = "";
+const b = "\u{1b}[0m";
+EOF
+# clean: routes through a lib, no literal escapes
+cat > "$tmp/src/clean.go" <<'EOF'
+package x
+import "term"
+func f() { term.Red("hi") } // no hardcoded escapes; [ alone is fine: a[0]
+EOF
+# allowlisted rendering module owns the escapes
+cat > "$tmp/render/ansi.go" <<'EOF'
+package render
+const Reset = "\x1b[0m"
+EOF
+echo "not source" > "$tmp/empty/readme.md"
+
+assert_hit  "Go \\x1b[ literal"                  "colors.go"   "$tmp/src/colors.go"
+assert_hit  "Go \\033[ and \\e[ literals"        "hardcoded ANSI/OSC escape literal" "$tmp/src/colors.go"
+assert_hit  "TS \\u001b[ and \\u{1b}[ literals"  "colors.ts"   "$tmp/src/colors.ts"
+# exact count: colors.go has 3 escape lines, colors.ts has 2 → 5 over the dir
+got=$(python3 "$script" "$tmp/src" 2>/dev/null | grep -c "client-ansi smell:" || true)
+if [ "$got" = 5 ]; then pass=$((pass+1)); echo "ok   - src finding count == 5"; else fail=$((fail+1)); echo "FAIL - src count: want 5 got $got"; fi
+# regression (challenge R1): OSC escapes (\x1b] — hyperlink / OSC-52 clipboard) must be caught, not just CSI
+cat > "$tmp/osc.ts" <<'EOF'
+const link = "\x1b]8;;https://x.test\x07label\x1b]8;;\x07"
+const clip = "\033]52;c;BASE64\007"
+EOF
+assert_hit  "OSC \\x1b] hyperlink/clipboard escape caught" "hardcoded ANSI/OSC escape literal" "$tmp/osc.ts"
+assert_exit "clean source -> no finding (0)"        0 "$tmp/src/clean.go"
+assert_exit "allowlisted render module exempt (0)"  0 "$tmp/render/ansi.go" "--allow=/render/"
+# regression (challenge R2): --allow segment-anchored, must NOT exempt substring match
+cat > "$tmp/src/surrender.ts" <<'EOF'
+const c = "\x1b[31m"
+EOF
+assert_hit  "--allow=render does NOT exempt surrender.ts" "hardcoded ANSI/OSC escape literal" "$tmp/src/surrender.ts" --allow=render
+# regression (challenge R2): .mts scanned + padded-zero \u{001b} caught (printf %s keeps literal text)
+printf '%s\n' 'const a = "\u{001b}[31m"' > "$tmp/mod.mts"
+assert_hit  ".mts + padded \\u{001b} caught" "hardcoded ANSI/OSC escape literal" "$tmp/mod.mts"
+assert_exit "missing path -> inconclusive (2)"      2 "$tmp/src/nope.go"
+assert_exit "unsupported file -> inconclusive (2)"  2 "$tmp/empty/readme.md"
+assert_exit "dir without source -> inconclusive (2)" 2 "$tmp/empty"
+
+echo "----"; echo "passed=$pass failed=$fail"; [ "$fail" -eq 0 ]

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/scripts/lang-basics-ast-check.py

@@ -0,0 +1,170 @@
+#!/usr/bin/env python3
+"""lang-basics-ast-check.py — DETERMINISTIC (for the matched shapes) check for LB-1:
+Python boundary error-faking.
+
+Unlike the ripgrep smell-finder, this parses the AST, so it does NOT match text inside
+comments or strings, and it catches the grep-bypass forms the smell-grep missed:
+`dict(success=False)`, single-quoted dicts, a `{SUCCESS: False}` constant-key, and 2-tuple
+error returns.
+
+Scope: pass TRANSPORT / handler / view / router files or directories. The pure/domain core is
+exempt (Result/Either is allowed there) — do not point this at the whole tree.
+
+Determinism boundary: it is deterministic ONLY for the enumerated shapes below. "Is this a real
+fake error" is undecidable in general, so a clean run means "none of the matched fake-error
+shapes are present", NOT full conformance. Shapes it still does not catch (documented residual):
+an ad-hoc `{"code": ..., "message": ...}` dict (indistinguishable from a legit envelope without
+type/flow analysis), or a value aliased through another variable.
+
+Exit: 0 no finding; 1 finding(s); 2 setup/inconclusive (missing path, non-.py file, directory
+with no .py, or a parse error — NEVER reported as clean).
+"""
+import ast
+import os
+import sys
+
+SUCCESS_KEYS = {"success", "ok"}
+ERR_NAMES = {"err", "error", "errs", "exc", "e", "ex"}
+
+
+def _iter_py(paths, onerror=None):
+    for p in paths:
+        if os.path.isdir(p):
+            # onerror: os.walk silently skips unreadable subtrees by default — that could turn
+            # a partly-unreadable scope into a false "clean". Surface it so main() exits 2.
+            for root, _dirs, files in os.walk(p, onerror=onerror):
+                for f in files:
+                    if f.endswith(".py"):
+                        yield os.path.join(root, f)
+        elif p.endswith(".py"):
+            yield p
+
+
+def _is_false(node):
+    return isinstance(node, ast.Constant) and node.value is False
+
+
+def _dict_is_fake(d):
+    # {"success": False} / {'ok': False} (any quote) / {SUCCESS: False} (constant-name key).
+    # ONLY a literal boolean False — NOT 0/None: {"ok": 0} is a legit count, not an error fake.
+    for k, v in zip(d.keys, d.values):
+        key = None
+        if isinstance(k, ast.Constant) and isinstance(k.value, str):
+            key = k.value.lower()
+        elif isinstance(k, ast.Name) and k.id.isupper():
+            # only an ALL-CAPS constant name (e.g. SUCCESS); a lowercase `ok` is a runtime
+            # variable key, too ambiguous to flag.
+            key = k.id.lower()
+        if key in SUCCESS_KEYS and _is_false(v):
+            return True
+    return False
+
+
+def _call_is_fake_dict(c):
+    # dict(success=False)
+    if isinstance(c.func, ast.Name) and c.func.id == "dict":
+        for kw in c.keywords:
+            if kw.arg and kw.arg.lower() in SUCCESS_KEYS and _is_false(kw.value):
+                return True
+    return False
+
+
+def _tuple_is_fake(t):
+    if len(t.elts) != 2:
+        return False
+    a, b = t.elts
+    # (data, err) / (x, error) / (payload, exc)
+    if isinstance(b, ast.Name) and b.id.lower() in ERR_NAMES:
+        return True
+    # (None, "msg"): None paired with a string-literal message, or an error/message-ish name.
+    # NOT (None, default) — a generic name is a legit optional-pair, not an error fake.
+    if isinstance(a, ast.Constant) and a.value is None:
+        if isinstance(b, ast.Constant) and isinstance(b.value, str):
+            return True
+        if isinstance(b, ast.Name) and (b.id.lower() in ERR_NAMES or any(t in b.id.lower() for t in ("msg", "message", "err", "error"))):
+            return True
+    return False
+
+
+def _check_file(path):
+    try:
+        with open(path, encoding="utf-8") as fh:
+            tree = ast.parse(fh.read(), filename=path)
+    except (SyntaxError, UnicodeDecodeError, OSError) as exc:
+        return None, f"{path}: {exc}"
+    findings = []
+    for node in ast.walk(tree):
+        if not (isinstance(node, ast.Return) and node.value is not None):
+            continue
+        hit = _return_hit(node.value)
+        if hit:
+            findings.append(f"{path}:{node.lineno}: boundary error-fake [{hit}]")
+    return findings, None
+
+
+def _is_fake_dict_node(n):
+    # a fake dict literal ({"success": False}) OR a dict(success=False) call
+    return (isinstance(n, ast.Dict) and _dict_is_fake(n)) or (isinstance(n, ast.Call) and _call_is_fake_dict(n))
+
+
+def _return_hit(v):
+    # Inspect the return ROOT plus ONE level into a response constructor — NOT the whole
+    # subtree, so a fake dict nested inside legitimate data
+    # (`return {"items": [{"success": False}]}`) is not flagged.
+    if isinstance(v, ast.Tuple):
+        if _tuple_is_fake(v):
+            return "error-tuple (data,err)/(None,msg)"
+        # (body, status) form: return ({"success": False}, 400)
+        for el in v.elts:
+            if _is_fake_dict_node(el):
+                return "fake dict in (body, status) tuple"
+        return None
+    if isinstance(v, ast.Dict) and _dict_is_fake(v):
+        return "dict success/ok=False"
+    if isinstance(v, ast.Call):
+        if _call_is_fake_dict(v):
+            return "dict(success=False)"
+        # constructor-wrapped one level: JSONResponse({...}) / JSONResponse(dict(success=False))
+        # / Response(content={...})
+        for arg in list(v.args) + [kw.value for kw in v.keywords]:
+            if _is_fake_dict_node(arg):
+                return "fake dict (constructor-wrapped)"
+    return None
+
+
+def main(argv):
+    if not argv:
+        print("usage: lang-basics-ast-check.py <transport-path> [...]", file=sys.stderr)
+        return 2
+    walk_errs = []
+    for p in argv:
+        if not os.path.exists(p):
+            print(f"lang-basics-ast: path not found: {p} — inconclusive", file=sys.stderr)
+            return 2
+        if os.path.isfile(p) and not p.endswith(".py"):
+            print(f"lang-basics-ast: not a Python file: {p} — inconclusive", file=sys.stderr)
+            return 2
+        if os.path.isdir(p) and not any(_iter_py([p], onerror=walk_errs.append)):
+            print(f"lang-basics-ast: no Python files under directory: {p} — inconclusive", file=sys.stderr)
+            return 2
+    files = list(_iter_py(argv, onerror=walk_errs.append))
+    if walk_errs:
+        print(f"lang-basics-ast: cannot read part of scope ({walk_errs[0]}) — inconclusive", file=sys.stderr)
+        return 2
+    if not files:
+        print("lang-basics-ast: no Python files in scope — inconclusive", file=sys.stderr)
+        return 2
+    hits = 0
+    for f in files:
+        res, err = _check_file(f)
+        if err is not None:
+            print(f"lang-basics-ast: parse error: {err} — inconclusive", file=sys.stderr)
+            return 2
+        for line in res:
+            print(f"lang-basics-ast smell: {line}")
+            hits = 1
+    return hits
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/dist/assets/marketplace/plugins/ccl-skills/skills/testing-strategy/scripts/lang-basics-ast-check.test.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Test harness for lang-basics-ast-check.py — proves it catches the grep-bypass forms,
+# does not false-positive on legit returns, and is inconclusive (not clean) on bad scope.
+# Run: bash lang-basics-ast-check.test.sh   (honors $TMPDIR; needs python3)
+set -euo pipefail
+
+here="$(cd "$(dirname "$0")" && pwd)"
+script="$here/lang-basics-ast-check.py"
+command -v python3 >/dev/null 2>&1 || { echo "python3 required" >&2; exit 2; }
+base="${TMPDIR:-/tmp}"
+tmp="$(mktemp -d "${base%/}/lbast.XXXXXX")"
+trap 'rm -rf "$tmp"' EXIT
+
+pass=0 fail=0
+assert_hit() { # <desc> <expect-substr> <path...>
+  local desc="$1" want="$2"; shift 2
+  set +e; local out rc; out="$(python3 "$script" "$@" 2>/dev/null)"; rc=$?; set -e
+  if [ "$rc" = 1 ] && printf '%s' "$out" | grep -qF "$want"; then
+    pass=$((pass+1)); echo "ok   - $desc"
+  else
+    fail=$((fail+1)); echo "FAIL - $desc (rc=$rc, want '$want', out='$out')"
+  fi
+}
+assert_exit() { # <desc> <expected-exit> <path...>
+  local desc="$1" want="$2"; shift 2
+  set +e; python3 "$script" "$@" >/dev/null 2>&1; local rc=$?; set -e
+  if [ "$rc" = "$want" ]; then pass=$((pass+1)); echo "ok   - $desc"; else fail=$((fail+1)); echo "FAIL - $desc (want exit $want, got $rc)"; fi
+}
+
+mkdir -p "$tmp/t" "$tmp/empty"
+cat > "$tmp/t/bypasses.py" <<'EOF'
+def a(): return {"success": False}
+def b(): return {'success': False}
+def c(): return dict(success=False)
+def d(): return {SUCCESS: False}
+def e(): return {"ok": False, "error": msg}
+def f(): return (None, msg)
+def g(): return data, err
+def i(): return {"success": False, "note": "# lb-allow: ignored-by-ast"}
+def j(): return JSONResponse({"success": False, "error": "x"})
+def o(): return JSONResponse(dict(success=False))
+def p(): return {"success": False}, 400
+EOF
+cat > "$tmp/t/wrapped.py" <<'EOF'
+def w(): return JSONResponse({"success": False})
+EOF
+cat > "$tmp/t/clean.py" <<'EOF'
+def a(): raise DomainError(code=400, message="bad")
+def b(): return {"data": items, "total": n}
+def c(): return Result.err("x")
+def d(): return lat, lng
+def e(): return {"code": 200, "message": "ok", "data": d}
+def f(): return None
+def g(): return None, None
+def h(): return {"ok": 0, "data": []}
+def i(): return {"success": None}
+def j(): return None, default
+def k(): return None, fallback_value
+def l(): return {"items": [{"success": False}]}
+def r(): return {"items": [{"success": False}]}, 200
+def m(): return {ok: False}
+def n():
+    # return {"success": False}  <- a comment, must be ignored
+    s = "{'success': False}"
+    return {"data": s}
+EOF
+printf 'def broken(:\n' > "$tmp/t/syntax.py"
+echo "not python" > "$tmp/empty/readme.md"
+
+assert_hit  "dict success/ok=False (any quote, constant key)" "dict success/ok=False" "$tmp/t/bypasses.py"
+assert_hit  "dict(success=False) call form"                   "dict(success=False)"   "$tmp/t/bypasses.py"
+assert_hit  "error tuple (data,err)/(None,msg)"               "error-tuple"           "$tmp/t/bypasses.py"
+assert_hit  "constructor-wrapped fake dict (direct, by label)" "fake dict (constructor-wrapped)" "$tmp/t/wrapped.py"
+assert_hit  "(body, status) tuple boundary response"         "(body, status) tuple"  "$tmp/t/bypasses.py"
+# exact-count guard: bypasses.py has 11 fake-return lines (a,b,c,d,e,f,g,i,j,o,p); each → 1 finding.
+got=$(python3 "$script" "$tmp/t/bypasses.py" 2>/dev/null | grep -c "lang-basics-ast smell:" || true)
+if [ "$got" = 11 ]; then pass=$((pass+1)); echo "ok   - bypasses.py finding count == 11"; else fail=$((fail+1)); echo "FAIL - bypasses.py count: want 11 got $got"; fi
+assert_exit "clean returns -> no finding (0)"            0    "$tmp/t/clean.py"
+assert_exit "syntax error -> inconclusive (2)"          2    "$tmp/t/syntax.py"
+assert_exit "missing path -> setup (2)"                 2    "$tmp/t/nope.py"
+assert_exit "non-.py file -> setup (2)"                 2    "$tmp/empty/readme.md"
+assert_exit "dir without py -> setup (2)"               2    "$tmp/empty"
+assert_exit "multi-scope w/ one empty dir -> (2)"       2    "$tmp/t" "$tmp/empty"
+
+echo "----"
+echo "passed=$pass failed=$fail"
+[ "$fail" -eq 0 ]