@ccoalm/ccl-skills 0.1.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_code_review_identity.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Documentation-shape contract test for provider-neutral identity, routing, and
+# host-wait wording. It does not simulate or enforce host execution behavior.
+set -uo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+REPO_ROOT="$(cd "$DIR/../../.." && pwd -P)"
+SKILL="$REPO_ROOT/skills/code-review/SKILL.md"
+GATE="$REPO_ROOT/skills/code-review/scripts/review_gate.py"
+WAIT_REF="$REPO_ROOT/skills/code-review/references/timeout-auth-and-capabilities.md"
+QUICKSTART="$REPO_ROOT/skills/skill-extraction-workflow/references/extraction-quickstart.md"
+DUAL_TRACK="$REPO_ROOT/skills/skill-extraction-workflow/references/dual-track-review-gate.md"
+fails=0
+
+check() {
+  if eval "$2"; then echo "ok   - $1"; else echo "FAIL - $1"; fails=$((fails+1)); fi
+}
+
+check "provider-neutral skill directory exists" '[ -f "$SKILL" ]'
+check "legacy Claude-specific skill directory is absent" '[ ! -e "$REPO_ROOT/skills/claude-code-review" ]'
+check "frontmatter uses code-review" 'grep -q "^name: code-review$" "$SKILL"'
+check "Claude may route to the provider-neutral skill" \
+  '[ -f "$SKILL" ] && ! grep -q "^disable-model-invocation:" "$SKILL"'
+check "client order uses the provider-neutral local variable" \
+  'grep -q "CODE_REVIEW_CLIENT_ORDER" "$GATE" && ! grep -q "CLAUDE_CODE_REVIEW_CLIENT_ORDER" "$GATE"'
+check "owner wait contract records timeout as inconclusive" \
+  'grep -Fq "the final status must say \`inconclusive\` with the timeout reason so downstream review or merge state cannot treat the missing lane as approval" "$SKILL"'
+check "owner wait contract polls the exact live handle" \
+  'grep -Fq "poll that exact handle to terminal exit, and never start a replacement/fallback while its process is live" "$SKILL"'
+check "owner wait contract rejects nonzero unparseable output" \
+  'grep -Fq "non-zero exit without valid JSON remains inconclusive/manual-review-required, never as success" "$SKILL"'
+check "owner wait contract rejects kill-then-credit" \
+  'grep -Fq "must never kill the wrapper and then treat the killed output as success" "$SKILL"'
+check "owner wait contract forbids fallback after handle loss" \
+  'grep -Fq "If that handle is lost, the lane is infrastructure-inconclusive/manual-review-required and no replacement or fallback may be started or credited" "$SKILL"'
+check "owner final summary records lost-handle state" \
+  'grep -Fq "record that infrastructure-inconclusive state, diagnostic artifacts, and that fallback was unavailable" "$SKILL"'
+check "wait reference forbids replacement while the original handle is live" \
+  'tr "\n" " " <"$WAIT_REF" | grep -Fq "Do not start a second reviewer, enter fallback, or call the partial chunk \"empty reviewer output\" while that handle or its child process is alive"'
+check "wait reference rejects kill-then-credit" \
+  'grep -Fq "must never kill the wrapper and then treat the killed output as success" "$WAIT_REF"'
+check "wait reference rejects nonzero unparseable output" \
+  'grep -Fq "inconclusive/manual-review-required, never as success" "$WAIT_REF"'
+check "wait reference forbids replacement after handle loss" \
+  'tr "\n" " " <"$WAIT_REF" | grep -Fq "If orchestration loses the handle, the lane is infrastructure-inconclusive/manual-review-required and no replacement or fallback may be started or credited"'
+check "wait reference makes artifacts diagnostic only" \
+  'tr "\n" " " <"$WAIT_REF" | grep -Fq "may be inspected for diagnosis only; they cannot reconstruct the missing terminal result or authorize continuation"'
+check "wait reference scopes enforcement to the outer host" \
+  'grep -Fq "procedural host-workflow obligation, not a controller-owned field" "$WAIT_REF"'
+check "extraction quickstart forbids fallback while the original process is live" \
+  'grep -Fq "no replacement/fallback reviewer may start while the original process is live" "$QUICKSTART"'
+check "extraction quickstart forbids fallback after handle loss" \
+  'grep -Fq "If the handle is lost, the lane is infrastructure-inconclusive/manual-review-required and no replacement or fallback may be started or credited" "$QUICKSTART"'
+check "extraction quickstart makes artifacts diagnostic only" \
+  'grep -Fq "process-tree and wrapper artifacts are diagnostic only" "$QUICKSTART"'
+check "extraction quickstart scopes enforcement to the outer host" \
+  'grep -Fq "procedural host obligation because the inner gate cannot observe the outer handle" "$QUICKSTART"'
+check "dual-track remediation polls the original handle" \
+  'grep -Fq "poll it to terminal exit and do not start a replacement or fallback from its empty current output" "$DUAL_TRACK"'
+check "dual-track remediation forbids fallback after handle loss" \
+  'grep -Fq "If the handle is lost, the lane is infrastructure-inconclusive/manual-review-required and no replacement or fallback may be started or credited" "$DUAL_TRACK"'
+check "dual-track remediation makes artifacts diagnostic only" \
+  'grep -Fq "process-tree and wrapper artifacts are diagnostic only" "$DUAL_TRACK"'
+check "dual-track remediation scopes enforcement to the outer host" \
+  'grep -Fq "procedural host obligation because the inner gate cannot observe the outer handle" "$DUAL_TRACK"'
+
+echo '----'
+if [ "$fails" -eq 0 ]; then
+  echo code_review_identity_tests_ok
+else
+  echo "$fails FAILURES"
+  exit 1
+fi

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_concern_excerpt.sh

@@ -0,0 +1,245 @@
+#!/usr/bin/env bash
+# Behavior tests for the bounded concern-evidence excerpt carried on the
+# `stop_reviewer_lane` path. Rows map 1:1 to the acceptance matrix in
+# specs/010-review-concern-excerpt/plan.md.
+set -uo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+fails=0
+
+check() {
+  if eval "$2"; then echo "ok   - $1"; else echo "FAIL - $1"; fails=$((fails+1)); fi
+}
+
+# Evaluate a python expression against the helper and the parser, printing a
+# bare `True`/`False`. Anything else (import error, traceback) fails the row.
+py() {
+  DIR="$DIR" python3 - "$1" <<'PY' 2>/dev/null
+import os
+import sys
+
+sys.path.insert(0, os.environ["DIR"])
+import concern_excerpt as ce  # noqa: E402
+
+MAX_LINES = ce.MAX_EXCERPT_LINES
+MAX_CHARS = ce.MAX_EXCERPT_LINE_CHARS
+excerpt = ce.concern_excerpt
+print(bool(eval(sys.argv[1])))
+PY
+}
+
+row() { check "$1" "[ \"\$(py '$2')\" = True ]"; }
+
+# --- helper contract ------------------------------------------------------
+check "helper module exists" '[ -f "$DIR/concern_excerpt.py" ]'
+check "helper is the single source of the concern pattern" \
+  'grep -q "^CONCERN_RE" "$DIR/concern_excerpt.py"'
+
+# Row 1: no concern-shaped line -> no evidence, no excerpt.
+row "row1 plain refusal carries no concern evidence" \
+  'excerpt("I am unable to comply with that request.") == ([], False)'
+
+# Row 2: empty / unreadable verdict -> no evidence.
+row "row2 empty verdict carries no concern evidence" \
+  'excerpt("") == ([], False)'
+
+# Rows 3-8: UNSTRUCTURED output. After five rounds of credential shapes escaping
+# the redaction denylist (and one of benign prose being over-redacted), the
+# free-text relay was removed: report only tokens this module matched itself.
+row "row3 severity is reported without the surrounding text" \
+  'excerpt("P1 in the retry path")[0] == ["1 concern-shaped line(s), text withheld; severities: P1"]'
+
+row "row4 locator is reported without the surrounding text" \
+  '"locators: scripts/foo.py:42" in excerpt("scripts/foo.py:42 leaks a handle")[0][0] and "leaks a handle" not in excerpt("scripts/foo.py:42 leaks a handle")[0][0]'
+
+row "row5 concern_results key still counts as evidence" \
+  'excerpt("\"concern_results\": [")[0] == ["1 concern-shaped line(s), text withheld"]'
+
+row "row6 the summary counts every matched line" \
+  'excerpt("\n".join("P1 finding %d" % i for i in range(MAX_LINES + 5)))[0][0].startswith("%d concern-shaped line(s)" % (MAX_LINES + 5))'
+
+row "row7 no unstructured text can reach the excerpt at any length" \
+  '"word" not in excerpt("P1 " + "word " * 200)[0][0]'
+
+row "row8 the summary aggregates severities and locators" \
+  'excerpt("I read the supplied packet.\nP0 auth bypass\nNothing else to add.\nsrc/a.go:7 races")[0] == ["2 concern-shaped line(s), text withheld; severities: P0; locators: src/a.go:7"]'
+
+# The whole point of the redesign: nothing the model wrote rides out on the
+# unstructured path, so no denylist has to be complete.
+row "unstructured relay carries no model prose at all" \
+  '"supplied packet" not in excerpt("I read the supplied packet.\nP0 auth bypass")[0][0] and "auth bypass" not in excerpt("I read the supplied packet.\nP0 auth bypass")[0][0]'
+row "unstructured relay leaks no credential of any shape" \
+  'all(secret not in excerpt("P1 Bearer %s exposed" % secret)[0][0] for secret in ("hunter2", "secretsecret", "abc123def456"))'
+row "unstructured relay is flagged as reduced" \
+  'excerpt("P1 in the retry path")[1] is True'
+
+# Row 9: a one-line JSON verdict splits per concern instead of clipping mid-word.
+# Found by the first real gate run this helper instrumented: the reviewer answered
+# in one line of JSON and the excerpt came back as a single 200-char fragment.
+row "row9 json verdict splits per concern" \
+  'excerpt("{\"status\":\"findings\",\"concern_results\":[{\"concern\":\"correctness\",\"conclusion\":\"first conclusion here\"},{\"concern\":\"safety\",\"conclusion\":\"second conclusion here\"}],\"findings\":[]}") == (["correctness: first conclusion here", "safety: second conclusion here"], False)'
+
+row "row9b json findings become their own lines" \
+  'excerpt("{\"status\":\"findings\",\"findings\":[{\"severity\":\"P0\",\"file\":\"a.py\",\"line\":3,\"failure_path\":\"boom\",\"smallest_fix\":\"x\"}]}") == (["P0 a.py 3 boom"], False)'
+
+row "row9c malformed json falls back to the withheld summary" \
+  'excerpt("{not json at all P1 here")[0] == ["1 concern-shaped line(s), text withheld; severities: P1"]'
+
+# --- reason detail bound --------------------------------------------------
+row "reason detail flattens and bounds client text" \
+  'ce.bounded_reason_detail("a\nb  c") == "a b c" and ce.bounded_reason_detail("") == "(no message)" and len(ce.bounded_reason_detail("word " * 300)) == ce.MAX_REASON_DETAIL_CHARS + 1'
+
+# An error item can quote the frozen packet, so relayed text is redacted before
+# it reaches a durable evidence row (reviewer finding on this change).
+row "reason detail redacts urls" \
+  '"https" not in ce.bounded_reason_detail("failed calling https://internal.example/api/x?k=1")'
+row "reason detail redacts credential assignments" \
+  '"hunter2" not in ce.bounded_reason_detail("config had password=hunter2 set")'
+row "reason detail redacts long opaque tokens" \
+  '"AKIAIOSFODNN7EXAMPLEQQQQQQQQQQQQQQQQ" not in ce.bounded_reason_detail("key AKIAIOSFODNN7EXAMPLEQQQQQQQQQQQQQQQQ rejected")'
+row "reason detail redacts deep filesystem paths" \
+  '"/opt/example/nested" not in ce.bounded_reason_detail("cannot read /opt/example/nested/deep/thing")'
+row "reason detail keeps the class name readable" \
+  '"skills context budget" in ce.bounded_reason_detail("Skill descriptions were shortened to fit the skills context budget.")'
+
+# The excerpt is the larger relayed channel and gets the same redaction as the
+# diagnostic field (reviewer finding on this change). Both plain matched lines
+# and structure-derived lines go through it.
+row "excerpt redacts credentials on a plain matched line" \
+  '"hunter2" not in excerpt("P1 password=hunter2 leaked here")[0][0]'
+row "excerpt keeps the severity and locator readable" \
+  '"P1" in excerpt("P1 src/a.py:3 password=hunter2")[0][0]'
+row "excerpt redacts urls on a matched line" \
+  '"internal.example" not in excerpt("P2 see https://internal.example/x for detail")[0][0]'
+row "excerpt redacts inside structured concern lines" \
+  '"hunter2" not in excerpt("{\"status\":\"findings\",\"concern_results\":[{\"concern\":\"safety\",\"conclusion\":\"packet had password=hunter2 inline\"}]}")[0][0]'
+row "excerpt redacts inside structured finding lines" \
+  '"hunter2" not in excerpt("{\"status\":\"findings\",\"findings\":[{\"severity\":\"P0\",\"file\":\"a.py\",\"line\":1,\"failure_path\":\"password=hunter2\",\"smallest_fix\":\"x\"}]}")[0][0]'
+
+# --- CLI contract used by the shell wrappers ------------------------------
+cli_out="$(printf 'I read it.\nP2 stale cache at src/x.py:9\n' | python3 "$DIR/concern_excerpt.py" 2>/dev/null)"
+check "CLI reports concern evidence on stdin input" \
+  '[ -n "$cli_out" ] && python3 -c "import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if d[\"concern_evidence\"] is True and d[\"concern_excerpt\"] == [\"1 concern-shaped line(s), text withheld; severities: P2; locators: src/x.py:9\"] else 1)" "$cli_out"'
+
+clean_out="$(printf 'I am unable to comply.\n' | python3 "$DIR/concern_excerpt.py" 2>/dev/null)"
+check "CLI reports no concern evidence on clean refusal" \
+  '[ -n "$clean_out" ] && python3 -c "import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if d[\"concern_evidence\"] is False and d[\"concern_excerpt\"] == [] else 1)" "$clean_out"'
+
+# --- parser payload wiring ------------------------------------------------
+payload_probe() {
+  DIR="$DIR" python3 - "$1" <<'PY' 2>/dev/null
+import argparse
+import os
+import sys
+
+sys.path.insert(0, os.environ["DIR"])
+import parse_cli_review as p  # noqa: E402
+
+args = argparse.Namespace(
+    client="codex", mode="review", reviewer_family="openai",
+    provider="openai", model=None,
+)
+payload = p.invalid_model_output(args, "review verdict violated the output contract", sys.argv[1])
+print(bool(eval(os.environ["EXPR"])))
+PY
+}
+
+pcheck() {
+  local out
+  out="$(EXPR="$3" payload_probe "$2")"
+  check "$1" "[ \"$out\" = True ]"
+}
+
+pcheck "parser stop payload carries the excerpt" \
+  'P0 auth bypass at src/a.go:7' \
+  'payload["concern_evidence"] is True and payload["concern_excerpt"] == ["1 concern-shaped line(s), text withheld; severities: P0; locators: src/a.go:7"]'
+
+pcheck "parser stop payload still refuses to cascade" \
+  'P0 auth bypass at src/a.go:7' \
+  'payload["cascade_eligible"] is False and payload["reason_code"] == "invalid_model_output"'
+
+pcheck "parser omits excerpt fields when there is no concern evidence" \
+  'I am unable to comply.' \
+  'payload["concern_evidence"] is False and "concern_excerpt" not in payload and payload["cascade_eligible"] is True'
+
+pcheck "parser flags a truncated excerpt" \
+  "$(python3 -c 'print("\n".join("P1 finding %d" % i for i in range(40)))')" \
+  'payload["concern_excerpt_truncated"] is True and payload["concern_excerpt"][0].startswith("40 concern-shaped line(s)")'
+
+# --- wrapper wiring -------------------------------------------------------
+check "claude wrapper feeds its concern stop through the shared helper" \
+  'grep -q "concern_excerpt.py" "$DIR/claude_review.sh"'
+check "claude wrapper no longer stops without an excerpt" \
+  'grep -A8 "Claude returned concern evidence" "$DIR/claude_review.sh" | grep -q "concern_excerpt"'
+# Either branch of the Claude stop must be scanned: the reply text (concern regex)
+# or the raw output ("concern_results"). Scanning one leaves the other empty.
+check "claude wrapper scans both files that can trip its stop" \
+  'grep -q "concern_excerpt.py\" \"\$reply_text_file\" \"\$output_file\"" "$DIR/claude_review.sh"'
+check "codex item-level error names the underlying message" \
+  'grep -q "bounded_reason_detail(message)" "$DIR/parse_cli_review.py"'
+# Untrusted client text must not land in `reason`, which consumers display and
+# compare; it gets its own labelled field.
+check "client diagnostic is a separate field, not the reason string" \
+  'grep -q "payload\[\"client_diagnostic\"\] = bounded_reason_detail(message)" "$DIR/parse_cli_review.py"'
+
+# The benign skills-context-budget notice must match by shape. Pinning its exact
+# sentence is what took every Codex lane down when upstream dropped "2%".
+benign_probe() {
+  DIR="$DIR" python3 - "$1" <<'PY' 2>/dev/null
+import os
+import sys
+
+sys.path.insert(0, os.environ["DIR"])
+import parse_cli_review as p  # noqa: E402
+
+print(bool(p.is_benign_codex_error(sys.argv[1])))
+PY
+}
+check "benign notice matches the current CLI wording" \
+  '[ "$(benign_probe "Skill descriptions were shortened to fit the skills context budget. Codex can still see every skill, but some descriptions are shorter. Disable unused skills or plugins to leave more room for the rest.")" = True ]'
+check "benign notice still matches the older 2% wording" \
+  '[ "$(benign_probe "Skill descriptions were shortened to fit the 2% skills context budget. Codex can still see every skill, but some descriptions are shorter. Disable unused skills or plugins to leave more room for the rest.")" = True ]'
+check "benign matcher does not swallow a real error item" \
+  '[ "$(benign_probe "Sandbox denied write to /etc/passwd; skills context budget unaffected")" = False ]'
+# Prefix-only matching would let a crafted item append arbitrary content and
+# still be waved through as benign (challenge finding on this change).
+check "benign matcher rejects an over-long smuggled tail" \
+  '[ "$(benign_probe "Skill descriptions were shortened to fit the skills context budget. $(python3 -c "print(\"pad \" * 80)")")" = False ]'
+
+# Scheme-prefixed credentials put a space before the secret; an assignment-only
+# pattern redacts the label and leaks the token (challenge finding).
+row "redaction covers bearer-scheme credentials" \
+  '"hunter2" not in ce.redact_untrusted("Authorization: Bearer hunter2")'
+row "excerpt redacts bearer-scheme credentials" \
+  '"abc123def456" not in excerpt("P1 Authorization: Bearer abc123def456 rejected")[0][0]'
+# Over-redaction is the mirror failure and destroys the diagnostic value the
+# excerpt exists for (third-reviewer finding). Both directions are asserted.
+row "redaction leaves benign security prose intact" \
+  'ce.redact_untrusted("P1 token validation bypassed here") == "P1 token validation bypassed here"'
+row "redaction still catches a credential-shaped value" \
+  '"abc123def456" not in ce.redact_untrusted("token abc123def456")'
+# `\b` does not fire inside `client_secret` (`_` is a word char) — challenge finding.
+row "redaction covers underscored key names" \
+  '"hunter2" not in ce.redact_untrusted("OAuth client_secret=hunter2")'
+row "excerpt redacts underscored key names" \
+  '"hunter2" not in excerpt("P1 OAuth client_secret=hunter2 in packet")[0][0]'
+# A free tail let a real fault ride along behind the benign prefix — review finding.
+check "benign matcher rejects a fault smuggled behind the advisory prefix" \
+  '[ "$(benign_probe "Skill descriptions were shortened to fit the skills context budget. Sandbox denied required access")" = False ]'
+# Third round on this predicate: any free tail is a smuggling surface, so the
+# whole advisory must match. An upstream reword now fails loudly instead.
+check "benign matcher rejects a fault smuggled mid-sentence" \
+  '[ "$(benign_probe "Skill descriptions were shortened to fit the skills context budget. Codex can still see every skill, but sandbox denied required access")" = False ]'
+# A short credential after an auth scheme must not survive on value length.
+row "redaction covers a short bearer value" \
+  '"hunter2" not in ce.redact_untrusted("Authorization: Bearer hunter2")'
+row "excerpt redacts a short bearer value" \
+  '"hunter2" not in excerpt("P1 Authorization: Bearer hunter2 accepted")[0][0]'
+
+echo '----'
+if [ "$fails" -eq 0 ]; then
+  echo concern_excerpt_tests_ok
+else
+  echo "$fails FAILURES"
+  exit 1
+fi

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_egress_schema.sh

@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# Field-schema regression for the OpenCode lane's egress (specs/013).
+#
+# The lane's payload crosses from an untrusted export into durable evidence rows.
+# `EGRESS_KEYS` bounded WHICH keys may leave; nothing bounded WHAT was inside
+# them, so a crafted export could put arbitrary text into `version` and it
+# egressed verbatim on every parser failure path. These cases pin the bound.
+set -euo pipefail
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+python3 - "$script_dir" <<'PY'
+import importlib.util
+import sys
+from pathlib import Path
+
+script_dir = Path(sys.argv[1])
+
+
+def load(name, path):
+    spec = importlib.util.spec_from_file_location(name, path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+schema = load("egress_schema", script_dir / "egress_schema.py")
+failures = []
+checks = []
+
+
+def check(label, condition, detail=""):
+    # Counted here rather than written as a literal: a hand-maintained case
+    # count in a second place goes stale the moment a case is added.
+    checks.append(label)
+    if not condition:
+        failures.append(f"{label}: {detail}")
+
+
+# Row 1 — well-formed metadata passes through untouched.
+clean = {
+    "reviewer": "opencode",
+    "status": "inconclusive",
+    "reason": "session_id_mismatch",
+    "session_id": "sample_session_0001",
+    "model": "anthropic/claude-sonnet-4",
+    "provider": "anthropic",
+    "version": "0.4.12",
+    "mode": "review",
+}
+out = schema.apply(dict(clean))
+check("row1-passthrough", out == clean, f"got {out!r}")
+
+# Row 7 — no violation means the key is ABSENT, not an empty list.
+check("row7-absent", "field_schema_violations" not in out, f"got {out!r}")
+
+# Row 2 — a megabyte of prose in `version`.
+out = schema.apply(dict(clean, version="lorem ipsum " * 90000))
+check("row2-value", out["version"] is None, f"got {out['version']!r}")
+check("row2-report", out.get("field_schema_violations") == ["version"], f"got {out!r}")
+# ...and the verdict fields are untouched.
+check("row2-verdict", out["status"] == "inconclusive" and out["reason"] == "session_id_mismatch", f"got {out!r}")
+
+# Row 3 — 201 characters of otherwise-legal charset.
+out = schema.apply(dict(clean, version="a" * 201))
+check("row3", out["version"] is None and out.get("field_schema_violations") == ["version"], f"got {out!r}")
+out = schema.apply(dict(clean, version="a" * 200))
+check("row3-boundary", out["version"] == "a" * 200, "200 chars must be legal")
+
+# Row 4 — control characters and whitespace stop a value being a single field.
+for bad in ("sample_1\nstatus=passed", "sample_1\ttab", "sample_1 space", 'sample_"quote', "sample_\x00nul"):
+    out = schema.apply(dict(clean, session_id=bad))
+    check(f"row4[{bad!r}]", out["session_id"] is None, f"got {out['session_id']!r}")
+
+# Row 5 — a non-string in an export-token field.
+for bad in ({"a": 1}, ["x"], 5, True):
+    out = schema.apply(dict(clean, model=bad))
+    check(f"row5[{bad!r}]", out["model"] is None, f"got {out['model']!r}")
+# ...but None itself is legal (the export may simply not carry it).
+out = schema.apply(dict(clean, model=None))
+check("row5-none", out["model"] is None and "model" not in out.get("field_schema_violations", []), f"got {out!r}")
+
+# Row 6 — two violations at once, order stable and declaration-ordered.
+out = schema.apply(dict(clean, session_id="bad id", version="also bad"))
+check("row6", out.get("field_schema_violations") == ["session_id", "version"], f"got {out!r}")
+
+# Row 10 — an undeclared key cannot be emitted.
+try:
+    schema.apply(dict(clean, smuggled="x"))
+    check("row10", False, "expected a raise for an undeclared key")
+except schema.UndeclaredEgressKey as error:
+    check("row10-name-only", "smuggled" in str(error) and "x" not in str(error).replace("smuggled", ""), f"got {error}")
+
+# Row 12 — the violation report carries names only, never a fragment of the value.
+# The canary is deliberately NOT shaped like a real credential: a key-shaped
+# literal here trips the review gate's egress scanner and blocks every non-Claude
+# reviewer lane from ever seeing this diff. What row 12 tests is that a
+# distinctive value does not survive into the output, and any distinctive token
+# proves that.
+canary = "CANARY-must-not-appear-in-output-0001"
+out = schema.apply(dict(clean, version=f"v1 {canary}"))
+check("row12-value-dropped", out["version"] is None, f"got {out['version']!r}")
+check("row12-no-leak", canary not in repr(out), f"offending value leaked into {out!r}")
+
+# Row 11 — one table, not two: the shell consumes this module's set instead of
+# re-declaring the names inline, where the two copies could drift apart.
+check("row11-keys-exported", isinstance(schema.EGRESS_KEYS, frozenset) and schema.EGRESS_KEYS, "EGRESS_KEYS must be a non-empty frozenset")
+shell = (script_dir / "opencode_review.sh").read_text()
+check("row11-shell-imports", "from egress_schema import" in shell, "the shell must import the table")
+check("row11-no-inline-copy", "EGRESS_KEYS = frozenset({" not in shell, "the shell still declares its own inline allowlist")
+# The concern path's set is narrower ON PURPOSE (an unlisted key fails that path
+# closed); widening it to EGRESS_KEYS would turn the fail-closed into relay.
+check("row11-narrower", schema.CONCERN_RELAY_KEYS < schema.EGRESS_KEYS, "concern relay set must be a strict subset")
+check("row11-structured-excluded", not (schema.CONCERN_RELAY_KEYS & {"findings", "text", "concern_results"}), "model content must not be in the concern relay set")
+
+# Review round 1 (codex, P1): the sanitize-and-report path must NOT cover fields
+# whose values this repo chooses. Nulling `status` IS a verdict change — the one
+# thing this schema promises never to make — and downstream gates route on it.
+# These values cannot come from the export, so an illegal one is an internal bug
+# and the only safe answer is to refuse to emit.
+for field, bad in (("status", "not-a-status"), ("cascade_eligible", "yes"),
+                   ("reason", "not a reason"), ("mode", "audit")):
+    try:
+        out = schema.apply(dict(clean, **{field: bad}))
+        check(f"contract-raises[{field}]", False, f"emitted {out!r} instead of raising")
+    except schema.ContractFieldViolation as error:
+        check(f"contract-raises[{field}]", field in str(error) and str(bad) not in str(error), f"got {error}")
+out = schema.apply(dict(clean, cascade_eligible=False))
+check("scalar-legal", out["cascade_eligible"] is False, "a real bool must pass")
+out = schema.apply(dict(clean, transport_tail_timeout=True))
+check("timeout-tail-scalar-legal", out["transport_tail_timeout"] is True, "timeout recovery evidence must remain a bool")
+# The verdict fields are never nulled on ANY path the schema takes.
+out = schema.apply(dict(clean, version="bad value", session_id="also bad"))
+check("verdict-untouched", out["status"] == "inconclusive" and out["reason"] == "session_id_mismatch",
+      f"an export-field violation moved a verdict field: {out!r}")
+
+# Challenge round 1 (codex, P1): the None skip was blanket, so a contract field
+# set to None slipped past the raise entirely — the same shape of mistake as the
+# finding above, one branch further in. `None` is legal for an EXPORT field (the
+# export need not carry it) and illegal for a contract field (we always choose
+# one). Unreachable from today's call sites, which is why only an adversarial
+# read found it.
+for field in ("status", "reviewer", "mode", "reason"):
+    try:
+        out = schema.apply(dict(clean, **{field: None}))
+        check(f"contract-none[{field}]", False, f"emitted {out!r} instead of raising")
+    except schema.ContractFieldViolation as error:
+        check(f"contract-none[{field}]", field in str(error), f"got {error}")
+
+# Review round 1 (codex, P1): `field_schema_violations` is OUTPUT-ONLY. It has no
+# schema row, so allowing it in would leave it the one unvalidated field — free
+# to carry arbitrary prose and to forge or suppress the tamper report itself.
+for forged in ("arbitrary prose\nstatus=passed", ["version"], {"k": "v"}, []):
+    try:
+        schema.apply(dict(clean, field_schema_violations=forged))
+        check(f"violation-field-input[{type(forged).__name__}]", False, "expected a raise")
+    except schema.UndeclaredEgressKey as error:
+        check(f"violation-field-input[{type(forged).__name__}]", "field_schema_violations" in str(error), f"got {error}")
+# It must still be RELAYABLE once this module produces it, or a crafted export
+# could trip the concern path's fail-closed and take the verdict down that way.
+check("violation-field-relayable", schema.VIOLATION_FIELD in schema.CONCERN_RELAY_KEYS, "the report must survive relay")
+
+# Export-token LISTS (tool names) are bounded per element — these are export-derived
+# and were not in the plan's table; declared here rather than left undeclared.
+out = schema.apply(dict(clean, exposed_tools=["bash", "write"]))
+check("token-list-legal", out["exposed_tools"] == ["bash", "write"], f"got {out!r}")
+out = schema.apply(dict(clean, exposed_tools=["ok", "bad\nname"]))
+check("token-list-violation", out["exposed_tools"] is None and "exposed_tools" in out.get("field_schema_violations", []), f"got {out!r}")
+
+if failures:
+    print("egress_schema_test_failed", file=sys.stderr)
+    for line in failures:
+        print(f"  {line}", file=sys.stderr)
+    raise SystemExit(1)
+print(f"egress_schema_checks_ok cases={len(checks)}")
+PY
+
+printf 'egress_schema_tests_ok\n'