@ccoalm/ccl-skills 0.1.1 → 0.3.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -1,11 +1,13 @@
 #!/usr/bin/env bash
 # Aggregate deterministic shell regressions for check-ccl-skills wrappers.
 #
-# Default / local layer: --fast. CI has a changes-gated job that runs --full so
-# Makefile and CI both call this single entrypoint instead of copying test lists.
+# Default / local layer: --fast. CI runs the two layers as parallel jobs
+# (regression-fast --fast, regression-heavy --heavy-only); --full remains the
+# local aggregate (`make test-check-ccl-regressions`). Makefile and CI both call
+# this single entrypoint instead of copying test lists.
 #
 # Usage:
-#   bash skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh [--fast|--full]
+#   bash skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh [--fast|--full|--heavy-only]
 #
 # --fast runs the quick/mid wrapper regressions:
 #   - test_ai_coding_implementation_gates.sh
@@ -31,19 +33,24 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || { cd "$SCRIPT_DIR/../../.." && pwd -P; })"
-SCRIPTS_DIR="$REPO_ROOT/skills/skill-extraction-workflow/scripts"
+# REGRESSION_SCRIPTS_DIR redirects the whole runner (execution and audit) at a
+# fixture tree, so the lane-semantics regression can prove mode dispatch with
+# stub suites instead of the real multi-minute ones.
+SCRIPTS_DIR="${REGRESSION_SCRIPTS_DIR:-$REPO_ROOT/skills/skill-extraction-workflow/scripts}"
 
 usage() {
   cat <<'EOF'
-Usage: test_check_ccl_regressions.sh [--fast|--full]
+Usage: test_check_ccl_regressions.sh [--fast|--full|--heavy-only]
 
 Runs deterministic shell regressions for check-ccl-skills wrapper behavior.
-Default is --fast to keep local `make test` light. GitLab CI runs --full from a
-changes-gated job for public deterministic regressions.
+Default is --fast to keep local `make test` light. CI runs --fast and
+--heavy-only as parallel jobs; --full is the local aggregate.
 
 Modes:
   --fast  the quick/mid wrapper regressions (exact set = the fast_tests array below / the list above)
   --full  fast layer plus R0 status and source-register lifecycle regressions
+  --heavy-only  only the heavy full-checker regressions (the heavy_tests array);
+          gives CI a heavy execution surface that does not repeat the fast layer
   --list-unregistered  print sibling test_*.sh NOT in fast_tests/heavy_tests (one per
           line) and exit 0; used by the registration guard test so a new test cannot
           silently skip CI. REGRESSION_SCRIPTS_DIR overrides the scanned directory.
@@ -54,6 +61,7 @@ mode="fast"
 case "${1:-}" in
   ""|--fast) mode="fast" ;;
   --full) mode="full" ;;
+  --heavy-only) mode="heavy-only" ;;
   --list-unregistered) mode="list-unregistered" ;;
   -h|--help) usage; exit 0 ;;
   *) usage >&2; exit 2 ;;
@@ -64,20 +72,25 @@ if [ "$#" -gt 1 ]; then
   exit 2
 fi
 
-run_test() {
-  local test_name="$1"
-  local test_path="$SCRIPTS_DIR/$test_name"
-  local started_at ended_at rc
-  [ -f "$test_path" ] || { echo "FAIL: missing regression test: $test_path" >&2; exit 1; }
-  started_at="$(date +%s)"
-  if bash "$test_path"; then
-    rc=0
-  else
-    rc=$?
-  fi
-  ended_at="$(date +%s)"
-  echo "regression_test_timing: test=$test_name seconds=$((ended_at - started_at)) status=$rc"
-  return "$rc"
+# Lanes execute through the shared bounded-concurrency runner: these suites are
+# dominated by waiting (process timeouts, stub sleeps) and by independent
+# subprocesses, so serial execution burned wall-clock the runner host was not
+# using. The runner owns the missing-file precondition, the per-suite timing
+# line, in-order output replay, and failure propagation; assertions inside the
+# suites are untouched. `SUITE_JOBS=1` restores serial execution for debugging a
+# suspected concurrency interaction. See specs/037-ci-intra-job-parallel/plan.md
+# for the per-lane shared-state audit that makes this safe.
+PARALLEL_RUNNER="$REPO_ROOT/scripts/run-parallel-suites.sh"
+
+run_lane() {
+  local label="$1"; shift
+  local paths=() entry
+  for entry in "$@"; do paths+=("$SCRIPTS_DIR/$entry"); done
+  [ -f "$PARALLEL_RUNNER" ] || {
+    echo "FAIL: missing parallel suite runner: $PARALLEL_RUNNER" >&2
+    exit 1
+  }
+  bash "$PARALLEL_RUNNER" --label "$label" "${paths[@]}"
 }
 
 fast_tests=(
@@ -98,6 +111,13 @@ fast_tests=(
   # differential stays in the heavy suite, but a require-date regression must
   # go RED in every `make test`, not only under --full.
   test_impact_chain_gate_dateless_host.sh
+  # Row-ownership attribution probes: a control leg plus the refusals the gate
+  # owes on a surviving row that vouches for an unchanged owner, a row citing a
+  # package path other than SKILL.md, a row resolving to two selected owners,
+  # and the two shapes that must keep their prior silent skip (an unrelated
+  # five-column register table, a non-curated owner). Synthetic repos only, no
+  # clone, so it belongs in the lane every run exercises.
+  test_impact_chain_round_attribution.sh
   test_eval_routing_bank_grader_diagnostics.sh
   test_eval_routing_bank_surface_binding.sh
   test_eval_routing_prose_target.sh
@@ -106,6 +126,10 @@ fast_tests=(
   test_validate_skill_cross_refs.sh
   test_git_identity_predicate_gate.sh
   test_regression_runner_registration.sh
+  # Lane-semantics guard for this runner itself (036 challenge P2): proves
+  # --heavy-only / --fast / --full each run exactly their lane against a stub
+  # fixture via REGRESSION_SCRIPTS_DIR, and that a red heavy stub propagates.
+  test_regression_runner_lanes.sh
   test_routing_pointer_integrity.sh
   test_routing_bank_integrity.sh
   test_governing_chain_diff.sh
@@ -129,6 +153,17 @@ heavy_tests=(
   # here costs no enforcement — it only stops charging every pre-commit run for a
   # repo clone, and stops a slow entry competing for the runner host.
   test_register_firing_path_wiring.sh
+  # No-verdict-regression differential: materializes twelve pinned integration
+  # points as detached worktrees and runs both the baseline and candidate gate
+  # against each. Proves the other half of a gate change — that it did not start
+  # refusing what it used to accept — which is the half that blocks every author
+  # when it goes wrong. Worktree-per-point makes it far too slow for pre-commit.
+  # source-refuted 证据类的滥用面：16 条合成用例，每条一条分支，且整仓 clone 一次
+  # 作 fixture 底座。它测的正是「这个类会不会变成通用豁免」——七轮独立评审各击穿过
+  # 一版门槛，所以负向用例（真行为变更披标签、抵消式新增、路径穿越、子串锚、改权限、
+  # 对照表不交代被删内容）必须每轮都跑。clone + 16 分支对 pre-commit 太慢，进 heavy。
+  test_impact_chain_source_refuted.sh
+  test_impact_chain_gate_verdict_differential.sh
 )
 
 # Registration self-audit: every sibling test_*.sh must appear in fast_tests or
@@ -155,19 +190,25 @@ if [ "$mode" = "list-unregistered" ]; then
   exit 0
 fi
 
-for test_name in "${fast_tests[@]}"; do
-  run_test "$test_name"
-done
+# Unregistered siblings hard-fail every execution mode (036 challenge P1): the
+# old advisory-only tail made enforcement depend on the registration guard test
+# itself staying registered — removing it from fast_tests silenced the only red
+# path. Failing here keeps enforcement independent of any one array entry.
+if [ -n "$unregistered" ]; then
+  echo "FAIL: test_*.sh not registered in fast_tests/heavy_tests (CI would silently skip them):$unregistered" >&2
+  exit 1
+fi
 
-if [ "$mode" = "full" ]; then
-  for test_name in "${heavy_tests[@]}"; do
-    run_test "$test_name"
-  done
-  echo "test_check_ccl_regressions_full_ok"
-else
-  echo "test_check_ccl_regressions_fast_ok"
+if [ "$mode" != "heavy-only" ]; then
+  run_lane regression_fast_lane "${fast_tests[@]}"
 fi
 
-if [ -n "$unregistered" ]; then
-  echo "regression_runner_unregistered_tests_advisory: not in fast_tests/heavy_tests, CI will NOT run them:$unregistered" >&2
+if [ "$mode" = "full" ] || [ "$mode" = "heavy-only" ]; then
+  run_lane regression_heavy_lane "${heavy_tests[@]}"
 fi
+
+case "$mode" in
+  full) echo "test_check_ccl_regressions_full_ok" ;;
+  heavy-only) echo "test_check_ccl_regressions_heavy_only_ok" ;;
+  *) echo "test_check_ccl_regressions_fast_ok" ;;
+esac

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_skill_catalog.sh

@@ -205,7 +205,10 @@ expect_block() {
     printf '%s\n' "$CASE_OUTPUT" >&2
     exit 1
   }
-  printf '%s\n' "$CASE_OUTPUT" | grep -q "$token" || {
+  # SIGPIPE-safe match; see the note at the first such comparison below.
+  # `=~`, not a glob: callers pass REGEX tokens (c1 uses `.*`), so a literal
+  # substring test would reject a correct gate message.
+  [[ "$CASE_OUTPUT" =~ $token ]] || {
     echo "FAIL[$label]: gate blocked without naming $token" >&2
     printf '%s\n' "$CASE_OUTPUT" >&2
     exit 1
@@ -258,7 +261,11 @@ run_case
   printf '%s\n' "$CASE_OUTPUT" >&2
   exit 1
 }
-printf '%s\n' "$CASE_OUTPUT" | grep -q 'skill_catalog_contract_ok' || {
+# Pure-bash substring match, not `printf | grep -q`: grep -q exits on its first
+# hit, the producer takes SIGPIPE, and under `set -o pipefail` the SUCCESS path
+# then reports failure. Timing-dependent, so it stayed latent until this lane
+# ran concurrently (specs/037-ci-intra-job-parallel/plan.md).
+[[ "$CASE_OUTPUT" == *skill_catalog_contract_ok* ]] || {
   echo "FAIL[c6]: pristine tree passed without the contract marker" >&2
   printf '%s\n' "$CASE_OUTPUT" >&2
   exit 1
@@ -313,12 +320,12 @@ run_case
 new_case
 rm -f "$CASE_DIR/agent-context/session-start.md"
 run_case
-printf '%s\n' "$CASE_OUTPUT" | grep -q 'skill_catalog_entry_coverage_unevaluated' || {
+[[ "$CASE_OUTPUT" == *skill_catalog_entry_coverage_unevaluated* ]] || {
   echo "FAIL[c9]: missing routing layer was not reported as unevaluated" >&2
   printf '%s\n' "$CASE_OUTPUT" >&2
   exit 1
 }
-printf '%s\n' "$CASE_OUTPUT" | grep -q 'skill_catalog_contract_ok' && {
+[[ "$CASE_OUTPUT" == *skill_catalog_contract_ok* ]] && {
   echo "FAIL[c9]: contract_ok claimed while entry coverage was never evaluated" >&2
   printf '%s\n' "$CASE_OUTPUT" >&2
   exit 1

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_impact_chain_gate_verdict_differential.sh

@@ -0,0 +1,421 @@
+#!/usr/bin/env bash
+# No-verdict-regression differential for the impact-chain gate.
+#
+# The probe suite proves the gate refuses what it should. This proves it did not
+# start refusing anything it used to accept — the other half, and the half that
+# blocks every author when it goes wrong. A shared merge gate cannot ship a
+# tightening on an asserted "I checked": the check has to be re-runnable by
+# whoever reviews or reverts it.
+#
+# Method: for each pinned integration point M on the integration branch, the
+# gate's real input was (base = M's first parent, HEAD = M) — that is the merge
+# result CI evaluates. Replay exactly that for the BASELINE gate blob and for the
+# working-tree gate, and compare exit verdicts. A range that the baseline accepted
+# and the candidate refuses is a regression and fails this test.
+#
+# Refs are pinned by SHA, not by branch name, so this keeps testing the same
+# history after the branch moves. Missing refs FAIL rather than skip: a
+# differential that silently tests nothing is worse than no differential.
+#
+# TWO INPUT SETS, because the pins alone can only prove one direction. Every
+# pinned integration point is baseline-GREEN — asserted per point, not assumed,
+# since a baseline that failed for an EXECUTION reason (missing runtime,
+# incompatible checkout, moved path) is otherwise indistinguishable from a
+# candidate refusing for a POLICY reason: both nonzero, no mismatch recorded, a
+# green run certifying nothing. But an all-green input set makes the
+# newly-accepted arm unreachable, so a loosened candidate would clear all twelve
+# and the run would still claim "no change in either direction".
+#
+# The synthetic replay cases at the bottom carry the other half: one is
+# baseline-RED by construction (an owner changed with no ledger row), so a
+# candidate that stopped refusing it is caught there and nowhere else. Each case
+# declares the verdict the baseline must produce, and a refusal must also carry
+# its expected diagnostic token — that token is what separates a policy refusal
+# from a broken fixture, which would otherwise be banked as evidence.
+#
+# Oracle: an always-refuse candidate fails on the pins; an always-accept
+# candidate fails on the baseline-red case. Both arms are exercised.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+CANDIDATE_GATE="$SCRIPT_DIR/impact-chain-gate.rb"
+[ -f "$CANDIDATE_GATE" ] || { echo "FAIL: gate not found: $CANDIDATE_GATE" >&2; exit 1; }
+
+REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel)" || exit 1
+
+# The gate as it stood before the row-ownership change, pinned by the commit it
+# last shipped in. Update this together with the integration points below only
+# when re-baselining deliberately, and say so in the commit that does it.
+BASELINE_GATE_COMMIT="5146b3b315c487f93ba352584a0b27af9414676b"
+GATE_PATH="skills/skill-extraction-workflow/scripts/impact-chain-gate.rb"
+
+# Integration points, newest first: EVERY merge commit reachable from
+# BASELINE_GATE_COMMIT — the whole integration history this gate has judged, not
+# a window into it. The list is asserted against git's own answer below, so a pin
+# quietly dropped or left stale after a history rewrite fails the test instead of
+# shrinking its coverage silently.
+INTEGRATION_POINTS="
+5146b3b315c487f93ba352584a0b27af9414676b
+b9de138694624df13cba05ec9bdb4c99c3cc8ef5
+17db43bcb4083423ba071de26071041d3b3c1c67
+1b21d2efda0e64da47ab468d338a671be483bc0b
+73a62ca2da1f41bfe7bb9fb728315bdc0b9d0f27
+f7b11522e7e46fce2dee5ed2d6fc2b73b04eb6ac
+e645ea975e922bdb0a7036f853a2ecfdd19bb184
+d767d2ff6ed80ff91b05a5dcd1fe946eea0e785c
+af3f5e7d1410f62b7eaafe88bdff915af5d41831
+2b11657630e1a3c4cb8650b4d1f5f8282bcf0a16
+ff31d0ca0bd79405ac2dded54647c3a743511425
+4b7afd22a1001769ce970de4dfb41be28da578fc
+d4c9b092655e284e511855c4306ed7a9d1b0aa10
+f03b1140fc4c2b304411eb67d7771479c82874bf
+d2d6337e26493e762a3af3db624894e300008081
+a04f9a0bea97a1c53b3cab95ce7337cccec2583c
+76e8b8ccbd3178fc2341b674c8486356e63081d9
+c5d2d35e2e7c9b6725c2b533dd480bda3a9bacbf
+1b0c6fb0683d86fb9c6458a61beb32516c63f3cc
+408e11104c2cf5e47dcfe170243a260ffb5e8165
+93d09c563ff7bfe7ccc6c20b8b0d2f9c1758c031
+4516e30952cc429e2d0e5dbb7971a4e64796feae
+1ab0af0966044b1a1875a8737a448e394566db15
+6437abee61f9c41f3f890d75165aee701dfbbc65
+bd9d01b3b909f85529b5ef87539c6e73a7fa0be9
+e8c128d178ae2df94454859081ab0cad5ef52206
+b05b74d6796a511f88208673872990aa20027675
+61f5b2e1937c87ed4eeb763c1adf883fdbc97d79
+98735e027f10dcda57a6649534b9f6af3a451a71
+989cf5f9a0e4f33c4cf8ccb839b01da78b94af18
+c84beaf47805c4187714dbbf9010b04c08b0a585
+138ce664f1e40ccd563b3be896652b8335988003
+06163ecb1a2448deef50ff91527849b22a89fbfd
+9f233728a3b9deac9ba9a8c12d1d4fd3693bf2e6
+8cea35e6dba34a8af6eba3746d14b89efacc147a
+31d3b3f1ba130622fd888c2a6e35ba1b6eaafd1e
+34d504bec2dc5ec9935a9896fff71872359042fa
+759dc6030e9ae6ba8dca06d77a4afdb93231b12a
+2205292a900ad609f92d2d89d4ed9fbdc5f9456d
+673fece3cf3d893ed6707119f60cd656f3ae6331
+95f06b2e6057c4f070ab072f42ef959042a44036
+0fd26e7aeed9832307b7a6724855f31269c71b5f
+19a04b6a3e4c3025185690470fd501ba82f126d8
+8b0f44be666b894af319cecf823fca64ba448631
+fb551574b0d8cfac7022c406daa847717f46cc46
+37faff720a4786eaeeda328605a046cc1d66189d
+c0561c74e0f7249b8041f7c5800a8d6deadf496f
+7f114e56d9893f78834dc4f3bca2e2cfc6dfb320
+d249ab85d17705e4a30935759a15ff613a38a05c
+d63ac44bd37b9375309515c8ff62bc91d3f78072
+2aa8cd3d92efe18cb7a18990488481664f6b1286
+48e9eb627be2ee9f484f7b11a966ce8d4b146958
+1ecc8558da485eb8784030d629b0bb21547c07cb
+2a0ec222a847fb1a71396d0dcbd439004dfc1c0c
+6a795af5690a30bcef598e37886dd0cf06d9dc15
+87d42560005030dca3bef7a7aa0ef21e340059ae
+b332b01059eb7322a32d3ef186fd8bbb25e0037e
+a63246578f53d849e0a5cb41cb65763a5cdf4fcc
+fad480296eb0334291d804cdc3f1f7f0928d802d
+90ec533e172acdda8c6b42a20b572488bfe29b59
+ba0a1cc44d28f17ae1aafed390518655eaf7598c
+046612652f4613ae8f569a1f3287afcbd7509de6
+4c0904bf7c7d342bac0deafced16a8ba157d40d5
+15a89e95b7fc6ba0112fdb777545b55cc683f90b
+"
+
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/icverdict.XXXXXX")"
+cleanup() {
+  rc=$?
+  git -C "$REPO_ROOT" worktree remove --force "$TMP/probe" >/dev/null 2>&1 || true
+  rm -rf "$TMP"
+  exit $rc
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+BASELINE_GATE="$TMP/impact-chain-gate-baseline.rb"
+git -C "$REPO_ROOT" show "$BASELINE_GATE_COMMIT:$GATE_PATH" > "$BASELINE_GATE" 2>/dev/null || {
+  echo "FAIL: baseline gate blob is unreachable at $BASELINE_GATE_COMMIT:$GATE_PATH" >&2
+  echo "      fetch the integration branch's history, or re-baseline deliberately" >&2
+  exit 1
+}
+
+# EXPECTED DIVERGENCES. Four landings back-filled a ledger row by corrective
+# rewrite — the repair for a round that merged with this gate red — so the owner
+# change sits below their base and the row cites an owner the range does not
+# touch. The candidate refuses that shape by design and deliberately offers no
+# author-declared escape, so these four historical ranges diverge. The gate is
+# diff-scoped and never re-judges landed history, so nothing operational depends
+# on them; this differential is the only thing that replays them.
+#
+# Each exemption is constrained to ONE direction and ONE diagnostic. A blanket
+# "any mismatch at this SHA is fine" would also swallow the opposite direction —
+# a loosening — which is the failure this whole suite exists to catch. Entries are
+# named individually, never matched by pattern, and an entry that stops diverging
+# is reported as stale rather than tolerated.
+EXPECTED_DIVERGENCE_SHAS="f03b1140f 93d09c563 9f233728a 046612652"
+EXPECTED_DIVERGENCE_DIRECTION="newly refused"
+EXPECTED_DIVERGENCE_TOKEN="impact_chain_row_vouches_for_unchanged_owner"
+expected_divergence() { # <full sha> <direction> <candidate output>
+  local short="${1:0:9}" direction="$2" out="$3" known
+  [ "$direction" = "$EXPECTED_DIVERGENCE_DIRECTION" ] || return 1
+  case "$out" in *"$EXPECTED_DIVERGENCE_TOKEN"*) : ;; *) return 1 ;; esac
+  for known in $EXPECTED_DIVERGENCE_SHAS; do
+    [ "$known" = "$short" ] && return 0
+  done
+  return 1
+}
+
+# A no-op differential would pass vacuously and certify nothing. With expected
+# divergences configured it is worse than vacuous: identical gates cannot produce
+# them, so the exemptions are stale and the run would pass while silently failing
+# the staleness check it never reaches.
+if cmp -s "$BASELINE_GATE" "$CANDIDATE_GATE"; then
+  if [ -n "$(printf '%s' "$EXPECTED_DIVERGENCE_SHAS" | tr -d '[:space:]')" ]; then
+    echo "FAIL: baseline and candidate are byte-identical, yet expected divergences are configured" >&2
+    echo "      identical gates cannot diverge — the exemptions are stale and must be removed" >&2
+    exit 1
+  fi
+  echo "impact_chain_gate_verdict_differential: baseline and candidate are byte-identical — nothing to compare"
+  exit 0
+fi
+
+# Completeness assertion: the pinned list must be exactly every merge commit
+# reachable from the baseline, which is the whole integration history this gate
+# has ever judged. Without it the list is a hand sample that can lose points
+# silently while still reporting a clean run.
+expected_pins="$(git -C "$REPO_ROOT" rev-list --merges "$BASELINE_GATE_COMMIT" | tr -d ' ')"
+actual_pins="$(printf '%s\n' $INTEGRATION_POINTS)"
+if [ "$expected_pins" != "$actual_pins" ]; then
+  echo "FAIL: the pinned set is not every merge commit reachable from $BASELINE_GATE_COMMIT" >&2
+  echo "      re-baselining is a deliberate edit: regenerate the list and say so in the commit" >&2
+  diff <(printf '%s\n' "$expected_pins") <(printf '%s\n' "$actual_pins") | head -20 | sed 's/^/      | /' >&2
+  exit 1
+fi
+
+regressions=0
+expected_seen=0
+compared=0
+for point in $INTEGRATION_POINTS; do
+  git -C "$REPO_ROOT" rev-parse -q --verify "$point^{commit}" >/dev/null || {
+    echo "FAIL: pinned integration point is not present: $point" >&2
+    exit 1
+  }
+  parent="$(git -C "$REPO_ROOT" rev-parse "$point^1")"
+  subject="$(git -C "$REPO_ROOT" log --format=%s -n 1 "$point" | cut -c1-46)"
+  git -C "$REPO_ROOT" worktree remove --force "$TMP/probe" >/dev/null 2>&1 || true
+  git -C "$REPO_ROOT" worktree add --detach -q "$TMP/probe" "$point" >/dev/null 2>&1 || {
+    echo "FAIL: could not materialize $point" >&2
+    exit 1
+  }
+  set +e
+  baseline_out="$(env -u ALIAS_AUDIT_CMD CCL_SKILL_BASE_REF="$parent" ruby "$BASELINE_GATE" "$TMP/probe" 2>&1)"
+  baseline_rc=$?
+  set -e
+  # A nonzero baseline is only usable as a verdict when it is a POLICY refusal.
+  # An execution failure — missing runtime, incompatible checkout, moved path —
+  # also exits nonzero, and treating it as "the baseline refused" would let it
+  # mask a real candidate regression on the same point. The gate names every
+  # refusal it makes, so requiring one of those names is what separates the two.
+  if [ "$baseline_rc" != 0 ]; then
+    case "$baseline_out" in
+      *impact_chain_*) : ;;
+      *)
+        echo "FAIL: baseline exited $baseline_rc on $point without naming a gate refusal" >&2
+        echo "      that is an execution failure, not a verdict; fix the environment or re-baseline" >&2
+        printf '%s\n' "$baseline_out" | head -10 | sed 's/^/      | /' >&2
+        exit 1
+        ;;
+    esac
+  fi
+  set +e
+  candidate_out="$(env -u ALIAS_AUDIT_CMD CCL_SKILL_BASE_REF="$parent" ruby "$CANDIDATE_GATE" "$TMP/probe" 2>&1)"
+  candidate_rc=$?
+  set -e
+  compared=$((compared + 1))
+  # The same rule on the candidate side. Comparing exit codes alone counts
+  # "both nonzero" as agreement, so a candidate that CRASHES on a point the
+  # baseline legitimately refuses reads as unchanged — the one place a real
+  # regression could hide behind a matching number.
+  if [ "$candidate_rc" != 0 ]; then
+    case "$candidate_out" in
+      *impact_chain_*) : ;;
+      *)
+        echo "FAIL: candidate exited $candidate_rc on $point without naming a gate refusal" >&2
+        echo "      that is an execution failure, not a verdict" >&2
+        printf '%s\n' "$candidate_out" | head -10 | sed 's/^/      | /' >&2
+        exit 1
+        ;;
+    esac
+  fi
+  # EITHER direction is a mismatch. Reporting only the tighten-side drift would
+  # let a loosening pass the very evidence a tightening-only change offers: a
+  # point the baseline refused and the candidate now accepts is a silently
+  # widened gate, which on a shared merge gate is the worse of the two failures.
+  # An intended verdict change re-baselines the pins deliberately and says so;
+  # it does not slip through as an informational line.
+  flag=""
+  direction=""
+  if [ "$baseline_rc" = 0 ] && [ "$candidate_rc" != 0 ]; then
+    direction="newly refused"
+  elif [ "$baseline_rc" != 0 ] && [ "$candidate_rc" = 0 ]; then
+    direction="newly accepted"
+  fi
+  if [ -n "$direction" ]; then
+    if expected_divergence "$point" "$direction" "$candidate_out"; then
+      flag="  (expected divergence: corrective-rewrite back-fill, $direction)"
+      expected_seen=$((expected_seen + 1))
+    else
+      flag="  <== VERDICT MISMATCH: $direction"
+      regressions=$((regressions + 1))
+    fi
+  fi
+  # Only mismatches are printed: 64 agreeing lines is noise that hides the one
+  # line that matters.
+  if [ -n "$flag" ]; then
+    printf '%-10s %-10s rc=%-4s rc=%-4s %s%s\n' \
+      "${point:0:9}" "${parent:0:9}" "$baseline_rc" "$candidate_rc" "$subject" "$flag"
+  fi
+  if [ -n "$flag" ] && [ "$candidate_rc" != 0 ]; then
+    printf '%s\n' "$candidate_out" | head -8 | sed 's/^/       | /'
+  fi
+done
+
+
+
+# ---------------------------------------------------------------------------
+# BASELINE-RED REPLAY CASES.
+#
+# Every pinned integration point is baseline-green, and the assertion above
+# exits on any that is not. That makes the newly-accepted arm unreachable over
+# the pins alone: an always-accept candidate would clear all twelve and the run
+# would still report "no change in either direction" — a claim wider than the
+# evidence. The refusals the replaced gate made are the other half of its
+# behavior and need their own cases.
+#
+# Each case declares the verdict the BASELINE must produce and, for a refusal,
+# the diagnostic token that refusal must carry. Asserting the token is what
+# keeps a policy refusal distinguishable from an execution failure: a ruby
+# crash, a missing path, or a broken fixture also exits nonzero, and counting
+# that as "the baseline refused" would bank a broken setup as evidence.
+# ---------------------------------------------------------------------------
+LEDGER_REL="skills/skill-extraction-workflow/references/source-register.md"
+
+seed_case() { # <dir>
+  local repo="$1"
+  mkdir -p "$repo/skills/product-rd-workflow" "$repo/skills/skill-extraction-workflow/references"
+  git -C "$repo" init -q -b trunk
+  git -C "$repo" config user.email test@example.invalid
+  git -C "$repo" config user.name "Test User"
+  git -C "$repo" config commit.gpgsign false
+  cat > "$repo/skills/product-rd-workflow/SKILL.md" <<'MD'
+---
+name: product-rd-workflow
+description: Fixture owner for the verdict differential's baseline-red cases.
+---
+
+# Fixture Owner
+
+## Rules
+
+- Baseline rule line present before the case commit.
+MD
+  printf '| Lesson | Downstream owner | Behavior | Status | Evidence |\n| --- | --- | --- | --- | --- |\n' \
+    > "$repo/$LEDGER_REL"
+  git -C "$repo" add -A
+  git -C "$repo" commit -qm "seed"
+  git -C "$repo" branch fixture-base HEAD
+  git -C "$repo" switch -q -c case fixture-base
+  printf -- '- Rule DIFFERENTIAL-CASE must be recorded before the round lands.\n' \
+    >> "$repo/skills/product-rd-workflow/SKILL.md"
+}
+
+case_failures=0
+run_case() { # <name> <expected-baseline-rc> <expected-token-or-empty> <declare:yes|no>
+  local name="$1" want_rc="$2" want_token="$3" declare_row="$4"
+  local repo="$TMP/case-$name"
+  seed_case "$repo"
+  if [ "$declare_row" = yes ]; then
+    printf '| Fixture differential row | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/SKILL.md#DIFFERENTIAL-CASE | `updated` | `product-rd-workflow/SKILL.md` fixture change |\n' \
+      >> "$repo/$LEDGER_REL"
+  fi
+  git -C "$repo" add -A
+  git -C "$repo" commit -qm "case commit"
+
+  set +e
+  local b_out c_out b_rc c_rc
+  b_out="$(env -u ALIAS_AUDIT_CMD CCL_SKILL_BASE_REF=fixture-base ruby "$BASELINE_GATE" "$repo" 2>&1)"
+  b_rc=$?
+  c_out="$(env -u ALIAS_AUDIT_CMD CCL_SKILL_BASE_REF=fixture-base ruby "$CANDIDATE_GATE" "$repo" 2>&1)"
+  c_rc=$?
+  set -e
+
+  # The baseline must produce the verdict this case exists to pin. Anything else
+  # is a broken fixture or environment, and continuing would compare against it.
+  if [ "$b_rc" != "$want_rc" ]; then
+    echo "FAIL: case '$name' expected baseline rc=$want_rc, got rc=$b_rc" >&2
+    printf '%s\n' "$b_out" | head -6 | sed 's/^/      | /' >&2
+    exit 1
+  fi
+  if [ -n "$want_token" ]; then
+    case "$b_out" in
+      *"$want_token"*) : ;;
+      *)
+        echo "FAIL: case '$name' baseline refused, but not for '$want_token' — treat as setup failure, not policy" >&2
+        printf '%s\n' "$b_out" | head -6 | sed 's/^/      | /' >&2
+        exit 1
+        ;;
+    esac
+  fi
+
+  # Same rule on the candidate as on the baseline: a nonzero exit only counts as
+  # a verdict when it names a refusal. Comparing exit codes alone lets a candidate
+  # that CRASHES on the baseline-red case match rc=1 and read as agreement — the
+  # one place this case could certify nothing while looking green.
+  if [ "$c_rc" != 0 ]; then
+    case "$c_out" in
+      *impact_chain_*) : ;;
+      *)
+        echo "FAIL: case '$name' candidate exited $c_rc without naming a gate refusal" >&2
+        echo "      that is an execution failure, not a verdict" >&2
+        printf '%s\n' "$c_out" | head -6 | sed 's/^/      | /' >&2
+        exit 1
+        ;;
+    esac
+  fi
+  local flag=""
+  if [ "$b_rc" = 0 ] && [ "$c_rc" != 0 ]; then
+    flag="  <== VERDICT MISMATCH: newly refused"; case_failures=$((case_failures + 1))
+  elif [ "$b_rc" != 0 ] && [ "$c_rc" = 0 ]; then
+    flag="  <== VERDICT MISMATCH: newly accepted"; case_failures=$((case_failures + 1))
+  fi
+  printf '%-28s rc=%-4s rc=%-4s %s%s\n' "$name" "$b_rc" "$c_rc" "(expected baseline rc=$want_rc)" "$flag"
+  if [ -n "$flag" ]; then
+    printf '%s\n' "$c_out" | head -6 | sed 's/^/       | /'
+  fi
+}
+
+echo
+printf '%-28s %-7s %-7s %s\n' CASE BASELINE CANDIDATE EXPECTATION
+# Baseline-RED: an owner changed with no ledger row. This is the case that makes
+# the newly-accepted arm reachable — a candidate that stopped refusing it would
+# be caught here and nowhere else.
+run_case "undeclared-owner-change" 1 "impact_chain_gate_missing" no
+# Baseline-GREEN control on the same fixture shape, so a case that fails does so
+# because of the missing declaration and not because the shape itself is refused.
+run_case "declared-owner-change" 0 "" yes
+
+echo
+total_failures=$((regressions + case_failures))
+if [ "$total_failures" -gt 0 ]; then
+  echo "impact_chain_gate_verdict_differential: $regressions/$compared integration points and $case_failures replay cases changed verdict unexpectedly" >&2
+  exit 1
+fi
+# An expected divergence that stops diverging means the exemption is stale and
+# should be removed, so it is reported rather than silently tolerated.
+expected_total="$(for e in $EXPECTED_DIVERGENCE_SHAS; do echo "$e"; done | wc -l | tr -d ' ')"
+if [ "$expected_seen" != "$expected_total" ]; then
+  echo "FAIL: $expected_seen of $expected_total expected divergences actually diverged" >&2
+  echo "      an exemption that no longer fires is stale — remove it" >&2
+  exit 1
+fi
+echo "impact_chain_gate_verdict_differential: ok ($compared integration points, $expected_seen named expected divergences, 2 replay cases incl. one baseline-red; no unexpected verdict change in either direction)"