@ccoalm/ccl-skills 0.10.0 → 0.11.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/impact-chain-gate.rb

@@ -1327,19 +1327,48 @@ if upstream.any? || routing_entrypoint_changed || changed_paths.include?(LEDGER_
     # path is broken gets the firing-path message; every other failure shape
     # gets the behavior-evidence message. (A declared wording-only row can
     # never be a RED row, so no exclusion is needed here.)
-    firing_path_incomplete = evaluated.any? do |entry|
-      entry[:red_declared] && !entry[:firing_path_valid]
-    end
-    if firing_path_incomplete
-      firing_path_failures << path
+    # Name the OFFENDING ROWS, not just the owner. The owner-level `all?` above
+    # means one bad row reddens the package, so an owner-only diagnostic sends the
+    # author to inspect whichever row they were just writing — which is usually the
+    # correct one. Observed: a round whose new row was fine failed because an
+    # unrelated ALREADY-COMMITTED ledger row had been edited by an unbounded string
+    # replace; the edit made that old row an added row of this round, so its own
+    # original anchor no longer resolved here. Three iterations went into rewriting
+    # the good anchor before the real offender was found by patching debug output
+    # into this script. The row identity is what closes that gap.
+    offending_rows = evaluated.each_index.select do |index|
+      evaluated[index][:red_declared] && !evaluated[index][:firing_path_valid]
+    end.map { |index| owner_rows[index] }
+    if offending_rows.any?
+      firing_path_failures << { path: path, rows: offending_rows }
     else
       behavior_failures << path
     end
   end
+  # First cell of a ledger row, bounded: enough to recognise which row is meant
+  # without dumping a multi-thousand-character evidence cell into the diagnostic.
+  # This renders REPOSITORY TEXT a contributor controls onto a terminal/CI channel,
+  # so it is scrubbed before it is printed, not merely bounded. C0/C1 controls,
+  # bidi overrides, and zero-width characters can erase earlier output, restyle it,
+  # or reorder the rendered row so the named offender is not the one a reader sees —
+  # a length cap does nothing about any of that. Invalid bytes are replaced first so
+  # the escape pass cannot raise on a malformed cell. Both reviewer lanes raised this
+  # independently.
+  CONTROL_OR_INVISIBLE = /[\u0000-\u001F\u007F-\u009F\u200B-\u200F\u2028-\u202E\u2060-\u2064\u206A-\u206F\uFEFF]/.freeze
+  row_label = lambda do |row|
+    cell = row[:line].to_s.sub(/\A\+/, "").split("|")[1].to_s.strip
+    cell = cell.empty? ? row[:line].to_s.strip : cell
+    visible = cell.scrub("?").gsub(CONTROL_OR_INVISIBLE) { |ch| format("\\u%04X", ch.ord) }
+    visible.length > 120 ? "#{visible[0, 117]}..." : visible
+  end
   unless firing_path_failures.empty?
     warn "impact_chain_firing_path_missing: RED-baseline row has no owner-scoped firing path in this committed diff"
     warn "  fix: point to this owner with `firing-path: command:<changed repo executable>` or `firing-path: file:<changed markdown>#<unique token on a changed numbered/list rule with a normative action>`"
-    firing_path_failures.each { |path| warn "  incomplete: #{path}" }
+    warn "  note: the rows named below are the ones that failed — every RED row bound to an owner must resolve, so a row you did not intend to touch can redden the owner. If a named row is one you only EDITED, it became an added row of this round and its original anchor no longer resolves against this round's diff: restore that row rather than rewriting an anchor that was already correct."
+    firing_path_failures.each do |entry|
+      warn "  incomplete: #{entry[:path]}"
+      entry[:rows].each { |row| warn "    offending row: #{row_label.call(row)}" }
+    end
     exit 1
   end
   unless behavior_failures.empty?

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py

@@ -0,0 +1,476 @@
+#!/usr/bin/env python3
+"""Require the landing candidate to be the candidate an external round reviewed.
+
+The dual-track ledger is caller-built and caller-run. Nothing at merge time read
+it, so which candidate the rounds actually inspected was unchecked: a chain could
+close out on the pre-fix candidate while a different tree merged. This gate closes
+that gap from the merge side.
+
+The reviewed identity is the packet the controller froze, so this recomputes that
+packet with the controller's own `freeze_packet` rather than a second
+implementation of the same bytes -- two implementations of one hash drift, and the
+drift would read as a forged ledger. The bound set is every tracked path, minus
+exactly what this round adds under a round's evidence directory. It is a default
+of everything rather than a whitelist because a whitelist binds only the paths
+some round happened to review: a pull request could carry a ledger valid for its
+skill changes while also landing a root build script, a release script, or any
+other executable path, and because that content does not move the candidate the
+existing ledger still passed and the unreviewed content merged. Binding
+everything makes the default fail-closed -- a new top-level path is bound the day
+it appears rather than the day somebody remembers to add it. The cost is stated
+rather than hidden: a change confined to documentation now needs a ledger too,
+which is the direction this repository has already chosen for shared gates, where
+a false positive is cheaper than a false negative.
+
+The exclusion is computed per run (`added_evidence_paths`) rather than written
+down as a subtree, and the difference is load-bearing. Something must be outside
+the candidate or no ledger could ever be committed: a receipt inside the bound set
+would move the very hash it records. But excluding all of `specs/` would exclude
+far more than that -- a pull request could delete or rewrite an earlier round's
+plan and receipts, the committed review history itself, and none of it would reach
+the candidate, so the gate would pass while that history was corrupted. Only the
+paths this round ADDS under a round's own `<round>/evidence/` directory are excluded. Every
+modification and deletion under `specs/`, and every added path outside an evidence
+directory, is bound like any other file. What remains outside is narrow and worth
+naming: a file added under an EARLIER round's evidence directory is excluded too,
+because the rule is structural rather than round-aware.
+
+The candidate must also be committed (`require_committed_tree`). The frozen packet
+is built from the working tree and includes untracked files, so a scratch file or
+an unstaged edit inside the bound paths would silently produce a hash no clean
+checkout recomputes -- the author records it in the ledger, and the merge-side run
+then reports that nothing binds the landing candidate. Refusing out loud costs a
+commit; the alternative costs a review round nobody can reproduce. The workflow
+directory stays bound, as it was before: with only `skills/` bound, deleting the CI
+step that runs this gate would not move the candidate the evidence has to match.
+
+Boundaries this gate does NOT close, stated because a gate that lives inside the
+candidate cannot authenticate itself: it cannot prove the caller retained every
+earlier chain; it runs the candidate's own validator, so a candidate that also
+rewrites that validator is outside what any in-repo check can settle; and a pull
+request may edit the workflow step that runs it. The fail-closed branch is pinned
+as a contract anchor so hollowing it also edits a registry another required check
+verifies; the workflow step itself is NOT pinned, because that registry addresses
+skill files and a cross-tree row breaks the checker against its own fixtures. The terminal authority is the platform's
+required-check configuration plus human review of changes to this gate itself,
+both of which live outside the candidate. What this proves is narrow and worth
+stating plainly: that what merges is the candidate an external round inspected --
+not that the round was honest, and not that it found nothing. Any terminal state
+the validator accepts satisfies this gate, including one that carries unresolved
+findings forward for a human: this binds identity, and the verdict on the findings
+stays with the human who merges.
+"""
+
+from __future__ import annotations
+
+import sys
+
+# Importing the controller must not perturb the tree this gate hashes: a written
+# __pycache__ lands as an untracked binary file inside the reviewed paths and the
+# packet freeze then fails on it. Set before any import that can write bytecode.
+sys.dont_write_bytecode = True
+
+import argparse
+import hashlib
+import importlib.util
+import json
+import os
+import re
+import subprocess
+import time
+import types
+from pathlib import Path
+
+VALIDATOR = "validate_extraction_review_state.py"
+CONTROLLER = Path("skills") / "code-review" / "scripts" / "review_gate.py"
+# Every tracked path. See the module docstring: the inversion is what stops an
+# unreviewed path from riding along on a valid ledger. The only exclusion is
+# computed per run by `added_evidence_paths` -- the receipts this round adds --
+# because a written-down subtree would also hide edits to committed history.
+EVIDENCE_ROOT = "specs"
+EVIDENCE_MEMBER = re.compile(r"^specs/[^/]+/evidence/")
+# A receipt is small; anything larger is not one, and reading it is not free.
+MAX_RECEIPT_BYTES = 4_000_000
+DEFAULT_PATHS = (".",)
+
+
+def emit(message: str) -> None:
+    print(message, file=sys.stderr)
+
+
+def load_controller(repo_root: Path) -> types.ModuleType:
+    controller_path = repo_root / CONTROLLER
+    if not controller_path.is_file():
+        raise SystemExit(
+            f"review_ledger_binding_error: controller not found at {controller_path}"
+        )
+    spec = importlib.util.spec_from_file_location(
+        "ccl_review_gate_for_binding", controller_path
+    )
+    if spec is None or spec.loader is None:
+        raise SystemExit("review_ledger_binding_error: controller is not importable")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def resolve_base(repo_root: Path, base: str) -> str:
+    """Resolve the caller's base to a commit id before it reaches any git command.
+
+    An option-shaped base (``--quiet``) is read by git as an option rather than a
+    revision, and ``git diff`` with no revision compares the index to the working
+    tree: in a clean checkout that reports no paths at all, so the gate would pass
+    having compared nothing.
+    """
+    result = subprocess.run(
+        [
+            "git",
+            "-C",
+            str(repo_root),
+            "rev-parse",
+            "--verify",
+            "--quiet",
+            "--end-of-options",
+            f"{base}^{{commit}}",
+        ],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        check=False,
+    )
+    resolved = result.stdout.strip()
+    if result.returncode != 0 or len(resolved) != 40 or not all(
+        character in "0123456789abcdef" for character in resolved
+    ):
+        raise SystemExit(
+            f"review_ledger_binding_error: base does not resolve to a commit: {base}"
+        )
+    return resolved
+
+
+def fork_point(repo_root: Path, base: str) -> str:
+    """Compare against where this branch left the base, not the base's tip.
+
+    A candidate measured against the tip absorbs every unrelated change the base
+    branch gained meanwhile, so an advance on the target branch silently restates
+    what this branch is and voids evidence that is still correct. The fork point
+    is what the branch actually adds, and it does not move when someone else
+    merges.
+    """
+    result = subprocess.run(
+        ["git", "-C", str(repo_root), "merge-base", base, "HEAD"],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        check=False,
+    )
+    resolved = result.stdout.strip()
+    if result.returncode != 0 or len(resolved) != 40:
+        raise SystemExit(
+            f"review_ledger_binding_error: no fork point between HEAD and {base}"
+        )
+    return resolved
+
+
+def added_evidence_paths(repo_root: Path, base: str) -> list[str]:
+    """Paths this round ADDS under a round's evidence directory.
+
+    These are the only paths the candidate may exclude, and the predicate is what
+    the file IS, not where it sits. Two earlier shapes of this exclusion were
+    each broken by an adversarial round, and both failures were the same one: the
+    rule named a location and the location stood in for "this is a receipt".
+    Excluding all of `specs/` let a pull request delete or rewrite an earlier
+    round's plan and receipts -- the committed review history itself -- with no
+    evidence required. Narrowing that to added paths under an evidence directory
+    then let an arbitrary added file there, a script included, ride through
+    unreviewed for exactly the same reason.
+
+    So the third shape stops using the path as a proxy. A file is excluded only
+    when it is what the exclusion exists for: a committed JSON object carrying
+    the 64-hex `candidate_sha256` that makes it a receipt about some candidate.
+    Its directory still has to be a round's evidence directory, because that is
+    where receipts belong, but the directory alone no longer buys exclusion.
+    Anything else added there -- a script, a fixture, a data file, a JSON file
+    with no candidate binding -- is bound like any other path, as is every
+    modification and deletion under `specs/`.
+    """
+    result = subprocess.run(
+        [
+            "git", "-C", str(repo_root), "diff", "--name-only",
+            "--diff-filter=A", base, "HEAD", "--", EVIDENCE_ROOT,
+        ],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        raise SystemExit(
+            "review_ledger_binding_error: cannot enumerate added evidence: "
+            f"{result.stderr.strip()}"
+        )
+    excluded: list[str] = []
+    for line in result.stdout.splitlines():
+        if not EVIDENCE_MEMBER.match(line):
+            continue
+        if is_candidate_receipt(repo_root, line):
+            excluded.append(line)
+    return excluded
+
+
+def is_candidate_receipt(repo_root: Path, path_value: str) -> bool:
+    """Whether the committed blob at this path is a receipt about a candidate.
+
+    Read from the object store rather than the working tree: the exclusion has to
+    describe what merges. A blob that is not JSON, is not an object, or carries no
+    64-hex `candidate_sha256` is not a receipt, whatever it is named or wherever
+    it sits, and it stays inside the candidate.
+    """
+    result = subprocess.run(
+        ["git", "-C", str(repo_root), "cat-file", "blob", f"HEAD:{path_value}"],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        check=False,
+    )
+    if result.returncode != 0 or len(result.stdout) > MAX_RECEIPT_BYTES:
+        return False
+    try:
+        payload = json.loads(result.stdout.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        return False
+    if not isinstance(payload, dict):
+        return False
+    binding = payload.get("candidate_sha256")
+    return (
+        isinstance(binding, str)
+        and len(binding) == 64
+        and all(character in "0123456789abcdef" for character in binding)
+    )
+
+
+def require_committed_tree(repo_root: Path, paths: tuple[str, ...]) -> None:
+    """Refuse a candidate the merge cannot reproduce.
+
+    The frozen packet is built from the working tree and includes untracked
+    files, so a scratch file or an unstaged edit inside the bound paths silently
+    produces a hash no clean checkout will ever recompute: the author records it
+    in the ledger and the merge-side run then reports that no evidence binds the
+    landing candidate. Refusing out loud costs a commit; the alternative costs a
+    review round nobody can reproduce. This is the same stance the evidence tree
+    already takes -- what merges is the committed tree.
+    """
+    result = subprocess.run(
+        ["git", "-C", str(repo_root), "status", "--porcelain", "--", *paths],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        raise SystemExit(
+            f"review_ledger_binding_error: cannot read tree state: {result.stderr.strip()}"
+        )
+    dirty = [line for line in result.stdout.splitlines() if line]
+    if dirty:
+        raise SystemExit(
+            "review_ledger_binding_error: the candidate tree carries uncommitted "
+            "changes, so its hash is not the one a clean checkout recomputes; "
+            "commit them first: " + ", ".join(entry[3:] for entry in dirty[:5])
+        )
+
+
+def changed_skill_paths(repo_root: Path, base: str, paths: tuple[str, ...]) -> list[str]:
+    result = subprocess.run(
+        ["git", "-C", str(repo_root), "diff", "--name-only", base, "--", *paths],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        raise SystemExit(
+            f"review_ledger_binding_error: cannot diff against {base}: {result.stderr.strip()}"
+        )
+    return [line for line in result.stdout.splitlines() if line]
+
+
+def candidate_hash(module: types.ModuleType, repo_root: Path, base: str, paths: tuple[str, ...]) -> str:
+    args = argparse.Namespace(
+        cwd=str(repo_root),
+        diff_file=None,
+        base=base,
+        paths=list(paths),
+        wording_only_proof_file=None,
+    )
+    packet_path, packet_sha256, _paths, _secrets = module.freeze_packet(
+        args, time.monotonic() + 120
+    )
+    try:
+        Path(packet_path).unlink(missing_ok=True)
+    except OSError:
+        pass
+    return packet_sha256
+
+
+def validator_accepts(validator: Path, ledger_path: Path) -> tuple[bool, str]:
+    result = subprocess.run(
+        [sys.executable, str(validator), str(ledger_path)],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        text=True,
+        check=False,
+        timeout=60,
+    )
+    return result.returncode == 0, result.stdout.strip()
+
+
+def scan(repo_root: Path, evidence_root: str) -> list[tuple[Path, dict]]:
+    """Enumerate committed evidence only.
+
+    What merges is the committed tree, so evidence that is untracked or modified
+    in the working tree is not evidence about the landing candidate -- and a gate
+    that reads it would accept a ledger nobody can find after the merge. The
+    enumeration comes from HEAD, and a dirty evidence tree is refused outright
+    rather than silently read from disk.
+    """
+    listing = subprocess.run(
+        ["git", "-C", str(repo_root), "ls-tree", "-r", "--name-only", "HEAD", "--", evidence_root],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        check=False,
+    )
+    if listing.returncode != 0:
+        return []
+    dirty = subprocess.run(
+        ["git", "-C", str(repo_root), "status", "--porcelain", "--", evidence_root],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        check=False,
+    )
+    if dirty.returncode != 0 or dirty.stdout.strip():
+        raise SystemExit(
+            "review_ledger_binding_error: the evidence tree has uncommitted changes; "
+            "commit the ledger and its receipts before this gate can read them"
+        )
+    found: list[tuple[Path, dict]] = []
+    for relative in sorted(line for line in listing.stdout.splitlines() if line.endswith(".json")):
+        path = repo_root / relative
+        try:
+            payload = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, UnicodeError, json.JSONDecodeError):
+            continue
+        if isinstance(payload, dict):
+            found.append((path, payload))
+    return found
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--repo-root", default=".")
+    parser.add_argument("--base", default=None)
+    parser.add_argument(
+        "--allow-unevaluated",
+        action="store_true",
+        help="permit a run with no resolvable base to exit 0, for events that have none",
+    )
+    parser.add_argument("--evidence-root", default="specs")
+    parser.add_argument("--paths", nargs="*", default=list(DEFAULT_PATHS))
+    parser.add_argument(
+        "--print-candidate",
+        action="store_true",
+        help="print the candidate hash the evidence must bind, then exit",
+    )
+    args = parser.parse_args()
+
+    repo_root = Path(args.repo_root).resolve()
+    base = args.base or os.environ.get("CCL_SKILL_BASE_REF", "")
+    if not base:
+        # The gate is base-relative by construction, so a run with no base has
+        # checked nothing. Exiting 0 there is how a base-relative gate becomes
+        # decorative: a base-wiring mistake would read as a passing required
+        # check. Fail closed; a caller whose event genuinely has no base must
+        # say so out loud with --allow-unevaluated.
+        emit(
+            "review_ledger_binding_unevaluated: no base ref supplied "
+            "(pass --base or set CCL_SKILL_BASE_REF); nothing was checked"
+        )
+        return 0 if args.allow_unevaluated else 2
+
+    base = fork_point(repo_root, resolve_base(repo_root, base))
+    # The exclusion is derived from this round's own diff, not written down as a
+    # subtree, so edits to committed history stay inside the candidate.
+    # These names come from the candidate's own tree and are handed back to git as
+    # pathspecs, so `literal` stops git reading a filename as a pattern. A review
+    # round called this a total bypass -- a receipt named `*` excluding everything
+    # -- and that did not reproduce: the exclusion carries the full path, so a glob
+    # in the filename expands only within that one evidence directory, whose other
+    # members are receipts anyway. The claim is recorded as narrowed rather than
+    # confirmed, and no test asserts a bypass this gate does not have. `literal`
+    # stays because interpreting these names as patterns is a capability the gate
+    # never needed, and removing it costs nothing.
+    paths = tuple(args.paths) + tuple(
+        f":(exclude,literal){path}" for path in added_evidence_paths(repo_root, base)
+    )
+    require_committed_tree(repo_root, paths)
+    changed = changed_skill_paths(repo_root, base, paths)
+    if not changed:
+        # No reviewed path moved, so there is no candidate to freeze and nothing to
+        # bind. Say which it is rather than letting an empty packet surface as a
+        # freeze error, which reads like a broken gate.
+        if args.print_candidate:
+            emit(f"review_ledger_binding_no_change: no reviewed-path change against {base}")
+        else:
+            print(f"review_ledger_binding_ok: no reviewed-path change against {base}")
+        return 0
+
+    module = load_controller(repo_root)
+    try:
+        expected = candidate_hash(module, repo_root, base, paths)
+    except Exception as exc:  # noqa: BLE001 - surface the controller's own message
+        emit(f"review_ledger_binding_error: cannot freeze the candidate packet: {exc}")
+        return 1
+
+    if args.print_candidate:
+        print(expected)
+        return 0
+
+    validator = repo_root / "skills" / "skill-extraction-workflow" / "scripts" / VALIDATOR
+    ledgers: list[str] = []
+    for path, payload in scan(repo_root, args.evidence_root):
+        if payload.get("candidate_sha256") != expected:
+            continue
+        relative = str(path.relative_to(repo_root))
+        # Only a validator-accepted ledger counts. A receipt-shaped file proves
+        # nothing on its own: this gate cannot authenticate that a controller
+        # minted it, so any branch keyed on a self-declared field is a bypass a
+        # contributor can hand-write.
+        if "closeout_state" in payload and "controller_receipts" in payload:
+            accepted, output = validator_accepts(validator, path)
+            if accepted:
+                print(
+                    f"review_ledger_binding_ok: {relative} binds the landing candidate "
+                    f"({expected[:12]}...) -- {output}"
+                )
+                return 0
+            ledgers.append(f"{relative}: {output}")
+
+    emit(
+        "review_ledger_binding_failed: no accepted review evidence binds the landing "
+        f"candidate {expected}"
+    )
+    emit(f"  reviewed paths: {' '.join(paths)} against {base}")
+    emit(f"  changed files: {len(changed)}")
+    for row in ledgers:
+        emit(f"  rejected ledger -> {row}")
+    if not ledgers:
+        emit(
+            "  no committed ledger records this candidate; run the extraction review "
+            "lane against the final, committed tree"
+        )
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh

@@ -194,6 +194,86 @@ run_gate
 assert_not_contains "impact_chain_firing_path_missing" "$out" "a changed shebang owner executable should satisfy the firing-path gate"
 assert_rc "$rc" 0 "a complete RED row with a changed owner executable must pass"
 
+# Non-ASCII anchors must be accepted, and the proof must be DIFFERENTIAL rather
+# than one literal passing: a special-cased implementation, or one that handles
+# Han but not a combining mark, would satisfy a single-literal leg. Each row below
+# pairs a non-ASCII anchor with an ASCII anchor matched on everything the gate
+# actually predicates on - uniqueness, the 16-character bar, list-line shape, a
+# whitelisted normative verb - so the two verdicts must agree. This exists because
+# a round concluded from reading the wrong lambda (`raw_blob_at` forces binary;
+# `locator_valid` resolves through `blob_at`, which does not) that a non-ASCII
+# anchor could never validate, and recorded a defect that was not there.
+#
+# Representations covered: Han; a precomposed Latin letter (NFC, two bytes); the
+# same letter decomposed into base + combining mark (NFD, so the anchor carries a
+# codepoint that is not a character on its own).
+anchor_pair_case() {
+  # $1 = case label, $2 = non-ASCII anchor, $3 = ASCII anchor of the same shape
+  local label="$1" nonascii="$2" ascii="$3" verdict_nonascii verdict_ascii
+  new_case "case-ref-anchor-pair-$label-nonascii"
+  printf '\n- %s\n' "$nonascii" >> "$REPO/$UPSTREAM_REF"
+  printf '| Fixture anchor pair %s non-ASCII | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#%s | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' "$label" "$nonascii" >> "$REGISTER"
+  routing_surface_downscope
+  commit_case "anchor pair $label non-ASCII"
+  run_gate
+  verdict_nonascii="$rc"
+
+  new_case "case-ref-anchor-pair-$label-ascii"
+  printf '\n- %s\n' "$ascii" >> "$REPO/$UPSTREAM_REF"
+  printf '| Fixture anchor pair %s ASCII | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#%s | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' "$label" "$ascii" >> "$REGISTER"
+  routing_surface_downscope
+  commit_case "anchor pair $label ASCII"
+  run_gate
+  verdict_ascii="$rc"
+
+  assert_rc "$verdict_ascii" 0 "the ASCII control of pair $label must be accepted"
+  assert_rc "$verdict_nonascii" "$verdict_ascii" "pair $label: the non-ASCII anchor must get the same verdict as its ASCII control"
+}
+
+anchor_pair_case han \
+  '下游执行者必须在收到该契约变更时同步更新其验证面。' \
+  'The downstream executor must refresh its verification surface on this change.'
+# Same sentence and the same whitelisted verb in both arms; only the accented
+# codepoint differs, so a verdict difference can only come from byte composition.
+anchor_pair_case nfc \
+  'The owner must refresh its vérification surface on this change.' \
+  'The owner must refresh its verification surface on this change.'
+anchor_pair_case nfd \
+  'The owner must refresh its vérification surface on that change.' \
+  'The owner must refresh its verification surface on that change.'
+
+# When one owner carries several RED rows, the owner-level check reddens the whole
+# package for a single bad row — so the diagnostic must name WHICH row failed.
+# Without it the author inspects the row they just wrote (usually the correct one)
+# while an unrelated row is the offender; that cost one round three iterations.
+new_case case-ref-firing-path-names-offending-row
+printf '\n- 下游执行者必须在收到该契约变更时同步更新其验证面。\n' >> "$REPO/$UPSTREAM_REF"
+printf '| Fixture good row beside a bad one | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#下游执行者必须在收到该契约变更时同步更新其验证面 | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' >> "$REGISTER"
+printf '| Fixture offending row with an unresolvable anchor | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#this anchor text was never added by this round | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "one good row beside one unresolvable row"
+run_gate
+assert_rc "$rc" 1 "an unresolvable anchor on any bound RED row must fail the owner"
+assert_contains "impact_chain_firing_path_missing" "$out" "checker should report the firing-path verdict"
+assert_contains "Fixture offending row with an unresolvable anchor" "$out" "the diagnostic must name the offending row"
+assert_not_contains "offending row: Fixture good row beside a bad one" "$out" "the diagnostic must not name a row whose anchor resolves"
+
+# The offending-row line renders repository text a contributor controls onto a
+# terminal/CI channel. Control and invisible characters must be escaped, not merely
+# truncated: raw ANSI or carriage-return bytes can erase or restyle surrounding
+# output, and bidi overrides can reorder it, so a reader sees a diagnostic that does
+# not match what the gate decided. Both reviewer lanes raised this independently.
+new_case case-ref-offending-row-escapes-control-bytes
+printf '\n- 下游执行者必须在收到该契约变更时同步更新其验证面。\n' >> "$REPO/$UPSTREAM_REF"
+printf '| Fixture control-byte row \033[31m\rSPOOFED\u202E | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#this anchor text was never added by this round | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "offending row carrying control bytes"
+run_gate
+assert_rc "$rc" 1 "an unresolvable anchor must still fail with a control-byte row"
+assert_contains "\\u001B" "$out" "the diagnostic must escape an ANSI introducer rather than emit it"
+assert_contains "\\u000D" "$out" "the diagnostic must escape a carriage return rather than emit it"
+assert_contains "\\u202E" "$out" "the diagnostic must escape a bidi override rather than emit it"
+
 # A malformed impact-chain-looking row (wrong cell count) is warned but stays
 # advisory: hard-blocking would false-positive on the register's many other
 # legitimate table shapes, and deliberate mangling is outside the trust model
@@ -1329,6 +1409,6 @@ assert_rc "$rc" 1 "a directory masquerading as SKILL.md must not read as a prese
 assert_contains "platform-observability/SKILL.md" "$out" "the masqueraded owner must be named"
 
 assert_rc "$full_check_runs" 1 "fixture suite must retain exactly one full checker wiring case"
-assert_rc "$gate_runs" 80 "all remaining impact-chain fixtures must run the standalone gate"
+assert_rc "$gate_runs" 88 "all remaining impact-chain fixtures must run the standalone gate"
 
 echo "test_check_ccl_impact_chain_refscripts: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -114,6 +114,9 @@ fast_tests=(
   test_shared_git_surface_gate.sh
   test_extraction_review_gate.sh
   test_validate_extraction_review_state.sh
+  # Merge-side binding between the landing candidate and the review evidence that
+  # inspected it: own throwaway git repo, no clone, seconds.
+  test_review_ledger_binding.sh
   # Candidate-SHA-bound gate receipts (mint/verify): own throwaway git repo,
   # no clone, seconds — belongs in the lane every run exercises.
   test_gate_receipt.sh