@ccoalm/ccl-skills 0.10.0 → 0.11.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh

@@ -0,0 +1,336 @@
+#!/usr/bin/env bash
+# Regression for the merge-side binding between the landing candidate and the
+# review evidence that inspected it.
+set -uo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+GATE="$DIR/review_ledger_binding.py"
+CONTROLLER="$DIR/../../code-review/scripts/review_gate.py"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/review-ledger-binding.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+fails=0
+check() { if eval "$2"; then echo "ok   - $1"; else echo "FAIL - $1"; fails=$((fails+1)); fi; }
+
+[ -f "$GATE" ] || { echo "FAIL: gate missing: $GATE" >&2; exit 1; }
+[ -f "$CONTROLLER" ] || { echo "FAIL: controller missing: $CONTROLLER" >&2; exit 1; }
+
+REPO="$WORK/repo"
+mkdir -p "$REPO/skills/code-review/scripts" "$REPO/skills/skill-extraction-workflow/scripts" "$REPO/specs/round/evidence"
+cp "$CONTROLLER" "$REPO/skills/code-review/scripts/review_gate.py"
+# The gate delegates ledger acceptance to the validator; these stubs isolate the
+# gate's own contract (recompute the packet, bind it, delegate) from the
+# validator's fixture surface, which its own suite already covers.
+cat >"$REPO/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py" <<'PY'
+import sys
+print("extraction_review_state_ok: stub accepted")
+sys.exit(0)
+PY
+cat >"$WORK/reject-validator.py" <<'PY'
+import sys
+print("extraction_review_state_invalid: stub rejected")
+sys.exit(1)
+PY
+
+git -C "$REPO" init -q .
+git -C "$REPO" config user.email t@example.invalid
+git -C "$REPO" config user.name tester
+printf 'baseline\n' >"$REPO/skills/skill-extraction-workflow/SKILL.md"
+git -C "$REPO" add -A
+git -C "$REPO" commit -qm baseline
+BASE="$(git -C "$REPO" rev-parse HEAD)"
+
+run_gate() { python3 "$GATE" --repo-root "$REPO" "$@" 2>&1; }
+
+out="$(run_gate --base "$BASE")"; rc=$?
+check "an unchanged reviewed path needs no review evidence" \
+  '[ "$rc" = 0 ] && case "$out" in *"no reviewed-path change"*) true;; *) false;; esac'
+
+out="$(CCL_SKILL_BASE_REF= run_gate)"; rc=$?
+check "a missing base ref fails closed instead of recording a passing check" \
+  '[ "$rc" = 2 ] && case "$out" in *"nothing was checked"*) true;; *) false;; esac'
+
+out="$(CCL_SKILL_BASE_REF= run_gate --allow-unevaluated)"; rc=$?
+check "an event with genuinely no base must say so out loud to exit clean" \
+  '[ "$rc" = 0 ] && case "$out" in *"nothing was checked"*) true;; *) false;; esac'
+
+out="$(CCL_SKILL_BASE_REF="$BASE" run_gate)"; rc=$?
+check "the gate reads the base from the environment variable its diagnostic names" \
+  '[ "$rc" = 0 ] && case "$out" in *"no reviewed-path change"*) true;; *) false;; esac'
+
+# The fix batch lands under the reviewed paths.
+printf 'baseline\nlanded change\n' >"$REPO/skills/skill-extraction-workflow/SKILL.md"
+git -C "$REPO" add -A
+git -C "$REPO" commit -qm "landing change"
+
+out="$(run_gate --base "$BASE")"; rc=$?
+check "a reviewed-path change with no evidence fails closed" \
+  '[ "$rc" = 1 ] && case "$out" in *"no accepted review evidence binds the landing candidate"*) true;; *) false;; esac'
+EXPECTED="$(run_gate --base "$BASE" --print-candidate)"
+check "the gate can name the candidate hash the evidence must carry" \
+  '[ -n "$EXPECTED" ] && case "$out" in *"$EXPECTED"*) true;; *) false;; esac'
+
+# Evidence for a different candidate must not satisfy the gate: this is the exact
+# shape the gate exists to catch -- a chain that closed out on the pre-fix tree.
+python3 - "$REPO/specs/round/evidence/stale-closeout.json"  <<'JSONGEN'
+import json, sys
+from pathlib import Path
+Path(sys.argv[1]).write_text(json.dumps({"schema_version": 3, "closeout_state": "ready_for_human_decision", "controller_receipts": [], "candidate_sha256": "0" * 64}))
+JSONGEN
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "stale evidence"
+out="$(run_gate --base "$BASE")"; rc=$?
+check "a ledger bound to another candidate does not satisfy the gate" \
+  '[ "$rc" = 1 ] && case "$out" in *"no accepted review evidence"*) true;; *) false;; esac'
+
+# Committing evidence must not move the candidate: evidence lives outside the
+# reviewed paths, which is what lets a ledger record the tree that carries it.
+EXPECTED_AFTER="$(run_gate --base "$BASE" --print-candidate)"
+check "committing evidence outside the reviewed paths leaves the candidate unmoved" \
+  '[ "$EXPECTED_AFTER" = "$EXPECTED" ]'
+
+# A ledger that binds the landing candidate but fails validation is reported as a
+# rejected ledger, never silently ignored. Swapping the validator edits a reviewed
+# path, so the candidate moves and the ledger is written against the moved hash.
+cp "$WORK/reject-validator.py" "$REPO/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py"
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "rejecting validator"
+REJECT_CANDIDATE="$(run_gate --base "$BASE" --print-candidate)"
+check "editing a reviewed path moves the candidate the evidence must bind" \
+  '[ -n "$REJECT_CANDIDATE" ] && [ "$REJECT_CANDIDATE" != "$EXPECTED" ]'
+python3 - "$REPO/specs/round/evidence/closeout.json" "$REJECT_CANDIDATE" <<'JSONGEN'
+import json, sys
+from pathlib import Path
+Path(sys.argv[1]).write_text(json.dumps({"schema_version": 3, "closeout_state": "ready_for_human_decision", "controller_receipts": [], "candidate_sha256": sys.argv[2]}))
+JSONGEN
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "rejected ledger"
+out="$(run_gate --base "$BASE")"; rc=$?
+check "a bound but invalid ledger is reported as rejected, not ignored" \
+  '[ "$rc" = 1 ] && case "$out" in *"rejected ledger"*"stub rejected"*) true;; *) false;; esac'
+
+cat >"$REPO/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py" <<'ACCEPTSTUB'
+import sys
+print("extraction_review_state_ok: stub accepted")
+sys.exit(0)
+ACCEPTSTUB
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "accepting validator"
+ACCEPT_CANDIDATE="$(run_gate --base "$BASE" --print-candidate)"
+python3 - "$REPO/specs/round/evidence/closeout.json" "$ACCEPT_CANDIDATE" <<'JSONGEN'
+import json, sys
+from pathlib import Path
+Path(sys.argv[1]).write_text(json.dumps({"schema_version": 3, "closeout_state": "ready_for_human_decision", "controller_receipts": [], "candidate_sha256": sys.argv[2]}))
+JSONGEN
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "accepted ledger"
+out="$(run_gate --base "$BASE")"; rc=$?
+check "a validated ledger bound to the landing candidate passes the gate" \
+  '[ "$rc" = 0 ] && case "$out" in *"binds the landing candidate"*) true;; *) false;; esac'
+
+# The wording-only lane records a single review receipt rather than a ledger.
+rm "$REPO/specs/round/evidence/closeout.json"
+python3 - "$REPO/specs/round/evidence/wording-review.json" "$ACCEPT_CANDIDATE" <<'JSONGEN'
+import json, sys
+from pathlib import Path
+Path(sys.argv[1]).write_text(json.dumps({"schema_version": 3, "mode": "review", "candidate_sha256": sys.argv[2], "wording_only_proof_sha256": "b" * 64}))
+JSONGEN
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "wording-only proof"
+out="$(run_gate --base "$BASE")"; rc=$?
+check "a hand-writable receipt-shaped file never satisfies the gate" \
+  '[ "$rc" = 1 ] && case "$out" in *"no accepted review evidence"*) true;; *) false;; esac'
+
+# Precision: a wording-only receipt for a different candidate must not pass.
+python3 - "$REPO/specs/round/evidence/wording-review.json" <<'PY'
+import json, sys
+from pathlib import Path
+Path(sys.argv[1]).write_text(json.dumps({
+    "schema_version": 3,
+    "mode": "review",
+    "candidate_sha256": "1" * 64,
+    "wording_only_proof_sha256": "b" * 64,
+}))
+PY
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "stale wording-only proof"
+out="$(run_gate --base "$BASE")"; rc=$?
+check "a receipt-shaped file for another candidate does not satisfy the gate" \
+  '[ "$rc" = 1 ] && case "$out" in *"no accepted review evidence"*) true;; *) false;; esac'
+
+# An option-shaped base must not reach git as an option: git diff with no revision
+# compares the index to the working tree, which in a clean checkout reports no
+# paths and would let the gate pass having compared nothing.
+# The environment path is the one that reaches git without an argument parser in
+# front of it, which is exactly how such a base arrives in CI.
+for bad_base in --quiet --name-only refs/heads/does-not-exist; do
+  out="$(CCL_SKILL_BASE_REF="$bad_base" run_gate)"; rc=$?
+  check "an unresolvable base ($bad_base) is refused, not silently treated as no change" \
+    '[ "$rc" = 1 ] && case "$out" in *"does not resolve to a commit"*) true;; *) false;; esac'
+done
+
+out="$(run_gate --base "$BASE^{commit}")"; rc=$?
+check "a revision expression that does resolve is still accepted" \
+  '[ "$rc" = 1 ] && case "$out" in *"no accepted review evidence"*) true;; *) false;; esac'
+
+# The gate must not perturb the tree it hashes; asserting only that a hash comes
+# back would stay green if bytecode writes or packet cleanup regressed.
+before_state="$(git -C "$REPO" status --porcelain --ignored)"
+run_gate --base "$BASE" --print-candidate >/dev/null 2>&1
+after_state="$(git -C "$REPO" status --porcelain --ignored)"
+check "running the gate leaves the hashed tree byte-identical" \
+  '[ "$before_state" = "$after_state" ]'
+
+# What merges is the committed tree, so uncommitted evidence is not evidence about
+# the landing candidate: reading it would accept a ledger nobody can find later.
+printf '{"unfinished": true}\n' >"$REPO/specs/round/evidence/uncommitted.json"
+out="$(run_gate --base "$BASE")"; rc=$?
+check "an uncommitted evidence tree is refused rather than read from disk" \
+  '[ "$rc" = 1 ] && case "$out" in *"uncommitted changes"*) true;; *) false;; esac'
+rm "$REPO/specs/round/evidence/uncommitted.json"
+
+# An unrelated advance on the base branch must not restate what this branch is:
+# measured against the tip it would, and evidence that is still correct would go
+# stale every time somebody else merged.
+BEFORE_ADVANCE="$(run_gate --base "$BASE" --print-candidate)"
+git -C "$REPO" checkout -q -b other-work "$BASE"
+printf 'unrelated\n' >"$REPO/skills/code-review/UNRELATED.md"
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "unrelated work on the base branch"
+ADVANCED="$(git -C "$REPO" rev-parse HEAD)"
+git -C "$REPO" checkout -q -
+AFTER_ADVANCE="$(run_gate --base "$ADVANCED" --print-candidate)"
+check "an unrelated advance on the base branch leaves the candidate unchanged" \
+  '[ -n "$BEFORE_ADVANCE" ] && [ "$AFTER_ADVANCE" = "$BEFORE_ADVANCE" ]'
+
+# Scope: which paths the candidate is computed over. A whitelist of the paths the
+# round happened to review leaves every other tracked path unbound, so a pull
+# request can carry a ledger valid for its skill changes while also landing a root
+# build script nobody reviewed -- the extra content does not move the candidate, so
+# the existing ledger still passes. The bound set is therefore every tracked path
+# except the evidence tree, which must stay outside it: evidence that moved the
+# candidate it records could never be committed.
+SCOPE="$WORK/scope-repo"
+mkdir -p "$SCOPE/skills/code-review/scripts" "$SCOPE/skills/skill-extraction-workflow/scripts" "$SCOPE/specs/round/evidence" "$SCOPE/scripts"
+cp "$CONTROLLER" "$SCOPE/skills/code-review/scripts/review_gate.py"
+cat >"$SCOPE/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py" <<'PY'
+import sys
+print("extraction_review_state_ok: stub accepted")
+sys.exit(0)
+PY
+git -C "$SCOPE" init -q .
+git -C "$SCOPE" config user.email t@example.invalid
+git -C "$SCOPE" config user.name tester
+printf 'baseline\n' >"$SCOPE/skills/skill-extraction-workflow/SKILL.md"
+printf 'test:\n\t@echo baseline\n' >"$SCOPE/Makefile"
+printf 'baseline\n' >"$SCOPE/README.md"
+printf 'baseline\n' >"$SCOPE/scripts/release.sh"
+# Committed review history for the earlier round: a plan and a receipt that already
+# exist at the base. These are what a later pull request must not be able to rewrite
+# unnoticed.
+printf 'earlier round plan\n' >"$SCOPE/specs/round/plan.md"
+printf '{"schema_version": 3, "closeout_state": "ready_for_human_decision"}\n' \
+  >"$SCOPE/specs/round/evidence/history.json"
+git -C "$SCOPE" add -A
+git -C "$SCOPE" commit -qm baseline
+SCOPE_BASE="$(git -C "$SCOPE" rev-parse HEAD)"
+
+run_scope() { python3 "$GATE" --repo-root "$SCOPE" "$@" 2>&1; }
+
+# Each of these is an executable or consumer-facing tracked path outside the
+# reviewed-skill tree. Landing one with no evidence is the failure the whitelist
+# admitted: before the bound set was inverted every one of them reported
+# "no reviewed-path change" and merged unreviewed.
+for unbound in Makefile README.md scripts/release.sh; do
+  git -C "$SCOPE" checkout -q -B "probe" "$SCOPE_BASE"
+  printf 'landed unreviewed\n' >>"$SCOPE/$unbound"
+  git -C "$SCOPE" add -A && git -C "$SCOPE" commit -qm "land $unbound with no evidence"
+  out="$(run_scope --base "$SCOPE_BASE")"; rc=$?
+  check "a change to $unbound alone needs review evidence like any other tracked path" \
+    '[ "$rc" = 1 ] && case "$out" in *"no accepted review evidence binds the landing candidate"*) true;; *) false;; esac'
+done
+
+# The other half of the same decision: a committed receipt stays excluded. If it did
+# not, committing a ledger would move the candidate that ledger records and no
+# ledger could ever bind its own landing candidate.
+git -C "$SCOPE" checkout -q -B "evidence-only" "$SCOPE_BASE"
+printf '{"schema_version": 3, "candidate_sha256": "%s"}\n' \
+  "0000000000000000000000000000000000000000000000000000000000000000" \
+  >"$SCOPE/specs/round/evidence/note.json"
+git -C "$SCOPE" add -A && git -C "$SCOPE" commit -qm "land a receipt only"
+out="$(run_scope --base "$SCOPE_BASE")"; rc=$?
+check "a change confined to added receipts still reports no reviewed-path change" \
+  '[ "$rc" = 0 ] && case "$out" in *"no reviewed-path change"*) true;; *) false;; esac'
+
+# The exclusion covers what this round ADDS, not the whole tree. Committed review
+# history is the record the gate exists to protect, so rewriting or deleting an
+# earlier round's plan or receipt has to reach the candidate like any other change.
+for corruption in rewrite-plan rewrite-receipt delete-receipt; do
+  git -C "$SCOPE" checkout -q -B "corrupt" "$SCOPE_BASE"
+  case "$corruption" in
+    rewrite-plan)    printf 'rewritten by a later round\n' >"$SCOPE/specs/round/plan.md";;
+    rewrite-receipt) printf '{"schema_version": 3, "closeout_state": "forged"}\n' \
+                       >"$SCOPE/specs/round/evidence/history.json";;
+    delete-receipt)  rm "$SCOPE/specs/round/evidence/history.json";;
+  esac
+  git -C "$SCOPE" add -A && git -C "$SCOPE" commit -qm "$corruption"
+  out="$(run_scope --base "$SCOPE_BASE")"; rc=$?
+  check "a later round cannot $corruption of committed review history without evidence" \
+    '[ "$rc" = 1 ] && case "$out" in *"no accepted review evidence binds the landing candidate"*) true;; *) false;; esac'
+done
+
+# The exclusion is about what a file IS, not where it sits. An evidence directory is
+# where receipts belong, but the directory alone must not buy exclusion: otherwise a
+# script, a fixture, or any other artifact committed there lands unreviewed while an
+# unchanged ledger still passes.
+for smuggled in payload.py fixture.bin notes.json; do
+  git -C "$SCOPE" checkout -q -B "smuggle" "$SCOPE_BASE"
+  mkdir -p "$SCOPE/specs/new-round/evidence"
+  case "$smuggled" in
+    payload.py)  printf 'import os\nos.system("echo landed")\n' >"$SCOPE/specs/new-round/evidence/$smuggled";;
+    fixture.bin) printf 'not text at all\n' >"$SCOPE/specs/new-round/evidence/$smuggled";;
+    notes.json)  printf '{"note": "json, but binds no candidate"}\n' >"$SCOPE/specs/new-round/evidence/$smuggled";;
+  esac
+  git -C "$SCOPE" add -A && git -C "$SCOPE" commit -qm "smuggle $smuggled"
+  out="$(run_scope --base "$SCOPE_BASE")"; rc=$?
+  check "an added $smuggled under an evidence directory is bound, not excluded" \
+    '[ "$rc" = 1 ] && case "$out" in *"no accepted review evidence binds the landing candidate"*) true;; *) false;; esac'
+done
+
+# The candidate has to be the tree a clean checkout recomputes. An uncommitted edit
+# or a scratch file inside the bound paths would otherwise produce a hash only this
+# working copy can reproduce, which the author then records in the ledger.
+git -C "$SCOPE" checkout -q -B "dirty-probe" "$SCOPE_BASE"
+printf 'scratch\n' >"$SCOPE/scratch-note.txt"
+out="$(run_scope --base "$SCOPE_BASE" --print-candidate)"; rc=$?
+check "an untracked file inside the bound paths refuses instead of printing an unreproducible hash" \
+  '[ "$rc" != 0 ] && case "$out" in *"uncommitted changes"*) true;; *) false;; esac'
+rm "$SCOPE/scratch-note.txt"
+printf 'unstaged edit\n' >>"$SCOPE/Makefile"
+out="$(run_scope --base "$SCOPE_BASE" --print-candidate)"; rc=$?
+check "an unstaged edit inside the bound paths refuses instead of printing an unreproducible hash" \
+  '[ "$rc" != 0 ] && case "$out" in *"uncommitted changes"*) true;; *) false;; esac'
+git -C "$SCOPE" checkout -q -- Makefile
+out="$(run_scope --base "$SCOPE_BASE" --print-candidate)"; rc=$?
+check "the same clean checkout still reaches its normal verdict" \
+  '[ "$rc" = 0 ] && case "$out" in *"no reviewed-path change"*) true;; *) false;; esac'
+
+# The suite above exercises a synthetic repository. The gate must also run against
+# the real checkout it ships in, or a break in that path passes every test here.
+REAL_ROOT="$(cd "$DIR/../../.." && pwd -P)"
+real_out="$(env -u CCL_SKILL_BASE_REF python3 "$GATE" --repo-root "$REAL_ROOT" --base HEAD~1 --print-candidate 2>&1)"; real_rc=$?
+# Both outputs are legitimate and which one appears depends on what the parent
+# commit happened to touch: a candidate hash when a reviewed path moved, the
+# no-change signal when it did not. Accepting only the first makes this assertion
+# a function of repository state rather than of the gate.
+# Which answer is legitimate depends on the checkout, so decide that FIRST and then
+# assert the one matching branch. Accepting every output would make this assertion a
+# function of repository state; branching on the state keeps it an assertion about
+# the gate. A dirty checkout is a legitimate state for a developer to run in, and
+# the gate must refuse there rather than print a hash nobody else can recompute.
+real_dirty="$(git -C "$REAL_ROOT" status --porcelain)"
+if [ -n "$real_dirty" ]; then
+  check "the gate refuses to answer for a real checkout that is not committed" \
+    '[ "$real_rc" != 0 ] && case "$real_out" in *"uncommitted changes"*) true;; *) false;; esac'
+else
+  check "the gate answers for the clean real checkout it ships in, whichever legitimate answer applies" \
+    '[ "$real_rc" = 0 ] && { case "$real_out" in [0-9a-f]*) [ ${#real_out} = 64 ];; *) false;; esac || case "$real_out" in *review_ledger_binding_no_change*) true;; *) false;; esac; }'
+fi
+
+if [ "$fails" -gt 0 ]; then
+  echo "test_review_ledger_binding: $fails failing case(s)" >&2
+  exit 1
+fi
+echo "test_review_ledger_binding: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_routing_pointer_integrity.sh

@@ -133,10 +133,30 @@ check_absent() { # <file> <token> <label> — file must exist AND token absent;
   fi
 }
 
+check_line_all() { # <file> <selector> <label> <req...> — EVERY <req> must sit on
+  # ONE line that matches <selector>. Filtering the matched lines through each req in
+  # turn is what binds them to the same line: asserting each req against the whole set
+  # of matched lines lets two reqs pass on two different lines, so a contract that says
+  # "both owners on that line" would be satisfied while no line carries both.
+  # -e is required: a selector starting with "-" is otherwise parsed as an option.
+  local file="$1" sel="$2" label="$3"; shift 3
+  local out req
+  out=$(grep -F -e "$sel" "$file" 2>/dev/null)
+  if [ -z "$out" ]; then
+    echo "FAIL: $label missing ($file :: no line matches '$sel')" >&2; fail=1; return
+  fi
+  for req in "$@"; do
+    out=$(printf '%s\n' "$out" | grep -F -e "$req")
+    if [ -z "$out" ]; then
+      echo "FAIL: $label missing ($file :: one line matching '$sel' must also contain '$req')" >&2; fail=1; return
+    fi
+  done
+}
+
 # Self-pin: an emptied or truncated suite must fail, not pass. Update EXPECTED
 # when adding/removing checks deliberately (same diff). Runs FIRST: a truncated
 # tail removes real checks and the count goes red.
-EXPECTED_CHECKS=21
+EXPECTED_CHECKS=24
 actual_checks=$(grep -cE '^check([_a-z]+)? ' "$0")
 if [ "$actual_checks" -ne "$EXPECTED_CHECKS" ]; then
   echo "FAIL: suite self-pin: expected $EXPECTED_CHECKS checks, found $actual_checks" >&2
@@ -176,6 +196,22 @@ check "$ROOT/skills/product-rd-workflow/SKILL.md" "must go to that language's de
 # no-owner fallback be deleted while the suite stays green, which is exactly the
 # routing hole (a CLI in a language with no dev owner) this rule closes.
 check "$ROOT/skills/product-rd-workflow/SKILL.md" "no such dev owner stays with \`terminal-cli-dev\` as the default CLI owner" "product-rd coordinator CLI carve-out (no-owner fallback branch, incl. destination)"
+# A routing-bank case cannot guard this: a multi-stage Node request selects
+# product-rd-workflow from its own wording and stays green even when the
+# coordinator omits the Node owner from its dispatch map. Pin the map itself —
+# both the stack enumeration and the CLI carve-out list — or the omission that
+# sent Node deliveries to a coordinator with no owner to dispatch to recurs
+# invisibly, with the no-owner fallback above silently reclaiming Node CLIs.
+check_line_all "$ROOT/skills/product-rd-workflow/SKILL.md" "- Development routing:" "product-rd Development-routing line carries the Node owner in BOTH the stack enumeration and the CLI carve-out" "\`nodejs-service-dev\` for Node.js services" "\`python-service-dev\`, \`nodejs-service-dev\`)"
+# Node has no *-architecture sibling by decision, so the technical-design gate
+# must name where its architecture decisions go; without this the gate lists
+# only the Go and Python architecture owners and Node design work has no owner.
+# Naming the vacuum is not naming a destination: both owners must sit on that
+# line, or the gate can declare Node has no architecture sibling and stop there.
+# The positive ownership clause is pinned too: keeping only the two owner tokens
+# while deleting "run this gate here" would leave the architecture decision ownerless,
+# since nodejs-service-dev is named there as the IMPLEMENTATION owner, not the gate.
+check_line_all "$ROOT/skills/product-rd-workflow/references/delivery-lifecycle.md" "For Node.js backend, worker, or CLI/tooling architecture" "product-rd design gate owns the Node architecture decision and names both downstream owners on that line" "run this gate here" "\`platform-*\` owners" "\`nodejs-service-dev\` for the Node-side implementation contract"
 # Both legs of the skip clause are pinned: an unanchored leg can be deleted while
 # the reciprocal trigger anchor above stays green, and the eval fixtures assert
 # terminal-cli-dev must NOT receive either request.
@@ -187,6 +223,10 @@ check_frontmatter_present "$ROOT/skills/terminal-cli-dev/SKILL.md" "Node.js CLI
 # implementation) — the gap two independent reviewer lanes hit.
 check_frontmatter_present "$ROOT/skills/terminal-cli-dev/SKILL.md" "command/subcommand/flag/help contract (owned here even when nothing is rendered)" "terminal-cli-dev owns the non-rendered CLI contract"
 check "$ROOT/skills/product-rd-workflow/SKILL.md" "command/subcommand/flag/help contract, which it owns even when nothing is rendered" "product-rd mirrors CLI-contract ownership"
+# testing-strategy must not re-claim language-stack CLI test IMPLEMENTATION: that
+# claim collided with the CLI carve-out every stack dev owner and the coordinator
+# carry, so the line is scoped to the interface contract it actually owns.
+check_line_all "$ROOT/skills/testing-strategy/SKILL.md" "- Use \`terminal-cli-dev\` for" "testing-strategy scopes terminal-cli-dev to the interface contract, not language-stack CLI implementation" "terminal interface contract"
 check_frontmatter_present "$ROOT/skills/platform-release-engineering/SKILL.md" "上线范围确认 / 合并 main / 打 tag" "rollout description prod-release skip"
 check "$ROOT/skills/app-cross-platform-dev/agents/openai.yaml" "React Native" "app-cross-platform-dev openai overlay RN parity"
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_validate_extraction_review_state.sh

@@ -145,6 +145,7 @@ def make_fixture(
     closeout=None,
     unmatched=0,
     open_last=False,
+    succession=False,
 ):
     if receipt_findings is None:
         receipt_findings = [[finding(1)], []]
@@ -166,11 +167,15 @@ def make_fixture(
     receipt_hashes = []
     receipt_refs = []
     for index, findings in enumerate(receipt_findings, start=1):
-        mode = "review" if index == 1 else "challenge"
+        # With a succession the LAST round opens a second chain: its own chain
+        # arithmetic restarts at one while its lane position keeps counting.
+        is_succession = succession and index == rounds
+        chain_position = 1 if is_succession else index
+        mode = "challenge" if is_succession else "review" if index == 1 else "challenge"
         status = "findings" if findings else "passed"
-        remaining = 2 - index
+        remaining = 2 - chain_position
         if status == "findings":
-            state = "post_review_budget" if index == 2 else "findings_pending"
+            state = "post_review_budget" if chain_position == 2 else "findings_pending"
         else:
             state = "reviewed"
         receipt = {
@@ -179,16 +184,27 @@ def make_fixture(
             "status": status,
             "findings": copy.deepcopy(findings),
             "review_chain_tracked": True,
-            "review_chain_id": "extraction-chain",
-            "autonomous_review_index": index,
+            "review_chain_id": (
+                "extraction-succession" if is_succession else "extraction-chain"
+            ),
+            "autonomous_review_index": chain_position,
             "autonomous_review_budget": 2,
             "autonomous_reviews_remaining": remaining,
             "autonomous_review_allowed": remaining > 0,
-            "challenge_index": 0 if index == 1 else index - 1,
+            "challenge_index": 1 if is_succession else 0 if index == 1 else index - 1,
             "challenge_budget": budget,
-            "prior_review_result_sha256": list(receipt_hashes),
-            "candidate_sha256": CANDIDATE,
-            "packet_sha256": CANDIDATE,
+            "prior_review_result_sha256": [] if is_succession else list(receipt_hashes),
+            "predecessor_chain_id": "extraction-chain" if is_succession else None,
+            "predecessor_result_sha256": (
+                receipt_hashes[-1] if is_succession and receipt_hashes else None
+            ),
+            "predecessor_candidate_sha256": OTHER_CANDIDATE if is_succession else None,
+            "candidate_sha256": (
+                OTHER_CANDIDATE if succession and not is_succession else CANDIDATE
+            ),
+            "packet_sha256": (
+                OTHER_CANDIDATE if succession and not is_succession else CANDIDATE
+            ),
             "review_scope": copy.deepcopy(scope),
             "review_scope_sha256": scope_sha,
             "wording_only_proof_sha256": None,
@@ -504,6 +520,97 @@ run("review-only", review_only["ledger"], 1, "ready requires at least one tracke
 over_budget = make_fixture("over-budget", receipt_findings=[[], [], []])
 run("over-budget", over_budget["ledger"], 1, "exceeds the wrapper budget")
 
+# Chain succession. A fix that edits the reviewed owner package ends its chain, so
+# the landing candidate can only be challenged in a succeeding chain. The lane then
+# spans two chains and three rounds, and the succession round is the only one that
+# binds what actually lands.
+succession_ready = make_fixture(
+    "succession-ready", receipt_findings=[[finding(1)], [], []], succession=True
+)
+run("succession-ready", succession_ready["ledger"], 0, "closeout_state=ready_for_human_decision")
+
+# The failure this whole mechanism exists to make visible: the fix batch moved the
+# candidate and no round ever inspected what lands.
+succession_absent = make_fixture(
+    "succession-absent",
+    receipt_findings=[[finding(1)], []],
+    receipt_mutators={
+        1: lambda row: row.update(
+            candidate_sha256=OTHER_CANDIDATE, packet_sha256=OTHER_CANDIDATE
+        ),
+        2: lambda row: row.update(
+            candidate_sha256=OTHER_CANDIDATE, packet_sha256=OTHER_CANDIDATE
+        ),
+    },
+)
+run("succession-absent", succession_absent["ledger"], 1, "does not bind the ledger candidate")
+
+# A succession whose predecessor saw the same candidate reviewed nothing new.
+succession_unmoved = make_fixture(
+    "succession-unmoved",
+    receipt_findings=[[finding(1)], [], []],
+    succession=True,
+    receipt_mutators={
+        1: lambda row: row.update(candidate_sha256=CANDIDATE, packet_sha256=CANDIDATE),
+        2: lambda row: row.update(candidate_sha256=CANDIDATE, packet_sha256=CANDIDATE),
+        3: lambda row: row.update(predecessor_candidate_sha256=CANDIDATE),
+    },
+)
+run(
+    "succession-unmoved",
+    succession_unmoved["ledger"],
+    1,
+    "must bind a candidate the wrapper chain never saw",
+)
+
+succession_foreign_terminal = make_fixture(
+    "succession-foreign-terminal",
+    receipt_findings=[[finding(1)], [], []],
+    succession=True,
+    receipt_mutators={3: lambda row: row.update(predecessor_result_sha256="f" * 64)},
+)
+run(
+    "succession-foreign-terminal",
+    succession_foreign_terminal["ledger"],
+    1,
+    "does not bind the succeeded chain's terminal receipt",
+)
+
+succession_self = make_fixture(
+    "succession-self",
+    receipt_findings=[[finding(1)], [], []],
+    succession=True,
+    receipt_mutators={3: lambda row: row.update(review_chain_id="extraction-chain")},
+)
+run("succession-self", succession_self["ledger"], 1, "succeeds its own chain")
+
+succession_misplaced = make_fixture(
+    "succession-misplaced",
+    receipt_findings=[[finding(1)], [], []],
+    succession=True,
+    receipt_mutators={
+        2: lambda row: row.update(predecessor_chain_id="extraction-chain"),
+    },
+)
+run(
+    "succession-misplaced",
+    succession_misplaced["ledger"],
+    1,
+    "must be the lane's final round",
+)
+
+succession_over_lane = make_fixture(
+    "succession-over-lane",
+    receipt_findings=[[finding(1)], [], [], []],
+    succession=True,
+)
+run(
+    "succession-over-lane",
+    succession_over_lane["ledger"],
+    1,
+    "controller_receipts must contain one to 3 ordered Agent rounds",
+)
+
 missing_complete = make_fixture("missing-complete")
 missing_complete["ledger"]["completion_receipt"] = None
 run("missing-complete", missing_complete["ledger"], 1, "requires a completion receipt")