@ccoalm/ccl-skills 0.12.0 → 0.14.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -31,6 +31,7 @@
 #   - test_uiux_delivery_contract.sh
 #   - test_uiux_loading_budget.sh
 #   - test_obligation_ledger.sh
+#   - test_reference_access_census.sh
 # --full runs --fast plus the heavy full-checker regressions:
 #   - test_check_ccl_r0_status.sh
 #   - test_check_ccl_source_register_lifecycle.sh
@@ -107,6 +108,13 @@ fast_tests=(
   # applied deletion mutation in a throwaway copy (spec 031 review disposition).
   test_controlled_escalation_pins.sh
   test_check_ccl_size_budget.sh
+  # Entrypoint guidance-form census (what counts as one rule, a prohibition, a
+  # named baseline failure): synthetic fixtures plus the shipped entrypoint,
+  # seconds. Pins the definitions, never any round's figures.
+  test_entrypoint_form_census.sh
+  # Usage census over synthetic transcripts (counts, privacy contract,
+  # unevaluated sentinel, ARG_MAX batching): no host logs, seconds.
+  test_reference_access_census.sh
   test_check_ccl_skill_catalog.sh
   test_check_ccl_parallel_stack_parity.sh
   test_check_mr_target_freshness.sh

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_entrypoint_form_census.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# Regression for the entrypoint form census. The census is an instrument whose
+# only value is that a later round recomputes the same quantity, so the cases
+# below pin the definitions the script documents -- what counts as one rule,
+# what counts as a prohibition, and what counts as a named baseline failure --
+# rather than the figures of any particular entrypoint, which move every round.
+set -uo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+CENSUS="$DIR/entrypoint_form_census.py"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/entrypoint-form-census.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+fails=0
+check() { if eval "$2"; then echo "ok   - $1"; else echo "FAIL - $1"; fails=$((fails+1)); fi; }
+
+[ -f "$CENSUS" ] || { echo "FAIL: census missing: $CENSUS" >&2; exit 1; }
+
+field() { printf '%s\n' "$1" | sed -n "s/^$2=//p"; }
+
+# One rule per top-level bullet: the sub-bullet and the continuation line belong
+# to the rule above them, and the blank line between them does not close it.
+# Getting this wrong inflates every per-rule figure the census reports.
+# The prohibitions are placed in the continuation and the sub-bullet, never in
+# the bullet's own first line: a rule COUNT cannot detect a parser that drops
+# continuations, because a dropped continuation is still not a new top-level
+# bullet. The token total is the quantity that moves when the defect is present,
+# so that is what the case asserts.
+cat >"$WORK/one-rule.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- A rule head with no imperative of its own.
+
+  A continuation line that must hold.
+
+  - A sub-bullet that must also hold.
+
+## After
+
+- A bullet outside Core Rules that must not be counted.
+MD
+out="$(python3 "$CENSUS" "$WORK/one-rule.md")"; rc=$?
+check "sub-bullets and continuations separated by blank lines stay inside one rule" \
+  '[ "$rc" = 0 ] && [ "$(field "$out" rules)" = 1 ] && [ "$(field "$out" prohibitive_tokens)" = 2 ]'
+# This case owns the section boundary alone: a parser that ran past `## After`
+# would report two rules, so the rule count is the quantity that moves here.
+check "the census stops at the next same-level heading" \
+  '[ "$(field "$out" rules)" = 1 ]'
+
+# A prohibition with no named baseline failure is the diagnostic set; the same
+# rule with its failure named must leave that set. The pair is the control: if
+# the failure-shape vocabulary stopped matching, the first case would still pass
+# and only the second would fail, which is what makes the pair informative.
+cat >"$WORK/unanchored.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- A rule that must never be skipped.
+MD
+out="$(python3 "$CENSUS" "$WORK/unanchored.md")"
+check "a prohibition with no named baseline failure is reported unanchored" \
+  '[ "$(field "$out" unanchored_prohibition_rules)" = 1 ] && [ "$(field "$out" rules_naming_baseline_failure)" = 0 ]'
+
+cat >"$WORK/anchored.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- A rule that must never be skipped. Failure shape: the step is skipped under time pressure.
+MD
+out="$(python3 "$CENSUS" "$WORK/anchored.md")"
+check "the same prohibition with its baseline failure named leaves the unanchored set" \
+  '[ "$(field "$out" unanchored_prohibition_rules)" = 0 ] && [ "$(field "$out" rules_naming_baseline_failure)" = 1 ]'
+
+# A rule with no prohibitive token is not in the diagnostic set whether or not it
+# names a failure: the set is prohibitions the form table has something to say
+# about, not every rule that omits a rationale.
+cat >"$WORK/no-prohibition.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- State the artifact's parts, in order.
+MD
+out="$(python3 "$CENSUS" "$WORK/no-prohibition.md")"
+check "a rule carrying no prohibitive token is outside the diagnostic set" \
+  '[ "$(field "$out" prohibitive_tokens)" = 0 ] && [ "$(field "$out" unanchored_prohibition_rules)" = 0 ]'
+
+# The capitalised spellings are emphasis in this package and are counted; a word
+# that merely contains one of them is not a token.
+cat >"$WORK/tokens.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- This MUST hold and NEVER lapses, and the mustard and nevertheless here are not tokens.
+MD
+out="$(python3 "$CENSUS" "$WORK/tokens.md")"
+check "capitalised emphasis counts as prohibitive and a word merely containing one does not" \
+  '[ "$(field "$out" prohibitive_tokens)" = 2 ]'
+
+# The alternation is leftmost and non-overlapping, so a phrase absorbs the words
+# inside it. Two independent review lenses read the previous comment as promising
+# the opposite, which is exactly the failure this case now pins: the documented
+# counting rule and the reported figure have to be the same ruler.
+cat >"$WORK/overlap.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- This must not be counted twice, and this cannot be either.
+MD
+out="$(python3 "$CENSUS" "$WORK/overlap.md")"
+check "a phrase absorbs the word inside it: 'must not' is one token, not two" \
+  '[ "$(field "$out" prohibitive_tokens)" = 2 ]'
+
+# An existing but empty Core Rules section is an error, not a zero-rule census:
+# a section that lost its rules must not report as a clean sheet either.
+cat >"$WORK/empty-core.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+Prose with no top-level bullet.
+
+## After
+
+- A bullet outside Core Rules.
+MD
+out="$(python3 "$CENSUS" "$WORK/empty-core.md" 2>&1)"; rc=$?
+check "an existing but empty Core Rules section is an error, never a zero-rule census" \
+  '[ "$rc" != 0 ] && case "$out" in *entrypoint_form_census_error*) true;; *) false;; esac'
+
+# An entrypoint with no Core Rules section is an error, not a zero: reporting
+# zero rules would let a renamed or moved section read as a clean sheet.
+cat >"$WORK/no-core.md" <<'MD'
+# Entry
+
+## Something Else
+
+- A bullet.
+MD
+out="$(python3 "$CENSUS" "$WORK/no-core.md" 2>&1)"; rc=$?
+check "a file with no Core Rules heading is an error, never an empty census" \
+  '[ "$rc" != 0 ] && case "$out" in *entrypoint_form_census_error*) true;; *) false;; esac'
+
+# The shipped entrypoint must parse, or the instrument silently stops measuring
+# the only file it exists for.
+out="$(python3 "$CENSUS" "$DIR/../SKILL.md")"; rc=$?
+check "the shipped entrypoint parses and reports a non-zero rule count" \
+  '[ "$rc" = 0 ] && [ "$(field "$out" rules)" -gt 0 ] && case "$out" in *entrypoint_form_census_ok*) true;; *) false;; esac'
+
+if [ "$fails" -ne 0 ]; then
+  echo "test_entrypoint_form_census: $fails failing case(s)"
+  exit 1
+fi
+echo "test_entrypoint_form_census: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_reference_access_census.sh

@@ -0,0 +1,209 @@
+#!/usr/bin/env bash
+# Regression for reference-access-census.sh: synthetic transcripts only, no
+# host logs are read. Proves (1) per-file session counts and the touching
+# denominator, (2) the unevaluated sentinel when no transcript exists (never a
+# zero table), (3) the privacy contract — output carries no transcript text,
+# no absolute log path, no session id, (2b) input errors (an unreadable
+# transcript) withhold the table with exit 2 instead of printing zeros or the ok
+# token, (4) usage errors exit 2, and (5) the
+# ARG_MAX regression: a candidate set larger than one xargs batch still counts
+# (the first version silently reported 0 on a large window).
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CENSUS="$HERE/reference-access-census.sh"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+# --- fixture repo: one skill package with an entrypoint and three references ---
+REPO="$TMP/repo"; mkdir -p "$REPO/skills/demo-skill/references"
+git -C "$TMP" init -q repo 2>/dev/null || git init -q "$REPO"
+printf '# demo\n' > "$REPO/skills/demo-skill/SKILL.md"
+for r in alpha beta gamma; do printf '# %s\n' "$r" > "$REPO/skills/demo-skill/references/$r.md"; done
+git -C "$REPO" add -A && git -C "$REPO" -c user.email=t@t -c user.name=t commit -qm fixture
+
+# --- fixture transcripts: two log roots, distinct mention shapes ---
+LOGS="$TMP/logs-claude"; mkdir -p "$LOGS/proj-a" "$TMP/logs-codex/2026/09"
+SECRET_PROMPT="user-private-prompt-text-7f3a"
+SESSION_ID="session-9c1e2d3b-secret"
+# session 1 (claude shape): reads alpha and beta via a Read tool call
+printf '{"type":"tool_use","name":"Read","input":{"file_path":"/abs/checkout/skills/demo-skill/references/alpha.md"},"prompt":"%s","session":"%s"}\n' "$SECRET_PROMPT" "$SESSION_ID" > "$LOGS/proj-a/one.jsonl"
+printf '{"type":"tool_use","name":"Read","input":{"file_path":"/abs/checkout/skills/demo-skill/references/beta.md"}}\n' >> "$LOGS/proj-a/one.jsonl"
+# session 2 (codex shape): shell command mentioning alpha twice (must count once)
+printf '{"cmd":"sed -n 1,40p skills/demo-skill/references/alpha.md && cat skills/demo-skill/references/alpha.md"}\n' > "$TMP/logs-codex/2026/09/rollout-two.jsonl"
+# session 3: touches the package (SKILL.md) but no reference
+printf '{"cmd":"cat skills/demo-skill/SKILL.md"}\n' > "$TMP/logs-codex/2026/09/rollout-three.jsonl"
+# session 4: unrelated transcript (must not count as touching)
+printf '{"cmd":"ls skills/other-skill/"}\n' > "$LOGS/proj-a/four.jsonl"
+
+# deterministic, differing mtimes so the last_touched column can be asserted exactly (newest wins)
+touch -t "$(date -v-3d +%Y%m%d%H%M 2>/dev/null || date -d '3 days ago' +%Y%m%d%H%M)" "$LOGS/proj-a/one.jsonl"
+touch -t "$(date -v-1d +%Y%m%d%H%M 2>/dev/null || date -d '1 day ago' +%Y%m%d%H%M)" "$TMP/logs-codex/2026/09/rollout-two.jsonl"
+NEWEST="$(date -v-1d +%Y-%m-%d 2>/dev/null || date -d '1 day ago' +%Y-%m-%d)"
+OLDER="$(date -v-3d +%Y-%m-%d 2>/dev/null || date -d '3 days ago' +%Y-%m-%d)"
+# a stale transcript (older than the window) that mentions tracked files must not move any count, share, or date
+printf '{"cmd":"cat skills/demo-skill/references/alpha.md skills/demo-skill/references/gamma.md"}\n' > "$LOGS/proj-a/stale.jsonl"
+touch -t "$(date -v-45d +%Y%m%d%H%M 2>/dev/null || date -d '45 days ago' +%Y%m%d%H%M)" "$LOGS/proj-a/stale.jsonl"
+run() { bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$LOGS,$TMP/logs-codex"; }
+out="$(run)" || fail "census exited non-zero on a valid fixture"
+
+# (1) counts and denominator
+printf '%s\n' "$out" | grep -qF 'transcripts=4 sessions_touching_package=3' || fail "denominator wrong:\n$out"
+printf '%s\n' "$out" | grep -qF "references/alpha.md | 2 | $NEWEST | 66%" || fail "alpha should count 2 sessions with the newest touching date $NEWEST:\n$out"
+printf '%s\n' "$out" | grep -qF "references/beta.md | 1 | $OLDER | 33%" || fail "beta should count 1 session dated $OLDER:\n$out"
+printf '%s\n' "$out" | grep -qE '^references/gamma\.md \| 0 \| - \| 0%' || fail "gamma should count 0 with no date:\n$out"
+printf '%s\n' "$out" | grep -qE '^SKILL\.md \| 1 \|' || fail "SKILL.md should count 1 session:\n$out"
+[ "$(printf '%s\n' "$out" | tail -1)" = "reference_access_census_ok" ] || fail "last token must be the ok marker"
+
+# (3) privacy contract
+printf '%s\n' "$out" | grep -qF "$SECRET_PROMPT" && fail "transcript text leaked into census output"
+printf '%s\n' "$out" | grep -qF "$SESSION_ID" && fail "session id leaked into census output"
+printf '%s\n' "$out" | grep -qF "$LOGS" && fail "absolute log path leaked into census output"
+printf '%s\n' "$out" | grep -qF "/abs/checkout" && fail "absolute checkout path leaked into census output"
+
+# (2) unevaluated sentinel: no transcripts at all
+EMPTY="$TMP/empty-logs"; mkdir -p "$EMPTY"
+eout="$(bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$EMPTY")" || fail "empty-log run must exit 0"
+[ "$(printf '%s\n' "$eout" | tail -1)" = "reference_access_census_unevaluated: no transcripts within 30d under 1 log root(s); counts withheld" ] || fail "missing unevaluated sentinel:\n$eout"
+printf '%s\n' "$eout" | grep -qE '\| 0 \|' && fail "an unevaluated run must not print a zero table"
+printf '%s\n' "$eout" | grep -qF "$EMPTY" && fail "unevaluated sentinel leaked the log root path"
+printf '%s\n' "$eout" | grep -qF "$TMP" && fail "unevaluated sentinel leaked an absolute path"
+
+# (2b) input errors withhold the table: an unreadable transcript is exit 2 + unevaluated, never zeros or ok
+UNREAD="$TMP/logs-unreadable"; mkdir -p "$UNREAD"
+printf '{"cmd":"cat skills/demo-skill/references/alpha.md"}\n' > "$UNREAD/readable.jsonl"
+printf '{"cmd":"cat skills/demo-skill/references/beta.md"}\n' > "$UNREAD/locked.jsonl"
+chmod 000 "$UNREAD/locked.jsonl"
+if [ -r "$UNREAD/locked.jsonl" ]; then
+  echo "note: chmod 000 is readable here (root); skipping the unreadable-input leg"
+else
+  uout="$(bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$UNREAD" 2>"$TMP/unread.stderr")" && fail "unreadable transcript must exit non-zero"
+  urc=$?
+  uout="$(bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$UNREAD" 2>/dev/null || true)"
+  bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$UNREAD" >/dev/null 2>&1 || [ $? -eq 2 ] || fail "unreadable transcript must exit 2"
+  printf '%s\n' "$uout" | grep -qE 'reference_access_census_unevaluated: [0-9]+ input error\(s\)' || fail "unreadable transcript must withhold counts as unevaluated:\n$uout"
+  printf '%s\n' "$uout" | grep -qF 'reference_access_census_ok' && fail "ok token printed after an input error"
+  printf '%s\n' "$uout" | grep -qE '\| [0-9]+ \|' && fail "a table was printed after an input error"
+  printf '%s\n' "$uout" | grep -qF "$UNREAD" && fail "input-error sentinel leaked the log path"
+fi
+chmod 644 "$UNREAD/locked.jsonl"
+
+# (4) usage errors exit 2
+if bash "$CENSUS" --repo-root "$REPO" --skill no-such-skill --logs "$LOGS" >/dev/null 2>&1; then fail "unknown skill must exit 2"; fi
+bash "$CENSUS" --repo-root "$REPO" --skill no-such-skill --logs "$LOGS" >/dev/null 2>&1 || [ $? -eq 2 ] || fail "unknown skill must exit 2 exactly"
+bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days abc --logs "$LOGS" >/dev/null 2>&1 || [ $? -eq 2 ] || fail "non-integer --days must exit 2"
+
+# (5) ARG_MAX regression: the candidate path list must exceed THIS host's exec limit
+# (getconf ARG_MAX) so that a `$(cat candidates)` expansion — the first version's shape,
+# which silently reported 0 on a real 60-day window — cannot fit in one exec. The fixture
+# size is derived from the limit, never a fixed byte figure; a host whose limit exceeds the
+# fixture bound runs only the counting leg and says so. Verified RED by applying that exact
+# mutation to a disposable copy of the script.
+DPAD=""; i=0; while [ $i -lt 150 ]; do DPAD="${DPAD}d"; i=$((i+1)); done
+BIG="$TMP/logs-big/$DPAD"; mkdir -p "$BIG"
+PAD=""; i=0; while [ $i -lt 40 ]; do PAD="${PAD}x"; i=$((i+1)); done
+arg_max="$(getconf ARG_MAX 2>/dev/null || echo 2097152)"
+per_path=$(( ${#BIG} + 60 ))
+need=$(( (arg_max + 262144) / per_path + 1 ))
+[ "$need" -lt 11000 ] && need=11000
+probe=1
+if [ "$need" -gt 60000 ]; then
+  echo "note: ARG_MAX=$arg_max would need $need fixture files; the E2BIG probe is skipped on this host and only the counting leg runs"
+  need=11000; probe=0
+fi
+( cd "$BIG" && i=1; while [ $i -le $need ]; do : > "s$i-$PAD.jsonl"; i=$((i+1)); done )
+find "$BIG" -type f -name '*.jsonl' > "$TMP/big-list"
+inv_bytes=$(wc -c < "$TMP/big-list" | tr -d ' ')
+if [ "$probe" -eq 1 ]; then
+  erc=0; bash -c 'grep -lF "skills/demo-skill/" $(cat "$1") >/dev/null 2>&1' _ "$TMP/big-list" 2>"$TMP/e2big.err" || erc=$?
+  [ "$erc" -eq 126 ] || grep -qi "argument list too long" "$TMP/e2big.err" || fail "ARG_MAX fixture ($inv_bytes bytes, ARG_MAX=$arg_max) does not exceed this host's exec limit (rc=$erc), so the leg cannot kill the single-exec mutation"
+fi
+for i in 7 5208 10999; do printf '{"cmd":"cat skills/demo-skill/references/gamma.md"}\n' > "$BIG/s$i-$PAD.jsonl"; done
+bout="$(bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$BIG")" || fail "big run exited non-zero"
+printf '%s\n' "$bout" | grep -qF "transcripts=$need sessions_touching_package=3" || fail "large candidate set miscounted (ARG_MAX regression):\n$bout"
+printf '%s\n' "$bout" | grep -qE '^references/gamma\.md \| 3 \|' || fail "gamma should count 3 across xargs batches:\n$bout"
+
+# (6) a flag without its value is a usage error (exit 2), not an unbound-variable abort
+bash "$CENSUS" --repo-root "$REPO" --skill >/dev/null 2>&1 || [ $? -eq 2 ] || fail "flag without value must exit 2"
+
+# (7) an unknown argument never echoes its value (an absolute path passed by mistake stays private)
+uerr="$(bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --logs "$LOGS" "/private/mistyped/path" 2>&1 >/dev/null || true)"
+bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --logs "$LOGS" "/private/mistyped/path" >/dev/null 2>&1 || [ $? -eq 2 ] || fail "unknown argument must exit 2"
+printf '%s\n' "$uerr" | grep -qF "/private/mistyped/path" && fail "unknown-argument error echoed the caller's value"
+printf '%s\n' "$uerr" | grep -qF "unknown argument" || fail "unknown-argument error must still say what went wrong"
+
+# (8) an explicitly supplied log root that does not exist is an input error — alone or mixed with a valid root
+for roots in "$TMP/no-such-root" "$TMP/no-such-root,$LOGS"; do
+  mout="$(bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$roots" 2>/dev/null || true)"
+  bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$roots" >/dev/null 2>&1 || [ $? -eq 2 ] || fail "missing explicit log root must exit 2 ($roots)"
+  printf '%s\n' "$mout" | grep -qF 'reference_access_census_unevaluated: 1 input error(s)' || fail "missing explicit log root must withhold counts:\n$mout"
+  printf '%s\n' "$mout" | grep -qF 'reference_access_census_ok' && fail "ok token printed with a missing explicit log root"
+  printf '%s\n' "$mout" | grep -qE '\| [0-9]+ \|' && fail "a table was printed with a missing explicit log root"
+  printf '%s\n' "$mout" | grep -qF "$TMP" && fail "missing-root sentinel leaked a path"
+done
+# a missing DEFAULT root stays normal: with no --logs and an empty HOME the result is the no-transcript sentinel, exit 0
+dout="$(HOME="$TMP/empty-home" bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30)" || fail "absent default roots must not be an input error"
+[ "$(printf '%s\n' "$dout" | tail -1)" = "reference_access_census_unevaluated: no transcripts within 30d under 2 log root(s); counts withheld" ] || fail "absent default roots must yield the no-transcript sentinel:\n$dout"
+
+# (10) overlapping log roots (a root and its own subtree, or a root listed twice) count each transcript once
+oout="$(bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$TMP/logs-codex,$TMP/logs-codex/2026,$TMP/logs-codex")" || fail "overlapping roots run exited non-zero"
+printf '%s\n' "$oout" | grep -qF 'transcripts=2 sessions_touching_package=2' || fail "overlapping roots must not double-count transcripts:\n$oout"
+printf '%s\n' "$oout" | grep -qE '^references/alpha\.md \| 1 \|' || fail "alpha must count once under overlapping roots:\n$oout"
+
+# (11) an invalid --skill value is never echoed back (a mistyped private identifier stays private)
+kerr="$(bash "$CENSUS" --repo-root "$REPO" --skill "acme-internal-secret-project" --logs "$LOGS" 2>&1 >/dev/null || true)"
+printf '%s\n' "$kerr" | grep -qF "acme-internal-secret-project" && fail "unknown --skill error echoed the caller's value"
+printf '%s\n' "$kerr" | grep -qF "usage_error" || fail "unknown --skill must still be reported as a usage error"
+
+# (12) a transcript whose name contains a newline is one candidate, not two broken ones
+NL="$TMP/logs-newline"; mkdir -p "$NL"; printf '{"cmd":"cat skills/demo-skill/references/beta.md"}\n' > "$NL/odd
+name.jsonl"
+nout="$(bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$NL")" || fail "newline-named transcript run exited non-zero"
+printf '%s\n' "$nout" | grep -qF 'transcripts=1 sessions_touching_package=1' || fail "newline in a transcript name must not split the candidate:\n$nout"
+
+# (13) HOME unset and no --logs: no default roots, the no-transcript sentinel, exit 0 (never an unbound-variable abort)
+hout="$(env -u HOME bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30)" || fail "unset HOME must not abort the census"
+[ "$(printf '%s\n' "$hout" | tail -1)" = "reference_access_census_unevaluated: no transcripts within 30d under 0 log root(s); counts withheld" ] || fail "unset HOME must yield the no-transcript sentinel:\n$hout"
+
+# (14) a transcript-read error forced by a command shim (root-independent twin of the chmod leg)
+GSHIM="$TMP/gshim"; mkdir -p "$GSHIM"
+printf '#!/usr/bin/env bash\necho "grep: transcript: Input/output error" >&2\nexit 2\n' > "$GSHIM/grep"; chmod +x "$GSHIM/grep"
+gout="$(PATH="$GSHIM:$PATH" bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$LOGS" 2>/dev/null || true)"
+PATH="$GSHIM:$PATH" bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$LOGS" >/dev/null 2>&1 || [ $? -eq 2 ] || fail "a grep read error must exit 2"
+printf '%s\n' "$gout" | grep -qF 'reference_access_census_unevaluated:' || fail "a grep read error must withhold counts:\n$gout"
+printf '%s\n' "$gout" | grep -qF 'reference_access_census_ok' && fail "ok token printed after a grep read error"
+
+# (15) a grep that fails silently (exit 2, no stderr) is still an input error: withhold, exit 2, no ok token
+QSHIM="$TMP/qshim"; mkdir -p "$QSHIM"
+printf '#!/usr/bin/env bash\nexit 2\n' > "$QSHIM/grep"; chmod +x "$QSHIM/grep"
+qout="$(PATH="$QSHIM:$PATH" bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$LOGS" 2>/dev/null || true)"
+PATH="$QSHIM:$PATH" bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$LOGS" >/dev/null 2>&1 || [ $? -eq 2 ] || fail "a silent grep failure must exit 2"
+printf '%s\n' "$qout" | grep -qF 'reference_access_census_unevaluated:' || fail "a silent grep failure must withhold counts:\n$qout"
+printf '%s\n' "$qout" | grep -qF 'reference_access_census_ok' && fail "ok token printed after a silent grep failure"
+
+# (16) an inherited errexit (caller exported SHELLOPTS=errexit) must not turn an all-no-match batch into an input error
+NM="$TMP/logs-nomatch"; mkdir -p "$NM"; printf '{"cmd":"ls skills/other-skill/"}\n' > "$NM/quiet.jsonl"
+mout2="$(env SHELLOPTS=errexit bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$NM")" || fail "inherited errexit must not abort a valid census"
+printf '%s\n' "$mout2" | grep -qF 'transcripts=1 sessions_touching_package=0' || fail "all-no-match batch under inherited errexit must be a valid zero census:\n$mout2"
+[ "$(printf '%s\n' "$mout2" | tail -1)" = "reference_access_census_ok" ] || fail "inherited errexit must not withhold a valid census"
+
+# (17) a find that fails silently (exit 2, no stderr) is an input error: withhold, exit 2, no ok token
+FSHIM="$TMP/fshim"; mkdir -p "$FSHIM"
+printf '#!/usr/bin/env bash\nexit 2\n' > "$FSHIM/find"; chmod +x "$FSHIM/find"
+fout="$(PATH="$FSHIM:$PATH" bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$LOGS" 2>/dev/null || true)"
+frc=0; PATH="$FSHIM:$PATH" bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$LOGS" >/dev/null 2>&1 || frc=$?
+[ "$frc" -eq 2 ] || fail "a silent find failure must exit 2 (got $frc)"
+printf '%s\n' "$fout" | grep -qE 'reference_access_census_unevaluated: [0-9]+ input error' || fail "a silent find failure must withhold counts as an input error, not the no-transcript sentinel:\n$fout"
+printf '%s\n' "$fout" | grep -qF 'reference_access_census_ok' && fail "ok token printed after a silent find failure"
+
+# (9) a failing stat (a transcript vanishing before the timestamp read) withholds the table with exit 2 —
+# deterministic via a PATH shim, independent of filesystem permissions or root
+SHIM="$TMP/shim"; mkdir -p "$SHIM"
+printf '#!/usr/bin/env bash\necho "stat: cannot stat: No such file or directory" >&2\nexit 1\n' > "$SHIM/stat"; chmod +x "$SHIM/stat"
+sout="$(PATH="$SHIM:$PATH" bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$LOGS,$TMP/logs-codex" 2>/dev/null || true)"
+PATH="$SHIM:$PATH" bash "$CENSUS" --repo-root "$REPO" --skill demo-skill --days 30 --logs "$LOGS,$TMP/logs-codex" >/dev/null 2>&1 || [ $? -eq 2 ] || fail "failing stat must exit 2, not the pipeline status"
+printf '%s\n' "$sout" | grep -qF 'reference_access_census_unevaluated:' || fail "failing stat must print the unevaluated sentinel:\n$sout"
+printf '%s\n' "$sout" | grep -qF 'reference_access_census_ok' && fail "ok token printed after a failing stat"
+printf '%s\n' "$sout" | grep -qE '\| [0-9]+ \|' && fail "a table was printed after a failing stat"
+
+echo "test_reference_access_census_ok"