@ccoalm/ccl-skills 0.14.0 → 0.15.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh

@@ -108,6 +108,15 @@ run_gate() {
   rc=$?
   set -e
 }
+# Same gate, explicit base: for fixtures whose claim is about WHICH base the
+# verdict was taken against, pinning it beats inferring it from the upstream.
+run_gate_with_base() { # <base ref>
+  gate_runs=$((gate_runs + 1))
+  set +e
+  out="$(env -u ALIAS_AUDIT_CMD CCL_SKILL_BASE_REF="$1" ruby "$GATE_SCRIPT" "$REPO" 2>&1)"
+  rc=$?
+  set -e
+}
 
 # Case 1: an upstream owner's REFERENCE changed with NO impact-chain row -> block.
 new_case case-ref-no-row
@@ -1194,12 +1203,13 @@ run_gate
 assert_rc "$rc" 1 "a duplicated-then-dropped row must not vouch for new owner bytes"
 assert_contains "impact_chain_gate_missing" "$out" "the net-zero ledger leaves the owner undeclared"
 
-# Round scoping 6: the partition's central claim is that ONE MERGED worktree round
-# is ONE boundary — and this repo's integration branch is nothing but merge commits,
-# so a linear-only fixture set proves nothing about the shape the gate actually runs
-# on. `git rev-list --first-parent -- <path>` applies history simplification, so the
-# merge is a boundary only when it is not TREESAME to its first parent. These two
-# cases pin that behaviour instead of asserting it in a comment.
+# Round scoping 6: the partition's central claim is that a MERGED worktree round is
+# judged exactly as its branch was — and this repo's integration branch is nothing
+# but merge commits, so a linear-only fixture set proves nothing about the shape
+# the gate actually runs on. A merge git rebuilds from its parents is expanded
+# into the branch's own rounds; work committed on the integration line after it
+# is a round of its own. These two cases pin that behaviour instead of asserting
+# it in a comment.
 new_case case-round-scope-merged-worktree-round
 git -C "$REPO" switch -q -c feature-round-merged
 printf '\n- Never skip the fixture merged-round rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
@@ -1270,24 +1280,188 @@ run_gate
 assert_rc "$rc" 0 "a pre-rename round declared against its own round head must pass"
 assert_not_contains "impact_chain_evidence_missing_file" "$out" "a row citing the name that existed at its round head is valid evidence"
 
-# Round scoping 8: the --first-parent discriminator. On the branch the ledger
-# append lands BEFORE the owner work; first-parent collapses the merged branch
-# to one boundary (the merge), so row and work share a round. A full walk would
-# instead cut the round at the branch's ledger commit, stranding the work in a
-# rowless later round — so this fixture goes red if --first-parent is dropped,
-# which is what proves the flag load-bearing.
+# Round scoping 8: the merged view IS the branch view. On the branch the ledger
+# append lands BEFORE the owner work, so as a pull request the branch is refused:
+# the work sits in a rowless later round. Collapsing the merged branch to one
+# boundary used to accept the same bytes — what a pull request could not land,
+# its merge could, and the verdict moved after it landed. A merge git rebuilds
+# from its parents is now expanded into the branch's own rounds, so the two views
+# agree; both are run on the same fixture so the equality is a checked fact.
 new_case case-round-scope-merged-row-before-work
 git -C "$REPO" switch -q -c feature-round-row-first
+git -C "$REPO" branch --set-upstream-to=fixture-base feature-round-row-first >/dev/null 2>&1
 printf '| Fixture row-first merged round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture row-first rule | `updated` | `platform-observability/SKILL.md` merged round |\n' >> "$REGISTER"
 routing_surface_downscope
 commit_case "worktree round: ledger append first"
 printf '\n- Never skip the fixture row-first rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
 routing_surface_downscope
 commit_case "worktree round: owner work after the append"
+run_gate
+branch_rc="$rc"
+assert_rc "$rc" 1 "as a pull request, owner work after the ledger append sits in a rowless round"
+assert_contains "impact_chain_gate_missing" "$out" "the branch view names the undeclared work"
 git -C "$REPO" switch -q case-round-scope-merged-row-before-work
 git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-round-row-first': one worktree round" feature-round-row-first
 run_gate
-assert_rc "$rc" 0 "a merged worktree round collapses to one boundary even when the row precedes the work"
+assert_rc "$rc" "$branch_rc" "the merge of that branch is judged exactly as the branch was"
+assert_contains "impact_chain_gate_missing" "$out" "the merged view names the same undeclared work"
+
+# Round scoping 13: the observed failure. On the branch, round 1 adds a body rule
+# with its row and round 2 changes ONLY the description with a `#description`
+# row — as a pull request that is round scoping 2 and passes. Collapsed to one
+# boundary the owner's merged diff is body plus description, the routing-surface
+# class refuses the anchor, and a row that was valid when it landed reads
+# `impact_chain_firing_path_missing` on every post-merge evaluation (observed on
+# the integration branch's push build and on the promotion pull request, with
+# nothing about the row changed). Expanded, round 2 is judged on its own bytes.
+new_case case-round-scope-merged-description-round
+git -C "$REPO" switch -q -c feature-round-description
+git -C "$REPO" branch --set-upstream-to=fixture-base feature-round-description >/dev/null 2>&1
+printf '\n- Never skip the fixture merged-description body rule for this gate.\n' >> "$REPO/skills/product-rd-workflow/SKILL.md"
+printf '| Fixture merged body round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/SKILL.md#Never skip the fixture merged-description body rule | `updated` | `product-rd-workflow/SKILL.md` body round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round 1: body rule added to the entrypoint"
+perl -0pi -e 's/^(description: .+)$/$1 Fixture merged round-scope routing clause./m' "$REPO/skills/product-rd-workflow/SKILL.md"
+printf '| Fixture merged description round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/SKILL.md#description | `updated` | `product-rd-workflow/SKILL.md` description-only round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round 2: description-only edit to the same owner"
+run_gate
+branch_rc="$rc"
+assert_rc "$rc" 0 "as a pull request, the description-only round keeps its locator after the body round"
+git -C "$REPO" switch -q case-round-scope-merged-description-round
+git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-round-description': two worktree rounds" feature-round-description
+run_gate
+assert_rc "$rc" "$branch_rc" "the merge of that branch is judged exactly as the branch was"
+assert_not_contains "impact_chain_firing_path_missing" "$out" "the description anchor binds in its own round after the merge too"
+
+# Round scoping 14: expansion is bounded by what git can rebuild. A merge whose
+# tree is not the automatic merge of its parents carries content that came from
+# neither branch; expanding it would leave that content in no round, so such a
+# merge keeps the single boundary at the merge. The row-before-work branch from
+# round scoping 8, merged with an extra owner edit inside the merge commit, is
+# therefore judged as one span — which accepts it, as it always did, because that
+# span holds both the row and the work. The review-ledger binder refuses a
+# non-automatic merge on a promotion chain, so the hand-carried content is still
+# caught where promotion is decided; this fixture pins only that the expansion
+# does not silently widen past git's own reconstruction.
+new_case case-round-scope-hand-resolved-merge
+git -C "$REPO" switch -q -c feature-round-hand-resolved
+printf '| Fixture hand-resolved merged round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture hand-resolved rule | `updated` | `platform-observability/SKILL.md` merged round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round: ledger append first"
+printf '\n- Never skip the fixture hand-resolved rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
+routing_surface_downscope
+commit_case "worktree round: owner work after the append"
+git -C "$REPO" switch -q case-round-scope-hand-resolved-merge
+git -C "$REPO" merge -q --no-ff --no-commit feature-round-hand-resolved >/dev/null 2>&1
+printf '\nFixture line carried by the merge commit itself.\n' >> "$REPO/skills/platform-observability/references/platform-observability-playbook.md"
+commit_case "Merge branch 'feature-round-hand-resolved' with a hand-carried edit"
+run_gate
+assert_rc "$rc" 0 "a merge git cannot rebuild from its parents keeps one boundary and is not expanded"
+
+# Round scoping 15: the depth bound fails closed. Nine nested worktree rounds —
+# each branch cut from the previous one and merged back in turn, every merge the
+# automatic one — nest expansions past ROUND_WALK_MAX_DEPTH. The walk must stop
+# with its own diagnostic rather than fall back to a collapsed span, because a
+# fallback here would be the lenient verdict on exactly the history an author
+# could construct to reach it.
+new_case case-round-scope-nesting-depth
+prev=case-round-scope-nesting-depth
+for level in 1 2 3 4 5 6 7 8 9; do
+  git -C "$REPO" switch -q -c "feature-nest-$level" "$prev"
+  prev="feature-nest-$level"
+done
+printf '\n- Never skip the fixture nested rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
+printf '| Fixture nested round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture nested rule | `updated` | `platform-observability/SKILL.md` nested round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "deepest worktree round: owner work with its row"
+for level in 9 8 7 6 5 4 3 2 1; do
+  if [ "$level" -gt 1 ]; then outer="feature-nest-$((level - 1))"; else outer=case-round-scope-nesting-depth; fi
+  git -C "$REPO" switch -q "$outer"
+  git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-nest-$level'" "feature-nest-$level"
+done
+run_gate
+assert_rc "$rc" 1 "merges nested past the depth bound must fail closed, not fall back to a collapsed span"
+assert_contains "impact_chain_round_walk_too_deep" "$out" "the depth refusal names itself"
+
+# Round scoping 16 and 17: git failures inside the expansion decision fail closed.
+# A `git` shim on PATH delegates everything to the real git except the one
+# subcommand under test, which it makes fail with an operational status. If the
+# gate swallowed that status it would silently take the collapsed-span path — the
+# lenient verdict — so both lookups must abort with impact_chain_git_failed.
+GIT_REAL="$(command -v git)"
+SHIM_DIR="$(mktemp -d "${TMPDIR:-/tmp}/icshim.XXXXXX")"
+make_git_shim() { # <subcommand-to-break> <exit-status>
+  cat > "$SHIM_DIR/git" <<SHIM
+#!/usr/bin/env bash
+real="$GIT_REAL"
+args=("\$@")
+sub=""
+i=0
+while [ \$i -lt \${#args[@]} ]; do
+  case "\${args[\$i]}" in
+    -C) i=\$((i + 2)); continue ;;
+    -*) i=\$((i + 1)); continue ;;
+    *) sub="\${args[\$i]}"; break ;;
+  esac
+done
+if [ "\$sub" = "$1" ]; then
+  case "$1" in
+    merge-base) case " \${args[*]} " in *" --is-ancestor "*|*" HEAD "*) exec "\$real" "\$@" ;; esac ;;
+  esac
+  echo "shim: $1 unavailable" >&2
+  exit $2
+fi
+exec "\$real" "\$@"
+SHIM
+  chmod +x "$SHIM_DIR/git"
+}
+git -C "$REPO" switch -q case-round-scope-merged-description-round
+make_git_shim merge-tree 129
+PATH="$SHIM_DIR:$PATH" run_gate
+assert_rc "$rc" 1 "an unavailable merge-tree must abort the walk, not skip the expansion"
+assert_contains "impact_chain_git_failed: git merge-tree --write-tree" "$out" "the refusal names the merge-tree lookup"
+assert_contains "exited 129" "$out" "the refusal carries the shim status, so it is this lookup and not another git read"
+make_git_shim merge-base 128
+PATH="$SHIM_DIR:$PATH" run_gate
+assert_rc "$rc" 1 "a failing fork-point lookup must abort the walk, not skip the expansion"
+assert_contains "impact_chain_git_failed: git merge-base" "$out" "the refusal names the fork-point lookup"
+assert_contains "exited 128" "$out" "the refusal carries the shim status, so it is this lookup (the only two-commit merge-base in the gate) and not the base resolution, which passes HEAD"
+rm -rf "$SHIM_DIR"
+
+# Round scoping 18: a sync of the TARGET inside a branch is a sync on that
+# branch's own line. The target advances under a feature that already carries
+# owner work; the feature merges the target (automatically) and only then
+# appends its row. As a pull request the branch passes: the sync brings nothing
+# new and work plus row share a round. Promoted and judged against the older
+# base, that sync's second parent is not below the outer base — expanding it
+# would cut the branch at the sync and strand the work in a rowless span, so the
+# sync test is made against the line being walked, not the outer base alone.
+new_case case-round-scope-branch-synced-target
+git -C "$REPO" switch -q -c feature-synced-target
+git -C "$REPO" branch --set-upstream-to=case-round-scope-branch-synced-target feature-synced-target >/dev/null 2>&1
+git -C "$REPO" switch -q case-round-scope-branch-synced-target
+mkdir -p "$REPO/specs/fixture-refscripts"
+printf 'Fixture target note unrelated to any owner.\n' >> "$REPO/specs/fixture-refscripts/target-note.md"
+commit_case "target advances with an unrelated change"
+SYNC_TARGET_T="$(git -C "$REPO" rev-parse HEAD)"
+SYNC_TARGET_O="$(git -C "$REPO" rev-parse fixture-base)"
+git -C "$REPO" switch -q feature-synced-target
+printf '\n- Never skip the fixture synced-target rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
+routing_surface_downscope
+commit_case "worktree round: owner work before the sync"
+git -C "$REPO" merge -q --no-ff -m "Merge branch 'case-round-scope-branch-synced-target' into feature-synced-target" case-round-scope-branch-synced-target
+printf '| Fixture synced-target round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture synced-target rule | `updated` | `platform-observability/SKILL.md` synced round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round: its ledger append after the sync"
+run_gate_with_base "$SYNC_TARGET_T"
+branch_rc="$rc"
+assert_rc "$rc" 0 "as a pull request (base: the advanced target), a branch that synced the target keeps its work and row in one round"
+git -C "$REPO" switch -q case-round-scope-branch-synced-target
+git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-synced-target': one worktree round" feature-synced-target
+run_gate_with_base "$SYNC_TARGET_O"
+assert_rc "$rc" "$branch_rc" "promoted against the older base (pinned: the commit the target advanced from), the target sync inside the branch is still a sync and the verdict is the branch's"
+assert_not_contains "impact_chain_gate_missing" "$out" "the branch's pre-sync work is not stranded by expanding the target sync"
 
 # Round scoping 9: a TRANSIENT intermediate rename hop must not launder work.
 # X renames to Y (declared), a later round substantively changes Y with no row,
@@ -1409,6 +1583,6 @@ assert_rc "$rc" 1 "a directory masquerading as SKILL.md must not read as a prese
 assert_contains "platform-observability/SKILL.md" "$out" "the masqueraded owner must be named"
 
 assert_rc "$full_check_runs" 1 "fixture suite must retain exactly one full checker wiring case"
-assert_rc "$gate_runs" 88 "all remaining impact-chain fixtures must run the standalone gate"
+assert_rc "$gate_runs" 97 "all remaining impact-chain fixtures must run the standalone gate"
 
 echo "test_check_ccl_impact_chain_refscripts: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -24,6 +24,7 @@
 #   - test_check_ccl_register_pending_exclusion.sh
 #   - test_eval_routing_bank_grader_diagnostics.sh
 #   - test_eval_routing_bank_surface_binding.sh
+#   - test_eval_routing_bank_resolution.sh
 #   - test_eval_routing_prose_target.sh
 #   - test_validate_skill_credential_cwd.sh
 #   - test_validate_skill_root_depth.sh
@@ -145,6 +146,7 @@ fast_tests=(
   test_impact_chain_round_attribution.sh
   test_eval_routing_bank_grader_diagnostics.sh
   test_eval_routing_bank_surface_binding.sh
+  test_eval_routing_bank_resolution.sh
   test_eval_routing_prose_target.sh
   test_validate_skill_credential_cwd.sh
   test_validate_skill_root_depth.sh

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_bank_resolution.sh

@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+# Regression test for the bank runner's screening-vs-action resolution signal.
+#
+# A report taken below the action floor locates candidates; it does not license
+# a description edit. The runner says so on stdout and in the JSON report, and
+# this test pins BOTH sides of the number — the reference that states the rule
+# and the executable that enforces it — so they cannot drift apart the way the
+# description-length thresholds once did.
+#
+# Uses a fake `claude` earlier in PATH: never invokes a real CLI or account.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+EVAL_SCRIPT="$SCRIPT_DIR/eval-routing-bank.rb"
+DOC="$SCRIPT_DIR/../references/eval-routing.md"
+[ -f "$EVAL_SCRIPT" ] || { echo "FAIL: eval script not found: $EVAL_SCRIPT" >&2; exit 1; }
+[ -f "$DOC" ] || { echo "FAIL: reference not found: $DOC" >&2; exit 1; }
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+assert_contains() { case "$2" in *"$1"*) : ;; *) fail "expected output to contain: $1${3:+ ($3)}";; esac; }
+assert_absent() { case "$2" in *"$1"*) fail "expected output NOT to contain: $1${3:+ ($3)}";; *) : ;; esac; }
+
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/eval-routing-bank-resolution.XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+
+REPO="$TMP/repo"
+FAKE_BIN="$TMP/bin"
+mkdir -p "$REPO/skills/testing-strategy" "$REPO/skills/tighten-doc" "$REPO/eval" "$FAKE_BIN"
+
+git -C "$TMP" init -q repo
+git -C "$REPO" config user.email test@example.invalid
+git -C "$REPO" config user.name "Test User"
+
+cat > "$REPO/skills/testing-strategy/SKILL.md" <<'EOF'
+---
+description: Use when choosing test layers and regression evidence.
+---
+# Testing Strategy
+EOF
+
+# Keeps the outcome space larger than {expected, none} so the fixture is not
+# vacuous: a grader that always answered the only skill would pass trivially.
+cat > "$REPO/skills/tighten-doc/SKILL.md" <<'EOF'
+---
+description: Use when polishing document wording.
+---
+# Tighten Doc
+EOF
+
+# TWO cases, deliberately: with one case a per-case verdict and a report-wide
+# conjunction are indistinguishable, so every assertion below would also pass
+# against the defect they exist to catch. The degraded fixture fails only the
+# first utterance, which leaves one case short of the floor and one clear of it.
+cat > "$REPO/eval/routing-tasks.jsonl" <<'EOF'
+{"id":"resolution-fixture","utterance":"补一个回归测试","expected_skill":"testing-strategy","frozen_at_sha":""}
+{"id":"resolution-fixture-b","utterance":"帮我润色这段文档","expected_skill":"tighten-doc","frozen_at_sha":""}
+EOF
+
+git -C "$REPO" add -A
+git -C "$REPO" commit -qm "fixture"
+
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+prompt="$(cat)"
+case "$prompt" in
+  *润色*) printf '{"selected_skill":"tighten-doc","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n' ;;
+  *)      printf '{"selected_skill":"testing-strategy","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n' ;;
+esac
+EOF
+chmod +x "$FAKE_BIN/claude"
+export PATH="$FAKE_BIN:$PATH"
+
+# --- (1) below the floor: banner printed, report says action_resolution false --
+out_lo="$(ruby "$EVAL_SCRIPT" "$REPO" --replicas 3 --json "$TMP/lo.json" 2>&1)" \
+  || fail "runner exited non-zero below the floor:\n$out_lo"
+assert_contains "screening_resolution_only" "$out_lo" "sub-floor run must announce screening resolution"
+assert_contains "replicas=3" "$out_lo" "banner must name the observed replica count"
+assert_contains "floor 10" "$out_lo" "banner must name the required floor"
+assert_contains "valid observations" "$out_lo" "banner must report the weakest task's valid-observation count, not the request alone"
+grep -q '"action_resolution": false' "$TMP/lo.json" \
+  || fail "sub-floor report must carry action_resolution:false — a consumer cannot read a printed banner"
+
+# --- (2) at the floor: no banner, report says action_resolution true -----------
+out_hi="$(ruby "$EVAL_SCRIPT" "$REPO" --replicas 10 --json "$TMP/hi.json" 2>&1)" \
+  || fail "runner exited non-zero at the floor:\n$out_hi"
+assert_absent "screening_resolution_only" "$out_hi" "a run at the floor must not be labelled screening-only"
+grep -q '"action_resolution": true' "$TMP/hi.json" \
+  || fail "at-floor report must carry action_resolution:true"
+
+# --- (2b) a nominal at-floor run with an invalid observation is NOT actionable -
+# The floor is on valid observations. A grader that fails one call leaves the
+# task below the floor while `--replicas` still reads 10, and a report that
+# trusted the request would license an edit its evidence cannot support.
+# The runner gives each unparsable verdict ONE retry, treating it as a sampling
+# accident, so a fixture that fails a single call is repaired and records no
+# error. The failure has to persist across the retry to leave the task short of
+# the floor -- which is exactly the real shape this guards: a grader that is
+# reliably unable to answer one utterance, not a stray quote.
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+prompt="$(cat)"
+case "$prompt" in
+  *润色*) printf '{"selected_skill":"tighten-doc","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n'; exit 0 ;;
+esac
+echo x >> "$RESOLUTION_COUNT_FILE"
+n=$(wc -l < "$RESOLUTION_COUNT_FILE" | tr -d ' ')
+if [ "$n" = "3" ] || [ "$n" = "4" ]; then printf 'not json at all\n'; exit 0; fi
+printf '{"selected_skill":"testing-strategy","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+: > "$TMP/count"
+out_deg="$(RESOLUTION_COUNT_FILE="$TMP/count" ruby "$EVAL_SCRIPT" "$REPO" --replicas 10 --json "$TMP/deg.json" 2>&1)" \
+  || fail "runner exited non-zero on the degraded run:\n$out_deg"
+assert_contains "screening_resolution_only" "$out_deg" "a nominal 10-replica run with an invalid observation must not be actionable"
+grep -q '"action_resolution": false' "$TMP/deg.json" \
+  || fail "a 10-replica run with only 9 valid observations must report action_resolution:false"
+grep -q '"min_valid_observations": 9' "$TMP/deg.json" \
+  || fail "the report must expose the weakest task's valid-observation count"
+
+# --- (2c) the verdict is per case, and says nothing about a case not measured --
+# A report-wide boolean alone is unsound in the licensing direction: a subset run
+# over one case would otherwise read as licence for an edit to a case the run
+# never graded. Each result carries its own actionable and valid_observations.
+grep -q '"actionable": true' "$TMP/hi.json" \
+  || fail "an at-floor case must carry its own actionable:true"
+grep -q '"valid_observations": 10' "$TMP/hi.json" \
+  || fail "each case must expose its own valid-observation count"
+grep -q '"action_resolution_scope"' "$TMP/hi.json" \
+  || fail "the report must say its top-level verdict covers only the cases it measured"
+grep -q '"actionable": false' "$TMP/deg.json" \
+  || fail "a case left short by an invalid observation must carry actionable:false"
+# The split is the point: the degraded case is short, the other one is not, and a
+# report-wide conjunction substituted for the per-case field would mark both false.
+python3 - "$TMP/deg.json" <<'PYEOF' || fail "the healthy case must stay actionable while the degraded one does not"
+import json,sys
+d=json.load(open(sys.argv[1]))
+by={r["id"]:r for r in d["results"]}
+ok = (by["resolution-fixture"]["actionable"] is False
+      and by["resolution-fixture-b"]["actionable"] is True
+      and by["resolution-fixture-b"]["valid_observations"] == 10
+      and d["action_resolution"] is False)
+sys.exit(0 if ok else 1)
+PYEOF
+
+# --- (2d) shapes where a result could carry no usable verdict at all ----------
+# The resolution loop reads every result's verdict list. Review could not check
+# from the bounded packet that a list is always present, so the shapes that would
+# expose an absent one are pinned here: a single-replica run, and a task whose
+# every replica fails. Neither may crash, and neither may report itself
+# actionable.
+: > "$TMP/count"
+out_one="$(RESOLUTION_COUNT_FILE="$TMP/count" ruby "$EVAL_SCRIPT" "$REPO" --replicas 1 --json "$TMP/one.json" 2>&1)" \
+  || fail "runner exited non-zero on a single-replica run:\n$out_one"
+grep -q '"action_resolution": false' "$TMP/one.json" \
+  || fail "a single-replica run is below the floor and must not be actionable"
+python3 - "$TMP/one.json" <<'PYEOF' || fail "every result of a single-replica run must carry its own verdict list and count"
+import json,sys
+d=json.load(open(sys.argv[1]))
+ok = bool(d["results"]) and all(
+    isinstance(r.get("verdicts"), list) and len(r["verdicts"]) == 1
+    and r["valid_observations"] <= 1 and r["actionable"] is False
+    for r in d["results"])
+sys.exit(0 if ok else 1)
+PYEOF
+
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+cat >/dev/null
+printf 'never json\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+# Every task fails every replica: the runner reports the wholly-unmeasured run and
+# exits 3 by its documented contract, and the report must still be well formed.
+# `set -e` would kill the suite on the non-zero exit before it could be read, so
+# the status is captured in the same command that produces it.
+rc=0
+ruby "$EVAL_SCRIPT" "$REPO" --replicas 2 --json "$TMP/allfail.json" >/dev/null 2>&1 || rc=$?
+[ "$rc" = "3" ] || fail "a wholly failed run must exit 3 by the runner's contract, got $rc"
+python3 - "$TMP/allfail.json" <<'PYEOF' || fail "a wholly failed run must still report zero valid observations and no actionable case"
+import json,sys
+d=json.load(open(sys.argv[1]))
+ok = bool(d["results"]) and d["action_resolution"] is False and d["min_valid_observations"] == 0 \
+     and all(r["valid_observations"] == 0 and r["actionable"] is False and isinstance(r["verdicts"], list)
+             for r in d["results"])
+sys.exit(0 if ok else 1)
+PYEOF
+
+# --- (2e) a parseable answer naming no catalog skill is not an observation ------
+# Review could not see from the packet whether a well-formed JSON verdict whose
+# selected_skill is not in the catalog counts toward the floor. It must not: it
+# is absence of evidence, not evidence against the route, so it is an ERROR
+# verdict and the case it belongs to stays short of the floor.
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+cat >/dev/null
+printf '{"selected_skill":"skill-that-does-not-exist","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+rc=0
+ruby "$EVAL_SCRIPT" "$REPO" --replicas 10 --json "$TMP/badsel.json" >/dev/null 2>&1 || rc=$?
+python3 - "$TMP/badsel.json" <<'PYEOF' || fail "a parseable verdict naming a non-catalog skill must count as an error, not a usable observation"
+import json,sys
+d=json.load(open(sys.argv[1]))
+ok = d["action_resolution"] is False and d["min_valid_observations"] == 0 \
+     and all(r["valid_observations"] == 0 and r["actionable"] is False for r in d["results"]) \
+     and all(v["status"] == "ERROR" for r in d["results"] for v in r["verdicts"])
+sys.exit(0 if ok else 1)
+PYEOF
+
+# --- (2f) a skill the prompt never offered is not selectable ---------------------
+# A directory with a SKILL.md but no usable description is filtered out of the
+# prompt catalog. If the selectable-name list were built separately it could still
+# admit that name, and a verdict naming it would count. Both must come from one
+# filtered list, so selecting the unoffered skill is an ERROR like any other
+# non-catalog name.
+mkdir -p "$REPO/skills/ghost-skill"
+printf -- '---\ndescription: ""\n---\n# Ghost\n' > "$REPO/skills/ghost-skill/SKILL.md"
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "ghost skill with empty description"
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+cat >/dev/null
+printf '{"selected_skill":"ghost-skill","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+rc=0
+ruby "$EVAL_SCRIPT" "$REPO" --replicas 10 --json "$TMP/ghost.json" >/dev/null 2>&1 || rc=$?
+python3 - "$TMP/ghost.json" <<'PYEOF' || fail "a verdict naming a skill the prompt never offered must be an error, not a usable observation"
+import json,sys
+d=json.load(open(sys.argv[1]))
+ok = d["action_resolution"] is False and all(v["status"]=="ERROR" for r in d["results"] for v in r["verdicts"])
+sys.exit(0 if ok else 1)
+PYEOF
+
+# --- (3) the two sides of the number must agree -------------------------------
+# The rule is only as good as the agreement between the reference that states it
+# and the executable that enforces it. Compare the numbers themselves rather
+# than pinning one literal in two places.
+exe_min="$(grep -oE 'ACTION_RESOLUTION_MIN_REPLICAS = [0-9]+' "$EVAL_SCRIPT" | grep -oE '[0-9]+$' | sort -u)"
+[ -n "$exe_min" ] || fail "could not read ACTION_RESOLUTION_MIN_REPLICAS from $EVAL_SCRIPT"
+[ "$(printf '%s\n' "$exe_min" | wc -l | tr -d ' ')" = "1" ] \
+  || fail "ACTION_RESOLUTION_MIN_REPLICAS is defined with more than one value: $exe_min"
+doc_min="$(grep -oE 'replicas < [0-9]+' "$DOC" | grep -oE '[0-9]+$' | sort -u)"
+[ -n "$doc_min" ] || fail "$DOC does not state the replicas floor as \`replicas < N\`"
+[ "$doc_min" = "$exe_min" ] \
+  || fail "doc states floor $doc_min but the runner enforces $exe_min — they must be one number"
+
+# The prose obligation (">=N valid observations before acting") must name the
+# same number too, so a reader following the sentence and a consumer reading the
+# report are held to one bar.
+grep -qF "≥${exe_min} 个有效观测" "$DOC" \
+  || fail "$DOC must state the per-case obligation with the same floor (≥${exe_min} 个有效观测)"
+
+echo "PASS: eval-routing-bank resolution signal (banner, report field, doc/executor agreement)"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_impact_chain_gate_verdict_differential.sh

@@ -139,28 +139,52 @@ git -C "$REPO_ROOT" show "$BASELINE_GATE_COMMIT:$GATE_PATH" > "$BASELINE_GATE" 2
   exit 1
 }
 
-# EXPECTED DIVERGENCES. Four landings back-filled a ledger row by corrective
-# rewrite — the repair for a round that merged with this gate red — so the owner
-# change sits below their base and the row cites an owner the range does not
-# touch. The candidate refuses that shape by design and deliberately offers no
-# author-declared escape, so these four historical ranges diverge. The gate is
-# diff-scoped and never re-judges landed history, so nothing operational depends
-# on them; this differential is the only thing that replays them.
+# EXPECTED DIVERGENCES, two named classes, both "newly refused".
 #
-# Each exemption is constrained to ONE direction and ONE diagnostic. A blanket
-# "any mismatch at this SHA is fine" would also swallow the opposite direction —
-# a loosening — which is the failure this whole suite exists to catch. Entries are
-# named individually, never matched by pattern, and an entry that stops diverging
-# is reported as stale rather than tolerated.
-EXPECTED_DIVERGENCE_SHAS="f03b1140f 93d09c563 9f233728a 046612652"
-EXPECTED_DIVERGENCE_DIRECTION="newly refused"
-EXPECTED_DIVERGENCE_TOKEN="impact_chain_row_vouches_for_unchanged_owner"
-expected_divergence() { # <full sha> <direction> <candidate output>
-  local short="${1:0:9}" direction="$2" out="$3" known
-  [ "$direction" = "$EXPECTED_DIVERGENCE_DIRECTION" ] || return 1
-  case "$out" in *"$EXPECTED_DIVERGENCE_TOKEN"*) : ;; *) return 1 ;; esac
-  for known in $EXPECTED_DIVERGENCE_SHAS; do
-    [ "$known" = "$short" ] && return 0
+# `impact_chain_row_vouches_for_unchanged_owner` (four points): landings that
+# back-filled a ledger row by corrective rewrite — the repair for a round that
+# merged with this gate red — so the owner change sits below their base and the
+# row cites an owner the range does not touch. The candidate refuses that shape by
+# design and deliberately offers no author-declared escape.
+#
+# `impact_chain_gate_missing` (six points): merges from before CI judged the
+# branch head (register row on the checkout ref binding, 2026-08-25). The gate now
+# expands a merge git rebuilds from its parents into the branch's own rounds, so a
+# merge is judged exactly as its branch was; these six branches carry owner work
+# outside the round that declares it (a row appended before the work, or work
+# after the last append) and the baseline accepted them only through the
+# collapsed merged view, which no longer exists as a distinct verdict. Three of
+# the six are refused on their own branch head by the baseline gate too; the other
+# three are promotions or syncs whose second parent is the integration branch,
+# where the same shapes sit one merge deeper.
+#
+# The gate is diff-scoped and never re-judges landed history, so nothing
+# operational depends on these points; this differential is the only thing that
+# replays them. Each entry is constrained to ONE direction and ONE diagnostic. A
+# blanket "any mismatch at this SHA is fine" would also swallow the opposite
+# direction — a loosening — which is the failure this whole suite exists to
+# catch. Entries are named individually, never matched by pattern, and an entry
+# that stops diverging is reported as stale rather than tolerated.
+EXPECTED_DIVERGENCES="
+f03b1140f:refused:impact_chain_row_vouches_for_unchanged_owner
+93d09c563:refused:impact_chain_row_vouches_for_unchanged_owner
+9f233728a:refused:impact_chain_row_vouches_for_unchanged_owner
+046612652:refused:impact_chain_row_vouches_for_unchanged_owner
+b9de13869:refused:impact_chain_gate_missing
+8cea35e6d:refused:impact_chain_gate_missing
+95f06b2e6:refused:impact_chain_gate_missing
+c0561c74e:refused:impact_chain_gate_missing
+fad480296:refused:impact_chain_gate_missing
+90ec533e1:refused:impact_chain_gate_missing
+"
+expected_divergence() { # <full sha> <direction> <candidate output>; prints the matched token
+  local short="${1:0:9}" direction="$2" out="$3" entry sha dir token
+  case "$direction" in "newly refused") direction=refused ;; "newly accepted") direction=accepted ;; esac
+  for entry in $EXPECTED_DIVERGENCES; do
+    sha="${entry%%:*}"; token="${entry##*:}"; dir="${entry#*:}"; dir="${dir%%:*}"
+    [ "$sha" = "$short" ] || continue
+    [ "$dir" = "$direction" ] || return 1
+    case "$out" in *"$token"*) printf '%s' "$token"; return 0 ;; *) return 1 ;; esac
   done
   return 1
 }
@@ -170,7 +194,7 @@ expected_divergence() { # <full sha> <direction> <candidate output>
 # them, so the exemptions are stale and the run would pass while silently failing
 # the staleness check it never reaches.
 if cmp -s "$BASELINE_GATE" "$CANDIDATE_GATE"; then
-  if [ -n "$(printf '%s' "$EXPECTED_DIVERGENCE_SHAS" | tr -d '[:space:]')" ]; then
+  if [ -n "$(printf '%s' "$EXPECTED_DIVERGENCES" | tr -d '[:space:]')" ]; then
     echo "FAIL: baseline and candidate are byte-identical, yet expected divergences are configured" >&2
     echo "      identical gates cannot diverge — the exemptions are stale and must be removed" >&2
     exit 1
@@ -261,8 +285,8 @@ for point in $INTEGRATION_POINTS; do
     direction="newly accepted"
   fi
   if [ -n "$direction" ]; then
-    if expected_divergence "$point" "$direction" "$candidate_out"; then
-      flag="  (expected divergence: corrective-rewrite back-fill, $direction)"
+    if matched_token="$(expected_divergence "$point" "$direction" "$candidate_out")"; then
+      flag="  (expected divergence: $matched_token, $direction)"
       expected_seen=$((expected_seen + 1))
     else
       flag="  <== VERDICT MISMATCH: $direction"
@@ -412,7 +436,7 @@ if [ "$total_failures" -gt 0 ]; then
 fi
 # An expected divergence that stops diverging means the exemption is stale and
 # should be removed, so it is reported rather than silently tolerated.
-expected_total="$(for e in $EXPECTED_DIVERGENCE_SHAS; do echo "$e"; done | wc -l | tr -d ' ')"
+expected_total="$(for e in $EXPECTED_DIVERGENCES; do echo "$e"; done | wc -l | tr -d ' ')"
 if [ "$expected_seen" != "$expected_total" ]; then
   echo "FAIL: $expected_seen of $expected_total expected divergences actually diverged" >&2
   echo "      an exemption that no longer fires is stale — remove it" >&2