@ccoalm/ccl-skills 0.14.0 → 0.15.1

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh

@@ -48,6 +48,10 @@ printf '# fixture slug-named reference\n\nNeutral placeholder for the inner-rena
 # and isolate the prose-only guard from the reproduction check.
 printf '# fixture slug mention: platform-observability\n' >> "$REPO/skills/product-rd-workflow/scripts/check-agent-contract-coverage.sh"
 printf '\nFixture eligible sibling mention: platform-observability.\n' >> "$REPO/skills/product-rd-workflow/references/adr-convention.md"
+# A real table baseline distinguishes a changed definition from an old anchor
+# surviving an unrelated source-link edit on the same line.
+TABLE_REL="skills/product-rd-workflow/references/zz-fixture-definition.md"
+printf '# Definitions\n\n| Metric | Definition | Source |\n| --- | --- | --- |\n| Incident deployment ratio | Deployments needing later work | old-source |\n' > "$REPO/$TABLE_REL"
 git -C "$REPO" add -A
 git -C "$REPO" commit -qm "seed throwaway upstream reference"
 git -C "$REPO" branch fixture-base HEAD
@@ -108,6 +112,15 @@ run_gate() {
   rc=$?
   set -e
 }
+# Same gate, explicit base: for fixtures whose claim is about WHICH base the
+# verdict was taken against, pinning it beats inferring it from the upstream.
+run_gate_with_base() { # <base ref>
+  gate_runs=$((gate_runs + 1))
+  set +e
+  out="$(env -u ALIAS_AUDIT_CMD CCL_SKILL_BASE_REF="$1" ruby "$GATE_SCRIPT" "$REPO" 2>&1)"
+  rc=$?
+  set -e
+}
 
 # Case 1: an upstream owner's REFERENCE changed with NO impact-chain row -> block.
 new_case case-ref-no-row
@@ -145,6 +158,75 @@ run_gate
 assert_not_contains "impact_chain_firing_path_missing" "$out" "a never-phrased normative rule should satisfy the firing-path gate"
 assert_rc "$rc" 0 "a never-phrased normative list rule must be accepted"
 
+# Definitions are executable guidance even when their Markdown surface is a
+# table instead of a normative list. Negative controls keep anchors bound to
+# new, rendered data cells in the correct owner and round.
+definition_table_case() {
+  local label="$1" expected="$2" anchor='Unplanned deployments caused by production incidents'
+  local firing_path="$TABLE_REL"
+  new_case "case-ref-definition-table-$label"
+  case "$label" in
+    surviving-anchor)
+      anchor='Deployments needing later work'
+      perl -pi -e 's/old-source/new-source/' "$REPO/$TABLE_REL" ;;
+    unchanged-table)
+      anchor='Deployments needing later work'
+      printf '\nChanged neighboring prose.\n' >> "$REPO/$TABLE_REL" ;;
+    *)
+      perl -pi -e 's/Deployments needing later work/Unplanned deployments caused by production incidents/' "$REPO/$TABLE_REL" ;;
+  esac
+  case "$label" in
+    foreign-owner)
+      firing_path='skills/terminal-cli-dev/references/zz-fixture-definition.md'
+      cp "$REPO/$TABLE_REL" "$REPO/$firing_path" ;;
+    duplicate) printf '\n%s\n' "$anchor" >> "$REPO/$TABLE_REL" ;;
+    inline-comment) perl -pi -e 's/Unplanned deployments caused by production incidents/<!-- Unplanned deployments caused by production incidents -->/' "$REPO/$TABLE_REL" ;;
+    multiline-comment) perl -0777 -pi -e 's/\n\| Metric/\n<!--\n| Metric/; $_ .= "-->\n"' "$REPO/$TABLE_REL" ;;
+    backtick-fence) perl -0777 -pi -e 's/\n\| Metric/\n```markdown\n| Metric/; $_ .= "```\n"' "$REPO/$TABLE_REL" ;;
+    tilde-fence) perl -0777 -pi -e 's/\n\| Metric/\n~~~markdown\n| Metric/; $_ .= "~~~\n"' "$REPO/$TABLE_REL" ;;
+    raw-html) perl -0777 -pi -e 's/\n\| Metric/\n<script>\n\n| Metric/; $_ .= "<\/script>\n"' "$REPO/$TABLE_REL" ;;
+    raw-html-open-line) perl -0777 -pi -e 's/\n\| Metric/\n<script\n| Metric/; $_ .= "<\/script>\n"' "$REPO/$TABLE_REL" ;;
+    processing-instruction) perl -0777 -pi -e 's/\n\| Metric/\n<?xml\n| Metric/; $_ .= "?>\n"' "$REPO/$TABLE_REL" ;;
+    cdata) perl -0777 -pi -e 's/\n\| Metric/\n<![CDATA[\n| Metric/; $_ .= "]]>\n"' "$REPO/$TABLE_REL" ;;
+    declaration) perl -0777 -pi -e 's/\n\| Metric/\n<!DOCTYPE\n| Metric/; $_ .= ">\n"' "$REPO/$TABLE_REL" ;;
+    closed-cdata) perl -0777 -pi -e 's/\n\| Metric/\n<![CDATA[\nclosed example\n]]>\n\n| Metric/' "$REPO/$TABLE_REL" ;;
+    html-block) perl -0777 -pi -e 's/\n\| Metric/\n<div>\n| Metric/; $_ .= "<\/div>\n"' "$REPO/$TABLE_REL" ;;
+    indented-code) perl -pi -e 's/^\|/    |/' "$REPO/$TABLE_REL" ;;
+    no-header) perl -ni -e 'print unless /^\| (Metric|---)/' "$REPO/$TABLE_REL" ;;
+    header-anchor) perl -0777 -pi -e 's/\| Metric \| Definition \| Source \|/| Unplanned deployments caused by production incidents | Definition | Source |/; s/\n\| Incident deployment ratio[^\n]*\n/\n/' "$REPO/$TABLE_REL" ;;
+    no-red) : ;;
+  esac
+  local status='RED-baseline' observed='yes'
+  if [ "$label" = no-red ]; then status='semantic-control'; observed='no'; fi
+  printf '| Fixture definition table %s | `downstream-executor` | behavioral-evidence: %s; observed-failure: %s; result-class: failure; firing-path: file:%s#%s | `updated` | `product-rd-workflow/SKILL.md` definition correction |\n' "$label" "$status" "$observed" "$firing_path" "$anchor" >> "$REGISTER"
+  commit_case "definition table $label"
+  run_gate
+  assert_rc "$rc" "$expected" "definition table $label"
+  if [ "$expected" = 1 ]; then
+    if [ "$label" = no-red ]; then
+      assert_contains 'impact_chain_behavior_evidence_missing' "$out" "definition table $label: $out"
+    else
+      assert_contains 'impact_chain_firing_path_missing' "$out" "definition table $label: $out"
+    fi
+  fi
+}
+definition_table_case accepted 0
+definition_table_case closed-cdata 0
+for definition_control in surviving-anchor unchanged-table foreign-owner duplicate inline-comment multiline-comment backtick-fence tilde-fence raw-html raw-html-open-line processing-instruction cdata declaration html-block indented-code no-header header-anchor no-red; do
+  definition_table_case "$definition_control" 1
+done
+
+# Evidence is not its own firing surface. Keep the anchor only in the locator
+# itself so uniqueness cannot accidentally reject the self-certifying row.
+new_case case-ref-definition-table-self-register
+printf '\nFixture bookkeeping note, with no new enforcing rule.\n' >> "$REPO/skills/skill-extraction-workflow/references/validation-and-landing.md"
+printf '\n| Rule | Owner | Behavior | Status | Evidence |\n| --- | --- | --- | --- | --- |\n' >> "$REGISTER"
+printf '| Fixture self-citing table | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; firing-path: file:skills/skill-extraction-workflow/references/source-register.md#SELF-REGISTER-DEFINITION-ANCHOR | updated | `skill-extraction-workflow/SKILL.md` bookkeeping edit |\n' >> "$REGISTER"
+commit_case "source register cannot certify its own firing path"
+run_gate
+assert_rc "$rc" 1 "source register must not be its own firing surface"
+assert_contains 'impact_chain_firing_path_missing' "$out" "self-register refusal must name the firing-path boundary"
+
 # A purely DESCRIPTIVE list line ("always exposes" — no imperative/prohibitive
 # verb) is not an enforcing rule; the widened verb list must not admit it.
 new_case case-ref-descriptive-always-firing-path
@@ -1194,12 +1276,13 @@ run_gate
 assert_rc "$rc" 1 "a duplicated-then-dropped row must not vouch for new owner bytes"
 assert_contains "impact_chain_gate_missing" "$out" "the net-zero ledger leaves the owner undeclared"
 
-# Round scoping 6: the partition's central claim is that ONE MERGED worktree round
-# is ONE boundary — and this repo's integration branch is nothing but merge commits,
-# so a linear-only fixture set proves nothing about the shape the gate actually runs
-# on. `git rev-list --first-parent -- <path>` applies history simplification, so the
-# merge is a boundary only when it is not TREESAME to its first parent. These two
-# cases pin that behaviour instead of asserting it in a comment.
+# Round scoping 6: the partition's central claim is that a MERGED worktree round is
+# judged exactly as its branch was — and this repo's integration branch is nothing
+# but merge commits, so a linear-only fixture set proves nothing about the shape
+# the gate actually runs on. A merge git rebuilds from its parents is expanded
+# into the branch's own rounds; work committed on the integration line after it
+# is a round of its own. These two cases pin that behaviour instead of asserting
+# it in a comment.
 new_case case-round-scope-merged-worktree-round
 git -C "$REPO" switch -q -c feature-round-merged
 printf '\n- Never skip the fixture merged-round rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
@@ -1270,24 +1353,188 @@ run_gate
 assert_rc "$rc" 0 "a pre-rename round declared against its own round head must pass"
 assert_not_contains "impact_chain_evidence_missing_file" "$out" "a row citing the name that existed at its round head is valid evidence"
 
-# Round scoping 8: the --first-parent discriminator. On the branch the ledger
-# append lands BEFORE the owner work; first-parent collapses the merged branch
-# to one boundary (the merge), so row and work share a round. A full walk would
-# instead cut the round at the branch's ledger commit, stranding the work in a
-# rowless later round — so this fixture goes red if --first-parent is dropped,
-# which is what proves the flag load-bearing.
+# Round scoping 8: the merged view IS the branch view. On the branch the ledger
+# append lands BEFORE the owner work, so as a pull request the branch is refused:
+# the work sits in a rowless later round. Collapsing the merged branch to one
+# boundary used to accept the same bytes — what a pull request could not land,
+# its merge could, and the verdict moved after it landed. A merge git rebuilds
+# from its parents is now expanded into the branch's own rounds, so the two views
+# agree; both are run on the same fixture so the equality is a checked fact.
 new_case case-round-scope-merged-row-before-work
 git -C "$REPO" switch -q -c feature-round-row-first
+git -C "$REPO" branch --set-upstream-to=fixture-base feature-round-row-first >/dev/null 2>&1
 printf '| Fixture row-first merged round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture row-first rule | `updated` | `platform-observability/SKILL.md` merged round |\n' >> "$REGISTER"
 routing_surface_downscope
 commit_case "worktree round: ledger append first"
 printf '\n- Never skip the fixture row-first rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
 routing_surface_downscope
 commit_case "worktree round: owner work after the append"
+run_gate
+branch_rc="$rc"
+assert_rc "$rc" 1 "as a pull request, owner work after the ledger append sits in a rowless round"
+assert_contains "impact_chain_gate_missing" "$out" "the branch view names the undeclared work"
 git -C "$REPO" switch -q case-round-scope-merged-row-before-work
 git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-round-row-first': one worktree round" feature-round-row-first
 run_gate
-assert_rc "$rc" 0 "a merged worktree round collapses to one boundary even when the row precedes the work"
+assert_rc "$rc" "$branch_rc" "the merge of that branch is judged exactly as the branch was"
+assert_contains "impact_chain_gate_missing" "$out" "the merged view names the same undeclared work"
+
+# Round scoping 13: the observed failure. On the branch, round 1 adds a body rule
+# with its row and round 2 changes ONLY the description with a `#description`
+# row — as a pull request that is round scoping 2 and passes. Collapsed to one
+# boundary the owner's merged diff is body plus description, the routing-surface
+# class refuses the anchor, and a row that was valid when it landed reads
+# `impact_chain_firing_path_missing` on every post-merge evaluation (observed on
+# the integration branch's push build and on the promotion pull request, with
+# nothing about the row changed). Expanded, round 2 is judged on its own bytes.
+new_case case-round-scope-merged-description-round
+git -C "$REPO" switch -q -c feature-round-description
+git -C "$REPO" branch --set-upstream-to=fixture-base feature-round-description >/dev/null 2>&1
+printf '\n- Never skip the fixture merged-description body rule for this gate.\n' >> "$REPO/skills/product-rd-workflow/SKILL.md"
+printf '| Fixture merged body round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/SKILL.md#Never skip the fixture merged-description body rule | `updated` | `product-rd-workflow/SKILL.md` body round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round 1: body rule added to the entrypoint"
+perl -0pi -e 's/^(description: .+)$/$1 Fixture merged round-scope routing clause./m' "$REPO/skills/product-rd-workflow/SKILL.md"
+printf '| Fixture merged description round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/SKILL.md#description | `updated` | `product-rd-workflow/SKILL.md` description-only round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round 2: description-only edit to the same owner"
+run_gate
+branch_rc="$rc"
+assert_rc "$rc" 0 "as a pull request, the description-only round keeps its locator after the body round"
+git -C "$REPO" switch -q case-round-scope-merged-description-round
+git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-round-description': two worktree rounds" feature-round-description
+run_gate
+assert_rc "$rc" "$branch_rc" "the merge of that branch is judged exactly as the branch was"
+assert_not_contains "impact_chain_firing_path_missing" "$out" "the description anchor binds in its own round after the merge too"
+
+# Round scoping 14: expansion is bounded by what git can rebuild. A merge whose
+# tree is not the automatic merge of its parents carries content that came from
+# neither branch; expanding it would leave that content in no round, so such a
+# merge keeps the single boundary at the merge. The row-before-work branch from
+# round scoping 8, merged with an extra owner edit inside the merge commit, is
+# therefore judged as one span — which accepts it, as it always did, because that
+# span holds both the row and the work. The review-ledger binder refuses a
+# non-automatic merge on a promotion chain, so the hand-carried content is still
+# caught where promotion is decided; this fixture pins only that the expansion
+# does not silently widen past git's own reconstruction.
+new_case case-round-scope-hand-resolved-merge
+git -C "$REPO" switch -q -c feature-round-hand-resolved
+printf '| Fixture hand-resolved merged round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture hand-resolved rule | `updated` | `platform-observability/SKILL.md` merged round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round: ledger append first"
+printf '\n- Never skip the fixture hand-resolved rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
+routing_surface_downscope
+commit_case "worktree round: owner work after the append"
+git -C "$REPO" switch -q case-round-scope-hand-resolved-merge
+git -C "$REPO" merge -q --no-ff --no-commit feature-round-hand-resolved >/dev/null 2>&1
+printf '\nFixture line carried by the merge commit itself.\n' >> "$REPO/skills/platform-observability/references/platform-observability-playbook.md"
+commit_case "Merge branch 'feature-round-hand-resolved' with a hand-carried edit"
+run_gate
+assert_rc "$rc" 0 "a merge git cannot rebuild from its parents keeps one boundary and is not expanded"
+
+# Round scoping 15: the depth bound fails closed. Nine nested worktree rounds —
+# each branch cut from the previous one and merged back in turn, every merge the
+# automatic one — nest expansions past ROUND_WALK_MAX_DEPTH. The walk must stop
+# with its own diagnostic rather than fall back to a collapsed span, because a
+# fallback here would be the lenient verdict on exactly the history an author
+# could construct to reach it.
+new_case case-round-scope-nesting-depth
+prev=case-round-scope-nesting-depth
+for level in 1 2 3 4 5 6 7 8 9; do
+  git -C "$REPO" switch -q -c "feature-nest-$level" "$prev"
+  prev="feature-nest-$level"
+done
+printf '\n- Never skip the fixture nested rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
+printf '| Fixture nested round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture nested rule | `updated` | `platform-observability/SKILL.md` nested round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "deepest worktree round: owner work with its row"
+for level in 9 8 7 6 5 4 3 2 1; do
+  if [ "$level" -gt 1 ]; then outer="feature-nest-$((level - 1))"; else outer=case-round-scope-nesting-depth; fi
+  git -C "$REPO" switch -q "$outer"
+  git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-nest-$level'" "feature-nest-$level"
+done
+run_gate
+assert_rc "$rc" 1 "merges nested past the depth bound must fail closed, not fall back to a collapsed span"
+assert_contains "impact_chain_round_walk_too_deep" "$out" "the depth refusal names itself"
+
+# Round scoping 16 and 17: git failures inside the expansion decision fail closed.
+# A `git` shim on PATH delegates everything to the real git except the one
+# subcommand under test, which it makes fail with an operational status. If the
+# gate swallowed that status it would silently take the collapsed-span path — the
+# lenient verdict — so both lookups must abort with impact_chain_git_failed.
+GIT_REAL="$(command -v git)"
+SHIM_DIR="$(mktemp -d "${TMPDIR:-/tmp}/icshim.XXXXXX")"
+make_git_shim() { # <subcommand-to-break> <exit-status>
+  cat > "$SHIM_DIR/git" <<SHIM
+#!/usr/bin/env bash
+real="$GIT_REAL"
+args=("\$@")
+sub=""
+i=0
+while [ \$i -lt \${#args[@]} ]; do
+  case "\${args[\$i]}" in
+    -C) i=\$((i + 2)); continue ;;
+    -*) i=\$((i + 1)); continue ;;
+    *) sub="\${args[\$i]}"; break ;;
+  esac
+done
+if [ "\$sub" = "$1" ]; then
+  case "$1" in
+    merge-base) case " \${args[*]} " in *" --is-ancestor "*|*" HEAD "*) exec "\$real" "\$@" ;; esac ;;
+  esac
+  echo "shim: $1 unavailable" >&2
+  exit $2
+fi
+exec "\$real" "\$@"
+SHIM
+  chmod +x "$SHIM_DIR/git"
+}
+git -C "$REPO" switch -q case-round-scope-merged-description-round
+make_git_shim merge-tree 129
+PATH="$SHIM_DIR:$PATH" run_gate
+assert_rc "$rc" 1 "an unavailable merge-tree must abort the walk, not skip the expansion"
+assert_contains "impact_chain_git_failed: git merge-tree --write-tree" "$out" "the refusal names the merge-tree lookup"
+assert_contains "exited 129" "$out" "the refusal carries the shim status, so it is this lookup and not another git read"
+make_git_shim merge-base 128
+PATH="$SHIM_DIR:$PATH" run_gate
+assert_rc "$rc" 1 "a failing fork-point lookup must abort the walk, not skip the expansion"
+assert_contains "impact_chain_git_failed: git merge-base" "$out" "the refusal names the fork-point lookup"
+assert_contains "exited 128" "$out" "the refusal carries the shim status, so it is this lookup (the only two-commit merge-base in the gate) and not the base resolution, which passes HEAD"
+rm -rf "$SHIM_DIR"
+
+# Round scoping 18: a sync of the TARGET inside a branch is a sync on that
+# branch's own line. The target advances under a feature that already carries
+# owner work; the feature merges the target (automatically) and only then
+# appends its row. As a pull request the branch passes: the sync brings nothing
+# new and work plus row share a round. Promoted and judged against the older
+# base, that sync's second parent is not below the outer base — expanding it
+# would cut the branch at the sync and strand the work in a rowless span, so the
+# sync test is made against the line being walked, not the outer base alone.
+new_case case-round-scope-branch-synced-target
+git -C "$REPO" switch -q -c feature-synced-target
+git -C "$REPO" branch --set-upstream-to=case-round-scope-branch-synced-target feature-synced-target >/dev/null 2>&1
+git -C "$REPO" switch -q case-round-scope-branch-synced-target
+mkdir -p "$REPO/specs/fixture-refscripts"
+printf 'Fixture target note unrelated to any owner.\n' >> "$REPO/specs/fixture-refscripts/target-note.md"
+commit_case "target advances with an unrelated change"
+SYNC_TARGET_T="$(git -C "$REPO" rev-parse HEAD)"
+SYNC_TARGET_O="$(git -C "$REPO" rev-parse fixture-base)"
+git -C "$REPO" switch -q feature-synced-target
+printf '\n- Never skip the fixture synced-target rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
+routing_surface_downscope
+commit_case "worktree round: owner work before the sync"
+git -C "$REPO" merge -q --no-ff -m "Merge branch 'case-round-scope-branch-synced-target' into feature-synced-target" case-round-scope-branch-synced-target
+printf '| Fixture synced-target round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture synced-target rule | `updated` | `platform-observability/SKILL.md` synced round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round: its ledger append after the sync"
+run_gate_with_base "$SYNC_TARGET_T"
+branch_rc="$rc"
+assert_rc "$rc" 0 "as a pull request (base: the advanced target), a branch that synced the target keeps its work and row in one round"
+git -C "$REPO" switch -q case-round-scope-branch-synced-target
+git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-synced-target': one worktree round" feature-synced-target
+run_gate_with_base "$SYNC_TARGET_O"
+assert_rc "$rc" "$branch_rc" "promoted against the older base (pinned: the commit the target advanced from), the target sync inside the branch is still a sync and the verdict is the branch's"
+assert_not_contains "impact_chain_gate_missing" "$out" "the branch's pre-sync work is not stranded by expanding the target sync"
 
 # Round scoping 9: a TRANSIENT intermediate rename hop must not launder work.
 # X renames to Y (declared), a later round substantively changes Y with no row,
@@ -1409,6 +1656,6 @@ assert_rc "$rc" 1 "a directory masquerading as SKILL.md must not read as a prese
 assert_contains "platform-observability/SKILL.md" "$out" "the masqueraded owner must be named"
 
 assert_rc "$full_check_runs" 1 "fixture suite must retain exactly one full checker wiring case"
-assert_rc "$gate_runs" 88 "all remaining impact-chain fixtures must run the standalone gate"
+assert_rc "$gate_runs" 118 "all remaining impact-chain fixtures must run the standalone gate"
 
 echo "test_check_ccl_impact_chain_refscripts: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -24,6 +24,7 @@
 #   - test_check_ccl_register_pending_exclusion.sh
 #   - test_eval_routing_bank_grader_diagnostics.sh
 #   - test_eval_routing_bank_surface_binding.sh
+#   - test_eval_routing_bank_resolution.sh
 #   - test_eval_routing_prose_target.sh
 #   - test_validate_skill_credential_cwd.sh
 #   - test_validate_skill_root_depth.sh
@@ -145,6 +146,7 @@ fast_tests=(
   test_impact_chain_round_attribution.sh
   test_eval_routing_bank_grader_diagnostics.sh
   test_eval_routing_bank_surface_binding.sh
+  test_eval_routing_bank_resolution.sh
   test_eval_routing_prose_target.sh
   test_validate_skill_credential_cwd.sh
   test_validate_skill_root_depth.sh

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_eval_routing_bank_resolution.sh

@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+# Regression test for the bank runner's screening-vs-action resolution signal.
+#
+# A report taken below the action floor locates candidates; it does not license
+# a description edit. The runner says so on stdout and in the JSON report, and
+# this test pins BOTH sides of the number — the reference that states the rule
+# and the executable that enforces it — so they cannot drift apart the way the
+# description-length thresholds once did.
+#
+# Uses a fake `claude` earlier in PATH: never invokes a real CLI or account.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+EVAL_SCRIPT="$SCRIPT_DIR/eval-routing-bank.rb"
+DOC="$SCRIPT_DIR/../references/eval-routing.md"
+[ -f "$EVAL_SCRIPT" ] || { echo "FAIL: eval script not found: $EVAL_SCRIPT" >&2; exit 1; }
+[ -f "$DOC" ] || { echo "FAIL: reference not found: $DOC" >&2; exit 1; }
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+assert_contains() { case "$2" in *"$1"*) : ;; *) fail "expected output to contain: $1${3:+ ($3)}";; esac; }
+assert_absent() { case "$2" in *"$1"*) fail "expected output NOT to contain: $1${3:+ ($3)}";; *) : ;; esac; }
+
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/eval-routing-bank-resolution.XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+
+REPO="$TMP/repo"
+FAKE_BIN="$TMP/bin"
+mkdir -p "$REPO/skills/testing-strategy" "$REPO/skills/tighten-doc" "$REPO/eval" "$FAKE_BIN"
+
+git -C "$TMP" init -q repo
+git -C "$REPO" config user.email test@example.invalid
+git -C "$REPO" config user.name "Test User"
+
+cat > "$REPO/skills/testing-strategy/SKILL.md" <<'EOF'
+---
+description: Use when choosing test layers and regression evidence.
+---
+# Testing Strategy
+EOF
+
+# Keeps the outcome space larger than {expected, none} so the fixture is not
+# vacuous: a grader that always answered the only skill would pass trivially.
+cat > "$REPO/skills/tighten-doc/SKILL.md" <<'EOF'
+---
+description: Use when polishing document wording.
+---
+# Tighten Doc
+EOF
+
+# TWO cases, deliberately: with one case a per-case verdict and a report-wide
+# conjunction are indistinguishable, so every assertion below would also pass
+# against the defect they exist to catch. The degraded fixture fails only the
+# first utterance, which leaves one case short of the floor and one clear of it.
+cat > "$REPO/eval/routing-tasks.jsonl" <<'EOF'
+{"id":"resolution-fixture","utterance":"补一个回归测试","expected_skill":"testing-strategy","frozen_at_sha":""}
+{"id":"resolution-fixture-b","utterance":"帮我润色这段文档","expected_skill":"tighten-doc","frozen_at_sha":""}
+EOF
+
+git -C "$REPO" add -A
+git -C "$REPO" commit -qm "fixture"
+
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+prompt="$(cat)"
+case "$prompt" in
+  *润色*) printf '{"selected_skill":"tighten-doc","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n' ;;
+  *)      printf '{"selected_skill":"testing-strategy","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n' ;;
+esac
+EOF
+chmod +x "$FAKE_BIN/claude"
+export PATH="$FAKE_BIN:$PATH"
+
+# --- (1) below the floor: banner printed, report says action_resolution false --
+out_lo="$(ruby "$EVAL_SCRIPT" "$REPO" --replicas 3 --json "$TMP/lo.json" 2>&1)" \
+  || fail "runner exited non-zero below the floor:\n$out_lo"
+assert_contains "screening_resolution_only" "$out_lo" "sub-floor run must announce screening resolution"
+assert_contains "replicas=3" "$out_lo" "banner must name the observed replica count"
+assert_contains "floor 10" "$out_lo" "banner must name the required floor"
+assert_contains "valid observations" "$out_lo" "banner must report the weakest task's valid-observation count, not the request alone"
+grep -q '"action_resolution": false' "$TMP/lo.json" \
+  || fail "sub-floor report must carry action_resolution:false — a consumer cannot read a printed banner"
+
+# --- (2) at the floor: no banner, report says action_resolution true -----------
+out_hi="$(ruby "$EVAL_SCRIPT" "$REPO" --replicas 10 --json "$TMP/hi.json" 2>&1)" \
+  || fail "runner exited non-zero at the floor:\n$out_hi"
+assert_absent "screening_resolution_only" "$out_hi" "a run at the floor must not be labelled screening-only"
+grep -q '"action_resolution": true' "$TMP/hi.json" \
+  || fail "at-floor report must carry action_resolution:true"
+
+# --- (2b) a nominal at-floor run with an invalid observation is NOT actionable -
+# The floor is on valid observations. A grader that fails one call leaves the
+# task below the floor while `--replicas` still reads 10, and a report that
+# trusted the request would license an edit its evidence cannot support.
+# The runner gives each unparsable verdict ONE retry, treating it as a sampling
+# accident, so a fixture that fails a single call is repaired and records no
+# error. The failure has to persist across the retry to leave the task short of
+# the floor -- which is exactly the real shape this guards: a grader that is
+# reliably unable to answer one utterance, not a stray quote.
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+prompt="$(cat)"
+case "$prompt" in
+  *润色*) printf '{"selected_skill":"tighten-doc","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n'; exit 0 ;;
+esac
+echo x >> "$RESOLUTION_COUNT_FILE"
+n=$(wc -l < "$RESOLUTION_COUNT_FILE" | tr -d ' ')
+if [ "$n" = "3" ] || [ "$n" = "4" ]; then printf 'not json at all\n'; exit 0; fi
+printf '{"selected_skill":"testing-strategy","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+: > "$TMP/count"
+out_deg="$(RESOLUTION_COUNT_FILE="$TMP/count" ruby "$EVAL_SCRIPT" "$REPO" --replicas 10 --json "$TMP/deg.json" 2>&1)" \
+  || fail "runner exited non-zero on the degraded run:\n$out_deg"
+assert_contains "screening_resolution_only" "$out_deg" "a nominal 10-replica run with an invalid observation must not be actionable"
+grep -q '"action_resolution": false' "$TMP/deg.json" \
+  || fail "a 10-replica run with only 9 valid observations must report action_resolution:false"
+grep -q '"min_valid_observations": 9' "$TMP/deg.json" \
+  || fail "the report must expose the weakest task's valid-observation count"
+
+# --- (2c) the verdict is per case, and says nothing about a case not measured --
+# A report-wide boolean alone is unsound in the licensing direction: a subset run
+# over one case would otherwise read as licence for an edit to a case the run
+# never graded. Each result carries its own actionable and valid_observations.
+grep -q '"actionable": true' "$TMP/hi.json" \
+  || fail "an at-floor case must carry its own actionable:true"
+grep -q '"valid_observations": 10' "$TMP/hi.json" \
+  || fail "each case must expose its own valid-observation count"
+grep -q '"action_resolution_scope"' "$TMP/hi.json" \
+  || fail "the report must say its top-level verdict covers only the cases it measured"
+grep -q '"actionable": false' "$TMP/deg.json" \
+  || fail "a case left short by an invalid observation must carry actionable:false"
+# The split is the point: the degraded case is short, the other one is not, and a
+# report-wide conjunction substituted for the per-case field would mark both false.
+python3 - "$TMP/deg.json" <<'PYEOF' || fail "the healthy case must stay actionable while the degraded one does not"
+import json,sys
+d=json.load(open(sys.argv[1]))
+by={r["id"]:r for r in d["results"]}
+ok = (by["resolution-fixture"]["actionable"] is False
+      and by["resolution-fixture-b"]["actionable"] is True
+      and by["resolution-fixture-b"]["valid_observations"] == 10
+      and d["action_resolution"] is False)
+sys.exit(0 if ok else 1)
+PYEOF
+
+# --- (2d) shapes where a result could carry no usable verdict at all ----------
+# The resolution loop reads every result's verdict list. Review could not check
+# from the bounded packet that a list is always present, so the shapes that would
+# expose an absent one are pinned here: a single-replica run, and a task whose
+# every replica fails. Neither may crash, and neither may report itself
+# actionable.
+: > "$TMP/count"
+out_one="$(RESOLUTION_COUNT_FILE="$TMP/count" ruby "$EVAL_SCRIPT" "$REPO" --replicas 1 --json "$TMP/one.json" 2>&1)" \
+  || fail "runner exited non-zero on a single-replica run:\n$out_one"
+grep -q '"action_resolution": false' "$TMP/one.json" \
+  || fail "a single-replica run is below the floor and must not be actionable"
+python3 - "$TMP/one.json" <<'PYEOF' || fail "every result of a single-replica run must carry its own verdict list and count"
+import json,sys
+d=json.load(open(sys.argv[1]))
+ok = bool(d["results"]) and all(
+    isinstance(r.get("verdicts"), list) and len(r["verdicts"]) == 1
+    and r["valid_observations"] <= 1 and r["actionable"] is False
+    for r in d["results"])
+sys.exit(0 if ok else 1)
+PYEOF
+
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+cat >/dev/null
+printf 'never json\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+# Every task fails every replica: the runner reports the wholly-unmeasured run and
+# exits 3 by its documented contract, and the report must still be well formed.
+# `set -e` would kill the suite on the non-zero exit before it could be read, so
+# the status is captured in the same command that produces it.
+rc=0
+ruby "$EVAL_SCRIPT" "$REPO" --replicas 2 --json "$TMP/allfail.json" >/dev/null 2>&1 || rc=$?
+[ "$rc" = "3" ] || fail "a wholly failed run must exit 3 by the runner's contract, got $rc"
+python3 - "$TMP/allfail.json" <<'PYEOF' || fail "a wholly failed run must still report zero valid observations and no actionable case"
+import json,sys
+d=json.load(open(sys.argv[1]))
+ok = bool(d["results"]) and d["action_resolution"] is False and d["min_valid_observations"] == 0 \
+     and all(r["valid_observations"] == 0 and r["actionable"] is False and isinstance(r["verdicts"], list)
+             for r in d["results"])
+sys.exit(0 if ok else 1)
+PYEOF
+
+# --- (2e) a parseable answer naming no catalog skill is not an observation ------
+# Review could not see from the packet whether a well-formed JSON verdict whose
+# selected_skill is not in the catalog counts toward the floor. It must not: it
+# is absence of evidence, not evidence against the route, so it is an ERROR
+# verdict and the case it belongs to stays short of the floor.
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+cat >/dev/null
+printf '{"selected_skill":"skill-that-does-not-exist","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+rc=0
+ruby "$EVAL_SCRIPT" "$REPO" --replicas 10 --json "$TMP/badsel.json" >/dev/null 2>&1 || rc=$?
+python3 - "$TMP/badsel.json" <<'PYEOF' || fail "a parseable verdict naming a non-catalog skill must count as an error, not a usable observation"
+import json,sys
+d=json.load(open(sys.argv[1]))
+ok = d["action_resolution"] is False and d["min_valid_observations"] == 0 \
+     and all(r["valid_observations"] == 0 and r["actionable"] is False for r in d["results"]) \
+     and all(v["status"] == "ERROR" for r in d["results"] for v in r["verdicts"])
+sys.exit(0 if ok else 1)
+PYEOF
+
+# --- (2f) a skill the prompt never offered is not selectable ---------------------
+# A directory with a SKILL.md but no usable description is filtered out of the
+# prompt catalog. If the selectable-name list were built separately it could still
+# admit that name, and a verdict naming it would count. Both must come from one
+# filtered list, so selecting the unoffered skill is an ERROR like any other
+# non-catalog name.
+mkdir -p "$REPO/skills/ghost-skill"
+printf -- '---\ndescription: ""\n---\n# Ghost\n' > "$REPO/skills/ghost-skill/SKILL.md"
+git -C "$REPO" add -A && git -C "$REPO" commit -qm "ghost skill with empty description"
+cat > "$FAKE_BIN/claude" <<'EOF'
+#!/usr/bin/env bash
+cat >/dev/null
+printf '{"selected_skill":"ghost-skill","clarify":false,"confidence":0.9,"rationale_short":"fixture"}\n'
+EOF
+chmod +x "$FAKE_BIN/claude"
+rc=0
+ruby "$EVAL_SCRIPT" "$REPO" --replicas 10 --json "$TMP/ghost.json" >/dev/null 2>&1 || rc=$?
+python3 - "$TMP/ghost.json" <<'PYEOF' || fail "a verdict naming a skill the prompt never offered must be an error, not a usable observation"
+import json,sys
+d=json.load(open(sys.argv[1]))
+ok = d["action_resolution"] is False and all(v["status"]=="ERROR" for r in d["results"] for v in r["verdicts"])
+sys.exit(0 if ok else 1)
+PYEOF
+
+# --- (3) the two sides of the number must agree -------------------------------
+# The rule is only as good as the agreement between the reference that states it
+# and the executable that enforces it. Compare the numbers themselves rather
+# than pinning one literal in two places.
+exe_min="$(grep -oE 'ACTION_RESOLUTION_MIN_REPLICAS = [0-9]+' "$EVAL_SCRIPT" | grep -oE '[0-9]+$' | sort -u)"
+[ -n "$exe_min" ] || fail "could not read ACTION_RESOLUTION_MIN_REPLICAS from $EVAL_SCRIPT"
+[ "$(printf '%s\n' "$exe_min" | wc -l | tr -d ' ')" = "1" ] \
+  || fail "ACTION_RESOLUTION_MIN_REPLICAS is defined with more than one value: $exe_min"
+doc_min="$(grep -oE 'replicas < [0-9]+' "$DOC" | grep -oE '[0-9]+$' | sort -u)"
+[ -n "$doc_min" ] || fail "$DOC does not state the replicas floor as \`replicas < N\`"
+[ "$doc_min" = "$exe_min" ] \
+  || fail "doc states floor $doc_min but the runner enforces $exe_min — they must be one number"
+
+# The prose obligation (">=N valid observations before acting") must name the
+# same number too, so a reader following the sentence and a consumer reading the
+# report are held to one bar.
+grep -qF "≥${exe_min} 个有效观测" "$DOC" \
+  || fail "$DOC must state the per-case obligation with the same floor (≥${exe_min} 个有效观测)"
+
+echo "PASS: eval-routing-bank resolution signal (banner, report field, doc/executor agreement)"