@ccoalm/ccl-skills 0.15.1 → 0.15.2

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_client_compat.py

@@ -4,7 +4,11 @@
 from __future__ import annotations
 
 import argparse
+import contextlib
+import copy
+import hashlib
 import importlib.util
+import io
 import json
 import os
 from pathlib import Path
@@ -12,12 +16,14 @@ import subprocess
 import sys
 import tempfile
 import unittest
+from unittest import mock
 
 
 SCRIPT_DIR = Path(__file__).resolve().parent
 if str(SCRIPT_DIR) not in sys.path:
     sys.path.insert(0, str(SCRIPT_DIR))
 import review_gate
+import kimi_packet_mcp
 
 SPEC = importlib.util.spec_from_file_location(
     "parse_cli_review", SCRIPT_DIR / "parse_cli_review.py"
@@ -505,5 +511,571 @@ class ReviewClientCompatibilityTest(unittest.TestCase):
                     self.assertFalse(eligibility)
 
 
+class CodexPacketAuditTest(unittest.TestCase):
+    def setUp(self) -> None:
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        self.packet = Path(temporary.name) / "packet.txt"
+        self.packet.write_text("candidate\n", encoding="utf-8")
+        result = Path(temporary.name) / "result.txt"
+        result.write_text("NO_BLOCKING_FINDINGS\n", encoding="utf-8")
+        self.digest = hashlib.sha256(self.packet.read_bytes()).hexdigest()
+        self.args = argparse.Namespace(
+            client="codex",
+            mode="review",
+            reviewer_family="openai",
+            provider="codex-cli",
+            model="",
+            result_file=str(result),
+            packet=str(self.packet),
+            packet_sha256=self.digest,
+        )
+
+    @staticmethod
+    def completed_events(*items: dict) -> list[dict]:
+        return [
+            {"type": "thread.started", "thread_id": "synthetic-review"},
+            {"type": "turn.started"},
+            *items,
+            {
+                "type": "item.completed",
+                "item": {
+                    "id": "verdict",
+                    "type": "agent_message",
+                    "text": "NO_BLOCKING_FINDINGS",
+                },
+            },
+            {"type": "turn.completed"},
+        ]
+
+    @staticmethod
+    def read_event() -> dict:
+        return {
+            "type": "item.completed",
+            "item": {
+                "id": "read-1",
+                "type": "mcp_tool_call",
+                "server": "code_review_packet",
+                "tool": "read_packet",
+                "arguments": {"byte_offset": 0, "max_bytes": 46_000},
+                "status": "completed",
+                "result": {
+                    "content": [
+                        {"type": "text", "text": "PACKET_CHUNK 0:10/10\ncandidate\n"}
+                    ],
+                    "structured_content": None,
+                },
+                "error": None,
+            },
+        }
+
+    def assert_inconclusive(self, events: list[dict], reason: str | None = None) -> None:
+        failure = PARSER.audit_codex(self.args, events)
+        self.assertIsNotNone(failure)
+        self.assertEqual(failure["status"], "inconclusive")
+        if reason is not None:
+            self.assertEqual(failure["reason_code"], reason)
+
+    def test_codex_packet_accepts_verified_read(self) -> None:
+        failure = PARSER.audit_codex(
+            self.args, self.completed_events(self.read_event())
+        )
+
+        self.assertIsNone(failure)
+
+    def test_codex_packet_accepts_verified_search(self) -> None:
+        event = self.read_event()
+        arguments = {"query": "candidate", "byte_offset": 0, "limit": 2}
+        response = kimi_packet_mcp.search_packet(self.packet, self.digest, arguments)
+        self.assertFalse(response["isError"])
+        event["item"].update(tool="search_packet", arguments=arguments)
+        event["item"]["result"]["content"] = response["content"]
+
+        failure = PARSER.audit_codex(self.args, self.completed_events(event))
+
+        self.assertIsNone(failure)
+
+    def test_codex_packet_accepts_started_updated_completed_read(self) -> None:
+        completed = self.read_event()
+        started = copy.deepcopy(completed)
+        started["type"] = "item.started"
+        started["item"].update(status="in_progress", result=None)
+        updated = copy.deepcopy(started)
+        updated["type"] = "item.updated"
+
+        failure = PARSER.audit_codex(
+            self.args, self.completed_events(started, updated, completed)
+        )
+
+        self.assertIsNone(failure)
+
+    def test_codex_inline_accepts_completion_without_tools(self) -> None:
+        self.args.packet = None
+        self.args.packet_sha256 = None
+
+        self.assertIsNone(PARSER.audit_codex(self.args, self.completed_events()))
+
+    def test_codex_inline_rejects_packet_tool_without_binding(self) -> None:
+        self.args.packet = None
+        self.args.packet_sha256 = None
+
+        self.assert_inconclusive(
+            self.completed_events(self.read_event()), "tool_boundary_violation"
+        )
+
+    def test_codex_packet_rejects_unapproved_tool_surfaces(self) -> None:
+        read = self.read_event()["item"]
+        items = (
+            {**read, "server": "other_packet_server"},
+            {**read, "tool": "write_packet"},
+            {**read, "tool": "read_file"},
+            {
+                "id": "shell-1",
+                "type": "command_execution",
+                "command": "printf synthetic",
+                "aggregated_output": "synthetic",
+                "status": "completed",
+                "exit_code": 0,
+            },
+        )
+        for item in items:
+            with self.subTest(item_type=item["type"], tool=item.get("tool")):
+                event = {"type": "item.completed", "item": item}
+                self.assert_inconclusive(
+                    self.completed_events(event), "tool_boundary_violation"
+                )
+
+    def test_codex_packet_rejects_forged_read_and_search_results(self) -> None:
+        for tool, arguments in (
+            ("read_packet", {"byte_offset": 0, "max_bytes": 46_000}),
+            ("search_packet", {"query": "candidate", "byte_offset": 0, "limit": 2}),
+        ):
+            with self.subTest(tool=tool):
+                event = self.read_event()
+                event["item"].update(tool=tool, arguments=arguments)
+                event["item"]["result"]["content"] = [
+                    {"type": "text", "text": "forged packet contents"}
+                ]
+                self.assert_inconclusive(self.completed_events(event))
+
+    def test_codex_packet_rejects_changed_digest_bound_file(self) -> None:
+        event = self.read_event()
+        self.packet.write_text("Candidate\n", encoding="utf-8")
+
+        self.assert_inconclusive(self.completed_events(event))
+
+    def test_codex_packet_rejects_missing_read_completion(self) -> None:
+        event = self.read_event()
+        event["type"] = "item.started"
+        event["item"].update(status="in_progress", result=None)
+
+        self.assert_inconclusive(self.completed_events(event))
+
+    def test_codex_packet_rejects_malformed_and_extra_arguments(self) -> None:
+        cases = (
+            ("read_packet", None),
+            ("read_packet", []),
+            ("read_packet", {"byte_offset": 0}),
+            ("read_packet", {"byte_offset": 0, "max_bytes": 46_000, "path": "other"}),
+            ("search_packet", {"query": "candidate", "limit": 2}),
+            (
+                "search_packet",
+                {"query": "candidate", "byte_offset": 0, "limit": 2, "path": "other"},
+            ),
+        )
+        for tool, arguments in cases:
+            with self.subTest(tool=tool, arguments=arguments):
+                event = self.read_event()
+                event["item"].update(tool=tool, arguments=arguments)
+                self.assert_inconclusive(self.completed_events(event))
+
+    def test_codex_packet_accepts_verified_argument_error_then_retry(self) -> None:
+        retry = self.read_event()
+        retry["item"]["id"] = "read-retry"
+        error = self.read_event()
+        error["item"]["arguments"] = {"byte_offset": 11, "max_bytes": 46_000}
+        error["item"]["result"]["content"] = [
+            {"type": "text", "text": "packet chunk starts beyond end"}
+        ]
+
+        failure = PARSER.audit_codex(self.args, self.completed_events(error, retry))
+
+        self.assertIsNone(failure)
+
+    def test_codex_packet_transport_failure_stays_inconclusive_after_retry(self) -> None:
+        for status, result, error in (
+            ("failed", None, {"message": "transport closed"}),
+            ("completed", None, {"message": "transport closed"}),
+            ("completed", None, None),
+        ):
+            with self.subTest(status=status, error=error):
+                failed = self.read_event()
+                failed["item"].update(status=status, result=result, error=error)
+                retry = self.read_event()
+                retry["item"]["id"] = "read-retry"
+                self.assert_inconclusive(self.completed_events(failed, retry))
+
+
+class CompletionFindingDispositionTest(unittest.TestCase):
+    """Exercise real receipt and completion validation without external models."""
+
+    def setUp(self) -> None:
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name)
+        self.packet = self.root / "candidate.patch"
+        self.packet.write_text(
+            "diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -1 +1 @@\n-a\n+b\n",
+            encoding="utf-8",
+        )
+        self.plan = self.root / "review-plan.json"
+        self.write_json(self.plan, {
+            "intent": "Preserve bounded completion after source refutation.",
+            "acceptance": ["Every finding occurrence is resolved without adding review authority."],
+            "self_review": [
+                {"concern": concern,
+                 "conclusion": f"The synthetic completion fixture preserves {concern} boundaries.",
+                 "evidence_refs": ["fixture"]}
+                for concern in ("correctness", "safety", "failure_paths", "tests_evidence", "compatibility")
+            ],
+            "evidence": [{"id": "fixture", "result": "Synthetic exact-candidate completion and history fixture."}],
+        })
+        self.dispositions = self.root / "dispositions.json"
+        self.record_receipts()
+
+    def record_receipts(self, final_status: str = "findings", *,
+                        duplicate_findings: bool = False, distinct_finding: bool = False) -> None:
+        self.final_review_status = final_status
+        self.duplicate_findings = duplicate_findings
+        self.distinct_finding = distinct_finding
+        self.provider_calls: list[list[str]] = []
+        self.profiles: list[dict] = []
+        self.receipt_paths = [self.root / "review.json", self.root / "challenge.json"]
+        self.receipts = []
+        for index, mode in enumerate(("review", "challenge"), 1):
+            extra = ["--review-chain-id", "source-refutation-fixture",
+                     "--autonomous-review-index", str(index)]
+            if mode == "challenge":
+                extra.extend(["--challenge-index", "1", "--focus", "source-boundary",
+                              "--prior-review-result-file", str(self.receipt_paths[0])])
+            code, result = self.invoke(mode, extra)
+            self.assertEqual(code, 0, result)
+            self.assertEqual(result["status"], "findings" if mode == "review" else final_status, result)
+            self.receipts.append(result)
+            self.write_json(self.receipt_paths[index - 1], result)
+        self.original_receipt_bytes = [path.read_bytes() for path in self.receipt_paths]
+        self.refresh_dispositions()
+
+    @staticmethod
+    def write_json(path: Path, value: object) -> None:
+        path.write_text(json.dumps(value, ensure_ascii=False, sort_keys=True), encoding="utf-8")
+
+    @staticmethod
+    def digest(path: Path) -> str:
+        return hashlib.sha256(path.read_bytes()).hexdigest()
+
+    @staticmethod
+    def finding_digest(finding: dict) -> str:
+        canonical = json.dumps(finding, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
+        return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+    def wrapper_result(self, command: list[str], **kwargs: object) -> subprocess.CompletedProcess:
+        # Only the provider boundary is replaced. Packet, profile, chain and
+        # completion validation execute normally; no subprocess is launched.
+        self.assertTrue(command[0].endswith("kimi_review.sh"), command[0])
+        self.provider_calls.append(list(command))
+        profile_path = Path(command[command.index("--review-profile-file") + 1])
+        profile = json.loads(profile_path.read_text(encoding="utf-8"))
+        self.profiles.append(profile)
+        mode = command[command.index("--mode") + 1]
+        payload = {
+            "reviewer": "kimi", "reviewer_family": "moonshot", "provider": "kimi-cli",
+            "model": "synthetic", "mode": mode, "status": "findings",
+            "native_skill_binding": "established",
+            "concern_results": [
+                {"concern": item["id"], "conclusion": f"Checked {item['id']} against the frozen candidate."}
+                for item in profile["required_concerns"]
+            ],
+            "findings": [{"severity": "P1", "file": "x", "line": 1,
+                          "failure_path": "Synthetic missing guard before an action.",
+                          "smallest_fix": "Check the guard before the synthetic action."}],
+        }
+        if mode == "challenge" and self.final_review_status == "passed":
+            payload.update(status="passed", findings=[])
+        elif self.duplicate_findings:
+            payload["findings"].append(dict(reversed(list(payload["findings"][0].items()))))
+            if self.distinct_finding:
+                payload["findings"].append({**payload["findings"][0],
+                                            "failure_path": "A distinct synthetic failure on the same line."})
+        return subprocess.CompletedProcess(command, 0, json.dumps(payload).encode("utf-8"), b"")
+
+    def arguments(self, mode: str) -> list[str]:
+        return ["--mode", mode, "--cwd", str(self.root), "--diff-file", str(self.packet),
+                "--implementer-family", "openai", "--review-plan-file", str(self.plan),
+                "--challenge-budget", "1"]
+
+    def invoke(self, mode: str, extra: list[str]) -> tuple[int, dict]:
+        output = io.StringIO()
+        with (mock.patch.object(review_gate, "run", side_effect=self.wrapper_result),
+              mock.patch.object(review_gate, "client_order", return_value=["kimi"]),
+              contextlib.redirect_stdout(output)):
+            code = review_gate.main(self.arguments(mode) + extra)
+        return code, json.loads(output.getvalue())
+
+    def refresh_dispositions(self) -> dict:
+        hashes = [self.digest(path) for path in self.receipt_paths]
+        receipts = [json.loads(path.read_text(encoding="utf-8")) for path in self.receipt_paths]
+        manifest = {
+            "schema_version": 1,
+            "candidate_sha256": receipts[-1]["candidate_sha256"],
+            "review_result_sha256": hashes,
+            "dispositions": [
+                {"receipt_sha256": receipt_hash,
+                 "finding_sha256": self.finding_digest(finding),
+                 "disposition": "source_refuted",
+                 "evidence": ["Synthetic source x:1 checks the guard before the action; the reported path is unreachable."]}
+                for receipt_hash, receipt in zip(hashes, receipts)
+                for finding in {self.finding_digest(item): item for item in receipt["findings"]}.values()
+            ],
+        }
+        self.write_json(self.dispositions, manifest)
+        return manifest
+
+    def complete(self, *, include_prior: bool = True) -> tuple[int, dict]:
+        extra = ["--completion-review-result-file", str(self.receipt_paths[-1]),
+                 "--finding-dispositions-file", str(self.dispositions)]
+        if include_prior:
+            extra.extend(["--prior-review-result-file", str(self.receipt_paths[0])])
+        result = self.invoke("complete", extra)
+        self.assertEqual(len(self.provider_calls), 2, "completion must never call a reviewer")
+        return result
+
+    def assert_rejected(self, *, include_prior: bool = True) -> dict:
+        code, result = self.complete(include_prior=include_prior)
+        self.assertEqual(code, 2, result)
+        self.assertEqual(result["status"], "inconclusive", result)
+        self.assertTrue(result["completion_gated"], result)
+        return result
+
+    def test_source_refuted_findings_validate_bound_dispositions(self) -> None:
+        # Keep the narrower validator exercised independently of CLI parsing.
+        args = review_gate.build_parser().parse_args(self.arguments("complete") + [
+            "--completion-review-result-file", str(self.receipt_paths[-1])])
+        args.finding_dispositions_file = str(self.dispositions)
+        args.prior_review_result_file = [str(self.receipt_paths[0])]
+        result_hash, prior, metadata = review_gate.validate_finding_dispositions(
+            args, self.receipts[-1]["candidate_sha256"], self.profiles[-1])
+        self.assertEqual(result_hash, self.digest(self.receipt_paths[-1]))
+        self.assertEqual(prior["findings"], self.receipts[-1]["findings"])
+        self.assertEqual(metadata["completion_basis"], "source_refuted_findings")
+
+    def test_two_refuted_rounds_complete_without_new_review_or_history_reset(self) -> None:
+        code, result = self.complete()
+        self.assertEqual(code, 0, result)
+        self.assertEqual(result["status"], "passed")
+        self.assertFalse(result["completion_gated"])
+        self.assertEqual(result["completion_basis"], "source_refuted_findings")
+        self.assertEqual(result["finding_dispositions_sha256"], self.digest(self.dispositions))
+        manifest = json.loads(self.dispositions.read_text(encoding="utf-8"))
+        # A repeated finding in a later round is a separate occurrence even
+        # when its canonical finding hash is identical.
+        self.assertEqual(len({item["finding_sha256"] for item in manifest["dispositions"]}), 1)
+        self.assertEqual(len({item["receipt_sha256"] for item in manifest["dispositions"]}), 2)
+        self.assertEqual(result["resolved_finding_occurrences"], [
+            {key: item[key] for key in ("receipt_sha256", "finding_sha256")}
+            for item in manifest["dispositions"]])
+        for field in ("review_chain_id", "review_scope_sha256", "prior_review_result_sha256",
+                      "prior_challenge_focuses", "autonomous_review_budget", "autonomous_review_index",
+                      "autonomous_reviews_remaining"):
+            self.assertEqual(result[field], self.receipts[-1][field], field)
+        self.assertEqual(result["autonomous_review_budget"], 2)
+        self.assertEqual(result["autonomous_review_index"], 2)
+        self.assertEqual(result["autonomous_reviews_remaining"], 0)
+        self.assertFalse(result["autonomous_review_allowed"])
+        self.assertEqual(result["next_action"], "complete")
+        self.assertEqual([path.read_bytes() for path in self.receipt_paths], self.original_receipt_bytes)
+
+    def test_dispositions_file_is_required_and_must_exist(self) -> None:
+        code, result = self.invoke("complete", [
+            "--completion-review-result-file", str(self.receipt_paths[-1])])
+        self.assertEqual(code, 2, result)
+        self.assertTrue(result["completion_gated"], result)
+        self.dispositions.unlink()
+        self.assert_rejected()
+
+    def test_identical_findings_share_identity_without_rewriting_receipts(self) -> None:
+        for final_status in ("findings", "passed"):
+            with self.subTest(final_status=final_status):
+                self.record_receipts(final_status, duplicate_findings=True)
+                self.assertEqual(len(self.receipts[0]["findings"]), 2)
+                code, result = self.complete()
+                self.assertEqual(code, 0, result)
+                self.assertEqual(len(result["resolved_finding_occurrences"]),
+                                 2 if final_status == "findings" else 1)
+                self.assertEqual([path.read_bytes() for path in self.receipt_paths],
+                                 self.original_receipt_bytes)
+
+    def test_duplicate_identity_never_hides_a_distinct_finding_or_round(self) -> None:
+        self.record_receipts(duplicate_findings=True, distinct_finding=True)
+        manifest = self.refresh_dispositions()
+        self.assertEqual([len(row["findings"]) for row in self.receipts], [3, 3])
+        self.assertEqual(len(manifest["dispositions"]), 4)
+        code, result = self.complete()
+        self.assertEqual(code, 0, result)
+        self.assertEqual(len(result["resolved_finding_occurrences"]), 4)
+        for missing in range(4):
+            with self.subTest(missing_occurrence=missing):
+                incomplete = copy.deepcopy(manifest)
+                del incomplete["dispositions"][missing]
+                self.write_json(self.dispositions, incomplete)
+                self.assert_rejected()
+
+    def test_passed_final_still_requires_valid_historical_finding_dispositions(self) -> None:
+        self.record_receipts(final_status="passed")
+        code, result = self.complete()
+        self.assertEqual(code, 0, result)
+        self.assertEqual(result["completion_basis"], "source_refuted_findings")
+        self.assertEqual(len(result["resolved_finding_occurrences"]), 1)
+        self.assertEqual(result["resolved_finding_occurrences"][0]["receipt_sha256"],
+                         self.digest(self.receipt_paths[0]))
+        manifest = self.refresh_dispositions()
+        manifest["dispositions"][0]["disposition"] = "accepted_risk"
+        self.write_json(self.dispositions, manifest)
+        rejected = self.assert_rejected()
+        self.assertEqual(rejected["next_action"], "resolve_review_findings")
+        manifest["dispositions"] = []
+        self.write_json(self.dispositions, manifest)
+        self.assert_rejected()
+
+    def test_every_historical_finding_occurrence_must_be_covered_once(self) -> None:
+        original = self.refresh_dispositions()
+        for missing in (0, 1):
+            with self.subTest(missing_round=missing):
+                manifest = copy.deepcopy(original)
+                del manifest["dispositions"][missing]
+                self.write_json(self.dispositions, manifest)
+                self.assert_rejected()
+        manifest = copy.deepcopy(original)
+        manifest["dispositions"].append(copy.deepcopy(manifest["dispositions"][0]))
+        self.write_json(self.dispositions, manifest)
+        self.assert_rejected()
+
+    def test_disposition_candidate_receipt_and_finding_hashes_are_bound(self) -> None:
+        original = self.refresh_dispositions()
+        for field in ("candidate_sha256", "review_result_sha256", "receipt_sha256", "finding_sha256"):
+            with self.subTest(field=field):
+                manifest = copy.deepcopy(original)
+                if field == "review_result_sha256":
+                    manifest[field][0] = "f" * 64
+                elif field == "candidate_sha256":
+                    manifest[field] = "f" * 64
+                else:
+                    manifest["dispositions"][0][field] = "f" * 64
+                self.write_json(self.dispositions, manifest)
+                self.assert_rejected()
+
+    def test_unresolved_or_accepted_risk_cannot_complete(self) -> None:
+        original = self.refresh_dispositions()
+        for disposition in ("unresolved", "accepted_risk", "accepted_tradeoff", "needs_human_decision"):
+            with self.subTest(disposition=disposition):
+                manifest = copy.deepcopy(original)
+                manifest["dispositions"][0]["disposition"] = disposition
+                self.write_json(self.dispositions, manifest)
+                self.assert_rejected()
+
+    def test_source_refutation_requires_bounded_nonempty_evidence(self) -> None:
+        original = self.refresh_dispositions()
+        for evidence in (None, [], [""], ["  \n"], "source x:1", [123], ["x" * 100_000]):
+            with self.subTest(evidence_type=type(evidence).__name__, size=len(str(evidence))):
+                manifest = copy.deepcopy(original)
+                if evidence is None:
+                    del manifest["dispositions"][0]["evidence"]
+                else:
+                    manifest["dispositions"][0]["evidence"] = evidence
+                self.write_json(self.dispositions, manifest)
+                self.assert_rejected()
+
+    def test_evidence_strings_match_downstream_normalization_and_text_boundary(self) -> None:
+        original = self.refresh_dispositions()
+        for text in (" leading space", "trailing space ", "line\nbreak", "tab\tinside",
+                     "NUL\0inside", "DEL\x7finside", "C1\x85inside", "line\u2028separator",
+                     "paragraph\u2029separator", "zero\u200bwidth", "bidi\u202econtrol", "bad\ud800unicode"):
+            with self.subTest(text=ascii(text)):
+                manifest = copy.deepcopy(original)
+                manifest["dispositions"][0]["evidence"] = [text]
+                # Escaped JSON can encode an unpaired surrogate even though the
+                # decoded string cannot be encoded as valid UTF-8 text.
+                self.dispositions.write_text(json.dumps(manifest), encoding="utf-8")
+                self.assert_rejected()
+
+    def test_changed_candidate_cannot_use_previous_refutations(self) -> None:
+        self.packet.write_text(self.packet.read_text(encoding="utf-8").replace("+b\n", "+c\n"), encoding="utf-8")
+        self.assert_rejected()
+
+    def test_stale_historical_candidate_cannot_use_current_refutations(self) -> None:
+        historical = copy.deepcopy(self.receipts[0])
+        historical["candidate_sha256"] = historical["packet_sha256"] = "f" * 64
+        self.write_json(self.receipt_paths[0], historical)
+        final = copy.deepcopy(self.receipts[-1])
+        final["prior_review_result_sha256"][0] = self.digest(self.receipt_paths[0])
+        self.write_json(self.receipt_paths[-1], final)
+        # Refresh every outer receipt reference so stale candidate rejection
+        # cannot be attributed to an incidental raw-receipt hash mismatch.
+        self.refresh_dispositions()
+        self.assert_rejected()
+
+    def test_inconclusive_receipt_cannot_be_refuted_into_a_pass(self) -> None:
+        for index in (0, 1):
+            with self.subTest(round=index):
+                for path, raw in zip(self.receipt_paths, self.original_receipt_bytes):
+                    path.write_bytes(raw)
+                receipt = json.loads(self.receipt_paths[index].read_text(encoding="utf-8"))
+                receipt["status"] = "inconclusive"
+                self.write_json(self.receipt_paths[index], receipt)
+                if index == 0:
+                    final = copy.deepcopy(self.receipts[-1])
+                    final["prior_review_result_sha256"][0] = self.digest(self.receipt_paths[0])
+                    self.write_json(self.receipt_paths[-1], final)
+                self.refresh_dispositions()
+                self.assert_rejected()
+
+    def test_forged_or_missing_history_cannot_complete(self) -> None:
+        self.assert_rejected(include_prior=False)
+        receipt = copy.deepcopy(self.receipts[-1])
+        receipt["prior_review_result_sha256"][0] = "f" * 64
+        self.write_json(self.receipt_paths[-1], receipt)
+        self.refresh_dispositions()
+        self.assert_rejected()
+
+    def test_original_receipt_metadata_must_match_the_external_round(self) -> None:
+        for index in (0, 1):
+            for field in ("review_state", "human_decision_required", "gate_required", "gate_triggers"):
+                with self.subTest(round=index, field=field):
+                    for path, raw in zip(self.receipt_paths, self.original_receipt_bytes):
+                        path.write_bytes(raw)
+                    receipt = copy.deepcopy(self.receipts[index])
+                    if field == "review_state":
+                        receipt[field] = "reviewed"
+                    elif field == "human_decision_required":
+                        receipt[field] = not receipt[field]
+                    elif field == "gate_required":
+                        receipt["self_review_gate"]["required"] = False
+                    else:
+                        receipt["self_review_gate"]["required_triggers"] = []
+                    self.write_json(self.receipt_paths[index], receipt)
+                    if index == 0:
+                        final = copy.deepcopy(self.receipts[-1])
+                        final["prior_review_result_sha256"][0] = self.digest(self.receipt_paths[0])
+                        self.write_json(self.receipt_paths[-1], final)
+                    self.refresh_dispositions()
+                    self.assert_rejected()
+
+    def test_receipt_order_is_part_of_the_disposition_binding(self) -> None:
+        manifest = self.refresh_dispositions()
+        manifest["review_result_sha256"].reverse()
+        self.write_json(self.dispositions, manifest)
+        self.assert_rejected()
+
+
 if __name__ == "__main__":
     unittest.main()

package/dist/assets/marketplace/plugins/ccl-skills/skills/defect-diagnosis/SKILL.md

@@ -5,7 +5,9 @@ description: bug / 报错 / test 挂了 / 线上问题 / 接口变慢·性能退
 
 # Defect Diagnosis
 
-Use this skill for the full defect discipline: diagnose the immediate failure, fix it with evidence, then decide whether root-cause prevention should update a product, architecture, development, testing, release, or tooling skill.
+Diagnose and fix from evidence; route prevention to product, architecture, development, testing, release or tooling.
+
+- Code/test changes require self-checks; invoke `code-review` automatically before completion.
 
 ## Non-Negotiable Rules
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/go-microservice-dev/SKILL.md

@@ -5,7 +5,7 @@ description: Use when implementing, modifying, scaffolding, generating, or testi
 
 # Go Microservice Dev
 
-Use this for implementation of new backend products and services. It should adapt to the repo in front of you, but the workflow is independent of any prior codebase.
+Use this for implementation of new backend products and services. It should adapt to the repo in front of you, but the workflow is independent of any prior codebase. After code/test edits, self-check and invoke `code-review` automatically before completion.
 
 ## Skill Routing
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/llm-inference-integration/SKILL.md

@@ -7,6 +7,8 @@ description: Use when designing, implementing, reviewing, debugging, or operatin
 
 Use this for product backend work that calls, hosts, evaluates, or operates LLM and inference systems. Keep the skill generic: extract reusable mechanics only, not business-specific prompts, datasets, provider names, repository paths, or domain nouns.
 
+- Code/test changes require self-checks; invoke `code-review` automatically before completion.
+
 ## Skill Routing
 
 - Use this skill for LLM gateway/client design, model registry, prompt versioning, agent/tool orchestration, streaming APIs, fallback, token/cost accounting, evals, replay, shadow comparison, batch inference, and inference observability.

package/dist/assets/marketplace/plugins/ccl-skills/skills/miniapp-product-dev/SKILL.md

@@ -5,7 +5,7 @@ description: "小程序 / Taro / 微信小程序 / 支付宝小程序 / 抖音
 
 # Miniapp Product Dev
 
-Use this skill for mini-program client engineering and platform delivery. It covers product-facing miniapp work across WeChat, Alipay, Douyin/TikTok, Baidu, and similar host platforms. It does not own general product strategy, backend service architecture, or visual design rules.
+Mini-program client engineering and product-facing delivery across WeChat, Alipay, Douyin/TikTok, Baidu and similar hosts; excludes product strategy, backend architecture and visual design. After code/test edits, self-check and invoke `code-review` automatically before completion.
 
 ## Framework Scope
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/multi-agent-delegation/SKILL.md

@@ -57,7 +57,7 @@ This skill is about **using AI agents / subagents to execute work** — delegati
   5. **Value**: the task is worth that premium.
   If independence, value, or breadth is unclear, start with one focused agent or sequential delegation; use parallel multi-agent dispatch when those checks are explicitly satisfied.
 - Model tier per dispatch is an explicit decision, not an inherited accident. On hosts that inherit the session model for unnamed dispatches (a common default — Claude-family harnesses behave this way; verify yours), an unnamed model is often the most capable and most expensive tier, so a high-volume fan-out silently puts every worker and reviewer on the top tier. The observable triggers are a fan-out — multiple dispatches (workers/reviewers) in one delivery — and any high-risk dispatch: there, name the tier per dispatch and choose by judgment complexity and risk, not token price alone — the cheapest tier routinely takes 2–3× the turns on multi-step work and costs more overall, so use a mid-tier floor for reviewers and for implementers working from prose descriptions; reserve the cheapest tier for transcription-plus-tests tasks (the plan text already contains the code to write) and single-file mechanical fixes; put architecture/design judgment, security/authority/tenant-isolation/data-loss review, and the final whole-scope review on the most capable tier — review tier scales with the diff's size, complexity, and risk, and a high-risk review never silently inherits a cheap session default even as a single dispatch (tier principle: `../skill-extraction-workflow/references/harness-patterns-and-eval.md`). Record the decision as a brief field alongside `required_skills`: `model_tier: <tier>` or `model_tier: host-default (<reason: single low-risk dispatch | no host model selection>)` — an absent field is an unmade decision, not a default, and the field is bookkeeping only until the dispatch call actually passes the matching model selector (verify the effective model where the host exposes it; a field/selector mismatch is a defect, not a recorded decision).
-- Stop and escalate when the plan is unclear, a dependency is missing, verification fails repeatedly (same error ~3 times — identical retries, not new findings from successive review rounds), or an agent returns unsupported claims. An escalation message must carry five fields, or it is just "stuck": the specific blocker, the attempts made and their results, the current state (diff / commits / workspace), the safest next action for the human to align on, and whether a lower-risk part can continue meanwhile.
+- Stop and escalate when unclear direction, unavailable dependencies, unknown completion state or missing authority remains after bounded remediation. Repeated identical verification failures (~3 times) require a status report and method/evidence checkpoint, not renewed task permission; stop identical retries and continue necessary work within existing scope, respecting explicit user limits. Escalation must name the blocker, attempts and results, current diff/commits/workspace, safest next action, and lower-risk work that can continue.
 
 ## Execution Flow