@ccoalm/ccl-skills 0.15.5 → 0.17.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_gate.sh

@@ -951,7 +951,8 @@ cat >"$WORK/review-plan.json" <<'JSON'
     {"concern": "tests_evidence", "conclusion": "Focused deterministic contract tests cover the change.", "evidence_refs": ["e1"]},
     {"concern": "compatibility", "conclusion": "Existing provider routing remains backward compatible.", "evidence_refs": ["e1"]},
     {"concern": "rollout_rollback", "conclusion": "The local CLI change has a direct revert path.", "evidence_refs": ["e1"]},
-    {"concern": "observability_operations", "conclusion": "The JSON envelope exposes stage and depth for diagnosis.", "evidence_refs": ["e1"]}
+    {"concern": "observability_operations", "conclusion": "The JSON envelope exposes stage and depth for diagnosis.", "evidence_refs": ["e1"]},
+    {"concern": "claim_strength", "conclusion": "Each claim is scoped to the fixture it was observed on.", "evidence_refs": ["e1"]}
   ],
   "evidence": [
     {"id": "e1", "result": "Deterministic fake-wrapper contract fixture."}
@@ -1033,7 +1034,8 @@ cat >"$WORK/placeholder-plan.json" <<'JSON'
     {"concern": "safety", "conclusion": "Packet and tool boundaries remain fail closed.", "evidence_refs": ["e1"]},
     {"concern": "failure_paths", "conclusion": "Invalid and inconclusive paths remain terminal.", "evidence_refs": ["e1"]},
     {"concern": "tests_evidence", "conclusion": "A focused regression proves filler is rejected.", "evidence_refs": ["e1"]},
-    {"concern": "compatibility", "conclusion": "Existing provider routing remains compatible.", "evidence_refs": ["e1"]}
+    {"concern": "compatibility", "conclusion": "Existing provider routing remains compatible.", "evidence_refs": ["e1"]},
+    {"concern": "claim_strength", "conclusion": "No claim reaches past the filler-rejection fixture.", "evidence_refs": ["e1"]}
   ],
   "evidence": [{"id": "e1", "result": "Deterministic placeholder-validation fixture."}]
 }
@@ -1058,6 +1060,7 @@ cat >"$WORK/high-risk-plan.json" <<'JSON'
     {"concern": "compatibility", "conclusion": "Existing provider routing remains compatible.", "evidence_refs": ["e1"]},
     {"concern": "rollout_rollback", "conclusion": "The local contract change has a direct revert path.", "evidence_refs": ["e1"]},
     {"concern": "observability_operations", "conclusion": "The result exposes depth and risk tags for diagnosis.", "evidence_refs": ["e1"]},
+    {"concern": "claim_strength", "conclusion": "Each claim is scoped to the high-risk fixture it was observed on.", "evidence_refs": ["e1"]},
     {"concern": "high_risk_boundary", "conclusion": "Bypass attempts cannot remove controller-required concerns.", "evidence_refs": ["e1"]}
   ],
   "evidence": [{"id": "e1", "result": "Deterministic high-risk gate fixture."}]
@@ -1081,7 +1084,8 @@ cat >"$WORK/near-limit-plan.json" <<JSON
     {"concern": "safety", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]},
     {"concern": "failure_paths", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]},
     {"concern": "tests_evidence", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]},
-    {"concern": "compatibility", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]}
+    {"concern": "compatibility", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]},
+    {"concern": "claim_strength", "conclusion": "Scoped to this size fixture.", "evidence_refs": ["e1"]}
   ],
   "evidence": [{"id": "e1", "result": "$large_evidence"}]
 }
@@ -1374,6 +1378,144 @@ for malformed_plan in non-string-owner-review-plan empty-owner-review-plan; do
     '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=self_review_incomplete fallback_eligible=false next_action=deep_self_review self_review_gate.required=true'
 done
 
+# The claim-strength walk is a required concern, so it is owed BEFORE round 1 --
+# the one point in a round where correcting an overstated claim costs nothing. The
+# class it covers (absolutes, universals, causal and exhaustiveness claims the cited
+# evidence does not carry) otherwise keeps arriving as a LATE correction, after the
+# receipts are bound, where any candidate edit voids them.
+python3 - "$WORK/review-plan.json" "$WORK/no-claim-strength-review-plan.json" <<'PLAN'
+import json, sys
+from pathlib import Path
+plan = json.loads(Path(sys.argv[1]).read_text())
+plan["self_review"] = [row for row in plan["self_review"] if row["concern"] != "claim_strength"]
+Path(sys.argv[2]).write_text(json.dumps(plan))
+PLAN
+reset_case passed unavailable unavailable
+out="$(run_gate --review-plan-file "$WORK/no-claim-strength-review-plan.json")"; rc=$?
+check "a plan that skips the claim-strength walk fails before any provider runs" \
+  '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=self_review_incomplete fallback_eligible=false next_action=deep_self_review self_review_gate.required=true self_review_gate.required_triggers.0=before_external_review'
+
+reset_case passed unavailable unavailable
+out="$(run_gate --allow-fallback-egress)"; rc=$?
+check "the build reviewer is asked to check claim strength" \
+  '[ "$rc" = 0 ] && json_fields "$out" reviewed_concerns.5=claim_strength'
+
+# The exported list is only worth deriving from if it IS the enforced one. Build a
+# plan covering exactly what the controller prints, and then drop each printed
+# concern in turn: acceptance proves the print covers everything the gate demands,
+# and every single-drop rejection proves nothing printed is decorative. Without
+# both directions a caller could derive from a list that had quietly diverged --
+# which is the drift this export exists to remove.
+# The exit status is asserted too. This suite runs without errexit, so a command
+# substitution silently discards it: a printer that emits the right concerns and then
+# fails would satisfy a non-empty check and report agreement it never reached.
+printed_rc=0
+printed_concerns="$("$DIR/review_gate.sh" --print-required-concerns --stage build)" || printed_rc=$?
+check "the controller can print the concern set a plan owes, and succeeds doing it" \
+  '[ -n "$printed_concerns" ] && [ "$printed_rc" = 0 ]'
+# Proving agreement at ONE depth leaves the other branch free to diverge with every
+# test green -- and release/high-risk is the branch that carries the most concerns.
+# Assert the depth-raising branch answers what the gate itself derives for it.
+# Parity includes what each side REFUSES. A printer that answers for tags the enforcer
+# rejects reintroduces the divergence this export removes: a caller deriving from a
+# malformed tag would get a list where the real round fails closed.
+for bad_tag in "a b" "" "$(printf 'x%.0s' $(seq 81))"; do
+  # rc captured without touching shell options: this suite runs under `set -uo pipefail`
+  # and enabling errexit here would abort every later case at its first non-zero command.
+  bad_tag_rc=0
+  "$DIR/review_gate.sh" --print-required-concerns --stage build --risk-tag "$bad_tag" >/dev/null 2>&1 || bad_tag_rc=$?
+  # Parity is a claim about TWO sides, so both are exercised: asserting only the
+  # printer would keep these checks green if the enforcer's own rejection were
+  # removed, which is the half this pair exists to tie together.
+  enforcer_tag_rc=0
+  run_gate --risk-tag "$bad_tag" >/dev/null 2>&1 || enforcer_tag_rc=$?
+  check "printer and enforcer both refuse the same malformed risk tag (${#bad_tag} chars)" \
+    '[ "$bad_tag_rc" != 0 ] && [ "$enforcer_tag_rc" != 0 ]'
+done
+printed_release_rc=0
+printed_release="$("$DIR/review_gate.sh" --print-required-concerns --stage explore --risk-tag shared-gate)" || printed_release_rc=$?
+check "the raised-depth print succeeds" '[ "$printed_release_rc" = 0 ]'
+# Hoisted for the same reason as the calls above: nested inside the comparison, this
+# printer call's exit status was discarded, so a regression failing only for explicit
+# release depth would have compared equal and passed. Every printer invocation in this
+# suite now has its status asserted.
+printed_plain_release_rc=0
+printed_plain_release="$("$DIR/review_gate.sh" --print-required-concerns --stage release)" || printed_plain_release_rc=$?
+check "the plain release print succeeds" '[ "$printed_plain_release_rc" = 0 ]'
+check "a high-risk tag raises the printed set to release depth and adds the boundary concern" \
+  '[ "$(printf %s "$printed_release" | tr "\n" " ")" = "$(printf "%s\nhigh_risk_boundary" "$printed_plain_release" | tr "\n" " ")" ]'
+python3 - "$WORK/review-plan.json" "$WORK/printed-plan.json" $printed_concerns <<'PLAN'
+import json, sys
+from pathlib import Path
+source = json.loads(Path(sys.argv[1]).read_text())
+printed = sys.argv[3:]
+by_concern = {row["concern"]: row for row in source["self_review"]}
+source["self_review"] = [
+    by_concern.get(concern, {"concern": concern,
+                             "conclusion": f"The fixture covers {concern}.",
+                             "evidence_refs": ["e1"]})
+    for concern in printed
+]
+Path(sys.argv[2]).write_text(json.dumps(source))
+PLAN
+reset_case passed unavailable unavailable
+out="$(run_gate --review-plan-file "$WORK/printed-plan.json" --allow-fallback-egress)"; rc=$?
+check "a plan built from the printed set satisfies the gate" '[ "$rc" = 0 ]'
+printed_drop_failures=0
+for dropped in $printed_concerns; do
+  python3 - "$WORK/printed-plan.json" "$WORK/printed-plan-minus.json" "$dropped" <<'PLAN'
+import json, sys
+from pathlib import Path
+plan = json.loads(Path(sys.argv[1]).read_text())
+plan["self_review"] = [row for row in plan["self_review"] if row["concern"] != sys.argv[3]]
+Path(sys.argv[2]).write_text(json.dumps(plan))
+PLAN
+  reset_case passed unavailable unavailable
+  out="$(run_gate --review-plan-file "$WORK/printed-plan-minus.json")"; rc=$?
+  if [ "$rc" = 2 ] && json_fields "$out" reason_code=self_review_incomplete; then
+    printed_drop_failures=$((printed_drop_failures+1))
+  fi
+done
+check "every printed concern is one the gate actually demands" \
+  '[ "$printed_drop_failures" = "$(printf %s "$printed_concerns" | wc -w | tr -d " ")" ]'
+
+# The same two directions at the OTHER depth. A printer that agreed with the gate at
+# build and diverged at release/high-risk would keep every test above green, and
+# release is the branch carrying the most concerns.
+python3 - "$WORK/high-risk-plan.json" "$WORK/printed-release-plan.json" $printed_release <<'PLAN'
+import json, sys
+from pathlib import Path
+source = json.loads(Path(sys.argv[1]).read_text())
+by_concern = {row["concern"]: row for row in source["self_review"]}
+source["self_review"] = [
+    by_concern.get(concern, {"concern": concern,
+                             "conclusion": f"The high-risk fixture covers {concern}.",
+                             "evidence_refs": ["e1"]})
+    for concern in sys.argv[3:]
+]
+Path(sys.argv[2]).write_text(json.dumps(source))
+PLAN
+reset_case passed unavailable unavailable
+out="$(run_gate --stage explore --risk-tag shared-gate --review-plan-file "$WORK/printed-release-plan.json" --review-chain-id printed-release --autonomous-review-index 1 --allow-fallback-egress)"; rc=$?
+check "a plan built from the printed release set satisfies the raised-depth gate" '[ "$rc" = 0 ]'
+printed_release_drop_failures=0
+for dropped in $printed_release; do
+  python3 - "$WORK/printed-release-plan.json" "$WORK/printed-release-minus.json" "$dropped" <<'PLAN'
+import json, sys
+from pathlib import Path
+plan = json.loads(Path(sys.argv[1]).read_text())
+plan["self_review"] = [row for row in plan["self_review"] if row["concern"] != sys.argv[3]]
+Path(sys.argv[2]).write_text(json.dumps(plan))
+PLAN
+  reset_case passed unavailable unavailable
+  out="$(run_gate --stage explore --risk-tag shared-gate --review-plan-file "$WORK/printed-release-minus.json" --review-chain-id printed-release-minus --autonomous-review-index 1)"; rc=$?
+  if [ "$rc" = 2 ] && json_fields "$out" reason_code=self_review_incomplete; then
+    printed_release_drop_failures=$((printed_release_drop_failures+1))
+  fi
+done
+check "every printed release concern is one the raised-depth gate actually demands" \
+  '[ "$printed_release_drop_failures" = "$(printf %s "$printed_release" | wc -w | tr -d " ")" ]'
+
 owner_lstat_classification="$(python3 - "$DIR/review_gate.py" <<'PY'
 import errno
 import importlib.util
@@ -1679,7 +1821,7 @@ diff_alternate = root / "alternate.patch"
 diff_source.write_bytes(original_diff)
 diff_alternate.write_bytes(alternate_diff)
 with replace_after_symlink_check(diff_source, diff_alternate):
-    packet_path, digest, _, _ = review_gate.freeze_packet(
+    packet_path, digest, _candidate, _n, _, _ = review_gate.freeze_packet(
         SimpleNamespace(
             cwd=str(root), diff_file=str(diff_source), base=None, paths=[]
         ),
@@ -1774,6 +1916,241 @@ file_input_race_rc=$?
 check "diff, prior, and completion inputs are read once from a bounded opened descriptor" \
   '[ "$file_input_race_rc" = 0 ] && [ "$file_input_race_probe" = open_once_file_inputs_ok ]'
 
+# The reviewer's packet and the landing candidate are two objects. A widened
+# packet exists so a reviewer can judge a claim against code outside the diff;
+# the candidate exists so the merge-side binder can recompute what actually
+# lands. Aliasing them made the two mutually exclusive: widening produced a
+# receipt the binder could never match. These assert the split and the one
+# invariant that replaces the equality -- the candidate appears in the packet
+# verbatim, so nothing lands that its reviewer did not read.
+subject_packet_probe="$(
+PYTHONPATH="$WORK/harness/scripts" python3 - "$WORK" <<'PY'
+import hashlib
+import subprocess
+import sys
+import time
+from pathlib import Path
+from types import SimpleNamespace
+
+import review_gate
+
+root = Path(sys.argv[1]) / "subject-vs-packet"
+root.mkdir()
+# Packet files live OUTSIDE the repository on purpose: the base-derived
+# candidate includes untracked files, so a packet written into the worktree
+# would become part of the very candidate it has to contain.
+outside = Path(sys.argv[1]) / "subject-vs-packet-packets"
+outside.mkdir()
+
+
+def git(*args):
+    subprocess.run(
+        ["git", "-C", str(root), *args],
+        check=True,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+
+
+git("init", "-q")
+git("config", "user.email", "fixture@example.invalid")
+git("config", "user.name", "fixture")
+(root / "landing.txt").write_text("old\n", encoding="utf-8")
+(root / "context.txt").write_text("context-base\n", encoding="utf-8")
+git("add", "landing.txt", "context.txt")
+git("commit", "-qm", "base")
+base = subprocess.run(
+    ["git", "-C", str(root), "rev-parse", "HEAD"],
+    check=True,
+    capture_output=True,
+    text=True,
+).stdout.strip()
+(root / "landing.txt").write_text("new\n", encoding="utf-8")
+
+
+def freeze(*, diff_file=None, paths=(), base_ref=base, wording=None):
+    return review_gate.freeze_packet(
+        SimpleNamespace(
+            cwd=str(root),
+            diff_file=str(diff_file) if diff_file else None,
+            base=base_ref,
+            paths=list(paths),
+            wording_only_proof_file=wording,
+        ),
+        time.monotonic() + 30,
+    )
+
+
+def digest(value: bytes) -> str:
+    return hashlib.sha256(value).hexdigest()
+
+
+def expect_refused(label, **kwargs):
+    try:
+        result = freeze(**kwargs)
+    except review_gate.GateError as exc:
+        return exc
+    result[0].unlink()
+    raise AssertionError(label)
+
+
+# The base-derived subject: exactly what the landing binder recomputes.
+subject_path, subject_hash, subject_candidate_hash, subject_n, subject_paths, _ = freeze()
+subject_bytes = subject_path.read_bytes()
+subject_path.unlink()
+assert subject_hash == digest(subject_bytes)
+assert subject_candidate_hash == subject_hash
+assert subject_n == len(subject_bytes)
+assert subject_paths == ["landing.txt"], subject_paths
+
+# A7 -- with no --diff-file the two hashes are the same value, as they are today.
+plain_path, plain_packet_hash, plain_candidate_hash, _plain_n, plain_paths, _ = freeze()
+plain_path.unlink()
+assert plain_packet_hash == subject_hash
+assert plain_candidate_hash == subject_hash
+assert plain_paths == ["landing.txt"], plain_paths
+
+# A1/A2/A3 -- a widened packet carries the whole subject plus context the
+# reviewer needs. The packet hash is the widened bytes; the candidate hash is
+# still the base-derived subject the binder will recompute.
+context = (
+    b"\n--- context: skills/code-review/SKILL.md (unchanged, for judgment) ---\n"
+    b"the sibling clause the changed lines must not contradict\n"
+)
+widened = outside / "widened.patch"
+widened.write_bytes(subject_bytes + context)
+wide_path, wide_packet_hash, wide_candidate_hash, wide_n, wide_paths, _ = freeze(
+    diff_file=widened
+)
+try:
+    assert wide_packet_hash == digest(subject_bytes + context)
+    assert wide_candidate_hash == subject_hash
+    assert wide_packet_hash != wide_candidate_hash
+    # The reviewer is told where the candidate ends; without that, appended
+    # hunks that continue or appear to revert the diff are indistinguishable
+    # from candidate content in a packet-bounded read.
+    assert wide_n == len(subject_bytes), wide_n
+    # A10 -- candidate paths follow the subject, not the packet, so owner
+    # selection and the wording-only changed-file comparison stay bound to what
+    # lands rather than to whatever context was appended.
+    assert wide_paths == ["landing.txt"], wide_paths
+finally:
+    wide_path.unlink()
+
+# A5 -- a packet missing part of the candidate is refused. This is the property
+# the equality used to provide for free.
+truncated = outside / "truncated.patch"
+truncated.write_bytes(subject_bytes[: len(subject_bytes) // 2] + context)
+exc = expect_refused(
+    "a packet missing part of the candidate was accepted", diff_file=truncated
+)
+assert "BEGIN" in str(exc), str(exc)
+
+# A6 -- context appended passes; context spliced into the middle of the
+# candidate does not, because then the candidate is no longer in the packet
+# verbatim and no cheap check can tell a splice from a silent edit.
+split = len(subject_bytes) // 2
+interleaved = outside / "interleaved.patch"
+interleaved.write_bytes(subject_bytes[:split] + context + subject_bytes[split:])
+expect_refused(
+    "a packet interleaving context inside the candidate was accepted",
+    diff_file=interleaved,
+)
+
+# A11 -- context BEFORE the candidate is refused even though the candidate is
+# present verbatim. A bare containment test accepts this, and an adversarial
+# round showed what it buys: a sanitized decoy diff read as the change while the
+# real candidate reads as trailing context.
+prepended = outside / "prepended.patch"
+prepended.write_bytes(context + subject_bytes)
+exc = expect_refused(
+    "a packet preceding the candidate with other content was accepted",
+    diff_file=prepended,
+)
+assert "BEGIN" in str(exc), str(exc)
+
+# A4 -- a packet with no relation to the candidate is refused.
+unrelated = outside / "unrelated.patch"
+unrelated.write_bytes(b"diff --git a/x b/x\n--- a/x\n+++ b/x\n@@ -1 +1 @@\n-a\n+b\n")
+expect_refused("an unrelated packet was accepted", diff_file=unrelated)
+
+# A8 -- --diff-file alone keeps today's meaning: no base, so no subject, and
+# the candidate hash stays the packet's own hash.
+alone_path, alone_packet_hash, alone_candidate_hash, _n, _, _ = freeze(
+    diff_file=widened, base_ref=None
+)
+alone_path.unlink()
+assert alone_packet_hash == digest(subject_bytes + context)
+assert alone_candidate_hash == alone_packet_hash
+
+# A9 -- the wording-only proof is a machine check over a full-context
+# base-derived diff and has no meaning over an author-assembled packet.
+proof = outside / "wording-only.json"
+proof.write_text("{}", encoding="utf-8")
+expect_refused(
+    "a wording-only proof was accepted over an author-assembled packet",
+    diff_file=widened,
+    wording=str(proof),
+)
+# ... in the COMBINED form. Bare --diff-file with a wording-only proof stays
+# accepted, which the cases above this block exercise throughout; the boundary
+# is where a base-derived candidate and author-assembled bytes would both be in
+# play with nothing saying which one the proof's scope describes.
+result = freeze(diff_file=widened, base_ref=None, wording=str(proof))
+result[0].unlink()
+
+# A12 -- an empty base-derived candidate is refused rather than trivially
+# satisfying the prefix check, which every packet does for empty bytes.
+empty_repo = Path(sys.argv[1]) / "empty-candidate"
+empty_repo.mkdir()
+subprocess.run(["git", "-C", str(empty_repo), "init", "-q"], check=True)
+subprocess.run(
+    ["git", "-C", str(empty_repo), "config", "user.email", "fixture@example.invalid"],
+    check=True,
+)
+subprocess.run(
+    ["git", "-C", str(empty_repo), "config", "user.name", "fixture"], check=True
+)
+(empty_repo / "kept.txt").write_text("unchanged\n", encoding="utf-8")
+subprocess.run(
+    ["git", "-C", str(empty_repo), "add", "kept.txt"],
+    check=True,
+    stdout=subprocess.DEVNULL,
+)
+subprocess.run(
+    ["git", "-C", str(empty_repo), "commit", "-qm", "base"],
+    check=True,
+    stdout=subprocess.DEVNULL,
+)
+empty_base = subprocess.run(
+    ["git", "-C", str(empty_repo), "rev-parse", "HEAD"],
+    check=True,
+    capture_output=True,
+    text=True,
+).stdout.strip()
+try:
+    review_gate.freeze_packet(
+        SimpleNamespace(
+            cwd=str(empty_repo),
+            diff_file=str(widened),
+            base=empty_base,
+            paths=[],
+            wording_only_proof_file=None,
+        ),
+        time.monotonic() + 30,
+    )
+except review_gate.GateError as exc:
+    assert exc.reason_code == "empty_diff", exc.reason_code
+else:
+    raise AssertionError("an empty base-derived candidate was accepted")
+
+print("subject_packet_split_ok")
+PY
+)"
+subject_packet_rc=$?
+check "a widened packet keeps the base-derived candidate and must contain it verbatim" \
+  '[ "$subject_packet_rc" = 0 ] && [ "$subject_packet_probe" = subject_packet_split_ok ]'
+
 reset_case missing_coverage passed unavailable
 out="$(run_gate --diff-file "$WORK/secret-diff.patch")"; rc=$?
 check "missing coverage cannot widen egress for a secret-bearing diff without approval" \
@@ -1838,7 +2215,7 @@ check "complete but placeholder concern conclusions cannot false-green" \
 reset_case findings unavailable unavailable
 out="$(run_gate --allow-fallback-egress)"; rc=$?
 check "Claude findings remain findings" \
-  '[ "$rc" = 0 ] && json_fields "$out" status=findings selected_client=claude next_action=triage_findings_and_continue_independent_work autonomous_review_budget=1 autonomous_review_index=1 autonomous_review_allowed=false human_decision_required=true review_state=post_review_budget findings_require_implementer_self_review=true self_review_gate.required=true self_review_gate.required_triggers.0=findings_returned self_review_gate.required_triggers.1=post_review_budget_checkpoint self_review_gate.satisfied_triggers.0=before_external_review self_review_gate.blocks.0=external_review self_review_gate.blocks.1=completion_claim self_review_gate.allowed_next_actions.0=deep_self_review self_review_gate.allowed_next_actions.1=continue_implementation self_review_gate.allowed_next_actions.2=continue_independent_work'
+  '[ "$rc" = 0 ] && json_fields "$out" status=findings selected_client=claude next_action=triage_findings_and_continue_independent_work autonomous_review_budget=1 autonomous_review_index=1 autonomous_review_allowed=false human_decision_required=true review_state=post_review_budget findings_require_implementer_self_review=true self_review_gate.required=true self_review_gate.required_triggers.0=findings_returned self_review_gate.required_triggers.1=post_review_budget_checkpoint self_review_gate.satisfied_triggers.0=before_external_review self_review_gate.blocks.0=external_review self_review_gate.blocks.1=completion_claim self_review_gate.allowed_next_actions.0=deep_self_review self_review_gate.allowed_next_actions.1=continue_implementation self_review_gate.allowed_next_actions.2=continue_independent_work && ! grep -q recurring_findings_design_check <<<"$out"'
 
 reset_case quota passed unavailable
 out="$(run_gate --allow-fallback-egress)"; rc=$?
@@ -2116,7 +2493,7 @@ check "an initial review with challenge capacity requires a tracked Agent chain"
 reset_case passed unavailable unavailable
 out="$(run_gate --stage explore --risk-tag shared-gate --review-plan-file "$WORK/high-risk-plan.json" --review-chain-id high-risk-task --autonomous-review-index 1)"; rc=$?
 check "high-risk tags raise explore to release depth and default one challenge" \
-  '[ "$rc" = 0 ] && json_fields "$out" stage=explore stage_source=caller-declared review_depth=release risk_tags_source=caller-declared challenge_budget=1 challenge_rounds_remaining=1 review_chain_tracked=true review_chain_id=high-risk-task autonomous_review_budget=2 autonomous_review_index=1 autonomous_reviews_remaining=1 autonomous_review_allowed=true next_action=run_challenge completion_gated=true risk_tags.0=shared-gate reviewed_concerns.7=high_risk_boundary self_review_gate.required=false self_review_gate.satisfied_triggers.0=before_external_review self_review_gate.satisfied_triggers.1=risk_or_scope_escalation'
+  '[ "$rc" = 0 ] && json_fields "$out" stage=explore stage_source=caller-declared review_depth=release risk_tags_source=caller-declared challenge_budget=1 challenge_rounds_remaining=1 review_chain_tracked=true review_chain_id=high-risk-task autonomous_review_budget=2 autonomous_review_index=1 autonomous_reviews_remaining=1 autonomous_review_allowed=true next_action=run_challenge completion_gated=true risk_tags.0=shared-gate reviewed_concerns.8=high_risk_boundary self_review_gate.required=false self_review_gate.satisfied_triggers.0=before_external_review self_review_gate.satisfied_triggers.1=risk_or_scope_escalation'
 
 # Release/high-risk normally requires a challenge. The only single-review
 # exception is a candidate-bound deterministic wording-only proof whose result
@@ -2925,7 +3302,7 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
   --wording-only-proof-file "$WORK/wording-punctuation-proof.json")"; rc=$?
 punctuation_proof_hash="$(shasum -a 256 "$WORK/wording-punctuation-proof.json" | awk '{print $1}')"
 check "release wording-only punctuation scope can take one proof-bound review" \
-  '[ "$rc" = 0 ] && json_fields "$out" challenge_budget=0 review_chain_tracked=false wording_only_scope.status=passed wording_only_scope.check_kind=markdown-punctuation-only wording_only_proof_sha256="$punctuation_proof_hash" reviewed_concerns.7=wording_only_boundary'
+  '[ "$rc" = 0 ] && json_fields "$out" challenge_budget=0 review_chain_tracked=false wording_only_scope.status=passed wording_only_scope.check_kind=markdown-punctuation-only wording_only_proof_sha256="$punctuation_proof_hash" reviewed_concerns.8=wording_only_boundary'
 
 reset_case passed unavailable unavailable
 out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.sh" \
@@ -2934,7 +3311,7 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
   --implementer-family openai --review-plan-file "$WORK/review-plan.json" \
   --wording-only-proof-file "$WORK/wording-punctuation-proof.json")"; rc=$?
 check "build wording-only review records the same controller-bound proof" \
-  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build challenge_budget=0 wording_only_scope.check_kind=markdown-punctuation-only reviewed_concerns.5=wording_only_boundary'
+  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build challenge_budget=0 wording_only_scope.check_kind=markdown-punctuation-only reviewed_concerns.6=wording_only_boundary'
 printf '%s\n' "$out" >"$WORK/wording-punctuation-review.json"
 reset_case passed unavailable unavailable
 out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.sh" \
@@ -3010,7 +3387,7 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
   --implementer-family openai --review-plan-file "$WORK/review-plan.json" \
   --wording-only-proof-file "$WORK/wording-token-proof.json")"; rc=$?
 check "build exact typo replacement can take one proof-bound review" \
-  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build challenge_budget=0 wording_only_scope.check_kind=markdown-token-replacement wording_only_scope.old_token=teh wording_only_scope.new_token=the wording_only_scope.expected_count=1 wording_only_scope.replacement_count=1 reviewed_concerns.5=wording_only_boundary'
+  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build challenge_budget=0 wording_only_scope.check_kind=markdown-token-replacement wording_only_scope.old_token=teh wording_only_scope.new_token=the wording_only_scope.expected_count=1 wording_only_scope.replacement_count=1 reviewed_concerns.6=wording_only_boundary'
 
 reset_case passed unavailable unavailable
 out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.sh" \
@@ -3037,7 +3414,7 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
   --implementer-family openai --review-plan-file "$WORK/review-plan.json" \
   --wording-only-proof-file "$WORK/wording-base-proof.json")"; rc=$?
 check "base-mode build wording proof freezes full context from line one" \
-  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build wording_only_scope.check_kind=markdown-token-replacement wording_only_scope.replacement_count=1 reviewed_concerns.5=wording_only_boundary'
+  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build wording_only_scope.check_kind=markdown-token-replacement wording_only_scope.replacement_count=1 reviewed_concerns.6=wording_only_boundary'
 
 for rejected_scope in multi-skill-wording truncated-context-wording symlink-mode-wording frontmatter-shift-insert-wording frontmatter-shift-delete-wording no-final-newline-wording invalid-octal-wording huge-hunk-number-wording zero-width-wording bidi-control-wording emoji-symbol-wording currency-symbol-wording decomposed-boundary-wording zwj-boundary-wording; do
   reset_case passed unavailable unavailable
@@ -3264,6 +3641,13 @@ printf '%s\n' "$passed_round_one" >"$WORK/passed-round-one.json"
 check "a passed first tracked round still owes its challenge before completion" \
   '[ "$passed_round_one_rc" = 0 ] && json_fields "$passed_round_one" status=passed autonomous_review_index=1 autonomous_reviews_remaining=2 autonomous_review_allowed=true next_action=run_challenge completion_gated=true'
 
+# Control leg for the recurrence trigger: same shape, first findings round. Without it a
+# probe that fires for an unrelated reason would read as the recurrence being detected.
+reset_case findings unavailable unavailable
+out="$(run_challenge_gate --challenge-budget 2 --challenge-index 1 --focus passed-prior-findings --review-chain-id passed-task --autonomous-review-index 2 --prior-review-result-file "$WORK/passed-round-one.json")"; rc=$?
+check "findings after a clean prior round stay a first findings round" \
+  '[ "$rc" = 0 ] && json_fields "$out" status=findings self_review_gate.required_triggers.0=findings_returned && ! grep -q recurring_findings_design_check <<<"$out"'
+
 # Chain succession. A fix that touches the owner package moves selected_skills_sha256
 # and ends the chain by design, so the post-fix candidate can never be challenged
 # inside it. Succession opens ONE new chain whose first Agent round is a challenge,
@@ -3287,7 +3671,8 @@ python3 - "$WORK/succ-round-two.json" \
   "$WORK/succ-predecessor-owner-moved.json" \
   "$WORK/succ-predecessor-forged-controller.json" \
   "$WORK/succ-predecessor-foreign-scope.json" \
-  "$WORK/succ-predecessor-forged-terminal.json" <<'PY'
+  "$WORK/succ-predecessor-forged-terminal.json" \
+  "$WORK/succ-predecessor-complete-mode.json" <<'PY'
 import json
 from pathlib import Path
 import sys
@@ -3313,6 +3698,10 @@ forged_terminal["challenge_index"] = 0
 forged_terminal["autonomous_reviews_remaining"] = 1
 forged_terminal["autonomous_review_allowed"] = True
 Path(sys.argv[5]).write_text(json.dumps(forged_terminal, separators=(",", ":")))
+# Neither lane: a completion checkpoint is not a round the succession may carry.
+complete_mode = json.loads(json.dumps(source))
+complete_mode["mode"] = "complete"
+Path(sys.argv[6]).write_text(json.dumps(complete_mode, separators=(",", ":")))
 PY
 
 reset_case passed unavailable unavailable
@@ -3325,15 +3714,53 @@ out="$(run_challenge_gate --focus owner-moved --review-chain-id succ-owner-moved
 check "a succession accepts the owner-package hash move that ended the prior chain" \
   '[ "$rc" = 0 ] && json_fields "$out" mode=challenge predecessor_chain_id=succ-phase-one'
 
+# Budget is one review plus one challenge, so a fix ends the chain and the SECOND
+# findings round usually lands in the SUCCEEDING chain. Counting only in-chain rounds
+# would therefore never see the recurrence the trigger exists for.
+reset_case findings unavailable unavailable
+out="$(run_challenge_gate --focus recurring-findings --review-chain-id succ-recurrence --autonomous-review-index 1 --predecessor-chain-result-file "$WORK/succ-round-two.json")"; rc=$?
+check "findings after a predecessor chain that also returned findings raise the design check" \
+  '[ "$rc" = 0 ] && json_fields "$out" status=findings self_review_gate.required_triggers.0=findings_returned && grep -q recurring_findings_design_check <<<"$out"'
+
 reset_case passed unavailable unavailable
 out="$(run_challenge_gate --focus no-predecessor --review-chain-id succ-orphan --autonomous-review-index 1)"; rc=$?
 check "a tracked challenge cannot open a chain without a predecessor receipt" \
   '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=review_chain_invalid && case "$out" in *"chain succession"*) false;; *) true;; esac'
 
+# A fix applied straight after the REVIEW ends the chain exactly as a fix after the
+# challenge does -- the owner digest moves either way -- so the ended chain's terminal
+# receipt is its review. Requiring a challenge receipt here forced that challenge to be
+# spent on a candidate the author had already decided to change, and bought no evidence
+# about the candidate that lands: the succession challenge covers it either way. What is
+# exempted is exactly one class -- a challenge on a candidate that will never land.
 reset_case passed unavailable unavailable
 out="$(run_challenge_gate --focus review-predecessor --review-chain-id succ-review-predecessor --autonomous-review-index 1 --predecessor-chain-result-file "$WORK/succ-round-one.json")"; rc=$?
-check "a succession rejects a predecessor that is not a challenge receipt" \
-  '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=review_chain_invalid && case "$out" in *"chain succession predecessor is not a tracked challenge receipt"*) true;; *) false;; esac'
+check "a succession may carry a chain whose terminal receipt is its review" \
+  '[ "$rc" = 0 ] && json_fields "$out" mode=challenge review_chain_tracked=true review_chain_id=succ-review-predecessor autonomous_review_index=1 predecessor_chain_id=succ-phase-one'
+
+# The exemption is bounded by the receipt's own arithmetic. This is a FORGERY guard and
+# is asserted as one: the fixture below is a shape the controller never emits, because a
+# genuine round-1 review reads the same whether its chain later ran a challenge or not.
+# A caller who spent the challenge and presents only the review is accepted here -- the
+# stateless controller cannot see omitted history -- so no test claims otherwise.
+python3 - "$WORK/succ-round-one.json" "$WORK/succ-predecessor-spent-review.json" <<'PLAN'
+import json, sys
+from pathlib import Path
+source = json.loads(Path(sys.argv[1]).read_text())
+spent = json.loads(json.dumps(source))
+spent["autonomous_reviews_remaining"] = 0
+spent["autonomous_review_allowed"] = False
+Path(sys.argv[2]).write_text(json.dumps(spent, separators=(",", ":")))
+PLAN
+reset_case passed unavailable unavailable
+out="$(run_challenge_gate --focus spent-review --review-chain-id succ-spent-review --autonomous-review-index 1 --predecessor-chain-result-file "$WORK/succ-predecessor-spent-review.json")"; rc=$?
+check "a succession rejects a forged review receipt whose own arithmetic says its chain is spent" \
+  '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=review_chain_invalid && case "$out" in *"chain succession predecessor is not its chain'"'"'s terminal round"*) true;; *) false;; esac'
+
+reset_case passed unavailable unavailable
+out="$(run_challenge_gate --focus complete-predecessor --review-chain-id succ-complete-predecessor --autonomous-review-index 1 --predecessor-chain-result-file "$WORK/succ-predecessor-complete-mode.json")"; rc=$?
+check "a succession rejects a predecessor that is neither a review nor a challenge round" \
+  '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=review_chain_invalid && case "$out" in *"chain succession predecessor is not a tracked review or challenge receipt"*) true;; *) false;; esac'
 
 # A mid-chain challenge is a live chain, not an ended one: succeeding it would
 # silently retire rounds the wrapper still owes. chain-round-two above is round 2
@@ -4170,6 +4597,11 @@ reset_case findings unavailable unavailable
 out="$(run_challenge_gate --challenge-budget 2 --challenge-index 2 --focus final-findings --review-chain-id long-task --autonomous-review-index 3 --prior-review-result-file "$WORK/chain-round-one.json" --prior-review-result-file "$WORK/chain-round-two.json")"; rc=$?
 check "findings in the last tracked Agent round return to a post-budget checkpoint" \
   '[ "$rc" = 0 ] && json_fields "$out" status=findings review_chain_tracked=true autonomous_review_index=3 autonomous_reviews_remaining=0 autonomous_review_allowed=false human_decision_required=true review_state=post_review_budget findings_require_implementer_self_review=true next_action=triage_findings_and_continue_independent_work self_review_gate.required=true self_review_gate.required_triggers.0=findings_returned self_review_gate.required_triggers.1=post_review_budget_checkpoint self_review_gate.blocks.0=external_review self_review_gate.allowed_next_actions.2=continue_independent_work'
+# Round 1 of this chain also returned findings, so this is the second one: the rule the
+# trigger carries is about the RECURRENCE, and the agent reads it here rather than in a
+# skill it never loads while inside the chain.
+check "a second findings round in one chain raises the design check" \
+  '[ "$rc" = 0 ] && json_fields "$out" self_review_gate.required_triggers.2=recurring_findings_design_check && grep -q decide_keep_delete_narrow_replace <<<"$out"'
 
 reset_case passed unavailable unavailable
 out="$(run_challenge_gate --challenge-budget 2 --challenge-index 1 --focus missing-history --review-chain-id long-task --autonomous-review-index 2)"; rc=$?

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_update_review_plan_intent.sh

@@ -30,15 +30,22 @@ CORE="$TMP/core.txt"
 LATEST="$TMP/latest.txt"
 OLD_INTENT="$TMP/old-intent.txt"
 
-python3 - "$PLAN" "$APPEND" "$CORE" "$LATEST" "$OLD_INTENT" <<'PY'
+python3 - "$PLAN" "$APPEND" "$CORE" "$LATEST" "$OLD_INTENT" "$SCRIPT_DIR" <<'PY'
 import json
 import hashlib
+import subprocess
 import sys
 from pathlib import Path
 
 plan_path, append_path, core_path, latest_path, old_intent_path = map(
-    Path, sys.argv[1:]
+    Path, sys.argv[1:6]
 )
+required_concerns = subprocess.run(
+    [sys.executable, str(Path(sys.argv[6]) / "review_gate.py"),
+     "--print-required-concerns", "--stage", "build"],
+    capture_output=True, text=True, check=True,
+).stdout.split()
+assert required_concerns, "the controller printed no required concerns"
 old = "scope:" + ("x" * (3995 - len("scope:") - len("c27"))) + "c27"
 latest = "latest-round:c28"
 core = old[: 3892 - len("\n\n") - len(latest)]
@@ -55,12 +62,12 @@ plan = {
             "conclusion": conclusion,
             "evidence_refs": ["focused-test"],
         }
+        # Derived, not copied: a fixture holding its own copy of the required set
+        # stops satisfying the gate the moment that set changes, and the runner
+        # aborts at its first failing target so the drift surfaces rounds later.
         for concern, conclusion in (
-            ("correctness", "The focused checks cover the updater's accepted state transitions."),
-            ("safety", "The focused checks cover no-write failures and file integrity boundaries."),
-            ("failure_paths", "The focused checks cover overflow, stale input, and malformed text paths."),
-            ("tests_evidence", "The focused regression fails when bounded update guarantees are removed."),
-            ("compatibility", "The focused checks preserve the plan schema and original file permissions."),
+            (concern, f"The focused updater checks cover {concern} on this fixture.")
+            for concern in required_concerns
         )
     ],
     "evidence": [