@ccoalm/ccl-skills 0.16.0 → 0.18.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_gate.sh

@@ -951,7 +951,8 @@ cat >"$WORK/review-plan.json" <<'JSON'
     {"concern": "tests_evidence", "conclusion": "Focused deterministic contract tests cover the change.", "evidence_refs": ["e1"]},
     {"concern": "compatibility", "conclusion": "Existing provider routing remains backward compatible.", "evidence_refs": ["e1"]},
     {"concern": "rollout_rollback", "conclusion": "The local CLI change has a direct revert path.", "evidence_refs": ["e1"]},
-    {"concern": "observability_operations", "conclusion": "The JSON envelope exposes stage and depth for diagnosis.", "evidence_refs": ["e1"]}
+    {"concern": "observability_operations", "conclusion": "The JSON envelope exposes stage and depth for diagnosis.", "evidence_refs": ["e1"]},
+    {"concern": "claim_strength", "conclusion": "Each claim is scoped to the fixture it was observed on.", "evidence_refs": ["e1"]}
   ],
   "evidence": [
     {"id": "e1", "result": "Deterministic fake-wrapper contract fixture."}
@@ -1033,7 +1034,8 @@ cat >"$WORK/placeholder-plan.json" <<'JSON'
     {"concern": "safety", "conclusion": "Packet and tool boundaries remain fail closed.", "evidence_refs": ["e1"]},
     {"concern": "failure_paths", "conclusion": "Invalid and inconclusive paths remain terminal.", "evidence_refs": ["e1"]},
     {"concern": "tests_evidence", "conclusion": "A focused regression proves filler is rejected.", "evidence_refs": ["e1"]},
-    {"concern": "compatibility", "conclusion": "Existing provider routing remains compatible.", "evidence_refs": ["e1"]}
+    {"concern": "compatibility", "conclusion": "Existing provider routing remains compatible.", "evidence_refs": ["e1"]},
+    {"concern": "claim_strength", "conclusion": "No claim reaches past the filler-rejection fixture.", "evidence_refs": ["e1"]}
   ],
   "evidence": [{"id": "e1", "result": "Deterministic placeholder-validation fixture."}]
 }
@@ -1058,6 +1060,7 @@ cat >"$WORK/high-risk-plan.json" <<'JSON'
     {"concern": "compatibility", "conclusion": "Existing provider routing remains compatible.", "evidence_refs": ["e1"]},
     {"concern": "rollout_rollback", "conclusion": "The local contract change has a direct revert path.", "evidence_refs": ["e1"]},
     {"concern": "observability_operations", "conclusion": "The result exposes depth and risk tags for diagnosis.", "evidence_refs": ["e1"]},
+    {"concern": "claim_strength", "conclusion": "Each claim is scoped to the high-risk fixture it was observed on.", "evidence_refs": ["e1"]},
     {"concern": "high_risk_boundary", "conclusion": "Bypass attempts cannot remove controller-required concerns.", "evidence_refs": ["e1"]}
   ],
   "evidence": [{"id": "e1", "result": "Deterministic high-risk gate fixture."}]
@@ -1081,7 +1084,8 @@ cat >"$WORK/near-limit-plan.json" <<JSON
     {"concern": "safety", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]},
     {"concern": "failure_paths", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]},
     {"concern": "tests_evidence", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]},
-    {"concern": "compatibility", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]}
+    {"concern": "compatibility", "conclusion": "$large_conclusion", "evidence_refs": ["e1"]},
+    {"concern": "claim_strength", "conclusion": "Scoped to this size fixture.", "evidence_refs": ["e1"]}
   ],
   "evidence": [{"id": "e1", "result": "$large_evidence"}]
 }
@@ -1374,6 +1378,144 @@ for malformed_plan in non-string-owner-review-plan empty-owner-review-plan; do
     '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=self_review_incomplete fallback_eligible=false next_action=deep_self_review self_review_gate.required=true'
 done
 
+# The claim-strength walk is a required concern, so it is owed BEFORE round 1 --
+# the one point in a round where correcting an overstated claim costs nothing. The
+# class it covers (absolutes, universals, causal and exhaustiveness claims the cited
+# evidence does not carry) otherwise keeps arriving as a LATE correction, after the
+# receipts are bound, where any candidate edit voids them.
+python3 - "$WORK/review-plan.json" "$WORK/no-claim-strength-review-plan.json" <<'PLAN'
+import json, sys
+from pathlib import Path
+plan = json.loads(Path(sys.argv[1]).read_text())
+plan["self_review"] = [row for row in plan["self_review"] if row["concern"] != "claim_strength"]
+Path(sys.argv[2]).write_text(json.dumps(plan))
+PLAN
+reset_case passed unavailable unavailable
+out="$(run_gate --review-plan-file "$WORK/no-claim-strength-review-plan.json")"; rc=$?
+check "a plan that skips the claim-strength walk fails before any provider runs" \
+  '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=self_review_incomplete fallback_eligible=false next_action=deep_self_review self_review_gate.required=true self_review_gate.required_triggers.0=before_external_review'
+
+reset_case passed unavailable unavailable
+out="$(run_gate --allow-fallback-egress)"; rc=$?
+check "the build reviewer is asked to check claim strength" \
+  '[ "$rc" = 0 ] && json_fields "$out" reviewed_concerns.5=claim_strength'
+
+# The exported list is only worth deriving from if it IS the enforced one. Build a
+# plan covering exactly what the controller prints, and then drop each printed
+# concern in turn: acceptance proves the print covers everything the gate demands,
+# and every single-drop rejection proves nothing printed is decorative. Without
+# both directions a caller could derive from a list that had quietly diverged --
+# which is the drift this export exists to remove.
+# The exit status is asserted too. This suite runs without errexit, so a command
+# substitution silently discards it: a printer that emits the right concerns and then
+# fails would satisfy a non-empty check and report agreement it never reached.
+printed_rc=0
+printed_concerns="$("$DIR/review_gate.sh" --print-required-concerns --stage build)" || printed_rc=$?
+check "the controller can print the concern set a plan owes, and succeeds doing it" \
+  '[ -n "$printed_concerns" ] && [ "$printed_rc" = 0 ]'
+# Proving agreement at ONE depth leaves the other branch free to diverge with every
+# test green -- and release/high-risk is the branch that carries the most concerns.
+# Assert the depth-raising branch answers what the gate itself derives for it.
+# Parity includes what each side REFUSES. A printer that answers for tags the enforcer
+# rejects reintroduces the divergence this export removes: a caller deriving from a
+# malformed tag would get a list where the real round fails closed.
+for bad_tag in "a b" "" "$(printf 'x%.0s' $(seq 81))"; do
+  # rc captured without touching shell options: this suite runs under `set -uo pipefail`
+  # and enabling errexit here would abort every later case at its first non-zero command.
+  bad_tag_rc=0
+  "$DIR/review_gate.sh" --print-required-concerns --stage build --risk-tag "$bad_tag" >/dev/null 2>&1 || bad_tag_rc=$?
+  # Parity is a claim about TWO sides, so both are exercised: asserting only the
+  # printer would keep these checks green if the enforcer's own rejection were
+  # removed, which is the half this pair exists to tie together.
+  enforcer_tag_rc=0
+  run_gate --risk-tag "$bad_tag" >/dev/null 2>&1 || enforcer_tag_rc=$?
+  check "printer and enforcer both refuse the same malformed risk tag (${#bad_tag} chars)" \
+    '[ "$bad_tag_rc" != 0 ] && [ "$enforcer_tag_rc" != 0 ]'
+done
+printed_release_rc=0
+printed_release="$("$DIR/review_gate.sh" --print-required-concerns --stage explore --risk-tag shared-gate)" || printed_release_rc=$?
+check "the raised-depth print succeeds" '[ "$printed_release_rc" = 0 ]'
+# Hoisted for the same reason as the calls above: nested inside the comparison, this
+# printer call's exit status was discarded, so a regression failing only for explicit
+# release depth would have compared equal and passed. Every printer invocation in this
+# suite now has its status asserted.
+printed_plain_release_rc=0
+printed_plain_release="$("$DIR/review_gate.sh" --print-required-concerns --stage release)" || printed_plain_release_rc=$?
+check "the plain release print succeeds" '[ "$printed_plain_release_rc" = 0 ]'
+check "a high-risk tag raises the printed set to release depth and adds the boundary concern" \
+  '[ "$(printf %s "$printed_release" | tr "\n" " ")" = "$(printf "%s\nhigh_risk_boundary" "$printed_plain_release" | tr "\n" " ")" ]'
+python3 - "$WORK/review-plan.json" "$WORK/printed-plan.json" $printed_concerns <<'PLAN'
+import json, sys
+from pathlib import Path
+source = json.loads(Path(sys.argv[1]).read_text())
+printed = sys.argv[3:]
+by_concern = {row["concern"]: row for row in source["self_review"]}
+source["self_review"] = [
+    by_concern.get(concern, {"concern": concern,
+                             "conclusion": f"The fixture covers {concern}.",
+                             "evidence_refs": ["e1"]})
+    for concern in printed
+]
+Path(sys.argv[2]).write_text(json.dumps(source))
+PLAN
+reset_case passed unavailable unavailable
+out="$(run_gate --review-plan-file "$WORK/printed-plan.json" --allow-fallback-egress)"; rc=$?
+check "a plan built from the printed set satisfies the gate" '[ "$rc" = 0 ]'
+printed_drop_failures=0
+for dropped in $printed_concerns; do
+  python3 - "$WORK/printed-plan.json" "$WORK/printed-plan-minus.json" "$dropped" <<'PLAN'
+import json, sys
+from pathlib import Path
+plan = json.loads(Path(sys.argv[1]).read_text())
+plan["self_review"] = [row for row in plan["self_review"] if row["concern"] != sys.argv[3]]
+Path(sys.argv[2]).write_text(json.dumps(plan))
+PLAN
+  reset_case passed unavailable unavailable
+  out="$(run_gate --review-plan-file "$WORK/printed-plan-minus.json")"; rc=$?
+  if [ "$rc" = 2 ] && json_fields "$out" reason_code=self_review_incomplete; then
+    printed_drop_failures=$((printed_drop_failures+1))
+  fi
+done
+check "every printed concern is one the gate actually demands" \
+  '[ "$printed_drop_failures" = "$(printf %s "$printed_concerns" | wc -w | tr -d " ")" ]'
+
+# The same two directions at the OTHER depth. A printer that agreed with the gate at
+# build and diverged at release/high-risk would keep every test above green, and
+# release is the branch carrying the most concerns.
+python3 - "$WORK/high-risk-plan.json" "$WORK/printed-release-plan.json" $printed_release <<'PLAN'
+import json, sys
+from pathlib import Path
+source = json.loads(Path(sys.argv[1]).read_text())
+by_concern = {row["concern"]: row for row in source["self_review"]}
+source["self_review"] = [
+    by_concern.get(concern, {"concern": concern,
+                             "conclusion": f"The high-risk fixture covers {concern}.",
+                             "evidence_refs": ["e1"]})
+    for concern in sys.argv[3:]
+]
+Path(sys.argv[2]).write_text(json.dumps(source))
+PLAN
+reset_case passed unavailable unavailable
+out="$(run_gate --stage explore --risk-tag shared-gate --review-plan-file "$WORK/printed-release-plan.json" --review-chain-id printed-release --autonomous-review-index 1 --allow-fallback-egress)"; rc=$?
+check "a plan built from the printed release set satisfies the raised-depth gate" '[ "$rc" = 0 ]'
+printed_release_drop_failures=0
+for dropped in $printed_release; do
+  python3 - "$WORK/printed-release-plan.json" "$WORK/printed-release-minus.json" "$dropped" <<'PLAN'
+import json, sys
+from pathlib import Path
+plan = json.loads(Path(sys.argv[1]).read_text())
+plan["self_review"] = [row for row in plan["self_review"] if row["concern"] != sys.argv[3]]
+Path(sys.argv[2]).write_text(json.dumps(plan))
+PLAN
+  reset_case passed unavailable unavailable
+  out="$(run_gate --stage explore --risk-tag shared-gate --review-plan-file "$WORK/printed-release-minus.json" --review-chain-id printed-release-minus --autonomous-review-index 1)"; rc=$?
+  if [ "$rc" = 2 ] && json_fields "$out" reason_code=self_review_incomplete; then
+    printed_release_drop_failures=$((printed_release_drop_failures+1))
+  fi
+done
+check "every printed release concern is one the raised-depth gate actually demands" \
+  '[ "$printed_release_drop_failures" = "$(printf %s "$printed_release" | wc -w | tr -d " ")" ]'
+
 owner_lstat_classification="$(python3 - "$DIR/review_gate.py" <<'PY'
 import errno
 import importlib.util
@@ -1679,7 +1821,7 @@ diff_alternate = root / "alternate.patch"
 diff_source.write_bytes(original_diff)
 diff_alternate.write_bytes(alternate_diff)
 with replace_after_symlink_check(diff_source, diff_alternate):
-    packet_path, digest, _candidate, _n, _, _ = review_gate.freeze_packet(
+    packet_path, digest, _candidate, _n, _, _, _ = review_gate.freeze_packet(
         SimpleNamespace(
             cwd=str(root), diff_file=str(diff_source), base=None, paths=[]
         ),
@@ -1776,9 +1918,9 @@ check "diff, prior, and completion inputs are read once from a bounded opened de
 
 # The reviewer's packet and the landing candidate are two objects. A widened
 # packet exists so a reviewer can judge a claim against code outside the diff;
-# the candidate exists so the merge-side binder can recompute what actually
+# the candidate exists so a caller can compare a receipt with what actually
 # lands. Aliasing them made the two mutually exclusive: widening produced a
-# receipt the binder could never match. These assert the split and the one
+# receipt whose candidate no landing could match. These assert the split and the one
 # invariant that replaces the equality -- the candidate appears in the packet
 # verbatim, so nothing lands that its reviewer did not read.
 subject_packet_probe="$(
@@ -1853,7 +1995,7 @@ def expect_refused(label, **kwargs):
 
 
 # The base-derived subject: exactly what the landing binder recomputes.
-subject_path, subject_hash, subject_candidate_hash, subject_n, subject_paths, _ = freeze()
+subject_path, subject_hash, subject_candidate_hash, subject_n, subject_paths, _, _ = freeze()
 subject_bytes = subject_path.read_bytes()
 subject_path.unlink()
 assert subject_hash == digest(subject_bytes)
@@ -1862,7 +2004,7 @@ assert subject_n == len(subject_bytes)
 assert subject_paths == ["landing.txt"], subject_paths
 
 # A7 -- with no --diff-file the two hashes are the same value, as they are today.
-plain_path, plain_packet_hash, plain_candidate_hash, _plain_n, plain_paths, _ = freeze()
+plain_path, plain_packet_hash, plain_candidate_hash, _plain_n, plain_paths, _, _ = freeze()
 plain_path.unlink()
 assert plain_packet_hash == subject_hash
 assert plain_candidate_hash == subject_hash
@@ -1877,7 +2019,7 @@ context = (
 )
 widened = outside / "widened.patch"
 widened.write_bytes(subject_bytes + context)
-wide_path, wide_packet_hash, wide_candidate_hash, wide_n, wide_paths, _ = freeze(
+wide_path, wide_packet_hash, wide_candidate_hash, wide_n, wide_paths, _, _ = freeze(
     diff_file=widened
 )
 try:
@@ -1934,7 +2076,7 @@ expect_refused("an unrelated packet was accepted", diff_file=unrelated)
 
 # A8 -- --diff-file alone keeps today's meaning: no base, so no subject, and
 # the candidate hash stays the packet's own hash.
-alone_path, alone_packet_hash, alone_candidate_hash, _n, _, _ = freeze(
+alone_path, alone_packet_hash, alone_candidate_hash, _n, _, _, _ = freeze(
     diff_file=widened, base_ref=None
 )
 alone_path.unlink()
@@ -2073,7 +2215,7 @@ check "complete but placeholder concern conclusions cannot false-green" \
 reset_case findings unavailable unavailable
 out="$(run_gate --allow-fallback-egress)"; rc=$?
 check "Claude findings remain findings" \
-  '[ "$rc" = 0 ] && json_fields "$out" status=findings selected_client=claude next_action=triage_findings_and_continue_independent_work autonomous_review_budget=1 autonomous_review_index=1 autonomous_review_allowed=false human_decision_required=true review_state=post_review_budget findings_require_implementer_self_review=true self_review_gate.required=true self_review_gate.required_triggers.0=findings_returned self_review_gate.required_triggers.1=post_review_budget_checkpoint self_review_gate.satisfied_triggers.0=before_external_review self_review_gate.blocks.0=external_review self_review_gate.blocks.1=completion_claim self_review_gate.allowed_next_actions.0=deep_self_review self_review_gate.allowed_next_actions.1=continue_implementation self_review_gate.allowed_next_actions.2=continue_independent_work'
+  '[ "$rc" = 0 ] && json_fields "$out" status=findings selected_client=claude next_action=triage_findings_and_continue_independent_work autonomous_review_budget=1 autonomous_review_index=1 autonomous_review_allowed=false human_decision_required=true review_state=post_review_budget findings_require_implementer_self_review=true self_review_gate.required=true self_review_gate.required_triggers.0=findings_returned self_review_gate.required_triggers.1=post_review_budget_checkpoint self_review_gate.satisfied_triggers.0=before_external_review self_review_gate.blocks.0=external_review self_review_gate.blocks.1=completion_claim self_review_gate.allowed_next_actions.0=deep_self_review self_review_gate.allowed_next_actions.1=continue_implementation self_review_gate.allowed_next_actions.2=continue_independent_work && ! grep -q recurring_findings_design_check <<<"$out"'
 
 reset_case quota passed unavailable
 out="$(run_gate --allow-fallback-egress)"; rc=$?
@@ -2351,7 +2493,7 @@ check "an initial review with challenge capacity requires a tracked Agent chain"
 reset_case passed unavailable unavailable
 out="$(run_gate --stage explore --risk-tag shared-gate --review-plan-file "$WORK/high-risk-plan.json" --review-chain-id high-risk-task --autonomous-review-index 1)"; rc=$?
 check "high-risk tags raise explore to release depth and default one challenge" \
-  '[ "$rc" = 0 ] && json_fields "$out" stage=explore stage_source=caller-declared review_depth=release risk_tags_source=caller-declared challenge_budget=1 challenge_rounds_remaining=1 review_chain_tracked=true review_chain_id=high-risk-task autonomous_review_budget=2 autonomous_review_index=1 autonomous_reviews_remaining=1 autonomous_review_allowed=true next_action=run_challenge completion_gated=true risk_tags.0=shared-gate reviewed_concerns.7=high_risk_boundary self_review_gate.required=false self_review_gate.satisfied_triggers.0=before_external_review self_review_gate.satisfied_triggers.1=risk_or_scope_escalation'
+  '[ "$rc" = 0 ] && json_fields "$out" stage=explore stage_source=caller-declared review_depth=release risk_tags_source=caller-declared challenge_budget=1 challenge_rounds_remaining=1 review_chain_tracked=true review_chain_id=high-risk-task autonomous_review_budget=2 autonomous_review_index=1 autonomous_reviews_remaining=1 autonomous_review_allowed=true next_action=run_challenge completion_gated=true risk_tags.0=shared-gate reviewed_concerns.8=high_risk_boundary self_review_gate.required=false self_review_gate.satisfied_triggers.0=before_external_review self_review_gate.satisfied_triggers.1=risk_or_scope_escalation'
 
 # Release/high-risk normally requires a challenge. The only single-review
 # exception is a candidate-bound deterministic wording-only proof whose result
@@ -3160,7 +3302,7 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
   --wording-only-proof-file "$WORK/wording-punctuation-proof.json")"; rc=$?
 punctuation_proof_hash="$(shasum -a 256 "$WORK/wording-punctuation-proof.json" | awk '{print $1}')"
 check "release wording-only punctuation scope can take one proof-bound review" \
-  '[ "$rc" = 0 ] && json_fields "$out" challenge_budget=0 review_chain_tracked=false wording_only_scope.status=passed wording_only_scope.check_kind=markdown-punctuation-only wording_only_proof_sha256="$punctuation_proof_hash" reviewed_concerns.7=wording_only_boundary'
+  '[ "$rc" = 0 ] && json_fields "$out" challenge_budget=0 review_chain_tracked=false wording_only_scope.status=passed wording_only_scope.check_kind=markdown-punctuation-only wording_only_proof_sha256="$punctuation_proof_hash" reviewed_concerns.8=wording_only_boundary'
 
 reset_case passed unavailable unavailable
 out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.sh" \
@@ -3169,7 +3311,7 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
   --implementer-family openai --review-plan-file "$WORK/review-plan.json" \
   --wording-only-proof-file "$WORK/wording-punctuation-proof.json")"; rc=$?
 check "build wording-only review records the same controller-bound proof" \
-  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build challenge_budget=0 wording_only_scope.check_kind=markdown-punctuation-only reviewed_concerns.5=wording_only_boundary'
+  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build challenge_budget=0 wording_only_scope.check_kind=markdown-punctuation-only reviewed_concerns.6=wording_only_boundary'
 printf '%s\n' "$out" >"$WORK/wording-punctuation-review.json"
 reset_case passed unavailable unavailable
 out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.sh" \
@@ -3245,7 +3387,7 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
   --implementer-family openai --review-plan-file "$WORK/review-plan.json" \
   --wording-only-proof-file "$WORK/wording-token-proof.json")"; rc=$?
 check "build exact typo replacement can take one proof-bound review" \
-  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build challenge_budget=0 wording_only_scope.check_kind=markdown-token-replacement wording_only_scope.old_token=teh wording_only_scope.new_token=the wording_only_scope.expected_count=1 wording_only_scope.replacement_count=1 reviewed_concerns.5=wording_only_boundary'
+  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build challenge_budget=0 wording_only_scope.check_kind=markdown-token-replacement wording_only_scope.old_token=teh wording_only_scope.new_token=the wording_only_scope.expected_count=1 wording_only_scope.replacement_count=1 reviewed_concerns.6=wording_only_boundary'
 
 reset_case passed unavailable unavailable
 out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.sh" \
@@ -3272,7 +3414,7 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
   --implementer-family openai --review-plan-file "$WORK/review-plan.json" \
   --wording-only-proof-file "$WORK/wording-base-proof.json")"; rc=$?
 check "base-mode build wording proof freezes full context from line one" \
-  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build wording_only_scope.check_kind=markdown-token-replacement wording_only_scope.replacement_count=1 reviewed_concerns.5=wording_only_boundary'
+  '[ "$rc" = 0 ] && json_fields "$out" review_depth=build wording_only_scope.check_kind=markdown-token-replacement wording_only_scope.replacement_count=1 reviewed_concerns.6=wording_only_boundary'
 
 for rejected_scope in multi-skill-wording truncated-context-wording symlink-mode-wording frontmatter-shift-insert-wording frontmatter-shift-delete-wording no-final-newline-wording invalid-octal-wording huge-hunk-number-wording zero-width-wording bidi-control-wording emoji-symbol-wording currency-symbol-wording decomposed-boundary-wording zwj-boundary-wording; do
   reset_case passed unavailable unavailable
@@ -3499,6 +3641,13 @@ printf '%s\n' "$passed_round_one" >"$WORK/passed-round-one.json"
 check "a passed first tracked round still owes its challenge before completion" \
   '[ "$passed_round_one_rc" = 0 ] && json_fields "$passed_round_one" status=passed autonomous_review_index=1 autonomous_reviews_remaining=2 autonomous_review_allowed=true next_action=run_challenge completion_gated=true'
 
+# Control leg for the recurrence trigger: same shape, first findings round. Without it a
+# probe that fires for an unrelated reason would read as the recurrence being detected.
+reset_case findings unavailable unavailable
+out="$(run_challenge_gate --challenge-budget 2 --challenge-index 1 --focus passed-prior-findings --review-chain-id passed-task --autonomous-review-index 2 --prior-review-result-file "$WORK/passed-round-one.json")"; rc=$?
+check "findings after a clean prior round stay a first findings round" \
+  '[ "$rc" = 0 ] && json_fields "$out" status=findings self_review_gate.required_triggers.0=findings_returned && ! grep -q recurring_findings_design_check <<<"$out"'
+
 # Chain succession. A fix that touches the owner package moves selected_skills_sha256
 # and ends the chain by design, so the post-fix candidate can never be challenged
 # inside it. Succession opens ONE new chain whose first Agent round is a challenge,
@@ -3522,7 +3671,8 @@ python3 - "$WORK/succ-round-two.json" \
   "$WORK/succ-predecessor-owner-moved.json" \
   "$WORK/succ-predecessor-forged-controller.json" \
   "$WORK/succ-predecessor-foreign-scope.json" \
-  "$WORK/succ-predecessor-forged-terminal.json" <<'PY'
+  "$WORK/succ-predecessor-forged-terminal.json" \
+  "$WORK/succ-predecessor-complete-mode.json" <<'PY'
 import json
 from pathlib import Path
 import sys
@@ -3548,6 +3698,10 @@ forged_terminal["challenge_index"] = 0
 forged_terminal["autonomous_reviews_remaining"] = 1
 forged_terminal["autonomous_review_allowed"] = True
 Path(sys.argv[5]).write_text(json.dumps(forged_terminal, separators=(",", ":")))
+# Neither lane: a completion checkpoint is not a round the succession may carry.
+complete_mode = json.loads(json.dumps(source))
+complete_mode["mode"] = "complete"
+Path(sys.argv[6]).write_text(json.dumps(complete_mode, separators=(",", ":")))
 PY
 
 reset_case passed unavailable unavailable
@@ -3560,15 +3714,53 @@ out="$(run_challenge_gate --focus owner-moved --review-chain-id succ-owner-moved
 check "a succession accepts the owner-package hash move that ended the prior chain" \
   '[ "$rc" = 0 ] && json_fields "$out" mode=challenge predecessor_chain_id=succ-phase-one'
 
+# Budget is one review plus one challenge, so a fix ends the chain and the SECOND
+# findings round usually lands in the SUCCEEDING chain. Counting only in-chain rounds
+# would therefore never see the recurrence the trigger exists for.
+reset_case findings unavailable unavailable
+out="$(run_challenge_gate --focus recurring-findings --review-chain-id succ-recurrence --autonomous-review-index 1 --predecessor-chain-result-file "$WORK/succ-round-two.json")"; rc=$?
+check "findings after a predecessor chain that also returned findings raise the design check" \
+  '[ "$rc" = 0 ] && json_fields "$out" status=findings self_review_gate.required_triggers.0=findings_returned && grep -q recurring_findings_design_check <<<"$out"'
+
 reset_case passed unavailable unavailable
 out="$(run_challenge_gate --focus no-predecessor --review-chain-id succ-orphan --autonomous-review-index 1)"; rc=$?
 check "a tracked challenge cannot open a chain without a predecessor receipt" \
   '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=review_chain_invalid && case "$out" in *"chain succession"*) false;; *) true;; esac'
 
+# A fix applied straight after the REVIEW ends the chain exactly as a fix after the
+# challenge does -- the owner digest moves either way -- so the ended chain's terminal
+# receipt is its review. Requiring a challenge receipt here forced that challenge to be
+# spent on a candidate the author had already decided to change, and bought no evidence
+# about the candidate that lands: the succession challenge covers it either way. What is
+# exempted is exactly one class -- a challenge on a candidate that will never land.
 reset_case passed unavailable unavailable
 out="$(run_challenge_gate --focus review-predecessor --review-chain-id succ-review-predecessor --autonomous-review-index 1 --predecessor-chain-result-file "$WORK/succ-round-one.json")"; rc=$?
-check "a succession rejects a predecessor that is not a challenge receipt" \
-  '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=review_chain_invalid && case "$out" in *"chain succession predecessor is not a tracked challenge receipt"*) true;; *) false;; esac'
+check "a succession may carry a chain whose terminal receipt is its review" \
+  '[ "$rc" = 0 ] && json_fields "$out" mode=challenge review_chain_tracked=true review_chain_id=succ-review-predecessor autonomous_review_index=1 predecessor_chain_id=succ-phase-one'
+
+# The exemption is bounded by the receipt's own arithmetic. This is a FORGERY guard and
+# is asserted as one: the fixture below is a shape the controller never emits, because a
+# genuine round-1 review reads the same whether its chain later ran a challenge or not.
+# A caller who spent the challenge and presents only the review is accepted here -- the
+# stateless controller cannot see omitted history -- so no test claims otherwise.
+python3 - "$WORK/succ-round-one.json" "$WORK/succ-predecessor-spent-review.json" <<'PLAN'
+import json, sys
+from pathlib import Path
+source = json.loads(Path(sys.argv[1]).read_text())
+spent = json.loads(json.dumps(source))
+spent["autonomous_reviews_remaining"] = 0
+spent["autonomous_review_allowed"] = False
+Path(sys.argv[2]).write_text(json.dumps(spent, separators=(",", ":")))
+PLAN
+reset_case passed unavailable unavailable
+out="$(run_challenge_gate --focus spent-review --review-chain-id succ-spent-review --autonomous-review-index 1 --predecessor-chain-result-file "$WORK/succ-predecessor-spent-review.json")"; rc=$?
+check "a succession rejects a forged review receipt whose own arithmetic says its chain is spent" \
+  '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=review_chain_invalid && case "$out" in *"chain succession predecessor is not its chain'"'"'s terminal round"*) true;; *) false;; esac'
+
+reset_case passed unavailable unavailable
+out="$(run_challenge_gate --focus complete-predecessor --review-chain-id succ-complete-predecessor --autonomous-review-index 1 --predecessor-chain-result-file "$WORK/succ-predecessor-complete-mode.json")"; rc=$?
+check "a succession rejects a predecessor that is neither a review nor a challenge round" \
+  '[ "$rc" = 2 ] && [ ! -e "$WORK/state/client_sequence" ] && json_fields "$out" reason_code=review_chain_invalid && case "$out" in *"chain succession predecessor is not a tracked review or challenge receipt"*) true;; *) false;; esac'
 
 # A mid-chain challenge is a live chain, not an ended one: succeeding it would
 # silently retire rounds the wrapper still owes. chain-round-two above is round 2
@@ -4167,6 +4359,11 @@ post_deadline_ok" ]'
 check "the staged contract declares the current result schema" \
   'grep -q "current result envelope is schema 3" "$DIR/../references/staged-review-contract.md"'
 
+# The merge-side ledger binder was retired; a contract that still says a script
+# recomputes the candidate at merge time promises a check nothing performs.
+check "the staged contract promises no retired merge-side binder" \
+  '! grep -q "review_ledger_binding" "$DIR/../references/staged-review-contract.md"'
+
 reset_case passed unavailable unavailable
 out="$(run_gate --timeout 600 --total-timeout 90)"; rc=$?
 claude_timeout="$(cat "$WORK/state/claude_timeout" 2>/dev/null || true)"
@@ -4405,6 +4602,11 @@ reset_case findings unavailable unavailable
 out="$(run_challenge_gate --challenge-budget 2 --challenge-index 2 --focus final-findings --review-chain-id long-task --autonomous-review-index 3 --prior-review-result-file "$WORK/chain-round-one.json" --prior-review-result-file "$WORK/chain-round-two.json")"; rc=$?
 check "findings in the last tracked Agent round return to a post-budget checkpoint" \
   '[ "$rc" = 0 ] && json_fields "$out" status=findings review_chain_tracked=true autonomous_review_index=3 autonomous_reviews_remaining=0 autonomous_review_allowed=false human_decision_required=true review_state=post_review_budget findings_require_implementer_self_review=true next_action=triage_findings_and_continue_independent_work self_review_gate.required=true self_review_gate.required_triggers.0=findings_returned self_review_gate.required_triggers.1=post_review_budget_checkpoint self_review_gate.blocks.0=external_review self_review_gate.allowed_next_actions.2=continue_independent_work'
+# Round 1 of this chain also returned findings, so this is the second one: the rule the
+# trigger carries is about the RECURRENCE, and the agent reads it here rather than in a
+# skill it never loads while inside the chain.
+check "a second findings round in one chain raises the design check" \
+  '[ "$rc" = 0 ] && json_fields "$out" self_review_gate.required_triggers.2=recurring_findings_design_check && grep -q decide_keep_delete_narrow_replace <<<"$out"'
 
 reset_case passed unavailable unavailable
 out="$(run_challenge_gate --challenge-budget 2 --challenge-index 1 --focus missing-history --review-chain-id long-task --autonomous-review-index 2)"; rc=$?
@@ -4540,6 +4742,224 @@ out="$(run_base_gate --allow-fallback-egress)"; rc=$?
 check "base packet freezes tracked and untracked changes once" \
   '[ "$rc" = 0 ] && grep -q tracked.txt "$WORK/state/claude_packet" && grep -q untracked.txt "$WORK/state/claude_packet" && grep -q "Untracked files" "$WORK/state/claude_packet"'
 
+# A review quotes the repository's own contract files after the candidate: the
+# tracked AGENTS.override.md-or-AGENTS.md, CLAUDE.md and .claude/CLAUDE.md of
+# every directory from the root down to a changed path, root first. Untracked
+# and CLAUDE.local.md files are personal and never quoted; a file off every
+# changed path is not quoted; a linked file is omitted, not followed.
+contract_repo="$WORK/contract-repo"
+rm -rf "$contract_repo"
+mkdir -p "$contract_repo/sub/deep" "$contract_repo/other" "$contract_repo/.claude" \
+  "$contract_repo/linked" "$contract_repo/big"
+(
+  cd "$contract_repo"
+  git init -q
+  git config user.email test@example.invalid
+  git config user.name 'Test User'
+  printf 'root agents rule\n' >AGENTS.md
+  printf 'root claude rule\n' >.claude/CLAUDE.md
+  printf 'personal note must not egress\n' >CLAUDE.local.md
+  printf 'sub override rule\n' >sub/AGENTS.override.md
+  printf 'sub shadowed rule\n' >sub/AGENTS.md
+  printf 'sub claude rule\n' >sub/CLAUDE.md
+  printf 'other rule\n' >other/AGENTS.md
+  ln -s ../AGENTS.md linked/AGENTS.md
+  python3 -c 'print("x" * 40000)' >big/AGENTS.md
+  for dir in sub/deep other linked big; do printf 'before\n' >"$dir/code.txt"; done
+  printf 'before\n' >.claude/notes.txt
+  git add -A
+  git commit -q -m initial
+  printf 'untracked rule\n' >sub/deep/CLAUDE.md
+  printf 'after\n' >sub/deep/code.txt
+)
+run_contract_gate() {
+  REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.sh" \
+    --cwd "$contract_repo" --base HEAD --implementer-family openai \
+    --review-plan-file "$WORK/review-plan.json" --allow-fallback-egress "$@"
+}
+contract_packet_check() { # <result json> <expected quoted paths, comma-joined> <coverage>
+  JSON_PAYLOAD="$1" python3 - "$WORK/state/claude_packet" "$WORK/state/claude_profile" "$2" "$3" <<'PY' 2>&1
+import hashlib, json, os, re, sys
+result = json.loads(os.environ["JSON_PAYLOAD"])
+packet = open(sys.argv[1], "rb").read()
+profile = json.load(open(sys.argv[2], encoding="utf-8"))
+expected = [item for item in sys.argv[3].split(",") if item]
+quoted = re.findall(rb"^CCL_REPOSITORY_CONTRACT_[0-9a-f]{24}_BEGIN (.+)$", packet, re.M)
+assert [item.decode() for item in quoted] == expected, quoted
+assert b"personal note must not egress" not in packet
+assert hashlib.sha256(packet[: profile["candidate_bytes"]]).hexdigest() == result["candidate_sha256"]
+assert result["packet_sha256"] != result["candidate_sha256"]
+assert b"CCL_REPOSITORY_CONTRACT_" not in packet[: profile["candidate_bytes"]]
+concerns = [item["id"] for item in profile["required_concerns"]]
+assert "repository_contract" in concerns, concerns
+contract = result["repository_contract"]
+assert contract["coverage"] == sys.argv[4], contract
+assert [item["path"] for item in contract["files"]] == expected, contract
+print("contract_packet_ok")
+PY
+}
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode review)"; rc=$?
+check "review quotes the tracked contract files governing the changed path, root first" \
+  '[ "$rc" = 0 ] && contract_packet_check "$out" "AGENTS.md,.claude/CLAUDE.md,sub/AGENTS.override.md,sub/CLAUDE.md" complete | grep -qx contract_packet_ok'
+
+printf 'after\n' >"$contract_repo/linked/code.txt"
+printf 'after\n' >"$contract_repo/big/code.txt"
+# A change under .claude/ reaches .claude/CLAUDE.md twice (root and .claude/);
+# the expected list below admits it once.
+printf 'after\n' >"$contract_repo/.claude/notes.txt"
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode review)"; rc=$?
+check "a linked or oversized contract file is omitted and reported, never followed or failed on" \
+  '[ "$rc" = 0 ] && contract_packet_check "$out" "AGENTS.md,.claude/CLAUDE.md,sub/AGENTS.override.md,sub/CLAUDE.md" partial | grep -qx contract_packet_ok && json_fields "$out" repository_contract.omitted.0.path=big/AGENTS.md repository_contract.omitted.0.reason=size_budget repository_contract.omitted.1.path=linked/AGENTS.md repository_contract.omitted.1.reason=unreadable'
+
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode challenge --challenge-budget 1 --challenge-index 1 --focus "contract rules")"; rc=$?
+check "a challenge keeps its focus: no contract section and no contract concern" \
+  '[ "$rc" = 0 ] && ! grep -q CCL_REPOSITORY_CONTRACT_ "$WORK/state/claude_packet" && python3 -c "import json,sys; p=json.load(open(sys.argv[1])); assert p[\"repository_contract\"] is None and all(c[\"id\"] != \"repository_contract\" for c in p[\"required_concerns\"])" "$WORK/state/claude_profile" && json_fields "$out" repository_contract=None'
+
+receipt_file="$contract_repo/.git/ccl-code-review/last-review.json"
+check "a conclusive run leaves a local receipt of the HEAD it reviewed, outside the tree" \
+  '[ "$rc" = 0 ] && [ -f "$receipt_file" ] && [ "$(jq -r .head "$receipt_file")" = "$(git -C "$contract_repo" rev-parse HEAD)" ] && [ "$(jq -r .worktree_clean "$receipt_file")" = false ] && [ "$(jq -r .mode "$receipt_file")" = challenge ]'
+
+cp "$receipt_file" "$WORK/receipt-before"
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode challenge --challenge-budget 1 --challenge-index 1)"; rc=$?
+check "an inconclusive run leaves the last receipt untouched" \
+  '[ "$rc" = 2 ] && cmp -s "$receipt_file" "$WORK/receipt-before"'
+
+# The receipt directory swapped for a link: the write is refused, never followed.
+mkdir -p "$WORK/receipt-target"
+rm -rf "$contract_repo/.git/ccl-code-review"
+ln -s "$WORK/receipt-target" "$contract_repo/.git/ccl-code-review"
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode challenge --challenge-budget 1 --challenge-index 1 --focus "contract rules")"; rc=$?
+check "a linked receipt directory is never written through" \
+  '[ "$rc" = 0 ] && [ -L "$contract_repo/.git/ccl-code-review" ] && [ -z "$(ls -A "$WORK/receipt-target")" ]'
+rm -f "$contract_repo/.git/ccl-code-review"
+
+anchor_out="$(PYTHONPATH="$WORK/harness/scripts" python3 - <<'PY' 2>&1
+import review_gate
+a = {"git_dir": "/g", "head": "a" * 40, "worktree_clean": True}
+b = dict(a, head="b" * 40)
+c = dict(a, worktree_clean=False)
+assert review_gate.stable_review_anchor(a, dict(a)) == a
+assert review_gate.stable_review_anchor(a, b) is None
+assert review_gate.stable_review_anchor(a, c) is None
+assert review_gate.stable_review_anchor(None, a) is None
+print("anchor_stability_ok")
+PY
+)"
+check "a freeze that straddles a HEAD or cleanliness change records nothing" \
+  '[ "$anchor_out" = anchor_stability_ok ]'
+
+# A bare --diff-file packet may cover less than HEAD, so it records no receipt.
+git -C "$contract_repo" diff HEAD >"$WORK/contract.patch"
+rm -rf "$contract_repo/.git/ccl-code-review"
+reset_case passed unavailable unavailable
+out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.sh" \
+  --mode review --cwd "$contract_repo" --diff-file "$WORK/contract.patch" --implementer-family openai \
+  --review-plan-file "$WORK/review-plan.json" --allow-fallback-egress)"; rc=$?
+check "a bare --diff-file review records no receipt" \
+  '[ "$rc" = 0 ] && json_fields "$out" status=passed && [ ! -e "$contract_repo/.git/ccl-code-review" ]'
+
+swap_out="$(PYTHONPATH="$WORK/harness/scripts" python3 - "$WORK" <<'PY' 2>&1
+import os, sys, review_gate
+root = os.path.realpath(os.path.join(sys.argv[1], "gitdir-swap"))
+os.makedirs(root)
+def anchor_for(path):
+    st = os.stat(path)
+    return {"git_dir": path, "git_dir_identity": [st.st_dev, st.st_ino], "head": "a" * 40, "worktree_clean": True}
+def receipt_under(path):
+    return os.path.exists(os.path.join(path, "ccl-code-review", "last-review.json"))
+result = {"mode": "review", "status": "passed"}
+# A different directory swapped in under the anchored path.
+git_dir, other = os.path.join(root, "gitdir"), os.path.join(root, "other")
+os.mkdir(git_dir)
+anchor = anchor_for(git_dir)
+os.rename(git_dir, os.path.join(root, "moved"))
+os.mkdir(other)
+os.symlink(other, git_dir)
+review_gate.record_local_review(anchor, result)
+assert not receipt_under(other), "wrote through a swapped git directory"
+# The same directory relocated into a tree, its old path now a link to it.
+original = os.path.join(root, "original")
+os.mkdir(original)
+anchor = anchor_for(original)
+tree = os.path.join(root, "worktree")
+os.mkdir(tree)
+os.rename(original, os.path.join(tree, "relocated"))
+os.symlink(os.path.join(tree, "relocated"), original)
+review_gate.record_local_review(anchor, result)
+assert not receipt_under(os.path.join(tree, "relocated")), "followed a link to the relocated git directory"
+# A parent component swapped for a link while the directory keeps its inode.
+parent = os.path.join(root, "parent")
+os.makedirs(os.path.join(parent, "gd"))
+anchor = anchor_for(os.path.join(parent, "gd"))
+os.rename(parent, os.path.join(root, "parent-moved"))
+os.symlink(os.path.join(root, "parent-moved"), parent)
+review_gate.record_local_review(anchor, result)
+assert not receipt_under(os.path.join(root, "parent-moved", "gd")), "followed a linked parent"
+# Control: an unchanged directory is written.
+control = os.path.join(root, "control")
+os.mkdir(control)
+review_gate.record_local_review(anchor_for(control), result)
+assert receipt_under(control), "control write missing"
+print("gitdir_swap_ok")
+PY
+)"
+check "a git directory swapped during the review is never written into" \
+  '[ "$swap_out" = gitdir_swap_ok ]'
+
+# Repeated failed rooted reads (a linked ancestor, a missing file) must not
+# leave directory descriptors behind: every omitted contract file is one.
+fd_out="$(PYTHONPATH="$WORK/harness/scripts" python3 - "$WORK" <<'PY' 2>&1
+import os, sys, review_gate
+root = os.path.realpath(os.path.join(sys.argv[1], "fd-leak"))
+os.makedirs(os.path.join(root, "a", "b"))
+os.makedirs(os.path.join(root, "target"))
+os.symlink(os.path.join(root, "target"), os.path.join(root, "a", "linked"))
+def attempt(relative):
+    try:
+        review_gate.read_bounded_regular_file(relative, root=root, label="probe", maximum=10,
+                                              regular_error="irregular", oversized_error="big")
+    except review_gate.GateError:
+        pass
+before = len(os.listdir("/dev/fd"))
+for _ in range(50):
+    attempt("a/b/missing.md")
+    attempt("a/linked/AGENTS.md")
+after = len(os.listdir("/dev/fd"))
+assert after == before, (before, after)
+print("fd_release_ok")
+PY
+)"
+check "failed rooted reads release every directory descriptor" \
+  '[ "$fd_out" = fd_release_ok ]'
+
+# A tracked contract file whose ancestor became a link is omitted, and the
+# linked target's text never reaches the packet.
+(
+  cd "$contract_repo"
+  git add -A && git commit -q -m "settle earlier cases"
+  mkdir anc hl && printf 'anc rule\n' >anc/AGENTS.md && printf 'before\n' >anc/code.txt
+  printf 'hl rule\n' >hl/AGENTS.md && printf 'before\n' >hl/code.txt
+  git add -A && git commit -q -m "add anc"
+  ln hl/AGENTS.md "$WORK/hl-second-name.md" && printf 'after\n' >hl/code.txt
+  mkdir -p "$WORK/outside-anc" && printf 'outside secret rule\n' >"$WORK/outside-anc/AGENTS.md"
+  printf 'after\n' >"$WORK/outside-anc/code.txt"
+  rm -rf anc && ln -s "$WORK/outside-anc" anc
+)
+# Base mode refuses an untracked link as a candidate outright, so the transient
+# state is reached through a --diff-file packet that names the anc/ paths.
+git -C "$contract_repo" diff HEAD -- anc hl >"$WORK/anc.patch"
+reset_case passed unavailable unavailable
+out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.sh" \
+  --mode review --cwd "$contract_repo" --diff-file "$WORK/anc.patch" --implementer-family openai \
+  --review-plan-file "$WORK/review-plan.json" --allow-fallback-egress)"; rc=$?
+check "a contract file behind a linked ancestor or with a second hard link is omitted and never quoted" \
+  '[ "$rc" = 0 ] && ! grep -q "outside secret rule" "$WORK/state/claude_packet" && printf "%s" "$out" | python3 -c "import json,sys; d=json.load(sys.stdin)[\"repository_contract\"]; assert {\"path\": \"anc/AGENTS.md\", \"reason\": \"unreadable\"} in d[\"omitted\"] and {\"path\": \"hl/AGENTS.md\", \"reason\": \"unreadable\"} in d[\"omitted\"], d" && ! grep -q "hl rule" "$WORK/state/claude_packet"'
+
 # The explicit cwd is the only repository identity. Ambient Git variables must
 # not redirect discovery, objects, refs, index, or worktree to a clean decoy.
 git clone -q "$WORK/repo" "$WORK/git-env-decoy"