@ccoalm/ccl-skills 0.18.1 → 0.18.2

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_guard_delegation_owner.sh

@@ -3,13 +3,13 @@
 #
 # Mutation-resistant by construction: an earlier version of this suite passed
 # 13/13 against five separately broken hooks, so every probe now pins the full
-# observable contract, not just "did the word ask appear":
+# observable contract, not just "did the word deny appear":
 #   - exit status is always 0 (a PreToolUse hook must never fail the tool call)
 #   - stdout is either empty or a single valid JSON object of the exact shape
 #   - quiet means ZERO bytes on stdout, so a "deny" mutant cannot read as quiet
 #   - stderr is always empty (the transcript may hold prompt payloads or secrets)
 #   - each probe runs in its own TMPDIR, so one probe cannot satisfy another
-#   - only the VERIFIED-loaded state is cached; the ask is stateless by design
+#   - one atomic repair attempt is capped; it never represents a verified load
 # Registered in the Makefile `test` target and GitHub Actions; requires jq.
 set -u
 
@@ -50,7 +50,7 @@ run() {
   RUN_TD="$td"
   MARKERS_BEFORE=$(markers_in "$td")
   jq -nc --arg t "$tool" --arg p "$tr" --arg s "$sess" \
-        '{tool_name:$t,transcript_path:$p,session_id:$s,cwd:"/tmp"}' \
+        '{hook_event_name:"PreToolUse",tool_name:$t,transcript_path:$p,session_id:$s,cwd:"/tmp"}' \
         | TMPDIR="$td" bash "$HOOK" >"$so" 2>"$eo"
   RC=$?
   OUT=$(cat "$so" 2>/dev/null)
@@ -74,12 +74,12 @@ assert_universal() { # assert_universal <label>
   fi
 }
 
-assert_ask() { # assert_ask <label> <case-tmpdir>
+assert_deny() { # assert_deny <label> <case-tmpdir>
   local label="$1" td="$2" d
   assert_universal "$label"
-  [ -n "$OUT" ] || { note "$label: expected an ask, got no output"; return; }
+  [ -n "$OUT" ] || { note "$label: expected a deny, got no output"; return; }
   d=$(printf '%s' "$OUT" | jq -r '.hookSpecificOutput.permissionDecision // empty' 2>/dev/null)
-  [ "$d" = ask ] || { note "$label: permissionDecision=$d, expected ask"; return; }
+  [ "$d" = deny ] || { note "$label: permissionDecision=$d, expected deny"; return; }
   [ "$(printf '%s' "$OUT" | jq -r '.hookSpecificOutput.hookEventName // empty')" = PreToolUse ] \
     || note "$label: wrong or missing hookEventName"
   [ -n "$(printf '%s' "$OUT" | jq -r '.hookSpecificOutput.permissionDecisionReason // empty')" ] \
@@ -90,12 +90,6 @@ assert_ask() { # assert_ask <label> <case-tmpdir>
   [ "$(printf '%s' "$OUT" | jq -r '.hookSpecificOutput|keys|sort|join(",")')" \
     = "hookEventName,permissionDecision,permissionDecisionReason" ] \
     || note "$label: unexpected hookSpecificOutput keys"
-  # The ask is intentionally STATELESS: this ask must add NO new marker, or a
-  # fan-out's siblings slip through and a denial silences the rest of the session.
-  # Counted as a delta, not an existence check — an unrelated warm session in the
-  # same TMPDIR may legitimately have left one already.
-  [ "$(markers_in "$td")" -eq "${MARKERS_BEFORE:-0}" ] \
-    || note "$label: asking created a verified marker (would suppress later asks)"
   ok
 }
 
@@ -108,13 +102,23 @@ assert_quiet() { # assert_quiet <label>
   ok
 }
 
+assert_diagnostic() {
+  local label="$1"
+  assert_universal "$label"
+  [ -n "$(printf '%s' "$OUT" | jq -r '.systemMessage // empty')" ] \
+    || note "$label: unavailable evidence needs a static diagnostic"
+  [ -z "$(printf '%s' "$OUT" | jq -r '.hookSpecificOutput.permissionDecision // empty')" ] \
+    || note "$label: unavailable evidence must not produce a permission decision"
+  ok
+}
+
 case_dir() { local d="$ROOT/$1"; mkdir -p "$d"; printf '%s' "$d"; }
 
-# --- RED baseline: dispatch with the delegation owner never invoked -> ask ----
+# --- RED baseline: dispatch with the delegation owner never invoked -> bounded deny ----
 for tool in Task Agent; do
   td=$(case_dir "cold-$tool"); mk_transcript "$td/t.jsonl" cold
   run "$td" "$tool" "$td/t.jsonl" "s-$tool"
-  assert_ask "cold dispatch via $tool" "$td"
+  assert_deny "cold dispatch via $tool" "$td"
 done
 
 # --- GREEN: owner already invoked this session -> silent -------------------
@@ -122,50 +126,49 @@ td=$(case_dir warm); mk_transcript "$td/t.jsonl" warm
 run "$td" Task "$td/t.jsonl" s-warm
 assert_quiet "owner already invoked"
 
-# --- a cold session keeps asking: nothing about the ASK is cached ----------
-# Caching "already asked" inverted the gate twice (fan-out siblings sailed
-# through; a denial silenced the rest of the session), so every cold dispatch
-# must ask. Loading the owner is the only thing that stops the prompting.
+# --- one bounded repair attempt, then quiet on a blind retry ---------------
 td=$(case_dir repeat); mk_transcript "$td/t.jsonl" cold
-for n in 1 2 3; do
+run "$td" Task "$td/t.jsonl" s-rep
+assert_deny "first cold dispatch" "$td"
+for n in 2 3; do
   run "$td" Task "$td/t.jsonl" s-rep
-  assert_ask "cold dispatch #$n in the same session" "$td"
+  assert_quiet "bounded cold retry #$n"
 done
 
-# --- fan-out: every concurrent sibling is gated, not just the first --------
+# --- fan-out: exactly one replan; siblings can proceed (documented limit) ---
 # Each sibling captures into its OWN directory. Sharing one .stdout across the
-# five subprocesses made the observation itself racy: a regression that cached
-# the ask would let one process ask and four exit quietly, yet all five reads
-# could pick up the single ask and report a false 5/5.
+# five subprocesses would make the observation itself racy: each worker must
+# retain its own output while sharing one actor/context attempt cap.
 td=$(case_dir fanout); mk_transcript "$td/t.jsonl" cold
 for i in 1 2 3 4 5; do
   mkdir -p "$td/w$i"
   # ONE shared transcript path and one session id, as in a real fan-out: the
-  # cache key includes transcript_path, so giving each worker its own copy would
-  # hand them five different keys and a cached-ask regression would still show
-  # 5/5. Only the capture files are per-worker.
-  ( jq -nc --arg p "$td/t.jsonl" '{tool_name:"Task",transcript_path:$p,session_id:"s-fan",cwd:"/tmp"}' \
+  # state key includes transcript_path, so copies would create five different
+  # caps. Only the capture files are per-worker.
+  ( jq -nc --arg p "$td/t.jsonl" '{hook_event_name:"PreToolUse",tool_name:"Task",transcript_path:$p,session_id:"s-fan",cwd:"/tmp"}' \
       | TMPDIR="$td" bash "$HOOK" > "$td/w$i/out" 2>"$td/w$i/err" ) &
 done
 wait
 asked=0
 for i in 1 2 3 4 5; do
-  [ "$(jq -r '.hookSpecificOutput.permissionDecision // empty' < "$td/w$i/out" 2>/dev/null)" = ask ] \
+  [ "$(jq -r '.hookSpecificOutput.permissionDecision // empty' < "$td/w$i/out" 2>/dev/null)" = deny ] \
     && asked=$((asked+1))
   [ -s "$td/w$i/err" ] && note "fan-out worker $i wrote to stderr"
 done
-[ "$asked" -eq 5 ] || note "fan-out: only $asked/5 concurrent dispatches were gated"
-[ "$asked" -eq 5 ] && ok
+[ "$asked" -eq 1 ] || note "fan-out: expected one bounded repair, got $asked/5"
+[ "$asked" -eq 1 ] && ok
 
-# --- the verified-loaded state IS cached, and only that state --------------
+# --- completed loads are re-read; no lifetime verified shortcut ------------
 td=$(case_dir verified); mk_transcript "$td/t.jsonl" warm
 run "$td" Task "$td/t.jsonl" s-ver
 assert_quiet "warm dispatch stays quiet"
-ls "$td" 2>/dev/null | grep -q '^delegation-owner-loaded-' \
-  && ok || note "warm dispatch did not record the verified marker"
-# with the marker present the transcript is not needed at all
+if python3 -c 'import pathlib,sys; sys.exit(bool(list(pathlib.Path(sys.argv[1]).glob("ccl-skill-loading-*/*/*"))))' "$td"; then
+  ok
+else
+  note "warm dispatch created a verification or attempt marker"
+fi
 run "$td" Task "$td/gone.jsonl" s-ver
-assert_quiet "verified session skips the transcript scan"
+assert_diagnostic "missing transcript stays unverified"
 
 # --- only a real Skill tool-use event counts (spoof resistance) ------------
 # Each spoof carries the skill NAME in a non-invocation position. The last two
@@ -188,13 +191,13 @@ spoof_line() {
 # denied, or failed when the hook runs.
 td=$(case_dir requested); mk_transcript "$td/t.jsonl" requested
 run "$td" Task "$td/t.jsonl" s-req
-assert_ask "Skill requested but never completed" "$td"
+assert_deny "Skill requested but never completed" "$td"
 
 # A result belonging to a DIFFERENT call must not vouch for this one.
 td=$(case_dir mismatch); mk_transcript "$td/t.jsonl" requested
 printf '%s\n' '{"type":"user","message":{"content":[{"type":"tool_result","tool_use_id":"toolu_unrelated","content":"Launching skill: ccl-skills:multi-agent-delegation"}]}}' >> "$td/t.jsonl"
 run "$td" Task "$td/t.jsonl" s-mis
-assert_ask "unrelated tool_result does not complete the load" "$td"
+assert_deny "unrelated tool_result does not complete the load" "$td"
 
 # The canonical ccl-scoped id is required; a bare basename could be another
 # locally installed skill.
@@ -202,13 +205,13 @@ td=$(case_dir bare)
 printf '%s\n' '{"type":"assistant","message":{"content":[{"type":"tool_use","id":"toolu_b","name":"Skill","input":{"skill":"multi-agent-delegation"}}]}}' > "$td/t.jsonl"
 printf '%s\n' '{"type":"user","message":{"content":[{"type":"tool_result","tool_use_id":"toolu_b","content":"Launching skill: multi-agent-delegation"}]}}' >> "$td/t.jsonl"
 run "$td" Task "$td/t.jsonl" s-bare
-assert_ask "bare skill basename is not the CCL owner" "$td"
+assert_deny "bare skill basename is not the CCL owner" "$td"
 
 for s in prose quoted other userside nested; do
   td=$(case_dir "spoof-$s"); mk_transcript "$td/t.jsonl" cold
   spoof_line "$s" >> "$td/t.jsonl"
   run "$td" Task "$td/t.jsonl" "s-spoof-$s"
-  assert_ask "spoof/$s is not a Skill invocation" "$td"
+  assert_deny "spoof/$s is not a Skill invocation" "$td"
 done
 
 # --- one session must never vouch for another via a colliding cache key ----
@@ -220,14 +223,17 @@ mk_transcript "$td/cold.jsonl" cold
 run "$td" Task "$td/warm.jsonl" 'teama'
 assert_quiet "colliding-key: warm session is quiet"
 run "$td" Task "$td/cold.jsonl" 'team/a'
-assert_ask "colliding-key: cold session still asks" "$td"
+assert_deny "colliding-key: cold session still replans" "$td"
 
 # --- a session with no usable id gets no shared cache bucket ---------------
 td=$(case_dir nosession); mk_transcript "$td/t.jsonl" warm
 run "$td" Task "$td/t.jsonl" ''
-assert_quiet "warm dispatch without session_id"
-ls "$td" 2>/dev/null | grep -q '^delegation-owner-loaded-' \
-  && note "an id-less session wrote a shared cache marker" || ok
+assert_diagnostic "warm dispatch without session_id"
+if python3 -c 'import pathlib,sys; sys.exit(bool(list(pathlib.Path(sys.argv[1]).glob("ccl-skill-loading-*"))))' "$td"; then
+  ok
+else
+  note "an id-less session created shared state"
+fi
 
 # --- non-dispatch tools never fire -----------------------------------------
 for tool in Edit Bash Read; do
@@ -239,9 +245,9 @@ done
 # --- fail-open: absent, unreadable, or non-regular transcript --------------
 td=$(case_dir missing); mk_transcript "$td/t.jsonl" cold
 run "$td" Task "$td/nope.jsonl" s-miss
-assert_quiet "missing transcript"
+assert_diagnostic "missing transcript"
 run "$td" Task "" s-empty
-assert_quiet "empty transcript path"
+assert_diagnostic "empty transcript path"
 
 # a FIFO must not hang the hook. Needs both mkfifo and a timeout command; on a
 # platform lacking either, skip rather than fail on a missing tool (finding: an
@@ -250,7 +256,7 @@ td=$(case_dir fifo)
 TIMEOUT_BIN=""
 for c in timeout gtimeout; do command -v "$c" >/dev/null 2>&1 && { TIMEOUT_BIN="$c"; break; }; done
 if [ -n "$TIMEOUT_BIN" ] && mkfifo "$td/pipe" 2>/dev/null; then
-  jq -nc --arg p "$td/pipe" '{tool_name:"Task",transcript_path:$p,session_id:"s-fifo",cwd:"/tmp"}' \
+  jq -nc --arg p "$td/pipe" '{hook_event_name:"PreToolUse",tool_name:"Task",transcript_path:$p,session_id:"s-fifo",cwd:"/tmp"}' \
         | TMPDIR="$td" "$TIMEOUT_BIN" 5 bash "$HOOK" >"$td/.stdout" 2>"$td/.stderr"
   RC=$?
   OUT=$(cat "$td/.stdout" 2>/dev/null); ERR=$(cat "$td/.stderr" 2>/dev/null)
@@ -259,7 +265,7 @@ if [ -n "$TIMEOUT_BIN" ] && mkfifo "$td/pipe" 2>/dev/null; then
   if [ "$RC" -eq 124 ]; then
     note "FIFO transcript hung the hook until timeout"
   else
-    assert_quiet "FIFO transcript is not read"
+    assert_diagnostic "FIFO transcript is not read"
   fi
 else
   ok  # no mkfifo or no timeout command on this platform: nothing to assert
@@ -269,18 +275,18 @@ fi
 td=$(case_dir unreadable); mk_transcript "$td/t.jsonl" cold
 if chmod 000 "$td/t.jsonl" 2>/dev/null && [ ! -r "$td/t.jsonl" ]; then
   run "$td" Task "$td/t.jsonl" s-unread
-  assert_quiet "unreadable transcript fails open"
+  assert_diagnostic "unreadable transcript fails open"
   chmod 644 "$td/t.jsonl" 2>/dev/null
 else
   chmod 644 "$td/t.jsonl" 2>/dev/null
   ok  # running as root or on a permissionless filesystem: not assertable
 fi
 
-# Without jq the hook must degrade to silence, never to a decision or an error.
+# Parsing no longer depends on jq; the checkpoint still works without it.
 # The PATH must still carry a shell and coreutils — emptying it hides `bash` and
 # `cat` too, which tests the harness rather than the hook.
 td=$(case_dir nojq); mk_transcript "$td/t.jsonl" cold
-jq -nc --arg p "$td/t.jsonl" '{tool_name:"Task",transcript_path:$p,session_id:"s-nojq",cwd:"/tmp"}' > "$td/in.json"
+jq -nc --arg p "$td/t.jsonl" '{hook_event_name:"PreToolUse",tool_name:"Task",transcript_path:$p,session_id:"s-nojq",cwd:"/tmp"}' > "$td/in.json"
 BASE_PATH="/usr/bin:/bin:/usr/sbin:/sbin"
 BASH_ABS=$(command -v bash)
 if [ -x "$BASH_ABS" ] && ! PATH="$BASE_PATH" command -v jq >/dev/null 2>&1 \
@@ -290,7 +296,7 @@ if [ -x "$BASH_ABS" ] && ! PATH="$BASE_PATH" command -v jq >/dev/null 2>&1 \
   OUT=$(cat "$td/.stdout" 2>/dev/null); ERR=$(cat "$td/.stderr" 2>/dev/null)
   OUTBYTES=$(wc -c < "$td/.stdout" 2>/dev/null | tr -d ' ')
   ERRBYTES=$(wc -c < "$td/.stderr" 2>/dev/null | tr -d ' ')
-  assert_quiet "no jq on PATH degrades to silence"
+  assert_deny "no jq on PATH still permits the Python checkpoint" "$td"
 else
   ok  # jq lives in a system dir here, so it cannot be hidden without hiding coreutils
 fi
@@ -301,12 +307,12 @@ printf 'not json' | TMPDIR="$td" bash "$HOOK" >"$td/.stdout" 2>"$td/.stderr"; RC
 OUT=$(cat "$td/.stdout" 2>/dev/null); ERR=$(cat "$td/.stderr" 2>/dev/null)
 OUTBYTES=$(wc -c < "$td/.stdout" 2>/dev/null | tr -d ' ')
 ERRBYTES=$(wc -c < "$td/.stderr" 2>/dev/null | tr -d ' ')
-assert_quiet "malformed stdin"
+assert_diagnostic "malformed stdin"
 
 # --- hostile session_id stays inside TMPDIR --------------------------------
 td=$(case_dir hostile); mk_transcript "$td/t.jsonl" cold
 run "$td" Task "$td/t.jsonl" '../../escape'
-assert_ask "hostile session_id still asks" "$td"
+assert_deny "hostile session_id still replans" "$td"
 if [ -e "$ROOT/escape" ] || [ -e "$td/../escape" ]; then
   note "marker escaped TMPDIR"
 else
@@ -317,7 +323,7 @@ fi
 td=$(case_dir leak); mk_transcript "$td/t.jsonl" cold
 printf '%s\n' '{"type":"assistant","message":{"content":[{"type":"text","text":"SENTINEL-SECRET-VALUE"}]}}' >> "$td/t.jsonl"
 run "$td" Task "$td/t.jsonl" s-leak
-assert_ask "cold dispatch with secret in transcript" "$td"
+assert_deny "cold dispatch with secret in transcript" "$td"
 if printf '%s%s' "$OUT" "$ERR" | grep -q 'SENTINEL-SECRET-VALUE'; then
   note "transcript content leaked into hook output"
 else

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_guard_merge_authorization.sh

@@ -895,6 +895,146 @@ reason_has '字面绝对路径' "$MAIN_CWD" 'git -C "$WT" merge origin/main --no
 reason_has '!展开不了' "$MAIN_CWD" 'git merge origin/main'
 reason_has '直接推进'  "$MAIN_CWD" 'git merge origin/main'
 
+# Target-goal scope is checked through the public prompt-to-guard path.
+PROMPT_HOOK="${PROMPT_HOOK:-$SCRIPT_DIR/merge-authorization-prompt.sh}"
+git -C "$MAIN_CWD" remote add origin https://forge.example.invalid/team/project.git
+goal_prompt() {
+  jq -nc --arg p "$1" --arg s "$VSID" --arg w "$FEAT_CWD" '{prompt:$p,session_id:$s,cwd:$w}' | TMPDIR="$tmp" bash "$PROMPT_HOOK"
+}
+goal_arm() { goal_prompt '完成并合并 PR #123'; }
+goal_command='gh pr merge 123 --repo forge.example.invalid/team/project --merge --match-head-commit 0123456789012345678901234567890123456789'
+goal_arm
+probe_sid allow "$FEAT_CWD" "$VSID" "$goal_command"
+sentinel_state absent 'target-goal consumed once'
+probe_sid deny "$FEAT_CWD" "$VSID" "$goal_command"
+for bad in \
+  'gh pr merge 124 --repo forge.example.invalid/team/project --merge' \
+  'gh pr merge 123 --repo forge.example.invalid/team/other --merge' \
+  'gh pr merge 123 --merge' \
+  'gh pr merge 123 --repo forge.example.invalid/team/project --repo forge.example.invalid/team/other --merge' \
+  'gh pr merge 123 --repo forge.example.invalid/team/project --merge --squash' \
+  'gh pr merge 123 --repo forge.example.invalid/team/project --merge --match-head-commit abc' \
+  'gh pr merge 123 --repo forge.example.invalid/team/project --merge --unknown' \
+  'gh pr merge 123 --repo forge.example.invalid/team/project --auto' \
+  'gh pr merge 123 --repo forge.example.invalid/team/project --merge --admin' \
+  'gh api --method PUT repos/team/project/pulls/123/merge' \
+  'curl -X PUT https://forge.example.invalid/repos/team/project/pulls/123/merge' \
+  'gh pr merge 123 --repo forge.example.invalid/team/project --merge; echo done' \
+  'git push origin main'; do
+  goal_arm
+  probe_sid deny "$FEAT_CWD" "$VSID" "$bad"
+  sentinel_state present 'scope or command mismatch must preserve goal grant'
+done
+goal_arm
+goal_prompt '继续'
+probe_sid allow "$FEAT_CWD" "$VSID" "$goal_command"
+goal_arm
+goal_prompt '改成另一个功能'
+probe_sid deny "$FEAT_CWD" "$VSID" "$goal_command"
+goal_prompt '继续'
+probe_sid deny "$FEAT_CWD" "$VSID" "$goal_command"
+goal_arm
+old_ts=$(date -v-2H +%Y%m%d%H%M 2>/dev/null || date -d '-2 hours' +%Y%m%d%H%M)
+touch -t "$old_ts" "$VAUTH_DIR/$VSID"
+goal_prompt '状态'
+probe_sid deny "$FEAT_CWD" "$VSID" "$goal_command"
+goal_prompt '完成并合并 MR !123'
+probe_sid deny "$FEAT_CWD" "$VSID" 'glab mr merge 123 --repo forge.example.invalid/team/project --auto-merge=false --yes'
+probe_sid allow "$FEAT_CWD" "$VSID" 'glab mr merge 123 --repo https://forge.example.invalid/team/project --auto-merge=false --yes --sha 0123456789012345678901234567890123456789'
+
+# A corrupted or lost invalidation epoch cannot become a valid goal grant.
+goal_arm
+printf 'newer-prompt\n' >"$VAUTH_DIR/$VSID.epoch"
+probe_sid deny "$FEAT_CWD" "$VSID" "$goal_command"
+goal_arm
+rm -f "$VAUTH_DIR/$VSID.epoch"
+probe_sid deny "$FEAT_CWD" "$VSID" "$goal_command"
+
+# Two concurrent calls share one goal use, not two independent approvals.
+goal_arm
+for n in 1 2; do
+  jq -nc --arg s "$VSID" --arg w "$FEAT_CWD" --arg c "$goal_command" '{session_id:$s,cwd:$w,tool_input:{command:$c}}' \
+    | TMPDIR="$tmp" bash "$GUARD" >"$tmp/goal-contender-$n" &
+  if [ "$n" = 1 ]; then contender_one=$!; else contender_two=$!; fi
+done
+wait "$contender_one"; wait "$contender_two"
+allowed=0; denied=0
+for n in 1 2; do
+  if grep -q '"permissionDecision":"deny"' "$tmp/goal-contender-$n"; then denied=$((denied+1))
+  elif grep -q 'systemMessage' "$tmp/goal-contender-$n"; then allowed=$((allowed+1)); fi
+done
+if [ "$allowed" = 1 ] && [ "$denied" = 1 ] && [ ! -f "$VAUTH_DIR/$VSID" ]; then pass=$((pass+1)); else
+  fail=$((fail+1)); echo 'FAIL concurrent consumers must release exactly one goal use' >&2
+fi
+
+# Force revoke between consume and rearm. The wrapper only pauses the actual
+# filesystem rename of this disposable grant; no platform merge is executed.
+mkdir "$tmp/race-bin"
+REAL_MV=$(command -v mv)
+export REAL_MV
+cat >"$tmp/race-bin/mv" <<'RACE_MV'
+#!/usr/bin/env bash
+"$REAL_MV" "$@" || exit $?
+case "${2:-}" in
+  "$RACE_SENT".used.*)
+    : >"$RACE_REACHED"
+    for ((i=0;i<200;i++)); do
+      [ -f "$RACE_RESUME" ] && exit 0
+      sleep 0.05
+    done
+    exit 1
+    ;;
+esac
+RACE_MV
+chmod +x "$tmp/race-bin/mv"
+goal_prompt '批量合并 2'
+export RACE_SENT="$VAUTH_DIR/$VSID" RACE_REACHED="$tmp/race-reached" RACE_RESUME="$tmp/race-resume"
+jq -nc --arg s "$VSID" --arg w "$FEAT_CWD" '{session_id:$s,cwd:$w,tool_input:{command:"gh pr merge 123 --merge"}}' \
+  | PATH="$tmp/race-bin:$PATH" TMPDIR="$tmp" bash "$GUARD" >"$tmp/race-output" &
+race_pid=$!
+for ((i=0;i<200;i++)); do [ -f "$RACE_REACHED" ] && break; sleep 0.05; done
+if [ -f "$RACE_REACHED" ]; then
+  goal_prompt '停止'
+  : >"$RACE_RESUME"
+  wait "$race_pid"
+  if grep -q '"permissionDecision":"deny"' "$tmp/race-output" && [ ! -f "$RACE_SENT" ]; then
+    pass=$((pass+1))
+  else fail=$((fail+1)); echo 'FAIL revoke during consume must deny and prevent batch resurrection' >&2; fi
+else
+  : >"$RACE_RESUME"; wait "$race_pid"
+  fail=$((fail+1)); echo 'FAIL race harness never reached consume' >&2
+fi
+
+# Goal grants take the same post-consume invalidation path without batch rearm.
+# A revoke or unresolved scope change arriving in that window must deny even
+# though the prompt hook sees no sentinel to remove or mark suspended.
+for invalidation in '停止' '改成另一个功能'; do
+  goal_arm
+  epoch_before=$(cat "$RACE_SENT.epoch")
+  rm -f "$RACE_REACHED" "$RACE_RESUME"
+  jq -nc --arg s "$VSID" --arg w "$FEAT_CWD" --arg c "$goal_command" '{session_id:$s,cwd:$w,tool_input:{command:$c}}' \
+    | PATH="$tmp/race-bin:$PATH" TMPDIR="$tmp" bash "$GUARD" >"$tmp/goal-race-output" &
+  race_pid=$!
+  for ((i=0;i<200;i++)); do [ -f "$RACE_REACHED" ] && break; sleep 0.05; done
+  if [ -f "$RACE_REACHED" ]; then
+    goal_prompt "$invalidation"
+    : >"$RACE_RESUME"
+    wait "$race_pid"
+    if [ "$epoch_before" != "$(cat "$RACE_SENT.epoch")" ] \
+      && grep -q '"permissionDecision":"deny"' "$tmp/goal-race-output" \
+      && [ ! -f "$RACE_SENT" ] \
+      && ! compgen -G "$RACE_SENT.used.*" >/dev/null; then
+      pass=$((pass+1))
+    else
+      fail=$((fail+1)); printf 'FAIL goal invalidation during consume must deny without residual grant: %s\n' "$invalidation" >&2
+    fi
+  else
+    : >"$RACE_RESUME"; wait "$race_pid"
+    fail=$((fail+1)); echo 'FAIL goal race harness never reached consume' >&2
+  fi
+done
+unset RACE_SENT RACE_REACHED RACE_RESUME REAL_MV
+
 if [ "$fail" -ne 0 ]; then
   echo "test_guard_merge_authorization: FAIL pass=$pass fail=$fail" >&2
   exit 1