@ccoalm/ccl-skills 0.18.5 → 0.18.6

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_skill_loading.py

@@ -77,6 +77,83 @@ class SkillLoadingTests(unittest.TestCase):
         self.assertNotIn('permissionDecision":"ask', json.dumps(result))
         self.assertEqual(self.run_hook(self.payload()), {})
 
+    def ccl_checkout(self):
+        root = self.root / 'ccl'
+        (root / 'skills' / 'skill-extraction-workflow').mkdir(parents=True)
+        (root / 'skills' / 'skill-extraction-workflow' / 'SKILL.md').write_text('marker')
+        (root / 'skills' / 'sample-owner' / 'references').mkdir(parents=True)
+        (root / 'hooks').mkdir()
+        return root
+
+    def extraction_loaded(self, ident='ext'):
+        self.append({'type': 'assistant', 'message': {'content': [
+            {'type': 'tool_use', 'id': ident, 'name': 'Skill',
+             'input': {'skill': 'ccl-skills:skill-extraction-workflow'}}]}},
+            {'type': 'user', 'message': {'content': [
+                {'type': 'tool_result', 'tool_use_id': ident, 'content': 'Loaded owner'}]}})
+
+    def test_shared_skill_edit_names_the_extraction_owner_at_the_first_edit(self):
+        root = self.ccl_checkout()
+        target = root / 'skills' / 'sample-owner' / 'scripts' / 'gate.sh'
+        target.parent.mkdir(parents=True)
+        result = self.run_hook(self.payload(tool_input={'file_path': str(target)}))
+        self.assertEqual(self.decision(result), 'deny')
+        reason = result['hookSpecificOutput']['permissionDecisionReason']
+        self.assertIn('skill-extraction-workflow', reason)
+        self.assertIn('charter', reason.lower())
+
+    def test_shared_skill_markdown_edit_reaches_the_checkpoint(self):
+        root = self.ccl_checkout()
+        target = root / 'skills' / 'sample-owner' / 'references' / 'rule.md'
+        result = self.run_hook(self.payload(tool_input={'file_path': str(target)}))
+        self.assertEqual(self.decision(result), 'deny')
+        self.assertIn('skill-extraction-workflow',
+                      result['hookSpecificOutput']['permissionDecisionReason'])
+
+    def test_markdown_outside_a_ccl_checkout_still_skips_the_checkpoint(self):
+        outside = self.root / 'product' / 'skills' / 'thing' / 'notes.md'
+        outside.parent.mkdir(parents=True)
+        self.assertEqual(self.run_hook(self.payload(tool_input={'file_path': str(outside)})), {})
+        cached = self.ccl_checkout() / 'skills' / 'sample-owner' / 'SKILL.md'
+        # An installed plugin copy carries the same marker; only the cache exclusion skips it.
+        cache_root = self.root / 'plugins' / 'cache' / 'ccl'
+        (cache_root / 'skills' / 'skill-extraction-workflow').mkdir(parents=True)
+        (cache_root / 'skills' / 'skill-extraction-workflow' / 'SKILL.md').write_text('marker')
+        plugin_cache = cache_root / 'skills' / 'x' / 'SKILL.md'
+        plugin_cache.parent.mkdir(parents=True)
+        self.assertEqual(self.run_hook(self.payload(tool_input={'file_path': str(plugin_cache)})), {})
+        # The checkpoint is still unspent for a real shared-skill edit.
+        result = self.run_hook(self.payload(tool_input={'file_path': str(cached)}))
+        self.assertEqual(self.decision(result), 'deny')
+
+    def test_checkout_under_an_ancestor_named_like_a_surface_is_recognised(self):
+        root = self.root / 'skills' / 'ccl'
+        (root / 'skills' / 'skill-extraction-workflow').mkdir(parents=True)
+        (root / 'skills' / 'skill-extraction-workflow' / 'SKILL.md').write_text('marker')
+        target = root / 'skills' / 'sample-owner' / 'SKILL.md'
+        target.parent.mkdir(parents=True)
+        result = self.run_hook(self.payload(tool_input={'file_path': str(target)}))
+        self.assertEqual(self.decision(result), 'deny')
+        self.assertIn('skill-extraction-workflow',
+                      result['hookSpecificOutput']['permissionDecisionReason'])
+
+    def test_codex_install_copy_is_exempt_like_the_plugin_cache(self):
+        install = self.root / '.codex' / 'ccl'
+        (install / 'skills' / 'skill-extraction-workflow').mkdir(parents=True)
+        (install / 'skills' / 'skill-extraction-workflow' / 'SKILL.md').write_text('marker')
+        target = install / 'skills' / 'x' / 'SKILL.md'
+        target.parent.mkdir(parents=True)
+        self.assertEqual(self.run_hook(self.payload(tool_input={'file_path': str(target)})), {})
+        self.assertEqual(self.decision(self.run_hook(self.payload())), 'deny')
+
+    def test_shared_skill_edit_with_the_owner_loaded_keeps_the_generic_reason(self):
+        root = self.ccl_checkout()
+        self.extraction_loaded()
+        target = root / 'hooks' / 'gate.sh'
+        result = self.run_hook(self.payload(tool_input={'file_path': str(target)}))
+        self.assertEqual(self.decision(result), 'deny')
+        self.assertNotIn('charter', result['hookSpecificOutput']['permissionDecisionReason'].lower())
+
     def test_native_patch_and_all_targets(self):
         patch = '*** Begin Patch\n*** Add File: README.md\n+doc\n*** Add File: src/new.ts\n+code\n*** End Patch'
         value = self.run_hook(self.payload('apply_patch', tool_input={'command': patch}))

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/development-completion.md

@@ -23,7 +23,7 @@ A review quotes the repository's own tracked contract files for the changed path
 
 Walk these before you open a pull or merge request, push to one that is already open, ask for a merge, or report the work done or ready — every time, not only after the first review:
 
-1. Name the commit or packet the last conclusive review covered and compare it with the current candidate: HEAD plus staged, unstaged and untracked implementation files. For a review whose candidate `--base` derived from the whole worktree, the controller records that commit in the worktree's git directory (`ccl-code-review/last-review.json`; a bare `--diff-file` or `--paths` review records nothing), and the plugin's pull-request hook repeats this comparison when you open, ready or merge one; its reminder is this step firing, not a new question.
+1. Name the commit or packet the last conclusive review covered and compare it with the current candidate: HEAD plus staged, unstaged and untracked implementation files. For a review whose candidate `--base` derived from the whole worktree, the controller records that commit in the worktree's git directory (`ccl-code-review/last-review.json`; a bare `--diff-file` or `--paths` review records nothing), and the plugin's pull-request hook repeats this comparison when you open, ready or merge one; its reminder is this step firing, not a new question. A successful completion checkpoint on such a candidate records it as well, so a chain whose findings were disposed reads as passed; coverage alone is not disposition, and a covered receipt with findings or no status must still be dispositioned before a ready report.
 2. Any difference makes the current candidate unreviewed: a fix for a finding of any severity, an added or changed test, a changelog or doc line, a rebase that changed a file the candidate touches. Only the review's own record files (result JSON, disposition notes) are exempt.
 3. An unreviewed candidate must get the owning gate's renewed review now, run by you: a fresh full run per [manual invocation](manual-invocation-and-prompts.md); the skill-extraction lane runs its own delta pass instead. Pushing it for a human to review does not discharge it, and "awaiting human review" never stands in for the run.
 4. Apply the [review continuation checkpoint](#review-continuation-checkpoint) after five renewed runs or earlier when findings recur without progress. Necessary review continues within the task's authority; unresolved P0/P1 or unreviewed changes still prevent a ready report.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/AGENTS.md

@@ -10,7 +10,8 @@ Rules:
   their arguments, returned bytes and completed lifecycle. This does not permit
   arbitrary commands or workspace access. A malformed, timeout, or inconclusive
   wrapper result is not a pass.
-- **Never pin the parser to a CLI version's vocabulary.** `parse_probe_result.py`
+- **Never pin a lane to a CLI version's vocabulary — reading it or writing it.**
+  `parse_probe_result.py`
   gates on *shape*, not on field/value names: the isolation proof is the exact
   `tools` allowlist plus the tool_use scan, which no init field can bypass.
   Field-name and value whitelists were tried twice (`fast_mode_state`, then
@@ -19,6 +20,15 @@ Rules:
   or empty-container, and `agents`/`capabilities` are list-of-strings checks
   with no value vocabulary. Only `permissionMode` stays value-pinned (it widens
   what the runtime may do with no tool added).
+  The write side is the same class and was missed once: config a wrapper
+  GENERATES and then submits to the runtime's own validator as an admission
+  precondition carries a key that release may not know, and rejecting it turns
+  the whole lane off. So a generated setting that a per-invocation environment
+  variable already carries is belt, not the gate — on rejection regenerate the
+  strict subset without it and revalidate, unconditionally rather than by
+  matching the runtime's error wording, which is the same pin relocated. Only a
+  setting with no second, independent path to the same property may fail the
+  lane closed, and admission must never widen on the retry.
 - **Skill, command and plugin lists are vocabulary, not a boundary.**
   `slash_commands`, `terminal_slash_commands`, `skills` and `plugins` may hold
   any value and are never judged by name, shape, or origin; only `mcp_servers`

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/kimi_review.sh

@@ -721,7 +721,7 @@ fi
 # prevention. The cooperative probe below attempts only private-workspace
 # Read/Glob/Grep canaries and rejects any observed tool exposure.
 install_packet_only_config() {
-  "$PYTHON_BIN_PATH" - "$RUNTIME_HOME/config.toml" "$PACKET_DELIVERY" <<'PY'
+  "$PYTHON_BIN_PATH" - "$RUNTIME_HOME/config.toml" "$PACKET_DELIVERY" "${1:-guard}" <<'PY'
 import json
 import os
 from pathlib import Path
@@ -730,6 +730,15 @@ import tomllib
 
 config_path = Path(sys.argv[1])
 delivery = sys.argv[2]
+# "guard" writes the watcher table; "omit" leaves it out for a runtime whose
+# own validator does not recognise it. Both are equally isolated: every
+# invocation sets KIMI_CODE_WATCH, which the runtime reads ahead of the config.
+watch_mode = sys.argv[3]
+# A retry regenerates from the previous generation, so the marker is dropped on
+# the way in and re-added below; the output is the same bytes either way.
+generated_marker = (
+    "# Generated by code-review; source-home hooks, tools, and permissions are not inherited."
+)
 source = config_path.read_text(encoding="utf-8") if config_path.exists() else ""
 lines = source.splitlines(keepends=True)
 kept = []
@@ -793,6 +802,8 @@ def decoded_assignment_root(line):
 
 for line in lines:
     stripped = line.strip()
+    if stripped == generated_marker:
+        continue
     table_root = decoded_table_root(stripped)
     if table_root is not None:
         table_allowed = table_root in safe_table_roots
@@ -828,10 +839,19 @@ guard = (
     "[tools]\n"
     f"enabled = {json.dumps(enabled_tools, separators=(',', ':'))}\n"
 )
+if watch_mode == "guard":
+    guard += "[watch]\nenabled = false\n"
 rendered = "".join(kept).rstrip() + guard
 parsed = tomllib.loads(rendered)
 allowed_roots = safe_root_keys | safe_table_roots | {"tools"}
-if set(parsed) - allowed_roots or parsed.get("tools") != {"enabled": enabled_tools}:
+expected_watch = {"enabled": False} if watch_mode == "guard" else None
+if watch_mode == "guard":
+    allowed_roots = allowed_roots | {"watch"}
+if (
+    set(parsed) - allowed_roots
+    or parsed.get("tools") != {"enabled": enabled_tools}
+    or parsed.get("watch") != expected_watch
+):
     raise SystemExit("generated packet-only policy failed semantic verification")
 replacement = config_path.with_name(f".{config_path.name}.code-review.tmp")
 replacement.write_text(rendered, encoding="utf-8")
@@ -839,14 +859,30 @@ os.chmod(replacement, 0o600)
 os.replace(replacement, config_path)
 PY
 }
-install_packet_only_config \
-  || die_inconclusive kimi_packet_only_config_failed capability_missing true
 DOCTOR_STDOUT="$RUN_ROOT/doctor.stdout"
 DOCTOR_STDERR="$RUN_ROOT/doctor.stderr"
-KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_DISABLE_TELEMETRY=1 \
-  timeout --kill-after=1s 15s "$KIMI_BIN_PATH" doctor config "$RUNTIME_HOME/config.toml" \
-  >"$DOCTOR_STDOUT" 2>"$DOCTOR_STDERR" \
-  || die_inconclusive kimi_packet_only_config_unrecognized capability_missing true
+validate_packet_only_config() {
+  doctor_rc=0
+  KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_CODE_WATCH=0 KIMI_DISABLE_TELEMETRY=1 \
+    timeout --kill-after=1s 15s "$KIMI_BIN_PATH" doctor config "$RUNTIME_HOME/config.toml" \
+    >"$DOCTOR_STDOUT" 2>"$DOCTOR_STDERR" \
+    || doctor_rc=$?
+  [ "$doctor_rc" -eq 0 ]
+}
+install_packet_only_config guard \
+  || die_inconclusive kimi_packet_only_config_failed capability_missing true
+# The watcher table is belt on top of KIMI_CODE_WATCH, which every invocation
+# below sets and which the runtime reads ahead of the config. A runtime whose
+# validator does not know the table must not cost the whole lane, so retry once
+# with a strict subset of the same policy — admission cannot widen, and the
+# retry is unconditional rather than matched against the runtime's error
+# wording, which would be the same release-vocabulary pin in another place.
+if ! validate_packet_only_config; then
+  install_packet_only_config omit \
+    || die_inconclusive kimi_packet_only_config_failed capability_missing true
+  validate_packet_only_config \
+    || die_inconclusive kimi_packet_only_config_unrecognized capability_missing true "$doctor_rc"
+fi
 
 # Exercise the forbidden built-in tool surface without depending on a version
 # string. In MCP mode the generated config still exposes the one packet reader,
@@ -866,7 +902,7 @@ PROBE_TIMEOUT="$TIMEOUT"
 [ "$PROBE_TIMEOUT" -le 60 ] || PROBE_TIMEOUT=60
 (
   cd "$RUN_WORKSPACE" || exit 2
-  KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_DISABLE_TELEMETRY=1 \
+  KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_CODE_WATCH=0 KIMI_DISABLE_TELEMETRY=1 \
     timeout --kill-after=1s "${PROBE_TIMEOUT}s" "$KIMI_BIN_PATH" \
       --skills-dir "$ACTIVE_SKILLS_DIR" --prompt "$PROBE_PROMPT" \
       --output-format stream-json
@@ -876,6 +912,24 @@ if [ "$probe_rc" -ne 0 ]; then
   if grep -qiE 'EMFILE|too many open files' "$PROBE_STDERR"; then
     die_inconclusive kimi_host_resource_exhausted client_unavailable true "$probe_rc"
   fi
+  # NO SUB-CLASSIFICATION OF PROVIDER PROSE. Splitting this failure into quota
+  # and auth reasons was tried and withdrawn: four independent review rounds
+  # each broke the predicate on a new message. A digit boundary excluded 4290
+  # but not an offset of exactly 429; requiring a status word before the number
+  # matched `code` inside `decode`; matching what the message said instead
+  # matched `hit` inside `whitelisted` and still missed `credits are exhausted`.
+  # That is the shape this directory's contract already names — a predicate over
+  # a vocabulary the control does not own — and same-class recurrence is the cue
+  # to remove the capability rather than guard it again.
+  #
+  # Nothing about the gate changes: every one of those reasons was
+  # die_inconclusive and cascade-eligible, so the split only ever decided an
+  # operator hint, and a wrong hint is worse than none. The contract also
+  # forbids putting raw provider text in the payload, so the honest replacement
+  # is not a looser regex but a classifier over the structured error the probe
+  # already streams, the way the Claude lane's envelope classifier works. That
+  # is its own change, against a real sample.
+  :
   die_inconclusive kimi_tool_capability_unverified capability_missing true "$probe_rc"
 fi
 # MCP mode enables the packet reader for the later formal transport, but this
@@ -962,14 +1016,14 @@ run_started=$SECONDS
 if [ "$PACKET_DELIVERY" = inline ]; then
   (
     cd "$RUN_WORKSPACE" || exit 2
-    KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_DISABLE_TELEMETRY=1 \
+    KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_CODE_WATCH=0 KIMI_DISABLE_TELEMETRY=1 \
       timeout --kill-after=1s "${FORMAL_TIMEOUT}s" "$KIMI_BIN_PATH" --skills-dir "$ACTIVE_SKILLS_DIR" \
         --prompt "$PROMPT" --output-format stream-json
   ) >"$EVENTS" 2>"$STDERR_FILE"
 else
   (
     cd "$RUN_WORKSPACE" || exit 2
-    KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_DISABLE_TELEMETRY=1 \
+    KIMI_CODE_HOME="$RUNTIME_HOME" KIMI_CODE_WATCH=0 KIMI_DISABLE_TELEMETRY=1 \
       timeout --kill-after=1s "${FORMAL_TIMEOUT}s" "$KIMI_BIN_PATH" --skills-dir "$ACTIVE_SKILLS_DIR" \
         --agent-file "$AGENT_FILE" --prompt "$PROMPT" --output-format stream-json
   ) >"$EVENTS" 2>"$STDERR_FILE"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/review_gate.py

@@ -4661,8 +4661,10 @@ def main(argv: list[str] | None = None) -> int:
             )
         # Only a candidate derived from the whole worktree says what HEAD holds:
         # a bare --diff-file packet or a --paths slice may cover less than HEAD.
+        # A completion checkpoint records too: it is what turns a findings
+        # receipt into a passed one once every finding is disposed.
         anchors_wanted = (
-            args.mode in {"review", "challenge"}
+            args.mode in {"review", "challenge", "complete"}
             and bool(args.base)
             and not args.paths
         )
@@ -4831,6 +4833,7 @@ def main(argv: list[str] | None = None) -> int:
                 ),
             )
             result.update(completion_metadata)
+            record_local_review(review_anchor, result)
             return emit(result, 0)
         last_reason_code = "no_independent_reviewer_available"
         for client in order:

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_cli_review_wrappers.sh

@@ -64,6 +64,9 @@ base_url = "https://example.invalid"
 [future_tools]
 enabled = true
 
+[watch]
+enabled = true
+
 [permission]
 deny = ["Read"]
 
@@ -164,6 +167,7 @@ cat >"$WORK/bin/kimi" <<'KIMI_STUB'
 #!/usr/bin/env bash
 set -u
 state="$REVIEW_WRAPPER_TEST_STATE"
+printf '%s\t%s\n' invocation "${KIMI_CODE_WATCH-}" >>"$state/kimi_watch_all"
 if [ "${1:-}" = --version ]; then
   if [ "${STUB_BEHAVIOR:-}" = version_hang ]; then
     trap '' TERM
@@ -176,6 +180,23 @@ fi
 if [ "${1:-}" = doctor ]; then
   touch "$state/kimi_doctor_checked"
   printf '%s\n' "$*" >"$state/kimi_doctor_args"
+  printf '%s\t%s\n' doctor "${KIMI_CODE_WATCH-}" >>"$state/kimi_watch"
+  # Keep every validated config so a retry can be compared against the attempt
+  # it replaced, rather than only asserted about one property at a time.
+  doctor_n=$(( $(cat "$state/kimi_doctor_count" 2>/dev/null || echo 0) + 1 ))
+  printf '%s' "$doctor_n" >"$state/kimi_doctor_count"
+  if [ -n "${3:-}" ] && [ -f "$3" ]; then
+    cp "$3" "$state/kimi_doctor_config.$doctor_n"
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = doctor_reject_all ]; then
+    printf '%s\n' 'config rejected' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = doctor_reject_watch ] \
+    && [ -n "${3:-}" ] && [ -f "$3" ] && grep -q '^\[watch\]' "$3"; then
+    printf '%s\n' 'unknown config table: watch' >&2
+    exit 1
+  fi
   exit 0
 fi
 touch "$state/kimi_invoked"
@@ -199,6 +220,12 @@ while [ "$#" -gt 0 ]; do
     *) shift ;;
   esac
 done
+if [[ "$prompt" = "No-tools capability probe."* ]]; then
+  watch_phase=capability
+else
+  watch_phase=formal
+fi
+printf '%s\t%s\n' "$watch_phase" "${KIMI_CODE_WATCH-}" >>"$state/kimi_watch"
 printf '%s' "$has_stream" >"$state/kimi_stream"
 printf '%s' "$has_model" >"$state/kimi_model_override"
 printf '%s' "$has_skills_dir" >"$state/kimi_skills_dir"
@@ -213,7 +240,9 @@ if [ -f "$KIMI_CODE_HOME/config.toml" ]; then
   grep -q '/trusted/local/hook-marker' "$KIMI_CODE_HOME/config.toml" && touch "$state/kimi_hooks_preserved"
   grep -q 'enabled = \["\*"\]' "$KIMI_CODE_HOME/config.toml" \
     && touch "$state/kimi_no_tools_configured"
-  python3 - "$KIMI_CODE_HOME/config.toml" "$state/kimi_runtime_config_mode" "$state/kimi_dotted_config_preserved" <<'PY'
+  grep -c '^# Generated by code-review' "$KIMI_CODE_HOME/config.toml" \
+    >"$state/kimi_generated_marker_count"
+  python3 - "$KIMI_CODE_HOME/config.toml" "$state/kimi_runtime_config_mode" "$state/kimi_dotted_config_preserved" "$state/kimi_watch_disabled" "$state/kimi_watch_absent" <<'PY'
 import os, sys, tomllib
 from pathlib import Path
 
@@ -222,6 +251,10 @@ with open(sys.argv[2], "w", encoding="utf-8") as stream:
 config = tomllib.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
 if config.get("providers") and config.get("models"):
     Path(sys.argv[3]).touch()
+if config.get("watch") == {"enabled": False}:
+    Path(sys.argv[4]).touch()
+if "watch" not in config:
+    Path(sys.argv[5]).touch()
 PY
 fi
 if [ -f "$KIMI_CODE_HOME/mcp.json" ]; then
@@ -258,6 +291,58 @@ if [[ "$prompt" = "No-tools capability probe."* ]]; then
     printf '%s\n' 'EMFILE: too many open files, watch' >&2
     exit 1
   fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_quota ]; then
+    printf '%s\n' "provider.auth_error: 403 You've reached your weekly (7-day) usage limit" >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth ]; then
+    printf '%s\n' 'provider.auth_error: 403 authentication required' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_quota_mention ]; then
+    printf '%s\n' 'provider.auth_error: 403 authentication required; quota metadata unavailable' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_limit ]; then
+    printf '%s\n' 'provider.auth_error: 403 authentication required; usage limit metadata unavailable' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_word ]; then
+    printf '%s\n' 'tool surface rejected; authentication metadata unavailable' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_offset ]; then
+    printf '%s\n' 'provider failed at byte offset 4290 and line 14030' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_exact_offset ]; then
+    printf '%s\n' 'provider failed at byte offset 429 and line 403' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_rate_limit_403 ]; then
+    printf '%s\n' 'provider.auth_error: 403 rate limit exceeded' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_http_quota ]; then
+    printf '%s\n' 'provider error: HTTP 429 Too Many Requests' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_decode_offset ]; then
+    printf '%s\n' 'provider failed to decode offset 429' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_weekly_metadata ]; then
+    printf '%s\n' 'provider.auth_error: 403 authentication required; weekly usage limit metadata unavailable' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_too_many ]; then
+    printf '%s\n' 'provider.auth_error: HTTP 429 Too Many Requests' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_forbidden ]; then
+    printf '%s\n' 'provider error: 403 Forbidden' >&2
+    exit 1
+  fi
   if [ "${STUB_BEHAVIOR:-pass}" = capability_missing ]; then
     printf '%s\n' '{"role":"meta","type":"system.version","version":"future"}'
     exit 0
@@ -546,6 +631,7 @@ content = {
     "foreign_tool": clean,
     "nested_tool": clean,
     "unknown_event": clean,
+    "doctor_reject_watch": clean,
     "multi_message": clean,
     "mcp_bad_chunk": clean,
     "mcp_eof_confirmation": clean,
@@ -1321,15 +1407,37 @@ for client in kimi codex; do
   done
 done
 
-out="$(run_kimi pass)"; rc=$?
+rm -f "$WORK/state/kimi_watch" "$WORK/state/kimi_watch_all" "$WORK/state/kimi_watch_disabled"
+out="$(KIMI_CODE_WATCH=1 run_kimi pass)"; rc=$?
 check "Kimi clean result passes with fixed Moonshot attribution" \
-  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$(field concern_results.0.concern "$out")" = correctness ] && [ "$(field reviewer_family "$out")" = moonshot ] && [ "$(field provider "$out")" = kimi-cli ] && [ "$(field model "$out")" = None ] && [ "$(dir_mode "$WORK/kimi-source/config.toml")" = 400 ] && [ "$(cat "$WORK/state/kimi_runtime_config_mode")" = 600 ]'
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$(field concern_results.0.concern "$out")" = correctness ] && [ "$(field reviewer_family "$out")" = moonshot ] && [ "$(field provider "$out")" = kimi-cli ] && [ "$(field model "$out")" = None ] && [ "$(dir_mode "$WORK/kimi-source/config.toml")" = 400 ] && [ "$(cat "$WORK/state/kimi_runtime_config_mode")" = 600 ] && [ "$(wc -l < "$WORK/state/kimi_watch" | tr -d " ")" = 3 ] && [ "$(grep -c "^doctor[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^capability[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^formal[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(wc -l < "$WORK/state/kimi_watch_all" | tr -d " ")" = 3 ] && ! grep -qEv "^invocation[[:space:]]0$" "$WORK/state/kimi_watch_all" && [ -e "$WORK/state/kimi_watch_disabled" ]'
+# The retry's config must differ from the attempt it replaced by exactly the
+# watcher table: asserting only that watch is absent would also pass a retry
+# that dropped or widened something else.
+retry_config_is_watch_only_delta() {
+  python3 -c '
+import sys
+first = open(sys.argv[1], encoding="utf-8").read()
+retry = open(sys.argv[2], encoding="utf-8").read()
+sys.exit(0 if first.replace("[watch]\nenabled = false\n", "", 1) == retry else 1)
+' "$1" "$2"
+}
+rm -f "$WORK/state/kimi_watch" "$WORK/state/kimi_watch_all" "$WORK/state/kimi_watch_disabled" "$WORK/state/kimi_watch_absent" "$WORK/state/kimi_doctor_count" "$WORK/state/kimi_doctor_config."*
+out="$(KIMI_CODE_WATCH=1 run_kimi doctor_reject_watch)"; rc=$?
+# The watcher guard is belt on top of the per-invocation override, which the
+# runtime reads ahead of the config. A runtime that does not know the table may
+# not cost the whole lane: drop the table, keep the override, stay admitted.
+check "Kimi keeps the lane when the runtime rejects only the watcher table" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/kimi_watch_absent" ] && [ ! -e "$WORK/state/kimi_watch_disabled" ] && [ "$(tr -d " " < "$WORK/state/kimi_generated_marker_count")" = 1 ] && retry_config_is_watch_only_delta "$WORK/state/kimi_doctor_config.1" "$WORK/state/kimi_doctor_config.2" && [ "$(grep -c "^doctor[[:space:]]0$" "$WORK/state/kimi_watch")" = 2 ] && [ "$(grep -c "^capability[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^formal[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && ! grep -qEv "^invocation[[:space:]]0$" "$WORK/state/kimi_watch_all"'
+out="$(run_kimi doctor_reject_all)"; rc=$?
+check "Kimi still fails closed when no generated config is accepted" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_packet_only_config_unrecognized ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
 # Admission is version-neutral: deliberately unparseable version output must not
 # trigger --version or block a capable runtime.
-rm -f "$WORK/state/kimi_invoked" "$WORK/state/kimi_version_checked" "$WORK/state/kimi_no_tools_configured" "$WORK/state/kimi_no_tools_policy_verified"
+rm -f "$WORK/state/kimi_invoked" "$WORK/state/kimi_version_checked" "$WORK/state/kimi_no_tools_configured" "$WORK/state/kimi_no_tools_policy_verified" "$WORK/state/kimi_watch_all"
 out="$(KIMI_STUB_VERSION='not-a-version' run_kimi pass)"; rc=$?
 check "Kimi admission depends on runtime capability, not a version string" \
-  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ ! -e "$WORK/state/kimi_version_checked" ] && [ -e "$WORK/state/kimi_doctor_checked" ] && grep -q "^doctor config /.*config.toml$" "$WORK/state/kimi_doctor_args" && [ -e "$WORK/state/kimi_invoked" ] && [ -e "$WORK/state/kimi_no_tools_configured" ] && [ -e "$WORK/state/kimi_no_tools_policy_verified" ]'
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ ! -e "$WORK/state/kimi_version_checked" ] && [ -e "$WORK/state/kimi_doctor_checked" ] && grep -q "^doctor config /.*config.toml$" "$WORK/state/kimi_doctor_args" && [ -e "$WORK/state/kimi_invoked" ] && [ -e "$WORK/state/kimi_no_tools_configured" ] && [ -e "$WORK/state/kimi_no_tools_policy_verified" ] && [ "$(wc -l < "$WORK/state/kimi_watch_all" | tr -d " ")" = 3 ] && ! grep -qEv "^invocation[[:space:]]0$" "$WORK/state/kimi_watch_all"'
 rm -f "$WORK/state/kimi_invoked"
 out="$(run_kimi pass claude "$WORK/kimi-source" "$WORK/nul.patch")"; rc=$?
 check "Kimi rejects a NUL-bearing diff before inference" \
@@ -1346,6 +1454,47 @@ check "Kimi rejects any tool exposed during the no-tools probe" \
 out="$(run_kimi capability_emfile)"; rc=$?
 check "Kimi classifies probe-time EMFILE as a local client failure" \
   '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_host_resource_exhausted ] && [ "$(field reason_code "$out")" = client_unavailable ] && [ "$(field cascade_eligible "$out")" = True ]'
+# Provider prose is not sub-classified: these shapes each broke a predecessor
+# predicate, and all of them now land in the one capability class.
+out="$(run_kimi capability_quota)"; rc=$?
+check "Kimi does not sub-classify provider prose: quota" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_quota_mention)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth quota mention" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_limit)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth limit" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_word)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth word" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_offset)"; rc=$?
+check "Kimi does not sub-classify provider prose: offset" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_exact_offset)"; rc=$?
+check "Kimi does not sub-classify provider prose: exact offset" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_rate_limit_403)"; rc=$?
+check "Kimi does not sub-classify provider prose: rate limit 403" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_http_quota)"; rc=$?
+check "Kimi does not sub-classify provider prose: http quota" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_forbidden)"; rc=$?
+check "Kimi does not sub-classify provider prose: forbidden" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_decode_offset)"; rc=$?
+check "Kimi does not sub-classify provider prose: decode offset" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_weekly_metadata)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth weekly metadata" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_too_many)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth too many" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
 probe_started=$SECONDS
 out="$(REVIEW_TEST_TIMEOUT=5 run_kimi capability_hang)"; rc=$?
 probe_elapsed=$((SECONDS - probe_started))
@@ -1406,10 +1555,13 @@ out="$(REVIEW_TEST_TIMEOUT=180 REVIEW_TEST_PATH_PREFIX="$WORK/timeout-probe-bin"
 check "Kimi caps argv-exposed inline review at 120 seconds" \
   '[ "$rc" = 0 ] && grep -q -- "--kill-after=1s 120s " "$WORK/state/timeout_args"'
 rm -f "$WORK/state/timeout_args"
-out="$(REVIEW_TEST_TIMEOUT=180 REVIEW_TEST_PATH_PREFIX="$WORK/timeout-probe-bin" run_kimi pass claude "$WORK/kimi-source" "$WORK/agent-template.patch")"; rc=$?
+rm -f "$WORK/state/kimi_watch" "$WORK/state/kimi_watch_all" "$WORK/state/kimi_watch_disabled"
+out="$(KIMI_CODE_WATCH=1 REVIEW_TEST_TIMEOUT=180 REVIEW_TEST_PATH_PREFIX="$WORK/timeout-probe-bin" run_kimi pass claude "$WORK/kimi-source" "$WORK/agent-template.patch")"; rc=$?
 formal_timeout="$(tail -n 1 "$WORK/state/timeout_args" | awk '{ value=$2; sub(/s$/, "", value); print value }')"
 check "Kimi gives private MCP review only the remaining controller budget" \
   '[ "$rc" = 0 ] && [ "$formal_timeout" -ge 1 ] && [ "$formal_timeout" -le 180 ]'
+check "Kimi sets the watcher override on private MCP formal delivery" \
+  '[ "$(wc -l < "$WORK/state/kimi_watch" | tr -d " ")" = 3 ] && [ "$(grep -c "^doctor[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^capability[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^formal[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(wc -l < "$WORK/state/kimi_watch_all" | tr -d " ")" = 3 ] && ! grep -qEv "^invocation[[:space:]]0$" "$WORK/state/kimi_watch_all" && [ -e "$WORK/state/kimi_watch_disabled" ]'
 rm -f "$WORK/state/timeout_args"
 out="$(REVIEW_TEST_TIMEOUT=10 REVIEW_TEST_PATH_PREFIX="$WORK/timeout-probe-bin" run_kimi capability_delay claude "$WORK/kimi-source" "$WORK/agent-template.patch")"; rc=$?
 formal_timeout="$(tail -n 1 "$WORK/state/timeout_args" | awk '{ value=$2; sub(/s$/, "", value); print value }')"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_client_compat.py

@@ -832,11 +832,49 @@ class CompletionFindingDispositionTest(unittest.TestCase):
                                             "failure_path": "A distinct synthetic failure on the same line."})
         return subprocess.CompletedProcess(command, 0, json.dumps(payload).encode("utf-8"), b"")
 
+    base_repo: Path | None = None
+
     def arguments(self, mode: str) -> list[str]:
-        return ["--mode", mode, "--cwd", str(self.root), "--diff-file", str(self.packet),
+        if self.base_repo is not None:
+            candidate = ["--cwd", str(self.base_repo), "--base", self.base_commit]
+        else:
+            candidate = ["--cwd", str(self.root), "--diff-file", str(self.packet)]
+        return ["--mode", mode, *candidate,
                 "--implementer-family", "openai", "--review-plan-file", str(self.plan),
                 "--challenge-budget", "1"]
 
+    def test_source_refuted_completion_records_a_passed_receipt(self) -> None:
+        # The chain the pull-request reminder reads: findings recorded on a
+        # committed whole-worktree candidate, then disposed through completion.
+        repo = self.root / "repo"
+        repo.mkdir()
+        def git(*command: str) -> str:
+            return subprocess.run(["git", "-C", str(repo), "-c", "user.email=t@example.invalid",
+                             "-c", "user.name=t", *command],
+                            capture_output=True, check=True, text=True).stdout.strip()
+        git("init", "-q")
+        (repo / "x").write_text("a\n", encoding="utf-8")
+        git("add", "x")
+        git("commit", "-q", "-m", "base")
+        self.base_commit = git("rev-parse", "HEAD")
+        (repo / "x").write_text("b\n", encoding="utf-8")
+        git("commit", "-q", "-am", "candidate")
+        head = git("rev-parse", "HEAD")
+        self.base_repo = repo
+        self.record_receipts()
+        receipt = repo / ".git" / "ccl-code-review" / "last-review.json"
+        before = json.loads(receipt.read_text(encoding="utf-8"))
+        self.assertEqual((before["mode"], before["status"], before["head"], before["worktree_clean"]),
+                         ("challenge", "findings", head, True))
+
+        code, result = self.complete()
+
+        self.assertEqual(code, 0, result)
+        self.assertEqual(result["status"], "passed", result)
+        after = json.loads(receipt.read_text(encoding="utf-8"))
+        self.assertEqual((after["mode"], after["status"], after["head"], after["worktree_clean"]),
+                         ("complete", "passed", head, True))
+
     def invoke(self, mode: str, extra: list[str]) -> tuple[int, dict]:
         output = io.StringIO()
         with (mock.patch.object(review_gate, "run", side_effect=self.wrapper_result),

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_gate.sh

@@ -4863,6 +4863,24 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
 check "a bare --diff-file review records no receipt" \
   '[ "$rc" = 0 ] && json_fields "$out" status=passed && [ ! -e "$contract_repo/.git/ccl-code-review" ]'
 
+# The completion checkpoint is what the pull-request reminder reads as disposed:
+# on the same whole-worktree candidate it replaces the review's receipt with a
+# passed one; a checkpoint that fails leaves the receipt as it was.
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode review)"; rc=$?
+printf '%s\n' "$out" >"$WORK/contract-completion-review.json"
+check "the review before a completion checkpoint records its own receipt" \
+  '[ "$rc" = 0 ] && [ "$(jq -r .mode "$receipt_file")" = review ]'
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode complete --completion-review-result-file "$WORK/contract-completion-review.json")"; rc=$?
+check "a successful completion checkpoint records a passed receipt for the HEAD it bound" \
+  '[ "$rc" = 0 ] && json_fields "$out" mode=complete status=passed && [ "$(jq -r .mode "$receipt_file")" = complete ] && [ "$(jq -r .status "$receipt_file")" = passed ] && [ "$(jq -r .head "$receipt_file")" = "$(git -C "$contract_repo" rev-parse HEAD)" ]'
+cp "$receipt_file" "$WORK/receipt-before-failed-completion"
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode complete --review-plan-file "$WORK/changed-review-plan.json" --completion-review-result-file "$WORK/contract-completion-review.json")"; rc=$?
+check "a failed completion checkpoint leaves the receipt untouched" \
+  '[ "$rc" = 2 ] && cmp -s "$receipt_file" "$WORK/receipt-before-failed-completion"'
+
 swap_out="$(PYTHONPATH="$WORK/harness/scripts" python3 - "$WORK" <<'PY' 2>&1
 import os, sys, review_gate
 root = os.path.realpath(os.path.join(sys.argv[1], "gitdir-swap"))