@ccoalm/ccl-skills 0.6.2 → 0.8.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_parallel_stack_parity.sh

@@ -0,0 +1,183 @@
+#!/usr/bin/env bash
+# Integration test for check-parallel-stack-parity.sh (the cross-file mirror gate
+# wired into check-ccl-skills.sh). Builds throwaway sibling trees so verdicts are
+# DETERMINISTIC and do not depend on the real repository's current file content.
+#
+# Cases:
+#   a. identical mirrored regions + differing stack-glue        => exit 0, ok marker
+#   b. one-word drift inside the mirrored region                => exit 1, parity_drift + FAIL marker
+#   c. dual-tree routing text identical on both sides           => exit 0 (the supported shape)
+#   d. one-sided sibling-name / routing-reference divergence    => exit 1, parity_drift (no normalization)
+#   e. missing sibling file                                     => exit 1, parity_missing_file
+#   f. missing marker headings                                   => exit 1, parity_malformed_markers
+#   g. stop heading duplicated                                   => exit 1, parity_malformed_markers
+#   h. canonical (non-routing-mapped) reference swapped one side => exit 1, parity_drift
+#   j. extra trailing blank line before one side's stack-glue H2  => exit 1, parity_drift
+#   k. unreadable pair file                                       => exit 2, parity_infra
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+PARITY_SCRIPT="$SCRIPT_DIR/check-parallel-stack-parity.sh"
+[ -f "$PARITY_SCRIPT" ] || { echo "FAIL: parity script not found: $PARITY_SCRIPT" >&2; exit 1; }
+
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/stackparity.XXXXXX")"
+trap 'rm -rf "$TMP"' EXIT
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+assert_rc() { [ "$1" = "$2" ] || fail "expected rc=$2 got rc=$1${3:+ ($3)}"; }
+assert_contains() { case "$2" in *"$1"*) : ;; *) fail "expected output to contain: $1${3:+ ($3)}";; esac; }
+assert_not_contains() { case "$2" in *"$1"*) fail "expected output NOT to contain: $1${3:+ ($3)}";; *) : ;; esac; }
+
+PY_REFS="$TMP/skills/python-service-architecture/references"
+GO_REFS="$TMP/skills/go-microservice-architecture/references"
+mkdir -p "$PY_REFS" "$GO_REFS"
+
+# write_pair <mirrored-body-file-py> <mirrored-body-file-go>
+# Wraps each body in the standard skeleton: title + mirrored region + stack glue.
+write_pair() {
+  local name="$1" py_body="$2" go_body="$3"
+  {
+    echo "# $name (Python)"
+    echo
+    echo "Sibling: go-microservice-architecture mirrors this file."
+    echo
+    printf '%s\n' "$py_body"
+    echo "## Python-specific implementation patterns"
+    echo
+    echo "- Python glue: asyncio consumer shape."
+  } > "$PY_REFS/$name.md"
+  {
+    echo "# $name (Go)"
+    echo
+    echo "Sibling: python-service-architecture mirrors this file."
+    echo
+    printf '%s\n' "$go_body"
+    echo "## Go-specific implementation patterns"
+    echo
+    echo "- Go glue: goroutine consumer shape."
+  } > "$GO_REFS/$name.md"
+}
+
+MIRROR_BASE='## When this applies / does not apply
+
+Apply when the service publishes durable events.
+Skip when it only does in-process pub-sub (use `local-a.md` instead).
+The sibling tree is maintained by python-service-architecture and go-microservice-architecture maintainers.
+
+## Operations checklist
+
+- Delivery semantics declared explicitly.
+'
+
+# The gate iterates a fixed pair list; give all three names the same skeleton, then
+# vary the one under test per case.
+seed_all_identical() {
+  write_pair "event-driven-architecture" "$MIRROR_BASE" "$MIRROR_BASE"
+  write_pair "multi-tenant-isolation" "$MIRROR_BASE" "$MIRROR_BASE"
+  write_pair "data-platform-architecture" "$MIRROR_BASE" "$MIRROR_BASE"
+}
+
+run_gate() {
+  set +e
+  OUT="$(bash "$PARITY_SCRIPT" "$TMP" 2>&1)"
+  RC=$?
+  set -e
+}
+
+# --- case a: identical mirrored regions, differing glue => ok
+seed_all_identical
+run_gate
+assert_rc "$RC" 0 "case a"
+assert_contains "parallel_stack_parity_ok" "$OUT" "case a"
+
+# --- case b: one-word drift in a mirrored region => FAIL naming the pair
+GO_DRIFT="${MIRROR_BASE/durable events/durable events plus commands}"
+write_pair "event-driven-architecture" "$MIRROR_BASE" "$GO_DRIFT"
+run_gate
+assert_rc "$RC" 1 "case b"
+assert_contains "parity_drift: event-driven-architecture.md" "$OUT" "case b"
+assert_contains "parallel_stack_parity_FAIL" "$OUT" "case b"
+
+# --- case c: the supported dual-tree routing shape — identical bytes on both sides => ok
+DUAL="${MIRROR_BASE/\`local-a.md\`/\`api-contract-and-schema.md\` on the Python tree \/ \`protobuf-contract-architecture.md\` on the Go tree}"
+write_pair "event-driven-architecture" "$DUAL" "$DUAL"
+run_gate
+assert_rc "$RC" 0 "case c"
+assert_contains "parallel_stack_parity_ok" "$OUT" "case c"
+
+# --- case d: one-sided divergence is drift — there is NO normalization to hide behind
+# (d1: a routing reference differing per side; d2: an asymmetric sibling-name mention)
+PY_REFS_BODY="${MIRROR_BASE/\`local-a.md\`/\`api-contract-and-schema.md\`}"
+GO_REFS_BODY="${MIRROR_BASE/\`local-a.md\`/\`protobuf-contract-architecture.md\`}"
+write_pair "event-driven-architecture" "$PY_REFS_BODY" "$GO_REFS_BODY"
+run_gate
+assert_rc "$RC" 1 "case d1"
+assert_contains "parity_drift: event-driven-architecture.md" "$OUT" "case d1"
+PY_NAME_BODY="${MIRROR_BASE/python-service-architecture and go-microservice-architecture/python-service-architecture}"
+GO_NAME_BODY="${MIRROR_BASE/python-service-architecture and go-microservice-architecture/go-microservice-architecture}"
+write_pair "event-driven-architecture" "$PY_NAME_BODY" "$GO_NAME_BODY"
+run_gate
+assert_rc "$RC" 1 "case d2"
+assert_contains "parity_drift: event-driven-architecture.md" "$OUT" "case d2"
+
+# --- case e: missing sibling file => FAIL with missing token
+rm "$GO_REFS/event-driven-architecture.md"
+run_gate
+assert_rc "$RC" 1 "case e"
+assert_contains "parity_missing_file: event-driven-architecture.md" "$OUT" "case e"
+
+# --- case f: start marker missing => FAIL with malformed-markers token
+seed_all_identical
+printf '# t\n\nno markers here\n\n## Go-specific implementation patterns\n\nx\n' > "$GO_REFS/multi-tenant-isolation.md"
+run_gate
+assert_rc "$RC" 1 "case f"
+assert_contains "parity_malformed_markers: multi-tenant-isolation.md" "$OUT" "case f"
+
+# --- case g: stop heading duplicated => FAIL with malformed-markers token (a missing or
+# doubled stop must not silently fall through to a drift/ok verdict)
+seed_all_identical
+printf '\n## Go-specific implementation patterns\n\n- dup glue\n' >> "$GO_REFS/event-driven-architecture.md"
+run_gate
+assert_rc "$RC" 1 "case g"
+assert_contains "parity_malformed_markers: event-driven-architecture.md" "$OUT" "case g"
+
+# --- case h: canonical-pointer swap on one side only stays drift
+seed_all_identical
+PY_CANON="${MIRROR_BASE/Delivery semantics declared explicitly./Delivery semantics declared explicitly per \`data-modeling-and-migrations.md\`.}"
+GO_CANON="${MIRROR_BASE/Delivery semantics declared explicitly./Delivery semantics declared explicitly per \`background-jobs-and-scheduling.md\`.}"
+write_pair "event-driven-architecture" "$PY_CANON" "$GO_CANON"
+run_gate
+assert_rc "$RC" 1 "case h"
+assert_contains "parity_drift: event-driven-architecture.md" "$OUT" "case h"
+
+# --- case i: prefix/suffix-gamed stop heading => malformed, not silent region shrink
+seed_all_identical
+python_side="$PY_REFS/event-driven-architecture.md"
+sed_inplace() { local expr="$1" file="$2"; sed "$expr" "$file" > "$file.tmp" && mv "$file.tmp" "$file"; }
+sed_inplace 's/^## Python-specific implementation patterns$/## Python-specific implementation patterns (v2)/' "$python_side"
+run_gate
+assert_rc "$RC" 1 "case i"
+assert_contains "parity_malformed_markers: event-driven-architecture.md" "$OUT" "case i"
+
+# --- case j: extra blank line immediately before one side's stack-specific H2 — command
+# substitution strips trailing newlines, so the gate must compare region FILES, not strings
+seed_all_identical
+python_side="$PY_REFS/event-driven-architecture.md"
+awk '/^## Python-specific implementation patterns$/{print ""} {print}' "$python_side" > "$python_side.tmp" && mv "$python_side.tmp" "$python_side"
+run_gate
+assert_rc "$RC" 1 "case j"
+assert_contains "parity_drift: event-driven-architecture.md" "$OUT" "case j"
+
+# --- case k: unreadable pair file => infrastructure failure (exit 2), never a content verdict
+seed_all_identical
+chmod 000 "$GO_REFS/event-driven-architecture.md"
+if [ -r "$GO_REFS/event-driven-architecture.md" ]; then
+  echo "SKIP case k: file still readable (running as root?)"
+else
+  run_gate
+  assert_rc "$RC" 2 "case k"
+  assert_contains "parity_infra" "$OUT" "case k"
+fi
+chmod 644 "$GO_REFS/event-driven-architecture.md"
+
+echo "test_check_ccl_parallel_stack_parity_ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -14,7 +14,11 @@
 #   - test_controlled_escalation_pins.sh
 #   - test_check_ccl_size_budget.sh
 #   - test_check_ccl_skill_catalog.sh
+#   - test_check_ccl_parallel_stack_parity.sh
 #   - test_generic_r0_leak_scan.sh
+#   - test_shared_git_surface_gate.sh
+#   - test_extraction_review_gate.sh
+#   - test_validate_extraction_review_state.sh
 #   - test_check_ccl_route_drift.sh
 #   - test_check_sync_pointers.sh
 #   - test_check_ccl_register_pending_exclusion.sh
@@ -24,6 +28,9 @@
 #   - test_validate_skill_credential_cwd.sh
 #   - test_validate_skill_root_depth.sh
 #   - test_regression_runner_registration.sh
+#   - test_uiux_delivery_contract.sh
+#   - test_uiux_loading_budget.sh
+#   - test_obligation_ledger.sh
 # --full runs --fast plus the heavy full-checker regressions:
 #   - test_check_ccl_r0_status.sh
 #   - test_check_ccl_source_register_lifecycle.sh
@@ -101,8 +108,12 @@ fast_tests=(
   test_controlled_escalation_pins.sh
   test_check_ccl_size_budget.sh
   test_check_ccl_skill_catalog.sh
+  test_check_ccl_parallel_stack_parity.sh
   test_check_mr_target_freshness.sh
   test_generic_r0_leak_scan.sh
+  test_shared_git_surface_gate.sh
+  test_extraction_review_gate.sh
+  test_validate_extraction_review_state.sh
   test_check_ccl_route_drift.sh
   test_check_sync_pointers.sh
   test_check_ccl_register_pending_exclusion.sh
@@ -138,7 +149,10 @@ fast_tests=(
   test_regression_runner_lanes.sh
   test_routing_pointer_integrity.sh
   test_routing_bank_integrity.sh
+  test_uiux_delivery_contract.sh
+  test_uiux_loading_budget.sh
   test_governing_chain_diff.sh
+  test_obligation_ledger.sh
   # Owned by another skill package; run_test resolves it relative to SCRIPTS_DIR.
   # Registered here because this runner is the repo's only regression lane —
   # a skill-local test left unregistered is the false-green this file guards.
@@ -148,6 +162,11 @@ fast_tests=(
 heavy_tests=(
   test_check_ccl_r0_status.sh
   test_entrypoint_domain_scan_terms.sh
+  # Audits the REAL specs/065 mapping/ledger against the base SHA pinned in
+  # the ledger header. Catches carrier drift the synthetic obligation-ledger
+  # fixtures cannot see. Needs full history and walks a 1240-row real corpus,
+  # so it stays out of the pre-commit lane; CI --full enforces it.
+  test_obligation_ledger_repo_audit.sh
   test_check_ccl_source_register_lifecycle.sh
   # Clones the whole repo once; impact-chain cases call the standalone gate and
   # retain one full-checker wiring case. Still kept out of the pre-commit lane.

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_skill_catalog.sh

@@ -27,6 +27,7 @@ unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_OBJECT_DIRECTORY \
 #   c10 a row whose only clause is a redirect        => skill_catalog_missing_use_line
 #   c11 a leaf routed in the always-on layer         => skill_bootstrap_leaf_in_region
 #   c12 unset base override covers upstream/fallback x empty/changed diff
+#   c13 candidate-only skills and task banks are snapshotted, not read from HEAD
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel)"
@@ -37,6 +38,8 @@ CASE_INDEX=0
 
 # Each case gets its own clone so a mutation cannot leak into the next one.
 new_case() {
+  local candidate_skill_root="${1:-$REPO_ROOT}"
+  local candidate_eval_root="${2:-$REPO_ROOT}"
   CASE_INDEX=$((CASE_INDEX + 1))
   CASE_DIR="$TEST_ROOT/case$CASE_INDEX"
   git clone --quiet --no-local "$REPO_ROOT" "$CASE_DIR"
@@ -50,12 +53,17 @@ new_case() {
     exit 1
   }
   git -C "$CASE_DIR" update-ref refs/heads/ccl-test-base FETCH_HEAD
-  # The clone carries the default branch; copy the working-tree versions of the
-  # three files under test so the gate runs against what is about to land.
+  # The clone carries committed HEAD, while a newly added or removed skill or
+  # eval row can still exist only in the candidate working tree. Snapshot both
+  # owner roots and task banks so the pristine arm tests the tree that is about
+  # to land, not candidate contracts paired with old evaluation surfaces.
+  rm -rf "$CASE_DIR/skills"
+  mkdir -p "$CASE_DIR/skills"
+  cp -R "$candidate_skill_root/skills/." "$CASE_DIR/skills/"
   cp "$REPO_ROOT/docs/SKILLS.md" "$CASE_DIR/docs/SKILLS.md"
   cp "$REPO_ROOT/agent-context/session-start.md" "$CASE_DIR/agent-context/session-start.md"
-  cp "$REPO_ROOT/skills/skill-extraction-workflow/scripts/check-ccl-skills.sh" \
-    "$CASE_DIR/skills/skill-extraction-workflow/scripts/check-ccl-skills.sh"
+  cp "$candidate_eval_root/eval/routing-tasks.jsonl" "$CASE_DIR/eval/routing-tasks.jsonl"
+  cp "$candidate_eval_root/eval/behavior-fixtures.jsonl" "$CASE_DIR/eval/behavior-fixtures.jsonl"
 }
 
 run_case() {
@@ -495,4 +503,33 @@ expect_base_alias_tags_removed c12-fallback-changed
 run_with_hostile_git_context run_case_with_default_base || :
 expect_changed_entrypoint_warning c12-fallback-changed "$DEFAULT_CHANGED_SKILL"
 
+# c13 — a pristine candidate may contain skill roots and task-bank rows that do
+# not exist at committed HEAD yet. Prove new_case copies all three candidate
+# surfaces. The markers stay only in TEST_ROOT and never enter a checker run.
+CANDIDATE_ROOT="$TEST_ROOT/candidate-root"
+mkdir -p "$CANDIDATE_ROOT/eval" \
+  "$CANDIDATE_ROOT/skills/catalog-candidate-snapshot"
+printf '%s\n' 'catalog-candidate-skill-snapshot' \
+  >"$CANDIDATE_ROOT/skills/catalog-candidate-snapshot/marker.txt"
+cp "$REPO_ROOT/eval/routing-tasks.jsonl" "$CANDIDATE_ROOT/eval/routing-tasks.jsonl"
+cp "$REPO_ROOT/eval/behavior-fixtures.jsonl" "$CANDIDATE_ROOT/eval/behavior-fixtures.jsonl"
+printf '%s\n' '{"id":"route-catalog-candidate-snapshot"}' \
+  >>"$CANDIDATE_ROOT/eval/routing-tasks.jsonl"
+printf '%s\n' '{"id":"F-catalog-candidate-snapshot"}' \
+  >>"$CANDIDATE_ROOT/eval/behavior-fixtures.jsonl"
+new_case "$CANDIDATE_ROOT" "$CANDIDATE_ROOT"
+grep -Fq 'catalog-candidate-skill-snapshot' \
+  "$CASE_DIR/skills/catalog-candidate-snapshot/marker.txt" || {
+  echo 'FAIL[c13]: candidate skill roots were not snapshotted' >&2
+  exit 1
+}
+grep -Fq 'route-catalog-candidate-snapshot' "$CASE_DIR/eval/routing-tasks.jsonl" || {
+  echo 'FAIL[c13]: candidate routing bank was not snapshotted' >&2
+  exit 1
+}
+grep -Fq 'F-catalog-candidate-snapshot' "$CASE_DIR/eval/behavior-fixtures.jsonl" || {
+  echo 'FAIL[c13]: candidate behavior bank was not snapshotted' >&2
+  exit 1
+}
+
 echo "test_check_ccl_skill_catalog: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_ci_checkout_ref_binding.sh

@@ -42,6 +42,34 @@ import re, sys
 path, jobs = sys.argv[1], sys.argv[2:]
 src = open(path, encoding="utf8").read()
 
+# PR text is mutable without a new commit. The metadata gate must rerun when a
+# title or body edit is the only event, not only when the branch SHA changes.
+trigger = re.search(r"^  pull_request:\s*\n((?: {4}.*\n)*)", src, re.M)
+if trigger is None or not re.search(r"\bedited\b", trigger.group(1)):
+    print(
+        "FAIL: pull_request trigger does not include `edited`; PR text changes "
+        "would bypass the shared Git/PR metadata gate",
+        file=sys.stderr,
+    )
+    sys.exit(1)
+
+# The shared metadata gate is also the backstop for authorized direct landing
+# pushes. Both landing branches must trigger CI; the local hook is opt-in.
+push_trigger = re.search(r"^  push:\s*\n((?: {4}.*\n)*)", src, re.M)
+branches = set()
+if push_trigger is not None:
+    branch_row = re.search(r"branches:\s*\[([^]]*)\]", push_trigger.group(1))
+    if branch_row is not None:
+        branches = {item.strip() for item in branch_row.group(1).split(",") if item.strip()}
+missing_push_branches = {"dev", "main"} - branches
+if missing_push_branches:
+    print(
+        "FAIL: push trigger does not cover landing branch(es): "
+        + ", ".join(sorted(missing_push_branches)),
+        file=sys.stderr,
+    )
+    sys.exit(1)
+
 # Split the jobs: mapping stanza at exactly two spaces of indent.
 job_starts = [(m.start(), m.group(1)) for m in re.finditer(r"^  ([A-Za-z0-9_-]+):$", src, re.M)]
 if not job_starts:
@@ -76,10 +104,102 @@ for job in jobs:
     if "fetch-depth: 0" not in body:
         failures.append(f"{job}: no full history, so the gate cannot resolve its base")
 
+repository_body = bounds.get("repository-gates", "")
+step_start = re.search(
+    r"^      - name:\s*Repository gate suite\s*$", repository_body, re.M
+)
+repository_step = ""
+if step_start is None:
+    failures.append(
+        "repository-gates: `Repository gate suite` step is missing"
+    )
+else:
+    next_step = re.search(r"^      - ", repository_body[step_start.end() :], re.M)
+    step_end = (
+        step_start.end() + next_step.start()
+        if next_step is not None
+        else len(repository_body)
+    )
+    repository_step = repository_body[step_start.start() : step_end]
+
+if repository_step:
+    if not re.search(
+        r"^\s+CANDIDATE_BASE_REF:\s*\$\{\{\s*"
+        r"github\.event\.pull_request\.base\.sha\s*\|\|\s*"
+        r"github\.event\.before\s*\}\}\s*$",
+        repository_step,
+        re.M,
+    ):
+        failures.append(
+            "repository-gates: `Repository gate suite` does not bind the PR "
+            "base SHA with the pre-push event fallback; the commit range could "
+            "collapse to HEAD and silently scan zero candidate commits"
+        )
+    if not re.search(
+        r'^\s+if\s+\[\[\s+-n\s+"\$CANDIDATE_BASE_REF"\s+\]\]\s+&&\s+'
+        r'git\s+merge-base\s+"\$CANDIDATE_BASE_REF"\s+HEAD\s+'
+        r'>/dev/null\s+2>&1;\s+then\s*$\n'
+        r'^\s+export\s+CCL_SKILL_BASE_REF="\$CANDIDATE_BASE_REF"\s*$\n'
+        r'^\s+fi\s*$\n'
+        r"^\s+make test-repo-gates\s*$",
+        repository_step,
+        re.M,
+    ):
+        failures.append(
+            "repository-gates: `Repository gate suite` must validate the "
+            "candidate base, export it, then invoke `make test-repo-gates` in "
+            "that order; otherwise the metadata gate can scan the wrong range"
+        )
+
 if failures:
     for f in failures:
         print(f"FAIL: {f}", file=sys.stderr)
     sys.exit(1)
 PY
 
+default_make_dry_run="$(make --no-print-directory -n -C "$ROOT" test-repo-gates)"
+override_make_dry_run="$(
+  make --no-print-directory -n -C "$ROOT" \
+    CCL_SKILL_DEFAULT_BASE_REF=refs/remotes/upstream/dev test-repo-gates
+)"
+python3 - "$default_make_dry_run" "$override_make_dry_run" <<'PY'
+import shlex
+import sys
+
+
+def default_base(dry_run: str) -> str:
+    commands = [
+        line
+        for line in dry_run.splitlines()
+        if "shared_git_surface_gate.py" in line
+    ]
+    if len(commands) != 1:
+        raise SystemExit(
+            "FAIL: test-repo-gates must invoke the shared Git/PR metadata gate once"
+        )
+    tokens = shlex.split(commands[0])
+    if tokens.count("--default-base-ref") != 1:
+        raise SystemExit(
+            "FAIL: test-repo-gates must pass exactly one --default-base-ref"
+        )
+    index = tokens.index("--default-base-ref")
+    if index + 1 >= len(tokens):
+        raise SystemExit("FAIL: --default-base-ref has no value")
+    return tokens[index + 1]
+
+
+default_value = default_base(sys.argv[1])
+override_value = default_base(sys.argv[2])
+if default_value != "origin/dev":
+    raise SystemExit(
+        f"FAIL: test-repo-gates compatibility default is {default_value!r}, "
+        "expected 'origin/dev'"
+    )
+if override_value != "refs/remotes/upstream/dev":
+    raise SystemExit(
+        f"FAIL: caller default-base override resolved to {override_value!r}, "
+        "expected 'refs/remotes/upstream/dev'"
+    )
+PY
+
 echo "test_ci_checkout_ref_binding: ok (gate lanes judge the branch head, not the merge ref)"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_entrypoint_domain_scan_terms.sh

@@ -13,8 +13,12 @@
 #   Leg 1 (wiring)   : the real checker runs the scan and reports it clean here.
 #   Leg 2 (predicate): the retained terms still MATCH — the scan can still fail.
 #   Leg 3 (predicate): the retired term does NOT match — the retirement holds.
-# Legs 2-3 read the pattern out of the real script, so they cannot drift away
-# from what ships; extraction failure is a hard error, never a silent pass.
+#   Leg 4 (public IDs): canonical DOI/W3C identifiers pass; arbitrary paths,
+#                      attached IDs, query/fragment IDs, noncanonical hosts, and
+#                      another long ID on the same line all still fail.
+#   Leg 5 (failure): a planted retained-domain term prevents certification.
+# Legs 2-3 read the lexical pattern out of the real script, so they cannot drift
+# away from what ships; extraction failure is a hard error, never a silent pass.
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -60,20 +64,16 @@ retained=(
 for term in "${retained[@]}"; do
   matches "x ${term} y" || fail "retained domain term no longer matches — the scan was widened/broken, not narrowed"
 done
-# Non-vocabulary alternatives in the same pattern must also still bite.
+# Non-vocabulary host alternatives in the same pattern must also still bite.
 matches 'see code.example-host.internal for details' \
   || fail "host-style leak alternative no longer matches"
-matches 'ref 123456789' || fail "long-digit alternative no longer matches"
 
 # --- Leg 3: the retired term must NOT match, in ordinary prose.
 retired=$'扫描'
 ! matches "先跑一遍${retired}再判" \
   || fail "retired term still blocks ordinary prose; the retirement did not land"
 
-# --- Leg 4: the checker must still FAIL end-to-end on a planted leak.
-#     Legs 1-3 alone cannot see a broken conditional: leg 1 only proves the clean
-#     sentinel prints, legs 2-3 exercise the regex in isolation. Without this leg
-#     an inverted or bypassed failure branch would keep the whole suite green.
+# --- Leg 4: public identifier allowlist is precise, not line-wide.
 #     Runs against a throwaway --shared clone so the real tree is never written.
 TMP="$(mktemp -d "${TMPDIR:-/tmp}/domscan.XXXXXX")"
 trap 'rm -rf "$TMP"' EXIT
@@ -95,6 +95,80 @@ case "$ctl" in
 esac
 probe_dir="$TMP/repo/skills/tighten-doc/references"
 [ -d "$probe_dir" ] || fail "clone has no reference dir to plant the probe in: $probe_dir"
+public_probe="$probe_dir/_public_identifier_probe.md"
+printf '%s\n' \
+  '# public identifiers' \
+  'https://doi.org/10.1207/s15516709cog1202_4' \
+  'https://doi.org/10.1038/35057062' \
+  'https://www.w3.org/community/reports/design-tokens/CG-FINAL-format-20251028/' \
+  > "$public_probe"
+set +e
+public_out="$(bash "$CHECK_SCRIPT" "$TMP/repo" 2>&1)"
+public_rc=$?
+set -e
+[ "$public_rc" -eq 0 ] || fail "canonical public DOI/W3C identifiers were rejected\n$public_out"
+case "$public_out" in
+  *entrypoint_and_reference_domain_scan_ok*) : ;;
+  *) fail "public-identifier fixture did not reach the clean domain sentinel\n$public_out" ;;
+esac
+
+printf '%s\n' \
+  '# invalid public-identifier shapes' \
+  'same-line-id 123456789 https://doi.org/10.1207/s15516709cog1202_4' \
+  'arbitrary-doi-path https://doi.org/not-a-doi/123456789' \
+  'arbitrary-report-path https://www.w3.org/community/reports/not-a-report/123456789' \
+  'query-id https://doi.org/10.1207/s15516709cog1202_4?object=123456789' \
+  'fragment-id https://doi.org/10.1207/s15516709cog1202_4#123456789' \
+  'noncanonical-host https://doi.example.org/10.1207/123456789' \
+  'attached-report-id https://www.w3.org/community/reports/design-tokens/CG-FINAL-format-20251028/123456789' \
+  'laundered-suffix-id https://doi.org/10.1234/20260830123456' \
+  'split-run-id https://doi.org/10.1234/123456789-123456789' \
+  'split-timestamp-id https://doi.org/10.1234/20260830-123456' \
+  'double-separator-id https://doi.org/10.1234/20260830--123456' \
+  'plus-split-id https://doi.org/10.1234/123456789+123456789' \
+  'colon-split-id https://doi.org/10.1234/123456789:123456789' \
+  'report-name-id https://www.w3.org/community/reports/design-tokens/CG-FINAL-123456789-format-20251028/' \
+  'registrant-id https://doi.org/10.123456789/abc' \
+  > "$public_probe"
+set +e
+numeric_out="$(bash "$CHECK_SCRIPT" "$TMP/repo" 2>&1)"
+numeric_rc=$?
+set -e
+[ "$numeric_rc" -ne 0 ] || fail "an invalid public-identifier shape escaped the scan"
+case "$numeric_out" in
+  *entrypoint_or_reference_domain_scan_failed*) : ;;
+  *) fail "long-ID fixture did not raise the domain-scan failure token\n$numeric_out" ;;
+esac
+case "$numeric_out" in
+  *_public_identifier_probe.md*) : ;;
+  *) fail "long-ID failure did not name the public-identifier fixture\n$numeric_out" ;;
+esac
+for marker in \
+  same-line-id \
+  arbitrary-doi-path \
+  arbitrary-report-path \
+  query-id \
+  fragment-id \
+  noncanonical-host \
+  attached-report-id \
+  laundered-suffix-id \
+  split-run-id \
+  split-timestamp-id \
+  double-separator-id \
+  plus-split-id \
+  colon-split-id \
+  report-name-id \
+  registrant-id; do
+  case "$numeric_out" in
+    *"$marker"*) : ;;
+    *) fail "invalid identifier class escaped the scan: $marker\n$numeric_out" ;;
+  esac
+done
+rm "$public_probe"
+
+# --- Leg 5: the checker must still FAIL end-to-end on a planted lexical leak.
+#     Legs 1-4 cannot see a broken lexical failure branch. Without this leg an
+#     inverted or bypassed conditional would keep the whole suite green.
 printf '# probe\n\nx %s y\n' "${retained[0]}" > "$probe_dir/_domain_scan_probe.md"
 set +e
 e2e="$(bash "$CHECK_SCRIPT" "$TMP/repo" 2>&1)"