@ccoalm/ccl-skills 0.7.0 → 0.9.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -16,6 +16,9 @@
 #   - test_check_ccl_skill_catalog.sh
 #   - test_check_ccl_parallel_stack_parity.sh
 #   - test_generic_r0_leak_scan.sh
+#   - test_shared_git_surface_gate.sh
+#   - test_extraction_review_gate.sh
+#   - test_validate_extraction_review_state.sh
 #   - test_check_ccl_route_drift.sh
 #   - test_check_sync_pointers.sh
 #   - test_check_ccl_register_pending_exclusion.sh
@@ -25,6 +28,9 @@
 #   - test_validate_skill_credential_cwd.sh
 #   - test_validate_skill_root_depth.sh
 #   - test_regression_runner_registration.sh
+#   - test_uiux_delivery_contract.sh
+#   - test_uiux_loading_budget.sh
+#   - test_obligation_ledger.sh
 # --full runs --fast plus the heavy full-checker regressions:
 #   - test_check_ccl_r0_status.sh
 #   - test_check_ccl_source_register_lifecycle.sh
@@ -105,6 +111,9 @@ fast_tests=(
   test_check_ccl_parallel_stack_parity.sh
   test_check_mr_target_freshness.sh
   test_generic_r0_leak_scan.sh
+  test_shared_git_surface_gate.sh
+  test_extraction_review_gate.sh
+  test_validate_extraction_review_state.sh
   test_check_ccl_route_drift.sh
   test_check_sync_pointers.sh
   test_check_ccl_register_pending_exclusion.sh
@@ -140,7 +149,10 @@ fast_tests=(
   test_regression_runner_lanes.sh
   test_routing_pointer_integrity.sh
   test_routing_bank_integrity.sh
+  test_uiux_delivery_contract.sh
+  test_uiux_loading_budget.sh
   test_governing_chain_diff.sh
+  test_obligation_ledger.sh
   # Owned by another skill package; run_test resolves it relative to SCRIPTS_DIR.
   # Registered here because this runner is the repo's only regression lane —
   # a skill-local test left unregistered is the false-green this file guards.
@@ -150,6 +162,11 @@ fast_tests=(
 heavy_tests=(
   test_check_ccl_r0_status.sh
   test_entrypoint_domain_scan_terms.sh
+  # Audits the REAL specs/065 mapping/ledger against the base SHA pinned in
+  # the ledger header. Catches carrier drift the synthetic obligation-ledger
+  # fixtures cannot see. Needs full history and walks a 1240-row real corpus,
+  # so it stays out of the pre-commit lane; CI --full enforces it.
+  test_obligation_ledger_repo_audit.sh
   test_check_ccl_source_register_lifecycle.sh
   # Clones the whole repo once; impact-chain cases call the standalone gate and
   # retain one full-checker wiring case. Still kept out of the pre-commit lane.

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_skill_catalog.sh

@@ -27,6 +27,7 @@ unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_OBJECT_DIRECTORY \
 #   c10 a row whose only clause is a redirect        => skill_catalog_missing_use_line
 #   c11 a leaf routed in the always-on layer         => skill_bootstrap_leaf_in_region
 #   c12 unset base override covers upstream/fallback x empty/changed diff
+#   c13 candidate-only skills and task banks are snapshotted, not read from HEAD
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel)"
@@ -37,6 +38,8 @@ CASE_INDEX=0
 
 # Each case gets its own clone so a mutation cannot leak into the next one.
 new_case() {
+  local candidate_skill_root="${1:-$REPO_ROOT}"
+  local candidate_eval_root="${2:-$REPO_ROOT}"
   CASE_INDEX=$((CASE_INDEX + 1))
   CASE_DIR="$TEST_ROOT/case$CASE_INDEX"
   git clone --quiet --no-local "$REPO_ROOT" "$CASE_DIR"
@@ -50,12 +53,17 @@ new_case() {
     exit 1
   }
   git -C "$CASE_DIR" update-ref refs/heads/ccl-test-base FETCH_HEAD
-  # The clone carries the default branch; copy the working-tree versions of the
-  # three files under test so the gate runs against what is about to land.
+  # The clone carries committed HEAD, while a newly added or removed skill or
+  # eval row can still exist only in the candidate working tree. Snapshot both
+  # owner roots and task banks so the pristine arm tests the tree that is about
+  # to land, not candidate contracts paired with old evaluation surfaces.
+  rm -rf "$CASE_DIR/skills"
+  mkdir -p "$CASE_DIR/skills"
+  cp -R "$candidate_skill_root/skills/." "$CASE_DIR/skills/"
   cp "$REPO_ROOT/docs/SKILLS.md" "$CASE_DIR/docs/SKILLS.md"
   cp "$REPO_ROOT/agent-context/session-start.md" "$CASE_DIR/agent-context/session-start.md"
-  cp "$REPO_ROOT/skills/skill-extraction-workflow/scripts/check-ccl-skills.sh" \
-    "$CASE_DIR/skills/skill-extraction-workflow/scripts/check-ccl-skills.sh"
+  cp "$candidate_eval_root/eval/routing-tasks.jsonl" "$CASE_DIR/eval/routing-tasks.jsonl"
+  cp "$candidate_eval_root/eval/behavior-fixtures.jsonl" "$CASE_DIR/eval/behavior-fixtures.jsonl"
 }
 
 run_case() {
@@ -495,4 +503,33 @@ expect_base_alias_tags_removed c12-fallback-changed
 run_with_hostile_git_context run_case_with_default_base || :
 expect_changed_entrypoint_warning c12-fallback-changed "$DEFAULT_CHANGED_SKILL"
 
+# c13 — a pristine candidate may contain skill roots and task-bank rows that do
+# not exist at committed HEAD yet. Prove new_case copies all three candidate
+# surfaces. The markers stay only in TEST_ROOT and never enter a checker run.
+CANDIDATE_ROOT="$TEST_ROOT/candidate-root"
+mkdir -p "$CANDIDATE_ROOT/eval" \
+  "$CANDIDATE_ROOT/skills/catalog-candidate-snapshot"
+printf '%s\n' 'catalog-candidate-skill-snapshot' \
+  >"$CANDIDATE_ROOT/skills/catalog-candidate-snapshot/marker.txt"
+cp "$REPO_ROOT/eval/routing-tasks.jsonl" "$CANDIDATE_ROOT/eval/routing-tasks.jsonl"
+cp "$REPO_ROOT/eval/behavior-fixtures.jsonl" "$CANDIDATE_ROOT/eval/behavior-fixtures.jsonl"
+printf '%s\n' '{"id":"route-catalog-candidate-snapshot"}' \
+  >>"$CANDIDATE_ROOT/eval/routing-tasks.jsonl"
+printf '%s\n' '{"id":"F-catalog-candidate-snapshot"}' \
+  >>"$CANDIDATE_ROOT/eval/behavior-fixtures.jsonl"
+new_case "$CANDIDATE_ROOT" "$CANDIDATE_ROOT"
+grep -Fq 'catalog-candidate-skill-snapshot' \
+  "$CASE_DIR/skills/catalog-candidate-snapshot/marker.txt" || {
+  echo 'FAIL[c13]: candidate skill roots were not snapshotted' >&2
+  exit 1
+}
+grep -Fq 'route-catalog-candidate-snapshot' "$CASE_DIR/eval/routing-tasks.jsonl" || {
+  echo 'FAIL[c13]: candidate routing bank was not snapshotted' >&2
+  exit 1
+}
+grep -Fq 'F-catalog-candidate-snapshot' "$CASE_DIR/eval/behavior-fixtures.jsonl" || {
+  echo 'FAIL[c13]: candidate behavior bank was not snapshotted' >&2
+  exit 1
+}
+
 echo "test_check_ccl_skill_catalog: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_ci_checkout_ref_binding.sh

@@ -42,6 +42,34 @@ import re, sys
 path, jobs = sys.argv[1], sys.argv[2:]
 src = open(path, encoding="utf8").read()
 
+# PR text is mutable without a new commit. The metadata gate must rerun when a
+# title or body edit is the only event, not only when the branch SHA changes.
+trigger = re.search(r"^  pull_request:\s*\n((?: {4}.*\n)*)", src, re.M)
+if trigger is None or not re.search(r"\bedited\b", trigger.group(1)):
+    print(
+        "FAIL: pull_request trigger does not include `edited`; PR text changes "
+        "would bypass the shared Git/PR metadata gate",
+        file=sys.stderr,
+    )
+    sys.exit(1)
+
+# The shared metadata gate is also the backstop for authorized direct landing
+# pushes. Both landing branches must trigger CI; the local hook is opt-in.
+push_trigger = re.search(r"^  push:\s*\n((?: {4}.*\n)*)", src, re.M)
+branches = set()
+if push_trigger is not None:
+    branch_row = re.search(r"branches:\s*\[([^]]*)\]", push_trigger.group(1))
+    if branch_row is not None:
+        branches = {item.strip() for item in branch_row.group(1).split(",") if item.strip()}
+missing_push_branches = {"dev", "main"} - branches
+if missing_push_branches:
+    print(
+        "FAIL: push trigger does not cover landing branch(es): "
+        + ", ".join(sorted(missing_push_branches)),
+        file=sys.stderr,
+    )
+    sys.exit(1)
+
 # Split the jobs: mapping stanza at exactly two spaces of indent.
 job_starts = [(m.start(), m.group(1)) for m in re.finditer(r"^  ([A-Za-z0-9_-]+):$", src, re.M)]
 if not job_starts:
@@ -76,10 +104,102 @@ for job in jobs:
     if "fetch-depth: 0" not in body:
         failures.append(f"{job}: no full history, so the gate cannot resolve its base")
 
+repository_body = bounds.get("repository-gates", "")
+step_start = re.search(
+    r"^      - name:\s*Repository gate suite\s*$", repository_body, re.M
+)
+repository_step = ""
+if step_start is None:
+    failures.append(
+        "repository-gates: `Repository gate suite` step is missing"
+    )
+else:
+    next_step = re.search(r"^      - ", repository_body[step_start.end() :], re.M)
+    step_end = (
+        step_start.end() + next_step.start()
+        if next_step is not None
+        else len(repository_body)
+    )
+    repository_step = repository_body[step_start.start() : step_end]
+
+if repository_step:
+    if not re.search(
+        r"^\s+CANDIDATE_BASE_REF:\s*\$\{\{\s*"
+        r"github\.event\.pull_request\.base\.sha\s*\|\|\s*"
+        r"github\.event\.before\s*\}\}\s*$",
+        repository_step,
+        re.M,
+    ):
+        failures.append(
+            "repository-gates: `Repository gate suite` does not bind the PR "
+            "base SHA with the pre-push event fallback; the commit range could "
+            "collapse to HEAD and silently scan zero candidate commits"
+        )
+    if not re.search(
+        r'^\s+if\s+\[\[\s+-n\s+"\$CANDIDATE_BASE_REF"\s+\]\]\s+&&\s+'
+        r'git\s+merge-base\s+"\$CANDIDATE_BASE_REF"\s+HEAD\s+'
+        r'>/dev/null\s+2>&1;\s+then\s*$\n'
+        r'^\s+export\s+CCL_SKILL_BASE_REF="\$CANDIDATE_BASE_REF"\s*$\n'
+        r'^\s+fi\s*$\n'
+        r"^\s+make test-repo-gates\s*$",
+        repository_step,
+        re.M,
+    ):
+        failures.append(
+            "repository-gates: `Repository gate suite` must validate the "
+            "candidate base, export it, then invoke `make test-repo-gates` in "
+            "that order; otherwise the metadata gate can scan the wrong range"
+        )
+
 if failures:
     for f in failures:
         print(f"FAIL: {f}", file=sys.stderr)
     sys.exit(1)
 PY
 
+default_make_dry_run="$(make --no-print-directory -n -C "$ROOT" test-repo-gates)"
+override_make_dry_run="$(
+  make --no-print-directory -n -C "$ROOT" \
+    CCL_SKILL_DEFAULT_BASE_REF=refs/remotes/upstream/dev test-repo-gates
+)"
+python3 - "$default_make_dry_run" "$override_make_dry_run" <<'PY'
+import shlex
+import sys
+
+
+def default_base(dry_run: str) -> str:
+    commands = [
+        line
+        for line in dry_run.splitlines()
+        if "shared_git_surface_gate.py" in line
+    ]
+    if len(commands) != 1:
+        raise SystemExit(
+            "FAIL: test-repo-gates must invoke the shared Git/PR metadata gate once"
+        )
+    tokens = shlex.split(commands[0])
+    if tokens.count("--default-base-ref") != 1:
+        raise SystemExit(
+            "FAIL: test-repo-gates must pass exactly one --default-base-ref"
+        )
+    index = tokens.index("--default-base-ref")
+    if index + 1 >= len(tokens):
+        raise SystemExit("FAIL: --default-base-ref has no value")
+    return tokens[index + 1]
+
+
+default_value = default_base(sys.argv[1])
+override_value = default_base(sys.argv[2])
+if default_value != "origin/dev":
+    raise SystemExit(
+        f"FAIL: test-repo-gates compatibility default is {default_value!r}, "
+        "expected 'origin/dev'"
+    )
+if override_value != "refs/remotes/upstream/dev":
+    raise SystemExit(
+        f"FAIL: caller default-base override resolved to {override_value!r}, "
+        "expected 'refs/remotes/upstream/dev'"
+    )
+PY
+
 echo "test_ci_checkout_ref_binding: ok (gate lanes judge the branch head, not the merge ref)"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_entrypoint_domain_scan_terms.sh

@@ -13,8 +13,12 @@
 #   Leg 1 (wiring)   : the real checker runs the scan and reports it clean here.
 #   Leg 2 (predicate): the retained terms still MATCH — the scan can still fail.
 #   Leg 3 (predicate): the retired term does NOT match — the retirement holds.
-# Legs 2-3 read the pattern out of the real script, so they cannot drift away
-# from what ships; extraction failure is a hard error, never a silent pass.
+#   Leg 4 (public IDs): canonical DOI/W3C identifiers pass; arbitrary paths,
+#                      attached IDs, query/fragment IDs, noncanonical hosts, and
+#                      another long ID on the same line all still fail.
+#   Leg 5 (failure): a planted retained-domain term prevents certification.
+# Legs 2-3 read the lexical pattern out of the real script, so they cannot drift
+# away from what ships; extraction failure is a hard error, never a silent pass.
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -60,20 +64,16 @@ retained=(
 for term in "${retained[@]}"; do
   matches "x ${term} y" || fail "retained domain term no longer matches — the scan was widened/broken, not narrowed"
 done
-# Non-vocabulary alternatives in the same pattern must also still bite.
+# Non-vocabulary host alternatives in the same pattern must also still bite.
 matches 'see code.example-host.internal for details' \
   || fail "host-style leak alternative no longer matches"
-matches 'ref 123456789' || fail "long-digit alternative no longer matches"
 
 # --- Leg 3: the retired term must NOT match, in ordinary prose.
 retired=$'扫描'
 ! matches "先跑一遍${retired}再判" \
   || fail "retired term still blocks ordinary prose; the retirement did not land"
 
-# --- Leg 4: the checker must still FAIL end-to-end on a planted leak.
-#     Legs 1-3 alone cannot see a broken conditional: leg 1 only proves the clean
-#     sentinel prints, legs 2-3 exercise the regex in isolation. Without this leg
-#     an inverted or bypassed failure branch would keep the whole suite green.
+# --- Leg 4: public identifier allowlist is precise, not line-wide.
 #     Runs against a throwaway --shared clone so the real tree is never written.
 TMP="$(mktemp -d "${TMPDIR:-/tmp}/domscan.XXXXXX")"
 trap 'rm -rf "$TMP"' EXIT
@@ -95,6 +95,80 @@ case "$ctl" in
 esac
 probe_dir="$TMP/repo/skills/tighten-doc/references"
 [ -d "$probe_dir" ] || fail "clone has no reference dir to plant the probe in: $probe_dir"
+public_probe="$probe_dir/_public_identifier_probe.md"
+printf '%s\n' \
+  '# public identifiers' \
+  'https://doi.org/10.1207/s15516709cog1202_4' \
+  'https://doi.org/10.1038/35057062' \
+  'https://www.w3.org/community/reports/design-tokens/CG-FINAL-format-20251028/' \
+  > "$public_probe"
+set +e
+public_out="$(bash "$CHECK_SCRIPT" "$TMP/repo" 2>&1)"
+public_rc=$?
+set -e
+[ "$public_rc" -eq 0 ] || fail "canonical public DOI/W3C identifiers were rejected\n$public_out"
+case "$public_out" in
+  *entrypoint_and_reference_domain_scan_ok*) : ;;
+  *) fail "public-identifier fixture did not reach the clean domain sentinel\n$public_out" ;;
+esac
+
+printf '%s\n' \
+  '# invalid public-identifier shapes' \
+  'same-line-id 123456789 https://doi.org/10.1207/s15516709cog1202_4' \
+  'arbitrary-doi-path https://doi.org/not-a-doi/123456789' \
+  'arbitrary-report-path https://www.w3.org/community/reports/not-a-report/123456789' \
+  'query-id https://doi.org/10.1207/s15516709cog1202_4?object=123456789' \
+  'fragment-id https://doi.org/10.1207/s15516709cog1202_4#123456789' \
+  'noncanonical-host https://doi.example.org/10.1207/123456789' \
+  'attached-report-id https://www.w3.org/community/reports/design-tokens/CG-FINAL-format-20251028/123456789' \
+  'laundered-suffix-id https://doi.org/10.1234/20260830123456' \
+  'split-run-id https://doi.org/10.1234/123456789-123456789' \
+  'split-timestamp-id https://doi.org/10.1234/20260830-123456' \
+  'double-separator-id https://doi.org/10.1234/20260830--123456' \
+  'plus-split-id https://doi.org/10.1234/123456789+123456789' \
+  'colon-split-id https://doi.org/10.1234/123456789:123456789' \
+  'report-name-id https://www.w3.org/community/reports/design-tokens/CG-FINAL-123456789-format-20251028/' \
+  'registrant-id https://doi.org/10.123456789/abc' \
+  > "$public_probe"
+set +e
+numeric_out="$(bash "$CHECK_SCRIPT" "$TMP/repo" 2>&1)"
+numeric_rc=$?
+set -e
+[ "$numeric_rc" -ne 0 ] || fail "an invalid public-identifier shape escaped the scan"
+case "$numeric_out" in
+  *entrypoint_or_reference_domain_scan_failed*) : ;;
+  *) fail "long-ID fixture did not raise the domain-scan failure token\n$numeric_out" ;;
+esac
+case "$numeric_out" in
+  *_public_identifier_probe.md*) : ;;
+  *) fail "long-ID failure did not name the public-identifier fixture\n$numeric_out" ;;
+esac
+for marker in \
+  same-line-id \
+  arbitrary-doi-path \
+  arbitrary-report-path \
+  query-id \
+  fragment-id \
+  noncanonical-host \
+  attached-report-id \
+  laundered-suffix-id \
+  split-run-id \
+  split-timestamp-id \
+  double-separator-id \
+  plus-split-id \
+  colon-split-id \
+  report-name-id \
+  registrant-id; do
+  case "$numeric_out" in
+    *"$marker"*) : ;;
+    *) fail "invalid identifier class escaped the scan: $marker\n$numeric_out" ;;
+  esac
+done
+rm "$public_probe"
+
+# --- Leg 5: the checker must still FAIL end-to-end on a planted lexical leak.
+#     Legs 1-4 cannot see a broken lexical failure branch. Without this leg an
+#     inverted or bypassed conditional would keep the whole suite green.
 printf '# probe\n\nx %s y\n' "${retained[0]}" > "$probe_dir/_domain_scan_probe.md"
 set +e
 e2e="$(bash "$CHECK_SCRIPT" "$TMP/repo" 2>&1)"