@ccoalm/ccl-skills 0.8.0 → 0.10.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# Deterministic contract tests for eval/body-compliance-eval.rb — no live model.
+#
+# Covers the grading legs a live advisory run cannot regress-guard:
+#   G1 required-only verdict passes; G2 forbidden marker fails with forbidden_hit;
+#   G3 a marker immediately closed by a backtick/quote is a mention, not a verdict;
+#   G4 leading markdown decoration is accepted; G5 a mid-sentence prose marker
+#   does not count; G6 the differential holds in both directions (a continue
+#   probe fails on a blocked verdict).
+#   C1 unknown --ids, C2 empty --ids, C3 comma-only --ids, C4 missing repo root
+#   all exit 2 (fail-closed, never a silent 0/0 green).
+#   E1/E2 end-to-end with a stub `claude` on PATH: denominators scope to the
+#   selected subset (1/1 pass; 0/1 with forbidden_hit reported), exit stays 0
+#   because the lane is advisory by construction.
+# Bash 3.2-safe. Runs against the real repo tree read-only plus a tmp stub dir.
+set -u
+
+script_dir="$(cd "$(dirname "$0")" && pwd -P)"
+repo_root="$(cd "$script_dir/../../.." && pwd -P)"
+runner="$repo_root/eval/body-compliance-eval.rb"
+fails=0
+
+fail() { echo "test_body_compliance_grading FAIL: $1" >&2; fails=$((fails + 1)); }
+
+[ -f "$runner" ] || { echo "test_body_compliance_grading FAIL: runner missing at $runner" >&2; exit 1; }
+
+# G1-G6: grade() unit walk through the library require path.
+if ! ruby -e '
+  require_relative ARGV[0]
+  stop = PROBES.find { |p| p[:id] == "prd-stop-materially" } or abort "stop probe missing"
+  cont = PROBES.find { |p| p[:id] == "prd-continue-evidenced" } or abort "continue probe missing"
+  checks = []
+  checks << ["G1", grade(stop, "blocked: 两方案无占优，停给用户")[:status] == "PASS"]
+  g2 = grade(stop, "blocked: x\ncontinuing: y")
+  checks << ["G2", g2[:status] == "FAIL" && !g2[:forbidden_hit].empty?]
+  checks << ["G3", grade(stop, "`blocked:` is the label I would use")[:status] == "FAIL"]
+  checks << ["G4", grade(stop, "**blocked:** 加粗裁决")[:status] == "PASS"]
+  checks << ["G4b", grade(stop, "`blocked: 整行反引号裁决`")[:status] == "PASS"]
+  checks << ["G5", grade(stop, "他说 blocked: 不该出现在这里")[:status] == "FAIL"]
+  g6 = grade(cont, "blocked: 反向裁决")
+  checks << ["G6", g6[:status] == "FAIL" && !g6[:forbidden_hit].empty?]
+  bad = checks.reject { |_, ok| ok }
+  abort("grade walk failed: #{bad.map(&:first).join(",")}") unless bad.empty?
+  puts "grade walk ok (#{checks.length} cases)"
+' "$runner"; then
+  fail "grade() unit walk"
+fi
+
+# C1-C4: fail-closed CLI legs (no model involved; the runner must exit 2
+# before any probe would run).
+ruby "$runner" "$repo_root" --ids no-such-probe >/dev/null 2>&1
+[ $? -eq 2 ] || fail "unknown --ids did not exit 2"
+ruby "$runner" "$repo_root" --ids '' >/dev/null 2>&1
+[ $? -eq 2 ] || fail "empty --ids did not exit 2"
+ruby "$runner" "$repo_root" --ids ',' >/dev/null 2>&1
+[ $? -eq 2 ] || fail "comma-only --ids did not exit 2"
+ruby "$runner" >/dev/null 2>&1
+[ $? -eq 2 ] || fail "missing repo root did not exit 2"
+ruby "$runner" "$repo_root" --ids >/dev/null 2>&1
+[ $? -eq 2 ] || fail "bare --ids (no value) did not exit 2"
+ruby "$runner" "$repo_root" --ids --timeout >/dev/null 2>&1
+[ $? -eq 2 ] || fail "--ids followed by another flag did not exit 2"
+
+# E1/E2: end-to-end with a stub claude — proves subset denominators and the
+# forbidden_hit report line without a live model.
+stub_dir="$(mktemp -d "${TMPDIR:-/tmp}/bodycomp.XXXXXX")" || { fail "mktemp"; echo "test_body_compliance_grading: $fails failure(s)"; exit 1; }
+trap 'rm -rf "$stub_dir"' EXIT
+cat > "$stub_dir/claude" <<'STUB'
+#!/bin/sh
+cat > /dev/null
+printf '%s\n' "$BODY_COMPLIANCE_STUB_LINE"
+STUB
+chmod +x "$stub_dir/claude"
+
+e1_out="$(BODY_COMPLIANCE_STUB_LINE='continuing: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --timeout 30 2>&1)"
+e1_rc=$?
+case "$e1_out" in
+  *"1/1 pass"*) : ;;
+  *) fail "E1 expected 1/1 pass, got: $e1_out" ;;
+esac
+[ "$e1_rc" -eq 0 ] || fail "E1 advisory run exited $e1_rc"
+
+e2_out="$(BODY_COMPLIANCE_STUB_LINE='blocked: 桩裁决' PATH="$stub_dir:$PATH" ruby "$runner" "$repo_root" --ids prd-continue-evidenced --timeout 30 2>&1)"
+e2_rc=$?
+case "$e2_out" in
+  *"0/1 pass, 1 fail"*) : ;;
+  *) fail "E2 expected 0/1 pass, 1 fail, got: $e2_out" ;;
+esac
+case "$e2_out" in
+  *forbidden_hit=*) : ;;
+  *) fail "E2 expected a forbidden_hit report line, got: $e2_out" ;;
+esac
+[ "$e2_rc" -eq 0 ] || fail "E2 advisory run exited $e2_rc"
+
+if [ "$fails" -gt 0 ]; then
+  echo "test_body_compliance_grading: $fails failure(s)" >&2
+  exit 1
+fi
+echo "test_body_compliance_grading_ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -114,6 +114,9 @@ fast_tests=(
   test_shared_git_surface_gate.sh
   test_extraction_review_gate.sh
   test_validate_extraction_review_state.sh
+  # Candidate-SHA-bound gate receipts (mint/verify): own throwaway git repo,
+  # no clone, seconds — belongs in the lane every run exercises.
+  test_gate_receipt.sh
   test_check_ccl_route_drift.sh
   test_check_sync_pointers.sh
   test_check_ccl_register_pending_exclusion.sh
@@ -137,6 +140,13 @@ fast_tests=(
   test_validate_skill_cross_refs.sh
   test_git_identity_predicate_gate.sh
   test_liveness_predicate_gate.sh
+  # 074: contract-anchor gate self-proof (tmp fixtures + one real-repo leg,
+  # seconds) and the anti-patterns panel structural check (awk over one file).
+  test_check_contract_anchors.sh
+  test_antipattern_grep_panel.sh
+  # 075: body-compliance grading contract (grade() walk, fail-closed --ids legs,
+  # stub-model denominator/forbidden_hit legs; deterministic, seconds).
+  test_body_compliance_grading.sh
   test_regression_runner_registration.sh
   # Harness binding for the gate lanes themselves: the impact-chain gate's
   # round walk needs the branch's own first-parent chain, which the default
@@ -149,6 +159,14 @@ fast_tests=(
   test_regression_runner_lanes.sh
   test_routing_pointer_integrity.sh
   test_routing_bank_integrity.sh
+  # 077: frozen-case sanctity (regressions-are-sacred) — base-relative guard
+  # that a deleted/re-scoped bank case or golden trace names its adjudication
+  # row; degrades to an explicit skip token without CCL_SKILL_BASE_REF. The
+  # selfproof lane proves the oracle fails for the right reason (synthetic
+  # repo: deletion/re-scope/nested-trace mutants red, forged-credit legs red,
+  # adjudicated and control legs green).
+  test_frozen_case_sanctity.sh
+  test_frozen_case_sanctity_selfproof.sh
   test_uiux_delivery_contract.sh
   test_uiux_loading_budget.sh
   test_governing_chain_diff.sh
@@ -195,6 +213,13 @@ heavy_tests=(
   # 「跳过义务会不会留下可检出的缺席」——044 连续五轮 challenge 都停在这一点上，负向
   # 用例（缺证据、非枚举值、降范围无留痕）必须每轮都跑，否则触发器会悄悄退化成声称。
   test_impact_chain_self_adjudication.sh
+  # 074: one applied deletion mutation per pinned-phrase gate family, each leg
+  # running the FULL shipped checker against a committed fixture copy of the
+  # working tree (6 full-gate runs — far too slow for pre-commit). Proves the
+  # ~40 required_phrase pins and the contract-anchor delegation can actually
+  # go red for the right reason; the fast lane keeps the checker-level
+  # self-proof in test_check_contract_anchors.sh.
+  test_pinned_phrase_mutation_walk.sh
 )
 
 # Registration self-audit: every sibling test_*.sh must appear in fast_tests or

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_size_budget.sh

@@ -817,6 +817,257 @@ assert_contains "entrypoint_word_budget_block_partial: skills/demo-skill/SKILL.m
 assert_contains "entrypoint_word_budget_blocking_failed" "$out" "word-budget partial emits failed marker"
 assert_not_contains "entrypoint_word_budget_blocking_ok" "$out" "unknown baseline never earns a word-budget pass"
 
+# ---------------------------------------------------------------------------
+# Reference-file line ratchet (fresh repo): a NEW or crossing reference over 500
+# physical lines blocks; a historical over-limit reference may stay level or
+# shrink but not grow; the append-only ledger is excluded by gate design; an
+# unresolvable base fails closed; a long new reference without ## structure
+# draws an advisory, never a block.
+REF_REPO="$TMP/repo-reference-lines"
+mkdir -p "$REF_REPO/skills/demo-skill/references" "$REF_REPO/skills/legacy-skill/references"
+git init -q -b main "$REF_REPO"
+git -C "$REF_REPO" config user.email test@example.invalid
+git -C "$REF_REPO" config user.name "Test User"
+
+write_skill_stub() { # <skill-dir>
+  {
+    printf -- '---\nname: %s\ndescription: reference line-ratchet fixture.\n---\n\n' "$(basename "$1")"
+    printf -- 'Body pointer to references.\n'
+  } > "$1/SKILL.md"
+}
+write_reference_lines() { # <path> <line-count> [--no-headings]
+  local n="$2" i
+  : > "$1"
+  if [ "${3:-}" != "--no-headings" ]; then
+    printf -- '# Fixture reference\n\n## Section one\n' >> "$1"
+    i=3
+  else
+    i=0
+  fi
+  while [ "$i" -lt "$n" ]; do
+    printf -- 'line %s\n' "$i" >> "$1"
+    i=$((i + 1))
+  done
+}
+
+write_skill_stub "$REF_REPO/skills/demo-skill"
+write_skill_stub "$REF_REPO/skills/legacy-skill"
+write_reference_lines "$REF_REPO/skills/demo-skill/references/small.md" 40
+write_reference_lines "$REF_REPO/skills/legacy-skill/references/legacy.md" 620
+git -C "$REF_REPO" add -A
+git -C "$REF_REPO" commit -qm "reference baseline: one small, one historical over-limit"
+git -C "$REF_REPO" checkout -qb feature
+
+run_ref() { # runs with a guaranteed-unset base ref
+  set +e
+  out="$(env -u CCL_SKILL_BASE_REF bash "$SIZE_SCRIPT" "$REF_REPO" 2>&1)"
+  rc=$?
+  set -e
+}
+
+# Case g0: nothing changed => clean counts and the reference verdict token. The
+# historical over-limit file is visible in the counter but reddens nothing.
+run_ref
+assert_rc "$rc" 0 "untouched reference corpus must pass"
+assert_contains "reference_line_over_limit_count_base=1" "$out" "base over-limit count available"
+assert_contains "reference_line_over_limit_count_head=1" "$out" "head over-limit count available"
+assert_contains "reference_line_over_limit_count_delta=+0" "$out" "over-limit delta is signed"
+assert_contains "reference_line_budget_blocking_ok" "$out" "clean reference verdict token"
+assert_not_contains "reference_line_block" "$out" "an untouched over-limit reference must not red an unrelated change"
+
+# Case g1: a NEW reference over the line budget blocks with path, actual, and
+# allowed counts.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/oversized.md" 501
+run_ref
+assert_rc "$rc" 1 "new over-budget reference must block"
+assert_contains "reference_line_block: skills/demo-skill/references/oversized.md: new reference over line budget" "$out" "block names the file"
+assert_contains "head_lines=501" "$out" "block cites the actual line count"
+assert_contains "(> 500)" "$out" "block cites the allowed line count"
+assert_contains "reference_line_budget_blocking_failed" "$out" "reference failure marker present"
+assert_not_contains "reference_line_budget_blocking_ok" "$out" "no false ok next to a reference block"
+assert_not_contains "entrypoint_size_budget_advisory_ok" "$out" "no legacy ok next to a reference failure"
+
+# Case g1b: exactly at the budget is legal (the boundary is > 500, not >= 500).
+write_reference_lines "$REF_REPO/skills/demo-skill/references/oversized.md" 500
+run_ref
+assert_rc "$rc" 0 "a reference exactly at the budget must land"
+assert_contains "reference_line_budget_blocking_ok" "$out" "boundary case keeps the clean verdict"
+rm -f "$REF_REPO/skills/demo-skill/references/oversized.md"
+
+# Case g2: an existing within-limit reference that CROSSES the budget blocks on
+# the same new-or-crossing branch.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/small.md" 640
+run_ref
+assert_rc "$rc" 1 "a reference crossing the budget must block"
+assert_contains "reference_line_block: skills/demo-skill/references/small.md: new reference over line budget" "$out" "crossing block names the file"
+git -C "$REF_REPO" checkout -- skills/demo-skill/references/small.md
+
+# Case g3: a historical over-limit reference may SHRINK and may stay LEVEL.
+write_reference_lines "$REF_REPO/skills/legacy-skill/references/legacy.md" 600
+run_ref
+assert_rc "$rc" 0 "shrinking a historical over-limit reference must land"
+assert_contains "reference_line_budget_legacy_ok: skills/legacy-skill/references/legacy.md" "$out" "legacy allowance token emitted"
+assert_contains "allowed_lines=620" "$out" "legacy allowance is frozen at the base measure"
+assert_contains "delta_lines=-" "$out" "per-file reference delta is negative"
+
+# Case g3b: a same-line-count content edit of a historical over-limit reference
+# lands. A shrink leg alone cannot see a `>` turning into `>=`, which would block
+# an author who only rewrites text inside an already-over-limit file. The shrink
+# from the previous leg is restored first so this one measures a true level edit.
+git -C "$REF_REPO" checkout -- skills/legacy-skill/references/legacy.md
+python3 - "$REF_REPO/skills/legacy-skill/references/legacy.md" <<'PY'
+import sys
+p = sys.argv[1]
+lines = open(p, encoding="utf-8").read().splitlines(True)
+lines[5] = "rewritten content at the same line count\n"
+open(p, "w", encoding="utf-8").writelines(lines)
+PY
+run_ref
+assert_rc "$rc" 0 "a same-size content edit of a historical over-limit reference must land"
+assert_contains "reference_line_budget_legacy_ok: skills/legacy-skill/references/legacy.md" "$out" "level edit keeps the legacy allowance"
+assert_contains "delta_lines=+0" "$out" "the level edit really is level"
+git -C "$REF_REPO" checkout -- skills/legacy-skill/references/legacy.md
+
+# Case g4: the same historical reference may NOT grow.
+write_reference_lines "$REF_REPO/skills/legacy-skill/references/legacy.md" 621
+run_ref
+assert_rc "$rc" 1 "growing a historical over-limit reference must block"
+assert_contains "reference_line_block: skills/legacy-skill/references/legacy.md: over-limit reference grew" "$out" "growth block names the file"
+assert_contains "base_lines=620" "$out" "growth block cites the frozen baseline"
+assert_contains "head_lines=621" "$out" "growth block cites the head count"
+git -C "$REF_REPO" checkout -- skills/legacy-skill/references/legacy.md
+
+# Case g5: the append-only ledger is excluded by gate design — it may exceed the
+# budget and may GROW (append-only rows) without blocking, and says so.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/source-register.md" 900
+run_ref
+assert_rc "$rc" 0 "the append-only ledger must not be line-capped"
+assert_contains "reference_line_budget_ledger_excluded: skills/demo-skill/references/source-register.md" "$out" "ledger exclusion is reported, not silent"
+assert_not_contains "reference_line_block: skills/demo-skill/references/source-register.md" "$out" "ledger growth never blocks"
+git -C "$REF_REPO" add -A
+git -C "$REF_REPO" commit -qm "land the ledger fixture"
+write_reference_lines "$REF_REPO/skills/demo-skill/references/source-register.md" 1200
+run_ref
+assert_rc "$rc" 0 "appending rows to the ledger must stay landable"
+assert_not_contains "reference_line_block" "$out" "ledger append is not a growth block"
+git -C "$REF_REPO" checkout -- skills/demo-skill/references/source-register.md
+
+# Case g6: a rename of a historical over-limit reference carries ONLY its own
+# allowance, and move-plus-growth blocks.
+git -C "$REF_REPO" mv skills/legacy-skill/references/legacy.md skills/legacy-skill/references/legacy-renamed.md
+run_ref
+assert_rc "$rc" 0 "renaming a historical over-limit reference without growth must pass"
+assert_contains "reference_line_budget_move_ok: skills/legacy-skill/references/legacy-renamed.md" "$out" "rename carries its own historical allowance"
+assert_contains "moved_from=skills/legacy-skill/references/legacy.md" "$out" "move diagnostic proves the rename branch ran"
+write_reference_lines "$REF_REPO/skills/legacy-skill/references/legacy-renamed.md" 621
+run_ref
+assert_rc "$rc" 1 "rename plus growth must block"
+assert_not_contains "reference_line_budget_move_ok" "$out" "move credit must not survive growth"
+git -C "$REF_REPO" reset --hard -q HEAD
+
+# Case g7: a changed over-budget reference with an unresolvable base fails
+# closed — losing the baseline must never become a waiver.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/oversized.md" 700
+set +e
+out="$(env CCL_SKILL_BASE_REF=definitely-not-a-ref bash "$SIZE_SCRIPT" "$REF_REPO" 2>&1)"
+rc=$?
+set -e
+assert_rc "$rc" 1 "over-budget reference with unknown base must fail closed"
+assert_contains "reference_line_block_partial: skills/demo-skill/references/oversized.md: base unknown" "$out" "reference partial names the file"
+assert_contains "reference_line_budget_blocking_failed" "$out" "reference partial emits the failed marker"
+assert_not_contains "reference_line_budget_blocking_ok" "$out" "unknown baseline never earns a reference pass"
+rm -f "$REF_REPO/skills/demo-skill/references/oversized.md"
+
+# Case g8: committed-only reference growth with an unresolvable base and a clean
+# tree evaluates nothing, so it must say un-evaluated rather than ok.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/oversized.md" 700
+git -C "$REF_REPO" add -A
+git -C "$REF_REPO" commit -qm "commit the reference growth so the tree is clean"
+[ -z "$(git -C "$REF_REPO" status --porcelain)" ] || fail "g8 fixture: tree must be clean"
+set +e
+out="$(env CCL_SKILL_BASE_REF=definitely-not-a-ref bash "$SIZE_SCRIPT" "$REF_REPO" 2>&1)"
+rc=$?
+set -e
+assert_rc "$rc" 0 "base-less clean tree keeps the advisory exit contract"
+assert_contains "reference_line_budget_blocking_unevaluated" "$out" "un-evaluated reference gate says so"
+assert_not_contains "reference_line_budget_blocking_ok" "$out" "a base-less run must never claim a reference pass"
+
+# Case g9: a NEW reference over 100 lines with no ## structure draws the
+# navigation advisory and does NOT block; a structured one stays quiet. The g8
+# over-budget fixture is retired first so this leg measures only its own files.
+git -C "$REF_REPO" rm -q skills/demo-skill/references/oversized.md
+git -C "$REF_REPO" commit -qm "retire the over-budget reference fixture"
+write_reference_lines "$REF_REPO/skills/demo-skill/references/flat.md" 140 --no-headings
+run_ref
+assert_rc "$rc" 0 "the navigation advisory must never block"
+assert_contains "reference_nav_advisory: skills/demo-skill/references/flat.md" "$out" "unstructured long reference draws the advisory"
+assert_contains "reference_line_budget_blocking_ok" "$out" "advisory leaves the blocking verdict clean"
+write_reference_lines "$REF_REPO/skills/demo-skill/references/structured.md" 140
+run_ref
+assert_rc "$rc" 0 "a structured long reference stays clean"
+assert_not_contains "reference_nav_advisory: skills/demo-skill/references/structured.md" "$out" "sectioned reference draws no advisory"
+rm -f "$REF_REPO/skills/demo-skill/references/flat.md" "$REF_REPO/skills/demo-skill/references/structured.md"
+
+# Case g9b: H3 headings are not section structure for this purpose — a long new
+# reference whose only headings are `###` still draws the navigation advisory.
+{ printf -- '# Fixture\n\n### Detail only\n'; i=0; while [ "$i" -lt 140 ]; do printf -- 'line %s\n' "$i"; i=$((i + 1)); done; } > "$REF_REPO/skills/demo-skill/references/h3only.md"
+run_ref
+assert_rc "$rc" 0 "the H3-only advisory must never block"
+assert_contains "reference_nav_advisory: skills/demo-skill/references/h3only.md" "$out" "an H3-only long reference still needs ## sections"
+rm -f "$REF_REPO/skills/demo-skill/references/h3only.md"
+
+# Case g10: line endings must not change the measure. A CR-only or CRLF file
+# measures like the LF file a reader sees, so a 501-line CR-delimited reference
+# cannot slip through as a single line, and its 500-line sibling still lands.
+python3 - "$REF_REPO/skills/demo-skill/references/cr-only.md" <<'PY'
+import sys
+open(sys.argv[1], "wb").write(b"\r".join(b"line %d" % i for i in range(501)) + b"\r")
+PY
+run_ref
+assert_rc "$rc" 1 "a CR-delimited over-budget reference must block"
+assert_contains "reference_line_block: skills/demo-skill/references/cr-only.md: new reference over line budget" "$out" "CR-only block names the file"
+assert_contains "head_lines=501" "$out" "CR-only lines are counted like LF lines"
+python3 - "$REF_REPO/skills/demo-skill/references/cr-only.md" <<'PY'
+import sys
+open(sys.argv[1], "wb").write(b"\r\n".join(b"line %d" % i for i in range(501)) + b"\r\n")
+PY
+run_ref
+assert_rc "$rc" 1 "a CRLF over-budget reference must block"
+assert_contains "head_lines=501" "$out" "CRLF lines are counted once, not twice"
+python3 - "$REF_REPO/skills/demo-skill/references/cr-only.md" <<'PY'
+import sys
+open(sys.argv[1], "wb").write(b"\r".join(b"line %d" % i for i in range(500)) + b"\r")
+PY
+run_ref
+assert_rc "$rc" 0 "a CR-delimited reference at the budget still lands"
+assert_contains "reference_line_budget_blocking_ok" "$out" "boundary holds under CR line endings"
+rm -f "$REF_REPO/skills/demo-skill/references/cr-only.md"
+
+# Case g11: an unreadable reference degrades the CENSUS COUNTER to unknown and
+# says so, instead of silently counting it as within budget or aborting the whole
+# program before the per-file verdicts run. Running as root defeats chmod, so the
+# leg checks that the fixture is actually unreadable and prints an explicit skip
+# token otherwise — skipped is not passed.
+UNREADABLE="$REF_REPO/skills/demo-skill/references/unreadable.md"
+write_reference_lines "$UNREADABLE" 40
+git -C "$REF_REPO" add -A
+git -C "$REF_REPO" commit -qm "land a readable reference to make unreadable"
+chmod 000 "$UNREADABLE"
+if head -c 1 "$UNREADABLE" >/dev/null 2>&1; then
+  echo "reference_census_unreadable_leg_skipped: this process can still read a chmod-000 file (likely root) — skipped is not passed"
+else
+  run_ref
+  assert_rc "$rc" 1 "an unreadable CHANGED reference fails closed"
+  assert_contains "reference_line_census_partial" "$out" "the census says it is incomplete"
+  assert_contains "reference_line_over_limit_count_head=unknown" "$out" "an incomplete census reports unknown, never a count"
+  assert_contains "reference_line_over_limit_count_delta=unknown" "$out" "an unknown head count cannot produce a signed delta"
+  assert_contains "reference_line_block_partial: skills/demo-skill/references/unreadable.md" "$out" "the per-file verdict still runs and names the file"
+  assert_not_contains "reference_line_budget_blocking_ok" "$out" "an unreadable changed reference never earns a pass"
+fi
+chmod 644 "$UNREADABLE"
+git -C "$REF_REPO" rm -q "skills/demo-skill/references/unreadable.md"
+git -C "$REF_REPO" commit -qm "retire the unreadable fixture"
+
 # Case e8: gate wiring anchors — the validator must fail the gate on non-zero
 # and must not demote the size gate back to advisory.
 validator="$SCRIPT_DIR/check-ccl-skills.sh"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_contract_anchors.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+# Self-proof suite for check-contract-anchors.sh.
+#
+# Oracle self-proof tables (the gate is trusted only because every row below
+# was APPLIED and observed):
+#
+# MUST-HIT (mutant -> expected red token, expected rc):
+#   M1 pinned literal deleted from anchored file  -> contract_anchor_missing        rc 1
+#   M2 pinned literal duplicated in anchored file -> contract_anchor_duplicate      rc 1
+#   M3 anchored file removed                      -> contract_anchor_file_missing   rc 1
+#   M4 table emptied (comments only)              -> contract_anchor_table_empty    rc 2
+#   M5 malformed row (3 fields)                   -> contract_anchor_row_malformed  rc 2
+#   M6 literal under 16 chars                     -> contract_anchor_literal_too_short rc 2
+#   M7 duplicate anchor id                        -> contract_anchor_duplicate_id   rc 2
+#   M8 table file missing                         -> contract_anchor_table_missing  rc 2
+#   M9 malformed row + drifted anchor in one table -> BOTH reported, rc 2
+#      (integrity errors are collected, well-formed rows still evaluated,
+#       and a broken table yields no verdict — fail-closed over the drift)
+#
+# MUST-NOT-HIT (benign neighbor -> stays green, rc 0):
+#   B1 wording adjacent to the pinned literal edited (same line, outside the pin)
+#   B2 unrelated file in the tree edited freely
+#   B3 anchored file grows new content elsewhere
+#
+# DIFFERENTIAL ATTRIBUTION:
+#   D1 two anchors, one broken -> output names exactly the broken id, rc 1,
+#      and the healthy id is not reported
+#
+# REAL-REPO LEG:
+#   R1 shipped table against the repo root -> rc 0 and pinned output grammar
+#      "contract_anchor_gate_ok (<N> anchors)"
+set -u
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+checker="$script_dir/check-contract-anchors.sh"
+repo_root=$(cd "$script_dir/../../.." && pwd -P)
+fail=0
+
+note() { printf '%s\n' "$*"; }
+expect() { # expect <case> <want_rc> <got_rc> <want_token> <output>
+  local case_id="$1" want_rc="$2" got_rc="$3" want_token="$4" output="$5"
+  if [[ "$got_rc" -ne "$want_rc" ]]; then
+    note "FAIL $case_id: rc=$got_rc want=$want_rc"
+    note "$output"
+    fail=1
+    return
+  fi
+  if [[ -n "$want_token" && "$output" != *"$want_token"* ]]; then
+    note "FAIL $case_id: missing token '$want_token' in output"
+    note "$output"
+    fail=1
+    return
+  fi
+  note "ok $case_id"
+}
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+make_fixture() { # rebuild a fresh fixture tree + table under $tmp/fx
+  rm -rf "$tmp/fx"
+  mkdir -p "$tmp/fx/docs"
+  cat > "$tmp/fx/docs/sample-contract.md" <<'MD'
+# Sample contract
+
+The sample verdict is decided by exactly one discriminating predicate here.
+Unrelated surrounding prose that may change freely.
+MD
+  cat > "$tmp/fx/docs/other.md" <<'MD'
+Free-floating document with no anchors at all.
+MD
+  printf '%s\t%s\t%s\t%s\n' \
+    "sample-discriminator" "docs/sample-contract.md" \
+    "decided by exactly one discriminating predicate" "fixture row" \
+    > "$tmp/fx/anchors.tsv"
+}
+
+run() { # run <root> <table>; sets got_rc/got_out
+  got_out=$(bash "$checker" "$1" --table "$2" 2>&1)
+  got_rc=$?
+}
+
+# R1: shipped table against the real repo
+run "$repo_root" "$script_dir/contract-anchors.tsv"
+expect R1 0 "$got_rc" "contract_anchor_gate_ok (" "$got_out"
+if ! grep -qE '^contract_anchor_gate_ok \([0-9]+ anchors\)$' <<<"$got_out"; then
+  note "FAIL R1-grammar: green output grammar drifted: $got_out"
+  fail=1
+else
+  note "ok R1-grammar"
+fi
+
+# Green fixture control (precondition for every mutant below)
+make_fixture
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect C0 0 "$got_rc" "contract_anchor_gate_ok (1 anchors)" "$got_out"
+
+# M1 literal deleted
+make_fixture
+perl -pi -e 's/decided by exactly one discriminating predicate/decided case by case/' "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M1 1 "$got_rc" "contract_anchor_missing: sample-discriminator" "$got_out"
+
+# M2 literal duplicated
+make_fixture
+printf '\nA second copy: decided by exactly one discriminating predicate.\n' >> "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M2 1 "$got_rc" "contract_anchor_duplicate: sample-discriminator" "$got_out"
+
+# M3 anchored file removed
+make_fixture
+rm "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M3 1 "$got_rc" "contract_anchor_file_missing: sample-discriminator" "$got_out"
+
+# M4 table emptied
+make_fixture
+printf '# only comments\n\n' > "$tmp/fx/anchors.tsv"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M4 2 "$got_rc" "contract_anchor_table_empty" "$got_out"
+
+# M5 malformed row
+make_fixture
+printf 'bad-row\tdocs/sample-contract.md\tonly three fields\n' > "$tmp/fx/anchors.tsv"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M5 2 "$got_rc" "contract_anchor_row_malformed" "$got_out"
+
+# M6 short literal
+make_fixture
+printf 'short\tdocs/sample-contract.md\ttiny pin\tnote\n' > "$tmp/fx/anchors.tsv"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M6 2 "$got_rc" "contract_anchor_literal_too_short" "$got_out"
+
+# M7 duplicate id
+make_fixture
+printf '%s\t%s\t%s\t%s\n' "sample-discriminator" "docs/sample-contract.md" \
+  "Unrelated surrounding prose that may change" "second row same id" >> "$tmp/fx/anchors.tsv"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M7 2 "$got_rc" "contract_anchor_duplicate_id" "$got_out"
+
+# M8 table missing
+make_fixture
+run "$tmp/fx" "$tmp/fx/missing.tsv"
+expect M8 2 "$got_rc" "contract_anchor_table_missing" "$got_out"
+
+# M9 malformed row + drifted anchor: both reported in one run, rc 2
+make_fixture
+printf 'bad-row\tdocs/sample-contract.md\tonly three fields\n' >> "$tmp/fx/anchors.tsv"
+perl -pi -e 's/decided by exactly one discriminating predicate/decided informally/' "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M9 2 "$got_rc" "contract_anchor_table_invalid" "$got_out"
+if [[ "$got_out" != *"contract_anchor_row_malformed"* || "$got_out" != *"contract_anchor_missing: sample-discriminator"* ]]; then
+  note "FAIL M9-completeness: expected both the integrity error and the drift finding in one run"
+  note "$got_out"
+  fail=1
+else
+  note "ok M9-completeness"
+fi
+
+# B1 benign neighbor: same line, outside the pinned span
+make_fixture
+perl -pi -e 's/predicate here\./predicate here, with a clarifying tail./' "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect B1 0 "$got_rc" "contract_anchor_gate_ok" "$got_out"
+
+# B2 unrelated file edited
+make_fixture
+printf 'More free text.\n' >> "$tmp/fx/docs/other.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect B2 0 "$got_rc" "contract_anchor_gate_ok" "$got_out"
+
+# B3 anchored file grows elsewhere
+make_fixture
+printf '\n## New unrelated section\n\nNew prose.\n' >> "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect B3 0 "$got_rc" "contract_anchor_gate_ok" "$got_out"
+
+# D1 differential attribution: two anchors, one broken
+make_fixture
+printf '%s\t%s\t%s\t%s\n' "healthy-anchor" "docs/sample-contract.md" \
+  "Unrelated surrounding prose that may change freely." "healthy row" >> "$tmp/fx/anchors.tsv"
+perl -pi -e 's/decided by exactly one discriminating predicate/decided informally/' "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect D1 1 "$got_rc" "contract_anchor_missing: sample-discriminator" "$got_out"
+if [[ "$got_out" == *"healthy-anchor"* ]]; then
+  note "FAIL D1-attribution: healthy anchor reported in failure output"
+  fail=1
+else
+  note "ok D1-attribution"
+fi
+
+if [[ "$fail" -ne 0 ]]; then
+  echo "test_check_contract_anchors: FAIL"
+  exit 1
+fi
+echo "test_check_contract_anchors: ok"