@ccoalm/ccl-skills 0.9.0 → 0.11.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh

@@ -194,6 +194,86 @@ run_gate
 assert_not_contains "impact_chain_firing_path_missing" "$out" "a changed shebang owner executable should satisfy the firing-path gate"
 assert_rc "$rc" 0 "a complete RED row with a changed owner executable must pass"
 
+# Non-ASCII anchors must be accepted, and the proof must be DIFFERENTIAL rather
+# than one literal passing: a special-cased implementation, or one that handles
+# Han but not a combining mark, would satisfy a single-literal leg. Each row below
+# pairs a non-ASCII anchor with an ASCII anchor matched on everything the gate
+# actually predicates on - uniqueness, the 16-character bar, list-line shape, a
+# whitelisted normative verb - so the two verdicts must agree. This exists because
+# a round concluded from reading the wrong lambda (`raw_blob_at` forces binary;
+# `locator_valid` resolves through `blob_at`, which does not) that a non-ASCII
+# anchor could never validate, and recorded a defect that was not there.
+#
+# Representations covered: Han; a precomposed Latin letter (NFC, two bytes); the
+# same letter decomposed into base + combining mark (NFD, so the anchor carries a
+# codepoint that is not a character on its own).
+anchor_pair_case() {
+  # $1 = case label, $2 = non-ASCII anchor, $3 = ASCII anchor of the same shape
+  local label="$1" nonascii="$2" ascii="$3" verdict_nonascii verdict_ascii
+  new_case "case-ref-anchor-pair-$label-nonascii"
+  printf '\n- %s\n' "$nonascii" >> "$REPO/$UPSTREAM_REF"
+  printf '| Fixture anchor pair %s non-ASCII | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#%s | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' "$label" "$nonascii" >> "$REGISTER"
+  routing_surface_downscope
+  commit_case "anchor pair $label non-ASCII"
+  run_gate
+  verdict_nonascii="$rc"
+
+  new_case "case-ref-anchor-pair-$label-ascii"
+  printf '\n- %s\n' "$ascii" >> "$REPO/$UPSTREAM_REF"
+  printf '| Fixture anchor pair %s ASCII | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#%s | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' "$label" "$ascii" >> "$REGISTER"
+  routing_surface_downscope
+  commit_case "anchor pair $label ASCII"
+  run_gate
+  verdict_ascii="$rc"
+
+  assert_rc "$verdict_ascii" 0 "the ASCII control of pair $label must be accepted"
+  assert_rc "$verdict_nonascii" "$verdict_ascii" "pair $label: the non-ASCII anchor must get the same verdict as its ASCII control"
+}
+
+anchor_pair_case han \
+  '下游执行者必须在收到该契约变更时同步更新其验证面。' \
+  'The downstream executor must refresh its verification surface on this change.'
+# Same sentence and the same whitelisted verb in both arms; only the accented
+# codepoint differs, so a verdict difference can only come from byte composition.
+anchor_pair_case nfc \
+  'The owner must refresh its vérification surface on this change.' \
+  'The owner must refresh its verification surface on this change.'
+anchor_pair_case nfd \
+  'The owner must refresh its vérification surface on that change.' \
+  'The owner must refresh its verification surface on that change.'
+
+# When one owner carries several RED rows, the owner-level check reddens the whole
+# package for a single bad row — so the diagnostic must name WHICH row failed.
+# Without it the author inspects the row they just wrote (usually the correct one)
+# while an unrelated row is the offender; that cost one round three iterations.
+new_case case-ref-firing-path-names-offending-row
+printf '\n- 下游执行者必须在收到该契约变更时同步更新其验证面。\n' >> "$REPO/$UPSTREAM_REF"
+printf '| Fixture good row beside a bad one | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#下游执行者必须在收到该契约变更时同步更新其验证面 | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' >> "$REGISTER"
+printf '| Fixture offending row with an unresolvable anchor | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#this anchor text was never added by this round | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "one good row beside one unresolvable row"
+run_gate
+assert_rc "$rc" 1 "an unresolvable anchor on any bound RED row must fail the owner"
+assert_contains "impact_chain_firing_path_missing" "$out" "checker should report the firing-path verdict"
+assert_contains "Fixture offending row with an unresolvable anchor" "$out" "the diagnostic must name the offending row"
+assert_not_contains "offending row: Fixture good row beside a bad one" "$out" "the diagnostic must not name a row whose anchor resolves"
+
+# The offending-row line renders repository text a contributor controls onto a
+# terminal/CI channel. Control and invisible characters must be escaped, not merely
+# truncated: raw ANSI or carriage-return bytes can erase or restyle surrounding
+# output, and bidi overrides can reorder it, so a reader sees a diagnostic that does
+# not match what the gate decided. Both reviewer lanes raised this independently.
+new_case case-ref-offending-row-escapes-control-bytes
+printf '\n- 下游执行者必须在收到该契约变更时同步更新其验证面。\n' >> "$REPO/$UPSTREAM_REF"
+printf '| Fixture control-byte row \033[31m\rSPOOFED\u202E | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/references/adr-convention.md#this anchor text was never added by this round | `updated` | `product-rd-workflow/SKILL.md` reference edit |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "offending row carrying control bytes"
+run_gate
+assert_rc "$rc" 1 "an unresolvable anchor must still fail with a control-byte row"
+assert_contains "\\u001B" "$out" "the diagnostic must escape an ANSI introducer rather than emit it"
+assert_contains "\\u000D" "$out" "the diagnostic must escape a carriage return rather than emit it"
+assert_contains "\\u202E" "$out" "the diagnostic must escape a bidi override rather than emit it"
+
 # A malformed impact-chain-looking row (wrong cell count) is warned but stays
 # advisory: hard-blocking would false-positive on the register's many other
 # legitimate table shapes, and deliberate mangling is outside the trust model
@@ -1329,6 +1409,6 @@ assert_rc "$rc" 1 "a directory masquerading as SKILL.md must not read as a prese
 assert_contains "platform-observability/SKILL.md" "$out" "the masqueraded owner must be named"
 
 assert_rc "$full_check_runs" 1 "fixture suite must retain exactly one full checker wiring case"
-assert_rc "$gate_runs" 80 "all remaining impact-chain fixtures must run the standalone gate"
+assert_rc "$gate_runs" 88 "all remaining impact-chain fixtures must run the standalone gate"
 
 echo "test_check_ccl_impact_chain_refscripts: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -114,6 +114,12 @@ fast_tests=(
   test_shared_git_surface_gate.sh
   test_extraction_review_gate.sh
   test_validate_extraction_review_state.sh
+  # Merge-side binding between the landing candidate and the review evidence that
+  # inspected it: own throwaway git repo, no clone, seconds.
+  test_review_ledger_binding.sh
+  # Candidate-SHA-bound gate receipts (mint/verify): own throwaway git repo,
+  # no clone, seconds — belongs in the lane every run exercises.
+  test_gate_receipt.sh
   test_check_ccl_route_drift.sh
   test_check_sync_pointers.sh
   test_check_ccl_register_pending_exclusion.sh
@@ -137,6 +143,13 @@ fast_tests=(
   test_validate_skill_cross_refs.sh
   test_git_identity_predicate_gate.sh
   test_liveness_predicate_gate.sh
+  # 074: contract-anchor gate self-proof (tmp fixtures + one real-repo leg,
+  # seconds) and the anti-patterns panel structural check (awk over one file).
+  test_check_contract_anchors.sh
+  test_antipattern_grep_panel.sh
+  # 075: body-compliance grading contract (grade() walk, fail-closed --ids legs,
+  # stub-model denominator/forbidden_hit legs; deterministic, seconds).
+  test_body_compliance_grading.sh
   test_regression_runner_registration.sh
   # Harness binding for the gate lanes themselves: the impact-chain gate's
   # round walk needs the branch's own first-parent chain, which the default
@@ -149,6 +162,14 @@ fast_tests=(
   test_regression_runner_lanes.sh
   test_routing_pointer_integrity.sh
   test_routing_bank_integrity.sh
+  # 077: frozen-case sanctity (regressions-are-sacred) — base-relative guard
+  # that a deleted/re-scoped bank case or golden trace names its adjudication
+  # row; degrades to an explicit skip token without CCL_SKILL_BASE_REF. The
+  # selfproof lane proves the oracle fails for the right reason (synthetic
+  # repo: deletion/re-scope/nested-trace mutants red, forged-credit legs red,
+  # adjudicated and control legs green).
+  test_frozen_case_sanctity.sh
+  test_frozen_case_sanctity_selfproof.sh
   test_uiux_delivery_contract.sh
   test_uiux_loading_budget.sh
   test_governing_chain_diff.sh
@@ -195,6 +216,13 @@ heavy_tests=(
   # 「跳过义务会不会留下可检出的缺席」——044 连续五轮 challenge 都停在这一点上，负向
   # 用例（缺证据、非枚举值、降范围无留痕）必须每轮都跑，否则触发器会悄悄退化成声称。
   test_impact_chain_self_adjudication.sh
+  # 074: one applied deletion mutation per pinned-phrase gate family, each leg
+  # running the FULL shipped checker against a committed fixture copy of the
+  # working tree (6 full-gate runs — far too slow for pre-commit). Proves the
+  # ~40 required_phrase pins and the contract-anchor delegation can actually
+  # go red for the right reason; the fast lane keeps the checker-level
+  # self-proof in test_check_contract_anchors.sh.
+  test_pinned_phrase_mutation_walk.sh
 )
 
 # Registration self-audit: every sibling test_*.sh must appear in fast_tests or

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_size_budget.sh

@@ -817,6 +817,257 @@ assert_contains "entrypoint_word_budget_block_partial: skills/demo-skill/SKILL.m
 assert_contains "entrypoint_word_budget_blocking_failed" "$out" "word-budget partial emits failed marker"
 assert_not_contains "entrypoint_word_budget_blocking_ok" "$out" "unknown baseline never earns a word-budget pass"
 
+# ---------------------------------------------------------------------------
+# Reference-file line ratchet (fresh repo): a NEW or crossing reference over 500
+# physical lines blocks; a historical over-limit reference may stay level or
+# shrink but not grow; the append-only ledger is excluded by gate design; an
+# unresolvable base fails closed; a long new reference without ## structure
+# draws an advisory, never a block.
+REF_REPO="$TMP/repo-reference-lines"
+mkdir -p "$REF_REPO/skills/demo-skill/references" "$REF_REPO/skills/legacy-skill/references"
+git init -q -b main "$REF_REPO"
+git -C "$REF_REPO" config user.email test@example.invalid
+git -C "$REF_REPO" config user.name "Test User"
+
+write_skill_stub() { # <skill-dir>
+  {
+    printf -- '---\nname: %s\ndescription: reference line-ratchet fixture.\n---\n\n' "$(basename "$1")"
+    printf -- 'Body pointer to references.\n'
+  } > "$1/SKILL.md"
+}
+write_reference_lines() { # <path> <line-count> [--no-headings]
+  local n="$2" i
+  : > "$1"
+  if [ "${3:-}" != "--no-headings" ]; then
+    printf -- '# Fixture reference\n\n## Section one\n' >> "$1"
+    i=3
+  else
+    i=0
+  fi
+  while [ "$i" -lt "$n" ]; do
+    printf -- 'line %s\n' "$i" >> "$1"
+    i=$((i + 1))
+  done
+}
+
+write_skill_stub "$REF_REPO/skills/demo-skill"
+write_skill_stub "$REF_REPO/skills/legacy-skill"
+write_reference_lines "$REF_REPO/skills/demo-skill/references/small.md" 40
+write_reference_lines "$REF_REPO/skills/legacy-skill/references/legacy.md" 620
+git -C "$REF_REPO" add -A
+git -C "$REF_REPO" commit -qm "reference baseline: one small, one historical over-limit"
+git -C "$REF_REPO" checkout -qb feature
+
+run_ref() { # runs with a guaranteed-unset base ref
+  set +e
+  out="$(env -u CCL_SKILL_BASE_REF bash "$SIZE_SCRIPT" "$REF_REPO" 2>&1)"
+  rc=$?
+  set -e
+}
+
+# Case g0: nothing changed => clean counts and the reference verdict token. The
+# historical over-limit file is visible in the counter but reddens nothing.
+run_ref
+assert_rc "$rc" 0 "untouched reference corpus must pass"
+assert_contains "reference_line_over_limit_count_base=1" "$out" "base over-limit count available"
+assert_contains "reference_line_over_limit_count_head=1" "$out" "head over-limit count available"
+assert_contains "reference_line_over_limit_count_delta=+0" "$out" "over-limit delta is signed"
+assert_contains "reference_line_budget_blocking_ok" "$out" "clean reference verdict token"
+assert_not_contains "reference_line_block" "$out" "an untouched over-limit reference must not red an unrelated change"
+
+# Case g1: a NEW reference over the line budget blocks with path, actual, and
+# allowed counts.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/oversized.md" 501
+run_ref
+assert_rc "$rc" 1 "new over-budget reference must block"
+assert_contains "reference_line_block: skills/demo-skill/references/oversized.md: new reference over line budget" "$out" "block names the file"
+assert_contains "head_lines=501" "$out" "block cites the actual line count"
+assert_contains "(> 500)" "$out" "block cites the allowed line count"
+assert_contains "reference_line_budget_blocking_failed" "$out" "reference failure marker present"
+assert_not_contains "reference_line_budget_blocking_ok" "$out" "no false ok next to a reference block"
+assert_not_contains "entrypoint_size_budget_advisory_ok" "$out" "no legacy ok next to a reference failure"
+
+# Case g1b: exactly at the budget is legal (the boundary is > 500, not >= 500).
+write_reference_lines "$REF_REPO/skills/demo-skill/references/oversized.md" 500
+run_ref
+assert_rc "$rc" 0 "a reference exactly at the budget must land"
+assert_contains "reference_line_budget_blocking_ok" "$out" "boundary case keeps the clean verdict"
+rm -f "$REF_REPO/skills/demo-skill/references/oversized.md"
+
+# Case g2: an existing within-limit reference that CROSSES the budget blocks on
+# the same new-or-crossing branch.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/small.md" 640
+run_ref
+assert_rc "$rc" 1 "a reference crossing the budget must block"
+assert_contains "reference_line_block: skills/demo-skill/references/small.md: new reference over line budget" "$out" "crossing block names the file"
+git -C "$REF_REPO" checkout -- skills/demo-skill/references/small.md
+
+# Case g3: a historical over-limit reference may SHRINK and may stay LEVEL.
+write_reference_lines "$REF_REPO/skills/legacy-skill/references/legacy.md" 600
+run_ref
+assert_rc "$rc" 0 "shrinking a historical over-limit reference must land"
+assert_contains "reference_line_budget_legacy_ok: skills/legacy-skill/references/legacy.md" "$out" "legacy allowance token emitted"
+assert_contains "allowed_lines=620" "$out" "legacy allowance is frozen at the base measure"
+assert_contains "delta_lines=-" "$out" "per-file reference delta is negative"
+
+# Case g3b: a same-line-count content edit of a historical over-limit reference
+# lands. A shrink leg alone cannot see a `>` turning into `>=`, which would block
+# an author who only rewrites text inside an already-over-limit file. The shrink
+# from the previous leg is restored first so this one measures a true level edit.
+git -C "$REF_REPO" checkout -- skills/legacy-skill/references/legacy.md
+python3 - "$REF_REPO/skills/legacy-skill/references/legacy.md" <<'PY'
+import sys
+p = sys.argv[1]
+lines = open(p, encoding="utf-8").read().splitlines(True)
+lines[5] = "rewritten content at the same line count\n"
+open(p, "w", encoding="utf-8").writelines(lines)
+PY
+run_ref
+assert_rc "$rc" 0 "a same-size content edit of a historical over-limit reference must land"
+assert_contains "reference_line_budget_legacy_ok: skills/legacy-skill/references/legacy.md" "$out" "level edit keeps the legacy allowance"
+assert_contains "delta_lines=+0" "$out" "the level edit really is level"
+git -C "$REF_REPO" checkout -- skills/legacy-skill/references/legacy.md
+
+# Case g4: the same historical reference may NOT grow.
+write_reference_lines "$REF_REPO/skills/legacy-skill/references/legacy.md" 621
+run_ref
+assert_rc "$rc" 1 "growing a historical over-limit reference must block"
+assert_contains "reference_line_block: skills/legacy-skill/references/legacy.md: over-limit reference grew" "$out" "growth block names the file"
+assert_contains "base_lines=620" "$out" "growth block cites the frozen baseline"
+assert_contains "head_lines=621" "$out" "growth block cites the head count"
+git -C "$REF_REPO" checkout -- skills/legacy-skill/references/legacy.md
+
+# Case g5: the append-only ledger is excluded by gate design — it may exceed the
+# budget and may GROW (append-only rows) without blocking, and says so.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/source-register.md" 900
+run_ref
+assert_rc "$rc" 0 "the append-only ledger must not be line-capped"
+assert_contains "reference_line_budget_ledger_excluded: skills/demo-skill/references/source-register.md" "$out" "ledger exclusion is reported, not silent"
+assert_not_contains "reference_line_block: skills/demo-skill/references/source-register.md" "$out" "ledger growth never blocks"
+git -C "$REF_REPO" add -A
+git -C "$REF_REPO" commit -qm "land the ledger fixture"
+write_reference_lines "$REF_REPO/skills/demo-skill/references/source-register.md" 1200
+run_ref
+assert_rc "$rc" 0 "appending rows to the ledger must stay landable"
+assert_not_contains "reference_line_block" "$out" "ledger append is not a growth block"
+git -C "$REF_REPO" checkout -- skills/demo-skill/references/source-register.md
+
+# Case g6: a rename of a historical over-limit reference carries ONLY its own
+# allowance, and move-plus-growth blocks.
+git -C "$REF_REPO" mv skills/legacy-skill/references/legacy.md skills/legacy-skill/references/legacy-renamed.md
+run_ref
+assert_rc "$rc" 0 "renaming a historical over-limit reference without growth must pass"
+assert_contains "reference_line_budget_move_ok: skills/legacy-skill/references/legacy-renamed.md" "$out" "rename carries its own historical allowance"
+assert_contains "moved_from=skills/legacy-skill/references/legacy.md" "$out" "move diagnostic proves the rename branch ran"
+write_reference_lines "$REF_REPO/skills/legacy-skill/references/legacy-renamed.md" 621
+run_ref
+assert_rc "$rc" 1 "rename plus growth must block"
+assert_not_contains "reference_line_budget_move_ok" "$out" "move credit must not survive growth"
+git -C "$REF_REPO" reset --hard -q HEAD
+
+# Case g7: a changed over-budget reference with an unresolvable base fails
+# closed — losing the baseline must never become a waiver.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/oversized.md" 700
+set +e
+out="$(env CCL_SKILL_BASE_REF=definitely-not-a-ref bash "$SIZE_SCRIPT" "$REF_REPO" 2>&1)"
+rc=$?
+set -e
+assert_rc "$rc" 1 "over-budget reference with unknown base must fail closed"
+assert_contains "reference_line_block_partial: skills/demo-skill/references/oversized.md: base unknown" "$out" "reference partial names the file"
+assert_contains "reference_line_budget_blocking_failed" "$out" "reference partial emits the failed marker"
+assert_not_contains "reference_line_budget_blocking_ok" "$out" "unknown baseline never earns a reference pass"
+rm -f "$REF_REPO/skills/demo-skill/references/oversized.md"
+
+# Case g8: committed-only reference growth with an unresolvable base and a clean
+# tree evaluates nothing, so it must say un-evaluated rather than ok.
+write_reference_lines "$REF_REPO/skills/demo-skill/references/oversized.md" 700
+git -C "$REF_REPO" add -A
+git -C "$REF_REPO" commit -qm "commit the reference growth so the tree is clean"
+[ -z "$(git -C "$REF_REPO" status --porcelain)" ] || fail "g8 fixture: tree must be clean"
+set +e
+out="$(env CCL_SKILL_BASE_REF=definitely-not-a-ref bash "$SIZE_SCRIPT" "$REF_REPO" 2>&1)"
+rc=$?
+set -e
+assert_rc "$rc" 0 "base-less clean tree keeps the advisory exit contract"
+assert_contains "reference_line_budget_blocking_unevaluated" "$out" "un-evaluated reference gate says so"
+assert_not_contains "reference_line_budget_blocking_ok" "$out" "a base-less run must never claim a reference pass"
+
+# Case g9: a NEW reference over 100 lines with no ## structure draws the
+# navigation advisory and does NOT block; a structured one stays quiet. The g8
+# over-budget fixture is retired first so this leg measures only its own files.
+git -C "$REF_REPO" rm -q skills/demo-skill/references/oversized.md
+git -C "$REF_REPO" commit -qm "retire the over-budget reference fixture"
+write_reference_lines "$REF_REPO/skills/demo-skill/references/flat.md" 140 --no-headings
+run_ref
+assert_rc "$rc" 0 "the navigation advisory must never block"
+assert_contains "reference_nav_advisory: skills/demo-skill/references/flat.md" "$out" "unstructured long reference draws the advisory"
+assert_contains "reference_line_budget_blocking_ok" "$out" "advisory leaves the blocking verdict clean"
+write_reference_lines "$REF_REPO/skills/demo-skill/references/structured.md" 140
+run_ref
+assert_rc "$rc" 0 "a structured long reference stays clean"
+assert_not_contains "reference_nav_advisory: skills/demo-skill/references/structured.md" "$out" "sectioned reference draws no advisory"
+rm -f "$REF_REPO/skills/demo-skill/references/flat.md" "$REF_REPO/skills/demo-skill/references/structured.md"
+
+# Case g9b: H3 headings are not section structure for this purpose — a long new
+# reference whose only headings are `###` still draws the navigation advisory.
+{ printf -- '# Fixture\n\n### Detail only\n'; i=0; while [ "$i" -lt 140 ]; do printf -- 'line %s\n' "$i"; i=$((i + 1)); done; } > "$REF_REPO/skills/demo-skill/references/h3only.md"
+run_ref
+assert_rc "$rc" 0 "the H3-only advisory must never block"
+assert_contains "reference_nav_advisory: skills/demo-skill/references/h3only.md" "$out" "an H3-only long reference still needs ## sections"
+rm -f "$REF_REPO/skills/demo-skill/references/h3only.md"
+
+# Case g10: line endings must not change the measure. A CR-only or CRLF file
+# measures like the LF file a reader sees, so a 501-line CR-delimited reference
+# cannot slip through as a single line, and its 500-line sibling still lands.
+python3 - "$REF_REPO/skills/demo-skill/references/cr-only.md" <<'PY'
+import sys
+open(sys.argv[1], "wb").write(b"\r".join(b"line %d" % i for i in range(501)) + b"\r")
+PY
+run_ref
+assert_rc "$rc" 1 "a CR-delimited over-budget reference must block"
+assert_contains "reference_line_block: skills/demo-skill/references/cr-only.md: new reference over line budget" "$out" "CR-only block names the file"
+assert_contains "head_lines=501" "$out" "CR-only lines are counted like LF lines"
+python3 - "$REF_REPO/skills/demo-skill/references/cr-only.md" <<'PY'
+import sys
+open(sys.argv[1], "wb").write(b"\r\n".join(b"line %d" % i for i in range(501)) + b"\r\n")
+PY
+run_ref
+assert_rc "$rc" 1 "a CRLF over-budget reference must block"
+assert_contains "head_lines=501" "$out" "CRLF lines are counted once, not twice"
+python3 - "$REF_REPO/skills/demo-skill/references/cr-only.md" <<'PY'
+import sys
+open(sys.argv[1], "wb").write(b"\r".join(b"line %d" % i for i in range(500)) + b"\r")
+PY
+run_ref
+assert_rc "$rc" 0 "a CR-delimited reference at the budget still lands"
+assert_contains "reference_line_budget_blocking_ok" "$out" "boundary holds under CR line endings"
+rm -f "$REF_REPO/skills/demo-skill/references/cr-only.md"
+
+# Case g11: an unreadable reference degrades the CENSUS COUNTER to unknown and
+# says so, instead of silently counting it as within budget or aborting the whole
+# program before the per-file verdicts run. Running as root defeats chmod, so the
+# leg checks that the fixture is actually unreadable and prints an explicit skip
+# token otherwise — skipped is not passed.
+UNREADABLE="$REF_REPO/skills/demo-skill/references/unreadable.md"
+write_reference_lines "$UNREADABLE" 40
+git -C "$REF_REPO" add -A
+git -C "$REF_REPO" commit -qm "land a readable reference to make unreadable"
+chmod 000 "$UNREADABLE"
+if head -c 1 "$UNREADABLE" >/dev/null 2>&1; then
+  echo "reference_census_unreadable_leg_skipped: this process can still read a chmod-000 file (likely root) — skipped is not passed"
+else
+  run_ref
+  assert_rc "$rc" 1 "an unreadable CHANGED reference fails closed"
+  assert_contains "reference_line_census_partial" "$out" "the census says it is incomplete"
+  assert_contains "reference_line_over_limit_count_head=unknown" "$out" "an incomplete census reports unknown, never a count"
+  assert_contains "reference_line_over_limit_count_delta=unknown" "$out" "an unknown head count cannot produce a signed delta"
+  assert_contains "reference_line_block_partial: skills/demo-skill/references/unreadable.md" "$out" "the per-file verdict still runs and names the file"
+  assert_not_contains "reference_line_budget_blocking_ok" "$out" "an unreadable changed reference never earns a pass"
+fi
+chmod 644 "$UNREADABLE"
+git -C "$REF_REPO" rm -q "skills/demo-skill/references/unreadable.md"
+git -C "$REF_REPO" commit -qm "retire the unreadable fixture"
+
 # Case e8: gate wiring anchors — the validator must fail the gate on non-zero
 # and must not demote the size gate back to advisory.
 validator="$SCRIPT_DIR/check-ccl-skills.sh"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_contract_anchors.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+# Self-proof suite for check-contract-anchors.sh.
+#
+# Oracle self-proof tables (the gate is trusted only because every row below
+# was APPLIED and observed):
+#
+# MUST-HIT (mutant -> expected red token, expected rc):
+#   M1 pinned literal deleted from anchored file  -> contract_anchor_missing        rc 1
+#   M2 pinned literal duplicated in anchored file -> contract_anchor_duplicate      rc 1
+#   M3 anchored file removed                      -> contract_anchor_file_missing   rc 1
+#   M4 table emptied (comments only)              -> contract_anchor_table_empty    rc 2
+#   M5 malformed row (3 fields)                   -> contract_anchor_row_malformed  rc 2
+#   M6 literal under 16 chars                     -> contract_anchor_literal_too_short rc 2
+#   M7 duplicate anchor id                        -> contract_anchor_duplicate_id   rc 2
+#   M8 table file missing                         -> contract_anchor_table_missing  rc 2
+#   M9 malformed row + drifted anchor in one table -> BOTH reported, rc 2
+#      (integrity errors are collected, well-formed rows still evaluated,
+#       and a broken table yields no verdict — fail-closed over the drift)
+#
+# MUST-NOT-HIT (benign neighbor -> stays green, rc 0):
+#   B1 wording adjacent to the pinned literal edited (same line, outside the pin)
+#   B2 unrelated file in the tree edited freely
+#   B3 anchored file grows new content elsewhere
+#
+# DIFFERENTIAL ATTRIBUTION:
+#   D1 two anchors, one broken -> output names exactly the broken id, rc 1,
+#      and the healthy id is not reported
+#
+# REAL-REPO LEG:
+#   R1 shipped table against the repo root -> rc 0 and pinned output grammar
+#      "contract_anchor_gate_ok (<N> anchors)"
+set -u
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+checker="$script_dir/check-contract-anchors.sh"
+repo_root=$(cd "$script_dir/../../.." && pwd -P)
+fail=0
+
+note() { printf '%s\n' "$*"; }
+expect() { # expect <case> <want_rc> <got_rc> <want_token> <output>
+  local case_id="$1" want_rc="$2" got_rc="$3" want_token="$4" output="$5"
+  if [[ "$got_rc" -ne "$want_rc" ]]; then
+    note "FAIL $case_id: rc=$got_rc want=$want_rc"
+    note "$output"
+    fail=1
+    return
+  fi
+  if [[ -n "$want_token" && "$output" != *"$want_token"* ]]; then
+    note "FAIL $case_id: missing token '$want_token' in output"
+    note "$output"
+    fail=1
+    return
+  fi
+  note "ok $case_id"
+}
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+make_fixture() { # rebuild a fresh fixture tree + table under $tmp/fx
+  rm -rf "$tmp/fx"
+  mkdir -p "$tmp/fx/docs"
+  cat > "$tmp/fx/docs/sample-contract.md" <<'MD'
+# Sample contract
+
+The sample verdict is decided by exactly one discriminating predicate here.
+Unrelated surrounding prose that may change freely.
+MD
+  cat > "$tmp/fx/docs/other.md" <<'MD'
+Free-floating document with no anchors at all.
+MD
+  printf '%s\t%s\t%s\t%s\n' \
+    "sample-discriminator" "docs/sample-contract.md" \
+    "decided by exactly one discriminating predicate" "fixture row" \
+    > "$tmp/fx/anchors.tsv"
+}
+
+run() { # run <root> <table>; sets got_rc/got_out
+  got_out=$(bash "$checker" "$1" --table "$2" 2>&1)
+  got_rc=$?
+}
+
+# R1: shipped table against the real repo
+run "$repo_root" "$script_dir/contract-anchors.tsv"
+expect R1 0 "$got_rc" "contract_anchor_gate_ok (" "$got_out"
+if ! grep -qE '^contract_anchor_gate_ok \([0-9]+ anchors\)$' <<<"$got_out"; then
+  note "FAIL R1-grammar: green output grammar drifted: $got_out"
+  fail=1
+else
+  note "ok R1-grammar"
+fi
+
+# Green fixture control (precondition for every mutant below)
+make_fixture
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect C0 0 "$got_rc" "contract_anchor_gate_ok (1 anchors)" "$got_out"
+
+# M1 literal deleted
+make_fixture
+perl -pi -e 's/decided by exactly one discriminating predicate/decided case by case/' "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M1 1 "$got_rc" "contract_anchor_missing: sample-discriminator" "$got_out"
+
+# M2 literal duplicated
+make_fixture
+printf '\nA second copy: decided by exactly one discriminating predicate.\n' >> "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M2 1 "$got_rc" "contract_anchor_duplicate: sample-discriminator" "$got_out"
+
+# M3 anchored file removed
+make_fixture
+rm "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M3 1 "$got_rc" "contract_anchor_file_missing: sample-discriminator" "$got_out"
+
+# M4 table emptied
+make_fixture
+printf '# only comments\n\n' > "$tmp/fx/anchors.tsv"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M4 2 "$got_rc" "contract_anchor_table_empty" "$got_out"
+
+# M5 malformed row
+make_fixture
+printf 'bad-row\tdocs/sample-contract.md\tonly three fields\n' > "$tmp/fx/anchors.tsv"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M5 2 "$got_rc" "contract_anchor_row_malformed" "$got_out"
+
+# M6 short literal
+make_fixture
+printf 'short\tdocs/sample-contract.md\ttiny pin\tnote\n' > "$tmp/fx/anchors.tsv"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M6 2 "$got_rc" "contract_anchor_literal_too_short" "$got_out"
+
+# M7 duplicate id
+make_fixture
+printf '%s\t%s\t%s\t%s\n' "sample-discriminator" "docs/sample-contract.md" \
+  "Unrelated surrounding prose that may change" "second row same id" >> "$tmp/fx/anchors.tsv"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M7 2 "$got_rc" "contract_anchor_duplicate_id" "$got_out"
+
+# M8 table missing
+make_fixture
+run "$tmp/fx" "$tmp/fx/missing.tsv"
+expect M8 2 "$got_rc" "contract_anchor_table_missing" "$got_out"
+
+# M9 malformed row + drifted anchor: both reported in one run, rc 2
+make_fixture
+printf 'bad-row\tdocs/sample-contract.md\tonly three fields\n' >> "$tmp/fx/anchors.tsv"
+perl -pi -e 's/decided by exactly one discriminating predicate/decided informally/' "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect M9 2 "$got_rc" "contract_anchor_table_invalid" "$got_out"
+if [[ "$got_out" != *"contract_anchor_row_malformed"* || "$got_out" != *"contract_anchor_missing: sample-discriminator"* ]]; then
+  note "FAIL M9-completeness: expected both the integrity error and the drift finding in one run"
+  note "$got_out"
+  fail=1
+else
+  note "ok M9-completeness"
+fi
+
+# B1 benign neighbor: same line, outside the pinned span
+make_fixture
+perl -pi -e 's/predicate here\./predicate here, with a clarifying tail./' "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect B1 0 "$got_rc" "contract_anchor_gate_ok" "$got_out"
+
+# B2 unrelated file edited
+make_fixture
+printf 'More free text.\n' >> "$tmp/fx/docs/other.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect B2 0 "$got_rc" "contract_anchor_gate_ok" "$got_out"
+
+# B3 anchored file grows elsewhere
+make_fixture
+printf '\n## New unrelated section\n\nNew prose.\n' >> "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect B3 0 "$got_rc" "contract_anchor_gate_ok" "$got_out"
+
+# D1 differential attribution: two anchors, one broken
+make_fixture
+printf '%s\t%s\t%s\t%s\n' "healthy-anchor" "docs/sample-contract.md" \
+  "Unrelated surrounding prose that may change freely." "healthy row" >> "$tmp/fx/anchors.tsv"
+perl -pi -e 's/decided by exactly one discriminating predicate/decided informally/' "$tmp/fx/docs/sample-contract.md"
+run "$tmp/fx" "$tmp/fx/anchors.tsv"
+expect D1 1 "$got_rc" "contract_anchor_missing: sample-discriminator" "$got_out"
+if [[ "$got_out" == *"healthy-anchor"* ]]; then
+  note "FAIL D1-attribution: healthy anchor reported in failure output"
+  fail=1
+else
+  note "ok D1-attribution"
+fi
+
+if [[ "$fail" -ne 0 ]]; then
+  echo "test_check_contract_anchors: FAIL"
+  exit 1
+fi
+echo "test_check_contract_anchors: ok"