@chorus-aidlc/chorus 0.17.2 → 0.18.0

package/.next/standalone/public/chorus-plugin/bin/on-session-start.sh

@@ -67,45 +67,17 @@ if command -v jq >/dev/null 2>&1; then
 
 fi
 
-# Detect OpenSpec mode for this repo, once per session.
-# Both conditions are required for OpenSpec mode to be usable:
-#   (a) an openspec/ directory at the project root (this repo was inited via `openspec init`), AND
-#   (b) the `openspec` CLI on PATH (so we can `openspec new change`, `validate`, `archive`).
-# Overrides (precedence high -> low, first match wins):
-#   1. enableOpenSpec userConfig toggle (default true) — UI-level switch.
-#   2. CHORUS_OPENSPEC_MODE=off env var — env-level explicit opt-out.
-# When the folder is present but the CLI is missing, surface that as a
-# specific reason so the user-visible toast can hint at the install step
-# instead of silently falling back.
+# Resolve the active spec mode for this repo, once per session. The resolution
+# logic lives in resolve-spec-mode.sh (pure: env + filesystem only) so it can be
+# unit-tested — see bin/tests/test-spec-mode-resolution.sh. It sets SPEC_MODE,
+# SPEC_REASON, SPEC_FAIL, OPENSPEC_USABLE_REASON, OPENSPEC_HINT, CHORUS_OPENSPEC_ACTIVE.
 #
-# The inactive states split into two user-facing kinds:
-#   - OPENSPEC_OPTOUT=1 — the user explicitly turned OpenSpec off (plugin
-#     toggle or env var). Respect it: show a neutral note, no nag.
-#   - OPENSPEC_OPTOUT=0 — OpenSpec is simply not set up (no folder, or folder
-#     without the CLI). Point the user at `/chorus enable openspec`, which walks
-#     the actual install/init steps — the banner stays a one-liner.
+# Summary: an explicit CHORUS_SPEC_MODE (lite|openspec|off) wins; when UNSET,
+# OpenSpec stays the default whenever it is usable (openspec/ dir + CLI, not
+# disabled) and lite is the fallback only when OpenSpec is absent or disabled.
+# Legacy CHORUS_OPENSPEC_MODE=off still forces not-openspec (→ lite when unset).
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
-OPENSPEC_HINT=""
-OPENSPEC_OPTOUT=0
-if [ "${CLAUDE_PLUGIN_OPTION_ENABLEOPENSPEC:-true}" != "true" ]; then
-  CHORUS_OPENSPEC_ACTIVE=0
-  OPENSPEC_OPTOUT=1
-  OPENSPEC_REASON="enableOpenSpec userConfig=false (plugin-level opt-out)"
-elif [ "${CHORUS_OPENSPEC_MODE:-}" = "off" ]; then
-  CHORUS_OPENSPEC_ACTIVE=0
-  OPENSPEC_OPTOUT=1
-  OPENSPEC_REASON="CHORUS_OPENSPEC_MODE=off (explicit opt-out)"
-elif [ ! -d "${PROJECT_ROOT}/openspec" ]; then
-  CHORUS_OPENSPEC_ACTIVE=0
-  OPENSPEC_REASON="no openspec/ directory at ${PROJECT_ROOT}/openspec"
-elif ! command -v openspec >/dev/null 2>&1; then
-  CHORUS_OPENSPEC_ACTIVE=0
-  OPENSPEC_REASON="openspec/ directory present but \`openspec\` CLI not on PATH"
-  OPENSPEC_HINT="install with: npm i -g @fission-ai/openspec"
-else
-  CHORUS_OPENSPEC_ACTIVE=1
-  OPENSPEC_REASON="openspec/ directory + openspec CLI both present"
-fi
+. "${SCRIPT_DIR}/resolve-spec-mode.sh"
 
 # Build context for Claude (additionalContext)
 CONTEXT="# Chorus Plugin — Active
@@ -116,33 +88,33 @@ Chorus is connected at ${CHORUS_URL}. Session lifecycle hooks are enabled.
 
 ${CHECKIN_RESULT}
 
-## OpenSpec Mode
+## Spec Mode
 
-CHORUS_OPENSPEC_ACTIVE=${CHORUS_OPENSPEC_ACTIVE} (${OPENSPEC_REASON})"
+CHORUS_SPEC_MODE=${SPEC_MODE} (${SPEC_REASON})"
 
-if [ "$CHORUS_OPENSPEC_ACTIVE" = "1" ]; then
+if [ "$SPEC_MODE" = "lite" ]; then
   CONTEXT="${CONTEXT}
 
-OpenSpec mode is **active** for this session. When the proposal / develop / yolo skills reach an OpenSpec-aware step, load the openspec-aware skill at \`.claude/skills/openspec-aware/SKILL.md\` and follow §3 (OpenSpec authoring) — do NOT re-run the §1 detection block, the answer is already known.
+Routing: lite → follow the spec-lite skill (\`skills/spec-lite/SKILL.md\`). Author a Chorus-native change folder \`.chorus/specs/<slug>/\` (\`prd.md\` required; \`tech_design.md\` / \`adr.md\` / \`spec.md\` / \`guide.md\` optional) and mirror each \`<type>.md\` 1:1 into a Chorus Document of that type via \`chorus mcp call … --arg-file content=<file>\`. Do NOT scaffold \`openspec/changes/\` or add an \`OpenSpec change slug:\` line."
+elif [ "$SPEC_MODE" = "off" ]; then
+  CONTEXT="${CONTEXT}
 
-Critical rule (openspec-aware §2 Rule 1): document mirror calls (\`chorus_pm_add_document_draft\` / \`chorus_pm_update_document_draft\` / \`chorus_pm_update_document\`) MUST fill \`content\` from the local file — prefer \`chorus mcp call <tool> '<json>' --arg-file content=<file>\`, falling back to \`chorus-api.sh mcp-tool\` with \`json_encode_file\` when \`chorus\` is not on PATH. Do NOT invoke these MCP tools directly with hand-typed \`content\` in OpenSpec mode."
-else
+Routing: off → free-form, no spec artifact. Do NOT create \`.chorus/specs/\` or \`openspec/changes/\` files; author document drafts inline via direct MCP."
+elif [ -n "$SPEC_FAIL" ]; then
   CONTEXT="${CONTEXT}
 
-OpenSpec mode is **inactive** for this session. The proposal / develop / yolo skills follow their free-form path; do NOT scaffold \`openspec/changes/\`, do NOT add an \`OpenSpec change slug:\` line to proposal descriptions, and do NOT route document mirror calls through the \`chorus\` CLI or \`chorus-api.sh\`."
-  if [ "$OPENSPEC_OPTOUT" = "1" ]; then
-    CONTEXT="${CONTEXT}
+Routing: openspec → **cannot be honored** — ${SPEC_FAIL}. The proposal / yolo skill MUST halt after resolving the mode; do NOT silently fall back to lite/free-form. Surface this to the user."
+  if [ -n "$OPENSPEC_HINT" ]; then
+    CONTEXT="${CONTEXT} Install hint: ${OPENSPEC_HINT}."
+  fi
+else
+  CONTEXT="${CONTEXT}
 
-OpenSpec was **explicitly turned off** (${OPENSPEC_REASON}), so this is a deliberate choice — do NOT nag the user to enable it. If they ask to turn it back on, point them at re-enabling the plugin's \`enableOpenSpec\` toggle / unsetting \`CHORUS_OPENSPEC_MODE\`, then the OpenSpec setup section in the \`/chorus\` skill."
-  elif [ -n "$OPENSPEC_HINT" ]; then
-    CONTEXT="${CONTEXT}
+CHORUS_OPENSPEC_ACTIVE=1 (${OPENSPEC_USABLE_REASON})
 
-Note: this repo has an \`openspec/\` directory, so the user likely intends to use OpenSpec mode but the \`openspec\` CLI is not installed. Surface this to the user (e.g. \"This repo is OpenSpec-init'd but the \\\`openspec\\\` CLI isn't installed locally — ${OPENSPEC_HINT}\") before authoring documents. To set it up, run \`/chorus enable openspec\` (§6 walks the install + re-launch)."
-  else
-    CONTEXT="${CONTEXT}
+Routing: openspec → load the openspec-aware skill at \`.claude/skills/openspec-aware/SKILL.md\` and follow §3 (OpenSpec authoring) — do NOT re-run the §1 detection block, the answer is already known.
 
-Note: OpenSpec is not set up in this repo (${OPENSPEC_REASON}). Spec-driven authoring is optional — free-form works fine. If the user wants spec-driven mode (proposal.md / design.md / spec deltas mirrored into Chorus), run \`/chorus enable openspec\` — §6 walks the \`npm i -g @fission-ai/openspec\` + \`openspec init\` steps and the re-launch."
-  fi
+Critical rule (openspec-aware §2 Rule 1): document mirror calls (\`chorus_pm_add_document_draft\` / \`chorus_pm_update_document_draft\` / \`chorus_pm_update_document\`) MUST fill \`content\` from the local file — prefer \`chorus mcp call <tool> '<json>' --arg-file content=<file>\`, falling back to \`chorus-api.sh mcp-tool\` with \`json_encode_file\` when \`chorus\` is not on PATH. Do NOT invoke these MCP tools directly with hand-typed \`content\` in OpenSpec mode."
 fi
 
 CONTEXT="${CONTEXT}
@@ -164,18 +136,21 @@ Resuming with existing Chorus session: ${MAIN_SESSION}"
   "$API" mcp-tool "chorus_session_heartbeat" "$(printf '{"sessionUuid":"%s"}' "$MAIN_SESSION")" >/dev/null 2>&1 || true
 fi
 
-# Build user-visible message. When OpenSpec is off-but-enable-able, point the
-# user at `/chorus enable openspec` — the skill walks the actual install/init.
-#   active            -> (OpenSpec Enabled)
-#   not set up        -> (OpenSpec off — run `/chorus enable openspec` to set it up)
-#   explicit opt-out  -> (OpenSpec off)  [neutral, no nag — respects the choice]
+# Build user-visible message. Always states the active spec mode (lite is the
+# default); an explicit openspec that can't be honored is flagged as not usable.
+#   lite              -> (Spec: lite)
+#   off               -> (Spec: off)
+#   openspec (usable) -> (Spec: openspec)
+#   openspec (broken) -> (Spec: openspec — not usable)
 USER_MSG="Chorus connected at ${CHORUS_URL}"
-if [ "$CHORUS_OPENSPEC_ACTIVE" = "1" ]; then
-  USER_MSG="${USER_MSG} (OpenSpec Enabled)"
-elif [ "$OPENSPEC_OPTOUT" = "1" ]; then
-  USER_MSG="${USER_MSG} (OpenSpec off)"
+if [ "$SPEC_MODE" = "lite" ]; then
+  USER_MSG="${USER_MSG} (Spec: lite)"
+elif [ "$SPEC_MODE" = "off" ]; then
+  USER_MSG="${USER_MSG} (Spec: off)"
+elif [ -n "$SPEC_FAIL" ]; then
+  USER_MSG="${USER_MSG} (Spec: openspec — not usable)"
 else
-  USER_MSG="${USER_MSG} (OpenSpec off — run \`/chorus enable openspec\` to set it up)"
+  USER_MSG="${USER_MSG} (Spec: openspec)"
 fi
 if [ -n "$MAIN_SESSION" ]; then
   USER_MSG="${USER_MSG} (resumed session)"

package/.next/standalone/public/chorus-plugin/bin/resolve-spec-mode.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# resolve-spec-mode.sh — resolve the active Chorus spec mode for a repo.
+#
+# Pure (env + filesystem only; no network). Sourced by on-session-start.sh and
+# driven directly by tests/test-spec-mode-resolution.sh. Bash 3.2 compatible.
+#
+# Inputs (env):
+#   CHORUS_SPEC_MODE                    explicit override: lite | openspec | off (else unset)
+#   CHORUS_OPENSPEC_MODE                legacy opt-out: "off" disables OpenSpec
+#   CLAUDE_PLUGIN_OPTION_ENABLEOPENSPEC plugin toggle: "false" disables OpenSpec (default "true")
+#   PROJECT_ROOT                        repo root to probe for openspec/ (defaults to $PWD)
+#   command -v openspec                 OpenSpec CLI presence on PATH
+#
+# Outputs (vars set in the caller's shell when sourced):
+#   SPEC_MODE              lite | openspec | off      (value surfaced to Claude)
+#   SPEC_REASON            human-readable one-liner
+#   SPEC_FAIL              non-empty => stage skill MUST halt (unsatisfiable explicit openspec)
+#   OPENSPEC_USABLE        1 | 0
+#   OPENSPEC_USABLE_REASON human-readable
+#   OPENSPEC_HINT          install hint when OpenSpec is merely missing (else empty)
+#   CHORUS_OPENSPEC_ACTIVE 1 only when the resolved mode is a USABLE openspec
+#
+# Resolution (per owner): an explicit CHORUS_SPEC_MODE wins; when UNSET, OpenSpec
+# stays the default whenever it is usable (openspec/ dir + CLI, not disabled), and
+# lite is the fallback only when OpenSpec is absent or disabled.
+
+: "${PROJECT_ROOT:=$PWD}"
+
+# --- Is OpenSpec usable? (needs openspec/ dir + CLI on PATH + not disabled) ---
+OPENSPEC_DISABLED=0
+OPENSPEC_DISABLED_REASON=""
+if [ "${CLAUDE_PLUGIN_OPTION_ENABLEOPENSPEC:-true}" != "true" ]; then
+  OPENSPEC_DISABLED=1
+  OPENSPEC_DISABLED_REASON="enableOpenSpec userConfig=false (plugin-level opt-out)"
+elif [ "${CHORUS_OPENSPEC_MODE:-}" = "off" ]; then
+  OPENSPEC_DISABLED=1
+  OPENSPEC_DISABLED_REASON="CHORUS_OPENSPEC_MODE=off (legacy opt-out)"
+fi
+
+OPENSPEC_USABLE=0
+OPENSPEC_USABLE_REASON=""
+OPENSPEC_HINT=""
+if [ "$OPENSPEC_DISABLED" = "1" ]; then
+  OPENSPEC_USABLE_REASON="$OPENSPEC_DISABLED_REASON"
+elif [ ! -d "${PROJECT_ROOT}/openspec" ]; then
+  OPENSPEC_USABLE_REASON="no openspec/ directory at ${PROJECT_ROOT}/openspec"
+  OPENSPEC_HINT="npm i -g @fission-ai/openspec && openspec init"
+elif ! command -v openspec >/dev/null 2>&1; then
+  OPENSPEC_USABLE_REASON="openspec/ directory present but \`openspec\` CLI not on PATH"
+  OPENSPEC_HINT="npm i -g @fission-ai/openspec"
+else
+  OPENSPEC_USABLE=1
+  OPENSPEC_USABLE_REASON="openspec/ directory + openspec CLI both present"
+fi
+
+# --- Resolve CHORUS_SPEC_MODE ---
+SPEC_FAIL=""
+case "${CHORUS_SPEC_MODE:-}" in
+  lite)
+    SPEC_MODE="lite"
+    SPEC_REASON="explicit — Chorus-native lightweight specs in .chorus/specs/<slug>/"
+    ;;
+  off)
+    SPEC_MODE="off"
+    SPEC_REASON="explicit — free-form, no spec artifact"
+    ;;
+  openspec)
+    SPEC_MODE="openspec"
+    if [ "$OPENSPEC_USABLE" = "1" ]; then
+      SPEC_REASON="explicit; ${OPENSPEC_USABLE_REASON}"
+    elif [ "$OPENSPEC_DISABLED" = "1" ]; then
+      SPEC_REASON="explicit, but OpenSpec is disabled: ${OPENSPEC_USABLE_REASON}"
+      SPEC_FAIL="config conflict — CHORUS_SPEC_MODE=openspec vs OpenSpec disabled (${OPENSPEC_USABLE_REASON}); re-enable OpenSpec or set CHORUS_SPEC_MODE=lite"
+    else
+      SPEC_REASON="explicit, but OpenSpec is not installed: ${OPENSPEC_USABLE_REASON}"
+      SPEC_FAIL="OpenSpec not usable (${OPENSPEC_USABLE_REASON})"
+    fi
+    ;;
+  "")
+    # Unset: OpenSpec is the default when usable; lite is the fallback otherwise.
+    if [ "$OPENSPEC_USABLE" = "1" ]; then
+      SPEC_MODE="openspec"
+      SPEC_REASON="default — ${OPENSPEC_USABLE_REASON}; set CHORUS_SPEC_MODE=lite for Chorus-native specs, =off to disable"
+    else
+      SPEC_MODE="lite"
+      SPEC_REASON="default — OpenSpec not usable (${OPENSPEC_USABLE_REASON}); using Chorus-native lightweight specs in .chorus/specs/<slug>/"
+    fi
+    ;;
+  *)
+    # Unrecognized value: treat like unset (OpenSpec-if-usable, else lite).
+    if [ "$OPENSPEC_USABLE" = "1" ]; then
+      SPEC_MODE="openspec"
+      SPEC_REASON="CHORUS_SPEC_MODE='${CHORUS_SPEC_MODE}' unrecognized; falling back to default (${OPENSPEC_USABLE_REASON})"
+    else
+      SPEC_MODE="lite"
+      SPEC_REASON="CHORUS_SPEC_MODE='${CHORUS_SPEC_MODE}' unrecognized; OpenSpec not usable, defaulting to lite"
+    fi
+    ;;
+esac
+
+# Back-compat flag for the openspec-aware skill: active only when the resolved
+# mode is a USABLE openspec.
+if [ "$SPEC_MODE" = "openspec" ] && [ -z "$SPEC_FAIL" ]; then
+  CHORUS_OPENSPEC_ACTIVE=1
+else
+  CHORUS_OPENSPEC_ACTIVE=0
+fi

package/.next/standalone/public/chorus-plugin/bin/tests/test-resolver-drift.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# test-resolver-drift.sh — enforce the single-source invariant for the bash
+# spec-mode resolver. resolve-spec-mode.sh is COPIED into each bash plugin port
+# (Claude Code, Codex, Kiro, …); those copies MUST stay byte-identical to the
+# canonical Claude Code copy, or the "one computation of the mode" guarantee
+# silently rots as ports diverge. The 13-case matrix test covers the canonical
+# copy; this guard makes every other copy equal to it. Bash 3.2 compatible.
+set -u
+
+# Repo root = four levels up from this script (tests → bin → chorus-plugin → public → repo).
+ROOT="$(cd "$(dirname "$0")/../../../.." && pwd)"
+CANON="$ROOT/public/chorus-plugin/bin/resolve-spec-mode.sh"
+
+if [ ! -f "$CANON" ]; then
+  echo "FATAL: canonical resolver not found at $CANON" >&2
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+echo "resolver drift-guard (canonical: public/chorus-plugin/bin/resolve-spec-mode.sh):"
+
+# Every bash copy under public/, plugins/ or packages/ (excludes node_modules /
+# build output). packages/ is included because the OpenClaw plugin — which has no
+# SessionStart channel and so resolves the mode from its skill — SHIPS this
+# resolver rather than hand-rolling the rule in Markdown.
+COPIES=$(find "$ROOT/public" "$ROOT/plugins" "$ROOT/packages" -name resolve-spec-mode.sh 2>/dev/null \
+  | grep -v '/node_modules/' | grep -v '/dist/' | sort)
+
+for f in $COPIES; do
+  rel="${f#$ROOT/}"
+  if [ "$f" = "$CANON" ]; then
+    echo "  --    $rel (canonical)"
+    continue
+  fi
+  if diff -q "$CANON" "$f" >/dev/null 2>&1; then
+    PASS=$((PASS + 1)); echo "  PASS  $rel (byte-identical)"
+  else
+    FAIL=$((FAIL + 1)); echo "  FAIL  $rel DIFFERS from canonical:"
+    diff "$CANON" "$f" | sed 's/^/        /'
+  fi
+done
+
+echo ""
+echo "Results: $PASS identical copy(ies), $FAIL drifted"
+[ "$FAIL" -eq 0 ]

package/.next/standalone/public/chorus-plugin/bin/tests/test-skill-harness-fidelity-negative.sh

@@ -0,0 +1,328 @@
+#!/usr/bin/env bash
+# test-skill-harness-fidelity-negative.sh — negative cases for the fidelity guard.
+#
+# A blacklist guard that passes on a tree it never scanned is worse than no guard,
+# so this harness plants each blacklisted literal into a synthetic repo and asserts
+# the guard actually FAILS. Every case runs twice: once under a plain path and once
+# under a path containing a space, because the original guard word-split its scope
+# string and reported "3 PASS" on a repo checked out under e.g.
+# "/Users/me/My Repos/Chorus" while having searched nothing.
+#
+# Bash 3.2 compatible.
+set -u
+
+GUARD="$(cd "$(dirname "$0")" && pwd)/test-skill-harness-fidelity.sh"
+if [ ! -x "$GUARD" ]; then
+  echo "FATAL: guard not found or not executable at $GUARD" >&2
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+TMPROOT="$(mktemp -d)"
+trap 'rm -rf "$TMPROOT"' EXIT
+
+# scaffold <repo-root> — a minimal tree with every path the guard scans, all clean.
+# Missing paths are themselves a scan error now, so the clean case must be complete.
+scaffold() {
+  _r="$1"
+  mkdir -p "$_r/public/chorus-plugin/bin/tests" \
+           "$_r/public/chorus-plugin/skills/develop" \
+           "$_r/public/chorus-plugin/agents" \
+           "$_r/public/kiro-plugin/.kiro/skills" \
+           "$_r/public/kiro-plugin/.kiro/agents" \
+           "$_r/public/kiro-plugin/.kiro/steering" \
+           "$_r/public/skill/proposal-reviewer-chorus" \
+           "$_r/packages/chorus-dsh/skills" \
+           "$_r/packages/chorus-dsh/skills/proposal-reviewer-chorus" \
+           "$_r/packages/chorus-pi/agents" \
+           "$_r/packages/openclaw-plugin/skills/proposal-reviewer" \
+           "$_r/plugins/chorus/skills" \
+           "$_r/plugins/chorus/skills/chorus-proposal-reviewer" \
+           "$_r/docs"
+  printf 'clean skill text, wait using your harness mechanism\n' \
+    > "$_r/public/chorus-plugin/skills/develop/SKILL.md"
+  printf '# SPEC_LITE\nthe template is inlined here\n' > "$_r/docs/SPEC_LITE.md"
+  cp "$GUARD" "$_r/public/chorus-plugin/bin/tests/$(basename "$GUARD")"
+
+  # ── The seven proposal-reviewer surfaces, all carrying the canonical rule.
+  # Checks 4-6 fail on a missing enumerated path, so a clean tree needs all seven
+  # present AND compliant. The truthful "Any shell command beyond read-only
+  # inspection —" sentence is included deliberately: it must not trip check 4.
+  for _pr in "public/chorus-plugin/agents/proposal-reviewer.md" \
+             "plugins/chorus/skills/chorus-proposal-reviewer/SKILL.md" \
+             "packages/chorus-pi/agents/chorus-proposal-reviewer.md" \
+             "packages/chorus-dsh/skills/proposal-reviewer-chorus/SKILL.md" \
+             "packages/openclaw-plugin/skills/proposal-reviewer/SKILL.md" \
+             "public/skill/proposal-reviewer-chorus/SKILL.md"; do
+    printf 'Bash is READ-ONLY inspection only: ls, cat, grep/rg, find.\n' > "$_r/$_pr"
+    printf 'No file writes, no git write ops, no installs, no test/build runs.\n' >> "$_r/$_pr"
+    printf 'Any shell command beyond read-only inspection — no file writes.\n' >> "$_r/$_pr"
+    printf 'Use it to confirm a file or directory exists before flagging it as missing.\n' >> "$_r/$_pr"
+  done
+  # Claude Code's file additionally needs the frontmatter list check 6 reads.
+  cat > "$_r/public/chorus-plugin/agents/proposal-reviewer.md" <<'CCAGENT'
+---
+disallowedTools:
+  - Agent
+  - Edit
+  - Write
+---
+Bash is READ-ONLY inspection only: ls, cat, grep/rg, find.
+No file writes, no git write ops, no installs, no test/build runs.
+Any shell command beyond read-only inspection — no file writes.
+Use it to confirm a file or directory exists before flagging it as missing.
+CCAGENT
+  # Kiro states the rule inside a JSON prompt string and names its tool `shell`.
+  cat > "$_r/public/kiro-plugin/.kiro/agents/chorus-proposal-reviewer.json" <<'KIROAGENT'
+{
+  "name": "chorus-proposal-reviewer",
+  "tools": [
+    "read",
+    "shell",
+    "@chorus"
+  ],
+  "prompt": "Shell is READ-ONLY inspection only: ls, cat, grep/rg, find. No file writes, no git write ops, no installs, no test/build runs. Use it to confirm a file or directory exists before flagging it as missing."
+}
+KIROAGENT
+  # ── Check 4's extra scope: the Kiro orchestrator prompt and steering doc.
+  # Not reviewer definitions (so check 5 never looks at them), but they describe the
+  # grant to the agent that spawns the reviewer — a false claim here misleads it.
+  printf 'chorus-proposal-reviewer is scoped `tools: ["read", "shell", "@chorus"]`.\n' \
+    > "$_r/public/kiro-plugin/.kiro/agents/chorus.md"
+  printf 'chorus-proposal-reviewer is scoped `tools: ["read", "shell", "@chorus"]`.\n' \
+    > "$_r/public/kiro-plugin/.kiro/steering/chorus.md"
+}
+
+# run_guard <repo-root> — echo the guard's exit code, discarding its output.
+run_guard() {
+  "$1/public/chorus-plugin/bin/tests/$(basename "$GUARD")" >/dev/null 2>&1
+  echo $?
+}
+
+# expect <label> <repo-root> <want-rc-zero|want-rc-nonzero>
+expect() {
+  _label="$1"; _r="$2"; _want="$3"
+  _rc="$(run_guard "$_r")"
+  case "$_want" in
+    zero)    if [ "$_rc" -eq 0 ]; then PASS=$((PASS+1)); echo "  PASS  $_label (exit 0)"
+             else FAIL=$((FAIL+1)); echo "  FAIL  $_label — wanted exit 0, got $_rc"; fi ;;
+    nonzero) if [ "$_rc" -ne 0 ]; then PASS=$((PASS+1)); echo "  PASS  $_label (exit $_rc)"
+             else FAIL=$((FAIL+1)); echo "  FAIL  $_label — guard reported PASS but the literal is present"; fi ;;
+  esac
+}
+
+# case_in <dirname> — build a fresh scaffold under TMPROOT/<dirname>, echo its path.
+case_in() {
+  _d="$TMPROOT/$1"
+  rm -rf "$_d"; mkdir -p "$_d"
+  scaffold "$_d"
+  echo "$_d"
+}
+
+echo "skill/harness fidelity guard — negative cases (plain path AND path with a space):"
+echo ""
+
+for dirname in "plain" "with spaces"; do
+  echo "--- repo root: .../$dirname"
+
+  R="$(case_in "$dirname")"
+  expect "clean tree passes" "$R" zero
+
+  R="$(case_in "$dirname")"
+  printf 'Use TeamCreate to spawn the team\n' >> "$R/plugins/chorus/skills/note.md"
+  expect "check 1 catches TeamCreate" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'Run the reviewer synchronously and read the result\n' \
+    >> "$R/public/chorus-plugin/skills/develop/SKILL.md"
+  expect "check 2 catches 'reviewer synchronously'" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'the subagent waits and returns the VERDICT to you\n' \
+    >> "$R/public/kiro-plugin/.kiro/skills/SKILL.md"
+  expect "check 2 catches 'waits and returns the VERDICT' (kiro)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'spawn it in **foreground** so it blocks\n' >> "$R/packages/chorus-dsh/skills/SKILL.md"
+  expect "check 2 catches 'in **foreground**' (dsh)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'the launch returns the VERDICT inline\n' \
+    >> "$R/public/chorus-plugin/skills/develop/SKILL.md"
+  expect "check 2 catches 'returns the VERDICT inline'" "$R" nonzero
+
+  # dsh legitimately keeps run_in_background: false, so only this exact
+  # parenthesised imperative is blacklisted — not the flag itself.
+  R="$(case_in "$dirname")"
+  printf 'wait for it (do NOT set run_in_background)\n' \
+    >> "$R/packages/chorus-dsh/skills/SKILL.md"
+  expect "check 2 catches '(do NOT set run_in_background)' (dsh)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'Copy .chorus/specs/TEMPLATE/spec.md to start\n' >> "$R/docs/SPEC_LITE.md"
+  expect "check 3 catches .chorus/specs/TEMPLATE" "$R" nonzero
+
+  # chorus-pi is excluded from check 2 on purpose: its blocking `subagent` really
+  # does return the VERDICT, so the phrase is true there and must NOT trip a FAIL.
+  R="$(case_in "$dirname")"
+  mkdir -p "$R/packages/chorus-pi/skills"
+  printf 'the blocking subagent waits and returns the VERDICT\n' \
+    >> "$R/packages/chorus-pi/skills/SKILL.md"
+  expect "check 2 still exempts packages/chorus-pi" "$R" zero
+
+  # dsh's real wording must stay green. If someone later replaces the literal
+  # blacklist with a proximity rule pairing run_in_background against
+  # "foreground"/"synchronous"/"inline", this case fails a correct tree — which
+  # is exactly the regression the guard's header forbids.
+  R="$(case_in "$dirname")"
+  printf 'Spawn the reviewer with run_in_background: false and read its result.\n' \
+    >> "$R/packages/chorus-dsh/skills/SKILL.md"
+  expect "check 2 allows dsh's legitimate run_in_background: false" "$R" zero
+
+  # A scan that cannot run must never look like "no hits".
+  R="$(case_in "$dirname")"
+  rm -rf "$R/packages/chorus-dsh"
+  expect "missing scope path fails instead of passing" "$R" nonzero
+
+  # ── Check 4 — shell-disabled claims, one fixture per phrasing family ──────
+  R="$(case_in "$dirname")"
+  printf -- '- **You are READ-ONLY.** Do NOT run Bash.\n' \
+    >> "$R/packages/chorus-dsh/skills/proposal-reviewer-chorus/SKILL.md"
+  expect "check 4 catches 'Do NOT run Bash' (dsh reviewer)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'You have `read` and `@chorus` tools — no `shell`, no `write`.\n' \
+    >> "$R/public/kiro-plugin/.kiro/agents/chorus-proposal-reviewer.json"
+  expect "check 4 catches 'no \`shell\`' (kiro reviewer)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'Bash is disabled for this agent.\n' \
+    >> "$R/packages/chorus-pi/agents/chorus-proposal-reviewer.md"
+  expect "check 4 catches 'Bash is disabled' (pi reviewer)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'Running any shell commands is prohibited.\n' \
+    >> "$R/plugins/chorus/skills/chorus-proposal-reviewer/SKILL.md"
+  expect "check 4 catches 'Running any shell commands' (codex reviewer)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'You cannot run shell commands.\n' \
+    >> "$R/public/skill/proposal-reviewer-chorus/SKILL.md"
+  expect "check 4 catches 'cannot run shell' (standalone skill)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'Do not edit files or run Bash commands.\n' \
+    >> "$R/packages/openclaw-plugin/skills/proposal-reviewer/SKILL.md"
+  expect "check 4 catches 'or run Bash commands' (openclaw reviewer)" "$R" nonzero
+
+  # Check 4's extra scope: the orchestrator prompt and the steering doc. These two
+  # carried the "no `shell`" claim while sitting outside the guard, which is how the
+  # false statement survived the fix — so each gets its own fixture.
+  R="$(case_in "$dirname")"
+  printf 'Each reviewer is scoped `tools: ["read", "@chorus"]`, no `shell`.\n' \
+    >> "$R/public/kiro-plugin/.kiro/agents/chorus.md"
+  expect "check 4 catches 'no \`shell\`' (kiro orchestrator prompt)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  printf 'The reviewer cannot run shell commands.\n' \
+    >> "$R/public/kiro-plugin/.kiro/steering/chorus.md"
+  expect "check 4 catches 'cannot run shell' (kiro steering doc)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  rm -f "$R/public/kiro-plugin/.kiro/agents/chorus.md"
+  expect "a deleted check-4-only file fails instead of being skipped" "$R" nonzero
+
+  # The clean tree passes with neither of those two files carrying the canonical
+  # rule markers — that is check 5 correctly ignoring them (they are orchestrator
+  # prose, not reviewer definitions). Adding them to PR_FILES would break it.
+
+  # The truthful sentence every surface keeps must NOT trip check 4. This is the
+  # false positive an under-anchored blacklist (a bare "shell"/"Bash") would cause.
+  R="$(case_in "$dirname")"
+  printf 'Any shell command beyond read-only inspection — no git write ops.\n' \
+    >> "$R/public/skill/proposal-reviewer-chorus/SKILL.md"
+  expect "check 4 allows the truthful 'beyond read-only inspection' prose" "$R" zero
+
+  # ── Check 5 — the canonical rule must be present, all three markers ───────
+  R="$(case_in "$dirname")"
+  grep -v 'READ-ONLY inspection only' \
+    "$R/packages/openclaw-plugin/skills/proposal-reviewer/SKILL.md" > "$R/tmp.md"
+  mv "$R/tmp.md" "$R/packages/openclaw-plugin/skills/proposal-reviewer/SKILL.md"
+  expect "check 5 catches a missing read-only-inspection marker (openclaw)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  grep -v 'before flagging it as missing' \
+    "$R/packages/chorus-dsh/skills/proposal-reviewer-chorus/SKILL.md" > "$R/tmp.md"
+  mv "$R/tmp.md" "$R/packages/chorus-dsh/skills/proposal-reviewer-chorus/SKILL.md"
+  expect "check 5 catches a missing existence-check obligation (dsh)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  grep -v 'no installs, no test/build runs' \
+    "$R/packages/chorus-pi/agents/chorus-proposal-reviewer.md" > "$R/tmp.md"
+  mv "$R/tmp.md" "$R/packages/chorus-pi/agents/chorus-proposal-reviewer.md"
+  expect "check 5 catches a missing forbidden-command list (pi)" "$R" nonzero
+
+  # ── Enumerated path deleted — must FAIL, never be silently skipped ────────
+  R="$(case_in "$dirname")"
+  rm -f "$R/public/skill/proposal-reviewer-chorus/SKILL.md"
+  expect "a deleted enumerated surface fails instead of being skipped" "$R" nonzero
+
+  # ── Check 6 — the tool grants behind the rule ────────────────────────────
+  R="$(case_in "$dirname")"
+  # awk, not `sed 's/…/…\n…/'` — BSD sed (macOS) does not expand \n in the
+  # replacement, so the sed form would silently insert a literal "n" and the
+  # fixture would prove nothing.
+  awk '{print} /^  - Agent$/{print "  - Bash"}' \
+    "$R/public/chorus-plugin/agents/proposal-reviewer.md" > "$R/tmp.md"
+  mv "$R/tmp.md" "$R/public/chorus-plugin/agents/proposal-reviewer.md"
+  expect "check 6 catches '- Bash' re-added to disallowedTools (claude code)" "$R" nonzero
+
+  # Two evasions of a whole-line `- Bash` match, both of which YAML accepts and a
+  # harness would honour: flow style, and a quoted entry.
+  R="$(case_in "$dirname")"
+  awk '/^disallowedTools:$/{print "disallowedTools: [Bash, Agent, Edit, Write]"; skip=1; next}
+       skip&&/^[[:space:]]*-[[:space:]]/{next} {skip=0; print}' \
+    "$R/public/chorus-plugin/agents/proposal-reviewer.md" > "$R/tmp.md"
+  mv "$R/tmp.md" "$R/public/chorus-plugin/agents/proposal-reviewer.md"
+  expect "check 6 catches Bash in a YAML flow-style disallowedTools (claude code)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  awk '{print} /^  - Agent$/{print "  - \"Bash\""}' \
+    "$R/public/chorus-plugin/agents/proposal-reviewer.md" > "$R/tmp.md"
+  mv "$R/tmp.md" "$R/public/chorus-plugin/agents/proposal-reviewer.md"
+  expect "check 6 catches a quoted '- \"Bash\"' entry (claude code)" "$R" nonzero
+
+  # Two more evasions YAML accepts inside the list: a `#` comment line and a blank
+  # line before `- Bash`. An extractor that treats either as the end of the list
+  # reports PASS on a tree whose deny list really does contain Bash.
+  R="$(case_in "$dirname")"
+  awk '{print} /^  - Agent$/{print "  # restrict shell"; print "  - Bash"}' \
+    "$R/public/chorus-plugin/agents/proposal-reviewer.md" > "$R/tmp.md"
+  mv "$R/tmp.md" "$R/public/chorus-plugin/agents/proposal-reviewer.md"
+  expect "check 6 catches '- Bash' after a comment line in the list (claude code)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  awk '{print} /^  - Agent$/{print ""; print "  - Bash"}' \
+    "$R/public/chorus-plugin/agents/proposal-reviewer.md" > "$R/tmp.md"
+  mv "$R/tmp.md" "$R/public/chorus-plugin/agents/proposal-reviewer.md"
+  expect "check 6 catches '- Bash' after a blank line in the list (claude code)" "$R" nonzero
+
+  R="$(case_in "$dirname")"
+  grep -v '"shell",' "$R/public/kiro-plugin/.kiro/agents/chorus-proposal-reviewer.json" \
+    > "$R/tmp.json"
+  mv "$R/tmp.json" "$R/public/kiro-plugin/.kiro/agents/chorus-proposal-reviewer.json"
+  expect "check 6 catches \`shell\` dropped from kiro's tools" "$R" nonzero
+
+  # A `Bash` mention elsewhere in the Claude Code agent body is not a tool denial —
+  # only a `- Bash` entry inside the disallowedTools list is.
+  R="$(case_in "$dirname")"
+  printf 'Bash inspection findings belong in the VERDICT comment.\n' \
+    >> "$R/public/chorus-plugin/agents/proposal-reviewer.md"
+  expect "check 6 does not fire on 'Bash' outside the disallowedTools list" "$R" zero
+
+  echo ""
+done
+
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]