@devrik-tools/claude-gates 0.2.0 → 0.3.0

package/plugins/gates/hooks/gates/sdd-specs/edge.edge.test.mjs

@@ -1,130 +0,0 @@
-// Edge-case probes for sdd-specs. Previously: (1) an Edit (new_string) bypassed the
-// content check the same way as feature-catalog; (2) malformed JSON content failed
-// open (parseJsonOrNull -> null -> features=[] -> nothing to check); (3) the catalog
-// lookup was relative to process.cwd() only, so a monorepo subpackage's own
-// .ai/feature_list.json living outside cwd was invisible to findCatalog. All three are
-// now fixed: writtenContentOf()/writtenPathOf() read every field shape, invalid JSON on
-// a catalog write now denies (fail-closed) instead of silently allowing, and
-// findCatalog also resolves catalogLocations relative to the written file's own
-// directory.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function makeProject() {
-  const project = mkdtempSync(join(tmpdir(), 'sdd-specs-edge-'));
-  mkdirSync(join(project, '.git'));
-  return project;
-}
-
-function writeProjectConfig(project, config) {
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-}
-
-function runGate(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enableGate(project) {
-  writeProjectConfig(project, { gates: { requireSpecBeforeImplementing: true } });
-}
-
-test('FIXED: an Edit (new_string) moving a feature to spec_ready with no contract is now detected', () => {
-  const project = makeProject();
-  enableGate(project);
-  writeFileSync(join(project, '.ai', 'feature_list.json'), JSON.stringify({ features: [] }));
-  mkdirSync(join(project, '.ai', 'features', 'checkout'), { recursive: true });
-  const payload = {
-    tool_name: 'Edit',
-    tool_input: {
-      file_path: join(project, '.ai', 'feature_list.json'),
-      old_string: 'x',
-      new_string: JSON.stringify({
-        features: [{ name: 'checkout', status: 'spec_ready' }],
-      }),
-    },
-  };
-  assert.ok(
-    isDeny(runGate(project, payload)),
-    'writtenContentOf reads new_string and catches the spec_ready-with-no-contract write',
-  );
-});
-
-test('FIXED: malformed/invalid JSON content on a catalog write now denies (fail-closed)', () => {
-  const project = makeProject();
-  enableGate(project);
-  writeFileSync(join(project, '.ai', 'feature_list.json'), JSON.stringify({ features: [] }));
-  mkdirSync(join(project, '.ai', 'features', 'checkout'), { recursive: true });
-  const payload = {
-    tool_name: 'Write',
-    tool_input: {
-      file_path: join(project, '.ai', 'feature_list.json'),
-      // deliberately invalid JSON (unquoted keys): the gate can no longer verify the
-      // spec-contract invariant for this write, so it denies instead of allowing.
-      content:
-        '{features: [{name: "checkout", status: "spec_ready"}]}',
-    },
-  };
-  assert.ok(
-    isDeny(runGate(project, payload)),
-    'malformed JSON targeting the catalog must deny, not fail open',
-  );
-});
-
-test('FIXED: a catalog living outside process.cwd() is now found via the written path', () => {
-  const project = makeProject();
-  enableGate(project);
-  // The catalog lives under sub/.ai/feature_list.json, not the project root's .ai/ --
-  // findCatalog now also resolves catalogLocations relative to dirname(writtenPath).
-  mkdirSync(join(project, 'sub', '.ai', 'features', 'checkout'), { recursive: true });
-  writeFileSync(
-    join(project, 'sub', '.ai', 'feature_list.json'),
-    JSON.stringify({ features: [{ name: 'checkout', status: 'spec_ready' }] }),
-  );
-  const payload = {
-    tool_name: 'Write',
-    tool_input: {
-      file_path: join(project, 'sub', '.ai', 'feature_list.json'),
-      content: JSON.stringify({
-        features: [{ name: 'checkout', status: 'spec_ready' }],
-      }),
-    },
-  };
-  assert.ok(
-    isDeny(runGate(project, payload)),
-    'a subpackage catalog reached via its own written path must now be inspected',
-  );
-});
-
-test('OK: the equivalent Write-tool payload at the project root IS caught (control)', () => {
-  const project = makeProject();
-  enableGate(project);
-  writeFileSync(join(project, '.ai', 'feature_list.json'), JSON.stringify({ features: [] }));
-  const payload = {
-    tool_name: 'Write',
-    tool_input: {
-      file_path: join(project, '.ai', 'feature_list.json'),
-      content: JSON.stringify({
-        features: [{ name: 'checkout', status: 'spec_ready' }],
-      }),
-    },
-  };
-  assert.ok(isDeny(runGate(project, payload)), 'control failed');
-});

package/plugins/gates/hooks/gates/sdd-specs/test.mjs

@@ -1,163 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function makeProject() {
-  const project = mkdtempSync(join(tmpdir(), 'sdd-specs-'));
-  mkdirSync(join(project, '.git'));
-  return project;
-}
-
-function writeProjectConfig(project, config) {
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-}
-
-function runGate(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt, subagentType = 'backend') {
-  return {
-    tool_name: 'Agent',
-    tool_input: { prompt, subagent_type: subagentType },
-  };
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enableGate(project) {
-  writeProjectConfig(project, {
-    gates: { requireSpecBeforeImplementing: true },
-  });
-}
-
-test('auto-off: no catalog anywhere allows implementation delegation', () => {
-  const project = makeProject();
-  enableGate(project);
-  const prompt =
-    'Nivel: STANDARD\nImplementá el checkout citando .ai/features/checkout/tasks/t1/';
-  assert.equal(runGate(project, delegate(prompt)), null);
-});
-
-test('denies an implementation delegation citing a feature with no contract on disk', () => {
-  const project = makeProject();
-  enableGate(project);
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(
-    join(project, '.ai', 'feature_list.json'),
-    JSON.stringify({ features: [] }),
-  );
-  // features tree exists but the cited feature has no contract file
-  mkdirSync(join(project, '.ai', 'features', 'checkout'), { recursive: true });
-  const prompt =
-    'Nivel: STANDARD\nImplementá .ai/features/checkout/ el flujo de pago.';
-  assert.ok(isDeny(runGate(project, delegate(prompt))));
-});
-
-test('allows an implementation delegation citing a feature with a non-empty contract', () => {
-  const project = makeProject();
-  enableGate(project);
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(
-    join(project, '.ai', 'feature_list.json'),
-    JSON.stringify({ features: [] }),
-  );
-  mkdirSync(join(project, '.ai', 'features', 'checkout'), { recursive: true });
-  writeFileSync(
-    join(project, '.ai', 'features', 'checkout', 'brief.md'),
-    '# Checkout\n\nObjetivo: cobrar.',
-  );
-  const prompt =
-    'Nivel: STANDARD\nImplementá .ai/features/checkout/ el flujo de pago.';
-  assert.equal(runGate(project, delegate(prompt)), null);
-});
-
-test('disabled by config: the gate does not run', () => {
-  const project = makeProject();
-  writeProjectConfig(project, {
-    gates: { requireSpecBeforeImplementing: false },
-  });
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(
-    join(project, '.ai', 'feature_list.json'),
-    JSON.stringify({ features: [] }),
-  );
-  mkdirSync(join(project, '.ai', 'features', 'checkout'), { recursive: true });
-  const prompt =
-    'Nivel: STANDARD\nImplementá .ai/features/checkout/ el flujo de pago.';
-  assert.equal(runGate(project, delegate(prompt)), null);
-});
-
-test('a prompt that only describes, does not order, is exempt via QUESTION level', () => {
-  const project = makeProject();
-  enableGate(project);
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(
-    join(project, '.ai', 'feature_list.json'),
-    JSON.stringify({ features: [] }),
-  );
-  mkdirSync(join(project, '.ai', 'features', 'checkout'), { recursive: true });
-  const prompt =
-    'Nivel: QUESTION\nExplicá cómo funciona .ai/features/checkout/ hoy.';
-  assert.equal(runGate(project, delegate(prompt)), null);
-});
-
-test('exemptSubagents param override exempts a custom subagent type', () => {
-  const project = makeProject();
-  writeProjectConfig(project, {
-    gates: {
-      requireSpecBeforeImplementing: {
-        enabled: true,
-        exemptSubagents: ['worker'],
-      },
-    },
-  });
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(
-    join(project, '.ai', 'feature_list.json'),
-    JSON.stringify({ features: [] }),
-  );
-  mkdirSync(join(project, '.ai', 'features', 'checkout'), { recursive: true });
-  const prompt =
-    'Nivel: STANDARD\nImplementá .ai/features/checkout/ el flujo de pago.';
-  assert.equal(runGate(project, delegate(prompt, 'worker')), null);
-});
-
-test('a catalog write moving a feature to spec_ready without contract is denied', () => {
-  const project = makeProject();
-  enableGate(project);
-  mkdirSync(join(project, '.ai', 'features'), { recursive: true });
-  // The catalog already exists on disk (an Edit to an existing file); the write below
-  // is the new content about to replace it.
-  writeFileSync(
-    join(project, '.ai', 'feature_list.json'),
-    JSON.stringify({ features: [] }),
-  );
-  const write = {
-    tool_name: 'Write',
-    tool_input: {
-      file_path: join(project, '.ai', 'feature_list.json'),
-      content: JSON.stringify({
-        features: [{ name: 'checkout', status: 'spec_ready' }],
-      }),
-    },
-  };
-  assert.ok(isDeny(runGate(project, write)));
-});

package/plugins/gates/hooks/gates/stop-pending/test.mjs

@@ -1,114 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function setupProject({ enabled = true, tasks, allowStopWithBlockedTasks } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'stop-pending-'));
-  mkdirSync(join(project, '.git'), { recursive: true });
-  mkdirSync(join(project, '.ai'), { recursive: true });
-
-  const gateEntry = { enabled };
-  if (allowStopWithBlockedTasks !== undefined) {
-    gateEntry.allowStopWithBlockedTasks = allowStopWithBlockedTasks;
-  }
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify({ gates: { blockStopWithPendingTasks: gateEntry } }),
-  );
-
-  if (tasks) {
-    mkdirSync(join(project, '.ai', 'tasks'), { recursive: true });
-    writeFileSync(
-      join(project, '.ai', 'tasks', 'active.json'),
-      JSON.stringify({ tasks }),
-    );
-  }
-  return project;
-}
-
-function runGate(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-test('an open active task blocks the stop', () => {
-  const project = setupProject({
-    tasks: [{ id: 't-1', title: 'finish the thing', status: 'open' }],
-  });
-  const result = runGate(project, { session_id: 's1', stop_hook_active: false });
-  assert.equal(result.decision, 'block');
-  assert.match(result.reason, /t-1/);
-});
-
-test('no active tasks: stop is allowed', () => {
-  const project = setupProject({ tasks: [] });
-  const result = runGate(project, { session_id: 's1', stop_hook_active: false });
-  assert.equal(result, null);
-});
-
-test('no .ai/tasks directory at all: stop is allowed', () => {
-  const project = setupProject({});
-  const result = runGate(project, { session_id: 's1', stop_hook_active: false });
-  assert.equal(result, null);
-});
-
-test('stop_hook_active=true: always allow, even with an open task (loop guard)', () => {
-  const project = setupProject({
-    tasks: [{ id: 't-1', title: 'finish the thing', status: 'open' }],
-  });
-  const result = runGate(project, { session_id: 's1', stop_hook_active: true });
-  assert.equal(result, null);
-});
-
-test('a blocked task with allowStopWithBlockedTasks default (true): stop is allowed', () => {
-  const project = setupProject({
-    tasks: [{ id: 't-2', title: 'waiting on X', status: 'blocked', blockedReason: 'waiting on X' }],
-  });
-  const result = runGate(project, { session_id: 's1', stop_hook_active: false });
-  assert.equal(result, null);
-});
-
-test('a blocked task with allowStopWithBlockedTasks:false: stop is blocked', () => {
-  const project = setupProject({
-    tasks: [{ id: 't-2', title: 'waiting on X', status: 'blocked', blockedReason: 'waiting on X' }],
-    allowStopWithBlockedTasks: false,
-  });
-  const result = runGate(project, { session_id: 's1', stop_hook_active: false });
-  assert.equal(result.decision, 'block');
-  assert.match(result.reason, /t-2/);
-});
-
-test('gate disabled: stop is allowed even with an open task', () => {
-  const project = setupProject({
-    tasks: [{ id: 't-1', title: 'finish the thing', status: 'open' }],
-    enabled: false,
-  });
-  const result = runGate(project, { session_id: 's1', stop_hook_active: false });
-  assert.equal(result, null);
-});
-
-test('a done task in active.json (should not normally happen) never blocks', () => {
-  const project = setupProject({
-    tasks: [{ id: 't-3', title: 'already closed', status: 'done' }],
-  });
-  const result = runGate(project, { session_id: 's1', stop_hook_active: false });
-  assert.equal(result, null);
-});
-
-test('corrupt active.json: fail-safe allow', () => {
-  const project = setupProject({ tasks: [] });
-  writeFileSync(join(project, '.ai', 'tasks', 'active.json'), '{not json');
-  const result = runGate(project, { session_id: 's1', stop_hook_active: false });
-  assert.equal(result, null);
-});

package/plugins/gates/hooks/gates/test-after-implementation/test-after-implementation.edge.test.mjs

@@ -1,72 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function newProject({ config, git = true } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'test-after-implementation-edge-'));
-  if (git) {
-    execFileSync('git', ['init', '-q'], { cwd: project });
-    execFileSync('git', ['config', 'user.email', 'a@b.c'], { cwd: project });
-    execFileSync('git', ['config', 'user.name', 'a'], { cwd: project });
-  }
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return project;
-}
-
-function runGateIn(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function writeTest(filePath) {
-  return { tool_name: 'Write', tool_input: { file_path: filePath, content: 'test content' } };
-}
-function isWarn(result) {
-  return result?.hookSpecificOutput?.additionalContext !== undefined;
-}
-
-const ENABLE = { gates: { warnTestWrittenAfterImplementation: true } };
-
-// EDGE CASE (BUG): the paired-implementation match requires the changed file's directory
-// (relative to cwd) to equal the test file's directory exactly (index.mjs line 83-86). A
-// common layout keeps tests in a sibling __tests__/ directory next to the implementation —
-// this gate then never pairs them, silently missing the exact case (tests-after-impl) it
-// exists to catch.
-test('BUG: false negative — implementation and test in different conventional directories (src/ vs __tests__/) are never paired', () => {
-  const project = newProject({ config: ENABLE });
-  mkdirSync(join(project, 'src'));
-  mkdirSync(join(project, '__tests__'));
-  writeFileSync(join(project, 'src', 'thing.js'), 'export const thing = 1;');
-  const testPath = join(project, '__tests__', 'thing.test.js');
-  const result = runGateIn(project, writeTest(testPath));
-  assert.equal(result, null, 'gate misses the exact case it targets because dirname(test) !== dirname(impl) under a __tests__/ layout');
-});
-
-// EDGE CASE (BUG): only `git status --porcelain` (uncommitted changes) is checked. If the
-// implementation was written AND COMMITTED before writing the test (a slightly worse
-// practice: commit-then-test rather than just write-then-test), git status shows nothing
-// changed and the gate never warns — the temporal violation it targets still happened but
-// leaves no trace once committed.
-test('BUG: false negative — once the paired implementation change is committed, the warning never fires even though tests were still written strictly after', () => {
-  const project = newProject({ config: ENABLE });
-  writeFileSync(join(project, 'thing.js'), 'export const thing = 1;');
-  execFileSync('git', ['add', '-A'], { cwd: project });
-  execFileSync('git', ['commit', '-q', '-m', 'implement thing'], { cwd: project });
-  const testPath = join(project, 'thing.test.js');
-  const result = runGateIn(project, writeTest(testPath));
-  assert.equal(result, null, 'committing the implementation first launders the same temporal violation past a git-status-based check');
-});

package/plugins/gates/hooks/gates/test-after-implementation/test.mjs

@@ -1,81 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function newProject({ config, git = true } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'test-after-implementation-'));
-  if (git) {
-    execFileSync('git', ['init', '-q'], { cwd: project });
-    execFileSync('git', ['config', 'user.email', 'a@b.c'], { cwd: project });
-    execFileSync('git', ['config', 'user.name', 'a'], { cwd: project });
-  }
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return project;
-}
-
-function runGateIn(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function writeTest(filePath) {
-  return {
-    tool_name: 'Write',
-    tool_input: { file_path: filePath, content: 'test content' },
-  };
-}
-function isWarn(result) {
-  return result?.hookSpecificOutput?.additionalContext !== undefined;
-}
-
-const ENABLE = { gates: { warnTestWrittenAfterImplementation: true } };
-
-test('warns when creating a test whose paired implementation was just modified (uncommitted)', () => {
-  const project = newProject({ config: ENABLE });
-  writeFileSync(join(project, 'thing.js'), 'export const thing = 1;');
-  const testPath = join(project, 'thing.test.js');
-  assert.ok(isWarn(runGateIn(project, writeTest(testPath))));
-});
-
-test('allows creating a test with no paired uncommitted implementation', () => {
-  const project = newProject({ config: ENABLE });
-  const testPath = join(project, 'unrelated.test.js');
-  assert.equal(runGateIn(project, writeTest(testPath)), null);
-});
-
-test('allows editing (not creating) an existing test file', () => {
-  const project = newProject({ config: ENABLE });
-  writeFileSync(join(project, 'thing.js'), 'export const thing = 1;');
-  const testPath = join(project, 'thing.test.js');
-  writeFileSync(testPath, 'existing test');
-  assert.equal(runGateIn(project, writeTest(testPath)), null);
-});
-
-test('degrades to allow when not a git repo', () => {
-  const project = newProject({ config: ENABLE, git: false });
-  const testPath = join(project, 'thing.test.js');
-  assert.equal(runGateIn(project, writeTest(testPath)), null);
-});
-
-test('disabled by default (registry default is false)', () => {
-  const project = newProject();
-  writeFileSync(join(project, 'thing.js'), 'export const thing = 1;');
-  const testPath = join(project, 'thing.test.js');
-  assert.equal(runGateIn(project, writeTest(testPath)), null);
-});

package/plugins/gates/hooks/gates/test-matrix/edge.edge.test.mjs

@@ -1,63 +0,0 @@
-// Edge-case probe for test-matrix. Previously the prompt was read only from
-// toolInput.prompt/Prompt/task, the same root cause shared by implementation-pipeline,
-// mandatory-flow and the sdd-specs delegation check: a Task delegation carrying its
-// brief in `description` was invisible. Migrated to delegationPromptOf()
-// (hook-io.mjs), so this is now caught.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'test-matrix-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enabledConfig() {
-  return { gates: { requireTestMatrixWhenImplementing: true } };
-}
-
-test('FIXED: a Task delegation carrying its brief in `description` is now checked', () => {
-  const payload = {
-    tool_name: 'Task',
-    tool_input: {
-      description: 'Nivel: STANDARD\nImplementá el cobro de la cuota.',
-      subagent_type: 'backend',
-    },
-  };
-  assert.ok(
-    isDeny(runGate(payload, { config: enabledConfig() })),
-    'delegationPromptOf reads description and the missing-test-matrix deny fires',
-  );
-});
-
-test('OK: the equivalent payload using `prompt` IS caught (control)', () => {
-  const payload = {
-    tool_name: 'Task',
-    tool_input: {
-      prompt: 'Nivel: STANDARD\nImplementá el cobro de la cuota.',
-      subagent_type: 'backend',
-    },
-  };
-  assert.ok(isDeny(runGate(payload, { config: enabledConfig() })), 'control failed');
-});