@dzhechkov/p-replicator 1.5.17 → 1.6.0

package/tests/unit/db-port-rule.test.js

@@ -0,0 +1,216 @@
+'use strict';
+
+// Nothing in this package said a database port is not published to the internet. MEASURED: the
+// Architecture Constraints handed to every project (templates/.claude/rules/replicate-pipeline.md)
+// carried exactly five items — pattern, containers, infrastructure, deploy, MCP — and nothing about
+// storage; a sweep of templates/ for such a rule returned only unrelated hits.
+//
+// The working check already exists, in a course repository, and when it fails it prints
+// "Правило: .claude/rules/docker-ports.md, «Правило №0»" — pointing at a file this package did not
+// ship. The rule and the check are two different things, and only the rule ships here — ADR-001 D2,
+// whose load-bearing reasons are that a shipped script is a new component KIND touching five
+// consumers, and that a Node rewrite of a bash+awk compose parser is real work, not a transcription.
+//
+// P6 is the load-bearing one for the future: "5 rules" was a constant maintained BY HAND in seven
+// places, and missing one leaves doctor or the status line reporting a rule missing that is not.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const PKG_DIR = path.resolve(__dirname, '..', '..');
+const read = (rel) => fs.readFileSync(path.join(PKG_DIR, rel), 'utf-8');
+
+const RULE = path.join('templates', '.claude', 'rules', 'docker-ports.md');
+const PIPELINE = path.join('templates', '.claude', 'rules', 'replicate-pipeline.md');
+
+/** The Architecture Constraints block — the list actually handed to sparc-prd-mini. Scoped, because
+ *  a constraint stated anywhere else in the file is not passed to anything. */
+function constraints() {
+  const src = read(PIPELINE);
+  const start = src.indexOf('## Architecture Constraints');
+  const end = src.indexOf('\n## ', start + 1);
+  assert.ok(start > 0, 'replicate-pipeline.md must have an Architecture Constraints block');
+  assert.ok(end > start, 'and a following section');
+  return src.slice(start, end);
+}
+
+describe('a database port is not published to the internet (PR-012)', () => {
+  test('P1 — the constraints block carries the rule and names the file', () => {
+    const block = constraints();
+    // The INVARIANT, not one remedy. Cross-family QE: "does not publish outward" is too narrow —
+    // an explicit public address like 203.0.113.7:5432:5432 is not "all interfaces" and is exactly
+    // as reachable from the internet; and network_mode: host needs no ports: entry at all.
+    assert.match(block, /Storage: у баз и очередей НЕТ публикации на хост/,
+      'the constraint must be IN the block that is passed to Phase 1, not elsewhere in the file');
+    assert.match(block, /кроме привязки к петле/, 'and carry the loopback exception');
+    assert.match(block, /network_mode: host/,
+      'and name the escape path that needs no ports: entry at all');
+    assert.match(block, /docker-ports\.md/,
+      'and name the rule file, so the constraint and the rule are one thing rather than two');
+  });
+
+  test('P2 — the rule file exists and carries the name the shipped check prints', () => {
+    // The check prints: Правило: .claude/rules/docker-ports.md, «Правило №0».
+    // If the heading is renamed, that pointer stops resolving and the reader is left at a dead end.
+    const src = read(RULE);
+    assert.match(src, /Правило №0/,
+      'the rule must carry the exact name the existing check refers people to');
+    // The forbidden list is the security content: each row is a way a reader gets it wrong.
+    for (const bad of ['0.0.0.0:5432:5432', '\\[::\\]:5432:5432', '203.0.113.7:5432:5432',
+      'network_mode: host']) {
+      assert.match(src, new RegExp(bad), 'the forbidden list must name: ' + bad);
+    }
+    assert.match(src, /убрать `ports:` целиком/,
+      'the remedy must be stated as removing publication, not as adding expose:');
+    assert.match(src, /`expose:` в современном Compose ничего не открывает/,
+      'and expose: must be described honestly — it documents, it does not grant access');
+    assert.match(src, /достучатся до\s+сервиса по его имени/,
+      'and why the remedy suffices — otherwise it reads as a loss of capability');
+  });
+
+  test('P3 — the LOOPBACK exception is present, as an allowance and not a footnote', () => {
+    // Without it the rule forbids exactly what the same pipeline prescribes: a test environment that
+    // binds 127.0.0.1 so tests can run from the host. The field report's own pseudocode had this
+    // defect and would have failed the project's own compose.
+    const src = read(RULE);
+    assert.match(src, /Исключение: петля — это законно/,
+      'the exception needs its own heading — a rule whose exception is buried gets applied without it');
+    assert.match(src, /127\.0\.0\.1:55432:5432/, 'shown as a concrete legal line');
+    assert.match(src, /ЗАКОННО/, 'and labelled as permitted, not merely described');
+    // Both loopback forms are equals — a rule that allows ::1 while its own self-check greps only
+    // for 127.0.0.1 contradicts itself, which is what the first version did.
+    assert.match(src, /Петлевых форм две и они равноправны/,
+      'both loopback forms must be named as equals');
+    assert.match(src, /host_ip: ::1/,
+      'and the self-check must accept the IPv6 one it allows');
+    assert.match(src, /исключение\s*\n?такая же часть правила, как и запрет/,
+      'and its standing stated, so a later edit does not trim it as an aside');
+  });
+
+  test('P4 — the rule says what it is NOT, so nobody infers a guarantee', () => {
+    // A rule that reads like a gate is worse than no rule: it stops people looking for the gate.
+    const src = read(RULE);
+    // The property has MOVED, not weakened. When this test was written the package shipped the rule
+    // and no check, so the limit was "nobody may infer a guarantee". A check now ships — so the
+    // limit becomes what the check does NOT cover, and the fact that it must be invoked. A rule that
+    // reads like an automatic gate is still worse than no rule; only the shape of the honesty moved.
+    assert.match(src, /Чем это правило НЕ является|Чего она НЕ делает/,
+      'the limit needs its own heading');
+    assert.match(src, /не привязана ни к какому событию — её надо позвать/,
+      'a check nobody invokes guarantees nothing, and the rule must say so');
+    assert.match(src, /конфликты с портами, уже занятыми другими контейнерами, она не ищет/,
+      'and name what it does not look at, so nobody infers a wider guarantee');
+    assert.match(src, /проверка НЕ\s*\n?ВЫПОЛНЕНА/,
+      'and the third exit code must be documented where a reader will look for it');
+  });
+
+  test('P5 — the field report\'s non-verbatim compose fragment is not quoted', () => {
+    // The report quotes a postgres service carrying an `expose:` line. MEASURED: the real file has
+    // no such line. Copying it would put a fabricated quotation in a security rule.
+    const src = read(RULE);
+    assert.ok(!/image: postgres[\s\S]{0,200}expose:[\s\S]{0,40}5432[\s\S]{0,40}ports:/.test(src),
+      'the rule must not reproduce the report\'s composite fragment');
+  });
+
+  test('P6 — every count site agrees with COMPONENTS.rules.items', () => {
+    // The property is AGREEMENT, not a particular number: the next rule added moves all seven or
+    // this fails. statusline.cjs is a TEMPLATE copied into other projects and cannot import src/,
+    // and the four prose sites are prose, so the constant is irreducibly distributed — what is
+    // removed here is the SILENCE when the sites disagree.
+    const utils = require(path.join(PKG_DIR, 'src', 'utils.js'));
+    const n = Object.keys(utils.COMPONENTS.rules.items).length;
+    assert.ok(n >= 6, 'the docker-ports rule must be registered as a component: got ' + n);
+
+    const statusline = read(path.join('templates', '.claude', 'hooks', 'statusline.cjs'));
+    const m = statusline.match(/rulesExpected:\s*(\d+)/);
+    assert.ok(m, 'statusline.cjs must declare rulesExpected');
+    assert.equal(Number(m[1]), n,
+      'statusline would report a phantom missing rule: rulesExpected=' + m[1] + ' vs ' + n);
+
+    // SCAN, do not enumerate. The first version listed six prose sites by hand and MISSED SEVEN more,
+    // including templates/.claude/commands/replicate.md — the file that SHIPS INTO EVERY GENERATED
+    // PROJECT and names the rules a run must not overwrite. `docker-ports` was absent from that list,
+    // so the security rule this feature added could be silently regenerated away. Two independent
+    // reviewers found it; a hand-picked list is how it survived my own review.
+    //
+    // Historical documents are exempt BY NAME: a changelog entry describing what 1.4 shipped is a
+    // true statement about the past, and rewriting it would be falsifying a record.
+    const HISTORICAL = /changelog/i;
+    const COUNT_CLAIM = /(\d+)\s+rules\b|(\d+)\s+правил|Rules\s+●(\d+)|\*\*(\d+) rules\*\*/g;
+    const scanned = [];
+    const walk = (dir) => {
+      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) {
+          if (e.name === 'node_modules' || e.name === '.git') continue;
+          walk(full);
+        } else if (/\.(md|html)$/.test(e.name) && !HISTORICAL.test(full)) {
+          scanned.push(full);
+        }
+      }
+    };
+    walk(PKG_DIR);
+    assert.ok(scanned.length > 10, 'the scan must actually find documents: ' + scanned.length);
+
+    // `claimed`, not `n`. A rename made the inner variable shadow the authoritative one and the
+    // comparison became `n !== n` — a test that could never fail, caught by mutation and not by
+    // reading it. The same shape a reviewer caught in this suite's sibling yesterday.
+    const wrong = [];
+    for (const file of scanned) {
+      const text = fs.readFileSync(file, 'utf-8');
+      for (const hit of text.matchAll(COUNT_CLAIM)) {
+        // A release-notes SECTION inside an otherwise-current document is historical too — the README
+        // and the RU html bundle both embed one. The test is not a character window (which missed a
+        // line 1300 lines below its heading) but the NEAREST PRECEDING heading: a count written under
+        // a version heading is a statement about that version, and rewriting it would falsify a
+        // record.
+        const before = text.slice(0, hit.index);
+        const headings = before.match(/^#{1,3} .*$|^<h[1-3][^>]*>.*$/gm) || [];
+        const nearest = headings.length ? headings[headings.length - 1] : '';
+        const historicalSection = /changelog|release notes|version history|история версий|\[?v?\d+\.\d+/i;
+        if (historicalSection.test(nearest)) continue;
+        // and an explicit past-tense marker on the line itself
+        const lineStart = before.lastIndexOf('\n') + 1;
+        const line = text.slice(lineStart, text.indexOf('\n', hit.index));
+        if (/initial published version|первая опубликованная/i.test(line)) continue;
+        const claimed = Number(hit[1] || hit[2] || hit[3] || hit[4]);
+        if (claimed !== n) {
+          wrong.push(path.relative(PKG_DIR, file) + ': "' + hit[0].trim() + '"');
+        }
+      }
+    }
+    assert.deepEqual(wrong, [],
+      'these say a rule count that is not ' + n + ': ' + JSON.stringify(wrong, null, 1));
+
+    // An EIGHTH site the survey missed    // An EIGHTH site the survey missed, found by the suite going red: the e2e --help assertion,
+    // which is not a file constant but a re-typed expectation. cli.js:57 already derives its number
+    // from COMPONENTS, so a test that hardcodes one is a second source of truth — exactly the defect
+    // its own comment says it exists to catch ("cli.js used to say 1 rule while EXPECTED_RULES had 2
+    // entries"). It is now derived, and this asserts it stays derived.
+    const e2e = read(path.join('tests', 'e2e', 'lifecycle.test.js'));
+    const helpAt = e2e.indexOf("describe('e2e: --help shows correct component counts'");
+    assert.ok(helpAt > 0, 'the --help count test must exist');
+    const helpBlock = e2e.slice(helpAt, e2e.indexOf('});', e2e.indexOf('} finally', helpAt)));
+    assert.match(helpBlock, /Object\.keys\(COMPONENTS\[group\]\.items\)\.length/,
+      'the --help count test must DERIVE from COMPONENTS, not re-type the numbers');
+    assert.ok(!/\/\d+\\s\+rules\//.test(helpBlock),
+      'and must not carry a hardcoded rule count');
+  });
+
+  test('P7 — the HOOK surface stays Node-only', () => {
+    // ADR-001 D2, NARROWED by measurement during Step 7. The first version asserted that NO .sh
+    // ships anywhere in templates/, and that is FALSE: skills/brutal-honesty-review/scripts/
+    // assess-tests.sh and assess-code.sh already ship. The cross-platform promise in settings.json
+    // ("Cross-platform Node scripts (no bash dependencies)") is scoped to the HOOKS — all six are
+    // .cjs so Windows works — and a port check is hook-shaped, so that is the surface to guard.
+    // Asserting the broader claim would have been a test enforcing something untrue.
+    const hooks = path.join(PKG_DIR, 'templates', '.claude', 'hooks');
+    const files = fs.readdirSync(hooks);
+    assert.deepEqual(files.filter((f) => f.endsWith('.sh')), [],
+      'a .sh among the hooks contradicts the cross-platform promise in settings.json');
+    assert.ok(files.filter((f) => f.endsWith('.cjs')).length >= 6,
+      'and the six shipped hooks must still be .cjs: ' + JSON.stringify(files));
+  });
+});

package/tests/unit/detect-parse-anchor.test.js

@@ -0,0 +1,109 @@
+'use strict';
+
+// The project-type scanner probed seven paths from one parameter, and the paths disagreed about what
+// that parameter was. MEASURED before the fix:
+//
+//   {docs_path}/docs/ddd/ · /.ai-context/ · /docs/tests/*.feature · /docs/adr/*.md · /docs/ADR.md
+//        → all five imply docs_path is the PROJECT ROOT
+//   {docs_path}/Architecture.md · {docs_path}/Solution_Strategy.md
+//        → these two imply docs_path is `docs/`
+//
+// And the pipeline writes those two files to docs/ (commands/replicate.md:234,237). So the SPARC
+// probes looked exactly where the pipeline does not write: the scanner could not recognise its own
+// output as SPARC-shaped.
+//
+// The parameter description was the root of it — one sentence naming two directories: "In Claude
+// Code / replicate context this is `docs/` (project root)." A reader implementing a probe picked
+// whichever half they read last. Nobody passes the parameter explicitly (a sweep of SKILL.md and
+// commands/replicate.md for `docs_path` returns nothing), so that sentence IS the specification.
+//
+// Both the field report and the reviewing swarm got this wrong in opposite directions: the report
+// said all six probes were wrong, the swarm said the table was wrong and the probes right. Five
+// probes are right, two are wrong, and the table contradicts itself.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const MODULE = path.join(__dirname, '..', '..', 'templates', '.claude', 'skills',
+  'cc-toolkit-generator-enhanced', 'modules', '01-detect-parse.md');
+const read = () => fs.readFileSync(MODULE, 'utf-8');
+
+/** Every path this module probes, as written. */
+function probes() {
+  const src = read();
+  return [...src.matchAll(/\{docs_path\}\/([^"')\s]+)/g)].map((m) => m[1]);
+}
+
+describe('every probe resolves from ONE anchor, and the anchor is named once', () => {
+  test('P1 — no probe implies an anchor other than the project root', () => {
+    // The property is AGREEMENT across all of them, not the correctness of any single path. A
+    // top-level SPARC artifact would mean docs_path is `docs/` for that probe and the root for the
+    // others — which is the state this feature removes.
+    // DERIVED, not typed. Cross-family QE: the first version hard-coded seven basenames, so a probe
+    // for Research_Findings.md — a real pipeline document I had not listed — would have escaped it.
+    // The authoritative list is the pipeline's own: replicate.md writes every SPARC document to docs/.
+    const replicate = fs.readFileSync(path.join(__dirname, '..', '..', 'templates', '.claude',
+      'commands', 'replicate.md'), 'utf-8');
+    const written = new Set([...replicate.matchAll(/^- `docs\/([A-Z][A-Za-z_]*\.md)`/gm)].map((m) => m[1]));
+    assert.ok(written.size >= 9,
+      'the pipeline document list must be readable from replicate.md: ' + [...written]);
+
+    const disagreeing = probes().filter((p) => written.has(p));
+    assert.deepEqual(disagreeing, [],
+      'these probe a document the pipeline writes to docs/, as if it were at the project root — '
+      + 'which only makes sense if docs_path is `docs/`, while every other probe treats it as the '
+      + 'root: ' + JSON.stringify(disagreeing));
+
+    // And the prose must not re-introduce the ambiguity the probes just lost. Five sites carried it.
+    const src = read();
+    assert.ok(!/top-level or docs\//.test(src),
+      'the scan catalog still preserves the "top-level or docs/" reading this feature removes');
+    for (const doc of ['Architecture.md', 'Solution_Strategy.md', 'PRD.md', 'Specification.md']) {
+      const bare = new RegExp('(?<![/\\w])`' + doc.replace('.', '\\.') + '`');
+      assert.ok(!bare.test(src),
+        'a pipeline document is named without its docs/ prefix, which reads as project-root: ' + doc);
+    }
+  });
+
+  test('P2 — the two SPARC probes look under docs/, where the pipeline writes', () => {
+    const src = read();
+    assert.match(src, /has_sparc_arch = exists\(f"\{docs_path\}\/docs\/Architecture\.md"\)/,
+      'commands/replicate.md:237 writes docs/Architecture.md');
+    assert.match(src, /has_sparc_sol\s+= exists\(f"\{docs_path\}\/docs\/Solution_Strategy\.md"\)/,
+      'commands/replicate.md:234 writes docs/Solution_Strategy.md');
+  });
+
+  test('P3 — the root-level probe stays at the root', () => {
+    // .ai-context/ sits beside .claude/, not under docs/. Moving it "for consistency" would break a
+    // probe that was correct all along — the failure mode the field report actually proposed.
+    assert.ok(probes().includes('.ai-context/'),
+      'the .ai-context probe must remain anchored at the project root: ' + JSON.stringify(probes()));
+    assert.ok(!probes().includes('docs/.ai-context/'),
+      '.ai-context/ is a root-level directory; probing it under docs/ finds nothing');
+  });
+
+  test('P4 — the parameter names ONE directory', () => {
+    const src = read();
+    const row = src.split('\n').find((l) => l.startsWith('| `docs_path` |'));
+    assert.ok(row, 'the parameter table row must exist');
+    assert.ok(!/this is `docs\/` \(project root\)/.test(row),
+      'the row still names two different directories in one breath — that sentence is what split '
+      + 'the probes in the first place: ' + row);
+    assert.match(row, /the PROJECT ROOT/,
+      'it must name the anchor unambiguously');
+    assert.match(row, /not `docs\/`/,
+      'and rule out the other reading explicitly, since that reading is what produced the split');
+  });
+
+  test('P5 — both ADR shapes are still collected', () => {
+    // This logic shipped in an earlier feature (one decision per file, and /replicate's single
+    // docs/ADR.md). Re-anchoring must not disturb it.
+    const src = read();
+    assert.match(src, /glob\(f"\{docs_path\}\/docs\/adr\/\*\.md"\)/, 'shape A: a directory of files');
+    assert.match(src, /f"\{docs_path\}\/docs\/ADR\.md"/, 'shape B: /replicate\'s single file');
+    assert.match(src, /has_adr = len\(collect_adrs\(docs_path\)\) > 0/,
+      'and the one definition that unifies them');
+  });
+});

package/tests/unit/external-dependency-check.test.js

@@ -0,0 +1,209 @@
+'use strict';
+
+// Every validation lens compared documents to documents. MEASURED — replicate.md's Phase-2 table
+// listed five: stories→PRD, AC→stories, Architecture.md, Pseudocode.md, cross-document coherence.
+// Nothing anywhere asked whether the outside world agrees, so a requirement could rest on a
+// capability the provider does not have and reach code generation unchallenged. It is the only
+// contact-with-reality defect in this pipeline; everything else it checks, it can check by reading
+// its own output.
+//
+// TWO honesty constraints bind this suite, both from the field report:
+//   1. check-pipeline-gaps.sh, which the report cites, DOES NOT EXIST. P7 keeps it uncited.
+//   2. No external fact may be baked in. What an API can do DRIFTS: a fixture asserting one would
+//      fail when the world changes and pass when our own rule breaks. P6 asserts the ABSENCE of
+//      vendor names, and no assertion here mentions a capability of any real service.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+const read = (rel) => fs.readFileSync(path.join(TPL, rel), 'utf-8');
+
+const SPARC = 'skills/sparc-prd-mini/SKILL.md';
+const REPLICATE = 'commands/replicate.md';
+
+/** The External Dependencies section of the Phase-5 Architecture.md template. Scoped, because an
+ *  assertion over a whole file passes on any prose that happens to mention the words. */
+function inventory() {
+  const src = read(SPARC);
+  const start = src.indexOf('## External Dependencies\n');
+  assert.ok(start > 0, 'the Phase-5 template must carry an External Dependencies section');
+  const end = src.indexOf('## Data Architecture', start);
+  assert.ok(end > start, 'and it must sit before Data Architecture, where the stack is still in view');
+  return src.slice(start, end);
+}
+
+/** Phase 2 of replicate.md — a lens declared in a later phase validates nothing. */
+function phase2() {
+  const src = read(REPLICATE);
+  const start = src.indexOf('### Phase 2: VALIDATION');
+  const end = src.indexOf('### Phase 3', start);
+  assert.ok(start > 0 && end > start, 'replicate.md must have a Phase 2 before Phase 3');
+  return src.slice(start, end);
+}
+
+describe('the pipeline asks whether the outside world can do what a requirement needs (PR-010)', () => {
+  test('P1 — the inventory exists and carries all five columns', () => {
+    const block = inventory();
+    // The HEADER ROW, not five words scattered through prose. Cross-family QE: a paragraph
+    // containing all five labels would have replaced the table without failing.
+    const header = block.split('\n').find((l) => l.startsWith('| Capability needed |')) || '';
+    assert.notEqual(header, '', 'the inventory must have a table header row starting with the '
+      + 'capability column');
+    for (const col of ['Capability needed', 'Provider / API', 'Evidence', 'Verdict',
+      'Requirements relying on it']) {
+      assert.ok(header.includes(col), 'the header row must carry the column: ' + col);
+    }
+    // One row per CAPABILITY, not per vendor: a provider can do one of two things you need.
+    assert.match(block, /One row per capability, not one row\s+per vendor/,
+      'the granularity must be stated, or one row hides two questions');
+  });
+
+  test('P2 — the evidence rule is CLOSED on both sides', () => {
+    // Saying what evidence IS leaves every reader to decide what it is not. The three ways this
+    // check gets faked are named, so a row using one of them is visibly not evidence.
+    const block = inventory();
+    assert.match(block, /link to the PROVIDER'S OWN documentation/,
+      'what counts must be stated precisely — not "a source"');
+    assert.match(block, /plus the date it was checked/,
+      'a citation without a date cannot be re-checked later');
+    // Cross-family QE, the load-bearing finding: CONFIRMED was self-attested, and a plausible URL is
+    // the cheapest forgery there is. A verbatim quote is what a link alone cannot fake.
+    assert.match(block, /verbatim QUOTE from\s+that page stating the capability/,
+      'a non-fabricable artifact must be required, not just a link');
+    assert.match(block, /a URL nobody opened/,
+      'and the link-alone forgery must be named as not-evidence');
+    assert.match(block, /do NOT count/, 'and the rule must be closed on the other side too');
+    for (const fake of ['landing page', 'pricing page', 'recollection']) {
+      assert.ok(block.includes(fake), 'the not-evidence list must name: ' + fake);
+    }
+  });
+
+  test('P3 — exactly three verdicts, and the empty case is explicit', () => {
+    const block = inventory();
+    // Each verdict must be a ROW of the verdict table, not a word somewhere in the prose. Found by
+    // mutation: renaming the UNCONFIRMED row to UNKNOWN left the vocabulary broken and the first
+    // version of this assertion green, because the word still appeared in the paragraph below it.
+    for (const v of ['CONFIRMED', 'UNCONFIRMED', 'CONTRADICTED']) {
+      assert.match(block, new RegExp('^\\| ' + v + ' \\|', 'm'),
+        'the verdict must be a row of the verdict table, not merely mentioned: ' + v);
+    }
+    // Two values would collapse "we checked and it cannot" into "nobody checked", which overstates
+    // one and hides the other. The reason has to be written down or the third value looks redundant.
+    assert.match(block, /exactly three, because two would hide a difference that\s+matters/,
+      'the reason for three values must be recorded, or a later edit will merge two of them');
+    // EXACTLY three: the first version asserted the three exist and let a fourth in silently.
+    const verdictRows = block.split('\n')
+      .filter((l) => /^\| [A-Z_]+ \|/.test(l) && !l.startsWith('| Verdict |'));
+    assert.equal(verdictRows.length, 3,
+      'the verdict table must have exactly three rows, not merely contain the three: '
+      + JSON.stringify(verdictRows));
+    assert.match(block, /No external dependencies —\s+this product calls no third-party service/,
+      'a project with none must say so: an empty section and an absent one look identical');
+  });
+
+  test('P4 — Phase 2 declares the sixth lens, inside Phase 2', () => {
+    const block = phase2();
+    const lensRow = block.split('\n').find((l) => l.startsWith('| `validator-dependencies` |')) || '';
+    assert.notEqual(lensRow, '',
+      'the lens must be a ROW of the validator table, not a mention in prose');
+    assert.match(lensRow, /External Dependencies/,
+      'and its scope column must name the section it reads: ' + lensRow);
+    assert.match(lensRow, /evidence that names that capability/,
+      'and its criteria column must say what it checks for: ' + lensRow);
+    assert.match(block, /the only one that looks OUTSIDE the\s+documents/,
+      'and say what makes it different from the other five, or it reads as a sixth of the same kind');
+  });
+
+  test('P5 — the exit criteria carry BOTH consequences, and UNCONFIRMED does not pass silently', () => {
+    // Anchored to the exit-criteria ROW each term belongs to. Cross-family QE: three independent
+    // phrase matches anywhere in Phase 2 would pass on explanatory prose that changed no verdict.
+    const rows = {};
+    for (const l of phase2().split('\n')) {
+      const m = l.match(/^\| (🟢 READY|🟡 CAVEATS|🔴 NEEDS WORK) \|/);
+      if (m) rows[m[1]] = l;
+    }
+    assert.ok(rows['🟢 READY'] && rows['🟡 CAVEATS'] && rows['🔴 NEEDS WORK'],
+      'the exit-criteria table must carry all three verdict rows');
+    assert.match(rows['🔴 NEEDS WORK'], /any external dependency is `CONTRADICTED`/,
+      'a contradicted dependency must send the run back, in the row that sends it back');
+    assert.match(rows['🟡 CAVEATS'], /every `UNCONFIRMED` dependency NAMED row by row/,
+      'an unconfirmed dependency must be NAMED in the CAVEATS row — an unnamed caveat is one '
+      + 'nobody acts on');
+    assert.match(rows['🟢 READY'], /no external dependency `UNCONFIRMED` or `CONTRADICTED`/,
+      'and READY must exclude both, or the strongest verdict is the one that checks least');
+    // And the consequence must be scoped to the REQUIREMENT: without that, an inventory of nothing
+    // but UNCONFIRMED rows reaches Phase 3 with a caveat and feasibility is never established.
+    assert.match(inventory(), /cannot enter Phase 3 — defer, remove or replace them/,
+      'UNCONFIRMED must stop the requirements that rest on it, or the check is optional in practice');
+  });
+
+  test('P6 — NO vendor fact is baked in: external facts drift', () => {
+    // A fixture asserting what some API can do would fail when the world changes and pass when our
+    // own rule breaks. The template must teach the SHAPE and name nobody.
+    const block = inventory();
+    const vendors = ['Anthropic', 'OpenAI', 'Stripe', 'Twilio', 'SendGrid', 'AWS', 'Google Cloud',
+      'Azure', 'Firebase', 'Supabase'];
+    for (const v of vendors) {
+      assert.ok(!block.includes(v),
+        'the template must name no real provider — capabilities drift and a stale fact recorded as '
+        + 'evidence is worse than none. Found: ' + v);
+    }
+    // A denylist can only ever catch the names on it. The positive assertion is what actually holds:
+    // the example row's own cells must be bracketed placeholders, so there is no cell for a real
+    // vendor to sit in. The list above stays as a cheap second net.
+    const exampleRow = block.split('\n')
+      .find((l) => l.startsWith('| [') && l.includes('CONFIRMED')) || '';
+    assert.notEqual(exampleRow, '', 'the template must show one example row');
+    const cells = exampleRow.split('|').map((c) => c.trim()).filter(Boolean);
+    for (const cell of cells) {
+      assert.ok(/^\[|^CONFIRMED$/.test(cell) || cell.startsWith('['),
+        'every example cell must be a bracketed placeholder or the verdict itself, so no real '
+        + 'provider can sit in the row: ' + cell);
+    }
+    assert.match(block, /are PLACEHOLDERS/, 'and it must say the example names are placeholders');
+    assert.match(block, /a stale fact recorded as evidence is worse than\s+none/,
+      'with the reason, so a later editor does not helpfully fill in a real one');
+  });
+
+  test('P8 — the agent that DISPATCHES the swarm lists the same lenses as the command', () => {
+    // Found by an independent reviewer after the fact: commands/replicate.md gained the sixth lens
+    // and templates/.claude/agents/doc-validator.md did not. Two files describing one swarm, one of
+    // them a lens short — and the sha256 snapshot test cannot see it, because both files hash fine.
+    const cmd = read(REPLICATE);
+    const agent = fs.readFileSync(path.join(TPL, 'agents', 'doc-validator.md'), 'utf-8');
+    const names = (src) => new Set([...src.matchAll(/\| `(validator-[a-z-]+)`/g)].map((m) => m[1]));
+    const inCmd = names(cmd);
+    const inAgent = names(agent);
+    assert.ok(inCmd.size >= 6, 'the command must dispatch at least six lenses: ' + [...inCmd]);
+    assert.deepEqual([...inAgent].sort(), [...inCmd].sort(),
+      'the dispatching agent and the command disagree about the swarm: '
+      + JSON.stringify({ agent: [...inAgent], command: [...inCmd] }));
+    // And the count in the agent's own prose must match the table it introduces.
+    const stated = agent.match(/Launch (\d+) parallel validation agents/);
+    assert.ok(stated, 'doc-validator.md must state how many it launches');
+    assert.equal(Number(stated[1]), inAgent.size,
+      'doc-validator.md says ' + stated[1] + ' but tables ' + inAgent.size);
+  });
+
+  test('P7 — nothing cites check-pipeline-gaps.sh, which does not exist', () => {
+    // The report cites it. MEASURED — a repo-wide find returns nothing. Pointing a reader at a
+    // script that is not there is a worse failure than the gap it was cited to close.
+    for (const f of [SPARC, REPLICATE]) {
+      assert.ok(!read(f).includes('check-pipeline-gaps'),
+        f + ' references a script that does not exist in this repository');
+    }
+    // The premise, asserted rather than assumed: if someone ever ADDS the script, this goes red and
+    // whoever added it has to revisit the rule instead of leaving a stale prohibition behind.
+    const pkgRoot = path.join(__dirname, '..', '..');
+    const candidates = ['check-pipeline-gaps.sh', path.join('scripts', 'check-pipeline-gaps.sh'),
+      path.join('bin', 'check-pipeline-gaps.sh')];
+    for (const c of candidates) {
+      assert.ok(!fs.existsSync(path.join(pkgRoot, c)),
+        'the script now exists at ' + c + ' — this rule was written on the premise that it does '
+        + 'not, so revisit it rather than deleting this assertion');
+    }
+  });
+});

package/tests/unit/growth-module-b2b-gate.test.js

@@ -0,0 +1,104 @@
+'use strict';
+
+// Two callers disabled the exact branch the module they call declares. MEASURED:
+//
+//   commands/replicate.md:169        | M5: Growth Engine | If B2C/PLG | …
+//   agents/product-discoverer.md:22  | M5: Growth Engine | If B2C/PLG | …
+//   modules/05-growth-engine.md:62   - Если B2B → sales-led growth, не product-led; переключи framework
+//   reverse-engineering-unicorn/SKILL.md:94   MODULE 5: GROWTH ENGINE → …      (no condition)
+//
+// Three files disagreed about whether M5 runs, and the two that said "only for B2C" were the ones
+// that decided. For every B2B project the one output slot — product-discoverer.md "### Growth
+// Channels [From growth engine analysis — if applicable]" — arrived empty, not because there was
+// nothing to say but because the gate stopped the module that would have said it.
+//
+// NOT done, deliberately: editing the growth module. It exists in four byte-identical copies across
+// three published packages, kept in step by a --check gate that exits 1 on drift. A two-line fix in
+// two callers touches ONE package; touching the module is a three-package release. P5 pins that.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+const read = (rel) => fs.readFileSync(path.join(TPL, rel), 'utf-8');
+
+const CALLERS = [
+  { file: 'commands/replicate.md', produces: 'Channels, integrations' },
+  { file: 'agents/product-discoverer.md', produces: 'Channels, integrations, viral loops' },
+];
+const MODULE = 'skills/reverse-engineering-unicorn/modules/05-growth-engine.md';
+
+/** EVERY table row that decides whether M5 runs. Cross-family QE: taking the FIRST match let a gate
+ *  come back in a duplicate row further down, invisible to both helpers. */
+function m5Rows(file) {
+  const rows = read(file).split('\n').filter((l) => l.startsWith('| M5: Growth Engine |'));
+  assert.equal(rows.length, 1,
+    file + ' must have exactly one M5 row; found ' + rows.length + ': ' + JSON.stringify(rows));
+  return rows;
+}
+const cells = (row) => row.split('|').map((c) => c.trim());
+
+describe('the growth module is not gated off for the type it handles itself', () => {
+  test('P1 — neither caller conditions M5 on a product type', () => {
+    // Asserted on the ROW, not the file: the phrase "B2C" appears legitimately elsewhere (the
+    // sentence explaining WHY the gate went), and a whole-file check would forbid the explanation.
+    // The property is not "no condition" — cross-family QE was right that `Always` over-promises,
+    // because M5's outputs are CAC, channels and loops and an internal tool with no acquisition
+    // objective has nothing to put in them. The property is that the condition does not EXCLUDE a
+    // product type the module handles: if it names types at all, B2B must be among them.
+    for (const { file } of CALLERS) {
+      for (const row of m5Rows(file)) {
+        const condition = cells(row)[2];
+        assert.notEqual(condition, '', file + ': the M5 condition cell is empty');
+        const namesTypes = /B2C|B2B|PLG|product-led|sales-led/i.test(condition);
+        if (namesTypes) {
+          assert.match(condition, /B2B/i,
+            file + ' gates M5 on product type and leaves B2B out — the module handles B2B at '
+            + 'modules/05-growth-engine.md:62: ' + JSON.stringify(condition));
+        }
+        assert.ok(!/^If B2C/i.test(condition),
+          file + ' restored the original product-type gate: ' + JSON.stringify(condition));
+      }
+    }
+  });
+
+  test('P2 — the row keeps saying what M5 produces', () => {
+    // A removal that took the row with it would satisfy P1 and lose the module from the table.
+    // The OUTPUT COLUMN, not a substring of the row: cross-family QE noted a substring check passes
+    // if the text drifts into the condition cell.
+    for (const { file, produces } of CALLERS) {
+      for (const row of m5Rows(file)) {
+        assert.equal(cells(row)[3], produces,
+          file + ' lost or moved M5\'s output column: ' + row);
+      }
+    }
+  });
+
+  test('P3 — the orchestrator still runs M5 unconditionally: it is the fixed point', () => {
+    const skill = read('skills/reverse-engineering-unicorn/SKILL.md');
+    const line = skill.split('\n').find((l) => l.includes('MODULE 5: GROWTH ENGINE'));
+    assert.ok(line, 'SKILL.md must still list MODULE 5');
+    assert.ok(!/if |если |B2C|B2B|PLG/i.test(line),
+      'the orchestrator must stay unconditional — all three files agree with IT: ' + line);
+  });
+
+  test('P4 — the module\'s own B2B branch survives the removal that it justifies', () => {
+    // This is the load-bearing one. Removing the gate is safe BECAUSE the module decides per type.
+    // Without this assertion someone could delete the justification and keep the removal, and the
+    // module would then run for B2B with no B2B behaviour.
+    assert.match(read(MODULE), /Если B2B → sales-led growth, не product-led/,
+      'the branch that makes the ungated call correct must still be there');
+  });
+
+  test('P5 — the growth module is byte-identical: this feature touches two callers only', () => {
+    // Four byte-identical copies across three published packages hang off this file. Pinning its
+    // hash is what keeps a two-line fix from becoming a three-package release by accident.
+    const sha = crypto.createHash('sha256')
+      .update(fs.readFileSync(path.join(TPL, MODULE))).digest('hex');
+    assert.equal(sha, '98e8577aa5a5472574ac9bac590b76a4a3d16f99bc67ebec2b09b604c7c1faab',
+      'the growth module changed; that is a three-package release, not this feature');
+  });
+});