@dzhechkov/p-replicator 1.5.18 → 1.6.0

package/tests/unit/autocommit-deletion.test.js

@@ -0,0 +1,242 @@
+'use strict';
+
+// All three autocommit hooks opened with `if (!fs.existsSync(TARGET)) process.exit(0);`, so a DELETED
+// roadmap was "nothing to do" — though a deletion is exactly the change these hooks exist to record.
+// The history showed the file being maintained and then, silently, not.
+//
+// THE TRAP, measured before a line was written: simply deleting that guard breaks the failure
+// reporting that shipped the day before.
+//
+//   git add -- <a path that never existed>   → exit 128, "fatal: pathspec … did not match any files"
+//   git add -- <a tracked file, deleted>     → exit 0, and diff --cached then reports a change
+//
+// A failing git call now prints one line, so the naive fix would print a failure on EVERY session
+// stop in every project without this artifact — which is most of them. That is the noise the same
+// feature's own comment warns trains people to ignore notices. P3 is the guard on it.
+//
+// The discriminator is `git ls-files -- <path>`: entries for a path git knows, nothing for one it
+// does not. It must run BEFORE staging: staging a deletion removes the entry from the index, after
+// which the same question answers "not tracked". (`--error-unmatch` discriminates just as well, for
+// files and directories alike — an earlier note here said otherwise and was withdrawn after
+// re-measuring. `ls-files --` is preferred only because it answers with data instead of throwing.)
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { execFileSync, spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+
+const HOOKS = [
+  { name: 'autocommit-roadmap', remove: /auto-remove/,
+    make: (root) => {
+      fs.mkdirSync(path.join(root, '.claude'), { recursive: true });
+      const f = path.join(root, '.claude', 'feature-roadmap.json');
+      fs.writeFileSync(f, '{"v":1}\n');
+      return { drop: () => fs.rmSync(f), touch: () => fs.writeFileSync(f, '{"v":2}\n') };
+    } },
+  { name: 'autocommit-insights', remove: /auto-remove/,
+    make: (root) => {
+      const d = path.join(root, '.claude', 'insights');
+      fs.mkdirSync(d, { recursive: true });
+      fs.writeFileSync(path.join(d, 'index.md'), '## one\n');
+      return { drop: () => fs.rmSync(d, { recursive: true }),
+        touch: () => fs.writeFileSync(path.join(d, 'index.md'), '## one\n## two\n') };
+    } },
+  { name: 'autocommit-plans', remove: /auto-remove/,
+    make: (root) => {
+      const d = path.join(root, 'docs', 'plans');
+      fs.mkdirSync(d, { recursive: true });
+      fs.writeFileSync(path.join(d, 'a.md'), '# plan\n');
+      return { drop: () => fs.rmSync(d, { recursive: true }),
+        touch: () => fs.writeFileSync(path.join(d, 'a.md'), '# plan v2\n') };
+    } },
+];
+
+function project(opts) {
+  const o = opts || {};
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-del-')));
+  fs.mkdirSync(path.join(root, '.claude', 'hooks'), { recursive: true });
+  for (const h of HOOKS) {
+    fs.copyFileSync(path.join(TPL, 'hooks', h.name + '.cjs'),
+      path.join(root, '.claude', 'hooks', h.name + '.cjs'));
+  }
+  if (o.git !== false) {
+    const git = (a) => execFileSync('git', a, { cwd: root, stdio: 'ignore' });
+    git(['init', '-q']);
+    git(['config', 'user.email', 'test@example.invalid']);
+    git(['config', 'user.name', 'test']);
+  }
+  return root;
+}
+
+const git = (root, args) =>
+  execFileSync('git', args, { cwd: root, encoding: 'utf8' }).trim();
+const commitAll = (root) => {
+  execFileSync('git', ['add', '-A'], { cwd: root, stdio: 'ignore' });
+  execFileSync('git', ['commit', '-qm', 'base'], { cwd: root, stdio: 'ignore' });
+};
+
+function run(root, hookName) {
+  const r = spawnSync(process.execPath,
+    [path.join(root, '.claude', 'hooks', hookName + '.cjs')],
+    { cwd: root, env: Object.assign({}, process.env, { CLAUDE_PROJECT_DIR: root }),
+      encoding: 'utf8' });
+  return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
+}
+
+const cleanup = (d) => fs.rmSync(d, { recursive: true, force: true });
+
+describe('a deleted artifact is recorded, and an absent one is still silent', () => {
+  test('P1 — deleting a tracked target produces a commit and leaves the tree clean', () => {
+    const root = project({});
+    try {
+      const h = HOOKS[0];
+      const ctl = h.make(root);
+      commitAll(root);
+      const before = Number(git(root, ['rev-list', '--count', 'HEAD']));
+      ctl.drop();
+
+      const r = run(root, h.name);
+      assert.equal(r.code, 0, 'the hook must stay non-blocking: ' + r.out);
+      assert.equal(Number(git(root, ['rev-list', '--count', 'HEAD'])), before + 1,
+        'the deletion must be committed, not treated as nothing to do');
+      assert.equal(git(root, ['status', '--porcelain']), '',
+        'and the tree must be left clean, not merely staged');
+    } finally { cleanup(root); }
+  });
+
+  test('P2 — the commit names the removal, so the event is findable in the log', () => {
+    // The owner's stated purpose: be able to spot the event and undo it. A deletion recorded as
+    // "auto-update" is findable only by reading diffs.
+    const root = project({});
+    try {
+      const h = HOOKS[0];
+      const ctl = h.make(root);
+      commitAll(root);
+      ctl.drop();
+      run(root, h.name);
+      const subject = git(root, ['log', '-1', '--format=%s']);
+      assert.match(subject, h.remove,
+        'the subject must say the artifact was removed: ' + JSON.stringify(subject));
+    } finally { cleanup(root); }
+  });
+
+  test('P3 — a project that never had the artifact stays SILENT', () => {
+    // The guard on the naive fix. Deleting the existence check outright would make `git add` exit
+    // 128 here, and the failure reporting that shipped yesterday would print a line on every session
+    // stop in every project without this artifact.
+    const root = project({});
+    try {
+      fs.writeFileSync(path.join(root, 'unrelated.txt'), 'x\n');
+      commitAll(root);
+      for (const h of HOOKS) {
+        const r = run(root, h.name);
+        assert.equal(r.code, 0, h.name + ' must exit 0');
+        assert.equal(r.out.trim(), '',
+          h.name + ' printed something for an artifact this project never had: ' + r.out);
+      }
+      assert.equal(git(root, ['rev-list', '--count', 'HEAD']), '1',
+        'and nothing may be committed');
+    } finally { cleanup(root); }
+  });
+
+  test('P4 — not a git repository: silent, exit 0', () => {
+    const root = project({ git: false });
+    try {
+      const r = run(root, HOOKS[0].name);
+      assert.equal(r.code, 0);
+      assert.equal(r.out.trim(), '', 'not-a-repo is not a failure to report: ' + r.out);
+    } finally { cleanup(root); }
+  });
+
+  test('P5 — an existing, changed target still commits as before', () => {
+    const root = project({});
+    try {
+      const h = HOOKS[0];
+      const ctl = h.make(root);
+      commitAll(root);
+      ctl.touch();
+      const before = Number(git(root, ['rev-list', '--count', 'HEAD']));
+      assert.equal(run(root, h.name).code, 0);
+      assert.equal(Number(git(root, ['rev-list', '--count', 'HEAD'])), before + 1,
+        'the ordinary update path must be untouched');
+      assert.doesNotMatch(git(root, ['log', '-1', '--format=%s']), /auto-remove/,
+        'and an update must NOT be labelled a removal');
+    } finally { cleanup(root); }
+  });
+
+  test('P6 — an existing, unchanged target is silent', () => {
+    const root = project({});
+    try {
+      const h = HOOKS[0];
+      h.make(root);
+      commitAll(root);
+      const before = Number(git(root, ['rev-list', '--count', 'HEAD']));
+      const r = run(root, h.name);
+      assert.equal(r.code, 0);
+      assert.equal(r.out.trim(), '', 'nothing to commit must stay silent: ' + r.out);
+      assert.equal(Number(git(root, ['rev-list', '--count', 'HEAD'])), before,
+        'and must not create an empty commit');
+    } finally { cleanup(root); }
+  });
+
+  test('P8 — a PARTIAL deletion is still a removal, even though the directory remains', () => {
+    // Cross-family QE: classifying from `existsSync` on the DIRECTORY was wrong. Deleting one file
+    // inside it — or every tracked file while an ignored one keeps the directory present — left the
+    // path existing, so the commit said "auto-save" and the removal was unfindable by the very
+    // search this feature promises. The classification now comes from what git actually STAGED.
+    const root = project({});
+    try {
+      const d = path.join(root, 'docs', 'plans');
+      fs.mkdirSync(d, { recursive: true });
+      fs.writeFileSync(path.join(d, 'a.md'), 'a\n');
+      fs.writeFileSync(path.join(d, 'b.md'), 'b\n');
+      commitAll(root);
+      fs.rmSync(path.join(d, 'a.md'));           // the directory still exists
+
+      const r = run(root, 'autocommit-plans');
+      assert.equal(r.code, 0, r.out);
+      assert.ok(fs.existsSync(d), 'the fixture must leave the directory in place');
+      assert.match(git(root, ['log', '-1', '--format=%s']), /auto-remove/,
+        'one deleted file inside a surviving directory is still a removal: '
+        + git(root, ['log', '-1', '--format=%s']));
+    } finally { cleanup(root); }
+  });
+
+  test('P9 — a real git failure is not laundered into "never existed"', () => {
+    // The `ls-files` answer decides whether a deletion is recorded at all. A bare catch that turned
+    // every failure into an empty answer would silently skip the deletion — a bypass of the feature
+    // itself, wearing the shape of the ordinary case.
+    for (const h of HOOKS) {
+      const src = fs.readFileSync(path.join(TPL, 'hooks', h.name + '.cjs'), 'utf-8');
+      const at = src.indexOf("git(['ls-files'");
+      assert.ok(at > 0, h.name + ' must ask git whether the path is tracked');
+      const around = src.slice(at - 200, at + 200);
+      assert.ok(!/catch\s*\{\s*tracked\s*=\s*''/.test(around),
+        h.name + ' swallows a real ls-files failure as "not tracked": ' + around);
+    }
+  });
+
+  test('P7 — all three hooks record their own deletion identically', () => {
+    // Two of the three watch a DIRECTORY rather than a file, so the deletion path has to work for
+    // both shapes — that is what this case proves, and it is why the fixtures differ.
+    for (const h of HOOKS) {
+      const root = project({});
+      try {
+        const ctl = h.make(root);
+        commitAll(root);
+        const before = Number(git(root, ['rev-list', '--count', 'HEAD']));
+        ctl.drop();
+        const r = run(root, h.name);
+        assert.equal(r.code, 0, h.name + ' must exit 0: ' + r.out);
+        assert.equal(Number(git(root, ['rev-list', '--count', 'HEAD'])), before + 1,
+          h.name + ' did not record its deletion');
+        assert.match(git(root, ['log', '-1', '--format=%s']), h.remove,
+          h.name + ' did not name the removal');
+      } finally { cleanup(root); }
+    }
+  });
+});

package/tests/unit/check-ports.test.js

@@ -0,0 +1,184 @@
+'use strict';
+
+// The package shipped a rule saying a database must not face the internet, and the rule said of
+// itself — correctly — that it was not a check. This is the check.
+//
+// It is a REWRITE, not a transcription. MEASURED: the bash original it replaces never looked at
+// `network_mode: host` (`grep network_mode check-port-conflicts.sh` → nothing), while
+// rules/docker-ports.md forbids it explicitly. A faithful copy would have shipped a check unable to
+// enforce the invariant it is named after.
+//
+// The load-bearing property is the THIRD exit code. A check that answers "clean" when it could not
+// read the config is worse than no check: it turns an unknown into a reassurance. So an absent
+// compose, a missing docker and an unparseable config all exit 2, and P6/P7/P8 assert exactly that.
+//
+// These are BEHAVIOUR tests: they run the real utility over real compose files with real docker.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const PKG = path.resolve(__dirname, '..', '..');
+const TPL = path.join(PKG, 'templates', '.claude');
+const CHECK = path.join(TPL, 'hooks', 'check-ports.cjs');
+
+const DOCKER = spawnSync('docker', ['--version'], { encoding: 'utf8' }).status === 0;
+
+/** Write a compose file into a throwaway directory and run the real check over it. */
+function check(compose, opts) {
+  const o = opts || {};
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-ports-')));
+  try {
+    if (compose !== null) fs.writeFileSync(path.join(dir, 'docker-compose.yml'), compose);
+    const env = Object.assign({}, process.env);
+    if (o.noDocker) env.PATH = dir;            // an empty PATH: docker cannot be found
+    const r = spawnSync(process.execPath, [CHECK, dir], { encoding: 'utf8', env });
+    return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+
+const storagePublished = `services:
+  db:
+    image: postgres:16
+    ports: ["5432:5432"]
+`;
+
+describe('the storage-port rule finally has a check that can fail', () => {
+  test('P1 — it ships as a hooks-directory component, not a new component kind', () => {
+    // The earlier decision to defer this assumed a new `scripts/` directory and five new consumers.
+    // MEASURED: hooks/ already carries a non-event utility (state-update.cjs), so an existing kind
+    // and an existing counter carry this too.
+    assert.ok(fs.existsSync(CHECK), 'the check must ship under templates/.claude/hooks/');
+    const { COMPONENTS } = require(path.join(PKG, 'src', 'utils.js'));
+    assert.ok(COMPONENTS.hooks.items['check-ports'],
+      'it must be registered as a hooks component, or init/doctor/verify will not know it');
+    const statusline = fs.readFileSync(path.join(TPL, 'hooks', 'statusline.cjs'), 'utf-8');
+    const m = statusline.match(/hooksExpected:\s*(\d+)/);
+    assert.ok(m, 'statusline must declare hooksExpected');
+    assert.equal(Number(m[1]), Object.keys(COMPONENTS.hooks.items).length,
+      'the status line would report a phantom missing hook: ' + m[1]);
+  });
+
+  test('P2 — it is NOT registered as an event hook', () => {
+    // Registering it would run `docker compose config` on every session stop, on every project,
+    // including the ones with no compose at all. It is invoked deliberately.
+    const settings = fs.readFileSync(path.join(TPL, 'settings.json'), 'utf-8');
+    assert.ok(!settings.includes('check-ports'),
+      'check-ports must not be wired to an event — it is a utility, like state-update.cjs');
+  });
+
+  test('P3 — a loopback bind PASSES: the exception is part of the rule', { skip: !DOCKER }, () => {
+    for (const bind of ['127.0.0.1:55432:5432', '[::1]:55432:5432']) {
+      const r = check('services:\n  db:\n    image: postgres:16\n    ports: ["' + bind + '"]\n');
+      assert.equal(r.code, 0,
+        bind + ' is legitimate — a check without the exception forbids the test setup the same '
+        + 'pipeline prescribes: ' + r.out);
+    }
+  });
+
+  test('P4 — every forbidden form FAILS, including the one the original missed',
+    { skip: !DOCKER }, () => {
+      const cases = [
+        ['ports: ["5432:5432"]', 'no address at all binds every interface'],
+        ['ports: ["0.0.0.0:5432:5432"]', 'all interfaces, explicitly'],
+        ['ports: ["203.0.113.7:5432:5432"]', 'ONE public address — not "all interfaces", equally reachable'],
+        ['network_mode: host', 'no ports: entry at all, and the container listens on the host'],
+      ];
+      for (const [line, why] of cases) {
+        const r = check('services:\n  db:\n    image: postgres:16\n    ' + line + '\n');
+        assert.equal(r.code, 1, 'must be a violation (' + why + '): ' + r.out);
+        assert.match(r.out, /Правило №0/, 'and must name the rule it enforces: ' + r.out);
+        assert.match(r.out, /db/, 'and the service: ' + r.out);
+      }
+    });
+
+  test('P5 — an app published beside a reverse-proxy FAILS', { skip: !DOCKER }, () => {
+    const r = check('services:\n  proxy:\n    image: caddy:2\n    ports: ["80:80"]\n'
+      + '  app:\n    image: node:22\n    ports: ["3000:3000"]\n');
+    assert.equal(r.code, 1, 'the proxy is the only door: ' + r.out);
+    assert.match(r.out, /app/, 'the offending service must be named, not the proxy: ' + r.out);
+  });
+
+  test('P6 — an unreadable config exits 2 and SAYS the check did not run', { skip: !DOCKER }, () => {
+    // The whole point of the third exit code. "Could not look" is not "nothing found".
+    const r = check('services:\n  db:\n    image: postgres:16\n'
+      + '    ports: ["${UNSET_VAR:?required}:5432"]\n');
+    assert.equal(r.code, 2, 'an unreadable config must not read as clean: ' + r.out);
+    assert.match(r.out, /проверка НЕ выполнена/, 'and must say so in words: ' + r.out);
+  });
+
+  test('P7 — no compose file exits 2', () => {
+    const r = check(null);
+    assert.equal(r.code, 2, 'nothing to check is not the same as nothing wrong: ' + r.out);
+    assert.match(r.out, /проверка НЕ выполнена/);
+  });
+
+  test('P8 — docker unavailable exits 2', () => {
+    // Driven by an empty PATH rather than by uninstalling docker: the property is the code path,
+    // and a test that needs the machine reconfigured is a test nobody runs.
+    const r = check(storagePublished, { noDocker: true });
+    assert.equal(r.code, 2, 'without docker the question cannot be answered: ' + r.out);
+    assert.match(r.out, /docker недоступен/, 'and the reason must be named: ' + r.out);
+  });
+
+  test('P10 — one matrix, all three verdicts: a constant check cannot pass this',
+    { skip: !DOCKER }, () => {
+      // Cross-family QE: every earlier case asserted ONE direction, so an always-clean binary passed
+      // P3 and P9, an always-failing one passed P4 and P5, and a completely non-functional one still
+      // passed P1 and P2. A single run of the SAME executable must produce all three codes.
+      const matrix = [
+        [0, 'services:\n  db:\n    image: postgres:16\n'],
+        [1, 'services:\n  db:\n    image: postgres:16\n    ports: ["5432:5432"]\n'],
+        [2, null],
+      ];
+      const seen = matrix.map(([, compose]) => check(compose).code);
+      assert.deepEqual(seen, [0, 1, 2],
+        'the same binary must answer clean / violation / could-not-check: ' + JSON.stringify(seen));
+    });
+
+  test('P11 — the counter-examples the reviewer supplied', { skip: !DOCKER }, () => {
+    // Each of these was a real defect in the first version, and each is named by the input that
+    // produced it rather than by the rule it broke.
+    const cases = [
+      [0, 'services:\n  db:\n    image: postgres:16\n    command:\n      - postgres\n'
+        + '      - -c\n      - "log_line_prefix=published: 6543"\n',
+        'a sequence item under command: is not a published port'],
+      [0, 'services:\n  ui:\n    image: rediscommander/redis-commander:latest\n'
+        + '    ports: ["8081:8081"]\n',
+        'a redis WEB UI is not storage — substring matching said it was'],
+      [1, 'services:\n  db:\n    image: mcr.microsoft.com/mssql/server:2022-latest\n'
+        + '    ports: ["1433:1433"]\n',
+        'mssql on 1433 was missed by both the name list and the port set'],
+      [1, 'services:\n  db:\n    image: postgres:16\n    ports: ["[::]:5432:5432"]\n',
+        'the IPv6 wildcard is in the rule\'s forbidden table and was untested'],
+      [1, 'services:\n  db:\n    image: myco/custom-store:1\n    ports: ["5432:5432"]\n',
+        'an unrecognised engine on a well-known port is still storage'],
+    ];
+    for (const [expected, compose, why] of cases) {
+      const r = check(compose);
+      assert.equal(r.code, expected, why + ' — got ' + r.code + ': ' + r.out);
+    }
+  });
+
+  test('P12 — several services, and the right one is named', { skip: !DOCKER }, () => {
+    // Fields must not leak between services: the offender has to be identified, not just counted.
+    const r = check('services:\n  cache:\n    image: redis:7\n    ports: ["127.0.0.1:6379:6379"]\n'
+      + '  db:\n    image: postgres:16\n    ports: ["5432:5432"]\n'
+      + '  web:\n    image: node:22\n    ports: ["3000:3000"]\n');
+    assert.equal(r.code, 1, r.out);
+    assert.match(r.out, /db/, 'the offender must be named: ' + r.out);
+    assert.ok(!/cache/.test(r.out),
+      'the loopback-bound cache is legal and must not be reported: ' + r.out);
+    assert.ok(!/web/.test(r.out),
+      'a non-storage service with no proxy present is not this rule\'s business: ' + r.out);
+  });
+
+  test('P9 — a clean compose exits 0', { skip: !DOCKER }, () => {
+    const r = check('services:\n  db:\n    image: postgres:16\n'
+      + '  web:\n    image: node:22\n    ports: ["3000:3000"]\n');
+    assert.equal(r.code, 0, 'a storage service with no publication is exactly right: ' + r.out);
+  });
+});

package/tests/unit/db-port-rule.test.js

@@ -0,0 +1,216 @@
+'use strict';
+
+// Nothing in this package said a database port is not published to the internet. MEASURED: the
+// Architecture Constraints handed to every project (templates/.claude/rules/replicate-pipeline.md)
+// carried exactly five items — pattern, containers, infrastructure, deploy, MCP — and nothing about
+// storage; a sweep of templates/ for such a rule returned only unrelated hits.
+//
+// The working check already exists, in a course repository, and when it fails it prints
+// "Правило: .claude/rules/docker-ports.md, «Правило №0»" — pointing at a file this package did not
+// ship. The rule and the check are two different things, and only the rule ships here — ADR-001 D2,
+// whose load-bearing reasons are that a shipped script is a new component KIND touching five
+// consumers, and that a Node rewrite of a bash+awk compose parser is real work, not a transcription.
+//
+// P6 is the load-bearing one for the future: "5 rules" was a constant maintained BY HAND in seven
+// places, and missing one leaves doctor or the status line reporting a rule missing that is not.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const PKG_DIR = path.resolve(__dirname, '..', '..');
+const read = (rel) => fs.readFileSync(path.join(PKG_DIR, rel), 'utf-8');
+
+const RULE = path.join('templates', '.claude', 'rules', 'docker-ports.md');
+const PIPELINE = path.join('templates', '.claude', 'rules', 'replicate-pipeline.md');
+
+/** The Architecture Constraints block — the list actually handed to sparc-prd-mini. Scoped, because
+ *  a constraint stated anywhere else in the file is not passed to anything. */
+function constraints() {
+  const src = read(PIPELINE);
+  const start = src.indexOf('## Architecture Constraints');
+  const end = src.indexOf('\n## ', start + 1);
+  assert.ok(start > 0, 'replicate-pipeline.md must have an Architecture Constraints block');
+  assert.ok(end > start, 'and a following section');
+  return src.slice(start, end);
+}
+
+describe('a database port is not published to the internet (PR-012)', () => {
+  test('P1 — the constraints block carries the rule and names the file', () => {
+    const block = constraints();
+    // The INVARIANT, not one remedy. Cross-family QE: "does not publish outward" is too narrow —
+    // an explicit public address like 203.0.113.7:5432:5432 is not "all interfaces" and is exactly
+    // as reachable from the internet; and network_mode: host needs no ports: entry at all.
+    assert.match(block, /Storage: у баз и очередей НЕТ публикации на хост/,
+      'the constraint must be IN the block that is passed to Phase 1, not elsewhere in the file');
+    assert.match(block, /кроме привязки к петле/, 'and carry the loopback exception');
+    assert.match(block, /network_mode: host/,
+      'and name the escape path that needs no ports: entry at all');
+    assert.match(block, /docker-ports\.md/,
+      'and name the rule file, so the constraint and the rule are one thing rather than two');
+  });
+
+  test('P2 — the rule file exists and carries the name the shipped check prints', () => {
+    // The check prints: Правило: .claude/rules/docker-ports.md, «Правило №0».
+    // If the heading is renamed, that pointer stops resolving and the reader is left at a dead end.
+    const src = read(RULE);
+    assert.match(src, /Правило №0/,
+      'the rule must carry the exact name the existing check refers people to');
+    // The forbidden list is the security content: each row is a way a reader gets it wrong.
+    for (const bad of ['0.0.0.0:5432:5432', '\\[::\\]:5432:5432', '203.0.113.7:5432:5432',
+      'network_mode: host']) {
+      assert.match(src, new RegExp(bad), 'the forbidden list must name: ' + bad);
+    }
+    assert.match(src, /убрать `ports:` целиком/,
+      'the remedy must be stated as removing publication, not as adding expose:');
+    assert.match(src, /`expose:` в современном Compose ничего не открывает/,
+      'and expose: must be described honestly — it documents, it does not grant access');
+    assert.match(src, /достучатся до\s+сервиса по его имени/,
+      'and why the remedy suffices — otherwise it reads as a loss of capability');
+  });
+
+  test('P3 — the LOOPBACK exception is present, as an allowance and not a footnote', () => {
+    // Without it the rule forbids exactly what the same pipeline prescribes: a test environment that
+    // binds 127.0.0.1 so tests can run from the host. The field report's own pseudocode had this
+    // defect and would have failed the project's own compose.
+    const src = read(RULE);
+    assert.match(src, /Исключение: петля — это законно/,
+      'the exception needs its own heading — a rule whose exception is buried gets applied without it');
+    assert.match(src, /127\.0\.0\.1:55432:5432/, 'shown as a concrete legal line');
+    assert.match(src, /ЗАКОННО/, 'and labelled as permitted, not merely described');
+    // Both loopback forms are equals — a rule that allows ::1 while its own self-check greps only
+    // for 127.0.0.1 contradicts itself, which is what the first version did.
+    assert.match(src, /Петлевых форм две и они равноправны/,
+      'both loopback forms must be named as equals');
+    assert.match(src, /host_ip: ::1/,
+      'and the self-check must accept the IPv6 one it allows');
+    assert.match(src, /исключение\s*\n?такая же часть правила, как и запрет/,
+      'and its standing stated, so a later edit does not trim it as an aside');
+  });
+
+  test('P4 — the rule says what it is NOT, so nobody infers a guarantee', () => {
+    // A rule that reads like a gate is worse than no rule: it stops people looking for the gate.
+    const src = read(RULE);
+    // The property has MOVED, not weakened. When this test was written the package shipped the rule
+    // and no check, so the limit was "nobody may infer a guarantee". A check now ships — so the
+    // limit becomes what the check does NOT cover, and the fact that it must be invoked. A rule that
+    // reads like an automatic gate is still worse than no rule; only the shape of the honesty moved.
+    assert.match(src, /Чем это правило НЕ является|Чего она НЕ делает/,
+      'the limit needs its own heading');
+    assert.match(src, /не привязана ни к какому событию — её надо позвать/,
+      'a check nobody invokes guarantees nothing, and the rule must say so');
+    assert.match(src, /конфликты с портами, уже занятыми другими контейнерами, она не ищет/,
+      'and name what it does not look at, so nobody infers a wider guarantee');
+    assert.match(src, /проверка НЕ\s*\n?ВЫПОЛНЕНА/,
+      'and the third exit code must be documented where a reader will look for it');
+  });
+
+  test('P5 — the field report\'s non-verbatim compose fragment is not quoted', () => {
+    // The report quotes a postgres service carrying an `expose:` line. MEASURED: the real file has
+    // no such line. Copying it would put a fabricated quotation in a security rule.
+    const src = read(RULE);
+    assert.ok(!/image: postgres[\s\S]{0,200}expose:[\s\S]{0,40}5432[\s\S]{0,40}ports:/.test(src),
+      'the rule must not reproduce the report\'s composite fragment');
+  });
+
+  test('P6 — every count site agrees with COMPONENTS.rules.items', () => {
+    // The property is AGREEMENT, not a particular number: the next rule added moves all seven or
+    // this fails. statusline.cjs is a TEMPLATE copied into other projects and cannot import src/,
+    // and the four prose sites are prose, so the constant is irreducibly distributed — what is
+    // removed here is the SILENCE when the sites disagree.
+    const utils = require(path.join(PKG_DIR, 'src', 'utils.js'));
+    const n = Object.keys(utils.COMPONENTS.rules.items).length;
+    assert.ok(n >= 6, 'the docker-ports rule must be registered as a component: got ' + n);
+
+    const statusline = read(path.join('templates', '.claude', 'hooks', 'statusline.cjs'));
+    const m = statusline.match(/rulesExpected:\s*(\d+)/);
+    assert.ok(m, 'statusline.cjs must declare rulesExpected');
+    assert.equal(Number(m[1]), n,
+      'statusline would report a phantom missing rule: rulesExpected=' + m[1] + ' vs ' + n);
+
+    // SCAN, do not enumerate. The first version listed six prose sites by hand and MISSED SEVEN more,
+    // including templates/.claude/commands/replicate.md — the file that SHIPS INTO EVERY GENERATED
+    // PROJECT and names the rules a run must not overwrite. `docker-ports` was absent from that list,
+    // so the security rule this feature added could be silently regenerated away. Two independent
+    // reviewers found it; a hand-picked list is how it survived my own review.
+    //
+    // Historical documents are exempt BY NAME: a changelog entry describing what 1.4 shipped is a
+    // true statement about the past, and rewriting it would be falsifying a record.
+    const HISTORICAL = /changelog/i;
+    const COUNT_CLAIM = /(\d+)\s+rules\b|(\d+)\s+правил|Rules\s+●(\d+)|\*\*(\d+) rules\*\*/g;
+    const scanned = [];
+    const walk = (dir) => {
+      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) {
+          if (e.name === 'node_modules' || e.name === '.git') continue;
+          walk(full);
+        } else if (/\.(md|html)$/.test(e.name) && !HISTORICAL.test(full)) {
+          scanned.push(full);
+        }
+      }
+    };
+    walk(PKG_DIR);
+    assert.ok(scanned.length > 10, 'the scan must actually find documents: ' + scanned.length);
+
+    // `claimed`, not `n`. A rename made the inner variable shadow the authoritative one and the
+    // comparison became `n !== n` — a test that could never fail, caught by mutation and not by
+    // reading it. The same shape a reviewer caught in this suite's sibling yesterday.
+    const wrong = [];
+    for (const file of scanned) {
+      const text = fs.readFileSync(file, 'utf-8');
+      for (const hit of text.matchAll(COUNT_CLAIM)) {
+        // A release-notes SECTION inside an otherwise-current document is historical too — the README
+        // and the RU html bundle both embed one. The test is not a character window (which missed a
+        // line 1300 lines below its heading) but the NEAREST PRECEDING heading: a count written under
+        // a version heading is a statement about that version, and rewriting it would falsify a
+        // record.
+        const before = text.slice(0, hit.index);
+        const headings = before.match(/^#{1,3} .*$|^<h[1-3][^>]*>.*$/gm) || [];
+        const nearest = headings.length ? headings[headings.length - 1] : '';
+        const historicalSection = /changelog|release notes|version history|история версий|\[?v?\d+\.\d+/i;
+        if (historicalSection.test(nearest)) continue;
+        // and an explicit past-tense marker on the line itself
+        const lineStart = before.lastIndexOf('\n') + 1;
+        const line = text.slice(lineStart, text.indexOf('\n', hit.index));
+        if (/initial published version|первая опубликованная/i.test(line)) continue;
+        const claimed = Number(hit[1] || hit[2] || hit[3] || hit[4]);
+        if (claimed !== n) {
+          wrong.push(path.relative(PKG_DIR, file) + ': "' + hit[0].trim() + '"');
+        }
+      }
+    }
+    assert.deepEqual(wrong, [],
+      'these say a rule count that is not ' + n + ': ' + JSON.stringify(wrong, null, 1));
+
+    // An EIGHTH site the survey missed    // An EIGHTH site the survey missed, found by the suite going red: the e2e --help assertion,
+    // which is not a file constant but a re-typed expectation. cli.js:57 already derives its number
+    // from COMPONENTS, so a test that hardcodes one is a second source of truth — exactly the defect
+    // its own comment says it exists to catch ("cli.js used to say 1 rule while EXPECTED_RULES had 2
+    // entries"). It is now derived, and this asserts it stays derived.
+    const e2e = read(path.join('tests', 'e2e', 'lifecycle.test.js'));
+    const helpAt = e2e.indexOf("describe('e2e: --help shows correct component counts'");
+    assert.ok(helpAt > 0, 'the --help count test must exist');
+    const helpBlock = e2e.slice(helpAt, e2e.indexOf('});', e2e.indexOf('} finally', helpAt)));
+    assert.match(helpBlock, /Object\.keys\(COMPONENTS\[group\]\.items\)\.length/,
+      'the --help count test must DERIVE from COMPONENTS, not re-type the numbers');
+    assert.ok(!/\/\d+\\s\+rules\//.test(helpBlock),
+      'and must not carry a hardcoded rule count');
+  });
+
+  test('P7 — the HOOK surface stays Node-only', () => {
+    // ADR-001 D2, NARROWED by measurement during Step 7. The first version asserted that NO .sh
+    // ships anywhere in templates/, and that is FALSE: skills/brutal-honesty-review/scripts/
+    // assess-tests.sh and assess-code.sh already ship. The cross-platform promise in settings.json
+    // ("Cross-platform Node scripts (no bash dependencies)") is scoped to the HOOKS — all six are
+    // .cjs so Windows works — and a port check is hook-shaped, so that is the surface to guard.
+    // Asserting the broader claim would have been a test enforcing something untrue.
+    const hooks = path.join(PKG_DIR, 'templates', '.claude', 'hooks');
+    const files = fs.readdirSync(hooks);
+    assert.deepEqual(files.filter((f) => f.endsWith('.sh')), [],
+      'a .sh among the hooks contradicts the cross-platform promise in settings.json');
+    assert.ok(files.filter((f) => f.endsWith('.cjs')).length >= 6,
+      'and the six shipped hooks must still be .cjs: ' + JSON.stringify(files));
+  });
+});