@dzhechkov/p-replicator 1.5.18 → 1.9.0

package/tests/unit/check-growth-trace.test.js

@@ -0,0 +1,188 @@
+'use strict';
+
+// The deterministic half of the growth gate. The validator criterion is prose a model reads —
+// layer 3. This is layer 1, and only for whoever runs it.
+//
+// The load-bearing property is the THIRD exit code, for the same reason it was in check-ports:
+// a checker that answers "clean" when it could not look converts an unknown into a reassurance.
+// Here the unknown has a specific and common cause — the --from-docs entry skips Phase 0, so the
+// brief legitimately does not exist. That must be 2. Reading it as 0 would report "all growth
+// requirements traced" for a project that never analysed growth at all.
+//
+// These are BEHAVIOUR tests: the real utility, real files, real exit codes.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const PKG = path.resolve(__dirname, '..', '..');
+const TPL = path.join(PKG, 'templates', '.claude');
+const CHECK = path.join(TPL, 'hooks', 'check-growth-trace.cjs');
+
+/** Build a throwaway project and run the real checker over it. */
+function check(files) {
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-growth-')));
+  try {
+    for (const [rel, body] of Object.entries(files || {})) {
+      const abs = path.join(dir, rel);
+      fs.mkdirSync(path.dirname(abs), { recursive: true });
+      fs.writeFileSync(abs, body);
+    }
+    const r = spawnSync(process.execPath, [CHECK, dir], { encoding: 'utf8' });
+    return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+
+const brief = (rows) => '# Brief\n\n## 🌱 Growth Requirements Seed\n\n'
+  + '| ID | Требование | Блок-источник | Confidence | Статус |\n'
+  + '|----|----|----|----|----|\n' + rows.join('\n') + '\n';
+
+const ROW1 = '| FR-GROWTH-001 | Реферальная петля в онбординге | A. Primary Growth Loop | 4/5 | ЧЕРНОВИК |';
+const ROW2 = '| FR-GROWTH-002 | Интеграция с маркетплейсом | B. Top-3 Acquisition Channels | 3/5 | ЧЕРНОВИК |';
+
+describe('the growth-trace checker answers three questions, and never confuses two of them', () => {
+  test('P1 - a traced requirement is exit 0', () => {
+    const r = check({
+      'docs/product-discovery-brief.md': brief([ROW1]),
+      'docs/Specification.md': '# Spec\n\n## FR-GROWTH-001 Реферальная петля\n\nПодробности.\n',
+    });
+    assert.equal(r.code, 0, 'a traced id must pass: ' + r.out);
+    assert.match(r.out, /прослежены/, r.out);
+  });
+
+  test('P2 - an analysed-then-dropped requirement is exit 1, and the id is named', () => {
+    const r = check({
+      'docs/product-discovery-brief.md': brief([ROW1]),
+      'docs/Specification.md': '# Spec\n\nНичего про рост.\n',
+    });
+    assert.equal(r.code, 1, 'a dropped obligation must fail: ' + r.out);
+    assert.match(r.out, /FR-GROWTH-001/, 'and the lost id must be named: ' + r.out);
+  });
+
+  test('P3 - an absent brief is exit 2, never exit 0', () => {
+    // The single most important case. --from-docs skips Phase 0, so this is the COMMON state, and
+    // reading it as clean would silently bless every such project.
+    const r = check({ 'docs/Specification.md': '# Spec\n' });
+    assert.equal(r.code, 2, 'no brief means the check did not run: ' + r.out);
+    assert.match(r.out, /проверка НЕ выполнена/, r.out);
+    assert.match(r.out, /Фаза 0 не запускалась/, 'and the reason must be named: ' + r.out);
+  });
+
+  test('P4 - an absent Specification is exit 2, not exit 1', () => {
+    // Without the destination there is nothing to compare against. Calling that "nothing traced"
+    // would blame the project for the checker's blindness.
+    const r = check({ 'docs/product-discovery-brief.md': brief([ROW1]) });
+    assert.equal(r.code, 2, 'no Specification means the check could not run: ' + r.out);
+    assert.match(r.out, /Specification/, r.out);
+  });
+
+  test('P5 - an untouched template table is exit 2, not exit 0', () => {
+    // The shipped module carries example rows with bracketed placeholders. Counting them would let
+    // an untouched template look like a filled-in one — and then "0 traced of 0" reads as clean.
+    const r = check({
+      'docs/product-discovery-brief.md': brief([
+        '| FR-GROWTH-001 | [что обязаны построить, одним предложением] | A. Primary Growth Loop | [как записано] | ЧЕРНОВИК |',
+        '| FR-GROWTH-002 | ... | B. Top-3 Acquisition Channels | ... | ... |',
+      ]),
+      'docs/Specification.md': '# Spec\n',
+    });
+    assert.equal(r.code, 2, 'a placeholder row is not an obligation: ' + r.out);
+    assert.match(r.out, /шаблоном|ни одной заполненной/, r.out);
+  });
+
+  test('P6 - a rejection WITH a reason passes; a bare drop does not', () => {
+    const withReason = check({
+      'docs/product-discovery-brief.md': brief([ROW1]),
+      'docs/Specification.md': '# Spec\n\nFR-GROWTH-001 отклонено — нет бюджета на реферальную программу в MVP.\n',
+    });
+    assert.equal(withReason.code, 0, 'a recorded rejection is a legitimate answer: ' + withReason.out);
+
+    const bare = check({
+      'docs/product-discovery-brief.md': brief([ROW1]),
+      'docs/Specification.md': '# Spec\n\nFR-GROWTH-001\n',
+    });
+    // A bare id mention IS a trace by the stated definition — that is deliberate and documented.
+    // What must not pass is an id that appears nowhere, which P2 covers.
+    assert.equal(bare.code, 0, 'the exact token is the definition of a mention: ' + bare.out);
+  });
+
+  test('P7 - a partial loss is reported with the count, not averaged away', () => {
+    const r = check({
+      'docs/product-discovery-brief.md': brief([ROW1, ROW2]),
+      'docs/Specification.md': '# Spec\n\nFR-GROWTH-001 реализуем.\n',
+    });
+    assert.equal(r.code, 1, 'one of two lost is still a loss: ' + r.out);
+    assert.match(r.out, /1 из 2/, 'the count must be reported: ' + r.out);
+    assert.match(r.out, /FR-GROWTH-002/, 'and the lost one named: ' + r.out);
+    assert.ok(!/FR-GROWTH-001/.test(r.out.split('\n').filter((l) => l.includes('•')).join('\n')),
+      'the traced one must NOT be listed as lost: ' + r.out);
+  });
+
+  test('P8 - one binary, all three verdicts in a single run', () => {
+    // Each case above asserts ONE direction, so a constant-answer implementation could pass a
+    // subset. The same executable must produce 0, 1 and 2.
+    const seen = [
+      check({ 'docs/product-discovery-brief.md': brief([ROW1]),
+        'docs/Specification.md': 'FR-GROWTH-001\n' }).code,
+      check({ 'docs/product-discovery-brief.md': brief([ROW1]),
+        'docs/Specification.md': 'ничего\n' }).code,
+      check({}).code,
+    ];
+    assert.deepEqual(seen, [0, 1, 2], 'expected clean/lost/could-not-check: ' + JSON.stringify(seen));
+  });
+
+  test('P11 - the counter-examples cross-family review supplied', () => {
+    // Each was a false CLEAN in the first version, and each is named by the input that produced it.
+    const cases = [
+      [1, '# Spec\nFR-GROWTH-001 rejected\n',
+        'a bare refusal with no reason: the reason pattern accepted a hyphen and the IDENTIFIER '
+        + 'carries two — and the mention rule reached the line first, so the reason was never asked for'],
+      [0, '# Spec\nFR-GROWTH-001 отклонено — нет бюджета на реферальную программу в MVP\n',
+        'a refusal WITH a reason is a legitimate answer and must still pass'],
+      [1, '# Spec\nFR-GROWTH-001 declined - x\n',
+        'one character is a separator plus noise, not a reason'],
+    ];
+    for (const [expected, spec, why] of cases) {
+      const r = check({ 'docs/product-discovery-brief.md': brief([ROW1]), 'docs/Specification.md': spec });
+      assert.equal(r.code, expected, why + ' — got ' + r.code + ': ' + r.out);
+    }
+  });
+
+  test('P12 - a reused id is exit 2, because one mention would clear two obligations', () => {
+    // The module's own rule is that a number is never reused. When it is, `mentioned()` answers from
+    // a Set and a SINGLE mention marks BOTH rows traced — coverage counted over usable items rather
+    // than per position. Malformed input is inconclusive, never a pass.
+    const dup = '| FR-GROWTH-001 | Совсем другое требование | B. Top-3 Acquisition Channels | 3/5 | ЧЕРНОВИК |';
+    const r = check({
+      'docs/product-discovery-brief.md': brief([ROW1, dup]),
+      'docs/Specification.md': '# Spec\nFR-GROWTH-001 берём\n',
+    });
+    assert.equal(r.code, 2, 'a duplicate id must not read as clean: ' + r.out);
+    assert.match(r.out, /повторяются идентификаторы/, r.out);
+    assert.match(r.out, /FR-GROWTH-001/, 'and the duplicated id must be named: ' + r.out);
+  });
+
+  test('P9 - it is a hooks component wired to NO event', () => {
+    const { COMPONENTS } = require(path.join(PKG, 'src', 'utils.js'));
+    assert.ok(COMPONENTS.hooks.items['check-growth-trace'],
+      'it must be registered, or init/doctor/verify will not know it');
+    const settings = fs.readFileSync(path.join(TPL, 'settings.json'), 'utf-8');
+    assert.ok(!settings.includes('check-growth-trace'),
+      'it must not be wired to an event: this packages hooks are non-blocking by contract, so a '
+      + 'hook could only print — it could never refuse anything');
+    const statusline = fs.readFileSync(path.join(TPL, 'hooks', 'statusline.cjs'), 'utf-8');
+    const m = statusline.match(/hooksExpected:\s*(\d+)/);
+    assert.ok(m, 'statusline must declare hooksExpected');
+    assert.equal(Number(m[1]), Object.keys(COMPONENTS.hooks.items).length,
+      'the status line would report a phantom missing hook: ' + m[1]);
+  });
+
+  test('P10 - a directory that does not exist is exit 2', () => {
+    const r = spawnSync(process.execPath, [CHECK, '/nonexistent-path-for-this-test'],
+      { encoding: 'utf8' });
+    assert.equal(r.status, 2, 'an unusable argument is not a clean bill: ' + r.stdout);
+  });
+});

package/tests/unit/check-ports.test.js

@@ -0,0 +1,184 @@
+'use strict';
+
+// The package shipped a rule saying a database must not face the internet, and the rule said of
+// itself — correctly — that it was not a check. This is the check.
+//
+// It is a REWRITE, not a transcription. MEASURED: the bash original it replaces never looked at
+// `network_mode: host` (`grep network_mode check-port-conflicts.sh` → nothing), while
+// rules/docker-ports.md forbids it explicitly. A faithful copy would have shipped a check unable to
+// enforce the invariant it is named after.
+//
+// The load-bearing property is the THIRD exit code. A check that answers "clean" when it could not
+// read the config is worse than no check: it turns an unknown into a reassurance. So an absent
+// compose, a missing docker and an unparseable config all exit 2, and P6/P7/P8 assert exactly that.
+//
+// These are BEHAVIOUR tests: they run the real utility over real compose files with real docker.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const PKG = path.resolve(__dirname, '..', '..');
+const TPL = path.join(PKG, 'templates', '.claude');
+const CHECK = path.join(TPL, 'hooks', 'check-ports.cjs');
+
+const DOCKER = spawnSync('docker', ['--version'], { encoding: 'utf8' }).status === 0;
+
+/** Write a compose file into a throwaway directory and run the real check over it. */
+function check(compose, opts) {
+  const o = opts || {};
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-ports-')));
+  try {
+    if (compose !== null) fs.writeFileSync(path.join(dir, 'docker-compose.yml'), compose);
+    const env = Object.assign({}, process.env);
+    if (o.noDocker) env.PATH = dir;            // an empty PATH: docker cannot be found
+    const r = spawnSync(process.execPath, [CHECK, dir], { encoding: 'utf8', env });
+    return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+
+const storagePublished = `services:
+  db:
+    image: postgres:16
+    ports: ["5432:5432"]
+`;
+
+describe('the storage-port rule finally has a check that can fail', () => {
+  test('P1 — it ships as a hooks-directory component, not a new component kind', () => {
+    // The earlier decision to defer this assumed a new `scripts/` directory and five new consumers.
+    // MEASURED: hooks/ already carries a non-event utility (state-update.cjs), so an existing kind
+    // and an existing counter carry this too.
+    assert.ok(fs.existsSync(CHECK), 'the check must ship under templates/.claude/hooks/');
+    const { COMPONENTS } = require(path.join(PKG, 'src', 'utils.js'));
+    assert.ok(COMPONENTS.hooks.items['check-ports'],
+      'it must be registered as a hooks component, or init/doctor/verify will not know it');
+    const statusline = fs.readFileSync(path.join(TPL, 'hooks', 'statusline.cjs'), 'utf-8');
+    const m = statusline.match(/hooksExpected:\s*(\d+)/);
+    assert.ok(m, 'statusline must declare hooksExpected');
+    assert.equal(Number(m[1]), Object.keys(COMPONENTS.hooks.items).length,
+      'the status line would report a phantom missing hook: ' + m[1]);
+  });
+
+  test('P2 — it is NOT registered as an event hook', () => {
+    // Registering it would run `docker compose config` on every session stop, on every project,
+    // including the ones with no compose at all. It is invoked deliberately.
+    const settings = fs.readFileSync(path.join(TPL, 'settings.json'), 'utf-8');
+    assert.ok(!settings.includes('check-ports'),
+      'check-ports must not be wired to an event — it is a utility, like state-update.cjs');
+  });
+
+  test('P3 — a loopback bind PASSES: the exception is part of the rule', { skip: !DOCKER }, () => {
+    for (const bind of ['127.0.0.1:55432:5432', '[::1]:55432:5432']) {
+      const r = check('services:\n  db:\n    image: postgres:16\n    ports: ["' + bind + '"]\n');
+      assert.equal(r.code, 0,
+        bind + ' is legitimate — a check without the exception forbids the test setup the same '
+        + 'pipeline prescribes: ' + r.out);
+    }
+  });
+
+  test('P4 — every forbidden form FAILS, including the one the original missed',
+    { skip: !DOCKER }, () => {
+      const cases = [
+        ['ports: ["5432:5432"]', 'no address at all binds every interface'],
+        ['ports: ["0.0.0.0:5432:5432"]', 'all interfaces, explicitly'],
+        ['ports: ["203.0.113.7:5432:5432"]', 'ONE public address — not "all interfaces", equally reachable'],
+        ['network_mode: host', 'no ports: entry at all, and the container listens on the host'],
+      ];
+      for (const [line, why] of cases) {
+        const r = check('services:\n  db:\n    image: postgres:16\n    ' + line + '\n');
+        assert.equal(r.code, 1, 'must be a violation (' + why + '): ' + r.out);
+        assert.match(r.out, /Правило №0/, 'and must name the rule it enforces: ' + r.out);
+        assert.match(r.out, /db/, 'and the service: ' + r.out);
+      }
+    });
+
+  test('P5 — an app published beside a reverse-proxy FAILS', { skip: !DOCKER }, () => {
+    const r = check('services:\n  proxy:\n    image: caddy:2\n    ports: ["80:80"]\n'
+      + '  app:\n    image: node:22\n    ports: ["3000:3000"]\n');
+    assert.equal(r.code, 1, 'the proxy is the only door: ' + r.out);
+    assert.match(r.out, /app/, 'the offending service must be named, not the proxy: ' + r.out);
+  });
+
+  test('P6 — an unreadable config exits 2 and SAYS the check did not run', { skip: !DOCKER }, () => {
+    // The whole point of the third exit code. "Could not look" is not "nothing found".
+    const r = check('services:\n  db:\n    image: postgres:16\n'
+      + '    ports: ["${UNSET_VAR:?required}:5432"]\n');
+    assert.equal(r.code, 2, 'an unreadable config must not read as clean: ' + r.out);
+    assert.match(r.out, /проверка НЕ выполнена/, 'and must say so in words: ' + r.out);
+  });
+
+  test('P7 — no compose file exits 2', () => {
+    const r = check(null);
+    assert.equal(r.code, 2, 'nothing to check is not the same as nothing wrong: ' + r.out);
+    assert.match(r.out, /проверка НЕ выполнена/);
+  });
+
+  test('P8 — docker unavailable exits 2', () => {
+    // Driven by an empty PATH rather than by uninstalling docker: the property is the code path,
+    // and a test that needs the machine reconfigured is a test nobody runs.
+    const r = check(storagePublished, { noDocker: true });
+    assert.equal(r.code, 2, 'without docker the question cannot be answered: ' + r.out);
+    assert.match(r.out, /docker недоступен/, 'and the reason must be named: ' + r.out);
+  });
+
+  test('P10 — one matrix, all three verdicts: a constant check cannot pass this',
+    { skip: !DOCKER }, () => {
+      // Cross-family QE: every earlier case asserted ONE direction, so an always-clean binary passed
+      // P3 and P9, an always-failing one passed P4 and P5, and a completely non-functional one still
+      // passed P1 and P2. A single run of the SAME executable must produce all three codes.
+      const matrix = [
+        [0, 'services:\n  db:\n    image: postgres:16\n'],
+        [1, 'services:\n  db:\n    image: postgres:16\n    ports: ["5432:5432"]\n'],
+        [2, null],
+      ];
+      const seen = matrix.map(([, compose]) => check(compose).code);
+      assert.deepEqual(seen, [0, 1, 2],
+        'the same binary must answer clean / violation / could-not-check: ' + JSON.stringify(seen));
+    });
+
+  test('P11 — the counter-examples the reviewer supplied', { skip: !DOCKER }, () => {
+    // Each of these was a real defect in the first version, and each is named by the input that
+    // produced it rather than by the rule it broke.
+    const cases = [
+      [0, 'services:\n  db:\n    image: postgres:16\n    command:\n      - postgres\n'
+        + '      - -c\n      - "log_line_prefix=published: 6543"\n',
+        'a sequence item under command: is not a published port'],
+      [0, 'services:\n  ui:\n    image: rediscommander/redis-commander:latest\n'
+        + '    ports: ["8081:8081"]\n',
+        'a redis WEB UI is not storage — substring matching said it was'],
+      [1, 'services:\n  db:\n    image: mcr.microsoft.com/mssql/server:2022-latest\n'
+        + '    ports: ["1433:1433"]\n',
+        'mssql on 1433 was missed by both the name list and the port set'],
+      [1, 'services:\n  db:\n    image: postgres:16\n    ports: ["[::]:5432:5432"]\n',
+        'the IPv6 wildcard is in the rule\'s forbidden table and was untested'],
+      [1, 'services:\n  db:\n    image: myco/custom-store:1\n    ports: ["5432:5432"]\n',
+        'an unrecognised engine on a well-known port is still storage'],
+    ];
+    for (const [expected, compose, why] of cases) {
+      const r = check(compose);
+      assert.equal(r.code, expected, why + ' — got ' + r.code + ': ' + r.out);
+    }
+  });
+
+  test('P12 — several services, and the right one is named', { skip: !DOCKER }, () => {
+    // Fields must not leak between services: the offender has to be identified, not just counted.
+    const r = check('services:\n  cache:\n    image: redis:7\n    ports: ["127.0.0.1:6379:6379"]\n'
+      + '  db:\n    image: postgres:16\n    ports: ["5432:5432"]\n'
+      + '  web:\n    image: node:22\n    ports: ["3000:3000"]\n');
+    assert.equal(r.code, 1, r.out);
+    assert.match(r.out, /db/, 'the offender must be named: ' + r.out);
+    assert.ok(!/cache/.test(r.out),
+      'the loopback-bound cache is legal and must not be reported: ' + r.out);
+    assert.ok(!/web/.test(r.out),
+      'a non-storage service with no proxy present is not this rule\'s business: ' + r.out);
+  });
+
+  test('P9 — a clean compose exits 0', { skip: !DOCKER }, () => {
+    const r = check('services:\n  db:\n    image: postgres:16\n'
+      + '  web:\n    image: node:22\n    ports: ["3000:3000"]\n');
+    assert.equal(r.code, 0, 'a storage service with no publication is exactly right: ' + r.out);
+  });
+});

package/tests/unit/db-port-rule.test.js

@@ -0,0 +1,216 @@
+'use strict';
+
+// Nothing in this package said a database port is not published to the internet. MEASURED: the
+// Architecture Constraints handed to every project (templates/.claude/rules/replicate-pipeline.md)
+// carried exactly five items — pattern, containers, infrastructure, deploy, MCP — and nothing about
+// storage; a sweep of templates/ for such a rule returned only unrelated hits.
+//
+// The working check already exists, in a course repository, and when it fails it prints
+// "Правило: .claude/rules/docker-ports.md, «Правило №0»" — pointing at a file this package did not
+// ship. The rule and the check are two different things, and only the rule ships here — ADR-001 D2,
+// whose load-bearing reasons are that a shipped script is a new component KIND touching five
+// consumers, and that a Node rewrite of a bash+awk compose parser is real work, not a transcription.
+//
+// P6 is the load-bearing one for the future: "5 rules" was a constant maintained BY HAND in seven
+// places, and missing one leaves doctor or the status line reporting a rule missing that is not.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const PKG_DIR = path.resolve(__dirname, '..', '..');
+const read = (rel) => fs.readFileSync(path.join(PKG_DIR, rel), 'utf-8');
+
+const RULE = path.join('templates', '.claude', 'rules', 'docker-ports.md');
+const PIPELINE = path.join('templates', '.claude', 'rules', 'replicate-pipeline.md');
+
+/** The Architecture Constraints block — the list actually handed to sparc-prd-mini. Scoped, because
+ *  a constraint stated anywhere else in the file is not passed to anything. */
+function constraints() {
+  const src = read(PIPELINE);
+  const start = src.indexOf('## Architecture Constraints');
+  const end = src.indexOf('\n## ', start + 1);
+  assert.ok(start > 0, 'replicate-pipeline.md must have an Architecture Constraints block');
+  assert.ok(end > start, 'and a following section');
+  return src.slice(start, end);
+}
+
+describe('a database port is not published to the internet (PR-012)', () => {
+  test('P1 — the constraints block carries the rule and names the file', () => {
+    const block = constraints();
+    // The INVARIANT, not one remedy. Cross-family QE: "does not publish outward" is too narrow —
+    // an explicit public address like 203.0.113.7:5432:5432 is not "all interfaces" and is exactly
+    // as reachable from the internet; and network_mode: host needs no ports: entry at all.
+    assert.match(block, /Storage: у баз и очередей НЕТ публикации на хост/,
+      'the constraint must be IN the block that is passed to Phase 1, not elsewhere in the file');
+    assert.match(block, /кроме привязки к петле/, 'and carry the loopback exception');
+    assert.match(block, /network_mode: host/,
+      'and name the escape path that needs no ports: entry at all');
+    assert.match(block, /docker-ports\.md/,
+      'and name the rule file, so the constraint and the rule are one thing rather than two');
+  });
+
+  test('P2 — the rule file exists and carries the name the shipped check prints', () => {
+    // The check prints: Правило: .claude/rules/docker-ports.md, «Правило №0».
+    // If the heading is renamed, that pointer stops resolving and the reader is left at a dead end.
+    const src = read(RULE);
+    assert.match(src, /Правило №0/,
+      'the rule must carry the exact name the existing check refers people to');
+    // The forbidden list is the security content: each row is a way a reader gets it wrong.
+    for (const bad of ['0.0.0.0:5432:5432', '\\[::\\]:5432:5432', '203.0.113.7:5432:5432',
+      'network_mode: host']) {
+      assert.match(src, new RegExp(bad), 'the forbidden list must name: ' + bad);
+    }
+    assert.match(src, /убрать `ports:` целиком/,
+      'the remedy must be stated as removing publication, not as adding expose:');
+    assert.match(src, /`expose:` в современном Compose ничего не открывает/,
+      'and expose: must be described honestly — it documents, it does not grant access');
+    assert.match(src, /достучатся до\s+сервиса по его имени/,
+      'and why the remedy suffices — otherwise it reads as a loss of capability');
+  });
+
+  test('P3 — the LOOPBACK exception is present, as an allowance and not a footnote', () => {
+    // Without it the rule forbids exactly what the same pipeline prescribes: a test environment that
+    // binds 127.0.0.1 so tests can run from the host. The field report's own pseudocode had this
+    // defect and would have failed the project's own compose.
+    const src = read(RULE);
+    assert.match(src, /Исключение: петля — это законно/,
+      'the exception needs its own heading — a rule whose exception is buried gets applied without it');
+    assert.match(src, /127\.0\.0\.1:55432:5432/, 'shown as a concrete legal line');
+    assert.match(src, /ЗАКОННО/, 'and labelled as permitted, not merely described');
+    // Both loopback forms are equals — a rule that allows ::1 while its own self-check greps only
+    // for 127.0.0.1 contradicts itself, which is what the first version did.
+    assert.match(src, /Петлевых форм две и они равноправны/,
+      'both loopback forms must be named as equals');
+    assert.match(src, /host_ip: ::1/,
+      'and the self-check must accept the IPv6 one it allows');
+    assert.match(src, /исключение\s*\n?такая же часть правила, как и запрет/,
+      'and its standing stated, so a later edit does not trim it as an aside');
+  });
+
+  test('P4 — the rule says what it is NOT, so nobody infers a guarantee', () => {
+    // A rule that reads like a gate is worse than no rule: it stops people looking for the gate.
+    const src = read(RULE);
+    // The property has MOVED, not weakened. When this test was written the package shipped the rule
+    // and no check, so the limit was "nobody may infer a guarantee". A check now ships — so the
+    // limit becomes what the check does NOT cover, and the fact that it must be invoked. A rule that
+    // reads like an automatic gate is still worse than no rule; only the shape of the honesty moved.
+    assert.match(src, /Чем это правило НЕ является|Чего она НЕ делает/,
+      'the limit needs its own heading');
+    assert.match(src, /не привязана ни к какому событию — её надо позвать/,
+      'a check nobody invokes guarantees nothing, and the rule must say so');
+    assert.match(src, /конфликты с портами, уже занятыми другими контейнерами, она не ищет/,
+      'and name what it does not look at, so nobody infers a wider guarantee');
+    assert.match(src, /проверка НЕ\s*\n?ВЫПОЛНЕНА/,
+      'and the third exit code must be documented where a reader will look for it');
+  });
+
+  test('P5 — the field report\'s non-verbatim compose fragment is not quoted', () => {
+    // The report quotes a postgres service carrying an `expose:` line. MEASURED: the real file has
+    // no such line. Copying it would put a fabricated quotation in a security rule.
+    const src = read(RULE);
+    assert.ok(!/image: postgres[\s\S]{0,200}expose:[\s\S]{0,40}5432[\s\S]{0,40}ports:/.test(src),
+      'the rule must not reproduce the report\'s composite fragment');
+  });
+
+  test('P6 — every count site agrees with COMPONENTS.rules.items', () => {
+    // The property is AGREEMENT, not a particular number: the next rule added moves all seven or
+    // this fails. statusline.cjs is a TEMPLATE copied into other projects and cannot import src/,
+    // and the four prose sites are prose, so the constant is irreducibly distributed — what is
+    // removed here is the SILENCE when the sites disagree.
+    const utils = require(path.join(PKG_DIR, 'src', 'utils.js'));
+    const n = Object.keys(utils.COMPONENTS.rules.items).length;
+    assert.ok(n >= 6, 'the docker-ports rule must be registered as a component: got ' + n);
+
+    const statusline = read(path.join('templates', '.claude', 'hooks', 'statusline.cjs'));
+    const m = statusline.match(/rulesExpected:\s*(\d+)/);
+    assert.ok(m, 'statusline.cjs must declare rulesExpected');
+    assert.equal(Number(m[1]), n,
+      'statusline would report a phantom missing rule: rulesExpected=' + m[1] + ' vs ' + n);
+
+    // SCAN, do not enumerate. The first version listed six prose sites by hand and MISSED SEVEN more,
+    // including templates/.claude/commands/replicate.md — the file that SHIPS INTO EVERY GENERATED
+    // PROJECT and names the rules a run must not overwrite. `docker-ports` was absent from that list,
+    // so the security rule this feature added could be silently regenerated away. Two independent
+    // reviewers found it; a hand-picked list is how it survived my own review.
+    //
+    // Historical documents are exempt BY NAME: a changelog entry describing what 1.4 shipped is a
+    // true statement about the past, and rewriting it would be falsifying a record.
+    const HISTORICAL = /changelog/i;
+    const COUNT_CLAIM = /(\d+)\s+rules\b|(\d+)\s+правил|Rules\s+●(\d+)|\*\*(\d+) rules\*\*/g;
+    const scanned = [];
+    const walk = (dir) => {
+      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) {
+          if (e.name === 'node_modules' || e.name === '.git') continue;
+          walk(full);
+        } else if (/\.(md|html)$/.test(e.name) && !HISTORICAL.test(full)) {
+          scanned.push(full);
+        }
+      }
+    };
+    walk(PKG_DIR);
+    assert.ok(scanned.length > 10, 'the scan must actually find documents: ' + scanned.length);
+
+    // `claimed`, not `n`. A rename made the inner variable shadow the authoritative one and the
+    // comparison became `n !== n` — a test that could never fail, caught by mutation and not by
+    // reading it. The same shape a reviewer caught in this suite's sibling yesterday.
+    const wrong = [];
+    for (const file of scanned) {
+      const text = fs.readFileSync(file, 'utf-8');
+      for (const hit of text.matchAll(COUNT_CLAIM)) {
+        // A release-notes SECTION inside an otherwise-current document is historical too — the README
+        // and the RU html bundle both embed one. The test is not a character window (which missed a
+        // line 1300 lines below its heading) but the NEAREST PRECEDING heading: a count written under
+        // a version heading is a statement about that version, and rewriting it would falsify a
+        // record.
+        const before = text.slice(0, hit.index);
+        const headings = before.match(/^#{1,3} .*$|^<h[1-3][^>]*>.*$/gm) || [];
+        const nearest = headings.length ? headings[headings.length - 1] : '';
+        const historicalSection = /changelog|release notes|version history|история версий|\[?v?\d+\.\d+/i;
+        if (historicalSection.test(nearest)) continue;
+        // and an explicit past-tense marker on the line itself
+        const lineStart = before.lastIndexOf('\n') + 1;
+        const line = text.slice(lineStart, text.indexOf('\n', hit.index));
+        if (/initial published version|первая опубликованная/i.test(line)) continue;
+        const claimed = Number(hit[1] || hit[2] || hit[3] || hit[4]);
+        if (claimed !== n) {
+          wrong.push(path.relative(PKG_DIR, file) + ': "' + hit[0].trim() + '"');
+        }
+      }
+    }
+    assert.deepEqual(wrong, [],
+      'these say a rule count that is not ' + n + ': ' + JSON.stringify(wrong, null, 1));
+
+    // An EIGHTH site the survey missed    // An EIGHTH site the survey missed, found by the suite going red: the e2e --help assertion,
+    // which is not a file constant but a re-typed expectation. cli.js:57 already derives its number
+    // from COMPONENTS, so a test that hardcodes one is a second source of truth — exactly the defect
+    // its own comment says it exists to catch ("cli.js used to say 1 rule while EXPECTED_RULES had 2
+    // entries"). It is now derived, and this asserts it stays derived.
+    const e2e = read(path.join('tests', 'e2e', 'lifecycle.test.js'));
+    const helpAt = e2e.indexOf("describe('e2e: --help shows correct component counts'");
+    assert.ok(helpAt > 0, 'the --help count test must exist');
+    const helpBlock = e2e.slice(helpAt, e2e.indexOf('});', e2e.indexOf('} finally', helpAt)));
+    assert.match(helpBlock, /Object\.keys\(COMPONENTS\[group\]\.items\)\.length/,
+      'the --help count test must DERIVE from COMPONENTS, not re-type the numbers');
+    assert.ok(!/\/\d+\\s\+rules\//.test(helpBlock),
+      'and must not carry a hardcoded rule count');
+  });
+
+  test('P7 — the HOOK surface stays Node-only', () => {
+    // ADR-001 D2, NARROWED by measurement during Step 7. The first version asserted that NO .sh
+    // ships anywhere in templates/, and that is FALSE: skills/brutal-honesty-review/scripts/
+    // assess-tests.sh and assess-code.sh already ship. The cross-platform promise in settings.json
+    // ("Cross-platform Node scripts (no bash dependencies)") is scoped to the HOOKS — all six are
+    // .cjs so Windows works — and a port check is hook-shaped, so that is the surface to guard.
+    // Asserting the broader claim would have been a test enforcing something untrue.
+    const hooks = path.join(PKG_DIR, 'templates', '.claude', 'hooks');
+    const files = fs.readdirSync(hooks);
+    assert.deepEqual(files.filter((f) => f.endsWith('.sh')), [],
+      'a .sh among the hooks contradicts the cross-platform promise in settings.json');
+    assert.ok(files.filter((f) => f.endsWith('.cjs')).length >= 6,
+      'and the six shipped hooks must still be .cjs: ' + JSON.stringify(files));
+  });
+});