@dzhechkov/p-replicator 1.5.18 → 1.9.0

package/tests/unit/detect-parse-anchor.test.js

@@ -0,0 +1,109 @@
+'use strict';
+
+// The project-type scanner probed seven paths from one parameter, and the paths disagreed about what
+// that parameter was. MEASURED before the fix:
+//
+//   {docs_path}/docs/ddd/ · /.ai-context/ · /docs/tests/*.feature · /docs/adr/*.md · /docs/ADR.md
+//        → all five imply docs_path is the PROJECT ROOT
+//   {docs_path}/Architecture.md · {docs_path}/Solution_Strategy.md
+//        → these two imply docs_path is `docs/`
+//
+// And the pipeline writes those two files to docs/ (commands/replicate.md:234,237). So the SPARC
+// probes looked exactly where the pipeline does not write: the scanner could not recognise its own
+// output as SPARC-shaped.
+//
+// The parameter description was the root of it — one sentence naming two directories: "In Claude
+// Code / replicate context this is `docs/` (project root)." A reader implementing a probe picked
+// whichever half they read last. Nobody passes the parameter explicitly (a sweep of SKILL.md and
+// commands/replicate.md for `docs_path` returns nothing), so that sentence IS the specification.
+//
+// Both the field report and the reviewing swarm got this wrong in opposite directions: the report
+// said all six probes were wrong, the swarm said the table was wrong and the probes right. Five
+// probes are right, two are wrong, and the table contradicts itself.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const MODULE = path.join(__dirname, '..', '..', 'templates', '.claude', 'skills',
+  'cc-toolkit-generator-enhanced', 'modules', '01-detect-parse.md');
+const read = () => fs.readFileSync(MODULE, 'utf-8');
+
+/** Every path this module probes, as written. */
+function probes() {
+  const src = read();
+  return [...src.matchAll(/\{docs_path\}\/([^"')\s]+)/g)].map((m) => m[1]);
+}
+
+describe('every probe resolves from ONE anchor, and the anchor is named once', () => {
+  test('P1 — no probe implies an anchor other than the project root', () => {
+    // The property is AGREEMENT across all of them, not the correctness of any single path. A
+    // top-level SPARC artifact would mean docs_path is `docs/` for that probe and the root for the
+    // others — which is the state this feature removes.
+    // DERIVED, not typed. Cross-family QE: the first version hard-coded seven basenames, so a probe
+    // for Research_Findings.md — a real pipeline document I had not listed — would have escaped it.
+    // The authoritative list is the pipeline's own: replicate.md writes every SPARC document to docs/.
+    const replicate = fs.readFileSync(path.join(__dirname, '..', '..', 'templates', '.claude',
+      'commands', 'replicate.md'), 'utf-8');
+    const written = new Set([...replicate.matchAll(/^- `docs\/([A-Z][A-Za-z_]*\.md)`/gm)].map((m) => m[1]));
+    assert.ok(written.size >= 9,
+      'the pipeline document list must be readable from replicate.md: ' + [...written]);
+
+    const disagreeing = probes().filter((p) => written.has(p));
+    assert.deepEqual(disagreeing, [],
+      'these probe a document the pipeline writes to docs/, as if it were at the project root — '
+      + 'which only makes sense if docs_path is `docs/`, while every other probe treats it as the '
+      + 'root: ' + JSON.stringify(disagreeing));
+
+    // And the prose must not re-introduce the ambiguity the probes just lost. Five sites carried it.
+    const src = read();
+    assert.ok(!/top-level or docs\//.test(src),
+      'the scan catalog still preserves the "top-level or docs/" reading this feature removes');
+    for (const doc of ['Architecture.md', 'Solution_Strategy.md', 'PRD.md', 'Specification.md']) {
+      const bare = new RegExp('(?<![/\\w])`' + doc.replace('.', '\\.') + '`');
+      assert.ok(!bare.test(src),
+        'a pipeline document is named without its docs/ prefix, which reads as project-root: ' + doc);
+    }
+  });
+
+  test('P2 — the two SPARC probes look under docs/, where the pipeline writes', () => {
+    const src = read();
+    assert.match(src, /has_sparc_arch = exists\(f"\{docs_path\}\/docs\/Architecture\.md"\)/,
+      'commands/replicate.md:237 writes docs/Architecture.md');
+    assert.match(src, /has_sparc_sol\s+= exists\(f"\{docs_path\}\/docs\/Solution_Strategy\.md"\)/,
+      'commands/replicate.md:234 writes docs/Solution_Strategy.md');
+  });
+
+  test('P3 — the root-level probe stays at the root', () => {
+    // .ai-context/ sits beside .claude/, not under docs/. Moving it "for consistency" would break a
+    // probe that was correct all along — the failure mode the field report actually proposed.
+    assert.ok(probes().includes('.ai-context/'),
+      'the .ai-context probe must remain anchored at the project root: ' + JSON.stringify(probes()));
+    assert.ok(!probes().includes('docs/.ai-context/'),
+      '.ai-context/ is a root-level directory; probing it under docs/ finds nothing');
+  });
+
+  test('P4 — the parameter names ONE directory', () => {
+    const src = read();
+    const row = src.split('\n').find((l) => l.startsWith('| `docs_path` |'));
+    assert.ok(row, 'the parameter table row must exist');
+    assert.ok(!/this is `docs\/` \(project root\)/.test(row),
+      'the row still names two different directories in one breath — that sentence is what split '
+      + 'the probes in the first place: ' + row);
+    assert.match(row, /the PROJECT ROOT/,
+      'it must name the anchor unambiguously');
+    assert.match(row, /not `docs\/`/,
+      'and rule out the other reading explicitly, since that reading is what produced the split');
+  });
+
+  test('P5 — both ADR shapes are still collected', () => {
+    // This logic shipped in an earlier feature (one decision per file, and /replicate's single
+    // docs/ADR.md). Re-anchoring must not disturb it.
+    const src = read();
+    assert.match(src, /glob\(f"\{docs_path\}\/docs\/adr\/\*\.md"\)/, 'shape A: a directory of files');
+    assert.match(src, /f"\{docs_path\}\/docs\/ADR\.md"/, 'shape B: /replicate\'s single file');
+    assert.match(src, /has_adr = len\(collect_adrs\(docs_path\)\) > 0/,
+      'and the one definition that unifies them');
+  });
+});

package/tests/unit/external-dependency-check.test.js

@@ -0,0 +1,209 @@
+'use strict';
+
+// Every validation lens compared documents to documents. MEASURED — replicate.md's Phase-2 table
+// listed five: stories→PRD, AC→stories, Architecture.md, Pseudocode.md, cross-document coherence.
+// Nothing anywhere asked whether the outside world agrees, so a requirement could rest on a
+// capability the provider does not have and reach code generation unchallenged. It is the only
+// contact-with-reality defect in this pipeline; everything else it checks, it can check by reading
+// its own output.
+//
+// TWO honesty constraints bind this suite, both from the field report:
+//   1. check-pipeline-gaps.sh, which the report cites, DOES NOT EXIST. P7 keeps it uncited.
+//   2. No external fact may be baked in. What an API can do DRIFTS: a fixture asserting one would
+//      fail when the world changes and pass when our own rule breaks. P6 asserts the ABSENCE of
+//      vendor names, and no assertion here mentions a capability of any real service.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+const read = (rel) => fs.readFileSync(path.join(TPL, rel), 'utf-8');
+
+const SPARC = 'skills/sparc-prd-mini/SKILL.md';
+const REPLICATE = 'commands/replicate.md';
+
+/** The External Dependencies section of the Phase-5 Architecture.md template. Scoped, because an
+ *  assertion over a whole file passes on any prose that happens to mention the words. */
+function inventory() {
+  const src = read(SPARC);
+  const start = src.indexOf('## External Dependencies\n');
+  assert.ok(start > 0, 'the Phase-5 template must carry an External Dependencies section');
+  const end = src.indexOf('## Data Architecture', start);
+  assert.ok(end > start, 'and it must sit before Data Architecture, where the stack is still in view');
+  return src.slice(start, end);
+}
+
+/** Phase 2 of replicate.md — a lens declared in a later phase validates nothing. */
+function phase2() {
+  const src = read(REPLICATE);
+  const start = src.indexOf('### Phase 2: VALIDATION');
+  const end = src.indexOf('### Phase 3', start);
+  assert.ok(start > 0 && end > start, 'replicate.md must have a Phase 2 before Phase 3');
+  return src.slice(start, end);
+}
+
+describe('the pipeline asks whether the outside world can do what a requirement needs (PR-010)', () => {
+  test('P1 — the inventory exists and carries all five columns', () => {
+    const block = inventory();
+    // The HEADER ROW, not five words scattered through prose. Cross-family QE: a paragraph
+    // containing all five labels would have replaced the table without failing.
+    const header = block.split('\n').find((l) => l.startsWith('| Capability needed |')) || '';
+    assert.notEqual(header, '', 'the inventory must have a table header row starting with the '
+      + 'capability column');
+    for (const col of ['Capability needed', 'Provider / API', 'Evidence', 'Verdict',
+      'Requirements relying on it']) {
+      assert.ok(header.includes(col), 'the header row must carry the column: ' + col);
+    }
+    // One row per CAPABILITY, not per vendor: a provider can do one of two things you need.
+    assert.match(block, /One row per capability, not one row\s+per vendor/,
+      'the granularity must be stated, or one row hides two questions');
+  });
+
+  test('P2 — the evidence rule is CLOSED on both sides', () => {
+    // Saying what evidence IS leaves every reader to decide what it is not. The three ways this
+    // check gets faked are named, so a row using one of them is visibly not evidence.
+    const block = inventory();
+    assert.match(block, /link to the PROVIDER'S OWN documentation/,
+      'what counts must be stated precisely — not "a source"');
+    assert.match(block, /plus the date it was checked/,
+      'a citation without a date cannot be re-checked later');
+    // Cross-family QE, the load-bearing finding: CONFIRMED was self-attested, and a plausible URL is
+    // the cheapest forgery there is. A verbatim quote is what a link alone cannot fake.
+    assert.match(block, /verbatim QUOTE from\s+that page stating the capability/,
+      'a non-fabricable artifact must be required, not just a link');
+    assert.match(block, /a URL nobody opened/,
+      'and the link-alone forgery must be named as not-evidence');
+    assert.match(block, /do NOT count/, 'and the rule must be closed on the other side too');
+    for (const fake of ['landing page', 'pricing page', 'recollection']) {
+      assert.ok(block.includes(fake), 'the not-evidence list must name: ' + fake);
+    }
+  });
+
+  test('P3 — exactly three verdicts, and the empty case is explicit', () => {
+    const block = inventory();
+    // Each verdict must be a ROW of the verdict table, not a word somewhere in the prose. Found by
+    // mutation: renaming the UNCONFIRMED row to UNKNOWN left the vocabulary broken and the first
+    // version of this assertion green, because the word still appeared in the paragraph below it.
+    for (const v of ['CONFIRMED', 'UNCONFIRMED', 'CONTRADICTED']) {
+      assert.match(block, new RegExp('^\\| ' + v + ' \\|', 'm'),
+        'the verdict must be a row of the verdict table, not merely mentioned: ' + v);
+    }
+    // Two values would collapse "we checked and it cannot" into "nobody checked", which overstates
+    // one and hides the other. The reason has to be written down or the third value looks redundant.
+    assert.match(block, /exactly three, because two would hide a difference that\s+matters/,
+      'the reason for three values must be recorded, or a later edit will merge two of them');
+    // EXACTLY three: the first version asserted the three exist and let a fourth in silently.
+    const verdictRows = block.split('\n')
+      .filter((l) => /^\| [A-Z_]+ \|/.test(l) && !l.startsWith('| Verdict |'));
+    assert.equal(verdictRows.length, 3,
+      'the verdict table must have exactly three rows, not merely contain the three: '
+      + JSON.stringify(verdictRows));
+    assert.match(block, /No external dependencies —\s+this product calls no third-party service/,
+      'a project with none must say so: an empty section and an absent one look identical');
+  });
+
+  test('P4 — Phase 2 declares the sixth lens, inside Phase 2', () => {
+    const block = phase2();
+    const lensRow = block.split('\n').find((l) => l.startsWith('| `validator-dependencies` |')) || '';
+    assert.notEqual(lensRow, '',
+      'the lens must be a ROW of the validator table, not a mention in prose');
+    assert.match(lensRow, /External Dependencies/,
+      'and its scope column must name the section it reads: ' + lensRow);
+    assert.match(lensRow, /evidence that names that capability/,
+      'and its criteria column must say what it checks for: ' + lensRow);
+    assert.match(block, /the only one that looks OUTSIDE the\s+documents/,
+      'and say what makes it different from the other five, or it reads as a sixth of the same kind');
+  });
+
+  test('P5 — the exit criteria carry BOTH consequences, and UNCONFIRMED does not pass silently', () => {
+    // Anchored to the exit-criteria ROW each term belongs to. Cross-family QE: three independent
+    // phrase matches anywhere in Phase 2 would pass on explanatory prose that changed no verdict.
+    const rows = {};
+    for (const l of phase2().split('\n')) {
+      const m = l.match(/^\| (🟢 READY|🟡 CAVEATS|🔴 NEEDS WORK) \|/);
+      if (m) rows[m[1]] = l;
+    }
+    assert.ok(rows['🟢 READY'] && rows['🟡 CAVEATS'] && rows['🔴 NEEDS WORK'],
+      'the exit-criteria table must carry all three verdict rows');
+    assert.match(rows['🔴 NEEDS WORK'], /any external dependency is `CONTRADICTED`/,
+      'a contradicted dependency must send the run back, in the row that sends it back');
+    assert.match(rows['🟡 CAVEATS'], /every `UNCONFIRMED` dependency NAMED row by row/,
+      'an unconfirmed dependency must be NAMED in the CAVEATS row — an unnamed caveat is one '
+      + 'nobody acts on');
+    assert.match(rows['🟢 READY'], /no external dependency `UNCONFIRMED` or `CONTRADICTED`/,
+      'and READY must exclude both, or the strongest verdict is the one that checks least');
+    // And the consequence must be scoped to the REQUIREMENT: without that, an inventory of nothing
+    // but UNCONFIRMED rows reaches Phase 3 with a caveat and feasibility is never established.
+    assert.match(inventory(), /cannot enter Phase 3 — defer, remove or replace them/,
+      'UNCONFIRMED must stop the requirements that rest on it, or the check is optional in practice');
+  });
+
+  test('P6 — NO vendor fact is baked in: external facts drift', () => {
+    // A fixture asserting what some API can do would fail when the world changes and pass when our
+    // own rule breaks. The template must teach the SHAPE and name nobody.
+    const block = inventory();
+    const vendors = ['Anthropic', 'OpenAI', 'Stripe', 'Twilio', 'SendGrid', 'AWS', 'Google Cloud',
+      'Azure', 'Firebase', 'Supabase'];
+    for (const v of vendors) {
+      assert.ok(!block.includes(v),
+        'the template must name no real provider — capabilities drift and a stale fact recorded as '
+        + 'evidence is worse than none. Found: ' + v);
+    }
+    // A denylist can only ever catch the names on it. The positive assertion is what actually holds:
+    // the example row's own cells must be bracketed placeholders, so there is no cell for a real
+    // vendor to sit in. The list above stays as a cheap second net.
+    const exampleRow = block.split('\n')
+      .find((l) => l.startsWith('| [') && l.includes('CONFIRMED')) || '';
+    assert.notEqual(exampleRow, '', 'the template must show one example row');
+    const cells = exampleRow.split('|').map((c) => c.trim()).filter(Boolean);
+    for (const cell of cells) {
+      assert.ok(/^\[|^CONFIRMED$/.test(cell) || cell.startsWith('['),
+        'every example cell must be a bracketed placeholder or the verdict itself, so no real '
+        + 'provider can sit in the row: ' + cell);
+    }
+    assert.match(block, /are PLACEHOLDERS/, 'and it must say the example names are placeholders');
+    assert.match(block, /a stale fact recorded as evidence is worse than\s+none/,
+      'with the reason, so a later editor does not helpfully fill in a real one');
+  });
+
+  test('P8 — the agent that DISPATCHES the swarm lists the same lenses as the command', () => {
+    // Found by an independent reviewer after the fact: commands/replicate.md gained the sixth lens
+    // and templates/.claude/agents/doc-validator.md did not. Two files describing one swarm, one of
+    // them a lens short — and the sha256 snapshot test cannot see it, because both files hash fine.
+    const cmd = read(REPLICATE);
+    const agent = fs.readFileSync(path.join(TPL, 'agents', 'doc-validator.md'), 'utf-8');
+    const names = (src) => new Set([...src.matchAll(/\| `(validator-[a-z-]+)`/g)].map((m) => m[1]));
+    const inCmd = names(cmd);
+    const inAgent = names(agent);
+    assert.ok(inCmd.size >= 6, 'the command must dispatch at least six lenses: ' + [...inCmd]);
+    assert.deepEqual([...inAgent].sort(), [...inCmd].sort(),
+      'the dispatching agent and the command disagree about the swarm: '
+      + JSON.stringify({ agent: [...inAgent], command: [...inCmd] }));
+    // And the count in the agent's own prose must match the table it introduces.
+    const stated = agent.match(/Launch (\d+) parallel validation agents/);
+    assert.ok(stated, 'doc-validator.md must state how many it launches');
+    assert.equal(Number(stated[1]), inAgent.size,
+      'doc-validator.md says ' + stated[1] + ' but tables ' + inAgent.size);
+  });
+
+  test('P7 — nothing cites check-pipeline-gaps.sh, which does not exist', () => {
+    // The report cites it. MEASURED — a repo-wide find returns nothing. Pointing a reader at a
+    // script that is not there is a worse failure than the gap it was cited to close.
+    for (const f of [SPARC, REPLICATE]) {
+      assert.ok(!read(f).includes('check-pipeline-gaps'),
+        f + ' references a script that does not exist in this repository');
+    }
+    // The premise, asserted rather than assumed: if someone ever ADDS the script, this goes red and
+    // whoever added it has to revisit the rule instead of leaving a stale prohibition behind.
+    const pkgRoot = path.join(__dirname, '..', '..');
+    const candidates = ['check-pipeline-gaps.sh', path.join('scripts', 'check-pipeline-gaps.sh'),
+      path.join('bin', 'check-pipeline-gaps.sh')];
+    for (const c of candidates) {
+      assert.ok(!fs.existsSync(path.join(pkgRoot, c)),
+        'the script now exists at ' + c + ' — this rule was written on the premise that it does '
+        + 'not, so revisit it rather than deleting this assertion');
+    }
+  });
+});

package/tests/unit/growth-axes-and-compliance.test.js

@@ -0,0 +1,169 @@
+'use strict';
+
+// Two prose defects in 05-growth-engine.md, shipped as one change because the file has four
+// byte-identical copies and splitting them means two three-package releases.
+//
+// P4: the growth-type list forced ONE choice across TWO different questions — how a company reaches
+// buyers, and what makes usage produce more usage. A sales-led company running a referral loop was
+// literally unsayable. Three loop mechanics were also absent.
+//
+// P2: the Research Protocol's three modes mentioned no constraint of any kind, so the module could
+// design a violation with full confidence — confidence here comes from data quality, not legality.
+//
+// The load-bearing rule in P2's fix, and the evidence for it is the source report's own failure: it
+// warned that a 2024 penalty figure was stale and then quoted the 2025 figure as current, in August
+// 2026. Warning and error, one document, one year apart. So: cite the norm, never the amount — and
+// P5 exists to make a future edit that re-adds a figure go red.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const MODULE = path.join(__dirname, '..', '..', 'templates', '.claude', 'skills',
+  'reverse-engineering-unicorn', 'modules', '05-growth-engine.md');
+
+const read = () => fs.readFileSync(MODULE, 'utf-8');
+
+/** A named section, from its heading to the next heading at the same level. */
+function section(heading, level) {
+  const src = read();
+  const start = src.indexOf(heading);
+  assert.ok(start > 0, 'the module must carry: ' + heading);
+  const end = src.indexOf('\n' + '#'.repeat(level) + ' ', start + 1);
+  assert.ok(end > start, heading + ' must be followed by another section');
+  return src.slice(start, end);
+}
+
+const compliance = () => section('### ⚖️ Чеклист допустимости', 3);
+
+describe('growth type is two questions, and the protocol knows constraints exist', () => {
+  test('P1 - the two axes are separate and independently chosen', () => {
+    const src = read();
+    assert.match(src, /\*\*Ось 1 — МОТИОН/, 'the go-to-market axis must be its own list');
+    assert.match(src, /\*\*Ось 2 — ПЕТЛЯ/, 'and the loop axis its own');
+    assert.match(src, /Оси НЕЗАВИСИМЫ/, 'independence must be stated, not left to be inferred');
+    assert.match(src, /Sales-Led` \+ `Поощряемая реферальная/,
+      'and shown with the combination the old single list made unsayable');
+
+    // The defect was ONE instruction spanning both questions. Its removal is the property.
+    assert.ok(!/\*\*Выбранный тип:\*\* \[ONE из:\]/.test(src),
+      'the single cross-axis selector must be gone, or the fix is cosmetic');
+  });
+
+  test('P2 - the three missing loop mechanics are present', () => {
+    const src = read();
+    for (const m of ['Значковая / встраиваемая', 'Поощряемая реферальная', 'Сетевой эффект']) {
+      assert.ok(src.includes(m), 'the loop axis must offer: ' + m);
+    }
+    // "no loop" must be sayable, or every project claims one it does not have.
+    assert.match(src, /Нет петли/, 'absence of a loop must be a choice');
+    assert.match(src, /полноценный ответ, а не пропуск/,
+      'and must be marked as an answer, not a blank');
+  });
+
+  test('P3 - the artifact does not claim the module was blind to virality', () => {
+    // The backlog item's own correction: the K-factor is already tracked and referrals already
+    // appear in the TRIZ table. A false problem statement outlives the fix that follows it.
+    const src = read();
+    assert.ok(/K-фактор|K-factor/.test(src), 'the pre-existing K-factor site must survive the edit');
+    assert.ok(/[Рр]еферал|referral/i.test(src), 'and the pre-existing referral mentions');
+    for (const claim of ['не знает про виральность', 'слеп к виральности', 'ignores virality']) {
+      assert.ok(!src.includes(claim), 'the module must not be accused of what it already did: ' + claim);
+    }
+  });
+
+  test('P4 - the compliance checklist covers all three research modes', () => {
+    const src = read();
+    const c = src.indexOf('### ⚖️ Чеклист допустимости');
+    const quick = src.indexOf('### 🟢 Режим QUICK');
+    assert.ok(c > 0 && quick > c,
+      'the checklist must precede the modes, or it reads as an afterthought to QUICK alone');
+    assert.match(compliance(), /все три режима/,
+      'and must say it applies to all three, not only the one it sits above');
+  });
+
+  // The two detectors P5 runs. Declared at module scope so P8 can drive them over counter-examples:
+  // a detector asserted only against text that happens to be clean proves nothing about its reach.
+  //
+  // Cross-family review found both too narrow. The statute pattern REQUIRED a leading number, so the
+  // ordinary form `Article 6 GDPR` slipped through; the money pattern required a currency marker, so
+  // a bare threshold such as `30 дней` did too — and the rule forbids thresholds, not only prices.
+  const MONEY = /(?:[0-9][0-9\s,.]*\s*(?:долл|USD|\$|€|руб|₽|%|дн(?:я|ей)|мес|год|лет|час|тыс|млн))|(?:(?:не более|не менее|до|свыше|от)\s+[0-9])/gi;
+  const L = '(?<![\\p{L}\\p{N}])';   // a real left boundary, Cyrillic included
+  const STATUTE = new RegExp(
+    '(?:' + L + '\\d+\\s*(?:CFR|U\\.?S\\.?C|USC|ФЗ))'
+    + '|(?:' + L + '(?:Article|Art\\.|Статья|ст\\.)\\s*\\d+)'
+    + '|(?:' + L + '(?:GDPR|CCPA))'
+    + '|(?:' + L + 'ФЗ[- ]?\\d+)'
+    + '|(?:' + L + '\\d+-ФЗ)', 'giu');
+
+  test('P5 - no monetary figure and no statute is asserted', () => {
+    // THE rule. A number in a template is wrong within a year; a statute is jurisdiction-specific and
+    // unverified in this repository. Written so a future edit re-adding either goes red.
+    const c = compliance();
+    MONEY.lastIndex = 0; STATUTE.lastIndex = 0;
+    const money = c.match(MONEY) || [];
+    assert.deepEqual(money, [],
+      'a monetary figure or threshold appeared in the checklist: ' + JSON.stringify(money));
+    const statutes = c.match(STATUTE) || [];
+    assert.deepEqual(statutes, [],
+      'a statute is asserted as authoritative, and none was verified here: ' + JSON.stringify(statutes));
+    assert.match(c, /Ссылайтесь на \*\*норму и на то, где её смотреть\*\*, никогда — на сумму/,
+      'the rule itself must be written down, or the absence above is an accident');
+    assert.match(c, /Здесь намеренно нет ни одной\s*\n?цифры/,
+      'and the absence must be declared deliberate, so a later editor does not "helpfully" add one');
+  });
+
+  test('P6 - it is questions, and it says it is not a gate', () => {
+    const c = compliance();
+    assert.match(c, /это вопросы, а не утверждения о праве/,
+      'a template installed into arbitrary projects cannot assert any project law');
+    assert.match(c, /Это не юридическая проверка и не застава/,
+      'and it must refuse to be read as a gate — it has no verifiable input');
+    assert.match(c, /у неё нет проверяемого входа/, 'with the reason stated');
+    assert.match(c, /Ответ «нет» — это находка, а не формальность/,
+      'an unanswered question and a cleared one must not look alike');
+    assert.ok((c.match(/^\| \d+ \|/gm) || []).length >= 5,
+      'the checklist needs enough questions to be worth running');
+  });
+
+  test('P8 - the detectors CATCH the forms a future edit would actually add', () => {
+    // A detector run only against clean text is vacuous evidence: it cannot be distinguished from a
+    // detector that matches nothing at all. These are the exact strings that slipped through the
+    // first version, plus the ones it did catch, so the fix is proven to have widened reach without
+    // losing it.
+    const mustCatch = [
+      ['штраф 53088 долларов', MONEY, 'the stale figure this whole rule exists because of'],
+      ['30 дней', MONEY, 'a bare time threshold — the rule forbids thresholds, not only prices'],
+      ['не более 3 месяцев', MONEY, 'a threshold written in words plus a number'],
+      ['до 20% оборота', MONEY, 'a percentage cap'],
+      ['Article 6 GDPR', STATUTE, 'the ordinary citation form, which needed no leading number'],
+      ['16 CFR Part 465', STATUTE, 'the US form'],
+      ['ст. 15 ФЗ-152', STATUTE, 'the Russian form'],
+      ['152-ФЗ', STATUTE, 'and its other spelling'],
+    ];
+    for (const [text, re, why] of mustCatch) {
+      re.lastIndex = 0;
+      assert.ok(re.test(text), 'detector missed (' + why + '): ' + JSON.stringify(text));
+    }
+
+    // And it must not fire on ordinary prose, or the guard becomes noise someone disables.
+    const mustNotCatch = ['вопрос 1', 'семь вопросов', 'Ось 2 — ПЕТЛЯ', 'K-фактор'];
+    for (const text of mustNotCatch) {
+      MONEY.lastIndex = 0; STATUTE.lastIndex = 0;
+      assert.ok(!MONEY.test(text) && !STATUTE.test(text),
+        'detector false-fires on ordinary text: ' + JSON.stringify(text));
+    }
+  });
+
+  test('P7 - the staleness lesson is recorded where the next editor will read it', () => {
+    // The reason for the norm-not-amount rule is a real, dated failure. Keeping the reason next to
+    // the rule is what stops the rule from being softened by someone who does not know why it exists.
+    const c = compliance();
+    assert.match(c, /предупреждал, что цифра позапрошлого\s*\n?года устарела/,
+      'the source failure must be recorded');
+    assert.match(c, /Предупреждение и ошибка в одном\s*\n?документе/,
+      'including what made it instructive');
+  });
+});

package/tests/unit/growth-gate-conditional.test.js

@@ -0,0 +1,122 @@
+'use strict';
+
+// The Growth Traceability criterion is CONDITIONAL, and that is where the danger is.
+//
+// An unconditional growth threshold sends a project with no acquisition objective (internal tool,
+// on-prem) into a permanent NEEDS WORK loop — the exact trap already closed once for the Measurable
+// criterion. But the cure has its own failure mode, and it is the quieter one: a condition that can
+// never be true makes a gate that never fires, and a gate that never fires reads exactly like a gate
+// that always passes.
+//
+// Recalled lesson (dz recall, 0.85): "a verification probe that CAN run in a mode where it checks
+// nothing is vacuous evidence". So both directions are asserted here — the -10 path must be
+// REACHABLE, and the +0 path must exist for the projects the condition exempts.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+const VALIDATOR = path.join(TPL, 'skills', 'requirements-validator', 'SKILL.md');
+
+const read = () => fs.readFileSync(VALIDATOR, 'utf-8');
+
+/** The criterion, from its heading to the next one. */
+function criterion() {
+  const src = read();
+  const start = src.indexOf('### Growth Traceability');
+  assert.ok(start > 0, 'requirements-validator must carry the Growth Traceability criterion');
+  const end = src.indexOf('\n### ', start + 1);
+  assert.ok(end > start, 'the criterion must be followed by another section');
+  return src.slice(start, end);
+}
+
+describe('the growth gate has teeth AND an exemption, and neither swallows the other', () => {
+  test('P1 - the penalty path is reachable and the exempt path is not', () => {
+    const c = criterion();
+    // REACHABLE: a project with a filled seed table and no trace scores the penalty.
+    assert.match(c, /-10 not traced|-10 if the seed table carries rows/,
+      'the -10 path must exist for a project the criterion applies to');
+    assert.match(c, /≥1 `FR-GROWTH-nnn` row \| YES/,
+      'and the applicable row of the table must say YES, or nothing ever reaches -10');
+    // EXEMPT: three named situations score +0, and each is a row of the same table.
+    for (const exempt of ['says `нет` / is empty', 'internal tool, on-prem', 'is ABSENT']) {
+      assert.ok(c.includes(exempt), 'the exemption table must name: ' + exempt);
+    }
+    // The two must be distinguishable by a reader: an applicability table with only YES rows or
+    // only no rows is one of the two failure modes above wearing the other's clothes.
+    const yes = (c.match(/\| YES \|/g) || []).length;
+    const no = (c.match(/\| no \|/g) || []).length;
+    assert.ok(yes >= 1 && no >= 3,
+      'both verdicts must be reachable in the table: YES=' + yes + ' no=' + no);
+  });
+
+  test('P2 - an absent brief is +0, never -10, with the reason stated', () => {
+    const c = criterion();
+    assert.match(c, /An absent brief is \+0, never -10/,
+      'the --from-docs entry skips Phase 0 — penalising it would loop those projects forever');
+    assert.match(c, /Phase 0 did not run.*is not.*the growth requirements are missing/is,
+      'and the two must be distinguished in words, not only in a table cell');
+  });
+
+  test('P3 - the condition is APPLICABILITY, not project type', () => {
+    // Gating on type was tried upstream and refuted: replicate.md:171 records that gating M5 on
+    // PRODUCT TYPE disabled the one branch M5 declares, and every B2B project got an empty slot.
+    // Repeating that mistake one phase later would re-open it.
+    const c = criterion();
+    assert.match(c, /acquisition or adoption is in scope/,
+      'the condition must be the same fact replicate.md gates M5 on');
+    assert.match(c, /incl\. B2B/, 'including B2B explicitly, or the refuted type-gate returns');
+    assert.match(c, /it is not about project type/i,
+      'and the artifact must refuse the type reading out loud');
+  });
+
+  test('P4 - the scoring stays OUTSIDE the 100-point table', () => {
+    // validation-gate-teeth.test.js pins 72/100 in its own title, derived from the current weight
+    // table. A new weight changes that arithmetic and reddens the test whose job is holding the
+    // gate's teeth. The Security criterion already solved this; this one copies the mechanism.
+    const c = criterion();
+    assert.match(c, /scores OUTSIDE the 100-point/i, 'the criterion must say where it scores');
+    assert.match(c, /adds no\s*\n?weight to any existing criterion/i,
+      'and that it adds no weight');
+    // Structural proof, not a promise: the INVEST/SMART weight headings must be untouched.
+    const src = read();
+    assert.match(src, /### INVEST Criteria \(User Stories\) — 50% weight/,
+      'the INVEST weight must still be 50%');
+    assert.match(src, /### SMART Criteria \(Acceptance Criteria\) — 30% weight/,
+      'and SMART still 30% — a growth weight here is what reddens validation-gate-teeth');
+    assert.ok(!/Growth.*—\s*\d+% weight/i.test(src),
+      'no growth criterion may carry a percentage weight');
+  });
+
+  test('P5 - TRACED is defined, and a silent drop is separated from a recorded rejection', () => {
+    const c = criterion();
+    assert.match(c, /case-sensitive, the exact token/,
+      '"mention" must be defined or every reader draws a different line');
+    assert.match(c, /not a title, not a paraphrase/i, 'and what does NOT count must be named');
+    assert.match(c, /A silently dropped row is the defect/,
+      'the defect class must be stated');
+    assert.match(c, /A row rejected on the record is not/,
+      'and a conscious rejection must be permitted, or the gate forbids saying no');
+  });
+
+  test('P6 - the criterion states its own limit and does not claim legality', () => {
+    const c = criterion();
+    assert.match(c, /proves an obligation was CARRIED FORWARD, not that it was built/,
+      'a traceability gate looks like proof of implementation and must refuse the reading');
+    assert.match(c, /Legality is not assessed anywhere in this pipeline/,
+      'and legality must be disclaimed here too — it is a separate backlog item');
+  });
+
+  test('P7 - the prose gate points at its deterministic counterpart and does not claim to be one', () => {
+    // AR-2: this section is read by a model — layer 3. Calling it layer 1 would be exactly the
+    // documented-but-false safety story this project has been burned by.
+    const c = criterion();
+    assert.match(c, /check-growth-trace\.cjs/, 'the deterministic checker must be named');
+    assert.match(c, /This\s*\n?section is a prose gate read by a model/i,
+      'and the prose gate must say what it is');
+    assert.match(c, /the utility is the deterministic one/,
+      'and which of the two is deterministic');
+  });
+});