@dzhechkov/p-replicator 1.5.18 → 1.9.0

package/tests/unit/skill-paths-prebaked.test.js

@@ -0,0 +1,174 @@
+'use strict';
+
+// The ten shipped skills referenced each other by claude.ai paths (`/mnt/skills/user/<name>/`) and
+// worked only because two rules files tell the model to rewrite them at read time. That is layer 4
+// on the cost-of-detection ladder: probabilistic, and silent when it lapses. MEASURED before this
+// change: 83 occurrences across 19 files.
+//
+// A blind transform would have been worse than the defect, in two separate ways:
+//
+//   1. Seven of those occurrences are the GENERATOR'S OWN instructions to scan its output for
+//      unrewritten paths, and more are the rewrite tables themselves. Rewriting a MENTION destroys
+//      the mechanism that keeps generated skills clean.
+//   2. Two referenced skills — frontend-design, idea2prd-manual — are NOT shipped here. Rewriting
+//      them yields `.claude/skills/frontend-design/`: a path that looks local, looks valid, and
+//      resolves to nothing. Worse than a foreign path, which at least announces itself.
+//
+// So the guard is an ALLOWLIST OF EXACT LOCATIONS, not a count. A count is defeated by adding one
+// violation and deleting one mention; naming the survivors is not — and P4 asserts the second
+// direction, because losing the generator's self-check is the failure this exists to prevent.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+const SKILLS = path.join(TPL, 'skills');
+
+/**
+ * Files permitted to mention `/mnt/`, keyed by a fingerprint of THE MENTION LINES THEMSELVES.
+ *
+ * A per-file COUNT was the first version and cross-family review broke it in one move: in
+ * `03-generate-p0.md`, replace one rewrite-table row with an unrelated unrewritten path and the total
+ * stays 11, so the guard stays green over exactly the add/delete mutation the ADR says must fail.
+ * The fingerprint is over the sorted mention lines, so swapping one for another changes it.
+ */
+const ALLOWED = {
+  'pipeline-forge/SKILL.md': 'b2773e5b80c19885',
+  'pipeline-forge/references/patterns-catalog.md': '9025717e78f2ead3',
+  'pipeline-forge/references/self-extracted-patterns.md': '010eb3198d929b13',
+  'cc-toolkit-generator-enhanced/SKILL.md': 'd7c97e6b6cae4831',
+  'cc-toolkit-generator-enhanced/references/templates/feature-lifecycle-ent.md': '7826a204d7214a22',
+  'cc-toolkit-generator-enhanced/references/templates/feature-lifecycle.md': 'c01aaa46eb670a1b',
+  'cc-toolkit-generator-enhanced/modules/01-detect-parse.md': '70a68e025bd84997',
+  'cc-toolkit-generator-enhanced/modules/03-generate-p0.md': '6410a1ea4107ee33',
+  'cc-toolkit-generator-enhanced/modules/04-generate-p1.md': '634066fcf5a485bf',
+  'cc-toolkit-generator-enhanced/modules/06-package-deliver.md': '12d0dd630ba3d992',
+  'cc-toolkit-generator-enhanced/modules/08-skill-composition.md': 'd9b68fbe2cf1dbfc',
+};
+
+/** The fingerprint of one file's mention lines — the identity the allowlist is keyed on. */
+function mentionPrint(rel) {
+  const lines = fs.readFileSync(path.join(SKILLS, rel), 'utf-8').split('\n')
+    .filter((l) => l.includes('/mnt/')).map((l) => l.trim());
+  return crypto.createHash('sha256').update(lines.join('\n')).digest('hex').slice(0, 16);
+}
+
+/** Every file under templates/.claude/skills, as repo-relative-to-SKILLS paths. */
+function walk(dir, base) {
+  const out = [];
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const abs = path.join(dir, e.name);
+    if (e.isDirectory()) out.push(...walk(abs, base));
+    else out.push(path.relative(base, abs).split(path.sep).join('/'));
+  }
+  return out;
+}
+
+const countMnt = (rel) => {
+  const body = fs.readFileSync(path.join(SKILLS, rel), 'utf-8');
+  return (body.match(/\/mnt\//g) || []).length;
+};
+
+describe('shipped skills resolve without a rewrite step', () => {
+  test('P1 - no unrewritten /mnt/ path outside the named allowlist', () => {
+    const offenders = [];
+    for (const rel of walk(SKILLS, SKILLS)) {
+      const n = countMnt(rel);
+      if (n > 0 && !(rel in ALLOWED)) offenders.push(rel + ' (' + n + ')');
+    }
+    assert.deepEqual(offenders, [],
+      'these files carry claude.ai paths and are not on the mention allowlist: '
+      + JSON.stringify(offenders));
+  });
+
+  test('P2 - every rewritten .claude/skills/<name>/ path resolves to something that exists', () => {
+    // NARROWED after the first version failed loudly and was right to: a `.claude/skills/<name>`
+    // target does NOT have to be a skill this package ships. Phase 3 GENERATES several into the
+    // user's project (`project-context`, `coding-standards`, `security-patterns` — named in
+    // replicate-pipeline.md), the rewrite tables carry placeholder names, and two skills are
+    // declared optional externals. What this feature created is the class under test: a path that
+    // REPLACED a /mnt/ reference to a skill shipped here.
+    const shipped = new Set(fs.readdirSync(SKILLS));
+    const GENERATED = new Set(['project-context', 'coding-standards', 'security-patterns',
+      'testing-patterns', 'aggregate-patterns', 'event-handlers', 'feature-navigator']);
+    const OPTIONAL_EXTERNAL = new Set(['frontend-design', 'idea2prd-manual']);
+    const bad = [];
+    for (const rel of walk(SKILLS, SKILLS)) {
+      const body = fs.readFileSync(path.join(SKILLS, rel), 'utf-8');
+      for (const line of body.split('\n')) {
+        // A line that shows BOTH sides of the mapping is describing the transform, not performing it.
+        if (line.includes('/mnt/')) continue;
+        const re = /\.claude\/skills\/([a-z0-9-]+)/g;
+        for (let m = re.exec(line); m !== null; m = re.exec(line)) {
+          const name = m[1];
+          if (shipped.has(name) || GENERATED.has(name) || OPTIONAL_EXTERNAL.has(name)) continue;
+          if (name === 'skills' || line.includes('{{') || line.includes('[name]')) continue;
+          bad.push(rel + ' → .claude/skills/' + name);
+        }
+      }
+    }
+    assert.deepEqual([...new Set(bad)], [],
+      'a path points at a skill that is neither shipped, nor Phase-3 generated, nor a declared '
+      + 'optional external: ' + JSON.stringify([...new Set(bad)]));
+  });
+
+  test('P3 - absent skills are declared optional, not rewritten', () => {
+    // frontend-design is referenced but not shipped. It must NOT have become a local-looking path.
+    const cjm = fs.readFileSync(
+      path.join(SKILLS, 'reverse-engineering-unicorn', 'modules', '025-cjm-prototype.md'), 'utf-8');
+    assert.match(cjm, /`frontend-design` — OPTIONAL, ВНЕШНИЙ/,
+      'an absent dependency must be declared optional');
+    assert.match(cjm, /\*\*Fallback, если его нет:\*\*/,
+      'and carry a fallback — the shipped skill-interface-protocol §6 requires one for every OPTIONAL');
+    assert.match(cjm, /Молча пропускать нельзя/,
+      'and must refuse the silent-skip reading');
+    assert.ok(!/\.claude\/skills\/frontend-design\/SKILL\.md/.test(cjm),
+      'it must not be given a local path at all — that is the dangling-path failure this avoids');
+  });
+
+  test('P4 - each allowlisted mention still exists, by identity not by count', () => {
+    // Both directions, and neither expressible as a total. A NEW unrewritten path changes the
+    // fingerprint; so does a DELETED self-check — and losing the generator's `grep -r /mnt/` would
+    // silently stop it noticing unrewritten paths in the skills it GENERATES.
+    const drift = [];
+    for (const [rel, expected] of Object.entries(ALLOWED)) {
+      const abs = path.join(SKILLS, rel);
+      if (!fs.existsSync(abs)) { drift.push(rel + ' (file gone)'); continue; }
+      const got = mentionPrint(rel);
+      if (got !== expected) drift.push(rel + ' expected ' + expected + ', got ' + got);
+    }
+    assert.deepEqual(drift, [],
+      'a mention changed: a new unrewritten path, a lost self-check, or one swapped for the other '
+      + '— a per-file count could not tell these apart: ' + JSON.stringify(drift));
+  });
+
+  test('P5 - the guard is an allowlist of locations, not a count', () => {
+    // Asserted on the guard itself. A total-count assertion passes after someone adds one violation
+    // and removes one mention, which is exactly the edit this feature makes plausible.
+    const self = fs.readFileSync(__filename, 'utf-8');
+    assert.match(self, /const ALLOWED = \{/, 'the guard must name locations');
+    assert.ok(Object.keys(ALLOWED).length >= 5, 'and enumerate them all');
+    // Keyed by fingerprint, not count — the property cross-family review found missing.
+    assert.match(self, /function mentionPrint/, 'identity, not arithmetic');
+    for (const v of Object.values(ALLOWED)) {
+      assert.match(String(v), /^[0-9a-f]{16}$/, 'every entry must be a fingerprint, not a number');
+    }
+    // A count over the whole tree would be a single number; the allowlist is per-file, and P1 keys
+    // on membership rather than on any total.
+    assert.match(self, /!\(rel in ALLOWED\)/,
+      'P1 must decide by membership, not by comparing a sum');
+  });
+
+  test('P6 - the rewrite rules survive, for skills a user brings from claude.ai', () => {
+    // The fix removes the shipped skills' DEPENDENCE on the table, not the table. A user may still
+    // install a skill written against /mnt/ paths, and then the rule is what makes it work.
+    const proto = fs.readFileSync(path.join(TPL, 'rules', 'skill-interface-protocol.md'), 'utf-8');
+    assert.match(proto, /\/mnt\/skills\/user\/\[name\]\/`? \| `\.claude\/skills\/\[name\]\/`/,
+      'the rewrite table must remain');
+    const pipeline = fs.readFileSync(path.join(TPL, 'rules', 'replicate-pipeline.md'), 'utf-8');
+    assert.match(pipeline, /\/mnt\/skills\/user\//, 'and the pipeline rule must keep its copy');
+  });
+});

package/tests/unit/sparc-reconciliation.test.js

@@ -0,0 +1,117 @@
+'use strict';
+
+// sparc-prd-mini — Phase 5 must reconcile with Phase 4's data model before its checkpoint.
+//
+// The skill runs strictly linearly: Phase 4 PSEUDOCODE authors `## Data Structures` — entity types
+// with concrete field types — and only then does Phase 5 ARCHITECTURE choose the storage and
+// technology those structures have to live in. A sweep from Phase 5 to end-of-file found ZERO
+// re-reads of Pseudocode.md, so nothing ever noticed the two documents disagreeing. One ordering
+// fact explained three separately-reported field symptoms: a boolean where the schema took an enum,
+// an algorithm using a column the schema lacks, and a status with three values on one side and five
+// on the other.
+//
+// The fix is a RECONCILIATION step, deliberately NOT a reorder: SPARC is an acronym — Specification,
+// Pseudocode, Architecture, Refinement, Completion — and the skill is named `sparc-prd-mini`.
+// Swapping P and A would leave the file claiming a methodology it no longer follows. P5 below guards
+// that refused decision, so a later edit cannot quietly take it.
+//
+// These are PROMPT modules executed by a model, so the strongest deterministic layer available is
+// the file's own content. Each assertion is DISCRIMINATING: removing what it names turns it red.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const SKILL = path.join(
+  __dirname, '..', '..', 'templates', '.claude', 'skills', 'sparc-prd-mini', 'SKILL.md',
+);
+
+function read() {
+  return fs.readFileSync(SKILL, 'utf-8');
+}
+
+/** The text between the Phase 5 heading and the Phase 6 heading — placement is the property. */
+function phase5(src) {
+  const start = src.indexOf('### Phase 5: ARCHITECTURE');
+  const end = src.indexOf('### Phase 6: REFINEMENT');
+  assert.ok(start > 0, 'Phase 5 heading must exist');
+  assert.ok(end > start, 'Phase 6 heading must follow Phase 5');
+  return src.slice(start, end);
+}
+
+describe('sparc-prd-mini — Phase 5 reconciles with Pseudocode (PR-005/PR-010)', () => {
+  test('P1 — the reconciliation step lives INSIDE Phase 5, before its checkpoint', () => {
+    const block = phase5(read());
+    assert.match(block, /СВЕРКА С ПСЕВДОКОДОМ/,
+      'the step must be inside Phase 5 — somewhere in the file is not the same property');
+    const step = block.indexOf('СВЕРКА С ПСЕВДОКОДОМ');
+    const checkpoint = block.indexOf('CHECKPOINT 5');
+    assert.ok(checkpoint > 0, 'Phase 5 must still carry its checkpoint');
+    assert.ok(step < checkpoint,
+      'reconciling AFTER the user has already approved the phase reconciles nothing');
+  });
+
+  test('P1b — the step is OUTSIDE the [MANUAL] CP5 block, so AUTO mode cannot skip it', () => {
+    // Cross-family QE (Codex gpt-5.6-sol) caught this: the first placement landed the step INSIDE
+    // the fenced `**[MANUAL] CP5:**` block, which AUTO mode is entitled to skip — a mandatory
+    // reconciliation that only happens in one of two run modes is not mandatory. P1's before/after
+    // ordering was true and still missed it, because "before the checkpoint text" and "outside the
+    // MANUAL-only block" are two different facts.
+    const block = phase5(read());
+    const step = block.indexOf('СВЕРКА С ПСЕВДОКОДОМ');
+    const manual = block.indexOf('**[MANUAL] CP5:**');
+    assert.ok(manual > 0, 'the MANUAL checkpoint marker must still exist');
+    assert.ok(step < manual,
+      'the step must precede the [MANUAL] marker — inside it, an AUTO run reconciles nothing');
+  });
+
+  test('P2 — it names BOTH artifacts to re-read, not "check for consistency"', () => {
+    const block = phase5(read());
+    assert.match(block, /Pseudocode\.md/, 'the step must name the file it re-reads');
+    assert.match(block, /## Data Structures/, 'and the data-model section within it');
+    // Codex: "an algorithm uses a missing column" cannot be detected from the type list alone.
+    assert.match(block, /## Core Algorithms/,
+      'the missing-column kind is undetectable without the algorithms — naming only the data '
+      + 'structures would promise a check the step cannot perform');
+  });
+
+  test('P3 — all three measured discrepancy kinds are named verbatim', () => {
+    const block = phase5(read());
+    // Each of these is a real symptom that reached code before this step existed. A generic
+    // "look for inconsistencies" would satisfy a reviewer and catch none of them.
+    // Checked in BOLD form, i.e. where the kinds are DEFINED. A first draft matched the bare
+    // phrase and did not discriminate: the same words also appear inside the example table row, so
+    // deleting a kind from the definition list left the assertion green. A phrase appearing in an
+    // example is not the same fact as a phrase defining a kind — the fifth instance of that trap
+    // in one day, so it is closed by construction here.
+    for (const kind of ['смена типа', 'отсутствующая колонка', 'несовпадение набора значений']) {
+      assert.ok(block.includes(`**${kind}**`),
+        `discrepancy kind must be DEFINED (bold) in the step, not merely mentioned: ${kind}`);
+    }
+  });
+
+  test('P4 — a written outcome is required in EVERY case, including no-change', () => {
+    const block = phase5(read());
+    assert.match(block, /## Reconciliation with Pseudocode/,
+      'the step must name the block it writes into Architecture.md');
+    assert.match(block, /Расхождений с/,
+      'the no-change case needs its own stated sentence — silence cannot distinguish '
+      + '"reconciled and clean" from "never reconciled"');
+  });
+
+  test('P5 — SPARC order is unchanged: the refused decision stays refused', () => {
+    const src = read();
+    const order = ['### Phase 3: SPECIFICATION', '### Phase 4: PSEUDOCODE',
+      '### Phase 5: ARCHITECTURE', '### Phase 6: REFINEMENT', '### Phase 7: COMPLETION'];
+    const at = order.map((h) => {
+      const i = src.indexOf(h);
+      assert.ok(i > 0, `heading must exist: ${h}`);
+      return i;
+    });
+    for (let i = 1; i < at.length; i += 1) {
+      assert.ok(at[i] > at[i - 1],
+        `phases must stay in S-P-A-R-C order — the acronym IS the method's name; ${order[i]} moved`);
+    }
+  });
+});

package/tests/unit/spec-pseudocode-traceability.test.js

@@ -0,0 +1,146 @@
+'use strict';
+
+// A scenario could promise a check that no algorithm performs, and nothing in the pipeline could
+// notice. MEASURED: Specification.md's user-story template produced Gherkin acceptance criteria with
+// no identifier of any kind, Pseudocode.md's algorithm template was "### Algorithm: [Name]" with no
+// back-reference, and a sweep of the skill for traceab|SC-\d|scenario id returned nothing. The two
+// documents are written one phase apart and were never compared again.
+//
+// WHAT THIS FEATURE CLAIMS, exactly. It establishes that a CLAIM exists and that its two ends name
+// each other. It does not establish that the algorithm performs the check — no comparison of names
+// can. The nearest precedent says the same of itself: the K2 gate's own source records that its C1
+// check is a grep and that PROSE satisfies it. So this catches "nobody wrote anything about this
+// scenario"; it does not catch "someone wrote a line that mentions it", and closing a gap with
+// paperwork is precisely the failure the field report is about. P6 asserts the limit is written into
+// the template, so the next reader sees the same caveat the author did.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const SKILL = path.join(__dirname, '..', '..', 'templates', '.claude', 'skills',
+  'sparc-prd-mini', 'SKILL.md');
+const read = () => fs.readFileSync(SKILL, 'utf-8');
+
+function phase(src, heading, nextHeading) {
+  const start = src.indexOf(heading);
+  const end = src.indexOf(nextHeading, start + 1);
+  assert.ok(start > 0, 'missing section: ' + heading);
+  assert.ok(end > start, 'missing terminator: ' + nextHeading);
+  return src.slice(start, end);
+}
+
+const phase3 = (src) => phase(src, '### Phase 3: SPECIFICATION', '### Phase 4: PSEUDOCODE');
+const phase4 = (src) => phase(src, '### Phase 4: PSEUDOCODE', '### Phase 5: ARCHITECTURE');
+
+describe('a scenario and the algorithm that claims it can be traced to each other (PR-003)', () => {
+  test('P1 — Phase 3 gives every acceptance scenario an ID of a stated form', () => {
+    const block = phase3(read());
+    assert.match(block, /\[SC-<story-id>-1\]/,
+      'the ID must appear IN the template, so its form is unambiguous rather than described');
+    assert.match(block, /`SC-<US-id>-<n>`/, 'and the form must be stated');
+    // Cross-family QE: <story-id> had no definition and no uniqueness rule, so two scenarios could
+    // end up with the same name and a trace would point at either.
+    assert.match(block, /`US-<nnn>` — three digits, assigned in order, never reused/,
+      'the story id must be DEFINED, with a uniqueness rule, or the scenario id is not well-formed');
+    assert.match(block, /the scenarios of `US-007` are `SC-US-007-1`/,
+      'and shown worked once, so the composition is unambiguous');
+    assert.match(block, /nothing to trace to if a scenario has no\s+name/,
+      'and WHY, or a later editor drops the ID as noise');
+  });
+
+  test('P2 — Phase 4 algorithms declare what they realise, where they are written', () => {
+    const block = phase4(read());
+    // Structural, not textual: between the algorithm heading and its INPUT line. Cross-family QE
+    // noted the first version only proved the string occurs somewhere in the phase.
+    const at = block.indexOf('### Algorithm: [Name]');
+    assert.ok(at > 0, 'the algorithm template must exist');
+    const algo = block.slice(at, block.indexOf('COMPLEXITY', at));
+    assert.match(algo, /REALISES: \[SC-… ids this algorithm implements/,
+      'the declaration must sit in the algorithm block itself, not in a table someone must remember');
+    assert.ok(algo.indexOf('REALISES') < algo.indexOf('INPUT:'),
+      'and beside INPUT/OUTPUT where the algorithm is written, not appended after it');
+  });
+
+  test('P3 — the reconciliation is INSIDE Phase 4 and OUTSIDE the [MANUAL] CP4 block', () => {
+    // Placement is the property, twice over. A step after Phase 4 reconciles nothing in time; a step
+    // inside the fenced [MANUAL] block is skipped by an AUTO run, so a "mandatory" step would run in
+    // half of runs. The sibling Phase-5 feature shipped that exact defect and had it caught in
+    // review — "precedes the checkpoint text" and "outside the MANUAL-only block" are two different
+    // facts, and only the second one is the property.
+    const src = read();
+    const block = phase4(src);
+    const step = block.indexOf('**Шаг 4.9 — ПОКРЫТИЕ СЦЕНАРИЕВ');
+    const manual = block.indexOf('**[MANUAL] CP4:**');
+    assert.ok(step > 0, 'the coverage step must live inside Phase 4');
+    assert.ok(manual > step,
+      'and BEFORE the manual checkpoint block, not after it: ' + step + ' vs ' + manual);
+    // NOTE: an earlier version added a "not inside the fenced block" assertion here. It was VACUOUS
+    // — the fence is located FROM `manual`, so after `manual > step` the step cannot be inside it.
+    // Cross-family QE caught it. The assertion above is the real guard, and the mutation that moves
+    // the step into the fenced block turns it red, which is the evidence that matters.
+  });
+
+  test('P4 — a Scenario Coverage block is required in EVERY case, including all-covered', () => {
+    const block = phase4(read());
+    assert.match(block, /## Scenario Coverage/,
+      'the required output block must be named, or "reconcile" is advice');
+    assert.match(block, /in every\s+case, including the one where everything is covered/,
+      'an absent block and a block saying "all covered" are indistinguishable to the next reader');
+    assert.match(block, /Not claimed by any algorithm:/,
+      'and the uncovered scenarios must be listed, not summarised as a count');
+    // Cross-family QE: the check ran ONE WAY. An algorithm could declare REALISES for a scenario
+    // nobody ever wrote, and the dangling reference reads exactly like coverage.
+    assert.match(block, /Claimed by an algorithm but absent from Specification\.md:/,
+      'traceability must run both ways, or a dangling REALISES passes as coverage');
+    assert.match(block, /Both tables are required, and both may be the single word `none`/,
+      'and the empty case must be written out — an empty table and a forgotten one look identical');
+  });
+
+  test('P5 — the reason vocabulary is CLOSED, and the two escape hatches are rejected by name', () => {
+    const block = phase4(read());
+    const expected = ['ui-only', 'external-service', 'out-of-mvp-scope', 'data-only', 'config-only'];
+    for (const reason of expected) {
+      assert.ok(block.includes('`' + reason + '`'),
+        'the closed list must carry the reason: ' + reason);
+    }
+    assert.match(block, /CLOSED list of five/, 'and declare itself closed, with its size');
+    // CLOSED means closed: the first version asserted the values exist and let a sixth in silently.
+    // The count is the property, and it must agree with the stated size.
+    const at = block.indexOf('CLOSED list of five');
+    const table = block.slice(at, block.indexOf('Free text is NOT a reason', at));
+    const rows = table.split('\n').filter((l) => /^\| `[a-z-]+` \|/.test(l));
+    assert.equal(rows.length, expected.length,
+      'the reason table must have exactly the stated number of rows: ' + JSON.stringify(rows));
+    // Without these two named, "free text" creeps back as the default and the list means nothing.
+    assert.match(block, /Free text is NOT a reason, and `N\/A` is NOT a reason/,
+      'the two ways this field gets emptied must be rejected by name');
+    assert.match(block, /A field that accepts anything records nothing/,
+      'with the reason, so the rejection survives an editor who finds it unfriendly');
+  });
+
+  test('P6 — the template states its own limit', () => {
+    // The load-bearing honesty. A traceability block LOOKS like proof of implementation, and the
+    // field report's actual complaint is gaps closed with paperwork — which this cannot detect.
+    const block = phase4(read());
+    assert.match(block, /It does NOT establish that the algorithm's steps actually perform the check/,
+      'the limit must be written into the artifact, not only into the feature\'s own report');
+    assert.match(block, /nobody wrote anything about this\s+scenario/,
+      'and the class it DOES catch must be named, so the claim is bounded on both sides');
+  });
+
+  test('P7 — the phase order is still S→P→A→R→C', () => {
+    // Regression guard on the file this edits: the skill is named sparc-prd-mini and its phases are
+    // the acronym. A reorder would leave it claiming a methodology it no longer follows.
+    const src = read();
+    const order = ['### Phase 3: SPECIFICATION', '### Phase 4: PSEUDOCODE',
+      '### Phase 5: ARCHITECTURE', '### Phase 6: REFINEMENT', '### Phase 7: COMPLETION'];
+    let prev = -1;
+    for (const h of order) {
+      const at = src.indexOf(h);
+      assert.ok(at > prev, 'phases must appear in SPARC order; out of place: ' + h);
+      prev = at;
+    }
+  });
+});

package/tests/unit/statusline-honest-labels.test.js

@@ -0,0 +1,178 @@
+'use strict';
+
+// Two ways the status line said something untrue, both reproduced before the fix.
+//
+// 1. The progress bar was built from done/total and captioned `mvp`, with `Done x/y` rendered
+//    separately beside it — one glyph, two different quantities, read as one statement.
+//
+// 2. The domain regexes had no word boundaries, so ordinary sentences picked a domain:
+//      "Run healthchecks before deploy"  → healthcare   (`health` inside `healthchecks`)
+//      "We translate the UI"             → enterprise   (`sla` inside `tranSLAte`)
+//      "A slack bot for standups"        → enterprise   (`sla` inside `SLAck`)
+//      "Embankment mapping service"      → banking      (`bank` inside `emBANKment`)
+//    All four expressions were affected.
+//
+// THE TRAP, and it is why P3/P4 exist: `\b` is not the fix. It is defined over \w = [A-Za-z0-9_], so
+// there is no word boundary between a space and a Cyrillic letter — MEASURED, /\bбанк/.test('банк
+// России') is FALSE. A reflex `\b` fix would have silently deleted every Russian term while looking
+// correct in review. The boundaries are Unicode lookarounds with the `u` flag.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+const HOOK = path.join(TPL, 'hooks', 'statusline.cjs');
+const STRIP = new RegExp('\\x1b\\[[0-9;]*m', 'g');
+
+/** Run the REAL hook over a project whose CLAUDE.md says `text`, return its plain output. */
+function render(opts) {
+  const o = opts || {};
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-labels-')));
+  try {
+    fs.mkdirSync(path.join(root, '.claude', 'hooks'), { recursive: true });
+    fs.copyFileSync(HOOK, path.join(root, '.claude', 'hooks', 'statusline.cjs'));
+    if (o.claudeMd !== undefined) fs.writeFileSync(path.join(root, 'CLAUDE.md'), o.claudeMd);
+    // The Domain segment lives INSIDE the Roadmap line, so a domain fixture needs a roadmap too —
+    // without one the hook takes its "no roadmap yet" branch and never renders a domain at all.
+    if (o.features === undefined && o.claudeMd !== undefined) {
+      o.features = [{ id: 'a', status: 'next', priority: 'mvp' }];
+    }
+    if (o.features) {
+      fs.writeFileSync(path.join(root, '.claude', 'feature-roadmap.json'),
+        JSON.stringify({ version: '1.0', features: o.features }));
+    }
+    const r = spawnSync(process.execPath, [path.join(root, '.claude', 'hooks', 'statusline.cjs')],
+      { cwd: root, env: Object.assign({}, process.env, { CLAUDE_PROJECT_DIR: root }),
+        encoding: 'utf8' });
+    return { code: r.status, text: (r.stdout || '').replace(STRIP, '') };
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+}
+
+const domainOf = (text) => {
+  const m = text.match(/Domain:\s*(\S+)/);
+  return m ? m[1] : null;
+};
+
+/** The source of parseDomain, for the assertions that must look at the expressions themselves. */
+function parseDomainSource() {
+  const src = fs.readFileSync(HOOK, 'utf-8');
+  const start = src.indexOf('function parseDomain');
+  const end = src.indexOf('\nfunction ', start + 1);
+  assert.ok(start > 0 && end > start, 'parseDomain must exist');
+  return src.slice(start, end);
+}
+
+describe('the status line says what it means (PR-011, two small fixes)', () => {
+  test('P1 — ordinary sentences no longer pick a domain', () => {
+    // Each case is the EXACT sentence that produced the false positive, so a future edit that
+    // half-fixes one term is visible rather than averaged away.
+    const cases = [
+      ['Run healthchecks before deploy', 'health inside healthchecks'],
+      ['We translate the UI into three languages', 'sla inside translate'],
+      ['A slack bot for standups', 'sla inside slack'],
+      ['Embankment mapping service', 'bank inside embankment'],
+      ['Translation memory service', 'sla again'],
+      // Cross-family QE counter-examples: a left-only boundary was not enough for the Russian stems.
+      ['Сервис организации банкетов под ключ', 'банк inside банкетов'],
+      ['Финты в футболе: разбор техники', 'финт inside финты'],
+      ['ЦБС городской библиотеки', 'цб inside ЦБС — a two-letter acronym cannot be made safe'],
+      ['Video conversion service', 'bare conversion is not commerce'],
+    ];
+    for (const [text, why] of cases) {
+      const r = render({ claudeMd: '# Project\n\n' + text + '\n' });
+      assert.equal(r.code, 0, 'the status line must never fail the session');
+      assert.equal(domainOf(r.text), null,
+        'still matched (' + why + '): ' + JSON.stringify(text) + ' → ' + domainOf(r.text));
+    }
+  });
+
+  test('P2 — real domains are still detected, Cyrillic stems included', () => {
+    // The half a reflex `\b` fix would have deleted. Every Cyrillic entry here is a STEM meant to
+    // match its inflections, so it must keep matching them.
+    const cases = [
+      ['Мобильный банк для МСБ', 'banking'],
+      ['Финтех-стартап', 'banking'],
+      ['A healthcare records system', 'healthcare'],
+      ['Клиника на 40 врачей', 'healthcare'],
+      ['Retail analytics platform', 'retail'],
+      ['Рекомендательная система товаров', 'retail'],
+      ['Enterprise SLA dashboard', 'enterprise'],
+      // Cross-family QE: these were MISSED by the first version — a fix that loses true positives
+      // trades one wrong answer for another.
+      ['Retailer inventory analytics', 'retail'],
+      ['Health tech startup', 'healthcare'],
+      ['Platform for enterprises', 'enterprise'],
+      ['Улучшаем конверсию воронки', 'retail'],
+      ['Банковское приложение', 'banking'],
+    ];
+    for (const [text, expected] of cases) {
+      const r = render({ claudeMd: '# Project\n\n' + text + '\n' });
+      assert.equal(domainOf(r.text), expected,
+        JSON.stringify(text) + ' should be ' + expected + ', got ' + domainOf(r.text));
+    }
+  });
+
+  test('P3 — no domain expression uses \\b', () => {
+    // Asserted on the source because `\b` fails SILENTLY around Cyrillic: it does not error, it just
+    // stops matching, and every Russian term would vanish while the code looked right.
+    // Comments stripped first: the comment above these expressions EXPLAINS why \b is wrong and
+    // therefore contains it. A mention is not a use — the same trap this suite has hit before.
+    const code = parseDomainSource().split('\n').filter((l) => !/^\s*\/\//.test(l)).join('\n');
+    assert.ok(!/\\b/.test(code),
+      '\\b is not a word boundary around Cyrillic in JavaScript — /\\bбанк/.test("банк России") is '
+      + 'false. Use a Unicode lookaround.');
+  });
+
+  test('P4 — the boundaries are Unicode lookarounds with the u flag', () => {
+    const src = parseDomainSource();
+    assert.match(src, /\(\?<!\[\\\\p\{L\}\\\\p\{N\}\]\)/,
+      'a left boundary over Unicode letters is required');
+    assert.match(src, /\(\?!\[\\\\p\{L\}\\\\p\{N\}\]\)/,
+      'and a right boundary for whole words');
+    assert.match(src, /'iu'/, "and the `u` flag, or \\p{L} is not a property escape at all");
+    // The stem/word distinction is the reason the Cyrillic half survives; losing it would take the
+    // inflections with it.
+    assert.match(src, /const stem = /, 'stems take a left boundary only');
+    assert.match(src, /const word = /, 'whole words take both');
+    // Cross-family QE: the helpers being DECLARED proves nothing — dead declarations plus one 'iu'
+    // token satisfied the assertions above while an unbounded /conversion/i survived beside them.
+    // Every domain expression must be BUILT by one of the two helpers.
+    const built = [...src.matchAll(/const (\w+) = (stem|word)\(/g)].map((m) => m[1]);
+    assert.ok(built.length >= 6,
+      'each domain must be built by stem() or word(): found ' + JSON.stringify(built));
+    const raw = [...src.matchAll(/const (\w+(?:Stem|Word)) = \//g)].map((m) => m[1]);
+    assert.deepEqual(raw, [],
+      'these are raw regex literals, bypassing the boundary helpers: ' + JSON.stringify(raw));
+  });
+
+  test('P5 — the bar is captioned with what it draws', () => {
+    const r = render({ features: [
+      { id: 'a', status: 'done', priority: 'mvp' },
+      { id: 'b', status: 'next', priority: 'mvp' },
+      { id: 'c', status: 'next', priority: 'low' },
+    ] });
+    const line = r.text.split('\n').find((l) => l.includes('Roadmap')) || '';
+    assert.match(line, /\[[●○]+\]\s+Done\s+1\/3/,
+      'the bar is built from done/total, so Done is its caption: ' + line);
+    assert.match(line, /mvp\s+1\/2/, 'and mvp keeps its own segment: ' + line);
+    assert.ok(!/\[[●○]+\]\s+mvp/.test(line),
+      'the bar must not be captioned with a quantity it does not draw: ' + line);
+  });
+
+  test('P6 — with no MVP features the bar is still rendered', () => {
+    // The field report proposed hiding the bar when mvpTotal === 0. The bar is CORRECT; hiding a
+    // working indicator to mask a wrong caption fixes the wrong half.
+    const r = render({ features: [
+      { id: 'a', status: 'done', priority: 'low' },
+      { id: 'b', status: 'next', priority: 'low' },
+    ] });
+    const line = r.text.split('\n').find((l) => l.includes('Roadmap')) || '';
+    assert.match(line, /\[[●○]+\]/, 'the bar must survive an mvp count of zero: ' + line);
+    assert.match(line, /Done\s+1\/2/, 'and still report the real progress: ' + line);
+    assert.match(line, /mvp\s+0\/0/, 'while the mvp segment says plainly that there are none');
+  });
+});