@dzhechkov/p-replicator 1.9.0 → 1.10.0

package/tests/snapshot/baseline.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-08-27T10:29:04.397Z",
+  "generatedAt": "2026-08-27T14:30:37.254Z",
   "totalFiles": 138,
   "files": {
     ".claude/agents/doc-validator.md": "e57950758cd4764b2cb54b3f1905567e9dbc1ed20ac6ecd30998614894689f4f",
@@ -11,7 +11,7 @@
     ".claude/commands/feature.md": "3b605c004ae6d794dee30892956dc0a9536195e828929bdaff134f3e952e87bb",
     ".claude/commands/go.md": "655dc9cad37b61a9f283cef15e435c492ee7cbc88a6ce59295ac32c975dee858",
     ".claude/commands/harvest.md": "c074fe7799f594dda44c5f8166da707f25cee51b12f758dea562a8c1e6ac5dcd",
-    ".claude/commands/myinsights.md": "2e73e822384f976383d9c3313940888b9853f1781d2c39a2fb89825f221149dc",
+    ".claude/commands/myinsights.md": "93258a3340f99a0f14b374746ae2934b01d7cefe06d575434868eb98da2d854a",
     ".claude/commands/next.md": "1e4984306c3aa80dfc8734dc1c975dfe5fdf2cf6396ddd759e4c7635646107b8",
     ".claude/commands/plan.md": "6fef889f51168981bf4a98b8392a0d595e3d199e1cfaa8e08c0a181ec6c440e4",
     ".claude/commands/replicate.md": "8862d0dc117815b1c3fc7f6e929996e2458783f1ac443eb70bc2a7ebe63a67c3",
@@ -20,12 +20,12 @@
     ".claude/hooks/autocommit-insights.cjs": "5e7cef87b24d457f25315d79fe15f0dfaf94d9269495d638817f0faee2593c6f",
     ".claude/hooks/autocommit-plans.cjs": "9bb404b7f4fda5de03e6c2f16bf8939a79ec1944538767b04bcccc6cf50cc03d",
     ".claude/hooks/autocommit-roadmap.cjs": "f4dcc9ffd9a3aed91dd56e011e699fcf8af903cc81594e4ab1ef61e5432a36ad",
-    ".claude/hooks/check-docs-complete.cjs": "13eca8ab8f18325031ca707baa2f7068f8c05484f8e4b12d4129a1023cc7a478",
+    ".claude/hooks/check-docs-complete.cjs": "27c05c2adcedc806e395b30b455243193a4fbd0968ce96e415679e1f78db951a",
     ".claude/hooks/check-growth-trace.cjs": "91994fc109c8440306c9dd3d5eea176c533eb0818fcdb09bac2b309397d9908a",
-    ".claude/hooks/check-ports.cjs": "e5f2d2bd8899df27c2dfedf76128467becae1868210eb8525a1bad2869a8c78f",
+    ".claude/hooks/check-ports.cjs": "1813aa60e4d15c5f6ce54a9b3471c3772efe60c332316183c7ad8f5b619f2169",
     ".claude/hooks/session-insights.cjs": "46f8357e3886a6d54db1ab4af969b9b8643ae5937ba59038a5651ffbcfd0d30e",
     ".claude/hooks/state-update.cjs": "47146a76b768ac2273abe8f2f017856a0e28b45afaf90048148da417dd19604e",
-    ".claude/hooks/statusline.cjs": "948edf98ccabaa4e2dc59078435fb444639aa740baa08967d3a78067e4de3416",
+    ".claude/hooks/statusline.cjs": "465190ab21610357094fd6eba188ba9f7086dc5a933568f40a7f7c715ccd6745",
     ".claude/rules/docker-ports.md": "bef41c25c875479341f68783c2d64572800d4710f55401e55519245f03d22efb",
     ".claude/rules/feature-lifecycle.md": "f9ddc8c889ab7938a7207b36ae46c36be05e9b870956ef16617bf31b2f78c758",
     ".claude/rules/git-workflow.md": "7d8d2ded47fcc0fb95da3dc226efa6cb3c80d6adf7296977588c181dfce20192",
@@ -38,8 +38,8 @@
     ".claude/skills/brutal-honesty-review/resources/assessment-rubrics.md": "dac09c91c765e2211799cc230738fb72a966f47511edb872306a906e49640cbe",
     ".claude/skills/brutal-honesty-review/resources/review-template.md": "95182c8605b1d821360257e1c5dbac4300bda333d861785de417cbb84090b25b",
     ".claude/skills/brutal-honesty-review/schemas/output.json": "2e252a3497b86322e1a6e6bd1aca8708b44389db3a2d81a6f893d467b6351210",
-    ".claude/skills/brutal-honesty-review/scripts/assess-code.sh": "7e9722c1533f1b7d1a9d11a7add13ac12a2a5f0acfc0ed2cdede2bcf0dab788f",
-    ".claude/skills/brutal-honesty-review/scripts/assess-tests.sh": "8c6444bdb5ce97e49223cdaa6b1c58ac8fcec710cd6ee8d56de9bc677379bd88",
+    ".claude/skills/brutal-honesty-review/scripts/assess-code.sh": "2b10d2972b1379adde9a68ddf8bcdb399b7d65075e458a54523ffd8d99ddc746",
+    ".claude/skills/brutal-honesty-review/scripts/assess-tests.sh": "d33e760a0739e9291f6087adf189f01eb7c4a1136d9128390dd6e3ad8eadda6f",
     ".claude/skills/brutal-honesty-review/scripts/validate-config.json": "7418284839f89735d01f50eefdb488b013e0076f6003a67683062429c14984c6",
     ".claude/skills/brutal-honesty-review/SKILL.md": "21e41129dac8e99485b501dcb3767d5f4461ce527782fa7bc71f89dabe5bd2bd",
     ".claude/skills/cc-toolkit-generator-enhanced/modules/01-detect-parse.md": "85c72f6daa5af88b4a7ff520a387f47a7c92b81cb1f0757550c8b58100a97be6",
@@ -59,7 +59,7 @@
     ".claude/skills/cc-toolkit-generator-enhanced/references/security-patterns-library.md": "5f1d650c426cbd2c9536b385306605ea62a5a520ee4566d23ca7254409c672a5",
     ".claude/skills/cc-toolkit-generator-enhanced/references/templates/automation-commands.md": "23b8204fdc70b5afc5430cbe503af709a04b26716d2d2e07889283a755858fee",
     ".claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-agents.md": "c91f81da197a072b57378fd0018eea26c35d909a558bdca6f070eb60153c97b3",
-    ".claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-hooks-commands.md": "d70a0c4977d322602c35c53bf04880177b5dd8f0de2b339d68a0f55993903745",
+    ".claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-hooks-commands.md": "8398f2493434db101476300e514a34bf8124a51eb732cf81923f9a5b5a3d5db4",
     ".claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-skills.md": "2f1019d5da7d695983aee79186a47fcefccbfa24db48219c04f9bb9feb757d3a",
     ".claude/skills/cc-toolkit-generator-enhanced/references/templates/enhanced-claude-md.md": "db6898b7202b84965cbff9195a6ce780cadd6aeb64adae3fbfd951443a6bc43d",
     ".claude/skills/cc-toolkit-generator-enhanced/references/templates/feature-lifecycle-ent.md": "eb9025b687f0408b33280bf5fcc6c8be9b1670a544dd90b510557b89ae6cc123",

package/tests/unit/absence-is-not-emptiness.test.js

@@ -0,0 +1,255 @@
+'use strict';
+
+// A thing that is there but says nothing was reported as fine, in two places a caller reads for the
+// same purpose: "is my toolkit intact?".
+//
+// REPRODUCED 2026-08-27 before the fix: 31 files truncated to zero bytes — every SKILL.md, command,
+// rule and agent — and `verify` printed "[OK] All artifacts verified." with exit 0, `doctor` likewise.
+// DELETING a file was caught (exit 1). Cause: fileExists() is fs.accessSync — it asks whether the
+// path resolves, never what is in it.
+//
+// Why that is worse than it looks, and the evidence is from the same day: a twin test against the
+// harness's own registration event measured that a SKILL.md without YAML frontmatter is NOT
+// registered (35 -> 36 -> 37 as frontmatter was added). A zero-byte SKILL.md certainly has none. So
+// "all artifacts verified" over 31 empty files asserts the integrity of a toolkit that cannot load.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { execFileSync, spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const PKG = path.resolve(__dirname, '..', '..');
+const CLI = path.join(PKG, 'bin', 'cli.js');
+
+/** A fresh install in a throwaway directory. */
+function project() {
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-empty-')));
+  execFileSync(process.execPath, [CLI, 'init'], { cwd: dir, stdio: 'ignore' });
+  return dir;
+}
+
+const run = (dir, cmd) => {
+  const r = spawnSync(process.execPath, [CLI, cmd], { cwd: dir, encoding: 'utf8' });
+  return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
+};
+
+const cleanup = (d) => fs.rmSync(d, { recursive: true, force: true });
+
+describe('an artifact that is there but says nothing is not verified', () => {
+  test('P1 - truncated artifacts fail both health checks and are named', () => {
+    const dir = project();
+    try {
+      const victims = [
+        path.join(dir, '.claude', 'rules', 'docker-ports.md'),
+        path.join(dir, '.claude', 'commands', 'replicate.md'),
+        path.join(dir, '.claude', 'skills', 'explore', 'SKILL.md'),
+      ];
+      for (const f of victims) fs.writeFileSync(f, '');
+
+      const v = run(dir, 'verify');
+      assert.notEqual(v.code, 0,
+        'a toolkit whose skills cannot load is not verified: ' + v.out);
+      const d = run(dir, 'doctor');
+      assert.notEqual(d.code, 0, 'doctor must agree with verify: ' + d.out);
+
+      // NAMED, not counted. A count sends a reader to inspect files by hand.
+      for (const f of victims) {
+        const base = path.basename(f) === 'SKILL.md' ? 'explore' : path.basename(f, '.md');
+        assert.ok(v.out.includes(base),
+          'verify must name the offending artifact ' + base + ': ' + v.out);
+      }
+    } finally { cleanup(dir); }
+  });
+
+  test('P2 - whitespace-only counts as empty', () => {
+    // A file holding a newline is exactly as dead as one holding nothing, and a naive size check
+    // would pass it.
+    const dir = project();
+    try {
+      fs.writeFileSync(path.join(dir, '.claude', 'rules', 'git-workflow.md'), '\n   \n\t\n');
+      const v = run(dir, 'verify');
+      assert.notEqual(v.code, 0, 'whitespace is not content: ' + v.out);
+    } finally { cleanup(dir); }
+  });
+
+  test('P3 - missing and empty stay SEPARABLE words', () => {
+    // Their cures differ: missing -> run update; empty -> something truncated your file, and update
+    // would silently repair it without you ever learning that. Naming both "missing" moves the
+    // silence up one level instead of removing it.
+    const dirA = project();
+    const dirB = project();
+    try {
+      fs.rmSync(path.join(dirA, '.claude', 'rules', 'docker-ports.md'));
+      fs.writeFileSync(path.join(dirB, '.claude', 'rules', 'docker-ports.md'), '');
+      const a = run(dirA, 'verify');
+      const b = run(dirB, 'verify');
+      assert.notEqual(a.code, 0);
+      assert.notEqual(b.code, 0);
+      assert.match(a.out, /missing/i, 'a deleted artifact is missing: ' + a.out);
+      assert.match(b.out, /empty|пуст/i, 'a truncated artifact is EMPTY, not missing: ' + b.out);
+      assert.ok(!/\bempty\b/i.test(a.out.split('\n').filter((l) => l.includes('docker-ports')).join('\n')),
+        'the deleted one must not be called empty: ' + a.out);
+    } finally { cleanup(dirA); cleanup(dirB); }
+  });
+
+  test('P4 - fileExists keeps its old meaning', () => {
+    // 31 call sites. Several ask a genuine presence question about files that may legitimately hold
+    // nothing. This asserts the old predicate was NOT repurposed — a future reader must not "fix" it.
+    const { fileExists } = require(path.join(PKG, 'src', 'utils.js'));
+    const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-fe-')));
+    try {
+      const f = path.join(dir, 'empty.txt');
+      fs.writeFileSync(f, '');
+      assert.equal(fileExists(f), true,
+        'fileExists answers about PRESENCE and must keep doing so');
+      assert.equal(fileExists(path.join(dir, 'nope.txt')), false);
+    } finally { cleanup(dir); }
+  });
+
+  test('P5 - artifactState reports three states', () => {
+    const { artifactState } = require(path.join(PKG, 'src', 'utils.js'));
+    const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-as-')));
+    try {
+      fs.writeFileSync(path.join(dir, 'empty.txt'), '');
+      fs.writeFileSync(path.join(dir, 'ws.txt'), '  \n\t ');
+      fs.writeFileSync(path.join(dir, 'real.txt'), 'content');
+      assert.equal(artifactState(path.join(dir, 'nope.txt')), 'missing');
+      assert.equal(artifactState(path.join(dir, 'empty.txt')), 'empty');
+      assert.equal(artifactState(path.join(dir, 'ws.txt')), 'empty');
+      assert.equal(artifactState(path.join(dir, 'real.txt')), 'present');
+    } finally { cleanup(dir); }
+  });
+
+  test('P6 - none of the three insights states changes the exit code', () => {
+    // A project that has recorded no insight is a NEW project. A check that refuses a new project is
+    // a check people disable, and then the real signal goes with it. The defect was never the
+    // emptiness — it was that emptiness and ABSENCE were indistinguishable, so a carrier that never
+    // existed looked exactly like one being used and found empty. That is how 27 recorded insights
+    // became 0 without anyone noticing.
+    const dir = project();
+    try {
+      const idx = path.join(dir, '.claude', 'insights', 'index.md');
+
+      const absent = run(dir, 'doctor');
+      assert.equal(absent.code, 0, 'a fresh project must not fail: ' + absent.out);
+
+      fs.mkdirSync(path.dirname(idx), { recursive: true });
+      fs.writeFileSync(idx, '# Insights\n');
+      const zero = run(dir, 'doctor');
+      assert.equal(zero.code, 0, 'zero entries must not fail either: ' + zero.out);
+
+      fs.writeFileSync(idx, '# Insights\n\n## 2026-08-27 — a rake\n\nBody.\n');
+      const some = run(dir, 'doctor');
+      assert.equal(some.code, 0);
+
+      // Three states, three DIFFERENT strings. Two that read alike are the defect.
+      // Specific: the component list also contains the word 'insights' (/myinsights, session-insights.cjs).
+      const lineOf = (out) => (out.split('\n').find((l) => /insights carrier/i.test(l)) || '').trim();
+      const [a, z, s] = [lineOf(absent.out), lineOf(zero.out), lineOf(some.out)];
+      assert.ok(a && z && s, 'doctor must say something about insights in all three states: '
+        + JSON.stringify([a, z, s]));
+      assert.notEqual(a, z, 'ABSENT and ZERO-ENTRY must not read alike: ' + JSON.stringify([a, z]));
+      assert.notEqual(z, s, 'ZERO-ENTRY and POPULATED must not read alike: ' + JSON.stringify([z, s]));
+    } finally { cleanup(dir); }
+  });
+
+  test('P8 - doctor says EMPTY for every component kind, settings included', () => {
+    // Cross-family review found my first pass swapped the CONDITION to artifactState and left the
+    // two-way branch, so a whitespace-only artifact was reported as "missing" — the exact collapse
+    // AR-4 forbids. Worse: settings.json and the hooks were still on fileExists, so a ZERO-BYTE
+    // settings.json — no hooks wired at all — received a checkmark.
+    //
+    // Matched on the EXACT label the line carries, not a substring: `replicate` also occurs inside
+    // `replicate-coordinator`, and a loose matcher read a passing line as the failing one. Third
+    // time this class has bitten today.
+    const dir = project();
+    try {
+      const victims = {
+        '/replicate': path.join(dir, '.claude', 'commands', 'replicate.md'),
+        'doc-validator': path.join(dir, '.claude', 'agents', 'doc-validator.md'),
+        'docker-ports': path.join(dir, '.claude', 'rules', 'docker-ports.md'),
+        'explore': path.join(dir, '.claude', 'skills', 'explore', 'SKILL.md'),
+        'settings.json': path.join(dir, '.claude', 'settings.json'),
+      };
+      for (const f of Object.values(victims)) fs.writeFileSync(f, '  \n\t ');
+
+      const d = run(dir, 'doctor');
+      assert.notEqual(d.code, 0, d.out);
+      for (const label of Object.keys(victims)) {
+        const line = d.out.split('\n')
+          .map((l) => l.replace(/\x1b\[[0-9;]*m/g, '').trim())
+          .find((l) => l.startsWith('\u2717 ' + label + ' ') || l === '\u2717 ' + label);
+        assert.ok(line, label + ' must appear as a FAILING line: ' + d.out);
+        assert.match(line, /EMPTY, cannot load/,
+          label + ' must be EMPTY, not missing and never a checkmark: ' + JSON.stringify(line));
+      }
+    } finally { cleanup(dir); }
+  });
+
+  test('P10 - a zero-byte HOOK is reported too, when settings.json still parses', () => {
+    // The hook checks live inside the branch that runs only when settings.json is readable, so P8
+    // cannot reach them: killing settings.json hides its own children. Asserted separately, which
+    // is the honest shape — and it proves the hook path is on artifactState, not fileExists.
+    const dir = project();
+    try {
+      fs.writeFileSync(path.join(dir, '.claude', 'hooks', 'check-ports.cjs'), '');
+      const d = run(dir, 'doctor');
+      assert.notEqual(d.code, 0, d.out);
+      const line = d.out.split('\n')
+        .map((l) => l.replace(/\x1b\[[0-9;]*m/g, '').trim())
+        .find((l) => l.startsWith('\u2717 check-ports.cjs'));
+      assert.ok(line, 'a zero-byte hook must not receive a checkmark: ' + d.out);
+      assert.match(line, /EMPTY, cannot load/, line);
+    } finally { cleanup(dir); }
+  });
+
+  test('P9 - verify reports the carrier in all three states, failing none', () => {
+    // FR-5 asks for three SURFACES. The first pass shipped two and left verify producing identical
+    // output for absent, empty and populated — the same indistinguishability, one surface over.
+    const dir = project();
+    try {
+      const idx = path.join(dir, '.claude', 'insights', 'index.md');
+      const seen = [];
+      const carrierLine = (out) => (out.split('\n').find((l) => /insights carrier/i.test(l)) || '').trim();
+
+      let r = run(dir, 'verify'); seen.push(carrierLine(r.out));
+      assert.equal(r.code, 0, 'a fresh project must not fail verify: ' + r.out);
+
+      fs.mkdirSync(path.dirname(idx), { recursive: true });
+      fs.writeFileSync(idx, '# Insights\n');
+      r = run(dir, 'verify'); seen.push(carrierLine(r.out));
+      assert.equal(r.code, 0, 'zero entries must not fail verify: ' + r.out);
+
+      fs.writeFileSync(idx, '# Insights\n\n## 2026-08-27 — a rake\n\nBody.\n');
+      r = run(dir, 'verify'); seen.push(carrierLine(r.out));
+      assert.equal(r.code, 0);
+
+      assert.ok(seen.every(Boolean), 'verify must say something in all three states: ' + JSON.stringify(seen));
+      assert.equal(new Set(seen).size, 3, 'three states, three DIFFERENT lines: ' + JSON.stringify(seen));
+    } finally { cleanup(dir); }
+  });
+
+  test('P7 - the statusline distinguishes no-carrier from zero-entries', () => {
+    const dir = project();
+    try {
+      const hook = path.join(dir, '.claude', 'hooks', 'statusline.cjs');
+      const strip = new RegExp('\\x1b\\[[0-9;]*m', 'g');
+      const render = () => spawnSync(process.execPath, [hook],
+        { cwd: dir, env: { ...process.env, CLAUDE_PROJECT_DIR: dir }, encoding: 'utf8' })
+        .stdout.replace(strip, '');
+
+      const absent = render();
+      const idx = path.join(dir, '.claude', 'insights', 'index.md');
+      fs.mkdirSync(path.dirname(idx), { recursive: true });
+      fs.writeFileSync(idx, '# Insights\n');
+      const zero = render();
+
+      const seg = (out) => (out.split('\n').find((l) => /Insight/i.test(l)) || '');
+      assert.notEqual(seg(absent), seg(zero),
+        'a carrier that never existed rendered identically to one found empty — that is the defect: '
+        + JSON.stringify([seg(absent), seg(zero)]));
+    } finally { cleanup(dir); }
+  });
+});

package/tests/unit/assess-scripts.test.js

@@ -0,0 +1,150 @@
+'use strict';
+
+// brutal-honesty-review is Phase 4 of /feature — where a course participant meets it. Its two
+// assessment scripts print verdicts and CANNOT FAIL. MEASURED 2026-08-27:
+//
+//   assess-code.sh  on TODO/FIXME/BUG/HACK + nested for(;;) + empty catch + eval  → 2 red, exit 0
+//   assess-tests.sh on two tests, one timing-based, no edge cases                 → 6 red, exit 0
+//   assess-tests.sh /nope/nope                                                    →        exit 1
+//
+// The semantics is INVERTED: "I could not check" is louder than "I found six violations". A
+// participant sees red on screen and any automation reads success.
+//
+// Both scripts DETECT correctly — seven and nine verdict sites, all firing on the right inputs.
+// Nothing about the detection is wrong; nobody counts. These tests RUN the real scripts.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const PKG = path.resolve(__dirname, '..', '..');
+const SCRIPTS = path.join(PKG, 'templates', '.claude', 'skills', 'brutal-honesty-review', 'scripts');
+const CODE = path.join(SCRIPTS, 'assess-code.sh');
+const TESTS = path.join(SCRIPTS, 'assess-tests.sh');
+
+/** Build a throwaway target and run one script over it. `arg: null` passes no argument at all. */
+function run(script, files, arg) {
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-assess-')));
+  try {
+    for (const [name, body] of Object.entries(files || {})) {
+      const abs = path.join(dir, name);
+      fs.mkdirSync(path.dirname(abs), { recursive: true });
+      fs.writeFileSync(abs, body);
+    }
+    const argv = arg === null ? [script] : [script, path.join(dir, arg === undefined ? 'target' : arg)];
+    const r = spawnSync('bash', argv, { cwd: dir, encoding: 'utf8' });
+    return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+
+const AWFUL = 'function f(){ /* TODO FIXME BUG HACK */ for(;;){for(;;){}} try{}catch(e){} eval(x); }\n';
+// "Clean" BY THIS SCRIPT'S OWN STANDARDS, which are stricter than they first look: it wants
+// try/catch present and a tests directory to exist. My first fixture had neither and produced two
+// legitimate findings — the fixture was wrong, not the detection, which AR-1 forbids touching.
+const CLEAN = 'export function add(a, b) {\n'
+  + '  try {\n    if (typeof a !== "number") throw new Error("bad");\n    return a + b;\n'
+  + '  } catch (e) {\n    console.error(e);\n    throw e;\n  }\n}\n';
+// `tests/` sits at the fixture ROOT, not under target/: the script's testability check reads
+// `[ -d "tests" ]` against the CURRENT WORKING DIRECTORY rather than against $TARGET. That is a
+// pre-existing quirk — arguably its own defect — and AR-1 forbids changing detection in this
+// change, so the fixture matches the script rather than the other way round. Filed separately.
+const CLEAN_TREE = { 'target/add.js': CLEAN, 'tests/add.test.js': "test('adds', () => {});\n" };
+const BAD_TESTS = "test('t1', () => {});\ntest('t2', () => { setTimeout(() => {}, 1) });\n";
+
+describe('an assessment script that prints verdicts can refuse', () => {
+  test('P1 - awful code exits 1, and the count is printed', () => {
+    const r = run(CODE, { 'target/awful.js': AWFUL });
+    assert.equal(r.code, 1, 'red verdicts on screen must reach the exit code: ' + r.out);
+    assert.match(r.out, /🔴/, 'and the verdicts themselves must still appear: ' + r.out);
+    assert.match(r.out, /\b[1-9]\d*\b.*(?:finding|issue|проблем|нарушен)/i,
+      'the count must be stated, so a human sees the same answer as the exit code: ' + r.out);
+  });
+
+  test('P2 - bad tests exit 1', () => {
+    const r = run(TESTS, { 'target/a.test.js': BAD_TESTS });
+    assert.equal(r.code, 1, 'six red verdicts must not read as success: ' + r.out);
+    assert.match(r.out, /🔴/, r.out);
+  });
+
+  test('P3 - could-not-check is 2, and no argument is 2', () => {
+    // THE inversion. Today a nonexistent path exits 1 while six violations exit 0, so a gate
+    // reading 1 cannot tell blindness from findings. A caller who passed nothing and one pointing
+    // at a missing directory made the same class of mistake: the script could not look.
+    for (const script of [CODE, TESTS]) {
+      const missing = run(script, {}, 'nope');
+      assert.equal(missing.code, 2,
+        path.basename(script) + ': a target that does not exist is could-not-check: ' + missing.out);
+      const noArg = run(script, {}, null);
+      assert.equal(noArg.code, 2,
+        path.basename(script) + ': no argument is could-not-check too: ' + noArg.out);
+    }
+  });
+
+  test('P4 - clean input exits 0', () => {
+    // A script that only fails is as useless as one that only passes, and without this the suite
+    // could not tell them apart.
+    const r = run(CODE, CLEAN_TREE);
+    assert.equal(r.code, 0, 'clean code must pass: ' + r.out);
+  });
+
+  test('P5 - detection is unchanged', () => {
+    // The change adds counting. If a verdict that used to fire stops firing, the exit code is right
+    // for the wrong reason — and this suite would still be green.
+    const r = run(CODE, { 'target/awful.js': AWFUL });
+    // Only markers that DID fire before the change. `Found N loops` needs more than five lines
+    // matching `for.*{` and never fired on this input — asserting it would have been a test for
+    // behaviour the script never had.
+    for (const marker of [/TODO\/FIXME\/BUG\/HACK/, /No test directory found/]) {
+      assert.match(r.out, marker, 'a verdict that fired before must still fire: ' + r.out);
+    }
+  });
+
+  test('P6 - the closing voice survives', () => {
+    // The Ramsay-voice lines are the skill's character and a participant reads them. The verdict is
+    // ADDED, not substituted.
+    const r = run(CODE, CLEAN_TREE);
+    assert.match(r.out, /wouldn't deploy this to production/i,
+      'the closing prose must not be replaced by a machine verdict: ' + r.out);
+  });
+
+  test('P7 - all three verdicts from ONE script in one run', () => {
+    // assess-code.sh reaches all three from fixtures.
+    const seen = [
+      run(CODE, CLEAN_TREE).code,
+      run(CODE, { 'target/awful.js': AWFUL }).code,
+      run(CODE, {}, 'nope').code,
+    ];
+    assert.deepEqual(seen, [0, 1, 2], 'assess-code.sh: ' + JSON.stringify(seen));
+  });
+
+  test('P8 - assess-tests.sh reaches 1 and 2; its 0 path is proven by the shared footer', () => {
+    // HONEST LIMIT, stated rather than faked. assess-tests.sh RUNS the suite it is pointed at
+    // ("Tests don't even pass", "Tests failed 3/3 times"), so reaching exit 0 needs a real,
+    // installed, passing project — out of reach of a unit fixture. Constructing a fake green here
+    // would be the class of lie this whole file exists to remove.
+    //
+    // What IS proven: both non-zero verdicts from fixtures, and that the exit-0 branch is the SAME
+    // mechanism proven reachable in P7 — the two scripts carry a byte-identical verdict footer, so
+    // demonstrating it in one demonstrates the mechanism in both.
+    const seen = [
+      run(TESTS, { 'target/a.test.js': BAD_TESTS }).code,
+      run(TESTS, {}, 'nope').code,
+    ];
+    assert.deepEqual(seen, [1, 2], 'assess-tests.sh: ' + JSON.stringify(seen));
+
+    const footer = (f) => {
+      const src = fs.readFileSync(f, 'utf-8');
+      const at = src.indexOf('# ── Verdict ─');
+      assert.ok(at > 0, f + ' must carry the verdict footer');
+      return src.slice(at);
+    };
+    assert.equal(footer(TESTS), footer(CODE),
+      'the verdict footer must be identical in both, or P7 proves nothing about this script');
+    assert.match(footer(TESTS), /VERDICT: 0 findings\./,
+      'and the exit-0 branch must exist in it');
+    assert.match(footer(TESTS), /\nexit 0\n?$/, 'ending in the successful exit');
+  });
+});

package/tests/unit/check-docs-complete.test.js

@@ -130,6 +130,49 @@ describe('the cheap question is asked before the swarm is spent', () => {
     }
   });
 
+  test('P16 - a markdown task-list checkbox is NOT a placeholder', () => {
+    // MEASURED against a real completed /replicate project: 17 lines like `- [ ] AC покрыты
+    // автотестами` were reported as "possibly unfilled". Worse, that project's own Completion.md
+    // TEACHES the notation — "флажки [ ] при каждом FR-GROWTH-00N" — so this warning fired on the
+    // convention the pipeline itself prescribes. Noise on a legitimate convention trains people to
+    // ignore warnings, which is the failure this checker exists to prevent, one level down.
+    const withBoxes = '# Specification\n\n'
+      + '- [ ] AC покрыты автотестами\n'
+      + '- [x] События пишутся в аналитику\n'
+      + '* [ ] Anti-fraud сценарий задокументирован\n'
+      + '| `invite_shown` | [ ] | Share-CTA показан в момент первого рендера |\n\n' + REAL;
+    const r = check(complete({ 'Specification.md': withBoxes }));
+    assert.equal(r.code, 0, 'checkboxes must not block: ' + r.out);
+    assert.ok(!/Specification\.md: возможно незаполнено/.test(r.out),
+      'and must not even WARN — a warning on the pipeline own convention is noise: ' + r.out);
+  });
+
+  test('P17 - a real bracketed placeholder on a checkbox LINE is still seen', () => {
+    // The narrowing must not become an escape hatch: skipping the whole line would let a genuine
+    // placeholder hide behind a checkbox prefix.
+    const r = check(complete({
+      'Specification.md': '# Spec\n\n- [ ] [описание критерия приёмки]\n\n' + REAL,
+    }));
+    assert.match(r.out, /возможно незаполнено/,
+      'a bracketed placeholder AFTER a checkbox must still be reported: ' + r.out);
+  });
+
+  test('P18 - Final_Summary.md is reported when absent, and does not block', () => {
+    // MEASURED: the pipeline promises it in three places — replicate.md and two sites in
+    // sparc-prd-mini, including a whole SYNTHESIS phase — and a real completed project produced
+    // 8 of 9 promised documents WITHOUT it. One project is not enough evidence to decide whether
+    // the pipeline is broken or the document is optional in practice, and BLOCKING on it would
+    // have refused every project that ran like that one.
+    // The shared fixture DOES write it, so this case removes it deliberately — the state a real
+    // completed project was measured in.
+    const files = complete();
+    delete files['Final_Summary.md'];
+    const r = check(files);
+    assert.equal(r.code, 0, 'its absence must not block: ' + r.out);
+    assert.match(r.out, /Final_Summary\.md: отсутствует, хотя конвейер его обещает/,
+      'but the discrepancy must be NAMED, not silently tolerated: ' + r.out);
+  });
+
   test('P7 - no docs directory exits 2, and an empty one does too', () => {
     const none = check({}, { noDocs: true });
     assert.equal(none.code, 2, 'nothing to check is not "complete": ' + none.out);

package/tests/unit/check-ports.test.js

@@ -176,6 +176,105 @@ describe('the storage-port rule finally has a check that can fail', () => {
       'a non-storage service with no proxy present is not this rule\'s business: ' + r.out);
   });
 
+  test('P13 — every argument shape resolves in one frame', { skip: !DOCKER }, () => {
+    // The defect: `-f` stayed RELATIVE while the same spawnSync call overrode docker's cwd to the
+    // directory that relative path already named, so docker re-applied the directory component.
+    // MEASURED before the fix: `check-ports.cjs projects/01` from the parent reported
+    // "open /tmp/X/projects/01/projects/01/docker-compose.yml".
+    //
+    // PR-019 diagnosed a project-root join. There is no such join in the file — proven in pure shell:
+    // the SAME `-f projects/01/docker-compose.yml` succeeds from /tmp/X and doubles from
+    // /tmp/X/projects/01. The cwd override IS the mechanism.
+    const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-frame-')));
+    try {
+      const proj = path.join(root, 'projects', '01');
+      fs.mkdirSync(proj, { recursive: true });
+      fs.writeFileSync(path.join(proj, 'docker-compose.yml'),
+        'services:\n  db:\n    image: postgres:16\n');
+      // Every shape in ONE run: a matrix asserted from one side only cannot be told from a constant.
+      const shapes = [
+        ['projects/01', root, 'a bare relative directory — the shape that was broken'],
+        ['./projects/01', root, 'the ./-prefixed form, which path.join normalises identically'],
+        ['projects/01/docker-compose.yml', root, 'a relative path to the file itself'],
+        ['.', proj, 'the documented invocation — worked before only because it is idempotent'],
+        [null, proj, 'no argument at all'],
+        ['../01', proj, 'a sibling-relative path'],
+        [proj, root, 'absolute, from an unrelated cwd'],
+        [proj, proj, 'absolute, from inside'],
+      ];
+      for (const [arg, cwd, why] of shapes) {
+        const argv = arg === null ? [CHECK] : [CHECK, arg];
+        const r = spawnSync(process.execPath, argv, { encoding: 'utf8', cwd });
+        assert.equal(r.status, 0,
+          'shape must resolve (' + why + '): arg=' + JSON.stringify(arg) + ' cwd=' + cwd
+          + ' -> exit ' + r.status + ': ' + (r.stdout || '') + (r.stderr || ''));
+      }
+    } finally { fs.rmSync(root, { recursive: true, force: true }); }
+  });
+
+  test('P14 — run from a PARENT cwd with a relative argument', { skip: !DOCKER }, () => {
+    // The blind spot that let this ship green. Every other case here builds its fixture with
+    // realpathSync(mkdtempSync(...)) and passes it whole — ALWAYS ABSOLUTE — so all 12 tests passed
+    // against the live defect. A regression test that cannot reproduce the bug it guards is not a
+    // guard. This case is the one that could.
+    const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-parent-')));
+    try {
+      const proj = path.join(root, 'projects', '01');
+      fs.mkdirSync(proj, { recursive: true });
+      fs.writeFileSync(path.join(proj, 'docker-compose.yml'),
+        'services:\n  db:\n    image: postgres:16\n    ports: ["5432:5432"]\n');
+      const r = spawnSync(process.execPath, [CHECK, 'projects/01'], { encoding: 'utf8', cwd: root });
+      // A real violation must be REPORTED, not lost behind a path error.
+      assert.equal(r.status, 1, 'expected the published-storage violation: ' + r.stdout + r.stderr);
+      assert.match(r.stdout, /Правило №0/, r.stdout);
+      assert.ok(!/projects\/01\/projects\/01/.test(r.stdout + r.stderr),
+        'the doubled path must be gone: ' + r.stdout + r.stderr);
+    } finally { fs.rmSync(root, { recursive: true, force: true }); }
+  });
+
+  test('P15 — a required variable is reported as itself, not masked', { skip: !DOCKER }, () => {
+    // The defect fired BEFORE docker parsed the file, so a genuine config error came back as
+    // "no such file". Second harm, and the one a user would waste the most time on.
+    const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-mask-')));
+    try {
+      const proj = path.join(root, 'projects', '04');
+      fs.mkdirSync(proj, { recursive: true });
+      fs.writeFileSync(path.join(proj, 'docker-compose.yml'),
+        'services:\n  db:\n    image: postgres:${PGTAG:?PGTAG must be set}\n');
+      const r = spawnSync(process.execPath, [CHECK, 'projects/04'], { encoding: 'utf8', cwd: root });
+      assert.equal(r.status, 2, 'an unreadable config is still exit 2: ' + r.stdout);
+      assert.match(r.stdout, /PGTAG/, 'the REAL cause must reach the user: ' + r.stdout);
+      assert.ok(!/no such file/i.test(r.stdout),
+        'the path error must not stand in for the config error: ' + r.stdout);
+    } finally { fs.rmSync(root, { recursive: true, force: true }); }
+  });
+
+  test('P16 — the spawn overrides no cwd, and the hint neither guesses nor refutes itself', () => {
+    // Structural, so the removed line cannot creep back. MEASURED on Compose v5.1.1: project name,
+    // relative build contexts, .env discovery and env_file are ALL derived from the first -f file's
+    // directory — a .env in the process cwd was not even used as a fallback. The override's only
+    // demonstrated effect in this file's history is the defect.
+    const src = fs.readFileSync(CHECK, 'utf-8');
+    const at = src.indexOf('spawnSync(');
+    const spawnCall = src.slice(at, at + 300);
+    assert.ok(!/cwd:/.test(spawnCall),
+      'the cwd override must be GONE, not neutralised — a provably-useless line still encodes the '
+      + 'false premise that regrows the class: ' + spawnCall);
+    // The guessed cause named an UNREACHABLE case: a plain unset ${VAR} makes compose exit 0.
+    //
+    // Asserted on CODE, not on the file: the fix's own comment QUOTES the removed phrase to explain
+    // why it went, and a whole-file `includes` cannot tell a mention from a use. That is the same
+    // trap this repo has hit repeatedly, and it caught this test on its first run.
+    const code = src.split('\n')
+      .filter((l) => !l.trim().startsWith('//') && !l.trim().startsWith('*') && !l.trim().startsWith('/*'))
+      .join('\n');
+    assert.ok(!code.includes('обычно это незаданная переменная'),
+      'the hint must not name a cause that cannot produce this exit');
+    assert.match(code, /повторить ровно то, что делали мы/,
+      'and the cure must be presented as a reproduction of OUR invocation');
+    assert.match(src, /path\.resolve\(process\.cwd\(\)/,
+      'the argument must be absolutised once, at the boundary');
+  });
   test('P9 — a clean compose exits 0', { skip: !DOCKER }, () => {
     const r = check('services:\n  db:\n    image: postgres:16\n'
       + '  web:\n    image: node:22\n    ports: ["3000:3000"]\n');