@friedbotstudio/create-baseline 0.1.0

package/obj/template/.claude/hooks/swarm_boundary_guard.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+# Swarm Boundary Guard — PreToolUse(Write|Edit|MultiEdit)
+#
+# Enforces the swarm invariant: within an active wave, writes may only touch
+# files that appear in some task's declared write_set. Because write_sets are
+# pairwise disjoint within a wave (enforced by swarm-plan at plan time), any
+# write uniquely maps back to exactly one task — so the guard does not need
+# to identify which agent is writing. It only needs to verify the file is
+# owned by SOMEONE in the active wave.
+#
+# Control file:
+#   .claude/state/swarm/active_wave.json
+# Format:
+#   {
+#     "slug": "<slug>",
+#     "wave": <n>,
+#     "started_at": <epoch>,
+#     "write_sets": [
+#       {"task_id": "T-001", "files": ["src/foo.py", "tests/foo_test.py"]},
+#       ...
+#     ]
+#   }
+#
+# Semantics:
+#   - active_wave.json missing        → not in swarm, allow.
+#   - file path under an exempt prefix → allow (tooling/state/vcs writes).
+#   - file path in enforced prefix and in union(write_sets) → allow.
+#   - file path in enforced prefix and NOT in any write_set  → deny.
+#   - file path NOT in enforced prefix → allow (hook scope is narrow on purpose).
+#
+# Exempt / enforced prefixes come from project.json → swarm.exempt_path_prefixes
+# / swarm.enforced_path_prefixes. Sensible defaults if absent.
+
+# shellcheck source=./lib/common.sh
+. "${BASH_SOURCE[0]%/*}/lib/common.sh"
+read_payload
+
+TOOL="$(payload_get .tool_name)"
+case "$TOOL" in
+  Write|Edit|MultiEdit) ;;
+  *) emit_allow ;;
+esac
+
+FILE="$(payload_get .tool_input.file_path)"
+[ -n "$FILE" ] || emit_allow
+rel="${FILE#$CLAUDE_PROJECT_ROOT/}"
+
+ACTIVE_WAVE="$STATE_DIR/swarm/active_wave.json"
+if [ ! -f "$ACTIVE_WAVE" ]; then
+  # Not in a swarm — guard is dormant.
+  emit_allow
+fi
+
+HOOK_REL="$rel" HOOK_ACTIVE="$ACTIVE_WAVE" HOOK_PROJECT_JSON="$PROJECT_JSON" python3 <<'PY'
+import json, os, sys
+
+rel          = os.environ["HOOK_REL"]
+active_path  = os.environ["HOOK_ACTIVE"]
+pj_path      = os.environ["HOOK_PROJECT_JSON"]
+
+# Load active wave.
+try:
+    active = json.load(open(active_path))
+except Exception as e:
+    # Corrupt active_wave.json — fail CLOSED. If we're inside a swarm we need
+    # this file to be readable; if we can't read it, we cannot safely allow
+    # arbitrary writes.
+    print(json.dumps({
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": (
+                f"Swarm Boundary Guard: active_wave.json exists but could not be parsed ({e}). "
+                "This is a swarm-state corruption — swarm-dispatch must clean up and re-plan."
+            ),
+        }
+    }))
+    sys.exit(0)
+
+# Load config.
+exempt_prefixes = [".claude/", ".git/"]
+enforced_prefixes = None
+try:
+    pj = json.load(open(pj_path))
+    sw = (pj.get("swarm") or {})
+    if isinstance(sw.get("exempt_path_prefixes"), list):
+        exempt_prefixes = sw["exempt_path_prefixes"]
+    if isinstance(sw.get("enforced_path_prefixes"), list):
+        enforced_prefixes = sw["enforced_path_prefixes"]
+except Exception:
+    pass
+
+# Exempt paths (tooling / vcs / deps) — never enforced.
+for p in exempt_prefixes:
+    if rel.startswith(p):
+        sys.exit(0)
+
+# If enforced_prefixes is set, only enforce within those roots.
+# If absent, enforce on everything not exempt.
+if enforced_prefixes is not None:
+    if not any(rel.startswith(p) for p in enforced_prefixes):
+        sys.exit(0)
+
+# Build union of active write_sets.
+write_sets = active.get("write_sets") or []
+owners = {}  # file -> task_id
+for entry in write_sets:
+    tid = entry.get("task_id", "?")
+    for f in (entry.get("files") or []):
+        owners[f] = tid
+
+if rel in owners:
+    sys.exit(0)
+
+# Plan drift: file not owned by any active task in this wave.
+slug = active.get("slug", "?")
+wave = active.get("wave", "?")
+owners_preview = ", ".join(sorted(set(owners.keys()))[:6])
+if len(owners) > 6:
+    owners_preview += f", … ({len(owners)} total)"
+
+msg = (
+    f"Swarm Boundary Guard: write to '{rel}' denied. "
+    f"Swarm '{slug}' wave {wave} is active; no task in this wave owns that file. "
+    f"Files owned by this wave: {owners_preview or '(none)'}. "
+    "Either (a) abort this write, (b) stop the swarm and re-plan so the file is in some task's write_set, "
+    "or (c) if this is a genuinely required file that was missed at plan time, surface it — do not patch mid-wave."
+)
+print(json.dumps({
+    "hookSpecificOutput": {
+        "hookEventName": "PreToolUse",
+        "permissionDecision": "deny",
+        "permissionDecisionReason": msg,
+    }
+}))
+PY

package/obj/template/.claude/hooks/tdd_order_guard.sh

@@ -0,0 +1,176 @@
+#!/usr/bin/env bash
+# TDD Order Guard — PreToolUse(Write)
+#
+# When Claude creates a new source file (first write, file does not exist),
+# require that a corresponding test file already exists. Enforces
+# test-before-source TDD per seed.md § "TDD order guard".
+#
+# Applies only if .tdd.enabled is true in project.json. Skips edits to
+# existing files (TDD ordering applies to file creation, not later edits).
+# Honours source/test/exempt globs from project.json.
+
+# shellcheck source=./lib/common.sh
+. "${BASH_SOURCE[0]%/*}/lib/common.sh"
+read_payload
+
+TOOL="$(payload_get .tool_name)"
+[ "$TOOL" = "Write" ] || emit_allow
+
+enabled="$(project_get .tdd.enabled)"
+[ "$enabled" = "True" ] || [ "$enabled" = "true" ] || emit_allow
+
+FILE="$(payload_get .tool_input.file_path)"
+[ -n "$FILE" ] || emit_allow
+
+# Only apply on file *creation*. If file already exists, it's an edit.
+[ -e "$FILE" ] && emit_allow
+
+# Relative path for glob matching.
+rel="${FILE#$CLAUDE_PROJECT_ROOT/}"
+
+# Exempt patterns (docs, config, .claude itself, etc.).
+if path_matches_globs "$rel" "$(project_get .tdd.exempt_globs)"; then
+  emit_allow
+fi
+
+# Not a source path → nothing to enforce.
+if ! path_matches_globs "$rel" "$(project_get .tdd.source_globs)"; then
+  emit_allow
+fi
+
+# Never gate test files themselves.
+if path_matches_globs "$rel" "$(project_get .tdd.test_globs)"; then
+  emit_allow
+fi
+
+# Look for a corresponding test file. Candidates are derived from
+# `project.json → tdd.test_globs` so customized projects (Go-style
+# `<pkg>_test.go`, Rust `tests/integration.rs`, jest `__tests__/*`,
+# etc.) are honored without code changes here.
+stem="$(basename "$FILE")"
+name="${stem%.*}"
+ext="${stem##*.}"
+dir="$(dirname "$rel")"
+
+# Candidate generation in Python — reads tdd.test_globs and produces
+# combinations of {dir-root × name × suffix/prefix} plus mirrored layout.
+candidates="$(python3 - "$rel" "$CLAUDE_PROJECT_ROOT" <<'PY' 2>/dev/null || true
+import sys, os, re, json, pathlib
+
+rel       = sys.argv[1]
+root      = pathlib.Path(sys.argv[2])
+proj_path = root / ".claude/project.json"
+try:
+    cfg = json.loads(proj_path.read_text(encoding="utf-8"))
+except Exception:
+    cfg = {}
+test_globs = (cfg.get("tdd", {}) or {}).get("test_globs", []) or []
+
+stem = os.path.basename(rel)
+name, _, ext = stem.rpartition(".")
+ext = ext or "py"
+src_dir = os.path.dirname(rel)
+
+# Extension family — when source is .js/.mjs/.cjs, tests may use any of
+# the JS-ESM-family extensions. Same for .ts/.tsx/.mts/.cts. Without this,
+# a .js source whose test is .mjs (a common node:test ESM convention)
+# would fail the existence check and the guard would falsely block.
+JS_FAMILY = {"js", "mjs", "cjs"}
+TS_FAMILY = {"ts", "tsx", "mts", "cts"}
+if ext in JS_FAMILY:
+    ext_variants = list(JS_FAMILY)
+elif ext in TS_FAMILY:
+    ext_variants = list(TS_FAMILY)
+else:
+    ext_variants = [ext]
+
+# Strip a source-root prefix so candidates can mirror the layout under a
+# parallel test-root: src/foo/bar.py → foo/bar.py.
+src_subpath = rel
+for r in ("src/", "lib/", "app/", "pkg/", "internal/"):
+    if rel.startswith(r):
+        src_subpath = rel[len(r):]
+        break
+src_subpath_noext = re.sub(r"\.[^./]+$", "", src_subpath)
+
+suffix_patterns = []   # e.g. "_test", ".test", ".spec" — appended to name
+prefix_patterns = []   # e.g. "test_" — prepended to name
+dir_roots       = []   # e.g. "tests", "test", "spec", "__tests__"
+
+for g in test_globs:
+    # **/*<sep><word>.*    → suffix `<sep><word>`  e.g. "_test", ".test"
+    m = re.match(r"^\*\*/\*([._-][^*/.]+)\.\*$", g)
+    if m:
+        suffix_patterns.append(m.group(1))
+        continue
+    # **/<word>_*.*        → prefix "<word>_"     e.g. "test_*"
+    m = re.match(r"^\*\*/([^*/.]+)_\*\.\*$", g)
+    if m:
+        prefix_patterns.append(m.group(1) + "_")
+        continue
+    # <dir>/**             → directory root
+    m = re.match(r"^([\w._-]+)/\*\*$", g)
+    if m:
+        dir_roots.append(m.group(1))
+        continue
+
+# Backstop conventions for any pattern dimension the configured globs
+# don't cover. The common project.json ships directory globs only
+# (`tests/**` etc.) — without these backstops we'd miss pytest's
+# `test_<name>` prefix and the standard `_test`/`.test`/`.spec` suffixes.
+if not suffix_patterns:
+    suffix_patterns = ["_test", ".test", ".spec"]
+if not prefix_patterns:
+    prefix_patterns = ["test_"]
+if not dir_roots:
+    dir_roots = ["tests", "test", "spec", "__tests__"]
+
+cands = set()
+def add(p): cands.add(p.lstrip("/"))
+
+# Co-located beside the source file (across extension family)
+for e in ext_variants:
+    for s in suffix_patterns:
+        add(f"{src_dir}/{name}{s}.{e}")
+    for p in prefix_patterns:
+        add(f"{src_dir}/{p}{name}.{e}")
+
+# Under each dir-root: stem-based + mirrored-layout (across extension family)
+for d in dir_roots:
+    add(f"{d}/{src_subpath}")           # mirror layout: tests/foo/bar.py
+    for e in ext_variants:
+        add(f"{d}/{name}.{e}")          # plain stem (Rust-like)
+        for s in suffix_patterns:
+            add(f"{d}/{name}{s}.{e}")
+            add(f"{d}/{src_subpath_noext}{s}.{e}")
+        for p in prefix_patterns:
+            add(f"{d}/{p}{name}.{e}")
+            add(f"{d}/{p}{src_subpath_noext}.{e}")
+
+# Co-located inside __tests__-style subdirs (Jest)
+for d in dir_roots:
+    if d.startswith("_") or d == "__tests__":
+        for e in ext_variants:
+            for s in suffix_patterns:
+                add(f"{src_dir}/{d}/{name}{s}.{e}")
+
+print("\n".join(sorted(cands)))
+PY
+)"
+
+found=""
+while IFS= read -r c; do
+  [ -z "$c" ] && continue
+  if [ -f "$CLAUDE_PROJECT_ROOT/$c" ]; then
+    found="$c"
+    break
+  fi
+done <<< "$candidates"
+
+if [ -n "$found" ]; then
+  log_line tdd_order_guard "ALLOWED test exists: $found for $rel"
+  emit_allow
+fi
+
+log_line tdd_order_guard "BLOCKED no test for: $rel"
+emit_block "TDD Order Guard: no test file found for new source '$rel'. Write the failing test first. Candidates were derived from project.json → tdd.test_globs (e.g. tests/${name}_test.${ext}, ${dir}/${name}_test.${ext}, tests/${src_subpath_noext:-${name}}.${ext}). If this file truly has no tests by design, add the path to .tdd.exempt_globs in .claude/project.json."

package/obj/template/.claude/hooks/test_runner.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Test Runner hook — PostToolUse(Edit|Write|MultiEdit)
+#
+# Runs the project-configured test command against the changed file's
+# affected tests. This is a GUIDE hook: until `.claude/project.json`
+# declares `test.cmd`, it emits guidance pointing at `/init-project` rather
+# than failing. Once configured, it executes the command and surfaces
+# failures as stderr info (PostToolUse cannot block the edit that already
+# happened, but it surfaces test failures immediately so Claude reacts).
+#
+# Projects are free to replace this script entirely with their own logic.
+
+# shellcheck source=./lib/common.sh
+. "${BASH_SOURCE[0]%/*}/lib/common.sh"
+read_payload
+
+TOOL="$(payload_get .tool_name)"
+case "$TOOL" in
+  Edit|Write|MultiEdit) ;;
+  *) emit_allow ;;
+esac
+
+FILE="$(payload_get .tool_input.file_path)"
+[ -n "$FILE" ] || emit_allow
+rel="${FILE#$CLAUDE_PROJECT_ROOT/}"
+
+# Skip obviously non-code changes.
+case "$rel" in
+  *.md|*.json|*.yaml|*.yml|*.toml|*.txt|docs/*|.claude/*|.config/*) emit_allow ;;
+esac
+
+configured="$(project_get .configured)"
+cmd="$(project_get .test.cmd)"
+
+if [ "$configured" != "True" ] && [ "$configured" != "true" ]; then
+  emit_info "Test Runner: .claude/project.json is not configured yet. Run \`/init-project\` to declare the test command for this repo. (Skipping test run for '$rel'.)"
+  emit_allow
+fi
+
+if [ -z "$cmd" ] || [ "$cmd" = "None" ]; then
+  emit_info "Test Runner: no .test.cmd set in .claude/project.json. Skipping tests for '$rel'."
+  emit_allow
+fi
+
+# Resolve affected tests. If a custom resolver is configured, delegate to it;
+# otherwise pass the changed file path and let the test command decide.
+resolver="$(project_get .test.affected_resolver)"
+affected=""
+if [ -n "$resolver" ] && [ "$resolver" != "None" ]; then
+  if [ -x "$CLAUDE_PROJECT_ROOT/$resolver" ]; then
+    affected="$("$CLAUDE_PROJECT_ROOT/$resolver" "$rel" 2>/dev/null || true)"
+  else
+    emit_info "Test Runner: affected_resolver '$resolver' not found or not executable."
+  fi
+fi
+
+timeout_s="$(project_get .test.timeout_seconds)"
+[ -z "$timeout_s" ] && timeout_s=120
+
+# Compose final command. {file} and {affected} placeholders are substituted.
+final="${cmd//\{file\}/$rel}"
+final="${final//\{affected\}/$affected}"
+
+emit_info "Test Runner: running \`$final\` (timeout ${timeout_s}s)"
+out="$(cd "$CLAUDE_PROJECT_ROOT" && timeout "${timeout_s}s" bash -lc "$final" 2>&1)"
+rc=$?
+if [ $rc -ne 0 ]; then
+  log_line test_runner "FAIL rc=$rc cmd=$final"
+  emit_info "Test Runner: FAILED (exit $rc) — output:"
+  emit_info "$out"
+  exit 2
+fi
+
+log_line test_runner "PASS cmd=$final"
+emit_allow

package/obj/template/.claude/hooks/tests/fixtures/ac008_byte_equal_reference.txt

@@ -0,0 +1,12 @@
+## Project memory — index (.claude/memory/)
+
+HEAD: `n/a`  ·  total entries: 32  ·  stale (>=30 commits old): 0
+
+| File | Entries | Stale | Status |
+|---|---:|---:|---|
+| `landmarks.md` | 19 | 0 | ok |
+| `libraries.md` | 3 | 0 | ok |
+| `decisions.md` | 1 | 0 | ok |
+| `landmines.md` | 5 | 0 | ok |
+| `conventions.md` | 3 | 0 | ok |
+| `pending-questions.md` | 1 | 0 | ok |

package/obj/template/.claude/hooks/tests/memory_session_start_test.sh

@@ -0,0 +1,285 @@
+#!/usr/bin/env bash
+# Fixture-based integration tests for memory_session_start.sh
+# Covers AC-003, AC-005, AC-007, AC-008 from docs/specs/memory-lifecycle-closure.md
+#
+# Each test builds a synthetic .claude/memory/ tree under a tempdir, invokes
+# the hook with PROJECT_ROOT pointed at that tempdir, and asserts on the
+# emitted additionalContext JSON.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "$HERE/../../.." && pwd)"
+HOOK="$REPO_ROOT/.claude/hooks/memory_session_start.sh"
+FIXTURES="$HERE/fixtures"
+
+PASS=0; FAIL=0; FAILED=()
+
+# --- assertion helpers --------------------------------------------------------
+
+fail() { echo "  FAIL: $*"; return 1; }
+
+assert_contains() {
+  local haystack="$1" needle="$2" msg="$3"
+  case "$haystack" in
+    *"$needle"*) return 0 ;;
+    *) fail "$msg :: expected to contain: $needle" ;;
+  esac
+}
+
+assert_not_contains() {
+  local haystack="$1" needle="$2" msg="$3"
+  case "$haystack" in
+    *"$needle"*) fail "$msg :: should NOT contain: $needle" ;;
+    *) return 0 ;;
+  esac
+}
+
+# Run the hook against a project root. $1 = project root containing .claude/memory/.
+# Prints the parsed additionalContext to stdout. Returns 1 if hook crashed.
+run_hook() {
+  local proj="$1"
+  CLAUDE_PROJECT_DIR="$proj" \
+    bash "$HOOK" <<< '{}' 2>/dev/null | python3 -c '
+import json, sys
+data = sys.stdin.read().strip()
+if not data:
+    sys.exit(2)
+j = json.loads(data)
+print(j["hookSpecificOutput"]["additionalContext"])
+'
+}
+
+# Build a minimal synthetic memory tree. $1 = root.
+seed_tree() {
+  local root="$1"
+  mkdir -p "$root/.claude/memory" "$root/.claude/state/harness"
+  # Frontmatter-only files so hook reports 0 entries unless we add ## blocks.
+  for f in landmarks libraries decisions landmines conventions pending-questions; do
+    cat > "$root/.claude/memory/$f.md" <<'EOF'
+---
+owners: [test]
+size-cap: 500
+key: test
+---
+
+# Test fixture
+EOF
+  done
+  # Minimal _pending.md so the hook does not emit the nag by accident.
+  cat > "$root/.claude/memory/_pending.md" <<'EOF'
+---
+owners: [test]
+---
+
+# Pending
+EOF
+}
+
+# Add an entry block to a canonical file. $1 root, $2 file basename, $3 entry body.
+add_entry() {
+  local root="$1" file="$2"; shift 2
+  printf '\n%s\n' "$*" >> "$root/.claude/memory/$file.md"
+}
+
+# Compute an ISO date N days ago (portable: GNU or BSD date).
+days_ago() {
+  local n="$1"
+  if date -u -d "$n days ago" +%Y-%m-%d 2>/dev/null; then return; fi
+  date -u -v "-${n}d" +%Y-%m-%d
+}
+
+run() {
+  local name="$1"
+  echo "RUN  $name"
+  if "$name"; then
+    PASS=$((PASS+1)); echo "PASS $name"
+  else
+    FAIL=$((FAIL+1)); FAILED+=("$name"); echo "FAIL $name"
+  fi
+}
+
+# --- tests --------------------------------------------------------------------
+
+test_when_7_entries_stale_then_top_5_listed_oldest_first() {
+  local tmp; tmp="$(mktemp -d)"; trap "rm -rf $tmp" RETURN
+  seed_tree "$tmp"
+  # 7 entries across 3 files with ages 100/95/90/50/40/30/5 days, no closure fields.
+  local i=0
+  for spec in "landmarks:lm-a:100" "landmarks:lm-b:95" "libraries:lib-a:90" \
+              "libraries:lib-b:50" "decisions:dec-a:40" "decisions:dec-b:30" \
+              "conventions:conv-a:5"; do
+    local file="${spec%%:*}" key key_age age
+    key="$(echo "$spec" | cut -d: -f2)"
+    age="${spec##*:}"
+    add_entry "$tmp" "$file" "## $key
+
+- role: test
+- verified-at: HEAD
+- last-touched: $(days_ago "$age")"
+    i=$((i+1))
+  done
+  local out; out="$(run_hook "$tmp")"
+  assert_contains "$out" "## Stale entries" "AC-003 stale block missing" || return 1
+  # The 5 oldest by last-touched are 100/95/90/50/40 → lm-a lm-b lib-a lib-b dec-a.
+  for k in lm-a lm-b lib-a lib-b dec-a; do
+    assert_contains "$out" "$k" "AC-003 expected key $k in stale block" || return 1
+  done
+  # 30-day-old entry IS stale (>=30 day threshold for non-git), but only top 5 listed.
+  # conv-a (5 days) is not stale; should be absent from the block.
+  # With 6 stale entries total, the 6th (dec-b) should appear via overflow.
+  assert_contains "$out" "and 1 more" "AC-003 overflow indicator missing" || return 1
+  assert_not_contains "$out" "## conv-a" "AC-003 non-stale should not appear in block" || return 1
+}
+
+test_when_8_stale_then_overflow_indicator_shows_3_more() {
+  local tmp; tmp="$(mktemp -d)"; trap "rm -rf $tmp" RETURN
+  seed_tree "$tmp"
+  # 8 stale entries, ages 200..130 by 10s.
+  local i=0
+  for age in 200 190 180 170 160 150 140 130; do
+    add_entry "$tmp" "landmarks" "## ent-$i
+
+- role: test
+- verified-at: HEAD
+- last-touched: $(days_ago "$age")"
+    i=$((i+1))
+  done
+  local out; out="$(run_hook "$tmp")"
+  assert_contains "$out" "## Stale entries" "AC-003 stale block missing" || return 1
+  assert_contains "$out" "and 3 more" "AC-003 expected overflow '… and 3 more'" || return 1
+}
+
+test_when_5_stale_with_identical_last_touched_then_alphabetical_by_file_colon_key() {
+  local tmp; tmp="$(mktemp -d)"; trap "rm -rf $tmp" RETURN
+  seed_tree "$tmp"
+  local d; d="$(days_ago 120)"
+  # Place entries across files in non-alphabetical insertion order; expect
+  # alphabetical-by-file:key in the rendered block.
+  add_entry "$tmp" "landmines" "## zeta
+
+- role: test
+- verified-at: HEAD
+- last-touched: $d"
+  add_entry "$tmp" "landmarks" "## alpha
+
+- role: test
+- verified-at: HEAD
+- last-touched: $d"
+  add_entry "$tmp" "decisions" "## kappa
+
+- role: test
+- verified-at: HEAD
+- last-touched: $d"
+  add_entry "$tmp" "libraries" "## beta
+
+- role: test
+- verified-at: HEAD
+- last-touched: $d"
+  add_entry "$tmp" "conventions" "## mu
+
+- role: test
+- verified-at: HEAD
+- last-touched: $d"
+  local out; out="$(run_hook "$tmp")"
+  # Expected lexicographic order of "<file>:<key>":
+  #   conventions:mu < decisions:kappa < landmarks:alpha < landmines:zeta < libraries:beta
+  # Find the first appearance position of each key in the stale block.
+  local block; block="$(printf '%s\n' "$out" | awk '/## Stale entries/{flag=1;next}/^## /{flag=0}flag')"
+  local order; order="$(printf '%s\n' "$block" | grep -oE '(alpha|beta|kappa|mu|zeta)' | head -5 | tr '\n' ' ')"
+  assert_contains " $order" " mu kappa alpha zeta beta " "AC-003 alphabetical-by-file:key order wrong: got [$order]" || return 1
+}
+
+test_when_closure_field_and_stale_sha_then_not_counted_stale() {
+  local tmp; tmp="$(mktemp -d)"; trap "rm -rf $tmp" RETURN
+  seed_tree "$tmp"
+  # Entry stale by date but carries resolved-at on pending-questions → MUST be excluded.
+  add_entry "$tmp" "pending-questions" "## Q-999
+
+- Question: stub
+- verified-at: HEAD
+- last-touched: $(days_ago 200)
+- resolved-at: $(days_ago 1)"
+  # Plus a normal stale entry on landmarks (no closure) → still counted.
+  add_entry "$tmp" "landmarks" "## still-open
+
+- role: test
+- verified-at: HEAD
+- last-touched: $(days_ago 200)"
+  local out; out="$(run_hook "$tmp")"
+  assert_not_contains "$out" "Q-999" "AC-005 closed entry must not appear in stale block" || return 1
+  # Header count must be 1, not 2.
+  if printf '%s\n' "$out" | grep -qE 'stale \(>=30 commits old\): 1\b'; then :; else
+    fail "AC-005 expected stale count 1 in header"
+    return 1
+  fi
+  assert_contains "$out" "still-open" "AC-005 sanity: unclosed stale entry should appear" || return 1
+}
+
+test_when_audit_runs_against_changed_repo_then_exit_0() {
+  ( cd "$REPO_ROOT" && bash .claude/skills/audit-baseline/audit.sh >/dev/null 2>&1 ) \
+    || { fail "AC-007 audit exited non-zero"; return 1; }
+}
+
+test_when_hook_runs_unchanged_tree_then_header_and_table_byte_equal() {
+  # Run hook against the real repo memory tree and compare header+table to
+  # the captured pre-spec reference.
+  local out; out="$(run_hook "$REPO_ROOT")"
+  local actual_block
+  actual_block="$(printf '%s\n' "$out" | python3 -c '
+import sys
+lines = sys.stdin.read().split("\n")
+started = False
+out = []
+for ln in lines:
+    if ln.startswith("## Project memory"):
+        started = True
+    if not started:
+        continue
+    out.append(ln)
+    if ln.startswith("| `pending-questions.md`"):
+        break
+sys.stdout.write("\n".join(out) + "\n")
+')"
+  local expected; expected="$(cat "$FIXTURES/ac008_byte_equal_reference.txt")"
+  if [ "$actual_block" = "$expected" ]; then return 0; fi
+  fail "AC-008 header+table not byte-equal"
+  diff <(printf '%s' "$expected") <(printf '%s' "$actual_block") || true
+  return 1
+}
+
+test_when_old_resume_snapshot_reinjected_then_hook_does_not_crash() {
+  local tmp; tmp="$(mktemp -d)"; trap "rm -rf $tmp" RETURN
+  seed_tree "$tmp"
+  # Old _resume.md from a pre-spec session — minimal body, no new index format.
+  cat > "$tmp/.claude/memory/_resume.md" <<'EOF'
+---
+written_at: 2026-04-30T12:00:00Z
+---
+
+# Resume snapshot (legacy)
+Last phase: spec
+EOF
+  local out
+  out="$(run_hook "$tmp")" || { fail "AC-008 hook crashed on legacy _resume"; return 1; }
+  assert_contains "$out" "## Project memory" "AC-008 expected index header still present" || return 1
+  assert_contains "$out" "Resume snapshot (legacy)" "AC-008 legacy body should be appended" || return 1
+}
+
+# --- runner -------------------------------------------------------------------
+
+run test_when_7_entries_stale_then_top_5_listed_oldest_first
+run test_when_8_stale_then_overflow_indicator_shows_3_more
+run test_when_5_stale_with_identical_last_touched_then_alphabetical_by_file_colon_key
+run test_when_closure_field_and_stale_sha_then_not_counted_stale
+run test_when_audit_runs_against_changed_repo_then_exit_0
+run test_when_hook_runs_unchanged_tree_then_header_and_table_byte_equal
+run test_when_old_resume_snapshot_reinjected_then_hook_does_not_crash
+
+echo "----"
+echo "Passed: $PASS  Failed: $FAIL"
+if [ "$FAIL" -gt 0 ]; then
+  echo "Failed tests:"
+  for t in "${FAILED[@]}"; do echo "  - $t"; done
+fi
+exit $((FAIL > 0))