@ktpartners/dgs-platform 3.0.4 → 3.3.1

package/deliver-great-systems/bin/lib/core.test.cjs

@@ -24,6 +24,8 @@ const {
   loadConfig,
   isProjectCompleted,
   getProjectDir,
+  resolveModelInternal,
+  MODEL_PROFILES,
 } = require('./core.cjs');
 
 // ─── Root layout (no v2 markers) Tests ───────────────────────────────────────
@@ -388,7 +390,9 @@ describe('getProjectFolders', () => {
     const fixture = createFixture({
       'config.json': JSON.stringify({}),
       'PROJECTS.md': '# Projects\n',
+      'projects/auth-overhaul/PROJECT.md': '# Project\n',
       'projects/auth-overhaul/STATE.md': '# State',
+      'projects/dashboard-v2/PROJECT.md': '# Project\n',
       'projects/dashboard-v2/STATE.md': '# State',
       'phases/': null,
       'codebase/': null,
@@ -404,10 +408,11 @@ describe('getProjectFolders', () => {
     }
   });
 
-  it('only includes directories containing STATE.md', () => {
+  it('only includes directories containing PROJECT.md', () => {
     const fixture = createFixture({
       'config.json': JSON.stringify({}),
       'PROJECTS.md': '# Projects\n',
+      'projects/valid-project/PROJECT.md': '# Project\n',
       'projects/valid-project/STATE.md': '# State',
       'projects/empty-folder/': null,
     });
@@ -420,10 +425,43 @@ describe('getProjectFolders', () => {
     }
   });
 
+  it('returns thin-skeleton project folder containing PROJECT.md but no STATE.md', () => {
+    const fixture = createFixture({
+      'config.json': JSON.stringify({}),
+      'PROJECTS.md': '# Projects\n',
+      'projects/word-gen/PROJECT.md': '# Project: Word Gen\n',
+    });
+
+    try {
+      const result = getProjectFolders(fixture.cwd);
+      assert.deepEqual(result, ['word-gen']);
+    } finally {
+      fixture.cleanup();
+    }
+  });
+
+  it('excludes directory with neither PROJECT.md nor STATE.md', () => {
+    const fixture = createFixture({
+      'config.json': JSON.stringify({}),
+      'PROJECTS.md': '# Projects\n',
+      'projects/empty-folder/': null,
+      'projects/real-project/PROJECT.md': '# Project\n',
+    });
+
+    try {
+      const result = getProjectFolders(fixture.cwd);
+      assert.deepEqual(result, ['real-project']);
+    } finally {
+      fixture.cleanup();
+    }
+  });
+
   it('excludes dot-directories', () => {
     const fixture = createFixture({
       'config.json': JSON.stringify({}),
+      'projects/.hidden/PROJECT.md': '# Project\n',
       'projects/.hidden/STATE.md': '# State',
+      'projects/real-project/PROJECT.md': '# Project\n',
       'projects/real-project/STATE.md': '# State',
     });
 
@@ -745,6 +783,7 @@ describe('root layout', () => {
       'config.json': JSON.stringify({}),
       'PROJECTS.md': '# Projects\n',
       'REPOS.md': '# Repos\n',
+      'projects/proj-a/PROJECT.md': '# Project\n',
       'projects/proj-a/STATE.md': '# State\n',
       'projects/proj-a/phases/': null,
     });
@@ -837,3 +876,42 @@ describe('config two-file merge', () => {
   });
 
 });
+
+// ─── MODEL_PROFILES dgs-idea-researcher tiering ──────────────────────────────
+
+describe('MODEL_PROFILES dgs-idea-researcher tiering', () => {
+  let fixture;
+
+  afterEach(() => {
+    if (fixture) fixture.cleanup();
+    fixture = null;
+  });
+
+  it('MODEL_PROFILES table contains dgs-idea-researcher with quality/balanced/budget tiers', () => {
+    const profile = MODEL_PROFILES['dgs-idea-researcher'];
+    assert.ok(profile, 'MODEL_PROFILES[\'dgs-idea-researcher\'] should be defined');
+    assert.equal(typeof profile.quality, 'string', 'quality tier present');
+    assert.equal(typeof profile.balanced, 'string', 'balanced tier present');
+    assert.equal(typeof profile.budget, 'string', 'budget tier present');
+  });
+
+  it('resolveModelInternal returns inherit for dgs-idea-researcher on quality profile', () => {
+    fixture = createTempProject({ withConfig: { model_profile: 'quality' } });
+    const resolved = resolveModelInternal(fixture.cwd, 'dgs-idea-researcher');
+    // Per core.cjs: when the resolved tier is 'opus', the function returns 'inherit'.
+    assert.equal(resolved, 'inherit');
+  });
+
+  it('resolveModelInternal returns sonnet for dgs-idea-researcher on balanced profile', () => {
+    fixture = createTempProject({ withConfig: { model_profile: 'balanced' } });
+    const resolved = resolveModelInternal(fixture.cwd, 'dgs-idea-researcher');
+    assert.equal(resolved, 'sonnet');
+  });
+
+  it('resolveModelInternal returns haiku for dgs-idea-researcher on budget profile', () => {
+    fixture = createTempProject({ withConfig: { model_profile: 'budget' } });
+    const resolved = resolveModelInternal(fixture.cwd, 'dgs-idea-researcher');
+    assert.equal(resolved, 'haiku');
+  });
+
+});

package/deliver-great-systems/bin/lib/docs.cjs

@@ -14,6 +14,7 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { spawnSync } = require('child_process');
 const { safeReadFile, execGit, generateSlugInternal, output, error } = require('./core.cjs');
 const { getPlanningRoot } = require('./paths.cjs');
 const { findIdeaFile } = require('./ideas.cjs');
@@ -129,10 +130,11 @@ function extractText(filePath, ext) {
       try {
         const pdfParse = require('pdf-parse');
         const buffer = fs.readFileSync(filePath);
-        // pdf-parse returns a promise; we use execSync workaround for sync context
-        // Instead, we'll use a sync extraction approach
+        // pdf-parse returns a promise; run it in a child node process via
+        // spawnSync so the parent can stay synchronous. spawnSync (not
+        // execSync with a shell-built command) is required on Windows where
+        // cmd.exe applies different quoting rules.
         let result = null;
-        const { execSync } = require('child_process');
         const script = `
           const pdfParse = require('pdf-parse');
           const fs = require('fs');
@@ -143,12 +145,15 @@ function extractText(filePath, ext) {
             process.stdout.write(JSON.stringify({ error: err.message }));
           });
         `;
-        const out = execSync(`node -e ${JSON.stringify(script)}`, {
+        const r = spawnSync('node', ['-e', script], {
           encoding: 'utf-8',
           timeout: 30000,
           stdio: ['pipe', 'pipe', 'pipe'],
         });
-        result = JSON.parse(out.trim());
+        if (r.status !== 0) {
+          return { text: null, error: `PDF extraction failed: ${r.stderr || r.error?.message || 'unknown'}` };
+        }
+        result = JSON.parse(r.stdout.trim());
         if (result.error) {
           return { text: null, error: result.error };
         }
@@ -160,7 +165,6 @@ function extractText(filePath, ext) {
 
     if (ext === '.xlsx') {
       try {
-        const { execSync } = require('child_process');
         const script = `
           const ExcelJS = require('exceljs');
           const workbook = new ExcelJS.Workbook();
@@ -178,11 +182,15 @@ function extractText(filePath, ext) {
             process.stdout.write(JSON.stringify({ error: err.message }));
           });
         `;
-        const out = execSync(`node -e ${JSON.stringify(script)}`, {
+        const r = spawnSync('node', ['-e', script], {
           encoding: 'utf-8',
           timeout: 30000,
-        }).trim();
-        const parsed = JSON.parse(out);
+          stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        if (r.status !== 0) {
+          return { text: null, error: `XLSX extraction failed: ${r.stderr || r.error?.message || 'unknown'}` };
+        }
+        const parsed = JSON.parse(r.stdout.trim());
         if (parsed.error) return { text: null, error: parsed.error };
         return { text: parsed.text, error: null };
       } catch (e) {
@@ -202,7 +210,6 @@ function extractText(filePath, ext) {
     if (ext === '.docx') {
       try {
         const mammoth = require('mammoth');
-        const { execSync } = require('child_process');
         const script = `
           const mammoth = require('mammoth');
           mammoth.extractRawText({ path: ${JSON.stringify(filePath)} })
@@ -213,12 +220,15 @@ function extractText(filePath, ext) {
               process.stdout.write(JSON.stringify({ error: err.message }));
             });
         `;
-        const out = execSync(`node -e ${JSON.stringify(script)}`, {
+        const r = spawnSync('node', ['-e', script], {
           encoding: 'utf-8',
           timeout: 30000,
           stdio: ['pipe', 'pipe', 'pipe'],
         });
-        const result = JSON.parse(out.trim());
+        if (r.status !== 0) {
+          return { text: null, error: `DOCX extraction failed: ${r.stderr || r.error?.message || 'unknown'}` };
+        }
+        const result = JSON.parse(r.stdout.trim());
         if (result.error) {
           return { text: null, error: result.error };
         }

package/deliver-great-systems/bin/lib/fast-routing.cjs

@@ -0,0 +1,199 @@
+// deliver-great-systems/bin/lib/fast-routing.cjs
+//
+// REL-05/06: Fast-mode commit routing helpers for /dgs:fast.
+//
+// Exports:
+//   surveyDirty(planningRoot) -> { planningRoot: { dirty, paths }, subRepos: [{ name, path, dirty, paths }], submodules: [{ path, dirty }] }
+//   decideRouting(survey) -> { action: 'route-to-planning-root'|'route-to-sub-repo'|'fail', repoCwd?, exitCode?, warnings?: [string], message?: string }
+//   enumerateSubmodules(repoPath) -> [{ path, dirty }]
+//
+// REL-05: decideRouting routes commits to the correct repo on multi-repo products.
+// REL-06: surveyDirty + a thin pre-edit caller (in dgs-tools dispatcher) implements pre-edit dirt check.
+//
+// Both helpers honour the fail-loudly contract: surveyDirty returns structured data;
+// decideRouting names the exit-code label (`multi-repo-dirt`) and includes a 1-3 line
+// remediation message suitable for direct display.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execGit } = require('./core.cjs');
+
+// Inline REPOS.md parser — does NOT use repos.cjs's parseReposMd because that
+// helper goes through getPlanningRoot() which has a per-process cache that
+// breaks tests using multiple temp planning roots in the same process.
+function parseReposMdLocal(planningRoot) {
+  const filePath = path.join(planningRoot, 'REPOS.md');
+  let content;
+  try {
+    content = fs.readFileSync(filePath, 'utf-8');
+  } catch {
+    return { repos: [] };
+  }
+  if (!content || !content.startsWith('# Repos')) return { repos: [] };
+  const lines = content.split('\n');
+  let tableStart = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i].startsWith('|') && lines[i].includes('Name')) { tableStart = i; break; }
+  }
+  if (tableStart === -1) return { repos: [] };
+  const repos = [];
+  for (let i = tableStart + 2; i < lines.length; i++) {
+    const line = lines[i].trim();
+    if (!line.startsWith('|')) break;
+    const cells = line.split('|').map(c => c.trim()).filter((_, idx, arr) => idx > 0 && idx < arr.length - 1);
+    if (cells.length < 2) continue;
+    const [name, p] = cells;
+    if (!name || !p) continue;
+    repos.push({ name, path: p });
+  }
+  return { repos };
+}
+
+function readConfigLocalJson(planningRoot) {
+  const cfgPath = path.join(planningRoot, 'config.local.json');
+  if (!fs.existsSync(cfgPath)) return {};
+  try {
+    return JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
+  } catch {
+    return {};
+  }
+}
+
+function enumerateRegisteredRepos(planningRoot) {
+  const seen = new Map(); // absolute path -> { name, path }
+
+  // Source 1: REPOS.md (inline parser, bypassing repos.cjs cache)
+  const reposMd = parseReposMdLocal(planningRoot);
+  for (const r of (reposMd.repos || [])) {
+    const abs = path.resolve(planningRoot, r.path);
+    if (!seen.has(abs)) seen.set(abs, { name: r.name, path: abs });
+  }
+
+  // Source 2: config.local.json projects.*.worktrees.*.repos (map of name -> absolute path)
+  const cfg = readConfigLocalJson(planningRoot);
+  const projects = (cfg.projects || {});
+  for (const proj of Object.values(projects)) {
+    const wts = (proj.worktrees || {});
+    for (const wt of Object.values(wts)) {
+      const repos = (wt.repos || {});
+      for (const [name, abs] of Object.entries(repos)) {
+        if (typeof abs !== 'string') continue;
+        const resolved = path.resolve(abs);
+        if (!seen.has(resolved)) seen.set(resolved, { name, path: resolved });
+      }
+    }
+  }
+
+  return Array.from(seen.values());
+}
+
+function isGitRepo(p) {
+  try {
+    const res = execGit(p, ['rev-parse', '--is-inside-work-tree']);
+    if (!res || res.exitCode !== 0) return false;
+    return typeof res.stdout === 'string' && res.stdout.trim() === 'true';
+  } catch {
+    return false;
+  }
+}
+
+function porcelainPaths(repoPath) {
+  if (!isGitRepo(repoPath)) return null;
+  let out = '';
+  try {
+    const res = execGit(repoPath, ['status', '--porcelain']);
+    out = (res && res.stdout) || '';
+  } catch {
+    out = '';
+  }
+  // git status --porcelain format: "XY <path>" where XY is a 2-char status code
+  // Strip the 2-char status + 1 space; trim and filter empties.
+  return out
+    .split('\n')
+    .map(l => l.replace(/^.{2,3}/, '').trim())
+    .filter(Boolean);
+}
+
+function enumerateSubmodules(repoPath) {
+  if (!isGitRepo(repoPath)) return [];
+  let out = '';
+  try {
+    const res = execGit(repoPath, ['submodule', 'status']);
+    out = (res && res.stdout) || '';
+  } catch {
+    out = '';
+  }
+  return out
+    .split('\n')
+    .filter(Boolean)
+    .map(line => {
+      // Format: ` <sha> <path> (<ref>)` — leading char `+` (mismatch),
+      // `-` (uninitialised), ` ` (clean), `U` (conflict)
+      const lead = line[0];
+      const match = line.trim().match(/^[+\- U]?\w+\s+(\S+)/);
+      return {
+        path: match ? match[1] : line.trim(),
+        dirty: Boolean(lead && lead !== ' '),
+      };
+    });
+}
+
+function surveyDirty(planningRoot) {
+  const planningPaths = porcelainPaths(planningRoot) || [];
+  const planningRootEntry = { dirty: planningPaths.length > 0, paths: planningPaths };
+
+  const subRepos = [];
+  for (const repo of enumerateRegisteredRepos(planningRoot)) {
+    if (path.resolve(repo.path) === path.resolve(planningRoot)) continue; // skip if same dir
+    const paths = porcelainPaths(repo.path) || [];
+    subRepos.push({ name: repo.name, path: repo.path, dirty: paths.length > 0, paths });
+  }
+
+  const submodules = enumerateSubmodules(planningRoot);
+
+  return { planningRoot: planningRootEntry, subRepos, submodules };
+}
+
+function decideRouting(survey) {
+  const warnings = [];
+  const dirtySubmodules = (survey.submodules || []).filter(s => s.dirty);
+  for (const sm of dirtySubmodules) {
+    warnings.push(
+      `submodule changes detected at ${sm.path}; auto-routing not supported for submodules — commit manually or use /dgs:quick`
+    );
+  }
+
+  const planningRoot = survey.planningRoot || { dirty: false };
+  const subRepos = survey.subRepos || [];
+  const dirtySubRepos = subRepos.filter(r => r.dirty);
+
+  // Case (c): multiple sub-repos dirty OR planning + at least one sub-repo dirty
+  if (dirtySubRepos.length > 1 || (dirtySubRepos.length >= 1 && planningRoot.dirty)) {
+    return {
+      action: 'fail',
+      exitCode: 'multi-repo-dirt',
+      message:
+        'Multiple repos have dirty changes — fast-mode cannot auto-route. Review state with `git status` in each repo, run `/dgs:fast --repo <name>` per repo, or use `/dgs:quick` for multi-repo work.',
+      warnings,
+    };
+  }
+
+  // Case (a): exactly one sub-repo dirty + planning clean
+  if (dirtySubRepos.length === 1 && !planningRoot.dirty) {
+    return {
+      action: 'route-to-sub-repo',
+      repoCwd: dirtySubRepos[0].path,
+      warnings,
+    };
+  }
+
+  // Case (b): only planning root dirty (or nothing dirty — same code path)
+  return { action: 'route-to-planning-root', warnings };
+}
+
+module.exports = {
+  surveyDirty,
+  decideRouting,
+  enumerateSubmodules,
+  enumerateRegisteredRepos,
+};

package/deliver-great-systems/bin/lib/fast-routing.test.cjs

@@ -0,0 +1,108 @@
+// deliver-great-systems/bin/lib/fast-routing.test.cjs
+// REL-05/06 regression test scaffold — initially RED. Turns GREEN after plan 03
+// implements bin/lib/fast-routing.cjs with surveyDirty + decideRouting helpers.
+
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const { execSync } = require('node:child_process');
+
+function getModule() {
+  try {
+    return require('./fast-routing.cjs');
+  } catch (err) {
+    assert.fail('REL-05/06 module not yet implemented: bin/lib/fast-routing.cjs (plan 03 task)');
+  }
+}
+
+function setupMultiRepoFixture() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'fast-routing-'));
+  execSync('git init -q', { cwd: root });
+  execSync('git config user.email test@test', { cwd: root });
+  execSync('git config user.name test', { cwd: root });
+  const subRepo = path.join(root, '..', `fast-routing-sub-${path.basename(root)}`);
+  fs.mkdirSync(subRepo);
+  execSync('git init -q', { cwd: subRepo });
+  execSync('git config user.email test@test', { cwd: subRepo });
+  execSync('git config user.name test', { cwd: subRepo });
+  fs.writeFileSync(
+    path.join(root, 'REPOS.md'),
+    `# Repos\n\n| Name | Path | GitHub URL | Description |\n|------|------|------------|-------------|\n| sub | ${subRepo} | git@x:y.git | test sub-repo |\n`
+  );
+  // Commit something so the planning-root tree isn't entirely empty
+  execSync('git add REPOS.md', { cwd: root });
+  execSync('git commit -q -m init', { cwd: root });
+  return { root, subRepo };
+}
+
+test('REL-06: surveyDirty detects pre-existing dirt in planning root (pre-existing-dirt)', () => {
+  const m = getModule();
+  const { root } = setupMultiRepoFixture();
+  fs.writeFileSync(path.join(root, 'dirty.txt'), 'pre-existing');
+  const survey = m.surveyDirty(root);
+  assert.ok(survey.planningRoot.dirty, 'planning root should be flagged dirty');
+  assert.ok((survey.planningRoot.paths || []).some(p => /dirty\.txt/.test(p)), 'dirty.txt must appear in paths');
+});
+
+test('REL-06: surveyDirty detects pre-existing dirt in registered sub-repo', () => {
+  const m = getModule();
+  const { root, subRepo } = setupMultiRepoFixture();
+  fs.writeFileSync(path.join(subRepo, 'dirty.txt'), 'pre-existing');
+  const survey = m.surveyDirty(root);
+  const subEntry = (survey.subRepos || []).find(r => r.name === 'sub');
+  assert.ok(subEntry && subEntry.dirty, 'sub-repo should be flagged dirty');
+});
+
+test('REL-05: decideRouting returns route-to-sub-repo for single-sub-repo dirty case', () => {
+  const m = getModule();
+  const survey = {
+    planningRoot: { dirty: false, paths: [] },
+    subRepos: [{ name: 'sub', path: '/tmp/sub', dirty: true, paths: ['file.txt'] }],
+    submodules: [],
+  };
+  const decision = m.decideRouting(survey);
+  assert.strictEqual(decision.action, 'route-to-sub-repo');
+  assert.strictEqual(decision.repoCwd, '/tmp/sub');
+});
+
+test('REL-05: decideRouting returns route-to-planning-root for planning-only dirty case', () => {
+  const m = getModule();
+  const survey = {
+    planningRoot: { dirty: true, paths: ['a.md'] },
+    subRepos: [{ name: 'sub', path: '/tmp/sub', dirty: false, paths: [] }],
+    submodules: [],
+  };
+  const decision = m.decideRouting(survey);
+  assert.strictEqual(decision.action, 'route-to-planning-root');
+});
+
+test('REL-05: decideRouting fails with multi-repo-dirt for multiple-dirty case', () => {
+  const m = getModule();
+  const survey = {
+    planningRoot: { dirty: true, paths: ['a.md'] },
+    subRepos: [{ name: 'sub', path: '/tmp/sub', dirty: true, paths: ['b.txt'] }],
+    submodules: [],
+  };
+  const decision = m.decideRouting(survey);
+  assert.strictEqual(decision.action, 'fail');
+  assert.strictEqual(decision.exitCode, 'multi-repo-dirt');
+});
+
+test('REL-05: decideRouting warns on submodules but does not auto-route them', () => {
+  const m = getModule();
+  const survey = {
+    planningRoot: { dirty: false, paths: [] },
+    subRepos: [{ name: 'sub', path: '/tmp/sub', dirty: true, paths: ['file.txt'] }],
+    submodules: [{ path: 'vendor/lib', dirty: true }],
+  };
+  const decision = m.decideRouting(survey);
+  assert.strictEqual(decision.action, 'route-to-sub-repo');
+  assert.ok(
+    Array.isArray(decision.warnings) && decision.warnings.some(w => /submodule/i.test(w)),
+    'submodule warning must be present in decision.warnings'
+  );
+});
+
+// REL-05/06 sentinel — flag this file as a Wave-0 RED scaffold for plan 03.

package/deliver-great-systems/bin/lib/final-commit-precondition.test.cjs

@@ -0,0 +1,87 @@
+// deliver-great-systems/bin/lib/final-commit-precondition.test.cjs
+// REL-08 regression test scaffold — initially RED. Turns GREEN after plan 02
+// adds the pre-commit precondition gate to executor's <final_commit> step.
+
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const { execSync } = require('node:child_process');
+
+// Resolve dgs-tools.cjs CLI: __dirname = .../deliver-great-systems/bin/lib
+// CLI lives at .../deliver-great-systems/bin/dgs-tools.cjs
+const CLI = path.resolve(__dirname, '..', 'dgs-tools.cjs');
+
+function setupFixture({ planRequirements, summaryRequirementsCompleted }) {
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'rel08-'));
+  execSync('git init -q', { cwd: tmpDir });
+  execSync('git config user.email test@test', { cwd: tmpDir });
+  execSync('git config user.name test', { cwd: tmpDir });
+  fs.writeFileSync(
+    path.join(tmpDir, 'PLAN.md'),
+    `---\nphase: test\nplan: 01\nrequirements:\n${planRequirements.map(r => `  - ${r}`).join('\n')}\n---\n`
+  );
+  fs.writeFileSync(
+    path.join(tmpDir, 'SUMMARY.md'),
+    `---\nphase: test\nplan: 01\nrequirements_completed: [${summaryRequirementsCompleted.join(', ')}]\n---\n`
+  );
+  return tmpDir;
+}
+
+test('REL-08: precondition aborts with summary-frontmatter-mismatch when PLAN non-empty AND SUMMARY empty', () => {
+  const fixture = setupFixture({ planRequirements: ['TEST-01'], summaryRequirementsCompleted: [] });
+
+  let exitCode = 0;
+  let combined = '';
+  try {
+    execSync(`node ${CLI} final-commit-precondition --plan ${fixture}/PLAN.md --summary ${fixture}/SUMMARY.md`, { stdio: 'pipe' });
+  } catch (err) {
+    exitCode = err.status;
+    combined = (err.stderr ? err.stderr.toString() : '') + (err.stdout ? err.stdout.toString() : '');
+  }
+
+  // RED: the CLI subcommand doesn't exist yet, so execSync throws with a different error
+  // (CLI says "Unknown command: final-commit-precondition" or similar — does NOT include the literal label).
+  assert.notStrictEqual(exitCode, 0, 'should exit non-zero on mismatch');
+  assert.match(combined, /summary-frontmatter-mismatch/, 'stderr must include the exit-code label');
+});
+
+test('REL-08: precondition leaves working tree unchanged on abort (REL-08 fail-loudly contract)', () => {
+  const fixture = setupFixture({ planRequirements: ['TEST-01'], summaryRequirementsCompleted: [] });
+  // Snapshot working-tree state BEFORE precondition runs
+  const before = execSync('git status --porcelain', { cwd: fixture }).toString();
+
+  try {
+    execSync(`node ${CLI} final-commit-precondition --plan ${fixture}/PLAN.md --summary ${fixture}/SUMMARY.md`, { stdio: 'pipe' });
+  } catch (_) { /* expected non-zero */ }
+
+  const after = execSync('git status --porcelain', { cwd: fixture }).toString();
+  assert.strictEqual(after, before, 'working tree must be unchanged after precondition abort');
+});
+
+test('REL-08: precondition is a no-op (exit 0) when PLAN requirements is empty', () => {
+  const fixture = setupFixture({ planRequirements: [], summaryRequirementsCompleted: [] });
+
+  let exitCode = 0;
+  try {
+    execSync(`node ${CLI} final-commit-precondition --plan ${fixture}/PLAN.md --summary ${fixture}/SUMMARY.md`, { stdio: 'pipe' });
+  } catch (err) {
+    exitCode = err.status;
+  }
+  assert.strictEqual(exitCode, 0, 'precondition is no-op when PLAN requirements is empty');
+});
+
+test('REL-08: precondition succeeds (exit 0) when SUMMARY requirements_completed matches PLAN', () => {
+  const fixture = setupFixture({ planRequirements: ['TEST-01'], summaryRequirementsCompleted: ['TEST-01'] });
+
+  let exitCode = 0;
+  try {
+    execSync(`node ${CLI} final-commit-precondition --plan ${fixture}/PLAN.md --summary ${fixture}/SUMMARY.md`, { stdio: 'pipe' });
+  } catch (err) {
+    exitCode = err.status;
+  }
+  assert.strictEqual(exitCode, 0, 'precondition exits 0 when SUMMARY matches PLAN');
+});
+
+// REL-08 sentinel — flag this file as a Wave-0 RED scaffold for plan 02.

package/deliver-great-systems/bin/lib/fixtures/package-scan/bundler-audit-gemfile.json

@@ -0,0 +1,21 @@
+{
+  "results": [
+    {
+      "type": "unpatched_gem",
+      "advisory": {
+        "id": "CVE-2020-8164",
+        "url": "https://groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbY",
+        "title": "Possible Strong Parameters Bypass in ActionPack",
+        "description": "There is a strong parameters bypass vector in ActionPack versions 5.2.4.3 and below.",
+        "cvss_v3": 7.5,
+        "cvss_v2": 5.0,
+        "criticality": "high",
+        "solution": "Upgrade to activerecord >= 5.2.4.3"
+      },
+      "gem": {
+        "name": "activerecord",
+        "version": "5.2.3"
+      }
+    }
+  ]
+}