@lifeaitools/rdc-skills 0.24.1 → 0.24.3

package/git-sha.json

@@ -1,3 +1,3 @@
 {
-  "sha": "e04654eb140982dd3d79fe474a8a681c131e2e3d"
+  "sha": "c5d90e5aaa3925c071a380e1dd7d706d76d91bcd"
 }

package/hooks/lib/run-evidence-gate.mjs

@@ -0,0 +1,241 @@
+#!/usr/bin/env node
+/**
+ * run-evidence-gate.mjs — Truth Gate 3.0 Layer 2, the FUSED evidence primitive.
+ *
+ * Nidus / D4 principle: "you cannot submit evidence without running the test."
+ * This is ONE atomic call that (1) RUNS a verification command, (2) HASHES its
+ * captured output server-side, and (3) records the verdict TOGETHER with the
+ * hash and a timestamp. Evidence and execution are produced in the same call —
+ * an agent can never hand the gate a hash for a run that never happened.
+ *
+ * The output of runEvidenceGate() is the only legitimate shape of a
+ * machine-parseable `verification` artifact: it carries the exact command, the
+ * exit code, an SHA-256 of stdout+stderr, and a pass/fail verdict the CALLER
+ * did not author. The exit-gate's L2 verifier recognises this shape (and a few
+ * other captured-artifact shapes) and rejects anything that is bare prose.
+ *
+ * Pure-ish: it shells out to run the command but has no DB or network side
+ * effects, so it is unit-testable offline.
+ */
+'use strict';
+
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+
+/** Stable SHA-256 of a string (server-side hash — the caller cannot forge it). */
+export function hashOutput(text) {
+  return createHash('sha256').update(String(text == null ? '' : text), 'utf8').digest('hex');
+}
+
+/**
+ * The discriminant marker stamped on every fused artifact. The exit-gate keys
+ * on this to recognise a real run-and-attest result vs. an agent-typed string.
+ */
+export const EVIDENCE_KIND = 'run-evidence-gate/v1';
+
+/**
+ * Run a verification command and atomically produce a hashed, verdicted
+ * evidence artifact. There is NO path to a verdict that skips the run: the
+ * verdict is derived from the actual exit code of the actual spawn.
+ *
+ * @param {object} spec
+ * @param {string}   spec.command       executable to run (e.g. "node", "npx")
+ * @param {string[]} [spec.args]        argv for the command
+ * @param {string}   [spec.cwd]         working directory
+ * @param {object}   [spec.env]         extra env
+ * @param {number}   [spec.timeoutMs]   hard timeout (default 120s)
+ * @param {string}   [spec.label]       human label for the check
+ * @param {(spec)=>{status:number,stdout:string,stderr:string}} [runner]
+ *        injectable runner — defaults to spawnSync. Lets tests drive a fake
+ *        process WITHOUT removing the "must run" property (the runner is still
+ *        invoked exactly once and its result is what the verdict is built from).
+ * @returns {object} a fused evidence artifact (see EVIDENCE_KIND).
+ */
+export function runEvidenceGate(spec, runner) {
+  if (!spec || typeof spec !== 'object' || typeof spec.command !== 'string' || !spec.command) {
+    // Fail-closed: a malformed request can never produce a "pass".
+    return {
+      kind: EVIDENCE_KIND,
+      ran: false,
+      verdict: 'error',
+      reason: 'invalid-spec: command is required',
+      ts: new Date().toISOString(),
+    };
+  }
+
+  const exec = typeof runner === 'function' ? runner : defaultRunner;
+
+  let result;
+  try {
+    result = exec(spec);
+  } catch (e) {
+    // Spawn itself threw — fail-closed.
+    return {
+      kind: EVIDENCE_KIND,
+      ran: false,
+      verdict: 'error',
+      reason: `runner-threw: ${e && e.message ? e.message : String(e)}`,
+      command: renderCommand(spec),
+      ts: new Date().toISOString(),
+    };
+  }
+
+  // The runner MUST return a numeric status for the verdict to exist. No status
+  // (e.g. the process could not be spawned) => no run => fail-closed.
+  const status = result && typeof result.status === 'number' ? result.status : null;
+  const stdout = result && result.stdout != null ? String(result.stdout) : '';
+  const stderr = result && result.stderr != null ? String(result.stderr) : '';
+
+  if (status === null) {
+    return {
+      kind: EVIDENCE_KIND,
+      ran: false,
+      verdict: 'error',
+      reason: 'runner-produced-no-exit-status (process did not run)',
+      command: renderCommand(spec),
+      ts: new Date().toISOString(),
+    };
+  }
+
+  const combined = `EXIT:${status}\n--STDOUT--\n${stdout}\n--STDERR--\n${stderr}`;
+  return {
+    kind: EVIDENCE_KIND,
+    ran: true,
+    label: spec.label || null,
+    command: renderCommand(spec),
+    exit_code: status,
+    verdict: status === 0 ? 'pass' : 'fail',
+    output_sha256: hashOutput(combined),
+    output_bytes: Buffer.byteLength(combined, 'utf8'),
+    ts: new Date().toISOString(),
+  };
+}
+
+function renderCommand(spec) {
+  return [spec.command, ...(Array.isArray(spec.args) ? spec.args : [])].join(' ');
+}
+
+function defaultRunner(spec) {
+  const res = spawnSync(spec.command, Array.isArray(spec.args) ? spec.args : [], {
+    cwd: spec.cwd || process.cwd(),
+    env: { ...process.env, ...(spec.env || {}) },
+    encoding: 'utf8',
+    timeout: typeof spec.timeoutMs === 'number' ? spec.timeoutMs : 120000,
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  return { status: res.status, stdout: res.stdout, stderr: res.stderr };
+}
+
+/**
+ * Is `v` a legitimate machine-parseable verification artifact (NOT prose)?
+ *
+ * Accepts, in order of strength:
+ *   1. A fused run-evidence-gate artifact (object or its JSON string) — strongest.
+ *   2. A captured-artifact OBJECT with a recognised machine shape:
+ *        - { exit_code: <number> }            (tsc / test-runner exit)
+ *        - { http_status: <number> }          (captured HTTP status)
+ *        - { rowcount: <number> } / row_count (SQL rowcount)
+ *        - { passed: <number>, ... }          (test-runner JSON, e.g. vitest)
+ *      (a JSON string of any of these is also accepted)
+ * REJECTS:
+ *   - bare strings ("HTTP 200", "107 nodes", "works", "done") — proxy/prose.
+ *   - objects with no machine field.
+ */
+export function isMachineArtifact(v) {
+  if (v == null) return false;
+
+  // String input: only accepted if it parses to a recognised JSON artifact.
+  if (typeof v === 'string') {
+    const s = v.trim();
+    if (!(s.startsWith('{') || s.startsWith('['))) return false; // bare prose
+    let parsed;
+    try { parsed = JSON.parse(s); } catch { return false; }
+    return isMachineArtifact(parsed);
+  }
+
+  if (typeof v !== 'object') return false;
+
+  // 1. Fused artifact.
+  if (v.kind === EVIDENCE_KIND && v.ran === true && typeof v.output_sha256 === 'string') {
+    return true;
+  }
+
+  // 2. Recognised captured-artifact object shapes.
+  if (typeof v.exit_code === 'number') return true;
+  if (typeof v.http_status === 'number' || typeof v.httpStatus === 'number') return true;
+  if (typeof v.status_code === 'number' || typeof v.statusCode === 'number') return true;
+  if (typeof v.rowcount === 'number' || typeof v.row_count === 'number' || typeof v.rowCount === 'number') return true;
+  if (typeof v.passed === 'number' && (typeof v.failed === 'number' || typeof v.total === 'number')) return true;
+  if (typeof v.tsc_errors === 'number' || typeof v.tscErrors === 'number') return true;
+
+  return false;
+}
+
+/**
+ * Does `v` represent a verification whose OUTCOME is a PASS — not merely that it
+ * ran? This is the outcome gate that complements isMachineArtifact (the shape
+ * gate). A failing run (exit_code:1), an error HTTP status (500), a fused
+ * artifact with verdict:'fail', or a test artifact with failures must NOT be
+ * accepted as evidence of a passing verification.
+ *
+ * Returns true ONLY when the artifact is a recognised machine shape AND its
+ * outcome reads as a pass. Anything ambiguous or non-passing returns false.
+ *
+ * Pass rules (mirrors isMachineArtifact's accepted shapes):
+ *   - fused run-evidence-gate/v1 → ran===true && verdict==='pass'
+ *   - { exit_code }              → exit_code === 0
+ *   - { http_status|status_code }→ 200 <= s <= 399
+ *   - { passed, failed }         → failed === 0
+ *   - { passed, total }          → passed === total
+ *   - { tsc_errors }             → tsc_errors === 0
+ *   - { rowcount }               → a captured rowcount is presence-only evidence;
+ *                                  any numeric rowcount counts as a pass.
+ */
+export function isPassingArtifact(v) {
+  if (v == null) return false;
+
+  // String input: only accepted if it parses to a recognised JSON artifact.
+  if (typeof v === 'string') {
+    const s = v.trim();
+    if (!(s.startsWith('{') || s.startsWith('['))) return false; // bare prose
+    let parsed;
+    try { parsed = JSON.parse(s); } catch { return false; }
+    return isPassingArtifact(parsed);
+  }
+
+  if (typeof v !== 'object') return false;
+
+  // Must be a recognised machine shape first.
+  if (!isMachineArtifact(v)) return false;
+
+  // 1. Fused artifact — the verdict is authoritative.
+  if (v.kind === EVIDENCE_KIND) {
+    return v.ran === true && v.verdict === 'pass';
+  }
+
+  // 2. Captured-artifact shapes — read the outcome, not just the presence.
+  //    A tsc/test error count is checked even alongside another field.
+  if (typeof v.tsc_errors === 'number') return v.tsc_errors === 0;
+  if (typeof v.tscErrors === 'number') return v.tscErrors === 0;
+
+  if (typeof v.exit_code === 'number') return v.exit_code === 0;
+
+  if (typeof v.http_status === 'number') return v.http_status >= 200 && v.http_status <= 399;
+  if (typeof v.httpStatus === 'number') return v.httpStatus >= 200 && v.httpStatus <= 399;
+  if (typeof v.status_code === 'number') return v.status_code >= 200 && v.status_code <= 399;
+  if (typeof v.statusCode === 'number') return v.statusCode >= 200 && v.statusCode <= 399;
+
+  if (typeof v.passed === 'number') {
+    if (typeof v.failed === 'number') return v.failed === 0;
+    if (typeof v.total === 'number') return v.passed === v.total;
+  }
+
+  if (typeof v.rowcount === 'number') return true;
+  if (typeof v.row_count === 'number') return true;
+  if (typeof v.rowCount === 'number') return true;
+
+  // Recognised shape but no readable outcome → not a pass (fail-closed).
+  return false;
+}
+
+export default { runEvidenceGate, hashOutput, isMachineArtifact, isPassingArtifact, EVIDENCE_KIND };

package/hooks/work-item-exit-gate.js

@@ -11,12 +11,21 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { execFileSync } = require('child_process');
 const hookLog = require('./hook-logger');
 
 const UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+const FULL_SHA_RE = /^[0-9a-f]{40}$/i;
 const DEFAULT_SUPABASE_URL = 'https://uvojezuorjgqzmhhgluu.supabase.co';
 const EVENT_LOG = path.join(os.homedir(), '.claude', 'work-item-checklist-events.jsonl');
 
+// Truth Gate 3.0 — Layer 2 (FUSED evidence gate).
+//   Witness allow-list (D5 / SLSA: the doer cannot sign its own provenance).
+const WITNESS_ALLOWLIST = new Set(['validator-rerun', 'ci', 'human-review']);
+//   Repo the gate runs `git` against. The work tree under verification is
+//   regen-root; overridable for tests via RDC_TRUTH_GATE_REPO.
+const TRUTH_GATE_REPO = process.env.RDC_TRUTH_GATE_REPO || 'C:/Dev/regen-root';
+
 function readStdin() {
   return new Promise((resolve) => {
     let input = '';
@@ -208,6 +217,301 @@ function requiredItems(checklist) {
     : [];
 }
 
+// ===========================================================================
+// Truth Gate 3.0 — Layer 2 (FUSED evidence gate / freeze-the-leak)
+//
+// Asserts, server-checkable and FAIL-CLOSED, that a `done` close corresponds to
+// reality. Baru-trap hardening (from the auditors' OWN false positives):
+//   - resolve commits by FULL 40-hex SHA only — never short-prefix compare
+//     (prefix collisions falsely flagged real work as fabricated).
+//   - locate claimed files WHOLE-REPO (`git log --all -- <path>`), never
+//     cited-path-only (wrong-path lookups falsely cried "absent").
+// ===========================================================================
+
+/**
+ * A Layer-2 denial. Thrown by `deny()` so verifyLayer2 short-circuits without
+ * coupling to process.exit — production translates it to block(), tests assert
+ * on `.reason`. This keeps the gate logic pure + unit-testable while staying
+ * FAIL-CLOSED at the process boundary.
+ */
+class GateDenied extends Error {
+  constructor(reason, details) {
+    super(reason);
+    this.name = 'GateDenied';
+    this.reason = reason;
+    this.details = details || {};
+  }
+}
+
+function deny(reason, details) {
+  throw new GateDenied(reason, details);
+}
+
+/**
+ * Build the L1-captured SHA set bound to the item's ORIGINATING session, or
+ * DENY (throw GateDenied) when there is no originating session to bind to.
+ *
+ * FAIL-CLOSED: a null/empty originating session must NOT disable the per-session
+ * binding (the old `!originatingSession` short-circuit accepted ANY session's
+ * captured SHA — a fail-open laundering hole). With no session, there is no
+ * provenance to verify, so we DENY. Otherwise we keep ONLY rows whose
+ * session_id exactly equals the originating session.
+ *
+ * @param originatingSession string|null  the item's session_id
+ * @param capturedRows       Array<{sha, session_id}> from work_item_commits
+ * @returns Set<string>      full-SHA (lowercased) set for this item+session
+ */
+function buildCapturedShaSet(originatingSession, capturedRows) {
+  const sess = originatingSession || null;
+  if (!sess) {
+    deny(
+      'L2: done rejected — cannot bind commit provenance: work item has no originating session. ' +
+      'Without a session to bind captured SHAs to, the per-session commit binding cannot be verified; fail-closed.',
+      { originatingSession },
+    );
+  }
+  return new Set(
+    (Array.isArray(capturedRows) ? capturedRows : [])
+      .filter((r) => r && r.session_id === sess)
+      .map((r) => String((r && r.sha) || '').toLowerCase())
+      .filter((s) => FULL_SHA_RE.test(s)),
+  );
+}
+
+/** Run a git command in the truth-gate repo; returns trimmed stdout or null.
+ * stderr is captured (piped) so a failure carries a usable diagnostic instead
+ * of being swallowed. On failure with allowFail, returns null; otherwise the
+ * thrown error retains git's stderr in e.stderr / e.message. */
+function git(args, { allowFail = false } = {}) {
+  try {
+    return execFileSync('git', args, {
+      cwd: TRUTH_GATE_REPO,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      maxBuffer: 16 * 1024 * 1024,
+    }).trim();
+  } catch (e) {
+    if (allowFail) return null;
+    throw e;
+  }
+}
+
+/**
+ * Verify, once at entry, that TRUTH_GATE_REPO is a real git work tree the gate
+ * can interrogate. If git is missing or the path is not a work tree, every
+ * downstream SHA/file check would silently mis-verify, so we fail-closed with a
+ * clear `truth-gate repo unavailable` block — distinct from a `ref not found`.
+ */
+function assertGitRepoAvailable() {
+  let out;
+  try {
+    out = execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
+      cwd: TRUTH_GATE_REPO,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      maxBuffer: 1024 * 1024,
+    }).trim();
+  } catch (e) {
+    const detail = (e && (e.stderr || e.message)) ? String(e.stderr || e.message).trim().slice(0, 200) : 'git invocation failed';
+    deny(
+      'L2: done rejected — truth-gate repo unavailable: cannot run git in "' + TRUTH_GATE_REPO + '" (' + detail + '). ' +
+      'The gate cannot verify commit/file provenance without a working git tree; fail-closed.',
+      { repo: TRUTH_GATE_REPO },
+    );
+  }
+  if (out !== 'true') {
+    deny(
+      'L2: done rejected — truth-gate repo unavailable: "' + TRUTH_GATE_REPO + '" is not a git work tree (rev-parse returned "' + out + '"). ' +
+      'The gate cannot verify commit/file provenance; fail-closed.',
+      { repo: TRUTH_GATE_REPO },
+    );
+  }
+}
+
+/**
+ * Resolve a commit ref to its FULL 40-char SHA, or null if it does not exist.
+ * Uses `rev-parse --verify <ref>^{commit}` so only real commit objects resolve.
+ * NEVER does a prefix/substring compare — the returned value is the canonical
+ * full SHA, and all equality downstream is full-SHA equality.
+ */
+function resolveFullSha(ref) {
+  if (typeof ref !== 'string' || !ref.trim()) return null;
+  const full = git(['rev-parse', '--verify', '--quiet', `${ref.trim()}^{commit}`], { allowFail: true });
+  return full && FULL_SHA_RE.test(full) ? full.toLowerCase() : null;
+}
+
+/** Full set of file paths touched by a commit (`git show --stat`→ name-only). */
+function filesInCommit(fullSha) {
+  const out = git(['show', '--no-renames', '--name-only', '--pretty=format:', fullSha], { allowFail: true });
+  if (out == null) return null;
+  return new Set(out.split('\n').map((l) => l.trim()).filter(Boolean).map(normalizeRepoPath));
+}
+
+function normalizeRepoPath(p) {
+  return String(p || '').replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '').trim();
+}
+
+/**
+ * Whole-repo existence check for a claimed file. A file "exists for this repo"
+ * when EITHER it is tracked anywhere in history (`git log --all -- <path>`
+ * returns a commit) OR it is present on disk. This is deliberately broad to
+ * avoid the cited-path-only false "absent" verdict.
+ */
+function fileKnownToRepo(repoPath) {
+  const p = normalizeRepoPath(repoPath);
+  if (!p) return false;
+  // On disk now?
+  try {
+    if (fs.existsSync(path.join(TRUTH_GATE_REPO, p))) return true;
+  } catch (_) { /* fall through to history */ }
+  // Tracked anywhere in history (whole-repo locator, never cited-path-only)?
+  const log = git(['log', '--all', '--oneline', '-1', '--', p], { allowFail: true });
+  return Boolean(log && log.length > 0);
+}
+
+/** Does the file exist on disk in the work tree right now? */
+function fileOnDisk(repoPath) {
+  const p = normalizeRepoPath(repoPath);
+  if (!p) return false;
+  try { return fs.existsSync(path.join(TRUTH_GATE_REPO, p)); } catch { return false; }
+}
+
+let _evidenceLib = null;
+/** Lazy-load the fused primitive's artifact discriminators (ESM from CJS).
+ * Uses a file:// URL so the dynamic import works on Windows absolute paths.
+ * Returns { isMachineArtifact, isPassingArtifact }. */
+async function loadEvidenceLib() {
+  if (_evidenceLib) return _evidenceLib;
+  const { pathToFileURL } = require('url');
+  const libPath = path.join(__dirname, 'lib', 'run-evidence-gate.mjs');
+  const mod = await import(pathToFileURL(libPath).href);
+  _evidenceLib = { isMachineArtifact: mod.isMachineArtifact, isPassingArtifact: mod.isPassingArtifact };
+  return _evidenceLib;
+}
+
+/**
+ * Layer-2 verification of a `done` close against the real repo. Throws (caught
+ * by verifyDone → block) on any internal error so the gate is FAIL-CLOSED:
+ * an inability to verify is a DENY, never a silent pass.
+ *
+ * @param statusCall parsed update_work_item_status args (has .id, .actorSessionId)
+ * @param item       the work_items row (has implementation_report)
+ * @param capturedShas Set<string> of FULL L1-captured SHAs for this item/session
+ */
+async function verifyLayer2(statusCall, item, capturedShas) {
+  // Fail-closed: the gate's commit/file checks all shell out to git. If the
+  // truth-gate repo is not a usable git work tree, verify nothing — DENY.
+  assertGitRepoAvailable();
+
+  const post = item.implementation_report && item.implementation_report.codeflow_post;
+  if (!post || typeof post !== 'object') {
+    deny('L2: done rejected — implementation_report.codeflow_post is missing or not an object.', statusCall);
+  }
+
+  // (5) Witness allow-list — the doer cannot self-witness (D5 / SLSA).
+  const witness = String(post.witness || '').trim();
+  if (!WITNESS_ALLOWLIST.has(witness)) {
+    deny(
+      'L2: done rejected — codeflow_post.witness must be one of {validator-rerun, ci, human-review}; got "' +
+      (witness || '<missing>') + '". ' +
+      'The party that did the work cannot sign its own provenance (witness:"agent" is never accepted).',
+      { ...statusCall, witness },
+    );
+  }
+
+  // (1) Commit resolves (FULL SHA) AND was captured by L1 for this item/session.
+  const claimedCommit = post.commit;
+  const fullSha = resolveFullSha(claimedCommit);
+  if (!fullSha) {
+    deny(
+      'L2: done rejected — codeflow_post.commit ("' + (claimedCommit || '<missing>') +
+      '") does not resolve to a real commit (git cat-file/rev-parse). Free-typed or wrong SHAs are rejected.',
+      { ...statusCall, claimedCommit },
+    );
+  }
+  if (!capturedShas.has(fullSha)) {
+    deny(
+      'L2: done rejected — commit ' + fullSha + ' was not captured by Layer 1 for this work item + originating session. ' +
+      'The exit gate only accepts a commit SHA the commit-hook recorded against this item (no agent-asserted SHAs). ' +
+      'Captured SHAs for this item/session: ' + (capturedShas.size ? [...capturedShas].join(', ') : '(none)') + '.',
+      { ...statusCall, fullSha, capturedCount: capturedShas.size },
+    );
+  }
+
+  // (2)/(3) Every files_changed entry is in the commit AND exists on disk.
+  const filesChanged = Array.isArray(post.files_changed) ? post.files_changed : [];
+  if (filesChanged.length === 0) {
+    deny('L2: done rejected — codeflow_post.files_changed is empty; a closure must name the files it changed.', statusCall);
+  }
+  const commitFiles = filesInCommit(fullSha);
+  if (commitFiles == null) {
+    deny('L2: done rejected — could not read the file list of commit ' + fullSha + ' (git show failed).', statusCall);
+  }
+  for (const raw of filesChanged) {
+    const p = normalizeRepoPath(raw);
+    if (!p) {
+      deny('L2: done rejected — a files_changed entry is empty/blank.', { ...statusCall, raw });
+    }
+    // In the commit? (whole-repo lookup is implicit — commitFiles is the full
+    // name-only set of the resolved commit, not a cited-path filter.)
+    if (!commitFiles.has(p)) {
+      deny(
+        'L2: done rejected — file "' + p + '" is NOT among the files changed by commit ' + fullSha +
+        ' (git show --stat). files_changed must match the commit\'s actual contents.',
+        { ...statusCall, file: p, fullSha },
+      );
+    }
+    // On disk now?
+    if (!fileOnDisk(p)) {
+      deny(
+        'L2: done rejected — claimed file "' + p + '" does not exist on disk in the work tree. ' +
+        'A deliverable that is not present is not done.',
+        { ...statusCall, file: p },
+      );
+    }
+    // Whole-repo sanity (defense in depth; should always hold if on disk).
+    if (!fileKnownToRepo(p)) {
+      deny(
+        'L2: done rejected — claimed file "' + p + '" is unknown to the repo (not on disk and not in history).',
+        { ...statusCall, file: p },
+      );
+    }
+  }
+
+  // (4) Every verification entry is a machine-parseable artifact, not prose,
+  //     AND its OUTCOME is a PASS — not merely that it RAN. A failing run
+  //     (exit_code:1), an error HTTP status (500), a fused verdict:'fail', or a
+  //     test artifact with failures must DENY: "ran" is not "passed".
+  const { isMachineArtifact, isPassingArtifact } = await loadEvidenceLib();
+  const verifications = Array.isArray(post.verification) ? post.verification : [];
+  if (verifications.length === 0) {
+    deny('L2: done rejected — codeflow_post.verification is empty; closure needs a captured verification artifact.', statusCall);
+  }
+  for (const v of verifications) {
+    // 4a. Shape gate — it must be a captured machine artifact, not prose.
+    if (!isMachineArtifact(v)) {
+      const shown = typeof v === 'string' ? v.slice(0, 60) : JSON.stringify(v).slice(0, 80);
+      deny(
+        'L2: done rejected — verification entry is prose/proxy, not a captured artifact: "' + shown + '". ' +
+        'Each verification must be a run-evidence-gate result or a machine shape ' +
+        '({exit_code|http_status|rowcount|passed/total}). Strings like "HTTP 200" / "works" are rejected.',
+        { ...statusCall, verification: shown },
+      );
+    }
+    // 4b. Outcome gate — the captured artifact must read as a PASS.
+    if (!isPassingArtifact(v)) {
+      const shown = typeof v === 'string' ? v.slice(0, 80) : JSON.stringify(v).slice(0, 120);
+      deny(
+        'L2: done rejected — verification-not-passing: the captured artifact ran but did NOT pass: "' + shown + '". ' +
+        'A closure requires a PASSING verification (fused verdict:"pass" / exit_code:0 / http 2xx-3xx / ' +
+        'failed:0 / passed===total / tsc_errors:0). A failing or error run is not evidence of done.',
+        { ...statusCall, verification: shown },
+      );
+    }
+  }
+  // No denial thrown => Layer-2 verification PASSED.
+}
+
 async function verifyDone(statusCall, blob) {
   if (!statusCall.id) block('`update_work_item_status(..., done)` must include a work item UUID.', statusCall);
   if (!statusCall.actorSessionId || !statusCall.actorRole) {
@@ -222,9 +526,11 @@ async function verifyDone(statusCall, blob) {
 
   let rows;
   let events;
+  let capturedRows;
   try {
-    rows = await supabaseGet(`work_items?id=eq.${encodeURIComponent(statusCall.id)}&select=id,status,item_type,implementation_report,checklist`);
+    rows = await supabaseGet(`work_items?id=eq.${encodeURIComponent(statusCall.id)}&select=id,status,item_type,session_id,implementation_report,checklist`);
     events = await supabaseGet(`work_item_checklist_events?work_item_id=eq.${encodeURIComponent(statusCall.id)}&select=item_id,checked,actor_session_id,actor_role,created_at&order=created_at.desc&limit=200`);
+    capturedRows = await supabaseGet(`work_item_commits?work_item_id=eq.${encodeURIComponent(statusCall.id)}&select=sha,session_id`);
   } catch (e) {
     block(`Cannot live-verify work item exit gate: ${e.message}. Do not close the item until clauth/Supabase verification is available.`, statusCall);
   }
@@ -256,6 +562,22 @@ async function verifyDone(statusCall, blob) {
       { ...statusCall, supervisorReticks: supervisorReticks.map((e) => e.item_id) },
     );
   }
+
+  // --- Truth Gate 3.0 Layer 2 — FUSED evidence gate (freeze-the-leak) ---------
+  // The L1-captured SHA set is restricted to the item's ORIGINATING session
+  // (the session that ticked the checklist) so a SHA captured by some other
+  // session against this item cannot launder a fabricated close. A null
+  // originating session is fail-closed (DENY) inside buildCapturedShaSet.
+  try {
+    const capturedShas = buildCapturedShaSet(item.session_id || null, capturedRows);
+    await verifyLayer2(statusCall, item, capturedShas);
+  } catch (e) {
+    if (e instanceof GateDenied) {
+      block(e.reason, e.details);     // translate the L2 denial into a hard block
+    }
+    // Any OTHER error during L2 is an inability to verify => FAIL-CLOSED.
+    block('L2: done rejected — Layer-2 verification could not complete (' + (e && e.message ? e.message : String(e)) + '). Fail-closed: not closing.', statusCall);
+  }
 }
 
 function validateTick(tick, rawTool) {
@@ -283,6 +605,20 @@ async function main() {
   const statusCall = extractStatusCall(blob);
   if (!statusCall) pass({ reason: 'no-status-call' });
 
+  // Ambiguous-parse fail-closed: the tool blob references update_work_item_status
+  // AND contains a 'done' literal, but we could not extract a usable id/status.
+  // A done-close we cannot parse must NOT slip through as a pass — block.
+  if (/update_work_item_status/i.test(blob) && /\bdone\b/i.test(blob)) {
+    if (!statusCall.id || !statusCall.status) {
+      block(
+        'Work item exit gate could not parse the `update_work_item_status` call that references `done` ' +
+        '(missing ' + (!statusCall.id ? 'work item id' : 'status') + '). ' +
+        'Ambiguous done-close parses are fail-closed; re-issue the call in the documented 5-argument RPC shape.',
+        statusCall,
+      );
+    }
+  }
+
   const status = String(statusCall.status || '').toLowerCase();
   if (status === 'review' && (!statusCall.actorSessionId || statusCall.actorRole !== 'agent')) {
     block('Implementation agents must move completed work to `review` with `p_actor_session_id` and `p_actor_role := agent`.', statusCall);
@@ -294,4 +630,22 @@ async function main() {
   pass({ status });
 }
 
-main().catch((e) => block(`Exit gate crashed: ${e.message}`));
+// Run as a hook; export the Layer-2 internals when required by a test.
+if (require.main === module) {
+  main().catch((e) => block(`Exit gate crashed: ${e.message}`));
+} else {
+  module.exports = {
+    GateDenied,
+    deny,
+    verifyLayer2,
+    resolveFullSha,
+    filesInCommit,
+    fileOnDisk,
+    fileKnownToRepo,
+    normalizeRepoPath,
+    loadEvidenceLib,
+    assertGitRepoAvailable,
+    buildCapturedShaSet,
+    WITNESS_ALLOWLIST,
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.24.1",
+  "version": "0.24.3",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",
@@ -34,6 +34,7 @@
     "validate": "node tests/validate-skills.js",
     "rdc-design": "node scripts/rdc-design-cli.mjs",
     "test:hooks": "node scripts/test-rdc-hooks.mjs",
+    "test:truth-gate": "node tests/run-evidence-gate.test.mjs && node tests/work-item-exit-gate-l2.test.mjs && node tests/require-work-item-on-commit.test.mjs",
     "test:mcp": "node tests/mcp.test.mjs",
     "test:mcp:remote": "node tests/mcp.test.mjs --remote",
     "mcp": "node bin/rdc-skills-mcp.mjs",

package/skills/build/SKILL.md

@@ -288,6 +288,16 @@ Read the task title and description, then:
    Without `max_turns: 70`, agents hit the default turn cap mid-task and stop.
    `isolation: "worktree"` gives each agent its own git worktree and branch — eliminates push race conditions and index lock contention when multiple agents commit in parallel. The supervisor merges worktree branches after each wave (Step 9).
 
+   ### ✅ PREVENTION FIRST — create worktrees fresh off origin/develop (kills stale-base by construction)
+   The repeated stale-base failures below come from creating worktrees off a
+   local/old ref. Eliminate the failure mode at the source: ALWAYS create agent
+   worktrees with a fresh fetch + `origin/develop` base, e.g.
+   `git fetch origin develop && git worktree add <dir> -b <branch> origin/develop`
+   — or use the canonical launcher `node scripts/wt.mjs add <name>`, which does
+   exactly that. A worktree cut from `origin/develop` HEAD **cannot** be stale.
+   The HARD GATE below remains as the blocking backstop (detection), but
+   construction-from-`origin/develop` is the primary defense.
+
    ### ⛔ HARD GATE — Worktree base MUST equal develop HEAD (blocking, not advisory)
    The worktree-isolation harness has shipped worktrees pinned to a STALE base
    commit (lessons 2026-06-10-build-worktree-stale-base, 2026-06-11-build-worktree-stale-base,

package/tests/run-evidence-gate.test.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/**
+ * Truth Gate 3.0 — fused run-evidence-gate primitive tests.
+ *
+ * Proves the Nidus property: evidence cannot exist without a run.
+ *   - a verdict is emitted ONLY after the command runs (no run => no pass).
+ *   - the output hash is server-side and derived from the actual run.
+ *   - isMachineArtifact rejects prose and accepts captured machine shapes.
+ *
+ * Run: node tests/run-evidence-gate.test.mjs
+ */
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const LIB = pathToFileURL(join(resolve(__dirname, '..'), 'hooks', 'lib', 'run-evidence-gate.mjs')).href;
+const { runEvidenceGate, isMachineArtifact, hashOutput, EVIDENCE_KIND } = await import(LIB);
+
+const failures = [];
+function assert(name, cond, detail = '') {
+  if (!cond) failures.push(`${name}${detail ? `: ${detail}` : ''}`);
+  else process.stdout.write(`  ok  ${name}\n`);
+}
+
+// --- 1. A passing run produces verdict:'pass' WITH a hash, only after running.
+let ranCount = 0;
+const passArt = runEvidenceGate(
+  { command: 'noop', args: ['x'], label: 'unit-pass' },
+  () => { ranCount += 1; return { status: 0, stdout: 'ok', stderr: '' }; },
+);
+assert('runner invoked exactly once', ranCount === 1, String(ranCount));
+assert('pass: kind stamped', passArt.kind === EVIDENCE_KIND);
+assert('pass: ran=true', passArt.ran === true);
+assert('pass: verdict=pass', passArt.verdict === 'pass', passArt.verdict);
+assert('pass: output_sha256 present', typeof passArt.output_sha256 === 'string' && passArt.output_sha256.length === 64, passArt.output_sha256);
+
+// --- 2. A failing run -> verdict:'fail', never silently pass.
+const failArt = runEvidenceGate(
+  { command: 'noop' },
+  () => ({ status: 7, stdout: '', stderr: 'boom' }),
+);
+assert('fail: verdict=fail', failArt.verdict === 'fail', failArt.verdict);
+assert('fail: exit_code preserved', failArt.exit_code === 7, String(failArt.exit_code));
+
+// --- 3. NO RUN -> NO verdict (fail-closed). Invalid spec.
+const noCmd = runEvidenceGate({});
+assert('no-command: ran=false', noCmd.ran === false);
+assert('no-command: verdict=error (never pass)', noCmd.verdict === 'error', noCmd.verdict);
+
+// --- 4. Runner that yields no exit status -> cannot have run -> error.
+const noStatus = runEvidenceGate({ command: 'noop' }, () => ({ status: null, stdout: '', stderr: '' }));
+assert('no-status: ran=false', noStatus.ran === false);
+assert('no-status: verdict=error', noStatus.verdict === 'error', noStatus.verdict);
+
+// --- 5. Runner throws -> fail-closed error, never pass.
+const threw = runEvidenceGate({ command: 'noop' }, () => { throw new Error('spawn failed'); });
+assert('runner-throws: ran=false', threw.ran === false);
+assert('runner-throws: verdict=error', threw.verdict === 'error', threw.verdict);
+
+// --- 6. Hash is deterministic + derived from the captured combined output.
+assert('hash deterministic', hashOutput('abc') === hashOutput('abc'));
+assert('hash differs by content', hashOutput('abc') !== hashOutput('abd'));
+
+// --- 7. isMachineArtifact discrimination.
+assert('reject bare prose "HTTP 200"', isMachineArtifact('HTTP 200') === false);
+assert('reject bare prose "works"', isMachineArtifact('works') === false);
+assert('reject "107 nodes"', isMachineArtifact('107 nodes') === false);
+assert('accept fused artifact', isMachineArtifact(passArt) === true);
+assert('accept {exit_code}', isMachineArtifact({ exit_code: 0 }) === true);
+assert('accept {http_status}', isMachineArtifact({ http_status: 200 }) === true);
+assert('accept {rowcount}', isMachineArtifact({ rowcount: 12 }) === true);
+assert('accept {passed,total}', isMachineArtifact({ passed: 5, total: 5 }) === true);
+assert('accept JSON string of machine shape', isMachineArtifact('{"exit_code":0}') === true);
+assert('reject plain object', isMachineArtifact({ note: 'done' }) === false);
+assert('reject null', isMachineArtifact(null) === false);
+
+if (failures.length > 0) {
+  console.error('\nrun-evidence-gate tests — FAIL\n');
+  for (const f of failures) console.error(`  - ${f}`);
+  process.exit(1);
+}
+console.log('\nrun-evidence-gate tests — PASS');

package/tests/work-item-exit-gate-l2.test.mjs

@@ -0,0 +1,368 @@
+#!/usr/bin/env node
+/**
+ * Truth Gate 3.0 — Layer 2 (FUSED evidence gate) tests.
+ *
+ * Exercises EVERY rejection branch of work-item-exit-gate.js verifyLayer2 plus
+ * the fully-valid close, against a REAL throwaway git repo (no live DB). The
+ * gate's git/disk checks run against RDC_TRUTH_GATE_REPO, which we point at the
+ * throwaway repo. verifyLayer2 throws GateDenied on rejection; we assert on the
+ * thrown reason. A fully-valid close throws nothing.
+ *
+ * Branches proven:
+ *   1. commit-not-resolving (free-typed bad SHA)        -> DENY
+ *   2. commit-not-captured  (real SHA, not in L1 set)   -> DENY
+ *   3. files ∉ commit                                   -> DENY
+ *   4. file not on disk (in commit, deleted from tree)  -> DENY
+ *   5. prose verification ("HTTP 200")                  -> DENY
+ *   6. witness:"agent"                                  -> DENY
+ *   7. fully-valid close (real SHA captured, files in   -> ALLOW (no throw)
+ *      commit + on disk, machine artifact, valid witness)
+ *   8. fail-closed: any internal error during L2        -> DENY (via main wrapper)
+ *
+ * Also a fused-primitive assertion: run_evidence_gate emits a verdict ONLY
+ * after running the command (no verdict without a run).
+ *
+ * Run: node tests/work-item-exit-gate-l2.test.mjs
+ */
+import { mkdtempSync, rmSync, existsSync, writeFileSync, unlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve, dirname } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, '..');
+const HOOK = join(REPO_ROOT, 'hooks', 'work-item-exit-gate.js');
+const GATE_LIB = pathToFileURL(join(REPO_ROOT, 'hooks', 'lib', 'run-evidence-gate.mjs')).href;
+
+const failures = [];
+function assert(name, condition, detail = '') {
+  if (!condition) failures.push(`${name}${detail ? `: ${detail}` : ''}`);
+  else process.stdout.write(`  ok  ${name}\n`);
+}
+
+// ---------------------------------------------------------------------------
+// Build a throwaway git repo: commit two files, capture the FULL HEAD sha.
+// ---------------------------------------------------------------------------
+const repo = mkdtempSync(join(tmpdir(), 'l2-repo-'));
+const g = (...a) => execFileSync('git', a, { cwd: repo, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+g('init', '-q');
+g('config', 'user.email', 'test@example.com');
+g('config', 'user.name', 'Test');
+writeFileSync(join(repo, 'a.txt'), 'alpha\n');
+writeFileSync(join(repo, 'b.txt'), 'beta\n');
+g('add', 'a.txt', 'b.txt');
+g('commit', '-q', '-m', 'feat: seed');
+const HEAD = g('rev-parse', 'HEAD').trim();          // real FULL 40-hex SHA
+
+// CRITICAL: set the repo the gate runs git against BEFORE requiring the hook,
+// because TRUTH_GATE_REPO is captured at module load.
+process.env.RDC_TRUTH_GATE_REPO = repo;
+const require = createRequire(import.meta.url);
+const gate = require(HOOK);
+
+const SESS = 'sess-l2-origin';
+// Build an `item` row shaped like the work_items SELECT the gate reads.
+function makeItem(post) {
+  return {
+    id: '11111111-2222-3333-4444-555555555555',
+    item_type: 'task',
+    status: 'review',
+    session_id: SESS,
+    implementation_report: { codeflow_post: post },
+  };
+}
+const statusCall = { id: '11111111-2222-3333-4444-555555555555', actorSessionId: 'validator-x', actorRole: 'validator' };
+
+// A machine-parseable verification artifact (exit-code shape).
+const MACHINE_VERIF = { exit_code: 0, label: 'tsc' };
+
+// Helper: run verifyLayer2 and return the GateDenied reason, or null if it passed.
+async function runL2(post, capturedShas) {
+  try {
+    await gate.verifyLayer2(statusCall, makeItem(post), capturedShas);
+    return null; // ALLOW
+  } catch (e) {
+    if (e instanceof gate.GateDenied) return e.reason;
+    throw e; // unexpected internal error — surface it
+  }
+}
+
+const CAPTURED = new Set([HEAD.toLowerCase()]); // L1-captured set for this item/session
+
+// ---------------------------------------------------------------------------
+await (async () => {
+  // 1. commit does NOT resolve (free-typed bad SHA)
+  {
+    const reason = await runL2({
+      commit: 'deadbeefdeadbeefdeadbeefdeadbeefdeadbeef',
+      files_changed: ['a.txt'], verification: [MACHINE_VERIF], witness: 'validator-rerun',
+    }, CAPTURED);
+    assert('1. free-typed/bad SHA -> DENY', reason && /does not resolve to a real commit/.test(reason), reason || 'no denial');
+  }
+
+  // 2. commit resolves but was NOT captured by L1 for this item/session
+  {
+    const reason = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [MACHINE_VERIF], witness: 'validator-rerun',
+    }, new Set()); // empty captured set
+    assert('2. commit not captured by L1 -> DENY', reason && /was not captured by Layer 1/.test(reason), reason || 'no denial');
+  }
+
+  // 3. files_changed entry NOT in the commit
+  {
+    const reason = await runL2({
+      commit: HEAD, files_changed: ['nonexistent-in-commit.txt'], verification: [MACHINE_VERIF], witness: 'ci',
+    }, CAPTURED);
+    assert('3. files not in commit -> DENY', reason && /is NOT among the files changed by commit/.test(reason), reason || 'no denial');
+  }
+
+  // 4. file is in the commit but NOT on disk (delete it from the work tree)
+  {
+    unlinkSync(join(repo, 'b.txt'));                 // b.txt is in the commit, now gone from disk
+    const reason = await runL2({
+      commit: HEAD, files_changed: ['b.txt'], verification: [MACHINE_VERIF], witness: 'human-review',
+    }, CAPTURED);
+    assert('4. file not on disk -> DENY', reason && /does not exist on disk/.test(reason), reason || 'no denial');
+    writeFileSync(join(repo, 'b.txt'), 'beta\n');     // restore for later valid-close test
+  }
+
+  // 5. prose / proxy verification ("HTTP 200")
+  {
+    const reason = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: ['HTTP 200'], witness: 'validator-rerun',
+    }, CAPTURED);
+    assert('5. prose verification -> DENY', reason && /prose\/proxy, not a captured artifact/.test(reason), reason || 'no denial');
+  }
+
+  // 6. witness:"agent" (self-witness)
+  {
+    const reason = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [MACHINE_VERIF], witness: 'agent',
+    }, CAPTURED);
+    assert('6. witness:agent -> DENY', reason && /witness must be one of/.test(reason), reason || 'no denial');
+  }
+
+  // 7. fully-valid close -> ALLOW (no throw)
+  {
+    const reason = await runL2({
+      commit: HEAD, files_changed: ['a.txt', 'b.txt'], verification: [MACHINE_VERIF], witness: 'validator-rerun',
+    }, CAPTURED);
+    assert('7. fully-valid close -> ALLOW', reason === null, `unexpected denial: ${reason}`);
+  }
+
+  // 7b. fully-valid close with a REAL fused run-evidence-gate artifact as verification
+  {
+    const lib = await import(GATE_LIB);
+    const fused = lib.runEvidenceGate({ command: process.execPath, args: ['-e', 'process.exit(0)'], label: 'fused-pass' });
+    const reason = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [fused], witness: 'ci',
+    }, CAPTURED);
+    assert('7b. fused artifact verification -> ALLOW', reason === null, `unexpected denial: ${reason}`);
+    assert('7b. fused artifact has verdict only after run', fused.ran === true && fused.verdict === 'pass' && typeof fused.output_sha256 === 'string', JSON.stringify(fused));
+  }
+
+  // 8. FUSED primitive: no verdict possible without a run (invalid spec -> error, ran:false)
+  {
+    const lib = await import(GATE_LIB);
+    const bad = lib.runEvidenceGate({});           // no command -> cannot run
+    assert('8. fused: no run -> no pass verdict (fail-closed)', bad.ran === false && bad.verdict === 'error', JSON.stringify(bad));
+    // and a run that fails yields verdict:'fail', never silently 'pass'
+    const failRun = lib.runEvidenceGate({ command: process.execPath, args: ['-e', 'process.exit(2)'] });
+    assert('8. fused: failing run -> verdict fail', failRun.ran === true && failRun.verdict === 'fail' && failRun.exit_code === 2, JSON.stringify(failRun));
+  }
+
+  // 9. FAIL-CLOSED contract: empty files_changed / empty verification both DENY
+  {
+    const r1 = await runL2({ commit: HEAD, files_changed: [], verification: [MACHINE_VERIF], witness: 'ci' }, CAPTURED);
+    assert('9a. empty files_changed -> DENY', r1 && /files_changed is empty/.test(r1), r1 || 'no denial');
+    const r2 = await runL2({ commit: HEAD, files_changed: ['a.txt'], verification: [], witness: 'ci' }, CAPTURED);
+    assert('9b. empty verification -> DENY', r2 && /verification is empty/.test(r2), r2 || 'no denial');
+    const r3 = await runL2({ commit: HEAD, files_changed: ['a.txt'], verification: [MACHINE_VERIF] }, CAPTURED); // no witness
+    assert('9c. missing witness -> DENY', r3 && /witness must be one of/.test(r3), r3 || 'no denial');
+  }
+
+  // 10. Baru-trap: a SHORT prefix of a real commit must NOT resolve-and-pass as
+  // the captured full SHA. We claim a 8-char prefix; even though it resolves to
+  // the same commit, the captured set holds the FULL sha, and the gate compares
+  // full-to-full, so a prefix that git expands still equals HEAD -> captured.
+  // The hardening we prove: the gate stores/compares the FULL resolved sha, so a
+  // WRONG short prefix (one that resolves to a DIFFERENT/absent commit) is caught
+  // by branch 1/2 above. Here we assert the FULL-sha resolution itself:
+  {
+    const full = gate.resolveFullSha(HEAD.slice(0, 8)); // valid short prefix of HEAD
+    assert('10. resolveFullSha expands a valid prefix to the FULL 40-hex sha',
+      full === HEAD.toLowerCase() && /^[0-9a-f]{40}$/.test(full), full || 'null');
+    const none = gate.resolveFullSha('00000000');       // prefix of no commit
+    assert('10. resolveFullSha returns null for a non-existent prefix', none === null, none || 'not-null');
+  }
+
+  // -------------------------------------------------------------------------
+  // Fix 1 — OUTCOME GATE: a verification that RAN but did NOT pass must DENY.
+  // isMachineArtifact passes (correct shape) but isPassingArtifact must fail.
+  // -------------------------------------------------------------------------
+  {
+    // 11a. exit_code:1 (a real machine shape, but a FAILING run) -> DENY
+    const r1 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ exit_code: 1 }], witness: 'validator-rerun',
+    }, CAPTURED);
+    assert('11a. verification exit_code:1 -> DENY (verification-not-passing)',
+      r1 && /verification-not-passing/.test(r1), r1 || 'no denial');
+
+    // 11b. fused run-evidence-gate artifact with verdict:'fail' -> DENY
+    const lib = await import(GATE_LIB);
+    const fusedFail = lib.runEvidenceGate({ command: process.execPath, args: ['-e', 'process.exit(1)'], label: 'fused-fail' });
+    assert('11b. fused failing run has verdict:fail', fusedFail.ran === true && fusedFail.verdict === 'fail', JSON.stringify(fusedFail));
+    const r2 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [fusedFail], witness: 'ci',
+    }, CAPTURED);
+    assert('11b. fused verdict:fail -> DENY (verification-not-passing)',
+      r2 && /verification-not-passing/.test(r2), r2 || 'no denial');
+
+    // 11c. http_status:500 (error status) -> DENY
+    const r3 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ http_status: 500 }], witness: 'human-review',
+    }, CAPTURED);
+    assert('11c. verification http_status:500 -> DENY (verification-not-passing)',
+      r3 && /verification-not-passing/.test(r3), r3 || 'no denial');
+
+    // 11d. failed test-runner JSON ({passed:3, failed:2}) -> DENY
+    const r4 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ passed: 3, failed: 2 }], witness: 'ci',
+    }, CAPTURED);
+    assert('11d. verification {passed:3,failed:2} -> DENY (verification-not-passing)',
+      r4 && /verification-not-passing/.test(r4), r4 || 'no denial');
+
+    // 11e. tsc_errors:4 -> DENY
+    const r5 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ tsc_errors: 4 }], witness: 'ci',
+    }, CAPTURED);
+    assert('11e. verification tsc_errors:4 -> DENY (verification-not-passing)',
+      r5 && /verification-not-passing/.test(r5), r5 || 'no denial');
+
+    // 11f. PASSING shapes still ALLOW (regression guard for the outcome gate).
+    const okExit = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ exit_code: 0 }], witness: 'validator-rerun',
+    }, CAPTURED);
+    assert('11f. exit_code:0 still ALLOWs', okExit === null, `unexpected denial: ${okExit}`);
+    const okHttp = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ http_status: 200 }], witness: 'ci',
+    }, CAPTURED);
+    assert('11f. http_status:200 still ALLOWs', okHttp === null, `unexpected denial: ${okHttp}`);
+    const okTests = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ passed: 5, total: 5 }], witness: 'ci',
+    }, CAPTURED);
+    assert('11f. {passed:5,total:5} still ALLOWs', okTests === null, `unexpected denial: ${okTests}`);
+  }
+
+  // 11g. isPassingArtifact unit checks (direct, lib-level).
+  {
+    const lib = await import(GATE_LIB);
+    const { isPassingArtifact } = lib;
+    assert('11g. isPassingArtifact rejects {exit_code:1}', isPassingArtifact({ exit_code: 1 }) === false);
+    assert('11g. isPassingArtifact accepts {exit_code:0}', isPassingArtifact({ exit_code: 0 }) === true);
+    assert('11g. isPassingArtifact rejects {http_status:500}', isPassingArtifact({ http_status: 500 }) === false);
+    assert('11g. isPassingArtifact accepts {http_status:204}', isPassingArtifact({ http_status: 204 }) === true);
+    assert('11g. isPassingArtifact rejects {passed:1,failed:1}', isPassingArtifact({ passed: 1, failed: 1 }) === false);
+    assert('11g. isPassingArtifact accepts {passed:5,total:5}', isPassingArtifact({ passed: 5, total: 5 }) === true);
+    assert('11g. isPassingArtifact rejects {passed:4,total:5}', isPassingArtifact({ passed: 4, total: 5 }) === false);
+    assert('11g. isPassingArtifact rejects prose "HTTP 200"', isPassingArtifact('HTTP 200') === false);
+    const fp = lib.runEvidenceGate({ command: process.execPath, args: ['-e', 'process.exit(0)'] });
+    const ff = lib.runEvidenceGate({ command: process.execPath, args: ['-e', 'process.exit(1)'] });
+    assert('11g. isPassingArtifact accepts fused verdict:pass', isPassingArtifact(fp) === true);
+    assert('11g. isPassingArtifact rejects fused verdict:fail', isPassingArtifact(ff) === false);
+  }
+
+  // -------------------------------------------------------------------------
+  // Fix 2 — NULL ORIGINATING SESSION must be FAIL-CLOSED. A null session must
+  // NOT disable the per-session commit binding (the old `!originatingSession`
+  // short-circuit accepted ANY session's captured SHA). buildCapturedShaSet
+  // DENIES when the originating session is null/empty.
+  // -------------------------------------------------------------------------
+  {
+    const otherSessionRows = [{ sha: HEAD.toLowerCase(), session_id: 'some-OTHER-session' }];
+
+    // 12a. session_id=null + a SHA captured by a DIFFERENT session -> DENY
+    let denied = null;
+    try {
+      gate.buildCapturedShaSet(null, otherSessionRows);
+    } catch (e) {
+      if (e instanceof gate.GateDenied) denied = e.reason; else throw e;
+    }
+    assert('12a. null originating session -> DENY (no provenance to bind)',
+      denied && /no originating session/.test(denied), denied || 'no denial');
+
+    // 12b. empty-string session is treated the same (fail-closed) -> DENY
+    let denied2 = null;
+    try {
+      gate.buildCapturedShaSet('', otherSessionRows);
+    } catch (e) {
+      if (e instanceof gate.GateDenied) denied2 = e.reason; else throw e;
+    }
+    assert('12b. empty originating session -> DENY', denied2 && /no originating session/.test(denied2), denied2 || 'no denial');
+
+    // 12c. with a real originating session, ONLY that session's SHAs are kept;
+    //      a DIFFERENT session's captured SHA is excluded (not laundered in).
+    const mixed = [
+      { sha: HEAD.toLowerCase(), session_id: 'some-OTHER-session' },
+      { sha: 'a'.repeat(40), session_id: SESS },
+    ];
+    const set = gate.buildCapturedShaSet(SESS, mixed);
+    assert('12c. only originating-session SHAs bound', set.has('a'.repeat(40)) && !set.has(HEAD.toLowerCase()),
+      `set=${[...set].join(',')}`);
+
+    // 12d. end-to-end consequence: null session + DIFFERENT-session SHA means
+    //      the SHA is never bound, so even a structurally valid post is denied.
+    //      (Drive verifyLayer2 with the EMPTY set buildCapturedShaSet would have
+    //      produced were the session real-but-mismatched; null short-circuits
+    //      earlier, but this proves a cross-session SHA never reaches capture.)
+    const crossSet = gate.buildCapturedShaSet(SESS, otherSessionRows); // SESS has none of these
+    const r = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [MACHINE_VERIF], witness: 'validator-rerun',
+    }, crossSet);
+    assert('12d. cross-session-only SHA not captured for this session -> DENY',
+      r && /was not captured by Layer 1/.test(r), r || 'no denial');
+  }
+
+  // -------------------------------------------------------------------------
+  // Fix 3a — assertGitRepoAvailable: a non-git directory is fail-closed with a
+  // distinct `truth-gate repo unavailable` reason (not `ref not found`).
+  // Drive it directly with the function's own repo via TRUTH_GATE_REPO capture:
+  // since TRUTH_GATE_REPO is module-captured to `repo` (a real git tree), the
+  // happy path must NOT throw; assert that, and assert a non-git path denies by
+  // re-importing the hook under a fresh env pointed at a non-git dir.
+  {
+    // happy path: the live throwaway repo is a work tree -> no throw
+    let ok = true;
+    try { gate.assertGitRepoAvailable(); } catch { ok = false; }
+    assert('13a. assertGitRepoAvailable passes for a real git work tree', ok === true);
+
+    // non-git path: re-load the hook with RDC_TRUTH_GATE_REPO pointed at a
+    // brand-new empty (non-git) temp dir; assertGitRepoAvailable must DENY.
+    const nonGit = mkdtempSync(join(tmpdir(), 'l2-nongit-'));
+    const prevRepo = process.env.RDC_TRUTH_GATE_REPO;
+    process.env.RDC_TRUTH_GATE_REPO = nonGit;
+    delete require.cache[require.resolve(HOOK)];
+    const gate2 = require(HOOK);
+    let denied = null;
+    try { gate2.assertGitRepoAvailable(); }
+    catch (e) { if (e instanceof gate2.GateDenied) denied = e.reason; else throw e; }
+    assert('13a. non-git dir -> DENY (truth-gate repo unavailable)',
+      denied && /truth-gate repo unavailable/.test(denied), denied || 'no denial');
+    // restore env + module cache for any later use
+    process.env.RDC_TRUTH_GATE_REPO = prevRepo;
+    delete require.cache[require.resolve(HOOK)];
+    rmSync(nonGit, { recursive: true, force: true });
+  }
+})();
+
+rmSync(repo, { recursive: true, force: true });
+
+// ---------------------------------------------------------------------------
+if (failures.length > 0) {
+  console.error('\nwork-item-exit-gate L2 tests — FAIL\n');
+  for (const f of failures) console.error(`  - ${f}`);
+  process.exit(1);
+}
+console.log('\nwork-item-exit-gate L2 tests — PASS');