@lifeaitools/rdc-skills 0.24.2 → 0.24.4

package/git-sha.json

@@ -1,3 +1,3 @@
 {
-  "sha": "e6ebb365ff8dc12473f5e2a8e0de04dee4003a91"
+  "sha": "df00249f44ad6e02c26d70bbc8b677dce3fd53e6"
 }

package/hooks/lib/run-evidence-gate.mjs

@@ -171,4 +171,71 @@ export function isMachineArtifact(v) {
   return false;
 }
 
-export default { runEvidenceGate, hashOutput, isMachineArtifact, EVIDENCE_KIND };
+/**
+ * Does `v` represent a verification whose OUTCOME is a PASS — not merely that it
+ * ran? This is the outcome gate that complements isMachineArtifact (the shape
+ * gate). A failing run (exit_code:1), an error HTTP status (500), a fused
+ * artifact with verdict:'fail', or a test artifact with failures must NOT be
+ * accepted as evidence of a passing verification.
+ *
+ * Returns true ONLY when the artifact is a recognised machine shape AND its
+ * outcome reads as a pass. Anything ambiguous or non-passing returns false.
+ *
+ * Pass rules (mirrors isMachineArtifact's accepted shapes):
+ *   - fused run-evidence-gate/v1 → ran===true && verdict==='pass'
+ *   - { exit_code }              → exit_code === 0
+ *   - { http_status|status_code }→ 200 <= s <= 399
+ *   - { passed, failed }         → failed === 0
+ *   - { passed, total }          → passed === total
+ *   - { tsc_errors }             → tsc_errors === 0
+ *   - { rowcount }               → a captured rowcount is presence-only evidence;
+ *                                  any numeric rowcount counts as a pass.
+ */
+export function isPassingArtifact(v) {
+  if (v == null) return false;
+
+  // String input: only accepted if it parses to a recognised JSON artifact.
+  if (typeof v === 'string') {
+    const s = v.trim();
+    if (!(s.startsWith('{') || s.startsWith('['))) return false; // bare prose
+    let parsed;
+    try { parsed = JSON.parse(s); } catch { return false; }
+    return isPassingArtifact(parsed);
+  }
+
+  if (typeof v !== 'object') return false;
+
+  // Must be a recognised machine shape first.
+  if (!isMachineArtifact(v)) return false;
+
+  // 1. Fused artifact — the verdict is authoritative.
+  if (v.kind === EVIDENCE_KIND) {
+    return v.ran === true && v.verdict === 'pass';
+  }
+
+  // 2. Captured-artifact shapes — read the outcome, not just the presence.
+  //    A tsc/test error count is checked even alongside another field.
+  if (typeof v.tsc_errors === 'number') return v.tsc_errors === 0;
+  if (typeof v.tscErrors === 'number') return v.tscErrors === 0;
+
+  if (typeof v.exit_code === 'number') return v.exit_code === 0;
+
+  if (typeof v.http_status === 'number') return v.http_status >= 200 && v.http_status <= 399;
+  if (typeof v.httpStatus === 'number') return v.httpStatus >= 200 && v.httpStatus <= 399;
+  if (typeof v.status_code === 'number') return v.status_code >= 200 && v.status_code <= 399;
+  if (typeof v.statusCode === 'number') return v.statusCode >= 200 && v.statusCode <= 399;
+
+  if (typeof v.passed === 'number') {
+    if (typeof v.failed === 'number') return v.failed === 0;
+    if (typeof v.total === 'number') return v.passed === v.total;
+  }
+
+  if (typeof v.rowcount === 'number') return true;
+  if (typeof v.row_count === 'number') return true;
+  if (typeof v.rowCount === 'number') return true;
+
+  // Recognised shape but no readable outcome → not a pass (fail-closed).
+  return false;
+}
+
+export default { runEvidenceGate, hashOutput, isMachineArtifact, isPassingArtifact, EVIDENCE_KIND };

package/hooks/work-item-exit-gate.js

@@ -247,13 +247,47 @@ function deny(reason, details) {
   throw new GateDenied(reason, details);
 }
 
-/** Run a git command in the truth-gate repo; returns trimmed stdout or null. */
+/**
+ * Build the L1-captured SHA set bound to the item's ORIGINATING session, or
+ * DENY (throw GateDenied) when there is no originating session to bind to.
+ *
+ * FAIL-CLOSED: a null/empty originating session must NOT disable the per-session
+ * binding (the old `!originatingSession` short-circuit accepted ANY session's
+ * captured SHA — a fail-open laundering hole). With no session, there is no
+ * provenance to verify, so we DENY. Otherwise we keep ONLY rows whose
+ * session_id exactly equals the originating session.
+ *
+ * @param originatingSession string|null  the item's session_id
+ * @param capturedRows       Array<{sha, session_id}> from work_item_commits
+ * @returns Set<string>      full-SHA (lowercased) set for this item+session
+ */
+function buildCapturedShaSet(originatingSession, capturedRows) {
+  const sess = originatingSession || null;
+  if (!sess) {
+    deny(
+      'L2: done rejected — cannot bind commit provenance: work item has no originating session. ' +
+      'Without a session to bind captured SHAs to, the per-session commit binding cannot be verified; fail-closed.',
+      { originatingSession },
+    );
+  }
+  return new Set(
+    (Array.isArray(capturedRows) ? capturedRows : [])
+      .filter((r) => r && r.session_id === sess)
+      .map((r) => String((r && r.sha) || '').toLowerCase())
+      .filter((s) => FULL_SHA_RE.test(s)),
+  );
+}
+
+/** Run a git command in the truth-gate repo; returns trimmed stdout or null.
+ * stderr is captured (piped) so a failure carries a usable diagnostic instead
+ * of being swallowed. On failure with allowFail, returns null; otherwise the
+ * thrown error retains git's stderr in e.stderr / e.message. */
 function git(args, { allowFail = false } = {}) {
   try {
     return execFileSync('git', args, {
       cwd: TRUTH_GATE_REPO,
       encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
+      stdio: ['ignore', 'pipe', 'pipe'],
       maxBuffer: 16 * 1024 * 1024,
     }).trim();
   } catch (e) {
@@ -262,6 +296,38 @@ function git(args, { allowFail = false } = {}) {
   }
 }
 
+/**
+ * Verify, once at entry, that TRUTH_GATE_REPO is a real git work tree the gate
+ * can interrogate. If git is missing or the path is not a work tree, every
+ * downstream SHA/file check would silently mis-verify, so we fail-closed with a
+ * clear `truth-gate repo unavailable` block — distinct from a `ref not found`.
+ */
+function assertGitRepoAvailable() {
+  let out;
+  try {
+    out = execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
+      cwd: TRUTH_GATE_REPO,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      maxBuffer: 1024 * 1024,
+    }).trim();
+  } catch (e) {
+    const detail = (e && (e.stderr || e.message)) ? String(e.stderr || e.message).trim().slice(0, 200) : 'git invocation failed';
+    deny(
+      'L2: done rejected — truth-gate repo unavailable: cannot run git in "' + TRUTH_GATE_REPO + '" (' + detail + '). ' +
+      'The gate cannot verify commit/file provenance without a working git tree; fail-closed.',
+      { repo: TRUTH_GATE_REPO },
+    );
+  }
+  if (out !== 'true') {
+    deny(
+      'L2: done rejected — truth-gate repo unavailable: "' + TRUTH_GATE_REPO + '" is not a git work tree (rev-parse returned "' + out + '"). ' +
+      'The gate cannot verify commit/file provenance; fail-closed.',
+      { repo: TRUTH_GATE_REPO },
+    );
+  }
+}
+
 /**
  * Resolve a commit ref to its FULL 40-char SHA, or null if it does not exist.
  * Uses `rev-parse --verify <ref>^{commit}` so only real commit objects resolve.
@@ -310,16 +376,17 @@ function fileOnDisk(repoPath) {
   try { return fs.existsSync(path.join(TRUTH_GATE_REPO, p)); } catch { return false; }
 }
 
-let _isMachineArtifact = null;
-/** Lazy-load the fused primitive's artifact discriminator (ESM from CJS).
- * Uses a file:// URL so the dynamic import works on Windows absolute paths. */
-async function loadIsMachineArtifact() {
-  if (_isMachineArtifact) return _isMachineArtifact;
+let _evidenceLib = null;
+/** Lazy-load the fused primitive's artifact discriminators (ESM from CJS).
+ * Uses a file:// URL so the dynamic import works on Windows absolute paths.
+ * Returns { isMachineArtifact, isPassingArtifact }. */
+async function loadEvidenceLib() {
+  if (_evidenceLib) return _evidenceLib;
   const { pathToFileURL } = require('url');
   const libPath = path.join(__dirname, 'lib', 'run-evidence-gate.mjs');
   const mod = await import(pathToFileURL(libPath).href);
-  _isMachineArtifact = mod.isMachineArtifact;
-  return _isMachineArtifact;
+  _evidenceLib = { isMachineArtifact: mod.isMachineArtifact, isPassingArtifact: mod.isPassingArtifact };
+  return _evidenceLib;
 }
 
 /**
@@ -332,6 +399,10 @@ async function loadIsMachineArtifact() {
  * @param capturedShas Set<string> of FULL L1-captured SHAs for this item/session
  */
 async function verifyLayer2(statusCall, item, capturedShas) {
+  // Fail-closed: the gate's commit/file checks all shell out to git. If the
+  // truth-gate repo is not a usable git work tree, verify nothing — DENY.
+  assertGitRepoAvailable();
+
   const post = item.implementation_report && item.implementation_report.codeflow_post;
   if (!post || typeof post !== 'object') {
     deny('L2: done rejected — implementation_report.codeflow_post is missing or not an object.', statusCall);
@@ -407,13 +478,17 @@ async function verifyLayer2(statusCall, item, capturedShas) {
     }
   }
 
-  // (4) Every verification entry is a machine-parseable artifact, not prose.
-  const isMachineArtifact = await loadIsMachineArtifact();
+  // (4) Every verification entry is a machine-parseable artifact, not prose,
+  //     AND its OUTCOME is a PASS — not merely that it RAN. A failing run
+  //     (exit_code:1), an error HTTP status (500), a fused verdict:'fail', or a
+  //     test artifact with failures must DENY: "ran" is not "passed".
+  const { isMachineArtifact, isPassingArtifact } = await loadEvidenceLib();
   const verifications = Array.isArray(post.verification) ? post.verification : [];
   if (verifications.length === 0) {
     deny('L2: done rejected — codeflow_post.verification is empty; closure needs a captured verification artifact.', statusCall);
   }
   for (const v of verifications) {
+    // 4a. Shape gate — it must be a captured machine artifact, not prose.
     if (!isMachineArtifact(v)) {
       const shown = typeof v === 'string' ? v.slice(0, 60) : JSON.stringify(v).slice(0, 80);
       deny(
@@ -423,6 +498,16 @@ async function verifyLayer2(statusCall, item, capturedShas) {
         { ...statusCall, verification: shown },
       );
     }
+    // 4b. Outcome gate — the captured artifact must read as a PASS.
+    if (!isPassingArtifact(v)) {
+      const shown = typeof v === 'string' ? v.slice(0, 80) : JSON.stringify(v).slice(0, 120);
+      deny(
+        'L2: done rejected — verification-not-passing: the captured artifact ran but did NOT pass: "' + shown + '". ' +
+        'A closure requires a PASSING verification (fused verdict:"pass" / exit_code:0 / http 2xx-3xx / ' +
+        'failed:0 / passed===total / tsc_errors:0). A failing or error run is not evidence of done.',
+        { ...statusCall, verification: shown },
+      );
+    }
   }
   // No denial thrown => Layer-2 verification PASSED.
 }
@@ -481,15 +566,10 @@ async function verifyDone(statusCall, blob) {
   // --- Truth Gate 3.0 Layer 2 — FUSED evidence gate (freeze-the-leak) ---------
   // The L1-captured SHA set is restricted to the item's ORIGINATING session
   // (the session that ticked the checklist) so a SHA captured by some other
-  // session against this item cannot launder a fabricated close.
-  const originatingSession = item.session_id || null;
-  const capturedShas = new Set(
-    (Array.isArray(capturedRows) ? capturedRows : [])
-      .filter((r) => !originatingSession || r.session_id === originatingSession)
-      .map((r) => String(r.sha || '').toLowerCase())
-      .filter((s) => FULL_SHA_RE.test(s)),
-  );
+  // session against this item cannot launder a fabricated close. A null
+  // originating session is fail-closed (DENY) inside buildCapturedShaSet.
   try {
+    const capturedShas = buildCapturedShaSet(item.session_id || null, capturedRows);
     await verifyLayer2(statusCall, item, capturedShas);
   } catch (e) {
     if (e instanceof GateDenied) {
@@ -525,6 +605,20 @@ async function main() {
   const statusCall = extractStatusCall(blob);
   if (!statusCall) pass({ reason: 'no-status-call' });
 
+  // Ambiguous-parse fail-closed: the tool blob references update_work_item_status
+  // AND contains a 'done' literal, but we could not extract a usable id/status.
+  // A done-close we cannot parse must NOT slip through as a pass — block.
+  if (/update_work_item_status/i.test(blob) && /\bdone\b/i.test(blob)) {
+    if (!statusCall.id || !statusCall.status) {
+      block(
+        'Work item exit gate could not parse the `update_work_item_status` call that references `done` ' +
+        '(missing ' + (!statusCall.id ? 'work item id' : 'status') + '). ' +
+        'Ambiguous done-close parses are fail-closed; re-issue the call in the documented 5-argument RPC shape.',
+        statusCall,
+      );
+    }
+  }
+
   const status = String(statusCall.status || '').toLowerCase();
   if (status === 'review' && (!statusCall.actorSessionId || statusCall.actorRole !== 'agent')) {
     block('Implementation agents must move completed work to `review` with `p_actor_session_id` and `p_actor_role := agent`.', statusCall);
@@ -549,7 +643,9 @@ if (require.main === module) {
     fileOnDisk,
     fileKnownToRepo,
     normalizeRepoPath,
-    loadIsMachineArtifact,
+    loadEvidenceLib,
+    assertGitRepoAvailable,
+    buildCapturedShaSet,
     WITNESS_ALLOWLIST,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.24.2",
+  "version": "0.24.4",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",

package/tests/require-work-item-on-commit.test.mjs

@@ -126,22 +126,31 @@ function runHook(payload, extraEnv = {}) {
 
 // ---------------------------------------------------------------------------
 // 4. PreToolUse legacy behavior preserved (warn-only, never blocks)
+//    Uses a fresh temp dir as HOME/USERPROFILE so no fixit.marker is visible
+//    regardless of real machine state — makes the warn-path assertion deterministic.
 // ---------------------------------------------------------------------------
 {
-  const res = runHook({
-    hook_event_name: 'PreToolUse',
-    tool_name: 'Bash',
-    tool_input: { command: 'git commit -m "no convention and no uuid"' },
-  });
-  assert('pre: warn exits zero (never blocks)', res.status === 0, res.stderr);
-  assert('pre: emits warn systemMessage', /no work item reference/.test(res.stdout), res.stdout);
+  const fakeHome = mkdtempSync(join(tmpdir(), 'wic-home-'));
+  try {
+    const preEnv = { HOME: fakeHome, USERPROFILE: fakeHome };
 
-  const ok = runHook({
-    hook_event_name: 'PreToolUse',
-    tool_name: 'Bash',
-    tool_input: { command: 'git commit -m "feat(x): conventional"' },
-  });
-  assert('pre: conventional passes silently', ok.status === 0 && ok.stdout.trim() === '', ok.stdout);
+    const res = runHook({
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Bash',
+      tool_input: { command: 'git commit -m "no convention and no uuid"' },
+    }, preEnv);
+    assert('pre: warn exits zero (never blocks)', res.status === 0, res.stderr);
+    assert('pre: emits warn systemMessage', /no work item reference/.test(res.stdout), res.stdout);
+
+    const ok = runHook({
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Bash',
+      tool_input: { command: 'git commit -m "feat(x): conventional"' },
+    }, preEnv);
+    assert('pre: conventional passes silently', ok.status === 0 && ok.stdout.trim() === '', ok.stdout);
+  } finally {
+    rmSync(fakeHome, { recursive: true, force: true });
+  }
 }
 
 // ---------------------------------------------------------------------------

package/tests/work-item-exit-gate-l2.test.mjs

@@ -197,6 +197,164 @@ await (async () => {
     const none = gate.resolveFullSha('00000000');       // prefix of no commit
     assert('10. resolveFullSha returns null for a non-existent prefix', none === null, none || 'not-null');
   }
+
+  // -------------------------------------------------------------------------
+  // Fix 1 — OUTCOME GATE: a verification that RAN but did NOT pass must DENY.
+  // isMachineArtifact passes (correct shape) but isPassingArtifact must fail.
+  // -------------------------------------------------------------------------
+  {
+    // 11a. exit_code:1 (a real machine shape, but a FAILING run) -> DENY
+    const r1 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ exit_code: 1 }], witness: 'validator-rerun',
+    }, CAPTURED);
+    assert('11a. verification exit_code:1 -> DENY (verification-not-passing)',
+      r1 && /verification-not-passing/.test(r1), r1 || 'no denial');
+
+    // 11b. fused run-evidence-gate artifact with verdict:'fail' -> DENY
+    const lib = await import(GATE_LIB);
+    const fusedFail = lib.runEvidenceGate({ command: process.execPath, args: ['-e', 'process.exit(1)'], label: 'fused-fail' });
+    assert('11b. fused failing run has verdict:fail', fusedFail.ran === true && fusedFail.verdict === 'fail', JSON.stringify(fusedFail));
+    const r2 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [fusedFail], witness: 'ci',
+    }, CAPTURED);
+    assert('11b. fused verdict:fail -> DENY (verification-not-passing)',
+      r2 && /verification-not-passing/.test(r2), r2 || 'no denial');
+
+    // 11c. http_status:500 (error status) -> DENY
+    const r3 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ http_status: 500 }], witness: 'human-review',
+    }, CAPTURED);
+    assert('11c. verification http_status:500 -> DENY (verification-not-passing)',
+      r3 && /verification-not-passing/.test(r3), r3 || 'no denial');
+
+    // 11d. failed test-runner JSON ({passed:3, failed:2}) -> DENY
+    const r4 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ passed: 3, failed: 2 }], witness: 'ci',
+    }, CAPTURED);
+    assert('11d. verification {passed:3,failed:2} -> DENY (verification-not-passing)',
+      r4 && /verification-not-passing/.test(r4), r4 || 'no denial');
+
+    // 11e. tsc_errors:4 -> DENY
+    const r5 = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ tsc_errors: 4 }], witness: 'ci',
+    }, CAPTURED);
+    assert('11e. verification tsc_errors:4 -> DENY (verification-not-passing)',
+      r5 && /verification-not-passing/.test(r5), r5 || 'no denial');
+
+    // 11f. PASSING shapes still ALLOW (regression guard for the outcome gate).
+    const okExit = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ exit_code: 0 }], witness: 'validator-rerun',
+    }, CAPTURED);
+    assert('11f. exit_code:0 still ALLOWs', okExit === null, `unexpected denial: ${okExit}`);
+    const okHttp = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ http_status: 200 }], witness: 'ci',
+    }, CAPTURED);
+    assert('11f. http_status:200 still ALLOWs', okHttp === null, `unexpected denial: ${okHttp}`);
+    const okTests = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [{ passed: 5, total: 5 }], witness: 'ci',
+    }, CAPTURED);
+    assert('11f. {passed:5,total:5} still ALLOWs', okTests === null, `unexpected denial: ${okTests}`);
+  }
+
+  // 11g. isPassingArtifact unit checks (direct, lib-level).
+  {
+    const lib = await import(GATE_LIB);
+    const { isPassingArtifact } = lib;
+    assert('11g. isPassingArtifact rejects {exit_code:1}', isPassingArtifact({ exit_code: 1 }) === false);
+    assert('11g. isPassingArtifact accepts {exit_code:0}', isPassingArtifact({ exit_code: 0 }) === true);
+    assert('11g. isPassingArtifact rejects {http_status:500}', isPassingArtifact({ http_status: 500 }) === false);
+    assert('11g. isPassingArtifact accepts {http_status:204}', isPassingArtifact({ http_status: 204 }) === true);
+    assert('11g. isPassingArtifact rejects {passed:1,failed:1}', isPassingArtifact({ passed: 1, failed: 1 }) === false);
+    assert('11g. isPassingArtifact accepts {passed:5,total:5}', isPassingArtifact({ passed: 5, total: 5 }) === true);
+    assert('11g. isPassingArtifact rejects {passed:4,total:5}', isPassingArtifact({ passed: 4, total: 5 }) === false);
+    assert('11g. isPassingArtifact rejects prose "HTTP 200"', isPassingArtifact('HTTP 200') === false);
+    const fp = lib.runEvidenceGate({ command: process.execPath, args: ['-e', 'process.exit(0)'] });
+    const ff = lib.runEvidenceGate({ command: process.execPath, args: ['-e', 'process.exit(1)'] });
+    assert('11g. isPassingArtifact accepts fused verdict:pass', isPassingArtifact(fp) === true);
+    assert('11g. isPassingArtifact rejects fused verdict:fail', isPassingArtifact(ff) === false);
+  }
+
+  // -------------------------------------------------------------------------
+  // Fix 2 — NULL ORIGINATING SESSION must be FAIL-CLOSED. A null session must
+  // NOT disable the per-session commit binding (the old `!originatingSession`
+  // short-circuit accepted ANY session's captured SHA). buildCapturedShaSet
+  // DENIES when the originating session is null/empty.
+  // -------------------------------------------------------------------------
+  {
+    const otherSessionRows = [{ sha: HEAD.toLowerCase(), session_id: 'some-OTHER-session' }];
+
+    // 12a. session_id=null + a SHA captured by a DIFFERENT session -> DENY
+    let denied = null;
+    try {
+      gate.buildCapturedShaSet(null, otherSessionRows);
+    } catch (e) {
+      if (e instanceof gate.GateDenied) denied = e.reason; else throw e;
+    }
+    assert('12a. null originating session -> DENY (no provenance to bind)',
+      denied && /no originating session/.test(denied), denied || 'no denial');
+
+    // 12b. empty-string session is treated the same (fail-closed) -> DENY
+    let denied2 = null;
+    try {
+      gate.buildCapturedShaSet('', otherSessionRows);
+    } catch (e) {
+      if (e instanceof gate.GateDenied) denied2 = e.reason; else throw e;
+    }
+    assert('12b. empty originating session -> DENY', denied2 && /no originating session/.test(denied2), denied2 || 'no denial');
+
+    // 12c. with a real originating session, ONLY that session's SHAs are kept;
+    //      a DIFFERENT session's captured SHA is excluded (not laundered in).
+    const mixed = [
+      { sha: HEAD.toLowerCase(), session_id: 'some-OTHER-session' },
+      { sha: 'a'.repeat(40), session_id: SESS },
+    ];
+    const set = gate.buildCapturedShaSet(SESS, mixed);
+    assert('12c. only originating-session SHAs bound', set.has('a'.repeat(40)) && !set.has(HEAD.toLowerCase()),
+      `set=${[...set].join(',')}`);
+
+    // 12d. end-to-end consequence: null session + DIFFERENT-session SHA means
+    //      the SHA is never bound, so even a structurally valid post is denied.
+    //      (Drive verifyLayer2 with the EMPTY set buildCapturedShaSet would have
+    //      produced were the session real-but-mismatched; null short-circuits
+    //      earlier, but this proves a cross-session SHA never reaches capture.)
+    const crossSet = gate.buildCapturedShaSet(SESS, otherSessionRows); // SESS has none of these
+    const r = await runL2({
+      commit: HEAD, files_changed: ['a.txt'], verification: [MACHINE_VERIF], witness: 'validator-rerun',
+    }, crossSet);
+    assert('12d. cross-session-only SHA not captured for this session -> DENY',
+      r && /was not captured by Layer 1/.test(r), r || 'no denial');
+  }
+
+  // -------------------------------------------------------------------------
+  // Fix 3a — assertGitRepoAvailable: a non-git directory is fail-closed with a
+  // distinct `truth-gate repo unavailable` reason (not `ref not found`).
+  // Drive it directly with the function's own repo via TRUTH_GATE_REPO capture:
+  // since TRUTH_GATE_REPO is module-captured to `repo` (a real git tree), the
+  // happy path must NOT throw; assert that, and assert a non-git path denies by
+  // re-importing the hook under a fresh env pointed at a non-git dir.
+  {
+    // happy path: the live throwaway repo is a work tree -> no throw
+    let ok = true;
+    try { gate.assertGitRepoAvailable(); } catch { ok = false; }
+    assert('13a. assertGitRepoAvailable passes for a real git work tree', ok === true);
+
+    // non-git path: re-load the hook with RDC_TRUTH_GATE_REPO pointed at a
+    // brand-new empty (non-git) temp dir; assertGitRepoAvailable must DENY.
+    const nonGit = mkdtempSync(join(tmpdir(), 'l2-nongit-'));
+    const prevRepo = process.env.RDC_TRUTH_GATE_REPO;
+    process.env.RDC_TRUTH_GATE_REPO = nonGit;
+    delete require.cache[require.resolve(HOOK)];
+    const gate2 = require(HOOK);
+    let denied = null;
+    try { gate2.assertGitRepoAvailable(); }
+    catch (e) { if (e instanceof gate2.GateDenied) denied = e.reason; else throw e; }
+    assert('13a. non-git dir -> DENY (truth-gate repo unavailable)',
+      denied && /truth-gate repo unavailable/.test(denied), denied || 'no denial');
+    // restore env + module cache for any later use
+    process.env.RDC_TRUTH_GATE_REPO = prevRepo;
+    delete require.cache[require.resolve(HOOK)];
+    rmSync(nonGit, { recursive: true, force: true });
+  }
 })();
 
 rmSync(repo, { recursive: true, force: true });