@lifeaitools/rdc-skills 0.37.4 → 0.37.7

package/skills/edit/SKILL.md

@@ -93,6 +93,14 @@ launch if it is dead.
   ```
 
 ### 4. Open the page
+- **Probe the resolved `targetUrl` before calling the preview open** (skip for
+  `brandSlug=test`). The editor host on 3015 can be up while the iframe target
+  returns a 500 (e.g. a Supabase-gated app with no local `.env.local`):
+  ```bash
+  curl -s -o /dev/null -w "%{http_code}" <targetUrl>/
+  ```
+  Non-2xx: do not report the preview as open. Report the status code and the first
+  error line from the target's dev-server log, and stop.
 - Normal use: open the URL in the browser and confirm the editor loaded.
   Open via PowerShell `Start-Process`, NOT `cmd start` — `cmd` treats the `&`
   between query params as a command separator and truncates the URL:

package/skills/fixit/SKILL.md

@@ -50,11 +50,18 @@ SELECT insert_work_item(
   p_item_type := 'bug',
   p_priority  := 'urgent',
   p_status    := 'in_progress',
-  p_source    := 'fixit'
+  p_source    := 'fixit',
+  p_session_id := '<agent-session-id>',
+  p_checklist := '[
+    {"id":"decomp-fix","text":"<the fix, one line>","required":true,"checked":false},
+    {"id":"test-fix-proof","text":"<command that proves the defect is gone> exits 0","required":true,"checked":false}
+  ]'::jsonb
 );
 ```
 
-Note the returned `id`.
+Note the returned `id`. The two rows are not optional: `update_work_item_status(...,'done')`
+refuses any non-epic item without a required `decomp-*` AND a required `test-*` row.
+`p_session_id` must be this session — only it may tick them.
 
 ### 2a. Declare the fix and its proof (before touching any code)
 
@@ -99,6 +106,7 @@ files, and verify behavior before moving the work item to `review`.
 
 ```bash
 git add <specific files only — never git add -A for a fixit>
+git diff --cached --stat   # every staged file and hunk must be yours
 git commit -m "fix(<scope>): <description>"
 if [ "$RDC_TEST" != "1" ]; then
   git push origin {development-branch}
@@ -107,6 +115,10 @@ else
 fi
 ```
 
+`git add <file>` stages every hunk in that file, including another session's
+uncommitted edit. If a file was already dirty before you touched it, stage with
+`git add -p <file>` and take only your hunks.
+
 ### 5.5 Mandatory code-review gate (before submitting implementation report)
 
 ⛔ **No fixit closes without a code-review pass.** Even single-file changes go through review.
@@ -144,7 +156,7 @@ complete it:
 
 | Target shape | "Done" = delivered means | How + structural proof |
 |---|---|---|
-| Published package (npm / PyPI) | new version live on the registry | run the repo's release/publish path (e.g. `npm publish --access public`); verify `npm view <pkg> version` == new version |
+| Published package (npm / PyPI) | new version live on the registry | run the repo's release/publish path (e.g. `npm publish --access public`); verify `curl -fsS https://registry.npmjs.org/<pkg>/<version>` returns 200 (exact version; `npm view` lags the registry) |
 | Deployed app (`apps/*`, sites) | change live on the running host | `/rdc:deploy <slug>` (dev) / `promote` (prod); verify HTTP 200 + content probe |
 | Shared lib consumed in-repo | landed on the integration branch | `node scripts/land.mjs` (or repo equivalent); verify branch contains the SHA |
 | Standalone repo | its own release ritual completed | follow the repo's release script/tag; verify the artifact/tag exists |
@@ -172,11 +184,15 @@ is fleet-wide yet — its absence is not itself a fixit failure.
 
 ### 6. Close and clean up
 
-Submit implementation report first, move to review, then close as validator.
+Tick the two checklist rows from Step 2 as the originating session (after the proof
+command passes), submit the implementation report, move to review, then close as validator.
 **Precondition: Step 5.7 delivery is verified.** If delivery is blocked, set status
 `blocked` (not `done`) with the remaining step — never mark `done` on an undelivered change:
 
 ```sql
+SELECT update_checklist_item('<id>'::uuid, 'decomp-fix',     true, '<agent-session-id>', 'agent');
+SELECT update_checklist_item('<id>'::uuid, 'test-fix-proof', true, '<agent-session-id>', 'agent');
+
 SELECT submit_implementation_report('<id>'::uuid,
   '{"tldr":"<one sentence>","assumptions":[],"deviations":[],"uncertainty":[],"detail":"<what was fixed>","flags":[],"transactional":false,"memory_records":[],"codeflow_post":{"agent_session_id":"<agent-session-id>","summary":"<what changed and why>","files_changed":["<path>"],"verification":["<command/evidence>"],"commit":"<hash optional>"}}'::jsonb
 );
@@ -194,6 +210,10 @@ SELECT update_work_item_status('<id>'::uuid, 'done',
 );
 ```
 
+If `done` is rejected as `close_blocked_uninstrumented` (an item created without the
+rows), add them and tick them, then retry:
+`SELECT append_checklist_item('<id>'::uuid, 'test-fix-proof', '<proof>', true, '<agent-session-id>', 'agent');`
+
 If the fix touched a transactional flow, API boundary, or package contract, set `"transactional": true` and populate `memory_records` (see `agent-bootstrap.md`), then run:
 ```bash
 node scripts/work-item-memory.mjs <work-item-id>

package/skills/plan/SKILL.md

@@ -317,6 +317,8 @@ choose the most conservative/reversible approach and document the decision.
 - Interactive: ALWAYS get approval before proceeding to build
 - Unattended: proceed immediately without approval
 - Plan doc goes in `.rdc/plans/` (fallback: `.rdc/plans/` if `.rdc/` does not exist) — not `.planning/`
+- An architecture or spec draft that has not passed its approval interview goes in
+  `.rdc/research/<topic>-draft.md`. Nothing is written under `docs/systems/**` until it is approved.
 - Each work package must be independently executable by an agent
 - No file overlap between work packages
 - Include test requirements in every work package

package/skills/release/SKILL.md

@@ -34,6 +34,7 @@ If `<repo>` is not resolvable from the current workspace, ask for its local path
 rdc:release: <repo> vX.Y.Z -> vA.B.C
 [ ] PUBLISH.md status gate: status=active AND prod in environments (block if not)
 [ ] Source path resolved
+[ ] <repo>/RELEASE.md read (if present) — its steps override the generic flow below
 [ ] Release metadata read
 [ ] Working tree clean or user-approved dirty scope identified
 [ ] Current version detected
@@ -81,8 +82,13 @@ these was in the command and NOT in this file, which is precisely the drift that
 shipping one verb as two documents produces.
 
 - Do not release without explicit user authorization.
-- Prefer repo-local release instructions in `.rdc/release.json`, README, package
-  scripts, or CI workflows.
+- **Read `<repo>/RELEASE.md` first.** When it exists it is the release procedure
+  and overrides everything generic in this skill (branch, who publishes — a tag
+  workflow, a push hook or you — and post-publish gates). Otherwise prefer
+  `.rdc/release.json`, README, package scripts, or CI workflows.
+- **`E403`/`E409` "cannot publish over the previously published version" right
+  after a push or tag usually means CI already published it.** Verify the exact
+  version on the registry; never bump again to get past it.
 - **Never force push or bypass hooks.**
 - **Never declare success without verifying the installed or deployed version.**
   A publish that exits 0 is not a published package — the registry can lag
@@ -123,7 +129,10 @@ node scripts/rdc-release.mjs --repo <repo-path> \
   --message "chore(release): vA.B.C" --tag vA.B.C
 git push origin HEAD
 git push origin vA.B.C
-npm view <package-name> version
+# exact-version fetch: 200 = published. `npm view` reads a cache that can 404
+# for minutes after a successful publish.
+curl -fsS -o /dev/null -w "%{http_code}
+" https://registry.npmjs.org/<package-name>/A.B.C
 ```
 
 The wrapper owns this documented commit-and-tag step. It compares the exact

package/skills/status/SKILL.md

@@ -57,12 +57,10 @@ description: rdc:status () — snapshot open epics, health, blockers and next ac
    ```
 
 6. **Dev server health (PM2):**
-   SSH into the Coolify server and check PM2 process state:
+   Read PM2 process state on the dev host through the sanctioned wrapper (it loads
+   the clauth-held key into ssh-agent; a raw key fetch is guard-blocked):
    ```bash
-   # Note: clauth key name for the SSH key may vary by project. Common names: ssh-key-path, vultr-ssh-key, dev-ssh-key.
-   # Check available keys with: curl -s http://127.0.0.1:52437/list-services
-   SSH_KEY=$(curl -s http://127.0.0.1:52437/v/ssh-key-path)
-   ssh -i "$SSH_KEY" -o StrictHostKeyChecking=no root@64.237.54.189 "pm2 jlist 2>/dev/null"
+   bash "$LIFEAI_ENV/services/ssh-clauth.sh" "pm2 jlist 2>/dev/null"
    ```
    Parse the JSON array — for each process note `name`, `pm2_env.status` (online/stopped/errored), and `pm2_env.pm_uptime`.
    If SSH fails or PM2 returns nothing, note "PM2 unreachable" and continue.

package/skills/terminal-config/SKILL.md

@@ -58,6 +58,11 @@ rdc:terminal-config: <task>
 Get-Content "$env:LOCALAPPDATA\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json" | ConvertFrom-Json
 ```
 
+- **A `%VAR%` in `commandline`/`startingDirectory` that does not expand has two causes; check which before editing:**
+  - **Stale inherited environment** (most common): the variable was set after `explorer.exe`, Terminal's parent, last started. Confirm it is set (`[Environment]::GetEnvironmentVariable('VAR','User')`), then `Stop-Process -Name explorer -Force` (it relaunches) and restart Windows Terminal fully — a new tab in a running instance keeps the old block.
+  - **Hardcoded path**: the config never used a variable. Only this case is fixed by editing the config.
+  - Never replace a `%VAR%` with a literal path to fix a stale environment; a restart fixes it and the literal breaks portability.
+
 ## Startup Scripts
 
 If a project uses role/cell startup scripts, keep those scripts under the project root and commit them with the project. Do not bake one user's absolute machine paths into shared RDC skill files.

package/tests/harness-gates.test.mjs

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 /**
- * Truth Gate 3.0 — Layers 5+6 harness-gate tests (WP-5).
+ * Truth Gate 3.0 — Layer 6 harness-gate tests (WP-5).
  *
- * Covers the three new hooks, fully offline (no DB, no brain, no clauth):
- *   task-completed-gate.js   — flag OFF no-op; flag ON + no/unsound closure BLOCK;
- *                              flag ON + sound closure PASS.
- *   post-tool-batch-gate.js  — flag OFF no-op; flag ON + stale worktree base FLAG;
- *                              flag ON + current base PASS.
+ * Fully offline (no DB, no brain, no clauth). task-completed-gate.js and
+ * post-tool-batch-gate.js were deleted in 0.37.5 (LIFEAI/regen-root#237): both
+ * sat behind env flags nothing ever set.
  *   gate-watchdog-selfcheck  — STOP-banner when a gate file/registration absent;
  *                              silent when all present; checks the LIVE hookify
  *                              hooks.json (plugin manifest), not the dead wrappers.
@@ -17,7 +15,6 @@ import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -31,120 +28,6 @@ function assert(name, condition, detail = '') {
   else process.stdout.write(`  ok  ${name}\n`);
 }
 
-function runHook(file, payload, extraEnv = {}) {
-  return spawnSync(process.execPath, [join(HOOKS, file)], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    env: { ...process.env, ...extraEnv },
-  });
-}
-
-const WI = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
-
-// ===========================================================================
-// 1. task-completed-gate.js
-// ===========================================================================
-{
-  const tcg = require(join(HOOKS, 'task-completed-gate.js'));
-
-  // pure: closureIsSound branches
-  assert('TCG closureIsSound: null row → not ok', tcg.closureIsSound(null).ok === false);
-  assert('TCG closureIsSound: not-done task → not ok',
-    tcg.closureIsSound({ id: WI, item_type: 'task', status: 'review' }).ok === false);
-  assert('TCG closureIsSound: done but witness:agent → not ok',
-    tcg.closureIsSound({ id: WI, item_type: 'task', status: 'done', implementation_report: { codeflow_post: { witness: 'agent', commit: 'x', files_changed: ['f'], verification: [{ exit_code: 0 }] } } }).ok === false);
-  const soundRow = {
-    id: WI, item_type: 'task', status: 'done',
-    implementation_report: { codeflow_post: { witness: 'validator-rerun', commit: 'c3189c9d58a37d648e9de4a6bcd7d46772053eea', files_changed: ['hooks/x.js'], verification: [{ exit_code: 0 }] } },
-  };
-  assert('TCG closureIsSound: full sound closure → ok', tcg.closureIsSound(soundRow).ok === true,
-    tcg.closureIsSound(soundRow).reason || '');
-  assert('TCG closureIsSound: epic done → ok',
-    tcg.closureIsSound({ id: WI, item_type: 'epic', status: 'done' }).ok === true);
-
-  // pure: extractWorkItemId
-  assert('TCG extractWorkItemId: from field', tcg.extractWorkItemId({ work_item_id: WI }) === WI);
-  assert('TCG extractWorkItemId: from blob', tcg.extractWorkItemId({ task: { note: `closes ${WI}` } }) === WI);
-  assert('TCG extractWorkItemId: none → null', tcg.extractWorkItemId({ task: { note: 'no uuid' } }) === null);
-
-  // pure: flagEnabledEnv default OFF
-  {
-    const prev = process.env.RDC_TRUTHGATE_TASKCOMPLETED;
-    delete process.env.RDC_TRUTHGATE_TASKCOMPLETED;
-    assert('TCG flag default OFF', tcg.flagEnabledEnv() === false);
-    process.env.RDC_TRUTHGATE_TASKCOMPLETED = 'true';
-    assert('TCG flag ON via env', tcg.flagEnabledEnv() === true);
-    if (prev === undefined) delete process.env.RDC_TRUTHGATE_TASKCOMPLETED;
-    else process.env.RDC_TRUTHGATE_TASKCOMPLETED = prev;
-  }
-
-  // pure: flagDbOptIn default OFF, ON via env
-  {
-    const prev = process.env.RDC_TRUTHGATE_TASKCOMPLETED_DB;
-    delete process.env.RDC_TRUTHGATE_TASKCOMPLETED_DB;
-    assert('TCG DB-opt-in default OFF', tcg.flagDbOptIn() === false);
-    process.env.RDC_TRUTHGATE_TASKCOMPLETED_DB = 'on';
-    assert('TCG DB-opt-in ON via env', tcg.flagDbOptIn() === true);
-    if (prev === undefined) delete process.env.RDC_TRUTHGATE_TASKCOMPLETED_DB;
-    else process.env.RDC_TRUTHGATE_TASKCOMPLETED_DB = prev;
-  }
-
-  // process: flag OFF → no-op (exit 0, no block)
-  {
-    const r = runHook('task-completed-gate.js', { work_item_id: WI }, { RDC_TRUTHGATE_TASKCOMPLETED: '' });
-    assert('TCG flag OFF → exit 0 no-op', r.status === 0, `status=${r.status} ${r.stderr}`);
-  }
-
-  // process: flag OFF + DB-opt-in unset → ZERO-COST OFF path makes NO DB call.
-  // Point Supabase + the clauth daemon at a non-routable, slow-to-fail address.
-  // If the OFF path consulted the DB, the call would stall near the hook's
-  // Supabase timeout (~3.5s) / clauth timeout (~2s). The run completing far
-  // under that floor proves no round-trip was attempted.
-  {
-    const t0 = Date.now();
-    const r = runHook('task-completed-gate.js', { work_item_id: WI }, {
-      RDC_TRUTHGATE_TASKCOMPLETED: '',
-      RDC_TRUTHGATE_TASKCOMPLETED_DB: '',     // DB check NOT opted into
-      SUPABASE_URL: 'http://10.255.255.1',    // non-routable: any call would hang
-      SUPABASE_SERVICE_ROLE_KEY: 'x',         // a key IS present, so only the opt-in gate keeps us off the network
-    });
-    const elapsed = Date.now() - t0;
-    assert('TCG OFF path → exit 0', r.status === 0, `status=${r.status} ${r.stderr}`);
-    assert('TCG OFF path makes no DB call (returns well under the network-timeout floor)',
-      elapsed < 1500, `elapsed=${elapsed}ms (a DB round-trip would approach the ~3.5s timeout)`);
-  }
-
-  // process: flag ON + no closure ref → BLOCK (exit 2)
-  {
-    const r = runHook('task-completed-gate.js', { task: { note: 'no uuid here' } },
-      { RDC_TRUTHGATE_TASKCOMPLETED: '1' });
-    assert('TCG flag ON + no work-item ref → exit 2 BLOCK', r.status === 2, `status=${r.status}`);
-    assert('TCG block mentions no work-item reference', /no work-item reference/.test(r.stdout + r.stderr), r.stdout);
-  }
-
-  // process: flag ON + unsound closure (status review via sink) → BLOCK
-  {
-    const dir = mkdtempSync(join(tmpdir(), 'tcg-'));
-    const sink = join(dir, 'closure.json');
-    writeFileSync(sink, JSON.stringify({ id: WI, item_type: 'task', status: 'review', implementation_report: null }));
-    const r = runHook('task-completed-gate.js', { work_item_id: WI },
-      { RDC_TRUTHGATE_TASKCOMPLETED: '1', RDC_TASKCOMPLETED_CLOSURE_SINK: sink });
-    assert('TCG flag ON + unsound closure → exit 2 BLOCK', r.status === 2, `status=${r.status} ${r.stdout}`);
-    rmSync(dir, { recursive: true, force: true });
-  }
-
-  // process: flag ON + sound closure (via sink) → PASS (exit 0)
-  {
-    const dir = mkdtempSync(join(tmpdir(), 'tcg-'));
-    const sink = join(dir, 'closure.json');
-    writeFileSync(sink, JSON.stringify(soundRow));
-    const r = runHook('task-completed-gate.js', { work_item_id: WI },
-      { RDC_TRUTHGATE_TASKCOMPLETED: '1', RDC_TASKCOMPLETED_CLOSURE_SINK: sink });
-    assert('TCG flag ON + sound closure → exit 0 PASS', r.status === 0, `status=${r.status} ${r.stdout}${r.stderr}`);
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
 // ===========================================================================
 // 2. foreground-process-gate.js — moved to its own file, tests/foreground-process-gate.test.mjs
 //
@@ -157,57 +40,6 @@ const WI = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
 // section is not a coverage loss — see that file instead.
 // ===========================================================================
 
-// ===========================================================================
-// 3. post-tool-batch-gate.js
-// ===========================================================================
-{
-  const ptb = require(join(HOOKS, 'post-tool-batch-gate.js'));
-  const DEV = 'c3189c9d58a37d648e9de4a6bcd7d46772053eea';
-  const STALE = 'deadbeefdeadbeefdeadbeefdeadbeefdeadbeef';
-  const FRESH = '1234567812345678123456781234567812345678';
-
-  // pure: evaluateWave — cannotEvaluate when no develop HEAD
-  {
-    const v = ptb.evaluateWave({ developHead: null, worktrees: [], isAncestor: () => true });
-    assert('PTB evaluateWave: no develop HEAD → cannotEvaluate', v.cannotEvaluate === true && v.ok === false);
-  }
-  // pure: current base (develop is ancestor of worktree HEAD) → ok
-  {
-    const v = ptb.evaluateWave({
-      developHead: DEV,
-      worktrees: [{ path: '/wt/a', head: FRESH }],
-      isAncestor: (a, b) => a === DEV && b === FRESH, // DEV is ancestor of FRESH
-    });
-    assert('PTB evaluateWave: current base → ok, no stale', v.ok === true && v.stale.length === 0);
-  }
-  // pure: worktree HEAD == develop HEAD → ok
-  {
-    const v = ptb.evaluateWave({
-      developHead: DEV,
-      worktrees: [{ path: '/wt/a', head: DEV }],
-      isAncestor: () => false,
-    });
-    assert('PTB evaluateWave: head==develop → ok', v.ok === true && v.stale.length === 0);
-  }
-  // pure: stale base (develop NOT an ancestor) → flagged
-  {
-    const v = ptb.evaluateWave({
-      developHead: DEV,
-      worktrees: [{ path: '/wt/stale', head: STALE }],
-      isAncestor: () => false, // DEV is NOT an ancestor of STALE
-    });
-    assert('PTB evaluateWave: stale base → not ok', v.ok === false, JSON.stringify(v));
-    assert('PTB evaluateWave: stale worktree listed', v.stale.length === 1 && v.stale[0].head === STALE);
-  }
-
-  // process: flag OFF → no-op (exit 0)
-  {
-    const r = runHook('post-tool-batch-gate.js', { hook_event_name: 'PostToolBatch' },
-      { RDC_TRUTHGATE_POSTTOOLBATCH: '' });
-    assert('PTB flag OFF → exit 0 no-op', r.status === 0, `status=${r.status} ${r.stderr}`);
-  }
-}
-
 // ===========================================================================
 // 4. gate-watchdog-selfcheck.js
 // ===========================================================================
@@ -296,6 +128,26 @@ const WI = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
     rmSync(home, { recursive: true, force: true });
     rmSync(repo, { recursive: true, force: true });
   }
+
+  // truthGateWiredForEvent (LIFEAI/regen-root#212): since the stage merge the
+  // event registers ONE dispatcher; truth-gate.mjs is named only inside it.
+  {
+    const dir = mkdtempSync(join(tmpdir(), 'wd-stage-'));
+    const stop = join(dir, 'stop.mjs');
+    const other = join(dir, 'other.mjs');
+    writeFileSync(stop, "import './truth-gate.mjs';\n");
+    writeFileSync(other, "console.log('unrelated');\n");
+    const N = 'truth-gate.mjs';
+    assert('WD wired: direct registration → true',
+      wd.truthGateWiredForEvent('Stop::node .claude/hooks/truth-gate.mjs', 'Stop', N) === true);
+    assert('WD wired: via stage dispatcher → true (positive control)',
+      wd.truthGateWiredForEvent(`Stop::node "${stop}"`, 'Stop', N) === true);
+    assert('WD wired: dispatcher that does not reference it → false (negative control)',
+      wd.truthGateWiredForEvent(`Stop::node "${other}"`, 'Stop', N) === false);
+    assert('WD wired: registered on a different event only → false',
+      wd.truthGateWiredForEvent(`SubagentStop::node "${stop}"`, 'Stop', N) === false);
+    rmSync(dir, { recursive: true, force: true });
+  }
 }
 
 // ===========================================================================

package/tests/install-stale-checkout.test.mjs

@@ -0,0 +1,42 @@
+// The installer warns when it runs from a checkout behind origin/master
+// (LIFEAI/regen-root#230). Builds a throwaway origin + clone; no network.
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+
+const require = createRequire(import.meta.url);
+const { checkoutBehindMaster } = require('../scripts/install-rdc-skills.js');
+
+const git = (cwd, ...args) => execFileSync('git', args, { cwd, encoding: 'utf8', stdio: 'pipe' }).trim();
+const commit = (cwd, name) => {
+  writeFileSync(join(cwd, name), name);
+  git(cwd, 'add', name);
+  git(cwd, '-c', 'user.name=t', '-c', 'user.email=t@t', 'commit', '-q', '-m', name);
+};
+
+test('checkoutBehindMaster', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'rdc-stale-'));
+  try {
+    const origin = join(dir, 'origin');
+    const clone = join(dir, 'clone');
+    execFileSync('git', ['init', '-q', '-b', 'master', origin]);
+    commit(origin, 'a');
+    execFileSync('git', ['clone', '-q', origin, clone]);
+
+    assert.deepEqual(checkoutBehindMaster(clone), { behind: 0, branch: 'master' });
+
+    git(clone, 'checkout', '-q', '-b', 'old-feature');
+    commit(origin, 'b');
+    commit(origin, 'c');
+    git(clone, 'fetch', '-q', 'origin');
+    assert.deepEqual(checkoutBehindMaster(clone), { behind: 2, branch: 'old-feature' });
+
+    assert.equal(checkoutBehindMaster(join(dir, 'origin-not-a-clone-dir')), null);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/tests/publish-manifest-staging-gates.test.mjs

@@ -0,0 +1,30 @@
+// staging_gates in a PUBLISH.md DEPLOY block must be a mapping, the shape
+// regen-root scripts/gen-deploy-blocks.mjs emits (LIFEAI/regen-root#210).
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { test } from 'node:test';
+
+const require = createRequire(import.meta.url);
+const { stagingGatesShapeError } = require('../scripts/validate-publish-manifests.js');
+
+const block = (gates) => `\nruntime: next\nport: registry\nhealth_path: /\n${gates}\n# slug: x\n`;
+
+test('generated mapping passes', () => {
+  assert.equal(stagingGatesShapeError(block('staging_gates:\n  tsc_clean: true\n  health_200: true\n  content_probe: true')), null);
+});
+
+test('absent key passes', () => {
+  assert.equal(stagingGatesShapeError(block('')), null);
+});
+
+test('a list fails', () => {
+  assert.match(stagingGatesShapeError(block('staging_gates:\n  - tsc_clean\n  - health_200')), /mapping.*not a list item/);
+});
+
+test('an inline value fails', () => {
+  assert.match(stagingGatesShapeError(block('staging_gates: [tsc_clean]')), /not inline/);
+});
+
+test('a bare key fails', () => {
+  assert.match(stagingGatesShapeError(block('staging_gates:\n  tsc_clean')), /not 'key: value'/);
+});

package/tests/require-work-item-on-commit.test.mjs

@@ -45,6 +45,19 @@ assert('isGitCommit: false for --help',
   hook.isGitCommit('git commit --help') === false);
 assert('isGitCommit: false for unrelated',
   hook.isGitCommit('git status') === false);
+// LIFEAI/regen-root#243: git must be the command word, not a substring anywhere.
+for (const [cmd, want] of [
+  ['( cd /repo && git add a.js && git commit -q -F - <<\'EOF\'\nfix(x): y\nEOF\n)', true],
+  ['git -C "C:/Dev/my repo" commit -m "fix: x"', true],
+  ['GIT_AUTHOR_NAME=x git -c user.email=a@b commit -m "fix: x"', true],
+  ['cd a; git --no-pager commit --amend --no-edit', true],
+  ['node rdc-lesson.mjs submit --what "the git hook fired before commit ran"', false],
+  ['git log --oneline --grep commit', false],
+  ['gh issue create --body "run git commit after staging"', false],
+  ['echo git && echo commit', false],
+]) {
+  assert(`isGitCommit(${JSON.stringify(cmd).slice(0, 60)}) === ${want}`, hook.isGitCommit(cmd) === want);
+}
 assert('commitSucceeded: false on nothing-to-commit',
   hook.commitSucceeded({ stdout: 'nothing to commit, working tree clean' }) === false);
 assert('commitSucceeded: true on exit 0',