@pareto4/pp-core 1.8.2 → 1.10.0

package/pp-core/workflows/code-review.md

@@ -88,6 +88,14 @@ Code review skipped (code-review capability inactive)
 Exit workflow.
 
 Default is active through the Capability Registry schema — only skip when the registry resolves no active code-review step hook. This check runs AFTER phase validation so invalid phase errors are shown first.
+
+Resolve the practices contribution independently, from the SAME `EXECUTE_POST_HOOKS_JSON` variable already fetched above — do not add a second `pp_run loop render-hooks` call:
+
+```bash
+PRACTICES_CONTRIBUTION_FRAGMENT=""
+```
+
+Resolve active entries in `EXECUTE_POST_HOOKS_JSON` where `kind == "contribution"` and `into == "pp-code-reviewer"`, and capture that entry's `fragment.inline` verbatim into `PRACTICES_CONTRIBUTION_FRAGMENT`. When no such entry is active, `PRACTICES_CONTRIBUTION_FRAGMENT` stays empty and the review runs exactly as it does today — the practices dimension is inert, not degraded.
 </step>
 
 <step name="resolve_depth">
@@ -359,9 +367,9 @@ if (resolved) process.stdout.write(resolved);
 
 2) If binary is missing, fail with actionable message:
 ```bash
-if [ -z \"$FALLOW_BIN\" ]; then
-  echo \"Error: fallow is enabled but no binary was found.\"
-  echo \"Install fallow via \`npm install -D fallow\` or \`cargo install fallow\`.\"
+if [ -z "$FALLOW_BIN" ]; then
+  echo "Error: fallow is enabled but no binary was found."
+  echo "Install fallow via \`npm install -D fallow\` or \`cargo install fallow\`."
   # Exit workflow
 fi
 ```
@@ -375,36 +383,36 @@ FALLOW_STDERR_TMP=$(mktemp)
 # Derive the phase base commit; if none is found, fall back to repo scope (fallow
 # auto-detects the base branch).
 FALLOW_SCOPE_ARGS=()
-if [ \"$FALLOW_SCOPE\" = \"phase\" ]; then
-  FALLOW_PHASE_COMMITS=$(git log --oneline --all --grep=\"${PADDED_PHASE}\" --format=\"%H\" 2>/dev/null)
-  if [ -n \"$FALLOW_PHASE_COMMITS\" ]; then
-    FALLOW_BASE=$(echo \"$FALLOW_PHASE_COMMITS\" | tail -1)^
-    FALLOW_SCOPE_ARGS=(--changed-since \"$FALLOW_BASE\")
+if [ "$FALLOW_SCOPE" = "phase" ]; then
+  FALLOW_PHASE_COMMITS=$(git log --oneline --all --grep="${PADDED_PHASE}" --format="%H" 2>/dev/null)
+  if [ -n "$FALLOW_PHASE_COMMITS" ]; then
+    FALLOW_BASE=$(echo "$FALLOW_PHASE_COMMITS" | tail -1)^
+    FALLOW_SCOPE_ARGS=(--changed-since "$FALLOW_BASE")
   fi
 fi
 
-timeout 120 \"$FALLOW_BIN\" audit --format json --quiet --max-crap \"$FALLOW_MAX_CRAP\" \"${FALLOW_SCOPE_ARGS[@]+\"${FALLOW_SCOPE_ARGS[@]}\"}\" > \"${FALLOW_JSON_PATH}.tmp\" 2>\"$FALLOW_STDERR_TMP\"
+timeout 120 "$FALLOW_BIN" audit --format json --quiet --max-crap "$FALLOW_MAX_CRAP" "${FALLOW_SCOPE_ARGS[@]+"${FALLOW_SCOPE_ARGS[@]}"}" > "${FALLOW_JSON_PATH}.tmp" 2>"$FALLOW_STDERR_TMP"
 FALLOW_EXIT=$?
 
 # fallow exits 0 (clean) or 1 (issues found) — BOTH are successful runs that produce a
 # valid JSON report. Only a timeout (124), usage error (2), or crash yields no usable JSON.
 # Decide success by whether the output parses as a fallow report, not by exit code.
-FALLOW_OK=$(FALLOW_TMP=\"${FALLOW_JSON_PATH}.tmp\" node -e \"
+FALLOW_OK=$(FALLOW_TMP="${FALLOW_JSON_PATH}.tmp" node -e "
   try {
     const fs = require('fs');
     const txt = fs.readFileSync(process.env.FALLOW_TMP, 'utf8');
     const o = JSON.parse(txt);
     process.stdout.write(o && typeof o === 'object' && 'verdict' in o ? '1' : '0');
   } catch { process.stdout.write('0'); }
-\")
-if [ \"$FALLOW_OK\" != \"1\" ]; then
-  FALLOW_STDERR_SUMMARY=$(head -5 \"$FALLOW_STDERR_TMP\")
-  rm -f \"${FALLOW_JSON_PATH}.tmp\" \"$FALLOW_STDERR_TMP\"
-  echo \"WARNING: fallow structural pre-pass failed (exit ${FALLOW_EXIT}): ${FALLOW_STDERR_SUMMARY}\"
-  FALLOW_JSON_PATH=\"\"
+")
+if [ "$FALLOW_OK" != "1" ]; then
+  FALLOW_STDERR_SUMMARY=$(head -5 "$FALLOW_STDERR_TMP")
+  rm -f "${FALLOW_JSON_PATH}.tmp" "$FALLOW_STDERR_TMP"
+  echo "WARNING: fallow structural pre-pass failed (exit ${FALLOW_EXIT}): ${FALLOW_STDERR_SUMMARY}"
+  FALLOW_JSON_PATH=""
 else
-  mv \"${FALLOW_JSON_PATH}.tmp\" \"$FALLOW_JSON_PATH\"
-  rm -f \"$FALLOW_STDERR_TMP\"
+  mv "${FALLOW_JSON_PATH}.tmp" "$FALLOW_JSON_PATH"
+  rm -f "$FALLOW_STDERR_TMP"
 fi
 ```
 
@@ -477,6 +485,16 @@ if [ -n "$FALLOW_JSON_PATH" ] && [ -f "$FALLOW_JSON_PATH" ]; then
 fi
 ```
 
+Build practices contribution block for agent:
+```bash
+PRACTICES_CONTRIBUTION_BLOCK=""
+if [ -n "$PRACTICES_CONTRIBUTION_FRAGMENT" ]; then
+  # Escape any literal closing tag before embedding; the closing tag literal is escaped so text arriving from outside this workflow cannot end the block early and steer the reviewer.
+  SAFE_PRACTICES_FRAGMENT=$(echo "$PRACTICES_CONTRIBUTION_FRAGMENT" | sed 's#</practices_contribution>#<\/practices_contribution>#g')
+  PRACTICES_CONTRIBUTION_BLOCK=$(printf '<practices_contribution>\n%s\n</practices_contribution>\n' "$SAFE_PRACTICES_FRAGMENT")
+fi
+```
+
 Spawn the pp-code-reviewer agent:
 
 Print: `◆ Spawning code reviewer... (runs in a subagent — no output until it returns, ~1–5 min; expected, not a freeze)`
@@ -489,6 +507,8 @@ ${FILES_TO_READ}
 
 ${STRUCTURAL_FINDINGS_BLOCK}
 
+${PRACTICES_CONTRIBUTION_BLOCK}
+
 <config>
 depth: ${REVIEW_DEPTH}
 phase_dir: ${PHASE_DIR}
@@ -549,6 +569,30 @@ fi
 ```
 </step>
 
+<step name="check_practice_boundaries">
+This is a safety report about untrusted client vault text already written to `${REVIEW_PATH}`, ahead of `dispatch_fix`, and never skipped when `--fix` short-circuits `present_results`. A boundary shortfall is a defect in the report, not the reviewed code, so this check never changes an exit status — failing the review would punish the wrong artifact. The detection logic lives in `src/practices-review-check.cts`, a compiled module whose own test suite (`tests/practices-review-check.test.cjs`) pins the property that a malformed finding can only ever change its own verdict, never a sibling's.
+
+```bash
+pp_run check practices-review --review "${REVIEW_PATH}" --boundaries 2>/dev/null || true
+```
+</step>
+
+<step name="check_unfenced_vault_quotes">
+Safety report about client vault text already in `${REVIEW_PATH}`, scoped to the WHOLE file — the sibling above cannot see a verbatim client quote unfenced in narrative prose. The comparison corpus is the client's own words from inside the boundary lines only, never the fixed reference-data sentences the check itself prepends to every excerpt. Reports findings only and never changes an exit status — a quote shortfall is a defect in the review, not the reviewed code. The detection logic lives in the same compiled `src/practices-review-check.cts` module as the sibling step above, with its own pinned regression tests.
+
+**Resolve and compare in one block**, deliberately: the block resolves and consumes the corpus in one invocation AND decides whether to attempt the resolution from inside that same invocation, because a gate read from another fenced block is the identical failure the merge exists to prevent. `REVIEW_FILES` and `REVIEW_PATH` are still read from earlier in the workflow — they are this step's actual inputs, not its gate — and both now degrade visibly rather than silently: an empty `REVIEW_PATH` produces an operator-visible usage line instead of a byte-identical clean result (the CLI seam's empty-value guard, T-27-R8-05), and an empty or unset `REVIEW_FILES` produces its own one-line notice from inside this same block, before the corpus is ever resolved — an unresolved comparison corpus is never mistaken for a clean result. A test harness can supply both `REVIEW_PATH` and `VAULT_QUOTE_CORPUS` directly, no vault/matcher/model:
+
+```bash
+VAULT_QUOTE_CORPUS=""
+if [ -z "${REVIEW_FILES[@]+x}" ]; then
+  echo "practices quote check: no review files in scope — corpus not resolved"
+elif ! VAULT_QUOTE_CORPUS=$(pp_run vault practices match "${REVIEW_FILES[@]}" --raw 2>/dev/null); then
+  VAULT_QUOTE_CORPUS=""
+fi
+VAULT_QUOTE_CORPUS="${VAULT_QUOTE_CORPUS}" pp_run check practices-review --review "${REVIEW_PATH}" --quotes 2>/dev/null || true
+```
+</step>
+
 <step name="dispatch_fix">
 If the `--fix` flag was passed (`FIX_FLAG=true`), delegate to the `code-review-fix.md` workflow
 to auto-apply findings from the REVIEW.md that was just written (or that already existed).
@@ -612,6 +656,15 @@ INFO=$(echo "$FRONTMATTER" | grep "info:" | head -1 | cut -d: -f2 | xargs)
 TOTAL=$(echo "$FRONTMATTER" | grep "total:" | head -1 | cut -d: -f2 | xargs)
 ```
 
+The six lines above take the first match over the whole frontmatter and therefore read the bugs/security numbers only — this is why the practices key below is read from its own slice and written after the existing counts (D-07):
+
+```bash
+# Scoped read: the practices: block only, so its total: line can never collide with
+# the bugs/security first-match extraction above.
+PRACTICES_FRONTMATTER_BLOCK=$(printf '%s\n' "$FRONTMATTER" | sed -n -e '/^practices:/,/^[^[:space:]]/{' -e '/^practices:/p' -e '/^[[:space:]]/p' -e '}')
+PRACTICES_TOTAL=$(echo "$PRACTICES_FRONTMATTER_BLOCK" | grep -E "^[[:space:]]*total:" | head -1 | cut -d: -f2 | xargs)
+```
+
 Display inline summary to user:
 
 ```
@@ -630,10 +683,13 @@ Display inline summary to user:
     Info:      ${INFO}
     ──────────
     Total:     ${TOTAL}
+${PRACTICES_TOTAL:+  Practices (advisory): ${PRACTICES_TOTAL}}
 
 ───────────────────────────────────────────────────────────────
 ```
 
+When `PRACTICES_TOTAL` is empty, omit the Practices line entirely — the block renders exactly as it did before this phase, with no blank line left in its place.
+
 If status is "clean":
 ```
 ✓ No issues found. All ${FILES_REVIEWED} files pass review at ${REVIEW_DEPTH} depth.