@qijenchen/design-system 0.1.0-beta.13 → 0.1.0-beta.130

package/ds-canonical/hooks/tests/test_check_solo_workflow.sh

@@ -1,20 +1,19 @@
 #!/bin/bash
-# Tests for check_solo_workflow.sh(M28,2026-05-08 codified)
-#
-# Hook 規則(PreToolUse,Bash + mcp__github__create_pull_request + mcp__github__merge_pull_request):
-#   R1. `git checkout -b claude/X` 第 2 次 in same session → BLOCK exit 2
-#       (1st creation OK,record to TRACK_FILE)
-#   R2. `gh pr create` / `gh api -X POST .../pulls` / mcp__github__create_pull_request → BLOCK exit 2
-#       (read-only `gh api .../pulls/N/comments` 不 block)
-#   R3. `git push ... main` / mcp__github__merge_pull_request 無 user "push" trigger → BLOCK exit 2
-#       (transcript 含 push/OK/合 main keyword → silent pass)
-# Override:CLAUDE_BYPASS_SOLO_WORKFLOW=1 → silent (audit-logged)。
-# Non-Bash non-MCP / 非觸發 command → silent。
+# Contract tests for protected-main solo workflow(M28).
 
 set -u
 
+# This suite intentionally verifies isolated runtime-state writes. Do not inherit
+# the read-only replay flag from the aggregate runner.
+export GOVERNANCE_READ_ONLY=0
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 HOOK="$SCRIPT_DIR/../check_solo_workflow.sh"
+REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null)" || {
+  echo "FATAL: canonical hook test is not inside a Git worktree"
+  exit 1
+}
+REPO_ROOT="$(cd "$REPO_ROOT" && pwd -P)"
 
 if [ ! -x "$HOOK" ]; then
   echo "FATAL: hook not executable: $HOOK"
@@ -24,178 +23,160 @@ fi
 PASS=0
 FAIL=0
 FAILED_TESTS=""
-
 TMP_DIR=$(mktemp -d)
+# A failed mktemp leaves TMP_DIR empty, and `cd "" && pwd -P` resolves to the CURRENT
+# directory — which run-all.sh has already set to this test corpus. The EXIT trap below
+# would then delete the corpus itself. Fail loudly before the value can be weaponized.
+if [ -z "${TMP_DIR:-}" ] || [ ! -d "$TMP_DIR" ]; then
+  echo "❌ mktemp -d failed(TMPDIR=${TMPDIR:-unset});fixture unavailable" >&2
+  exit 1
+fi
+TMP_DIR="$(cd "$TMP_DIR" && pwd -P)"
 trap 'rm -rf "$TMP_DIR"' EXIT
 
-# Override CLAUDE_PROJECT_DIR so TRACK_FILE / BYPASS_LOG land in TMP_DIR
-# (避免污染 repo .claude/logs/)
-export CLAUDE_PROJECT_DIR="$TMP_DIR"
-mkdir -p "$TMP_DIR/.claude/logs"
-TRACK_FILE="$TMP_DIR/.claude/logs/session-branch-track.jsonl"
-
-build_transcript() {
-  local path="$1"; shift
-  : > "$path"
-  for msg in "$@"; do
-    jq -n --arg t "$msg" \
-      '{type:"user", message:{role:"user", content:$t}}' >> "$path"
-  done
-}
+export GOVERNANCE_PROJECT_DIR="$TMP_DIR"
+
+git -C "$TMP_DIR" init -q
+GIT_DIR="$(git -C "$TMP_DIR" rev-parse --absolute-git-dir)"
+GIT_DIR="$(cd "$GIT_DIR" && pwd -P)"
+export GOVERNANCE_STATE_DIR="$GIT_DIR/governance-runtime"
+export GOVERNANCE_TELEMETRY_OPT_IN=1
+TRACK_FILE="$GOVERNANCE_STATE_DIR/session-branch-track.jsonl"
+git -C "$TMP_DIR" config user.email governance-test@example.invalid
+git -C "$TMP_DIR" config user.name governance-test
+printf 'base\n' > "$TMP_DIR/fixture.txt"
+git -C "$TMP_DIR" add fixture.txt
+git -C "$TMP_DIR" commit -qm base
 
 run_hook_bash() {
-  local cmd="$1"; local session="${2:-sess-1}"; local transcript="${3:-}"
+  local cmd="$1"; local session="${2:-sess-1}"
   local payload
-  if [ -n "$transcript" ]; then
-    payload=$(jq -n \
-      --arg c "$cmd" --arg s "$session" --arg tp "$transcript" \
-      '{tool_name:"Bash", session_id:$s, transcript_path:$tp, tool_input:{command:$c}}')
-  else
-    payload=$(jq -n \
-      --arg c "$cmd" --arg s "$session" \
-      '{tool_name:"Bash", session_id:$s, tool_input:{command:$c}}')
-  fi
+  payload=$(jq -n --arg c "$cmd" --arg s "$session" '{tool_name:"Bash", session_id:$s, tool_input:{command:$c}}')
   STDOUT=$(mktemp); STDERR=$(mktemp)
   set +e
   printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
   EXIT=$?
   set -e
+  STDOUT_TEXT=$(cat "$STDOUT")
   STDERR_TEXT=$(cat "$STDERR")
   rm -f "$STDOUT" "$STDERR"
 }
 
 run_hook_mcp() {
-  local tool="$1"; local transcript="${2:-}"
+  local tool="$1"
   local payload
-  if [ -n "$transcript" ]; then
-    payload=$(jq -n --arg t "$tool" --arg tp "$transcript" \
-      '{tool_name:$t, transcript_path:$tp, tool_input:{}}')
-  else
-    payload=$(jq -n --arg t "$tool" \
-      '{tool_name:$t, tool_input:{}}')
-  fi
+  payload=$(jq -n --arg t "$tool" '{tool_name:$t, tool_input:{}}')
   STDOUT=$(mktemp); STDERR=$(mktemp)
   set +e
   printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
   EXIT=$?
   set -e
+  STDOUT_TEXT=$(cat "$STDOUT")
   STDERR_TEXT=$(cat "$STDERR")
   rm -f "$STDOUT" "$STDERR"
 }
 
 expect_pass_silent() {
   local name="$1"
-  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ]; then
+  if [ "$EXIT" = "0" ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then
     echo "  PASS  $name"; PASS=$((PASS+1))
   else
-    echo "  FAIL  $name (expected silent, exit=$EXIT, stderr=$([ -n "$STDERR_TEXT" ] && echo non-empty || echo empty))"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    echo "  FAIL  $name(expected silent, exit=$EXIT)"
+    echo "$STDERR_TEXT" | sed 's/^/    /'
     FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
   fi
 }
 
 expect_block() {
   local name="$1"; local needle="$2"
-  if [ "$EXIT" = "2" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
+  if [ "$EXIT" = "2" ] && [ -z "$STDOUT_TEXT" ] \
+    && ! grep -qF 'GOVERNANCE_INTEGRITY:' <<<"$STDERR_TEXT" \
+    && grep -qF "$needle" <<<"$STDERR_TEXT"; then
     echo "  PASS  $name"; PASS=$((PASS+1))
   else
-    echo "  FAIL  $name (expected BLOCK exit=2 + '$needle', got exit=$EXIT)"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    echo "  FAIL  $name(expected exit=2 + $needle, got $EXIT)"
+    echo "$STDERR_TEXT" | sed 's/^/    /'
     FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
   fi
 }
 
-echo "=== check_solo_workflow tests ==="
-
-TX_NO_TRIGGER="$TMP_DIR/tx_no_trigger.jsonl"
-build_transcript "$TX_NO_TRIGGER" \
-  "請幫我看一下" \
-  "改個 padding" \
-  "audit 一下" \
-  "謝謝" \
-  "再 review"
-
-TX_PUSH_TRIGGER="$TMP_DIR/tx_push_trigger.jsonl"
-build_transcript "$TX_PUSH_TRIGGER" \
-  "請改" \
-  "OK 看起來不錯" \
-  "可以 push 了" \
-  "合進去" \
-  "謝謝"
-
-# 1. Non-Bash / Non-MCP tool → silent
+echo "=== check_solo_workflow protected-main tests ==="
+
 payload_other=$(jq -n '{tool_name:"Read", tool_input:{file_path:"/a"}}')
 STDOUT=$(mktemp); STDERR=$(mktemp)
 set +e
 printf '%s' "$payload_other" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
 EXIT=$?
 set -e
+STDOUT_TEXT=$(cat "$STDOUT")
 STDERR_TEXT=$(cat "$STDERR")
 rm -f "$STDOUT" "$STDERR"
-expect_pass_silent "1. tool=Read → skip"
+expect_pass_silent "1. non-Bash tool skips"
 
-# 2. Non-trigger Bash command → silent
 run_hook_bash "ls -la"
-expect_pass_silent "2. innocuous bash → silent"
+expect_pass_silent "2. innocuous Bash passes"
 
-# 3. R1: First `git checkout -b claude/foo` for session → silent + record
 rm -f "$TRACK_FILE"
 run_hook_bash "git checkout -b claude/foo" "sess-A"
-expect_pass_silent "3. R1 first claude/foo branch → silent (recorded)"
+expect_pass_silent "3. first provider branch is recorded"
 
-# 4. R1: Second different branch in SAME session → BLOCK
-# (TRACK_FILE has sess-A → claude/foo from test 3)
-run_hook_bash "git checkout -b claude/bar" "sess-A"
-expect_block "4. R1 second branch same session → BLOCK" "R1 BLOCKER"
+run_hook_bash "git switch -c codex/bar" "sess-A"
+expect_block "4. second cross-provider branch is blocked" "R1 BLOCKER"
 
-# 5. R1: Same branch name reuse in same session → silent (EXISTING == NEW_BRANCH)
-# Hook 邏輯:已存在 + 同 branch 名 → 不 block (跳 if 條件)。
 run_hook_bash "git checkout -b claude/foo" "sess-A"
-expect_pass_silent "5. R1 same branch reuse same session → silent"
+expect_pass_silent "5. same branch recovery passes"
 
-# 6. R2: gh pr create → BLOCK
-run_hook_bash "gh pr create --title 'x' --body 'y'"
-expect_block "6. R2 gh pr create → BLOCK" "R2 BLOCKER"
+run_hook_bash "git switch -c codex/other" "sess-B"
+expect_pass_silent "6. switch -c recognized for a new session"
 
-# 7. R2: read-only gh api pulls/N/comments → silent (allow read collab)
-run_hook_bash "gh api repos/foo/bar/pulls/123/comments"
-expect_pass_silent "7. R2 read-only gh api .../comments → silent"
+run_hook_bash "gh pr create --title x --body y"
+expect_pass_silent "7. PR creation is canonical"
 
-# 8. R2: gh api -X POST pulls → BLOCK (write method)
 run_hook_bash "gh api -X POST repos/foo/bar/pulls -f title=x"
-expect_block "8. R2 gh api -X POST pulls → BLOCK" "R2 BLOCKER"
+expect_pass_silent "8. PR API creation is canonical"
+
+run_hook_bash "git push origin main" "sess-C"
+expect_block "9. direct main push blocked" "R2 BLOCKER"
 
-# 9. R3: git push origin main + no trigger transcript → BLOCK
-run_hook_bash "git push origin main" "sess-B" "$TX_NO_TRIGGER"
-expect_block "9. R3 push main no trigger → BLOCK" "R3 BLOCKER"
+run_hook_bash "git push origin HEAD:main" "sess-D"
+expect_block "10. standing authorization cannot bypass protected main" "R2 BLOCKER"
 
-# 10. R3: git push origin main + trigger transcript → silent
-run_hook_bash "git push origin main" "sess-C" "$TX_PUSH_TRIGGER"
-expect_pass_silent "10. R3 push main + push trigger → silent"
+run_hook_bash "gh pr merge 42 --squash" "sess-E"
+expect_pass_silent "11. gh PR merge has no transcript approval gate"
+
+run_hook_bash "gh api -X PUT repos/foo/bar/pulls/42/merge" "sess-E"
+expect_pass_silent "12. API PR merge has no transcript approval gate"
 
-# 11. MCP create_pull_request → BLOCK
 run_hook_mcp "mcp__github__create_pull_request"
-expect_block "11. MCP create_pull_request → BLOCK" "R2 BLOCKER"
+expect_pass_silent "13. MCP PR creation is canonical"
+
+run_hook_mcp "mcp__github__merge_pull_request"
+expect_pass_silent "14. MCP merge has no transcript approval gate"
 
-# 12. MCP merge_pull_request + no trigger → BLOCK
-run_hook_mcp "mcp__github__merge_pull_request" "$TX_NO_TRIGGER"
-expect_block "12. MCP merge no trigger → BLOCK" "R3 BLOCKER"
+run_hook_bash "git push origin v1.2.3"
+expect_pass_silent "15. tag lifecycle is not blocked by retired local preflight R4"
 
-# 13. CLAUDE_BYPASS_SOLO_WORKFLOW=1 override → silent
-payload_bypass=$(jq -n '{tool_name:"Bash", session_id:"sess-X", tool_input:{command:"gh pr create"}}')
+run_hook_bash "echo 'git push origin v1.2.3'"
+expect_pass_silent "16. quoted tag example remains inert"
+
+payload_bypass=$(jq -n '{tool_name:"Bash", session_id:"sess-X", tool_input:{command:"git push origin main"}}')
 STDOUT=$(mktemp); STDERR=$(mktemp)
 set +e
-printf '%s' "$payload_bypass" | CLAUDE_BYPASS_SOLO_WORKFLOW=1 bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+printf '%s' "$payload_bypass" | GOVERNANCE_BYPASS_SOLO_WORKFLOW=1 bash "$HOOK" >"$STDOUT" 2>"$STDERR"
 EXIT=$?
 set -e
 STDERR_TEXT=$(cat "$STDERR")
+STDOUT_TEXT=$(cat "$STDOUT")
 rm -f "$STDOUT" "$STDERR"
-expect_pass_silent "13. CLAUDE_BYPASS_SOLO_WORKFLOW=1 override → silent"
+expect_pass_silent "17. audited recovery override passes local hook"
+
+run_hook_bash "GOVERNANCE_BYPASS_SOLO_WORKFLOW=1 git push origin main"
+expect_block "18. command text cannot self-authorize recovery override" "R2 BLOCKER"
 
 echo ""
 echo "=== Summary ==="
 echo "Passed: $PASS / $((PASS + FAIL))"
 if [ "$FAIL" -gt 0 ]; then
-  echo "Failed:$FAILED_TESTS"
+  echo -e "Failed:$FAILED_TESTS"
   exit 1
 fi

package/ds-canonical/hooks/tests/test_check_spec_class_drift.sh

@@ -3,7 +3,7 @@
 #
 # Hook 規則:Edit/Write/MultiEdit 對 packages/design-system/src/components/*/[a-z-]*.spec.md
 # 偵測 spec.md 寫「固定/寫死/硬寫 h-NN」但對應 tsx 已 migrate to var(--chrome-header-height)
-# token → stderr P1 warn(不 block;exit 0)。
+# token → stdout neutral governanceContext(不 block;exit 0),由 provider adapter 轉譯。
 #
 # Allow escape:NEW_CONTENT 含 `@spec-class-drift-allow:` → silent。
 # 非 spec.md / tsx 不存在 → silent。
@@ -52,13 +52,14 @@ run_hook() {
   printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
   EXIT=$?
   set -e
+  STDOUT_TEXT=$(cat "$STDOUT")
   STDERR_TEXT=$(cat "$STDERR")
   rm -f "$STDOUT" "$STDERR"
 }
 
 expect_pass_silent() {
   local name="$1"
-  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ]; then
+  if [ "$EXIT" = "0" ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then
     echo "  PASS  $name"; PASS=$((PASS+1))
   else
     echo "  FAIL  $name (expected silent, exit=$EXIT, stderr=$([ -n "$STDERR_TEXT" ] && echo non-empty || echo empty))"
@@ -67,17 +68,34 @@ expect_pass_silent() {
   fi
 }
 
-expect_warn() {
+expect_context() {
   local name="$1"; local needle="$2"
-  if [ "$EXIT" = "0" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
+  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] \
+    && printf '%s' "$STDOUT_TEXT" | jq -e --arg needle "$needle" '
+      (. | keys) == ["governanceContext"]
+      and .governanceContext.hookEventName == "PreToolUse"
+      and (.governanceContext.message | contains($needle))
+    ' >/dev/null 2>&1; then
     echo "  PASS  $name"; PASS=$((PASS+1))
   else
-    echo "  FAIL  $name (expected warn '$needle', exit=$EXIT)"
+    echo "  FAIL  $name (expected neutral context '$needle', exit=$EXIT)"
+    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
     echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
     FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
   fi
 }
 
+expect_integrity() {
+  local name="$1"
+  if [ "$EXIT" = "70" ] && [ -z "$STDOUT_TEXT" ] \
+    && echo "$STDERR_TEXT" | grep -qF "GOVERNANCE_INTEGRITY:"; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected integrity exit 70, got exit=$EXIT)"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
 echo "=== check_spec_class_drift tests ==="
 
 # 1. Non-spec file (tsx) → skip silent
@@ -101,7 +119,7 @@ export const Drifty = () => (
 );
 ")
 run_hook "Edit" "$SPEC_PATH" "header 高度固定 h-14,不可改"
-expect_warn "4. spec '固定 h-14' + tsx token → warn" "SPEC-CODE REVERSE DRIFT"
+expect_context "4. spec '固定 h-14' + tsx token → neutral context" "SPEC-CODE REVERSE DRIFT"
 
 # 5. spec 寫「寫死 h-12」+ tsx 不含 h-12 → P1 warn (phrase mismatch pattern 1)
 SPEC_PATH=$(build_pair "noclass" "
@@ -110,7 +128,7 @@ export const NoClass = () => (
 );
 ")
 run_hook "Edit" "$SPEC_PATH" "container 寫死 h-12 處理"
-expect_warn "5. spec '寫死 h-12' + tsx 不含 h-12 → warn" "SPEC-CODE REVERSE DRIFT"
+expect_context "5. spec '寫死 h-12' + tsx 不含 h-12 → neutral context" "SPEC-CODE REVERSE DRIFT"
 
 # 6. spec 寫「固定 h-14」+ allow marker → silent
 SPEC_PATH=$(build_pair "allowed" "
@@ -126,6 +144,16 @@ expect_pass_silent "6. spec with @spec-class-drift-allow: marker → silent"
 run_hook "Read" "$SPEC_PATH" "固定 h-14"
 expect_pass_silent "7. tool=Read → skip"
 
+# 8. Malformed canonical input is an integrity fault,never a silent diagnostic.
+STDOUT=$(mktemp); STDERR=$(mktemp)
+set +e
+printf '%s' 'not-json' | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+EXIT=$?
+set -e
+STDOUT_TEXT=$(cat "$STDOUT"); STDERR_TEXT=$(cat "$STDERR")
+rm -f "$STDOUT" "$STDERR"
+expect_integrity "8. malformed input → integrity 70"
+
 echo ""
 echo "=== Summary ==="
 echo "Passed: $PASS / $((PASS + FAIL))"

package/ds-canonical/hooks/tests/test_check_ssot_header_declaration.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+# test_check_ssot_header_declaration.sh — 新建 production tsx 必帶「── 消費的 SSOT ──」段
+# (2026-07-07 治理進化方向 3 洞 a;P0 exit 2;ratchet:只攔 Write 新檔)
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/check_ssot_header_declaration.sh"
+if [ ! -f "$HOOK" ]; then echo "FATAL: hook not found: $HOOK"; exit 1; fi
+
+PASS=0; FAIL=0; FAILED_TESTS=""
+
+run_hook() {
+  local file_path="$1"; local content="$2"; local tool="${3:-Write}"
+  STDERR_TEXT=$(jq -n --arg t "$tool" --arg f "$file_path" --arg c "$content" \
+    '{tool_name:$t, tool_input:{file_path:$f, content:$c}}' | bash "$HOOK" 2>&1 >/dev/null)
+  EXIT=$?
+}
+
+expect_block() {
+  local name="$1"
+  if [ "$EXIT" = "2" ] && echo "$STDERR_TEXT" | grep -qF "消費的 SSOT"; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected exit=2, got $EXIT)"; FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+expect_silent() {
+  local name="$1"
+  if [ "$EXIT" = "0" ]; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected exit=0, got $EXIT)"; FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
+echo "=== check_ssot_header_declaration tests ==="
+
+# 1. 新元件 tsx 無宣告段 → BLOCK
+run_hook "/repo/packages/design-system/src/components/NewThing/new-thing.tsx" 'import * as React from "react"
+export const NewThing = () => <div className="flex border rounded-md px-2" />'
+expect_block "1. 新元件 tsx 無 SSOT 段 → BLOCK"
+
+# 2. 有宣告段 → pass
+run_hook "/repo/packages/design-system/src/components/NewThing/new-thing.tsx" '// ── 消費的 SSOT ──
+// - Button(pill layout)/ --layout-space-tight
+import * as React from "react"'
+expect_silent "2. 有「── 消費的 SSOT ──」段 → pass"
+
+# 3. escape marker → pass
+run_hook "/repo/packages/design-system/src/components/NewThing/util.tsx" '// @ssot-header-exempt: 純型別 utility,零視覺
+export type X = string'
+expect_silent "3. @ssot-header-exempt escape → pass"
+
+# 4. stories 檔 → 豁免
+run_hook "/repo/packages/design-system/src/components/NewThing/new-thing.stories.tsx" 'export default {}'
+expect_silent "4. stories.tsx 豁免"
+
+# 5. 非 DS production 路徑 → 豁免
+run_hook "/repo/apps/template/src/App.tsx" 'export const App = () => <div className="flex border px-2" />'
+expect_silent "5. apps/ 路徑豁免"
+
+# 6. Edit 工具(存量檔)→ 豁免(ratchet)
+run_hook "/repo/packages/design-system/src/components/Button/button.tsx" 'whatever' "Edit"
+expect_silent "6. Edit(存量 ratchet)豁免"
+
+# 7. patterns/ 新檔無宣告 → BLOCK
+run_hook "/repo/packages/design-system/src/patterns/new-pattern/new-pattern.tsx" 'export const P = () => <div className="absolute shadow px-2" />'
+expect_block "7. patterns/ 新檔無 SSOT 段 → BLOCK"
+
+echo ""
+echo "=== Summary ==="
+echo "Passed: $PASS / $((PASS+FAIL))"
+if [ "$FAIL" -gt 0 ]; then printf "Failed:%b\n" "$FAILED_TESTS"; exit 1; fi
+exit 0

package/ds-canonical/hooks/tests/{test_check_story_anatomy.sh.broken → test_check_story_anatomy.sh}

@@ -1,17 +1,20 @@
 #!/bin/bash
 # Tests for check_story_anatomy.sh
 #
-# Runs 5 scenarios by crafting PreToolUse JSON payloads on stdin and checking
+# Runs focused R1 scenarios by crafting PreToolUse JSON payloads on stdin and checking
 # the hook's exit code (0 = pass / 2 = block) + stderr output.
 #
 # Usage: bash test_check_story_anatomy.sh
 
 set -u
 
+export GOVERNANCE_PROVIDER=codex
+export GOVERNANCE_READ_ONLY=1
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # Cluster A merge(2026-05-10):check_story_anatomy.sh 已 fold 進
 # check_story_invariants.sh dispatcher R1。本 test 改 call dispatcher,
-# dispatcher 會跑 5 rule(R1 anatomy + R2-R5),anatomy 違反時 R1 fire 攔截。
+# dispatcher 會跑完整 story rules；anatomy 違反時 R1 fire 攔截。
 HOOK="$SCRIPT_DIR/../check_story_invariants.sh"
 
 if [ ! -x "$HOOK" ]; then
@@ -37,7 +40,7 @@ run_hook() {
     --arg tool "$tool" \
     --arg fp "$file_path" \
     --arg c  "$content" \
-    '{tool_name: $tool, tool_input: {file_path: $fp, content: $c}}')
+    '{hook_event_name: "PreToolUse", tool_name: $tool, tool_input: {file_path: $fp, content: $c}}')
 
   STDOUT=$(mktemp)
   STDERR=$(mktemp)
@@ -144,7 +147,7 @@ export const Default = {
 }
 EOF
 run_hook "/fake/src/design-system/components/Dialog/dialog.stories.tsx" "$T3_CONTENT"
-expect_block "Test 3 dismiss via label Button is blocked" "B dismiss via label Button"
+expect_block "Test 3 dismiss via label Button is blocked" "[B dismiss via label]"
 
 # ── Test 4: file-level allowlist → bypass ────────────────────────────────────
 echo ""
@@ -185,6 +188,72 @@ EOF
 run_hook "/fake/src/design-system/components/Menu/menu.stories.tsx" "$T5_CONTENT"
 expect_block "Test 5 per-line exempt skips one line but next violation still blocks" "A.1"
 
+# ── Test 6: canonical first child is allowlisted ─────────────────────────────
+echo ""
+echo "Test 6: raw flex row whose first child is canonical → pass"
+run_hook "/fake/src/design-system/components/Menu/menu.stories.tsx" \
+  '<div className="flex items-center gap-2"><MenuItem /></div>'
+expect_pass "Test 6 canonical first child is not an A.1 violation"
+
+# ── Test 7-8: full-surface loading + lookahead boundary ──────────────────────
+echo ""
+echo "Test 7: absolute inset loading with nearby progress → block"
+run_hook "/fake/src/design-system/components/Foo/foo.stories.tsx" '
+<div className="absolute inset-0 flex items-center">
+  <CircularProgress />
+</div>'
+expect_block "Test 7 hand-crafted loading is blocked" "[A.3 hand-craft loading]"
+
+echo ""
+echo "Test 8: progress outside four-line lookahead → pass"
+run_hook "/fake/src/design-system/components/Foo/foo.stories.tsx" '
+<div className="absolute inset-0 flex items-center">
+  <span />
+  <span />
+  <span />
+  <span />
+  <CircularProgress />
+</div>'
+expect_pass "Test 8 A.3 lookahead boundary is preserved"
+
+# ── Test 9: hand-crafted field ───────────────────────────────────────────────
+echo ""
+echo "Test 9: raw h-field input → block"
+run_hook "/fake/src/design-system/components/Foo/foo.stories.tsx" \
+  '<input className="h-field-md border-border" />'
+expect_block "Test 9 hand-crafted field is blocked" "[A.4 hand-craft field]"
+
+# ── Test 10-11: overlay context + boundary ───────────────────────────────────
+echo ""
+echo "Test 10: absolute styled div with nearby dismiss → block"
+run_hook "/fake/src/design-system/components/Foo/foo.stories.tsx" '
+<div className="absolute bg-surface shadow-lg">
+  <span />
+  {onClose()}
+</div>'
+expect_block "Test 10 hand-crafted overlay is blocked" "[C hand-craft overlay]"
+
+echo ""
+echo "Test 11: dismiss outside six-line lookahead → pass"
+run_hook "/fake/src/design-system/components/Foo/foo.stories.tsx" '
+<div className="absolute bg-surface shadow-lg">
+  <span />
+  <span />
+  <span />
+  <span />
+  <span />
+  <span />
+  {onClose()}
+</div>'
+expect_pass "Test 11 C lookahead boundary is preserved"
+
+# ── Test 12: DataTable family owns raw table anatomy ─────────────────────────
+echo ""
+echo "Test 12: DataTable family raw table → pass"
+run_hook "/fake/packages/design-system/src/components/DataTable/data-table.stories.tsx" \
+  '<table><tbody><tr><td>x</td></tr></tbody></table>'
+expect_pass "Test 12 DataTable raw-table family exemption is preserved"
+
 # ── Summary ──────────────────────────────────────────────────────────────────
 echo ""
 echo "════════════════════════════════════════"