@qijenchen/design-system 0.1.0-beta.13 → 0.1.0-beta.131

package/ds-canonical/hooks/tests/test_check_consumer_story_baseline.sh

@@ -0,0 +1,209 @@
+#!/bin/bash
+# 2026-06-11 payload 正交化:bare `open` 不匹配 R3 P6 regex(open={true})、Sheet 無 defaultOpen 觸 R3 — 合併檔跑全規則,payload 須對非受測規則 clean
+# 2026-06-11 repoint:check_consumer_story_baseline.sh 已合併進 check_consumer_app_invariants.sh(prune merge;測試 payload 不變 = 行為等價驗證)
+# Tests for check_consumer_app_invariants.sh(P0 BLOCKER,M31 codex synthesis 2026-05-27)
+#
+# Hook 規則(PreToolUse,Edit|Write|MultiEdit):
+#   - tool_name not in {Edit,Write,MultiEdit} → silent exit 0
+#   - file_path 必 match /(apps|consumer)/.*\.stories\.tsx$ 且 NOT packages/design-system/src/ → 否則 silent
+#   - content = tool_input.new_string // tool_input.content;空 → silent
+#   - escape:content 含 @story-baseline-allow: 或 @consumer-catalog-allow: → silent
+#   - 偵測高風險 primitive 用法 regex `<DS\.(DataTable|Dialog|Sheet|Popover|DropdownMenu|
+#     Tooltip|HoverCard|LinkInput|RadioGroup|CircularProgress|AppShell|Sidebar)\b`
+#   - 若用了高風險 primitive 但無 `@story-baseline:[[:space:]]*\S` marker → BLOCK exit 2 + stderr
+#   - 否則 silent exit 0
+#
+# Broad-vs-narrow(M34)symmetry coverage:
+#   - over-narrow guard:真實 violation(<DS.Dialog 無 marker)必 BLOCK
+#   - over-broad guard:near-miss(bare <Dialog / 註解提到 Dialog / <DS.SidebarItem)必 silent
+
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="$SCRIPT_DIR/../check_consumer_app_invariants.sh"
+
+if [ ! -x "$HOOK" ]; then
+  echo "FATAL: hook not executable: $HOOK"
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+FAILED_TESTS=""
+
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# Override GOVERNANCE_PROJECT_DIR so any _log-fire.sh state lands in TMP_DIR
+# (避免污染 repo .claude/logs/)
+export GOVERNANCE_PROJECT_DIR="$TMP_DIR"
+mkdir -p "$TMP_DIR/.claude/logs"
+
+# run_hook <tool_name> <file_path> <content>
+# content 走 tool_input.content(Write 形 shape);hook 讀 new_string // content 皆可。
+run_hook() {
+  local tool="$1"; local file_path="$2"; local content="$3"
+  local payload
+  payload=$(jq -n \
+    --arg t "$tool" --arg fp "$file_path" --arg c "$content" \
+    '{hook_event_name:"PreToolUse", tool_name:$t, tool_input:{file_path:$fp, content:$c}}')
+  STDOUT=$(mktemp); STDERR=$(mktemp)
+  set +e
+  printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  EXIT=$?
+  set -e
+  STDERR_TEXT=$(cat "$STDERR" 2>/dev/null)
+  rm -f "$STDOUT" "$STDERR"
+}
+
+# run_hook_edit <file_path> <new_string>
+# 走 tool_input.new_string(Edit 形 shape)驗 new_string 路徑也讀得到。
+run_hook_edit() {
+  local file_path="$1"; local new_string="$2"
+  local payload
+  payload=$(jq -n \
+    --arg fp "$file_path" --arg ns "$new_string" \
+    '{hook_event_name:"PreToolUse", tool_name:"Edit", tool_input:{file_path:$fp, new_string:$ns}}')
+  STDOUT=$(mktemp); STDERR=$(mktemp)
+  set +e
+  printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  EXIT=$?
+  set -e
+  STDERR_TEXT=$(cat "$STDERR" 2>/dev/null)
+  rm -f "$STDOUT" "$STDERR"
+}
+
+expect_pass_silent() {
+  local name="$1"
+  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ]; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected silent, exit=$EXIT, stderr=$([ -n "$STDERR_TEXT" ] && echo non-empty || echo empty))"
+    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
+expect_block() {
+  local name="$1"; local needle="$2"
+  if [ "$EXIT" = "2" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected BLOCK exit=2 + '$needle', got exit=$EXIT)"
+    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
+echo "=== check_consumer_story_baseline tests ==="
+
+CONSUMER_STORY="/repo/apps/template/src/Foo.stories.tsx"
+
+# ── POSITIVE cases(SHOULD BLOCK exit 2)──────────────────────────────
+
+# P1. apps/** stories wrap <DS.Dialog> 無 marker → BLOCK
+#     (over-narrow guard:真實 violation 必被抓)
+CONTENT_VIOLATION='import * as DS from "@qijenchen/design-system";
+export const Basic = () => (
+  <DS.Dialog open>
+    <DS.Dialog.Content>hi</DS.Dialog.Content>
+  </DS.Dialog>
+);'
+run_hook "Write" "$CONSUMER_STORY" "$CONTENT_VIOLATION"
+expect_block "P1. <DS.Dialog> 無 marker → BLOCK" "CONSUMER-STORY-BASELINE BLOCKER"
+
+# P2. consumer/** path variant + <DS.DataTable> 無 marker → BLOCK
+CONTENT_DT='import * as DS from "@qijenchen/design-system";
+export const Grid = () => <DS.DataTable data={rows} columns={cols} />;'
+run_hook "Edit" "/repo/consumer/dashboard/Table.stories.tsx" "$CONTENT_DT"
+# note: Edit shape via run_hook uses content field — hook reads new_string // content,content works.
+expect_block "P2. consumer/** <DS.DataTable> 無 marker → BLOCK" "CONSUMER-STORY-BASELINE BLOCKER"
+
+# P3. new_string path(Edit shape)+ <DS.Sidebar> 無 marker → BLOCK
+NS_SIDEBAR='import * as DS from "@qijenchen/design-system";
+export const Nav = () => <DS.Sidebar collapsible="icon" />;'
+run_hook_edit "$CONSUMER_STORY" "$NS_SIDEBAR"
+expect_block "P3. new_string path <DS.Sidebar> 無 marker → BLOCK" "CONSUMER-STORY-BASELINE BLOCKER"
+
+# P4. empty @story-baseline: marker(no value after colon)→ 仍 BLOCK
+#     (over-narrow guard on marker side:marker 必須有 non-whitespace value)
+CONTENT_EMPTY_MARKER='// @story-baseline:
+import * as DS from "@qijenchen/design-system";
+export const Basic = () => <DS.Popover />;'
+run_hook "Write" "$CONSUMER_STORY" "$CONTENT_EMPTY_MARKER"
+expect_block "P4. empty @story-baseline: value → still BLOCK" "CONSUMER-STORY-BASELINE BLOCKER"
+
+# ── NEGATIVE cases(SHOULD NOT trigger,silent exit 0)─────────────────
+
+# N1. 高風險 primitive + 有效 @story-baseline: marker → silent
+CONTENT_OK='// @story-baseline: @qijenchen/design-system/components/Dialog/dialog.stories.tsx#Basic
+import * as DS from "@qijenchen/design-system";
+export const Basic = () => <DS.Dialog defaultOpen><DS.Dialog.Content>hi</DS.Dialog.Content></DS.Dialog>;'
+run_hook "Write" "$CONSUMER_STORY" "$CONTENT_OK"
+expect_pass_silent "N1. <DS.Dialog> + valid marker → silent"
+
+# N2. escape clause @story-baseline-allow: → silent(即使無 marker)
+CONTENT_ALLOW='// @story-baseline-allow: pure behavior test, no visual baseline needed
+import * as DS from "@qijenchen/design-system";
+export const KeyboardOnly = () => <DS.Sheet defaultOpen />;'
+run_hook "Write" "$CONSUMER_STORY" "$CONTENT_ALLOW"
+expect_pass_silent "N2. @story-baseline-allow: escape → silent"
+
+# N3. non-stories consumer file(App.tsx)→ out of scope → silent
+run_hook "Write" "/repo/apps/template/src/App.tsx" "$CONTENT_VIOLATION"
+expect_pass_silent "N3. non-stories file (App.tsx) → out of scope silent"
+
+# N4. DS internal stories(packages/design-system/src/)→ excluded → silent
+run_hook "Write" "/repo/packages/design-system/src/components/Dialog/dialog.stories.tsx" "$CONTENT_VIOLATION"
+expect_pass_silent "N4. DS internal stories → excluded silent"
+
+# N5. non-Edit/Write/MultiEdit tool(Read)→ silent
+run_hook "Read" "$CONSUMER_STORY" "$CONTENT_VIOLATION"
+expect_pass_silent "N5. tool=Read → silent"
+
+# N6. over-broad guard A:bare <Dialog>(no DS. namespace prefix)from consumer-local import → silent
+#     consumer 用自己的 local Dialog,不是高風險 DS primitive → 不該 fire
+CONTENT_BARE='import { Dialog } from "./local-dialog";
+export const Basic = () => <Dialog open>hi</Dialog>;'
+run_hook "Write" "$CONSUMER_STORY" "$CONTENT_BARE"
+expect_pass_silent "N6. bare <Dialog> (local import) → silent (over-broad guard)"
+
+# P5. named-import 除鏽 POSITIVE(2026-07-10):bare <Dialog> 但由 DS package named-import 進來
+#     → 是真 DS Dialog(fork 慣用 named import 繞過 <DS.> 前綴)→ 無 marker 必 BLOCK
+CONTENT_NAMED='import { Dialog, Button } from "@qijenchen/design-system";
+export const Basic = () => <Dialog open><Button>ok</Button></Dialog>;'
+run_hook "Write" "$CONSUMER_STORY" "$CONTENT_NAMED"
+expect_block "P5. named-import <Dialog> from DS pkg 無 marker → BLOCK" "CONSUMER-STORY-BASELINE BLOCKER"
+
+# N7. over-broad guard B:comment / prose mentioning "Dialog DataTable Sheet" but no JSX usage → silent
+CONTENT_PROSE='// This story demonstrates a layout. We avoid Dialog and DataTable here.
+import * as DS from "@qijenchen/design-system";
+export const Layout = () => <DS.Stack gap="md"><DS.Button>ok</DS.Button></DS.Stack>;'
+run_hook "Write" "$CONSUMER_STORY" "$CONTENT_PROSE"
+expect_pass_silent "N7. prose mentions primitives but no <DS.X> usage → silent (over-broad guard)"
+
+# N8. over-broad guard C:near-miss token <DS.SidebarItem>(longer ident, Sidebar\b 不該 match)→ silent
+#     Sidebar\b 要求 word boundary;SidebarItem 的 'r'→'I' 非邊界 → 不 match,正確不 fire
+CONTENT_NEARMISS='import * as DS from "@qijenchen/design-system";
+export const Nav = () => <DS.SidebarItem label="Home" />;'
+run_hook "Write" "$CONSUMER_STORY" "$CONTENT_NEARMISS"
+expect_pass_silent "N8. <DS.SidebarItem> (not Sidebar\\b) → silent (over-broad guard)"
+
+# N9. empty content → silent
+run_hook "Write" "$CONSUMER_STORY" ""
+expect_pass_silent "N9. empty content → silent"
+
+# N10. consumer stories with only non-high-risk DS primitives → silent
+CONTENT_LOWRISK='import * as DS from "@qijenchen/design-system";
+export const Form = () => (<DS.Field><DS.Input /><DS.Button>Save</DS.Button></DS.Field>);'
+run_hook "Write" "$CONSUMER_STORY" "$CONTENT_LOWRISK"
+expect_pass_silent "N10. only low-risk DS primitives → silent"
+
+echo ""
+echo "=== Summary ==="
+echo "Passed: $PASS / $((PASS + FAIL))"
+if [ "$FAIL" -gt 0 ]; then
+  printf "Failed:%b\n" "$FAILED_TESTS"
+  exit 1
+fi
+exit 0

package/ds-canonical/hooks/tests/test_check_data_table_size_num_to_meta_width.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+# 2026-06-11 repoint:check_data_table_size_num_to_meta_width.sh 已合併進 check_datatable_invariants.sh(prune merge;測試 payload 不變 = 行為等價驗證)
+# Tests for check_datatable_invariants.sh(M23(c))
+
+set -u
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="$SCRIPT_DIR/../check_datatable_invariants.sh"
+[ ! -f "$HOOK" ] && { echo "FATAL"; exit 1; }
+PASS=0; FAIL=0
+
+run() {
+  local fp="$1"; local content="$2"
+  local payload=$(jq -n --arg fp "$fp" --arg c "$content" \
+    '{hook_event_name:"PreToolUse",tool_name:"Write",tool_input:{file_path:$fp,content:$c}}')
+  STDOUT=$(mktemp); STDERR=$(mktemp)
+  set +e
+  printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  EXIT=$?
+  set -e
+  STDOUT_TEXT=$(cat "$STDOUT"); STDERR_TEXT=$(cat "$STDERR")
+  rm -f "$STDOUT" "$STDERR"
+}
+
+is_exact_context() {
+  local needle="$1" compact
+  compact=$(printf '%s' "$STDOUT_TEXT" | jq -c . 2>/dev/null) || return 1
+  [ "$STDOUT_TEXT" = "$compact" ] || return 1
+  printf '%s' "$STDOUT_TEXT" | jq -se --arg needle "$needle" '
+    length == 1
+    and (.[0] | type == "object" and (keys | sort) == ["governanceContext"])
+    and (.[0].governanceContext |
+      (keys | sort) == ["hookEventName", "message"]
+      and .hookEventName == "PreToolUse"
+      and (.message | type == "string" and length > 0 and contains($needle)))
+  ' >/dev/null
+}
+
+# Test 1:ColumnDef + size:<number> 無 meta.width → warn
+echo "Test 1: ColumnDef size:280 → warn"
+CONTENT='const columns: ColumnDef[] = [{ accessorKey: "name", size: 280 }]'
+run "/path/columns.tsx" "$CONTENT"
+if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] && is_exact_context "M23(c)"; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL: no exact context"; FAIL=$((FAIL+1)); fi
+
+# Test 2:ColumnDef + meta.width → silent
+echo "Test 2: ColumnDef meta.width → silent"
+CONTENT='const columns: ColumnDef[] = [{ accessorKey: "name", meta: { width: "md" } }]'
+run "/path/columns.tsx" "$CONTENT"
+if [ "$EXIT" = "0" ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
+
+# Test 3:mixed(size + meta.width) → silent(transition state allowed)
+echo "Test 3: mixed size + meta.width → silent"
+CONTENT='const columns: ColumnDef[] = [{ size: 280, meta: { width: "md" } }]'
+run "/path/columns.tsx" "$CONTENT"
+if [ "$EXIT" = "0" ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
+
+# Test 4:non-DataTable context skip
+echo "Test 4: non-DataTable context skip"
+CONTENT='const x = { size: 280 }'
+run "/path/unrelated.tsx" "$CONTENT"
+if [ "$EXIT" = "0" ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
+
+# Test 5:stories.tsx skip
+echo "Test 5: stories.tsx skip"
+CONTENT='const columns: ColumnDef[] = [{ size: 280 }]'
+run "/path/foo.stories.tsx" "$CONTENT"
+if [ "$EXIT" = "0" ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
+
+echo ""
+echo "════ Results: $PASS PASS, $FAIL FAIL ════"
+[ "$FAIL" -gt 0 ] && exit 1
+exit 0

package/ds-canonical/hooks/tests/test_check_datatable_invariants.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # Tests for check_datatable_invariants.sh — merged 3 sub-rules
 #
-# 全 sub-rules 都是 P2 stderr-only(exit 0),不阻擋。verify stderr 內容對。
+# 全 sub-rules 都是 P2 governance context(exit 0),不阻擋。
 
 set -u
 
@@ -15,20 +15,47 @@ run_hook() {
   local file_path="$1" content="$2"
   STDOUT=$(mktemp); STDERR=$(mktemp)
   set +e
-  jq -n --arg fp "$file_path" --arg c "$content" \
-    '{tool_name:"Write", tool_input:{file_path:$fp, content:$c}}' \
+  printf '%s' "$content" \
+    | jq -Rs --arg fp "$file_path" \
+      '{hook_event_name:"PreToolUse", tool_name:"Write", tool_input:{file_path:$fp, content:.}}' \
     | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
   EXIT=$?
   set -e
-  STDERR_TEXT=$(cat "$STDERR"); rm -f "$STDOUT" "$STDERR"
+  STDOUT_TEXT=$(cat "$STDOUT"); STDERR_TEXT=$(cat "$STDERR"); rm -f "$STDOUT" "$STDERR"
 }
 
-expect_stderr() {
+run_raw() {
+  local payload="$1"
+  STDOUT=$(mktemp); STDERR=$(mktemp)
+  set +e
+  printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  EXIT=$?
+  set -e
+  STDOUT_TEXT=$(cat "$STDOUT"); STDERR_TEXT=$(cat "$STDERR"); rm -f "$STDOUT" "$STDERR"
+}
+
+is_exact_context() {
+  local needle="$1" compact
+  compact=$(printf '%s' "$STDOUT_TEXT" | jq -c . 2>/dev/null) || return 1
+  [ "$STDOUT_TEXT" = "$compact" ] || return 1
+  printf '%s' "$STDOUT_TEXT" | jq -se --arg needle "$needle" '
+    length == 1
+    and (.[0] | type == "object" and (keys | sort) == ["governanceContext"])
+    and (.[0].governanceContext |
+      type == "object"
+      and (keys | sort) == ["hookEventName", "message"]
+      and .hookEventName == "PreToolUse"
+      and (.message | type == "string" and length > 0 and contains($needle)))
+  ' >/dev/null
+}
+
+expect_context() {
   local name="$1" needle="$2"
-  if [ "$EXIT" = "0" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
+  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] && is_exact_context "$needle"; then
     echo "  PASS  $name"; PASS=$((PASS+1))
   else
-    echo "  FAIL  $name (expected stderr '$needle', exit $EXIT)"
+    echo "  FAIL  $name (expected exact PreToolUse context '$needle', exit $EXIT)"
+    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
     echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
     FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
   fi
@@ -36,7 +63,7 @@ expect_stderr() {
 
 expect_silent() {
   local name="$1"
-  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ]; then
+  if [ "$EXIT" = "0" ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then
     echo "  PASS  $name"; PASS=$((PASS+1))
   else
     echo "  FAIL  $name (expected silent exit 0, exit $EXIT, stderr: ${STDERR_TEXT:0:80})"
@@ -50,7 +77,7 @@ echo "=== B.1 row drag getRowId ==="
 run_hook "/r/src/app/products.tsx" '
 <DataTable enableRowDrag onReorder={fn} />
 '
-expect_stderr "B.1.1 enableRowDrag without getRowId → WARN" "row drag getRowId"
+expect_context "B.1.1 enableRowDrag without getRowId → WARN" "row drag getRowId"
 
 # 2. enableRowDrag + getRowId → silent
 run_hook "/r/src/app/products.tsx" '
@@ -73,7 +100,7 @@ const cols = [
   { accessorKey: "name", size: 240 },
 ]
 '
-expect_stderr "B.2.1 root size NUMBER → WARN" "column size NUMBER"
+expect_context "B.2.1 root size NUMBER → WARN" "column size NUMBER"
 
 # 5. column with meta.width → silent
 run_hook "/r/src/app/orders.tsx" '
@@ -104,18 +131,105 @@ echo "=== B.3 filter↔sort sibling sync ==="
 run_hook "/r/packages/design-system/src/components/DataTable/data-table-filter-panel.tsx" '
 const x = 1
 '
-expect_stderr "B.3.1 edit filter → reminder" "data-table-sort-manager"
+expect_context "B.3.1 edit filter → reminder" "data-table-sort-manager"
 
 # 9. edit sort manager → reminder
 run_hook "/r/packages/design-system/src/components/DataTable/data-table-sort-manager.tsx" '
 const x = 1
 '
-expect_stderr "B.3.2 edit sort → reminder" "data-table-filter-panel"
+expect_context "B.3.2 edit sort → reminder" "data-table-filter-panel"
 
 # 10. unrelated tsx → silent
 run_hook "/r/src/app/foo.tsx" 'const x = 1'
 expect_silent "B.3.3 unrelated tsx → silent"
 
+# Full-file replays can be hundreds of KiB. `producer | grep -q` makes the
+# producer receive SIGPIPE after an early match and Bash emits a raw
+# "write error: Broken pipe" on stderr, which correctly violates the neutral
+# rc0 output contract. Keep the payload on stdin/here-strings instead.
+LARGE_CONTENT=$(
+  printf '%s\n' \
+    'const columns = createColumnHelper<Row>()' \
+    'const table = <DataTable enableRowDrag getRowId={(row) => row.id} />'
+  awk 'BEGIN { for (i = 0; i < 24000; i += 1) print "// deterministic large replay filler 0123456789" }'
+)
+run_hook "/r/src/app/large-replay.tsx" "$LARGE_CONTENT"
+expect_silent "large full-file replay has no broken-pipe stderr"
+unset LARGE_CONTENT
+
+# B.1 + B.2 warnings must be aggregated into one provider-neutral context.
+run_hook "/r/src/app/products.tsx" '
+const columns = [{ accessorKey: "name", size: 240 }]
+const table = <DataTable enableRowDrag />
+'
+if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] \
+  && is_exact_context "row drag getRowId" \
+  && printf '%s' "$STDOUT_TEXT" | jq -e \
+    '.governanceContext.message | contains("column size NUMBER")' >/dev/null; then
+  echo "  PASS  multiple DataTable warnings → one exact PreToolUse context"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL  DataTable warning aggregation contract"
+  FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - warning aggregation"
+fi
+
+# 11. Composite integrity:an undefined child status must not be rewritten as advisory success.
+FAULT_DIR=$(mktemp -d)
+trap 'rm -rf -- "$FAULT_DIR"' EXIT
+awk '
+  { print }
+  $0 == "r1_datatable_invariants() {" { print "return 1" }
+' "$HOOK" >"$FAULT_DIR/check_datatable_invariants.sh"
+set +e
+printf '%s' '{}' | bash "$FAULT_DIR/check_datatable_invariants.sh" \
+  >"$FAULT_DIR/stdout" 2>"$FAULT_DIR/stderr"
+FAULT_RC=$?
+set -e
+if [ "$FAULT_RC" -eq 70 ] \
+  && [ ! -s "$FAULT_DIR/stdout" ] \
+  && grep -qF 'GOVERNANCE_INTEGRITY:' "$FAULT_DIR/stderr" \
+  && grep -qF 'exit code 1' "$FAULT_DIR/stderr"; then
+  echo "  PASS  composite child exit 1 → dedicated integrity rc70"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL  composite child exit 1 was not failed closed (exit $FAULT_RC)"
+  FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - composite undefined child rc"
+fi
+
+run_raw '{'
+if [ "$EXIT" = "70" ] && [ -z "$STDOUT_TEXT" ] \
+  && echo "$STDERR_TEXT" | grep -qF "GOVERNANCE_INTEGRITY:" \
+  && echo "$STDERR_TEXT" | grep -qF "invalid input envelope"; then
+  echo "  PASS  malformed input → stderr-only integrity rc70"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL  malformed input output contract"
+  FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - malformed input"
+fi
+
+# A well-formed child policy denial remains stderr-only rc2, never integrity rc70.
+awk '
+  { print }
+  $0 == "r1_datatable_invariants() {" {
+    print "printf '\''synthetic DataTable policy blocker\\n'\'' >&2"
+    print "return 2"
+  }
+' "$HOOK" >"$FAULT_DIR/check_datatable_policy.sh"
+set +e
+printf '%s' '{"hook_event_name":"PreToolUse","tool_name":"Write","tool_input":{"file_path":"apps/demo/src/App.tsx","content":"x"}}' \
+  | bash "$FAULT_DIR/check_datatable_policy.sh" >"$FAULT_DIR/policy.stdout" 2>"$FAULT_DIR/policy.stderr"
+POLICY_RC=$?
+set -e
+if [ "$POLICY_RC" -eq 2 ] && [ ! -s "$FAULT_DIR/policy.stdout" ] \
+  && grep -qF 'synthetic DataTable policy blocker' "$FAULT_DIR/policy.stderr" \
+  && ! grep -qF 'GOVERNANCE_INTEGRITY:' "$FAULT_DIR/policy.stderr"; then
+  echo "  PASS  genuine child policy denial → stderr-only rc2"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL  genuine child policy denial contract (exit $POLICY_RC)"
+  FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - genuine policy rc2"
+fi
+
 echo ""
 echo "═══ Results: $PASS PASS, $FAIL FAIL ═══"
 [ "$FAIL" -gt 0 ] && { printf "Failed:%b\n" "$FAILED_TESTS"; exit 1; }

package/ds-canonical/hooks/tests/test_check_dim_count_drift.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
 # Tests for check_dim_count_drift.sh(audit dim count SSOT drift P1 soft warn)
 #
-# Hook 規則:Edit/Write/MultiEdit + 目標 file 是 chain skill / meta-patterns / CLAUDE.md /
+# Hook 規則:Edit/Write/MultiEdit + 目標 file 是 chain skill / meta-patterns / AGENTS.md /
+# provider import shell /
 # skill SKILL.md / skill references → 偵測 `\b[1-9][0-9]+[ -]?(dim|audit dim|audit dimension)`
 # 形 hardcode → stderr soft warn (exit 0)。
 # Skip:design-system-audit/SKILL.md(SSOT)/ design-system-audit/references/* / out-of-scope path /
@@ -62,31 +63,35 @@ expect_warn() {
 echo "=== check_dim_count_drift tests ==="
 
 # 1. non Edit/Write tool → skip
-run_hook "Read" "/repo/.claude/rules/meta-patterns.md" "53 dim hardcode"
+run_hook "Read" "/repo/packages/design-system/ds-canonical/rules/meta-patterns.md" "53 dim hardcode"
 expect_pass_silent "1. non Edit/Write → skip"
 
 # 2. SSOT itself (design-system-audit/SKILL.md) → skip
-run_hook "Edit" "/repo/.claude/skills/design-system-audit/SKILL.md" "53 audit dimensions covers all"
+run_hook "Edit" "/repo/packages/design-system/ds-canonical/skills/design-system-audit/SKILL.md" "53 audit dimensions covers all"
 expect_pass_silent "2. SSOT file path → skip"
 
 # 3. Out-of-scope file (random tsx) → skip
 run_hook "Edit" "/repo/packages/design-system/src/foo.tsx" "53 dim hardcode"
 expect_pass_silent "3. out-of-scope path → skip"
 
-# 4. CLAUDE.md with hardcoded `53 dim` → warn
+# 4. Shared AGENTS.md with hardcoded `53 dim` → warn
+run_hook "Edit" "/repo/AGENTS.md" "現有 53 dim 覆蓋全部"
+expect_warn "4. AGENTS.md + 53 dim hardcode → warn" "AUDIT DIM COUNT DRIFT"
+
+# 4b. Provider import shell remains covered too.
 run_hook "Edit" "/repo/CLAUDE.md" "現有 53 dim 覆蓋全部"
-expect_warn "4. CLAUDE.md + 53 dim hardcode → warn" "AUDIT DIM COUNT DRIFT"
+expect_warn "4b. provider import shell + 53 dim hardcode → warn" "AUDIT DIM COUNT DRIFT"
 
 # 5. meta-patterns.md with `46 audit dimensions` → warn
-run_hook "Write" "/repo/.claude/rules/meta-patterns.md" "鏈到 46 audit dimensions"
+run_hook "Write" "/repo/packages/design-system/ds-canonical/rules/meta-patterns.md" "鏈到 46 audit dimensions"
 expect_warn "5. meta-patterns + 46 audit dimensions → warn" "AUDIT DIM COUNT DRIFT"
 
 # 6. Allowed context (line contains 'SSOT') → silent
-run_hook "Edit" "/repo/.claude/skills/foo/SKILL.md" "53 dim SSOT 在 design-system-audit"
+run_hook "Edit" "/repo/packages/design-system/ds-canonical/skills/foo/SKILL.md" "53 dim SSOT 在 design-system-audit"
 expect_pass_silent "6. line contains SSOT → allowed silent"
 
 # 7. Allowed context (line contains '禁') → silent
-run_hook "Edit" "/repo/.claude/skills/foo/SKILL.md" "禁 hardcode 53 dim 形式的數字"
+run_hook "Edit" "/repo/packages/design-system/ds-canonical/skills/foo/SKILL.md" "禁 hardcode 53 dim 形式的數字"
 expect_pass_silent "7. line contains 禁 → allowed silent"
 
 echo ""