@qijenchen/design-system 0.1.0-beta.93 → 0.1.0-beta.96

package/ds-canonical/hooks/tests/test_check_full_story_visual_interaction_sweep.sh

@@ -3,17 +3,17 @@
 #
 # Hook 規則(PreToolUse,Write|Edit|MultiEdit):
 #   - File gate:tool_input.file_path 必 match `(sweep|audit-report)\.json$`,否則 silent。
-#   - Content:tool_input.new_string // tool_input.content。空 → silent。
-#   - Escape:content 含 `_sampling_allowed` → silent。
+#   - Content 必為 schema-valid report JSON；空/壞 JSON → integrity 70。
+#   - Escape:valid report 的 `_sampling_allowed` 非空 rationale → silent。
 #   - Story count:`.storyResults // .results | length`,fallback `.storySummary.total // .summary.total // .total`。
-#   - Manifest:$CLAUDE_PROJECT_DIR/packages/design-system/ds-story-manifest.json .totalStories。
-#       manifest 不存在 / total=0 → silent。STORY_COUNT=0 → silent。
+#   - Manifest:$GOVERNANCE_PROJECT_DIR/packages/design-system/ds-story-manifest.json .totalStories。
+#       manifest 不存在 / malformed / total=0 → integrity 70。STORY_COUNT=0 → policy block 2。
 #   - BLOCKER:STORY_COUNT < MANIFEST_TOTAL → exit 2 + stderr「FULL-STORY-SWEEP BLOCKER」。
 #   - STORY_COUNT >= MANIFEST_TOTAL → silent(全跑通過)。
 #
 # Non-Write/Edit tool / 非 sweep|audit-report 檔名 → silent。
 #
-# Determinism:TMP_DIR + CLAUDE_PROJECT_DIR override(manifest fixture totalStories=916),
+# Determinism:TMP_DIR + GOVERNANCE_PROJECT_DIR override(manifest fixture totalStories=916),
 # 不碰 repo 真 manifest / 不寫 repo logs。
 
 set -u
@@ -33,9 +33,9 @@ FAILED_TESTS=""
 TMP_DIR=$(mktemp -d)
 trap 'rm -rf "$TMP_DIR"' EXIT
 
-# Override CLAUDE_PROJECT_DIR so manifest lookup + _log-fire land in TMP_DIR
+# Override GOVERNANCE_PROJECT_DIR so manifest lookup + _log-fire land in TMP_DIR
 # (不污染 repo packages/ 與 .claude/logs/)
-export CLAUDE_PROJECT_DIR="$TMP_DIR"
+export GOVERNANCE_PROJECT_DIR="$TMP_DIR"
 mkdir -p "$TMP_DIR/.claude/logs"
 mkdir -p "$TMP_DIR/packages/design-system"
 
@@ -91,6 +91,17 @@ expect_block() {
   fi
 }
 
+expect_integrity() {
+  local name="$1"; local needle="${2:-GOVERNANCE_INTEGRITY:}"
+  if [ "$EXIT" = "70" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected integrity exit=70 + '$needle', got exit=$EXIT)"
+    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
 # Build a sampled audit-report content (storyResults array of N entries)
 sampled_results() {
   local n="$1"
@@ -155,16 +166,15 @@ expect_pass_silent "11. [NEG] unrelated *.json → silent (file gate)"
 run_hook "/tmp/codex-sweep/audit-report.json" "$(sampled_results 1)" "Read"
 expect_pass_silent "12. [NEG] tool=Read → silent (event gate)"
 
-# 13. NEGATIVE: STORY_COUNT=0 (no parseable count) → silent
-#     (hook explicitly exits 0 when count is 0 to avoid false positive on non-sweep payloads)
+# 13. A schema-valid audit report with no coverage is a real policy violation.
 run_hook "/tmp/codex-sweep/audit-report.json" '{"meta":{"note":"warmup"}}'
-expect_pass_silent "13. [NEG] count=0 unparseable → silent"
+expect_block "13. [POS] valid report with count=0 → BLOCK" "FULL-STORY-SWEEP BLOCKER"
 
-# 14. NEGATIVE: empty content → silent
+# 14. Empty report content is invalid enforcement evidence.
 run_hook "/tmp/codex-sweep/audit-report.json" ""
-expect_pass_silent "14. [NEG] empty content → silent"
+expect_integrity "14. empty report → integrity failure" "report is malformed or invalid"
 
-# 15. NEGATIVE: manifest missing → silent (graceful degrade)
+# 15. Missing manifest means the hook cannot evaluate completeness.
 #     Temporarily point at a project dir without a manifest.
 NOMANIFEST_DIR=$(mktemp -d)
 mkdir -p "$NOMANIFEST_DIR/.claude/logs"
@@ -172,12 +182,12 @@ payload=$(jq -n --arg fp "/tmp/codex-sweep/audit-report.json" --arg c "$(sampled
   '{hook_event_name:"PreToolUse", tool_name:"Write", tool_input:{file_path:$fp, content:$c}}')
 STDOUT=$(mktemp); STDERR=$(mktemp)
 set +e
-printf '%s' "$payload" | CLAUDE_PROJECT_DIR="$NOMANIFEST_DIR" bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+printf '%s' "$payload" | GOVERNANCE_PROJECT_DIR="$NOMANIFEST_DIR" bash "$HOOK" >"$STDOUT" 2>"$STDERR"
 EXIT=$?
 set -e
 STDERR_TEXT=$(cat "$STDERR")
 rm -f "$STDOUT" "$STDERR"
-expect_pass_silent "15. [NEG] manifest missing → silent (graceful degrade)"
+expect_integrity "15. manifest missing → integrity failure" "manifest is unavailable or unsafe"
 rm -rf "$NOMANIFEST_DIR"
 
 echo ""

package/ds-canonical/hooks/tests/test_check_header_with_tabs_border.sh

@@ -1,110 +1,220 @@
 #!/bin/bash
-# Tests for check_header_with_tabs_border.sh(header-canonical W1 BLOCKER)
-#
-# Hook 規則:PreToolUse Edit/Write/MultiEdit + file 為 `packages/design-system/src/**/*.tsx`(非 stories)→
-#   讀 disk content + tool_input.new_string/content 合 FULL_CONTENT;
-#   含 `<XxxHeader>` + `<Tabs|TabsList|TabsTrigger>` JSX 但 `withTabs` 出現 0 次 → exit 2 BLOCKER。
-#   header > withTabs(但 ≥ 1)→ soft warn exit 0。
-# Allow:FULL_CONTENT 含 `@header-withtabs-allow:` → 整檔豁免。
-# Skip:stories.tsx / anatomy.stories.tsx / principles.stories.tsx。
+# Proposed-state tests for header-canonical W1 withTabs enforcement.
 
 set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 HOOK="$SCRIPT_DIR/../lib/_header_with_tabs_border.sh"
-
-if [ ! -x "$HOOK" ]; then
-  echo "FATAL: hook not executable: $HOOK"
-  exit 1
-fi
-
 PASS=0
 FAIL=0
 FAILED_TESTS=""
 
 run_hook() {
-  local file_path="$1"; local content="$2"
+  local file_path="$1" content="$2" tool="${3:-Write}" state_mode="${4:-valid}"
+  local repo_path="${file_path#*/repo/}"
+  local payload
+  case "$state_mode" in
+    valid)
+      payload=$(jq -n --arg fp "$file_path" --arg rp "$repo_path" --arg c "$content" --arg tool "$tool" \
+        '{tool_name:$tool,tool_input:{file_path:$fp,content:"raw-native-content-must-not-win",governance_write_state:{schemaVersion:1,path:$rp,kind:"text",content:$c}}}')
+      ;;
+    deleted)
+      payload=$(jq -n --arg fp "$file_path" --arg rp "$repo_path" --arg tool "$tool" \
+        '{tool_name:$tool,tool_input:{file_path:$fp,governance_write_state:{schemaVersion:1,path:$rp,kind:"deleted"}}}')
+      ;;
+    missing)
+      payload=$(jq -n --arg fp "$file_path" --arg tool "$tool" \
+        '{tool_name:$tool,tool_input:{file_path:$fp}}')
+      ;;
+    malformed)
+      payload=$(jq -n --arg fp "$file_path" --arg tool "$tool" \
+        '{tool_name:$tool,tool_input:{file_path:$fp,governance_write_state:{schemaVersion:"1",path:false,kind:"text",content:null}}}')
+      ;;
+    mismatch)
+      payload=$(jq -n --arg fp "$file_path" --arg c "$content" --arg tool "$tool" \
+        '{tool_name:$tool,tool_input:{file_path:$fp,governance_write_state:{schemaVersion:1,path:"packages/design-system/src/other.tsx",kind:"text",content:$c}}}')
+      ;;
+  esac
+
+  STDOUT_FILE=$(mktemp)
+  STDERR_FILE=$(mktemp)
+  set +e
+  printf '%s' "$payload" \
+    | GOVERNANCE_WRITE_STATE_TRUST=runner-v1 bash "$HOOK" >"$STDOUT_FILE" 2>"$STDERR_FILE"
+  EXIT=$?
+  set -e
+  STDOUT_TEXT=$(cat "$STDOUT_FILE")
+  STDERR_TEXT=$(cat "$STDERR_FILE")
+  rm -f "$STDOUT_FILE" "$STDERR_FILE"
+}
+
+run_without_trust() {
+  local file_path="$1"
   local payload
-  payload=$(jq -n --arg fp "$file_path" --arg c "$content" \
-    '{tool_name: "Write", tool_input: {file_path: $fp, content: $c}}')
-  STDOUT=$(mktemp); STDERR=$(mktemp)
+  payload=$(jq -n --arg fp "$file_path" '{tool_name:"Edit",tool_input:{file_path:$fp}}')
+  STDOUT_FILE=$(mktemp)
+  STDERR_FILE=$(mktemp)
   set +e
-  printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  printf '%s' "$payload" \
+    | env -u GOVERNANCE_WRITE_STATE_TRUST bash "$HOOK" >"$STDOUT_FILE" 2>"$STDERR_FILE"
   EXIT=$?
   set -e
-  STDERR_TEXT=$(cat "$STDERR")
-  rm -f "$STDOUT" "$STDERR"
+  STDOUT_TEXT=$(cat "$STDOUT_FILE")
+  STDERR_TEXT=$(cat "$STDERR_FILE")
+  rm -f "$STDOUT_FILE" "$STDERR_FILE"
 }
 
 expect_pass_silent() {
   local name="$1"
-  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ]; then
-    echo "  PASS  $name"; PASS=$((PASS+1))
+  if [ "$EXIT" -eq 0 ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then
+    PASS=$((PASS + 1)); echo "  PASS  $name"
   else
-    echo "  FAIL  $name (expected silent, exit=$EXIT)"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+    FAIL=$((FAIL + 1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+    echo "  FAIL  $name (exit=$EXIT stdout=${#STDOUT_TEXT} stderr=${#STDERR_TEXT})"
+    printf '%s\n' "$STDERR_TEXT" | sed 's/^/    /'
   fi
 }
 
-expect_blocker() {
-  local name="$1"; local needle="$2"
-  if [ "$EXIT" = "2" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
-    echo "  PASS  $name"; PASS=$((PASS+1))
+expect_block() {
+  local name="$1" needle="$2"
+  if [ "$EXIT" -eq 2 ] && [ -z "$STDOUT_TEXT" ] && [ -n "$STDERR_TEXT" ] \
+    && printf '%s' "$STDERR_TEXT" | grep -qF "$needle" \
+    && ! printf '%s' "$STDERR_TEXT" | grep -Eq 'command not found|No such file or directory'; then
+    PASS=$((PASS + 1)); echo "  PASS  $name"
   else
-    echo "  FAIL  $name (expected exit 2 + '$needle', got exit $EXIT)"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+    FAIL=$((FAIL + 1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+    echo "  FAIL  $name (expected stderr-only rc2 + '$needle'; got rc=$EXIT)"
+    printf '%s\n' "$STDERR_TEXT" | sed 's/^/    /'
   fi
 }
 
-expect_warn_silent_exit0() {
-  # exit 0 but stderr contains needle (soft warn)
-  local name="$1"; local needle="$2"
-  if [ "$EXIT" = "0" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
-    echo "  PASS  $name"; PASS=$((PASS+1))
+expect_integrity() {
+  local name="$1" needle="$2"
+  if [ "$EXIT" -eq 70 ] && [ -z "$STDOUT_TEXT" ] && [ -n "$STDERR_TEXT" ] \
+    && printf '%s' "$STDERR_TEXT" | grep -qF "$needle"; then
+    PASS=$((PASS + 1)); echo "  PASS  $name"
   else
-    echo "  FAIL  $name (expected exit 0 + warn '$needle', got exit $EXIT)"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+    FAIL=$((FAIL + 1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+    echo "  FAIL  $name (expected stderr-only rc70 + '$needle'; got rc=$EXIT)"
+    printf '%s\n' "$STDERR_TEXT" | sed 's/^/    /'
   fi
 }
 
-echo "=== check_header_with_tabs_border tests ==="
+echo "=== check_header_with_tabs_border proposed-state tests ==="
+
+IN_SCOPE="/repo/packages/design-system/src/components/Foo/foo.tsx"
+
+run_hook "/repo/src/foo.tsx" '<ChromeHeader><Tabs /></ChromeHeader>' Write missing
+expect_pass_silent "1. out-of-scope path skips"
+
+run_hook "/repo/packages/design-system/src/components/Foo/foo.stories.tsx" '<ChromeHeader><Tabs /></ChromeHeader>' Write missing
+expect_pass_silent "2. story path skips"
+
+run_hook "$IN_SCOPE" '<button />'
+expect_pass_silent "3. proposed content without header skips"
+
+run_hook "$IN_SCOPE" '<ChromeHeader />' Edit
+expect_pass_silent "4. proposed Edit header without Tabs skips"
+
+run_hook "$IN_SCOPE" '<ChromeHeader withTabs><TabsList /></ChromeHeader>' MultiEdit
+expect_pass_silent "5. proposed MultiEdit compliant header+Tabs is silent"
+
+run_hook "$IN_SCOPE" '<ChromeHeader><TabsList /></ChromeHeader>' Edit
+expect_block "6. proposed Edit missing withTabs blocks" "HEADER + TABS WITHTABS BLOCKER"
+
+run_hook "$IN_SCOPE" '// @header-withtabs-allow: special case
+<ChromeHeader><TabsList /></ChromeHeader>'
+expect_pass_silent "7. proposed escape marker is silent"
+
+run_hook "$IN_SCOPE" '
+<>
+  <ChromeHeader withTabs><TabsList /></ChromeHeader>
+  <SurfaceHeader><TabsList /></SurfaceHeader>
+</>'
+expect_block "8. compliant instance cannot hide a violating header instance" "1 個未宣告 true withTabs"
+
+run_hook "$IN_SCOPE" '' Write deleted
+expect_pass_silent "9. trusted deletion has no post-write violation"
+
+run_hook "$IN_SCOPE" '<ChromeHeader withTabs><Tabs /></ChromeHeader>' Edit missing
+expect_integrity "10. runner marker without state is integrity failure" "trusted proposed write state 缺失或 malformed"
+
+run_hook "$IN_SCOPE" '<ChromeHeader withTabs><Tabs /></ChromeHeader>' Edit malformed
+expect_integrity "11. malformed state is integrity failure" "trusted proposed write state 缺失或 malformed"
+
+run_hook "$IN_SCOPE" '<ChromeHeader withTabs><Tabs /></ChromeHeader>' Edit mismatch
+expect_integrity "12. state path mismatch is integrity failure" "與 hook target 不相符"
+
+run_without_trust "$IN_SCOPE"
+expect_integrity "13. governed mutation without runner trust is integrity failure" "缺少 runner-v1 proposed state"
+
+run_hook "$IN_SCOPE" '
+const withTabs = false
+export const Example = () => <ChromeHeader><TabsList /></ChromeHeader>'
+expect_block "14. variable-name withTabs decoy cannot bypass" "HEADER + TABS WITHTABS BLOCKER"
+
+run_hook "$IN_SCOPE" '
+// withTabs =
+export const Example = () => <ChromeHeader><TabsList /></ChromeHeader>'
+expect_block "15. comment withTabs decoy cannot bypass" "HEADER + TABS WITHTABS BLOCKER"
+
+run_hook "$IN_SCOPE" '<ChromeHeader withTabs={false}><TabsList /></ChromeHeader>'
+expect_block "16. explicit withTabs false blocks" "HEADER + TABS WITHTABS BLOCKER"
+
+run_hook "$IN_SCOPE" '<ChromeHeader withTabs={true}><TabsList /></ChromeHeader>'
+expect_pass_silent "17. explicit withTabs true is compliant"
+
+run_hook "$IN_SCOPE" '
+<>
+  <ChromeHeader />
+  <TabsList />
+</>'
+expect_pass_silent "18. unrelated sibling Header/Tabs ambiguity stays silent"
+
+run_hook "$IN_SCOPE" '<ChromeHeader><TabsList />' Edit
+expect_integrity "19. malformed proposed TSX is integrity failure" "parser unavailable or proposed content malformed"
+
+run_hook "$IN_SCOPE" '// @header-withtabs-allow:
+<ChromeHeader><TabsList /></ChromeHeader>'
+expect_block "20. empty escape rationale cannot bypass" "HEADER + TABS WITHTABS BLOCKER"
+
+run_hook "$IN_SCOPE" 'const ready = true
+// @header-withtabs-allow: too late
+export const Example = () => <ChromeHeader><TabsList /></ChromeHeader>'
+expect_block "21. non-leading escape cannot bypass" "HEADER + TABS WITHTABS BLOCKER"
 
-# 1. Out-of-scope path (random tsx) → skip
-run_hook "/repo/src/foo.tsx" '<ChromeHeader/><Tabs/>'
-expect_pass_silent "1. out-of-scope path → skip"
+run_hook "$IN_SCOPE" 'const decoy = `// @header-withtabs-allow: template decoy`
+export const Example = () => <ChromeHeader><TabsList /></ChromeHeader>'
+expect_block "22. template escape decoy cannot bypass" "HEADER + TABS WITHTABS BLOCKER"
 
-# 2. Story file → skip
-run_hook "/repo/packages/design-system/src/components/Foo/foo.stories.tsx" '<ChromeHeader/><Tabs/>'
-expect_pass_silent "2. .stories.tsx → skip"
+run_hook "$IN_SCOPE" '/* // @header-withtabs-allow: block decoy */
+export const Example = () => <ChromeHeader><TabsList /></ChromeHeader>'
+expect_block "23. block-comment escape decoy cannot bypass" "HEADER + TABS WITHTABS BLOCKER"
 
-# 3. In-scope but no header → skip
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" '<button/>'
-expect_pass_silent "3. no header JSX → skip"
+run_hook "$IN_SCOPE" '<Header><TabsList /></Header>'
+expect_block "24. bare Header is governed" "HEADER + TABS WITHTABS BLOCKER"
 
-# 4. In-scope header but no Tabs → skip
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" '<ChromeHeader/>'
-expect_pass_silent "4. header but no Tabs → skip"
+run_hook "$IN_SCOPE" '<UI.Header><UI.TabsList /></UI.Header>'
+expect_block "25. namespaced UI.Header is governed" "HEADER + TABS WITHTABS BLOCKER"
 
-# 5. In-scope header + Tabs + withTabs prop → silent
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" '<ChromeHeader withTabs><TabsList ></TabsList></ChromeHeader>'
-expect_pass_silent "5. header + Tabs + withTabs → silent"
+run_hook "$IN_SCOPE" '
+<SurfaceHeader>
+  <Header withTabs><TabsList /></Header>
+</SurfaceHeader>'
+expect_pass_silent "26. outer Header does not consume nested Header Tabs"
 
-# 6. In-scope header + Tabs WITHOUT withTabs → BLOCKER exit 2
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" '<ChromeHeader><TabsList ></TabsList></ChromeHeader>'
-expect_blocker "6. header + Tabs missing withTabs → BLOCKER" "HEADER + TABS WITHTABS BLOCKER"
+run_hook "$IN_SCOPE" '
+<SurfaceHeader withTabs>
+  <Header><TabsList /></Header>
+</SurfaceHeader>'
+expect_block "27. nested Header is independently enforced" "HEADER + TABS WITHTABS BLOCKER"
 
-# 7. With allow escape → silent
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" '// @header-withtabs-allow: special case
-<ChromeHeader><TabsList ></TabsList></ChromeHeader>'
-expect_pass_silent "7. @header-withtabs-allow → silent"
+run_hook "$IN_SCOPE" '<ChromeHeader withTabs withTabs={false}><TabsList /></ChromeHeader>'
+expect_block "28. duplicate conflicting withTabs props cannot bypass" "HEADER + TABS WITHTABS BLOCKER"
 
-echo ""
-echo "=== Summary ==="
+echo
 echo "Passed: $PASS / $((PASS + FAIL))"
 if [ "$FAIL" -gt 0 ]; then
-  echo "Failed:$FAILED_TESTS"
+  printf 'Failed:%b\n' "$FAILED_TESTS"
   exit 1
 fi

package/ds-canonical/hooks/tests/test_check_item_list_gap.sh

@@ -11,32 +11,32 @@ run() {
   local fp="$1"; local content="$2"
   local payload=$(jq -n --arg fp "$fp" --arg c "$content" \
     '{hook_event_name:"PreToolUse",tool_name:"Write",tool_input:{file_path:$fp,content:$c}}')
-  STDERR=$(mktemp)
-  printf '%s' "$payload" | bash "$HOOK" 2>"$STDERR" >/dev/null
-  STDERR_TEXT=$(cat "$STDERR"); rm -f "$STDERR"
+  STDOUT=$(mktemp); STDERR=$(mktemp)
+  printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  STDOUT_TEXT=$(cat "$STDOUT"); STDERR_TEXT=$(cat "$STDERR"); rm -f "$STDOUT" "$STDERR"
 }
 
 # Test 1:2+ FileItem 無 gap → warn
 echo "Test 1: 2+ FileItem no gap → warn"
 CONTENT='<div><FileItem /><FileItem /><FileItem /></div>'
 run "/path/foo.tsx" "$CONTENT"
-if echo "$STDERR_TEXT" | grep -q "M16 Item-list gap"; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL: no warn"; FAIL=$((FAIL+1)); fi
+if [ -z "$STDERR_TEXT" ] && echo "$STDOUT_TEXT" | jq -e '.governanceContext.hookEventName == "PreToolUse" and (.governanceContext.message | contains("M16 Item-list gap"))' >/dev/null; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL: no model-visible context"; FAIL=$((FAIL+1)); fi
 
 # Test 2:有 gap-2 parent → silent
 echo "Test 2: with gap-2 parent → silent"
 CONTENT='<div className="flex gap-2"><FileItem /><FileItem /></div>'
 run "/path/foo.tsx" "$CONTENT"
-if [ -z "$STDERR_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
+if [ -z "$STDERR_TEXT" ] && [ -z "$STDOUT_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
 
 # Test 3:single FileItem → silent
 echo "Test 3: single FileItem → silent"
 run "/path/foo.tsx" '<FileItem />'
-if [ -z "$STDERR_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
+if [ -z "$STDERR_TEXT" ] && [ -z "$STDOUT_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
 
 # Test 4:stories.tsx skip
 echo "Test 4: stories.tsx skip"
 run "/path/foo.stories.tsx" '<FileItem /><FileItem />'
-if [ -z "$STDERR_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
+if [ -z "$STDERR_TEXT" ] && [ -z "$STDOUT_TEXT" ]; then echo "  PASS"; PASS=$((PASS+1)); else echo "  FAIL"; FAIL=$((FAIL+1)); fi
 
 echo ""
 echo "════ Results: $PASS PASS, $FAIL FAIL ════"

package/ds-canonical/hooks/tests/test_check_layout_space_magic_numbers.sh

@@ -33,9 +33,9 @@ FAILED_TESTS=""
 TMP_DIR=$(mktemp -d)
 trap 'rm -rf "$TMP_DIR"' EXIT
 
-# Override CLAUDE_PROJECT_DIR so _log-fire.sh per-hook log lands in TMP_DIR
+# Override GOVERNANCE_PROJECT_DIR so _log-fire.sh per-hook log lands in TMP_DIR
 # (避免污染 repo .claude/logs/)
-export CLAUDE_PROJECT_DIR="$TMP_DIR"
+export GOVERNANCE_PROJECT_DIR="$TMP_DIR"
 mkdir -p "$TMP_DIR/.claude/logs"
 
 # run_hook <tool> <file_path> <content_field> <content>

package/ds-canonical/hooks/tests/test_check_main_branch_workbench.sh

@@ -1,147 +1,82 @@
 #!/bin/bash
-# Tests for check_main_branch_workbench.sh(M28 main-as-workbench BLOCKER)
-#
-# Hook 規則:PreToolUse Edit/Write/MultiEdit + 目標 file 為 production code
-# (`packages/design-system/src/**/*.{tsx,ts,css}` OR `src/app/**` OR `src/explorations/**`)
-# + current git branch == main/master + transcript 近 5 user msg 無 branch trigger keyword
-# → exit 2 BLOCKER。
-# Allow:`CLAUDE_BYPASS_MAIN_WORKBENCH=1` / branch != main / out-of-scope path /
-#        trigger keyword(開 branch / 開 分支 / 新 branch / working branch / 在 branch 上做 / on branch)。
-#
-# 測試手法:`CLAUDE_PROJECT_DIR` 指向 fixture git repo(可控 current branch)。
+# Tests for the protected-main editing feedback gate(M28).
 
 set -u
-
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 HOOK="$SCRIPT_DIR/../check_main_branch_workbench.sh"
-
-if [ ! -x "$HOOK" ]; then
-  echo "FATAL: hook not executable: $HOOK"
-  exit 1
-fi
+[ -x "$HOOK" ] || { echo "FATAL: hook not executable: $HOOK"; exit 1; }
 
 TMP_ROOT=$(mktemp -d)
 trap 'rm -rf "$TMP_ROOT"' EXIT
-
-# Build fake git repos:one on main, one on feature branch
 REPO_MAIN="$TMP_ROOT/repo-main"
-REPO_FEAT="$TMP_ROOT/repo-feat"
+REPO_FEAT="$TMP_ROOT/repo-feature"
 
 setup_repo() {
-  local dir="$1"; local branch="$2"
+  local dir="$1" branch="$2"
   mkdir -p "$dir"
-  (
-    cd "$dir"
-    git init -q -b main 2>/dev/null || { git init -q && git checkout -q -b main; }
-    git config user.email test@example.com
-    git config user.name test
-    echo seed > seed.txt
-    git add seed.txt
-    git commit -q -m "seed"
-    if [ "$branch" != "main" ]; then
-      git checkout -q -b "$branch"
-    fi
-  )
+  git -C "$dir" init -q -b main 2>/dev/null || { git -C "$dir" init -q; git -C "$dir" checkout -q -b main; }
+  git -C "$dir" config user.email test@example.invalid
+  git -C "$dir" config user.name test
+  printf 'seed\n' > "$dir/seed.txt"
+  git -C "$dir" add seed.txt
+  git -C "$dir" commit -qm seed
+  [ "$branch" = main ] || git -C "$dir" checkout -q -b "$branch"
 }
-
-setup_repo "$REPO_MAIN" "main"
-setup_repo "$REPO_FEAT" "feature-x"
+setup_repo "$REPO_MAIN" main
+setup_repo "$REPO_FEAT" codex/feature
 
 PASS=0
 FAIL=0
-FAILED_TESTS=""
 
 run_hook() {
-  local file_path="$1"; local project_dir="$2"; local transcript="${3:-}"
-  local payload
-  payload=$(jq -n --arg fp "$file_path" \
-    '{tool_name: "Edit", tool_input: {file_path: $fp, new_string: "x"}}')
-  STDOUT=$(mktemp); STDERR=$(mktemp)
+  local file_path="$1" project_dir="$2" tool="${3:-Edit}"
+  local payload stdout_file stderr_file
+  payload=$(jq -n --arg fp "$file_path" --arg tool "$tool" '{tool_name:$tool,tool_input:{file_path:$fp}}')
+  stdout_file=$(mktemp); stderr_file=$(mktemp)
   set +e
-  CLAUDE_PROJECT_DIR="$project_dir" CLAUDE_TRANSCRIPT_PATH="$transcript" \
-    printf '%s' "$payload" | CLAUDE_PROJECT_DIR="$project_dir" CLAUDE_TRANSCRIPT_PATH="$transcript" \
-    bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  printf '%s' "$payload" | GOVERNANCE_PROJECT_DIR="$project_dir" bash "$HOOK" >"$stdout_file" 2>"$stderr_file"
   EXIT=$?
   set -e
-  STDERR_TEXT=$(cat "$STDERR")
-  rm -f "$STDOUT" "$STDERR"
+  STDERR_TEXT=$(cat "$stderr_file")
+  rm -f "$stdout_file" "$stderr_file"
 }
 
-expect_pass_silent() {
+expect_pass() {
   local name="$1"
-  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ]; then
-    echo "  PASS  $name"; PASS=$((PASS+1))
-  else
-    echo "  FAIL  $name (expected silent, exit=$EXIT)"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
-  fi
+  if [ "$EXIT" = 0 ] && [ -z "$STDERR_TEXT" ]; then echo "  PASS  $name"; PASS=$((PASS+1));
+  else echo "  FAIL  $name(exit=$EXIT)"; FAIL=$((FAIL+1)); fi
 }
-
-expect_blocker() {
-  local name="$1"; local needle="$2"
-  if [ "$EXIT" = "2" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
-    echo "  PASS  $name"; PASS=$((PASS+1))
-  else
-    echo "  FAIL  $name (expected exit 2 + '$needle', got exit $EXIT)"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
-  fi
+expect_block() {
+  local name="$1"
+  if [ "$EXIT" = 2 ] && echo "$STDERR_TEXT" | grep -qF 'PROTECTED-MAIN WORKBENCH BLOCKER'; then echo "  PASS  $name"; PASS=$((PASS+1));
+  else echo "  FAIL  $name(exit=$EXIT)"; echo "$STDERR_TEXT"; FAIL=$((FAIL+1)); fi
 }
 
-echo "=== check_main_branch_workbench tests ==="
+echo "=== check_main_branch_workbench protected-main tests ==="
+run_hook "$REPO_MAIN/README.md" "$REPO_MAIN" Read
+expect_pass "1. read tool skips"
 
-# 1. Non Edit/Write tool → skip (use payload with different tool)
-payload=$(jq -n '{tool_name: "Read", tool_input: {file_path: "/repo/packages/design-system/src/foo.tsx"}}')
-STDOUT=$(mktemp); STDERR=$(mktemp)
-set +e
-CLAUDE_PROJECT_DIR="$REPO_MAIN" printf '%s' "$payload" | CLAUDE_PROJECT_DIR="$REPO_MAIN" bash "$HOOK" >"$STDOUT" 2>"$STDERR"
-EXIT=$?
-set -e
-STDERR_TEXT=$(cat "$STDERR")
-rm -f "$STDOUT" "$STDERR"
-expect_pass_silent "1. non Edit/Write tool → skip"
+run_hook "$REPO_FEAT/README.md" "$REPO_FEAT"
+expect_pass "2. edits on the task branch pass"
 
-# 2. Out-of-scope path (random file) → skip
-run_hook "/repo/.claude/foo.md" "$REPO_MAIN"
-expect_pass_silent "2. out-of-scope path (.claude/) → skip"
+run_hook "$REPO_MAIN/packages/design-system/src/Foo.tsx" "$REPO_MAIN"
+expect_block "3. production edit on main blocks"
 
-# 3. Production code path + branch=feature-x → skip
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" "$REPO_FEAT"
-expect_pass_silent "3. on feature branch → skip"
+run_hook "$REPO_MAIN/.claude/rules/meta-patterns.md" "$REPO_MAIN"
+expect_block "4. governance/doc edit on main also blocks"
 
-# 4. Production code path + branch=main + no trigger transcript → BLOCKER
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" "$REPO_MAIN"
-expect_blocker "4. main + production code + no trigger → BLOCKER" "MAIN-AS-WORKBENCH BLOCKER"
+run_hook "$TMP_ROOT/outside.txt" "$REPO_MAIN"
+expect_pass "5. file outside checkout skips"
 
-# 5. CLAUDE_BYPASS_MAIN_WORKBENCH=1 escape → skip
-payload=$(jq -n '{tool_name: "Edit", tool_input: {file_path: "/repo/packages/design-system/src/components/Foo/foo.tsx", new_string: "x"}}')
-STDOUT=$(mktemp); STDERR=$(mktemp)
+payload=$(jq -n --arg fp "$REPO_MAIN/README.md" '{tool_name:"Edit",tool_input:{file_path:$fp}}')
+stdout_file=$(mktemp); stderr_file=$(mktemp)
 set +e
-printf '%s' "$payload" | CLAUDE_PROJECT_DIR="$REPO_MAIN" CLAUDE_BYPASS_MAIN_WORKBENCH=1 bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+printf '%s' "$payload" | GOVERNANCE_PROJECT_DIR="$REPO_MAIN" GOVERNANCE_BYPASS_MAIN_WORKBENCH=1 bash "$HOOK" >"$stdout_file" 2>"$stderr_file"
 EXIT=$?
 set -e
-STDERR_TEXT=$(cat "$STDERR")
-rm -f "$STDOUT" "$STDERR"
-expect_pass_silent "5. CLAUDE_BYPASS_MAIN_WORKBENCH=1 → skip"
-
-# 6. Transcript with branch trigger keyword → skip
-TRANSCRIPT="$TMP_ROOT/transcript.jsonl"
-cat >"$TRANSCRIPT" <<'EOF'
-{"role":"user","content":"我們開 working branch 來做這個 batch"}
-{"role":"assistant","content":"OK"}
-EOF
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" "$REPO_MAIN" "$TRANSCRIPT"
-expect_pass_silent "6. transcript has 'working branch' trigger → skip"
-
-# 7. src/app/** also intercepted on main → BLOCKER
-run_hook "/repo/src/app/page.tsx" "$REPO_MAIN"
-expect_blocker "7. src/app/ on main → BLOCKER" "MAIN-AS-WORKBENCH BLOCKER"
+STDERR_TEXT=$(cat "$stderr_file")
+rm -f "$stdout_file" "$stderr_file"
+expect_pass "6. local recovery override passes"
 
-echo ""
-echo "=== Summary ==="
 echo "Passed: $PASS / $((PASS + FAIL))"
-if [ "$FAIL" -gt 0 ]; then
-  echo "Failed:$FAILED_TESTS"
-  exit 1
-fi
+[ "$FAIL" -eq 0 ]