@reddb-io/red-skills-dev 2.75.2

package/skills/misc/branch-lock/scripts/lib/git-command-classifier.sh

@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# lib/git-command-classifier.sh — the Git Command Classifier: given the locked
+# branch and a shell command string, decides whether the command would lose the
+# agent's work while a lock is active and must be blocked. Pure / explicit-args,
+# like the sibling lib/ modules. Self-contained: it carries its own small
+# command matcher so the branch-lock hook needs no dependency on the
+# git-guardrails skill.
+#
+# It blocks two families of command:
+#   1. Branch-leaving `git checkout <branch>` / `git switch <branch>` (the
+#      original slice) — unless the target is the lock branch itself.
+#   2. The work-loss family (issue #61): commands that throw away the working
+#      tree or the stash —
+#        - `git stash` / `git stash push` / `git stash save`  (bare stash defaults to push)
+#        - `git clean` with any force flag (`-f`, `-fd`, `-xfd`, `--force`)
+#        - `git reset --hard`
+#        - whole-tree restore: `git checkout .`, `git checkout -- .`, `git restore .`
+#
+# Everything else is allowed — switching back to the lock branch, targeted
+# single-file restore (`git checkout -- <path>`, `git restore <path>`), a bare
+# `git checkout`, read-only stash (`list`/`show`), a dry-run clean (`-n`), a
+# soft/mixed reset, an unstage (`git restore --staged`), `git worktree add`
+# (worktrees are how /afk works and are exempt by scope), and any other command.
+#
+# Recognition is intentionally conservative: it scans the token stream for a
+# `git` token, skips any global options between `git` and the subcommand
+# (`git -C <path> checkout x`, `git --git-dir=… switch y`, `git -c k=v …`), and
+# classifies the recognised subcommand, so a compound command
+# (`cd x && git reset --hard`) and a global-option form are both classified.
+#
+# Public surface:
+#   classify_git_command <lock_branch> <command>
+#     Echoes exactly "block" or "allow" and returns 0.
+#
+#   classify_primary_branch_switch_guard <command>
+#     Echoes exactly "block" for commands that would move or destroy work in the
+#     primary checkout, and "allow" otherwise. This is the config-flag guard
+#     from ADR 0043 (unlike classify_git_command it has no lock branch). It
+#     blocks: branch movement (switch/create/checkout to a branch); `git reset`
+#     in ANY form; every `git stash` subcommand; and `git rebase --autostash`
+#     (issue #1024). Parallel human WIP lives in the primary checkout and these
+#     commands have destroyed in-progress work before; do branch work in an
+#     isolated worktree under .red/tmp/ instead. Worktrees are exempt by scope,
+#     so this classifier only ever runs against the primary checkout.
+
+# _git_subcommand_index <toks-name> <git-index>
+# Given the name of the token array and the index of a `git` token, echoes the
+# index of the git subcommand, skipping any leading global options. Global
+# options that take a separate argument (`-C <path>`, `-c <name=value>`,
+# `--git-dir <path>`, `--work-tree <path>`, `--namespace <name>`,
+# `--exec-path <path>`, `--super-prefix <path>`) consume the following token;
+# the `--opt=value` form is self-contained, and bare flags (`-p`, `--no-pager`,
+# `--bare`, …) consume only themselves. Echoes the array length when no
+# subcommand follows.
+_git_subcommand_index() {
+  local -n _t="$1"
+  local k=$(( $2 + 1 ))
+  local len=${#_t[@]}
+  while (( k < len )); do
+    local tok="${_t[k]}"
+    case "$tok" in
+      -C|-c|--git-dir|--work-tree|--namespace|--exec-path|--super-prefix)
+        k=$(( k + 2 )); continue ;;   # option + its separate argument
+      --*=*|-*)
+        k=$(( k + 1 )); continue ;;   # `--opt=value` or a bare flag
+      *)
+        break ;;                      # the subcommand token
+    esac
+  done
+  echo "$k"
+}
+
+# classify_git_command <lock_branch> <command>
+classify_git_command() {
+  local _lock="$1" _cmd="$2"
+  local -a toks
+  read -ra toks <<<"$_cmd"
+  local n=${#toks[@]} i j
+
+  for ((i = 0; i < n; i++)); do
+    [[ "${toks[i]}" == "git" ]] || continue
+    local s; s="$(_git_subcommand_index toks "$i")"   # subcommand index, past global options
+    local sub="${toks[s]:-}"
+    case "$sub" in
+      worktree)
+        echo "allow"; return 0
+        ;;
+      stash)
+        # bare `git stash` defaults to push; push/save discard the working tree.
+        local op="${toks[s + 1]:-}"
+        if [[ -z "$op" || "$op" == "push" || "$op" == "save" ]]; then
+          echo "block"; return 0
+        fi
+        echo "allow"; return 0   # list / show / pop / apply / drop …
+        ;;
+      clean)
+        # any force flag makes clean destructive; -n/--dry-run is safe.
+        for ((j = s + 1; j < n; j++)); do
+          local t="${toks[j]}"
+          [[ "$t" == "--force" ]] && { echo "block"; return 0; }
+          # short flag bundle containing 'f' (-f, -fd, -xfd, …) but not -n.
+          if [[ "$t" == -[^-]* && "$t" == *f* ]]; then echo "block"; return 0; fi
+        done
+        echo "allow"; return 0
+        ;;
+      reset)
+        for ((j = s + 1; j < n; j++)); do
+          [[ "${toks[j]}" == "--hard" ]] && { echo "block"; return 0; }
+        done
+        echo "allow"; return 0
+        ;;
+      restore)
+        # whole-tree restore (`git restore .`) loses work; a targeted path or an
+        # unstage (`--staged <path>`) is allowed, mirroring `checkout -- <path>`.
+        for ((j = s + 1; j < n; j++)); do
+          local t="${toks[j]}"
+          [[ "$t" == -* ]] && continue   # skip flags (--staged, --source=…, …)
+          if [[ "$t" == "." ]]; then echo "block"; return 0; fi
+          break                          # a named path: allowed
+        done
+        echo "allow"; return 0
+        ;;
+      checkout|switch)
+        local target="" sawdoubledash=0
+        for ((j = s + 1; j < n; j++)); do
+          local t="${toks[j]}"
+          if [[ "$t" == "--" ]]; then sawdoubledash=1; continue; fi
+          if [[ "$t" == "-" ]]; then target="-"; break; fi  # `switch -` = previous branch
+          [[ "$t" == -* ]] && continue   # skip flags (-b, -c, -q, --track, …)
+          target="$t"; break
+        done
+        # whole-tree restore via checkout (`git checkout .`, `git checkout -- .`).
+        if [[ "$target" == "." ]]; then echo "block"; return 0; fi
+        if (( sawdoubledash )); then echo "allow"; return 0; fi   # file restore
+        if [[ -z "$target" ]]; then echo "allow"; return 0; fi    # bare checkout
+        if [[ "$target" == "$_lock" ]]; then echo "allow"; return 0; fi # back to lock
+        echo "block"; return 0
+        ;;
+    esac
+  done
+
+  echo "allow"; return 0
+}
+
+# classify_primary_branch_switch_guard <command>
+classify_primary_branch_switch_guard() {
+  local _cmd="$1"
+  local -a toks
+  read -ra toks <<<"$_cmd"
+  local n=${#toks[@]} i j
+
+  for ((i = 0; i < n; i++)); do
+    [[ "${toks[i]}" == "git" ]] || continue
+    local s; s="$(_git_subcommand_index toks "$i")"   # subcommand index, past global options
+    local sub="${toks[s]:-}"
+    case "$sub" in
+      worktree)
+        echo "allow"; return 0
+        ;;
+      reset)
+        # `git reset` in ANY form (--hard/--soft/--mixed, with or without a
+        # pathspec) can throw away parallel human WIP in the primary checkout
+        # (issue #1024). All forms blocked; use a worktree for branch work.
+        echo "block"; return 0
+        ;;
+      stash)
+        # `git stash` and every subcommand (push/save/pop/apply/list/show/…)
+        # blocked in the primary checkout (issue #1024) — the whole family
+        # touches or hides the primary's working tree.
+        echo "block"; return 0
+        ;;
+      rebase)
+        # `git rebase --autostash` silently stashes/pops the primary's WIP
+        # around the rebase (issue #1024); a plain rebase is not this vector.
+        for ((j = s + 1; j < n; j++)); do
+          [[ "${toks[j]}" == "--autostash" ]] && { echo "block"; return 0; }
+        done
+        echo "allow"; return 0
+        ;;
+      checkout|switch)
+        local target="" sawdoubledash=0
+        for ((j = s + 1; j < n; j++)); do
+          local t="${toks[j]}"
+          if [[ "$t" == "--" ]]; then sawdoubledash=1; continue; fi
+          if [[ "$t" == "-" ]]; then target="-"; break; fi
+          [[ "$t" == -* ]] && continue
+          target="$t"; break
+        done
+        if (( sawdoubledash )); then echo "allow"; return 0; fi
+        if [[ -z "$target" ]]; then echo "allow"; return 0; fi
+        if [[ "$target" == "." ]]; then echo "allow"; return 0; fi
+        echo "block"; return 0
+        ;;
+    esac
+  done
+
+  echo "allow"; return 0
+}

package/skills/misc/branch-lock/scripts/lib/lock-store.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# lib/lock-store.sh — the Lock Store: owns the branch-lock.yaml file end to end,
+# following the pure / explicit-args contract of the afk lib/ modules.
+#
+# The lock file records the single branch the agent is pinned to in the primary
+# checkout. Its presence means "locked"; its absence means "unlocked". Content
+# is the branch name on one line (a bare YAML scalar — valid YAML, trivially
+# inspectable). It lives under the gitignored .red/tmp/ so every checkout and
+# machine locks independently and nothing is ever committed.
+#
+# Reads no globals. The lock-file path is a parameter on every call, so the
+# Module stays unit-testable by sourcing it directly. Writes are atomic
+# (temp-in-same-dir then mv) so a concurrent reader never sees a half-written
+# file and a relock can never leave the target empty.
+#
+# Public surface:
+#   lock_store_write <lockfile> <branch>
+#     Atomically writes <branch> as the lock target. Creates the parent dir if
+#     missing. Returns 2 on missing arguments.
+#
+#   lock_store_read <lockfile>
+#     Echoes the locked branch name (trailing whitespace stripped) and returns
+#     0 when locked. Prints nothing and returns 1 when the file is absent
+#     (= unlocked), so absence is strictly opt-out.
+#
+#   lock_store_clear <lockfile>
+#     Removes the lock file. Idempotent — returns 0 whether or not it existed.
+#
+#   lock_store_is_locked <lockfile>
+#     Returns 0 when a non-empty lock file is present, 1 otherwise. No output.
+
+# lock_store_write <lockfile> <branch>
+lock_store_write() {
+  local _path="$1" _branch="$2"
+  [[ -z "$_path" || -z "$_branch" ]] && { printf '[lock-store] lock_store_write: need <lockfile> <branch>\n' >&2; return 2; }
+  mkdir -p "$(dirname "$_path")"
+  local tmp
+  tmp="$(mktemp "$(dirname "$_path")/.branch-lock.XXXXXX")"
+  printf '%s\n' "$_branch" > "$tmp"
+  mv -f "$tmp" "$_path"
+}
+
+# lock_store_read <lockfile>
+lock_store_read() {
+  local _path="$1"
+  [[ -s "$_path" ]] || return 1
+  local branch
+  # strip trailing whitespace/newlines; keep the first line only
+  IFS= read -r branch < "$_path"
+  branch="${branch%"${branch##*[![:space:]]}"}"
+  [[ -n "$branch" ]] || return 1
+  printf '%s' "$branch"
+}
+
+# lock_store_clear <lockfile>
+lock_store_clear() {
+  local _path="$1"
+  [[ -z "$_path" ]] && { printf '[lock-store] lock_store_clear: need <lockfile>\n' >&2; return 2; }
+  rm -f "$_path"
+  return 0
+}
+
+# lock_store_is_locked <lockfile>
+lock_store_is_locked() {
+  local _path="$1"
+  lock_store_read "$_path" >/dev/null 2>&1
+}

package/skills/misc/branch-lock/scripts/lib/scope-resolver.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# lib/scope-resolver.sh — the Scope Resolver: decides whether the branch lock is
+# enforced for a given git checkout, by toplevel location alone. Pure /
+# explicit-args, like lib/lock-store.sh.
+#
+# The lock is defined as "the primary checkout's branch". /afk does its work in
+# isolated worktrees under registered .red/tmp worktree lanes, which must never
+# be strangled by an interactive session's lock. The robust discriminator is
+# *where the checkout lives*, not its branch name or an env flag (a branch can be
+# named anything; an env flag relies on every caller setting it). So: a toplevel
+# under .red/tmp/worktrees/<lane>/<slug> or the legacy .red/tmp/work-*/ shape is
+# a worktree (exempt); anything else is the primary checkout (enforced).
+#
+# Public surface:
+#   scope_is_worktree <toplevel>
+#     Returns 0 when <toplevel> is (or is nested under) a registered .red/tmp
+#     worktree lane or legacy .red/tmp/work-* directory. Returns 1 otherwise.
+#     No output.
+#
+#   scope_should_enforce <toplevel>
+#     The verdict the hook wants: returns 0 (enforce the lock) for the primary
+#     checkout, 1 (exempt) for a worktree. The exact inverse of
+#     scope_is_worktree. No output.
+
+# scope_is_worktree <toplevel>
+scope_is_worktree() {
+  local _top="$1"
+  case "$_top" in
+    */.red/tmp/worktrees/*/*) return 0 ;;   # registered worktree lane root
+    */.red/tmp/worktrees/*/*/*) return 0 ;; # nested below registered worktree lane root
+    */.red/tmp/work-*) return 0 ;;   # the worktree root itself
+    */.red/tmp/work-*/*) return 0 ;; # nested below a worktree root
+    *) return 1 ;;
+  esac
+}
+
+# scope_should_enforce <toplevel>
+scope_should_enforce() {
+  if scope_is_worktree "$1"; then
+    return 1
+  fi
+  return 0
+}

package/skills/misc/branch-lock/scripts/tests/branch-lock-cli.test.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Unit test for branch-lock.sh — the /branch-lock CLI (issue #63).
+#
+# Covers the atomic relock-then-switch contract of `set`:
+#   AC1: `set <new>` from a different branch updates the lock AND lands the
+#        working tree on <new> in one step.
+#   AC2: the CLI still lands the branch even though the untouchable-primary rule
+#        (ADR 0083) blocks every raw agent `git switch` — proven by showing
+#        (a) the PreToolUse hook BLOCKS a raw `git switch <new>`, yet (b)
+#        `set <new>` succeeds anyway, because the CLI performs the switch itself
+#        (a subprocess, not an agent Bash-tool call the hook can intercept).
+#   AC3: locking to the branch already checked out just rewrites the target
+#        (no switch needed, exit 0).
+#
+# End-to-end against throwaway git repos: branch-lock.sh runs main() on every
+# invocation, so it cannot be sourced for pure helpers — drive it as a subprocess.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+SCRIPTS="$(dirname "$HERE")"
+CLI="$SCRIPTS/branch-lock.sh"
+HOOK="$SCRIPTS/branch-lock-hook.sh"
+
+pass=0
+fail=0
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      expected: %q\n      actual:   %q\n' "$label" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+expect_contains() {
+  local label="$1" needle="$2" haystack="$3"
+  if [[ "$haystack" == *"$needle"* ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      missing: %q\n      in:      %q\n' "$label" "$needle" "$haystack"
+    fail=$((fail + 1))
+  fi
+}
+
+# A throwaway repo with two branches, left checked out on `main`. The dev plugin
+# is opted in (ADR 0067 gate) so the PreToolUse hook is armed for run_hook.
+mk_repo() {
+  local dir="$1"
+  git init -q -b main "$dir"
+  git -C "$dir" config user.email t@t.t
+  git -C "$dir" config user.name t
+  git -C "$dir" commit -q --allow-empty -m init
+  git -C "$dir" branch feature
+  mkdir -p "$dir/.red"
+  printf 'plugins:\n  dev:\n    enabled: true\n' > "$dir/.red/config.yaml"
+}
+
+current_branch() { git -C "$1" rev-parse --abbrev-ref HEAD; }
+locked_branch()  { cat "$1/.red/tmp/branch-lock.yaml" 2>/dev/null | tr -d '\n'; }
+
+# Run the CLI from inside the repo (git operates on cwd) with the root pinned.
+run_cli() { local root="$1"; shift; ( cd "$root" && CLAUDE_PROJECT_DIR="$root" bash "$CLI" "$@" ); }
+# Run the PreToolUse hook against a Bash command; echoes the exit code.
+run_hook() {
+  local root="$1" cmd="$2"
+  ( cd "$root" && CLAUDE_PROJECT_DIR="$root" bash "$HOOK" \
+    <<<"{\"tool_input\":{\"command\":\"$cmd\"}}" ) >/dev/null 2>&1
+  echo $?
+}
+
+# ===========================================================================
+# AC1 — set <new> from a different branch: lock moves AND tree lands on <new>.
+# ===========================================================================
+R1="$(mktemp -d)/red-skills"; mk_repo "$R1"
+OUT1="$(run_cli "$R1" set feature)"; RC1=$?
+expect_eq "AC1 set <new>: exit 0" "0" "$RC1"
+expect_eq "AC1 set <new>: lock target rewritten" "feature" "$(locked_branch "$R1")"
+expect_eq "AC1 set <new>: working tree on new branch" "feature" "$(current_branch "$R1")"
+expect_contains "AC1 set <new>: reports the lock" "locked to 'feature'" "$OUT1"
+
+# ===========================================================================
+# AC2 — the intended switch is never blocked by the hook.
+#   Lock to main first; a raw `git switch feature` is then hook-blocked, but the
+#   CLI's `set feature` still succeeds (it relocks first, then switches).
+# ===========================================================================
+R2="$(mktemp -d)/red-skills"; mk_repo "$R2"
+run_cli "$R2" set main >/dev/null
+expect_eq "AC2 raw switch to <new> is hook-blocked while locked to old" \
+  "2" "$(run_hook "$R2" "git switch feature")"
+OUT2="$(run_cli "$R2" set feature)"; RC2=$?
+expect_eq "AC2 CLI set <new>: exit 0 despite the old lock" "0" "$RC2"
+expect_eq "AC2 CLI set <new>: lock now on new branch" "feature" "$(locked_branch "$R2")"
+expect_eq "AC2 CLI set <new>: tree landed on new branch" "feature" "$(current_branch "$R2")"
+# Untouchable primary (ADR 0083): a raw agent switch to the new target is still
+# refused — the primary is never movable by the agent, even back to the lock
+# target. The CLI succeeds because it switches itself, outside the hook's reach.
+expect_eq "AC2 post-relock: hook still blocks raw switch to the new target" \
+  "2" "$(run_hook "$R2" "git switch feature")"
+
+# ===========================================================================
+# AC3 — locking to the branch already checked out just rewrites the target.
+# ===========================================================================
+R3="$(mktemp -d)/red-skills"; mk_repo "$R3"   # on main, unlocked
+OUT3="$(run_cli "$R3" set main)"; RC3=$?
+expect_eq "AC3 set <current>: exit 0" "0" "$RC3"
+expect_eq "AC3 set <current>: lock target written" "main" "$(locked_branch "$R3")"
+expect_eq "AC3 set <current>: still on the same branch" "main" "$(current_branch "$R3")"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/skills/misc/branch-lock/scripts/tests/claude-plugin-hook.test.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# Unit test for the Claude plugin PreToolUse(Bash) branch guard wiring.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+PLUGIN_ROOT="$(cd "$HERE/../../../../.." && pwd)"
+MANIFEST="$PLUGIN_ROOT/hooks/claude.hooks.json"
+
+pass=0
+fail=0
+
+ok()  { echo "PASS  $1"; pass=$((pass + 1)); }
+bad() { echo "FAIL  $1"; fail=$((fail + 1)); }
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    ok "$label"
+  else
+    bad "$label"
+    printf '  expected: %q\n  actual:   %q\n' "$expected" "$actual"
+  fi
+}
+
+expect_contains() {
+  local label="$1" needle="$2" haystack="$3"
+  if [[ "$haystack" == *"$needle"* ]]; then
+    ok "$label"
+  else
+    bad "$label"
+    printf '  missing: %q\n  in:      %q\n' "$needle" "$haystack"
+  fi
+}
+
+tmp="$(mktemp -d -t branch-lock-claude.XXXXXX)"
+trap 'rm -rf "$tmp"' EXIT
+
+primary="$tmp/red-skills"
+mkdir -p "$primary/.red"
+# No lock file and no `dev.lock.primary-branch` toggle: the untouchable-primary
+# rule (ADR 0083) must block branch movement anyway.
+cat > "$primary/.red/config.yaml" <<'EOF'
+plugins:
+  dev:
+    enabled: true
+EOF
+
+payload() {
+  local cmd="$1"
+  jq -nc --arg cmd "$cmd" '{hook_event_name:"PreToolUse", tool_input:{command:$cmd}}'
+}
+
+manifest_matcher="$(jq -r '.hooks.PreToolUse[0].matcher' "$MANIFEST")"
+manifest_hook="$(jq -r '.hooks.PreToolUse[0].hooks[0].command' "$MANIFEST")"
+expect_eq "manifest: matcher is Bash" "Bash" "$manifest_matcher"
+expect_contains "manifest: wires branch-lock-hook.sh" "branch-lock-hook.sh" "$manifest_hook"
+expect_contains "manifest: wrapper drains stdin before hook" 'cat >"$tmp"' "$manifest_hook"
+
+out="$tmp/out"
+err="$tmp/err"
+CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" CLAUDE_PROJECT_DIR="$primary" bash -lc "$manifest_hook" \
+  >"$out" 2>"$err" <<<"$(payload "git switch feature")"
+rc=$?
+expect_eq "primary guard: switch blocked with no lock and no config" "0" "$rc"
+expect_contains "primary guard: error names ADR 0083" "ADR 0083" "$(<"$err")"
+
+# issue #1024 — git reset (any form) and git stash (all subcommands) blocked,
+# and the refusal explains the reason + the sanctioned worktree alternative.
+CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" CLAUDE_PROJECT_DIR="$primary" bash -lc "$manifest_hook" \
+  >"$out" 2>"$err" <<<"$(payload "git reset --hard")"
+rc=$?
+expect_eq "primary guard: reset --hard is blocked when flag is on" "0" "$rc"
+expect_contains "primary guard: reset refusal points to worktree" ".red/tmp/work-" "$(<"$err")"
+
+CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" CLAUDE_PROJECT_DIR="$primary" bash -lc "$manifest_hook" \
+  >"$out" 2>"$err" <<<"$(payload "git stash")"
+rc=$?
+expect_eq "primary guard: stash is blocked when flag is on" "0" "$rc"
+
+CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" CLAUDE_PROJECT_DIR="$primary" bash -lc "$manifest_hook" \
+  >"$out" 2>"$err" <<<"$(payload "git rebase --autostash main")"
+rc=$?
+expect_eq "primary guard: rebase --autostash is blocked when flag is on" "0" "$rc"
+
+CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" CLAUDE_PROJECT_DIR="$primary" bash -lc "$manifest_hook" \
+  >"$out" 2>"$err" <<<"$(payload "git commit -m wip")"
+rc=$?
+expect_eq "primary guard: commit is allowed" "0" "$rc"
+
+# The legacy toggle stays readable but can no longer *enable* switching: with it
+# explicitly false the guard still blocks, because primary movement is
+# unconditional (ADR 0083 §2).
+cat > "$primary/.red/config.yaml" <<'EOF'
+plugins:
+  dev:
+    enabled: true
+    lock:
+      primary-branch: false
+EOF
+CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" CLAUDE_PROJECT_DIR="$primary" bash -lc "$manifest_hook" \
+  >"$out" 2>"$err" <<<"$(payload "git switch feature")"
+rc=$?
+expect_eq "primary guard: legacy toggle off still blocks switch" "0" "$rc"
+expect_contains "primary guard: legacy-off error names ADR 0083" "ADR 0083" "$(<"$err")"
+
+missing_root="$tmp/missing-plugin-root"
+mkdir -p "$missing_root"
+CLAUDE_PLUGIN_ROOT="$missing_root" CLAUDE_PROJECT_DIR="$primary" bash -lc "$manifest_hook" \
+  >"$out" 2>"$err" <<<"$(payload "git switch feature")"
+rc=$?
+expect_eq "manifest: missing hook fails open" "0" "$rc"
+expect_eq "manifest: missing hook prints empty JSON" "{}" "$(<"$out")"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[[ "$fail" -eq 0 ]]