@reddb-io/red-skills-dev 2.75.2

package/skills/misc/branch-lock/scripts/tests/scope-resolver.test.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Unit test for lib/scope-resolver.sh (issue #60).
+#
+# The lock enforces in the primary checkout and is exempt in registered
+# .red/tmp worktree lanes plus legacy .red/tmp/work-* worktrees. Verifies both
+# scope_is_worktree and its inverse scope_should_enforce across primary roots,
+# worktree roots, and paths nested inside a worktree.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIB="$(dirname "$HERE")/lib/scope-resolver.sh"
+
+# shellcheck source=../lib/scope-resolver.sh
+source "$LIB"
+
+pass=0
+fail=0
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      expected: %q\n      actual:   %q\n' "$label" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+rc_of() { "$@"; echo $?; }
+
+# ===========================================================================
+# primary checkout => enforce (not a worktree)
+# ===========================================================================
+PRIMARY="/home/dev/Work/reddb.io/red-skills"
+expect_eq "primary/is_worktree rc 1"     "1"  "$(rc_of scope_is_worktree "$PRIMARY")"
+expect_eq "primary/should_enforce rc 0"  "0"  "$(rc_of scope_should_enforce "$PRIMARY")"
+
+# a path that merely contains '.red/tmp' but is not a work-* worktree still enforces
+NEAR="/home/dev/Work/reddb.io/red-skills/.red/tmp"
+expect_eq "near/is_worktree rc 1"        "1"  "$(rc_of scope_is_worktree "$NEAR")"
+
+# ===========================================================================
+# registered worktree lane root => exempt
+# ===========================================================================
+WT="/home/dev/Work/reddb.io/red-skills/.red/tmp/worktrees/manual/fix-docs"
+expect_eq "worktree/is_worktree rc 0"    "0"  "$(rc_of scope_is_worktree "$WT")"
+expect_eq "worktree/should_enforce rc 1" "1"  "$(rc_of scope_should_enforce "$WT")"
+
+# legacy .red/tmp/work-* remains exempt during migration
+WTROOT="/home/dev/Work/reddb.io/red-skills/.red/tmp/work-abc-i1"
+expect_eq "worktree-root/is_worktree rc 0" "0" "$(rc_of scope_is_worktree "$WTROOT")"
+
+# ===========================================================================
+# nested path inside a worktree => still exempt
+# ===========================================================================
+NESTED="/home/dev/Work/reddb.io/red-skills/.red/tmp/worktrees/manual/fix-docs/plugins/dev"
+expect_eq "nested/is_worktree rc 0"      "0"  "$(rc_of scope_is_worktree "$NESTED")"
+expect_eq "nested/should_enforce rc 1"   "1"  "$(rc_of scope_should_enforce "$NESTED")"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/skills/misc/branch-lock/scripts/tests/session-start.test.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Unit test for branch-lock-session-start.sh (issue #62).
+#
+# The SessionStart hook offers — once, at session start — to lock the agent to
+# the current branch. It must:
+#   - emit an instruction (exit 0, JSON on stdout) in the primary checkout when
+#     the branch is unlocked, naming the current branch;
+#   - stay silent (no stdout) inside an /afk worktree (scope exemption);
+#   - stay silent when a lock is already present (nothing to offer);
+#   - stay silent on a detached HEAD (no branch to lock).
+#
+# Exercises the pure decision/text helpers sourced from the hook script, plus an
+# end-to-end run of the hook against throwaway git repos.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+HOOK="$(dirname "$HERE")/branch-lock-session-start.sh"
+
+# Source the script for its pure helpers (the script guards main on direct run).
+# shellcheck source=../branch-lock-session-start.sh
+source "$HOOK"
+
+pass=0
+fail=0
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      expected: %q\n      actual:   %q\n' "$label" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+expect_contains() {
+  local label="$1" needle="$2" haystack="$3"
+  if [[ "$haystack" == *"$needle"* ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      missing: %q\n      in:      %q\n' "$label" "$needle" "$haystack"
+    fail=$((fail + 1))
+  fi
+}
+
+rc_of() { "$@"; echo $?; }
+
+# ===========================================================================
+# session_start_should_prompt <root> <lockfile> <branch>
+#   prompt only when: primary checkout AND unlocked AND a real branch.
+# ===========================================================================
+PRIMARY="/home/dev/Work/reddb.io/red-skills"
+WT="/home/dev/Work/reddb.io/red-skills/.red/tmp/work-abc-i1/worktree"
+ABSENT_LOCK="$(mktemp -u)"   # path that does not exist => unlocked
+
+expect_eq "primary+unlocked+branch => prompt (rc 0)" \
+  "0" "$(rc_of session_start_should_prompt "$PRIMARY" "$ABSENT_LOCK" "main")"
+
+expect_eq "worktree => no prompt (rc 1)" \
+  "1" "$(rc_of session_start_should_prompt "$WT" "$ABSENT_LOCK" "main")"
+
+expect_eq "detached HEAD => no prompt (rc 1)" \
+  "1" "$(rc_of session_start_should_prompt "$PRIMARY" "$ABSENT_LOCK" "HEAD")"
+
+expect_eq "empty branch => no prompt (rc 1)" \
+  "1" "$(rc_of session_start_should_prompt "$PRIMARY" "$ABSENT_LOCK" "")"
+
+PRESENT_LOCK="$(mktemp)"; printf 'main\n' > "$PRESENT_LOCK"
+expect_eq "already locked => no prompt (rc 1)" \
+  "1" "$(rc_of session_start_should_prompt "$PRIMARY" "$PRESENT_LOCK" "feature/x")"
+rm -f "$PRESENT_LOCK"
+
+# ===========================================================================
+# session_start_prompt_text <branch> — names the branch, instructs to ask.
+# ===========================================================================
+TEXT="$(session_start_prompt_text "feature/login")"
+expect_contains "prompt text names the branch" "feature/login" "$TEXT"
+expect_contains "prompt text says to ask the user" "ask" "$TEXT"
+expect_contains "prompt text points at /branch-lock" "/branch-lock" "$TEXT"
+
+# ===========================================================================
+# End-to-end: run the hook against throwaway repos.
+# ===========================================================================
+mk_repo() {
+  local dir="$1"
+  git init -q "$dir"
+  git -C "$dir" config user.email t@t.t
+  git -C "$dir" config user.name t
+  git -C "$dir" commit -q --allow-empty -m init
+}
+
+run_hook() { CLAUDE_PROJECT_DIR="$1" bash "$HOOK" <<<'{"hook_event_name":"SessionStart"}'; }
+
+# primary checkout, unlocked => emits JSON with additionalContext naming branch
+TMP_PRIMARY="$(mktemp -d)/red-skills"
+mk_repo "$TMP_PRIMARY"
+git -C "$TMP_PRIMARY" branch -m work-branch
+OUT="$(run_hook "$TMP_PRIMARY")"
+expect_contains "e2e primary: emits SessionStart event" "SessionStart" "$OUT"
+expect_contains "e2e primary: names the branch" "work-branch" "$OUT"
+expect_contains "e2e primary: valid additionalContext" "additionalContext" "$OUT"
+if command -v jq >/dev/null 2>&1; then
+  CTX="$(jq -r '.hookSpecificOutput.additionalContext' <<<"$OUT" 2>/dev/null)"
+  expect_contains "e2e primary: JSON parses, branch in context" "work-branch" "$CTX"
+fi
+
+# already locked => silent (empty stdout)
+mkdir -p "$TMP_PRIMARY/.red/tmp"
+printf 'work-branch\n' > "$TMP_PRIMARY/.red/tmp/branch-lock.yaml"
+OUT_LOCKED="$(run_hook "$TMP_PRIMARY")"
+expect_eq "e2e locked: silent" "" "$OUT_LOCKED"
+
+# worktree => silent even when unlocked
+TMP_WT="$(mktemp -d)/red-skills/.red/tmp/work-zzz-i1/worktree"
+mkdir -p "$(dirname "$TMP_WT")"
+mk_repo "$TMP_WT"
+OUT_WT="$(run_hook "$TMP_WT")"
+expect_eq "e2e worktree: silent" "" "$OUT_WT"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/skills/misc/git-guardrails-claude-code/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: git-guardrails-claude-code
+description: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.
+disable-model-invocation: true
+---
+
+# Setup Git Guardrails
+
+**Block destructive git ops before they run.**
+
+Sets up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them.
+
+<what-to-do>
+
+## 1. Ask scope
+
+Ask the user: install for **this project only** (`.claude/settings.json`) or **all projects** (`~/.claude/settings.json`)?
+
+## 2. Copy the hook script
+
+The bundled script is at: [scripts/block-dangerous-git.sh](scripts/block-dangerous-git.sh)
+
+Copy it to the target location based on scope, then make it executable with `chmod +x`:
+
+- **Project**: `.claude/hooks/block-dangerous-git.sh`
+- **Global**: `~/.claude/hooks/block-dangerous-git.sh`
+
+## 3. Add hook to settings
+
+Add the `PreToolUse` hook to the appropriate settings file. The block is identical for both scopes — only the `command` path differs: **project** uses `"$CLAUDE_PROJECT_DIR"/.claude/hooks/block-dangerous-git.sh`, **global** uses `~/.claude/hooks/block-dangerous-git.sh`.
+
+```json
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh"
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+If the settings file already exists, merge the hook into the existing `hooks.PreToolUse` array — don't overwrite other settings.
+
+## 4. Ask about customization
+
+Ask if the user wants to add or remove any patterns from the blocked list. Edit the copied script accordingly.
+
+## 5. Verify
+
+Run a quick test:
+
+```bash
+echo '{"tool_input":{"command":"git push origin main"}}' | <path-to-script>
+```
+
+Should exit with code 2 and print a BLOCKED message to stderr.
+
+</what-to-do>
+
+<supporting-info>
+
+## What gets blocked
+
+- `git push` (all variants including `--force`)
+- `git reset --hard`
+- `git clean -f` / `git clean -fd`
+- `git branch -D`
+- `git checkout .` / `git restore .`
+
+When blocked, Claude sees a message telling it that it does not have authority to access these commands.
+
+## Primary branch guard
+
+Once the dev plugin is enabled (`plugins.dev.enabled: true`), this hook blocks the
+agent from switching the primary checkout's branch (`git switch <branch>`,
+`git checkout <branch>`, `git switch -b <new>`) **unconditionally** — with no
+branch-lock file and no config toggle (ADR 0083 §2, untouchable primary). `git
+commit`, `git worktree add`, read-only git, and registered `.red/tmp/worktrees/<lane>/<slug>` worktrees stay
+allowed; the human terminal is not intercepted. The historical
+`dev.lock.primary-branch` key is retained as read-only legacy history only — it no
+longer enables or disables the guard.
+
+## Branch-lock awareness
+
+When an opt-in branch lock is active, this hook also blocks the branch-leaving /
+work-loss family in the primary checkout. That behaviour is documented in full at
+[`branch-lock`](../branch-lock/SKILL.md); this hook is self-contained and reaches
+the same verdict without sourcing it.
+
+## Tests
+
+The full behaviour (dangerous patterns + branch-lock awareness + worktree
+scope + the no-dependency contract) is pinned by
+[scripts/tests/block-dangerous-git.test.sh](scripts/tests/block-dangerous-git.test.sh),
+run directly with `bash`.
+
+</supporting-info>

package/skills/misc/git-guardrails-claude-code/scripts/block-dangerous-git.sh

@@ -0,0 +1,231 @@
+#!/bin/bash
+# block-dangerous-git.sh — git-guardrails PreToolUse(Bash) hook.
+#
+# Two independent layers, both ending in exit 2 (Claude Code's "deny this tool
+# call") with a message on stderr:
+#
+#   1. Always-on dangerous patterns — push, reset --hard, clean -f, branch -D,
+#      whole-tree checkout/restore. These fire regardless of any branch lock and
+#      are the skill's original purpose.
+#
+#   2. Branch-lock awareness — when a branch lock is active in the primary
+#      checkout (an opt-in `.red/tmp/branch-lock.yaml` whose content is the
+#      locked branch), the hook ALSO blocks the branch-leaving / work-loss family
+#      (switch/checkout to another branch, `switch -`, bare `git stash`). This is
+#      a self-contained re-implementation: git-guardrails reads the lock and
+#      classifies the command on its own and never sources or requires the
+#      branch-lock skill (issue #65 — independent, no dependency). If branch-lock
+#      is also installed the two hooks reach the same verdict and stack
+#      idempotently — both deny, neither conflicts.
+#
+# The lock layer stays silent (no block) when there is no lock file, and is
+# scope-exempt inside registered worktree lanes under .red/tmp/worktrees/,
+# mirroring the branch-lock hook so the autonomous loop is never strangled.
+#
+#   3. Primary branch guard — when `.red/config.yaml` sets
+#      `dev.lock.primary-branch: true`, the hook blocks branch-switching in the
+#      primary checkout even without a branch-lock file. This is also
+#      self-contained and keeps the same worktree exemption.
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command')
+
+DANGEROUS_PATTERNS=(
+  "git push"
+  "git reset --hard"
+  "git clean -fd"
+  "git clean -f"
+  "git branch -D"
+  "git checkout \."
+  "git restore \."
+  "push --force"
+  "reset --hard"
+)
+
+for pattern in "${DANGEROUS_PATTERNS[@]}"; do
+  if echo "$COMMAND" | grep -qE "$pattern"; then
+    echo "BLOCKED: '$COMMAND' matches dangerous pattern '$pattern'. The user has prevented you from doing this." >&2
+    exit 2
+  fi
+done
+
+# --- Branch-lock awareness (self-contained; no branch-lock skill dependency) ---
+
+[ -z "$COMMAND" ] && exit 0
+
+# Project root: prefer the harness-provided dir, fall back to the git toplevel.
+ROOT="${CLAUDE_PROJECT_DIR:-}"
+if [ -z "$ROOT" ]; then
+  ROOT=$(git rev-parse --show-toplevel 2>/dev/null || true)
+fi
+[ -z "$ROOT" ] && exit 0
+
+# Scope: registered worktree lanes under .red/tmp/worktrees/ are exempt even when locked.
+case "$ROOT" in
+  */.red/tmp/worktrees/*/*) exit 0 ;;
+  */.red/tmp/worktrees/*/*/*) exit 0 ;;
+  */.red/tmp/work-*) exit 0 ;;
+  */.red/tmp/work-*/*) exit 0 ;;
+esac
+
+# Runtime reader for the one dev flag ADR 0043 needs. Missing file/key or
+# malformed input is disabled, so the plugin-level hook is dormant by default.
+_dev_lock_primary_branch_enabled() {
+  local _file="$1"
+  [ -f "$_file" ] || return 1
+
+  local -a _stack=()
+  local -a _indents=()
+  local _raw _line _indent_str _indent _rest _key _value _full _i
+
+  while IFS= read -r _raw || [ -n "$_raw" ]; do
+    _raw="${_raw%$'\r'}"
+    _line="$_raw"
+    if [[ "$_line" != *\"* && "$_line" != *\'* ]]; then
+      _line="${_line%%#*}"
+    fi
+    _line="${_line%"${_line##*[![:space:]]}"}"
+    [ -z "${_line//[[:space:]]/}" ] && continue
+
+    _indent_str="${_line%%[![:space:]]*}"
+    _indent=${#_indent_str}
+    (( _indent % 2 == 0 )) || return 1
+    _rest="${_line:$_indent}"
+
+    [[ "$_rest" =~ ^[A-Za-z_][A-Za-z0-9_-]*: ]] || return 1
+    _key="${_rest%%:*}"
+    _value="${_rest#*:}"
+    _value="${_value#"${_value%%[![:space:]]*}"}"
+
+    while ((${#_indents[@]} > 0 && _indents[${#_indents[@]} - 1] >= _indent)); do
+      local _last_stack=$(( ${#_stack[@]} - 1 ))
+      local _last_indent=$(( ${#_indents[@]} - 1 ))
+      unset "_stack[$_last_stack]"
+      unset "_indents[$_last_indent]"
+    done
+
+    _full=""
+    for ((_i = 0; _i < ${#_stack[@]}; _i++)); do
+      [ -n "$_full" ] && _full+="."
+      _full+="${_stack[$_i]}"
+    done
+    [ -n "$_full" ] && _full+="."
+    _full+="$_key"
+
+    if [ -z "$_value" ]; then
+      _stack+=("$_key")
+      _indents+=("$_indent")
+      continue
+    fi
+
+    if [[ "$_value" == \"*\" && "$_value" == *\" ]]; then
+      _value="${_value:1:${#_value}-2}"
+    elif [[ "$_value" == \'*\' && "$_value" == *\' ]]; then
+      _value="${_value:1:${#_value}-2}"
+    fi
+
+    if [ "$_full" = "dev.lock.primary-branch" ] || [ "$_full" = "plugins.dev.lock.primary-branch" ]; then
+      [ "$_value" = "true" ] && return 0
+    fi
+  done < "$_file"
+
+  return 1
+}
+
+_primary_branch_switch_verdict() {
+  local _cmd="$1"
+  read -ra _pb_toks <<<"$_cmd"
+  local _pb_n=${#_pb_toks[@]} _pb_i _pb_j
+  for ((_pb_i = 0; _pb_i < _pb_n; _pb_i++)); do
+    [ "${_pb_toks[_pb_i]}" = "git" ] || continue
+    local _pb_sub="${_pb_toks[_pb_i + 1]:-}"
+    case "$_pb_sub" in
+      worktree)
+        echo "allow"; return 0 ;;
+      checkout|switch)
+        local _pb_target="" _pb_sawdd=0
+        for ((_pb_j = _pb_i + 2; _pb_j < _pb_n; _pb_j++)); do
+          local _pb_t="${_pb_toks[_pb_j]}"
+          if [ "$_pb_t" = "--" ]; then _pb_sawdd=1; continue; fi
+          if [ "$_pb_t" = "-" ]; then _pb_target="-"; break; fi
+          case "$_pb_t" in -*) continue ;; esac
+          _pb_target="$_pb_t"; break
+        done
+        [ "$_pb_sawdd" -eq 1 ] && { echo "allow"; return 0; }
+        [ -z "$_pb_target" ] && { echo "allow"; return 0; }
+        [ "$_pb_target" = "." ] && { echo "allow"; return 0; }
+        echo "block"; return 0 ;;
+    esac
+  done
+  echo "allow"; return 0
+}
+
+if _dev_lock_primary_branch_enabled "$ROOT/.red/config.yaml" &&
+  [ "$(_primary_branch_switch_verdict "$COMMAND")" = "block" ]; then
+  cat >&2 <<EOF
+BLOCKED by primary branch guard: dev.lock.primary-branch is true.
+The command '$COMMAND' would switch the agent's primary checkout branch.
+
+Allowed in the primary checkout: git commit, git worktree add, read-only git,
+and non-branch-changing commands. To work on another branch, create/use a
+worktree under .red/tmp/worktrees/manual/<slug> or ask the user to change the primary branch.
+EOF
+  exit 2
+fi
+
+# Read the lock target (first line, trailing whitespace stripped). Absent or
+# empty file means unlocked — nothing more to enforce.
+LOCKFILE="$ROOT/.red/tmp/branch-lock.yaml"
+[ -s "$LOCKFILE" ] || exit 0
+IFS= read -r LOCK_BRANCH < "$LOCKFILE"
+LOCK_BRANCH="${LOCK_BRANCH%"${LOCK_BRANCH##*[![:space:]]}"}"
+[ -z "$LOCK_BRANCH" ] && exit 0
+
+# Classify the command against the lock. Scans the token stream for a `git` token
+# followed by a recognised subcommand, so compound commands (`cd x && git switch
+# y`) are still caught. Only the branch-leaving / work-loss family blocks; the
+# work-loss members already caught by the dangerous patterns above are harmless
+# duplicates here.
+read -ra _toks <<<"$COMMAND"
+_n=${#_toks[@]}
+_verdict="allow"
+for ((_i = 0; _i < _n; _i++)); do
+  [ "${_toks[_i]}" = "git" ] || continue
+  _sub="${_toks[_i + 1]:-}"
+  case "$_sub" in
+    worktree)
+      _verdict="allow"; break ;;
+    stash)
+      _op="${_toks[_i + 2]:-}"
+      if [ -z "$_op" ] || [ "$_op" = "push" ] || [ "$_op" = "save" ]; then
+        _verdict="block"
+      fi
+      break ;;
+    checkout|switch)
+      _target=""; _sawdd=0
+      for ((_j = _i + 2; _j < _n; _j++)); do
+        _t="${_toks[_j]}"
+        if [ "$_t" = "--" ]; then _sawdd=1; continue; fi
+        if [ "$_t" = "-" ]; then _target="-"; break; fi   # `switch -` = previous branch
+        case "$_t" in -*) continue ;; esac               # skip flags (-b, -c, --track, …)
+        _target="$_t"; break
+      done
+      if [ "$_target" = "." ]; then _verdict="block"; break; fi   # whole-tree restore (already a pattern)
+      [ "$_sawdd" -eq 1 ] && break                                # file restore: allow
+      [ -z "$_target" ] && break                                  # bare checkout: allow
+      [ "$_target" = "$LOCK_BRANCH" ] && break                    # back to the lock target: allow
+      _verdict="block"; break ;;
+  esac
+done
+
+if [ "$_verdict" = "block" ]; then
+  cat >&2 <<EOF
+BLOCKED by branch lock: this session is locked to '$LOCK_BRANCH'.
+The command '$COMMAND' would switch the agent away from the locked branch or
+shelve the working tree. To change or release the lock, ask the user — they
+drive it with '/branch-lock <branch>' or '/branch-lock clear'.
+EOF
+  exit 2
+fi
+
+exit 0

package/skills/misc/git-guardrails-claude-code/scripts/tests/block-dangerous-git.test.sh

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+# Unit test for block-dangerous-git.sh — the git-guardrails PreToolUse(Bash) hook
+# (issue #65: make git-guardrails lock-aware, independent, no dependency).
+#
+# Two responsibilities, exercised end-to-end against throwaway repos:
+#   1. The always-on dangerous-pattern block (push, reset --hard, …) is
+#      unchanged and lock-independent.
+#   2. When a branch lock is active in the primary checkout, the hook also blocks
+#      the branch-leaving / work-loss family — the same verdicts the branch-lock
+#      hook reaches — so git-guardrails alone enforces the lock (AC1). With both
+#      hooks installed the overlap is idempotent: both deny, never conflict (AC2).
+#      And the script depends on nothing from the branch-lock skill (AC3).
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+SCRIPTS="$(dirname "$HERE")"
+HOOK="$SCRIPTS/block-dangerous-git.sh"
+
+pass=0
+fail=0
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      expected: %q\n      actual:   %q\n' "$label" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+# A throwaway repo, optionally locked to <branch> via the gitignored lockfile.
+mk_repo() {
+  local dir="$1" lock="${2:-}"
+  git init -q -b main "$dir"
+  git -C "$dir" config user.email t@t.t
+  git -C "$dir" config user.name t
+  git -C "$dir" commit -q --allow-empty -m init
+  git -C "$dir" branch feature
+  if [[ -n "$lock" ]]; then
+    mkdir -p "$dir/.red/tmp"
+    printf '%s\n' "$lock" > "$dir/.red/tmp/branch-lock.yaml"
+  fi
+}
+
+# Run the hook against a Bash command with the project root pinned; echo exit code.
+run_hook() {
+  local root="$1" cmd="$2"
+  ( cd "$root" && CLAUDE_PROJECT_DIR="$root" bash "$HOOK" \
+    <<<"{\"tool_input\":{\"command\":\"$cmd\"}}" ) >/dev/null 2>&1
+  echo $?
+}
+
+# ===========================================================================
+# Always-on dangerous patterns — unchanged, lock-independent.
+# ===========================================================================
+RU="$(mktemp -d)/red-skills"; mk_repo "$RU"            # unlocked
+expect_eq "guardrail/push blocked (unlocked)"      "2" "$(run_hook "$RU" "git push origin main")"
+expect_eq "guardrail/reset --hard blocked"          "2" "$(run_hook "$RU" "git reset --hard")"
+expect_eq "guardrail/clean -fd blocked"             "2" "$(run_hook "$RU" "git clean -fd")"
+expect_eq "guardrail/branch -D blocked"             "2" "$(run_hook "$RU" "git branch -D feature")"
+expect_eq "guardrail/checkout dot blocked"          "2" "$(run_hook "$RU" "git checkout .")"
+expect_eq "guardrail/status allowed"                "0" "$(run_hook "$RU" "git status")"
+# Branch switching is NOT a guardrail pattern: allowed when no lock is active.
+expect_eq "no-lock/switch other allowed"            "0" "$(run_hook "$RU" "git switch feature")"
+expect_eq "no-lock/checkout -b allowed"             "0" "$(run_hook "$RU" "git checkout -b shiny")"
+expect_eq "no-lock/stash allowed"                   "0" "$(run_hook "$RU" "git stash")"
+
+# ===========================================================================
+# Primary branch guard — config flag on, no branch-lock file required.
+# ===========================================================================
+mkdir -p "$RU/.red"
+cat > "$RU/.red/config.yaml" <<'EOF'
+dev:
+  lock:
+    primary-branch: true
+EOF
+expect_eq "primary-guard/switch other blocked"      "2" "$(run_hook "$RU" "git switch feature")"
+expect_eq "primary-guard/checkout other blocked"    "2" "$(run_hook "$RU" "git checkout feature")"
+expect_eq "primary-guard/switch -b blocked"         "2" "$(run_hook "$RU" "git switch -b shiny")"
+expect_eq "primary-guard/commit allowed"            "0" "$(run_hook "$RU" "git commit -m wip")"
+expect_eq "primary-guard/worktree add allowed"      "0" "$(run_hook "$RU" "git worktree add ../wt feature")"
+expect_eq "primary-guard/status allowed"            "0" "$(run_hook "$RU" "git status")"
+
+cat > "$RU/.red/config.yaml" <<'EOF'
+dev:
+  lock:
+    primary-branch: false
+EOF
+expect_eq "primary-guard/flag off allows switch"    "0" "$(run_hook "$RU" "git switch feature")"
+
+# ===========================================================================
+# AC1 — lock active in the primary checkout: branch-leaving / work-loss blocked.
+# ===========================================================================
+RL="$(mktemp -d)/red-skills"; mk_repo "$RL" main       # locked to main
+expect_eq "AC1/switch other blocked"                "2" "$(run_hook "$RL" "git switch feature")"
+expect_eq "AC1/checkout other blocked"              "2" "$(run_hook "$RL" "git checkout feature")"
+expect_eq "AC1/checkout -b new blocked"             "2" "$(run_hook "$RL" "git checkout -b shiny")"
+expect_eq "AC1/switch - blocked"                    "2" "$(run_hook "$RL" "git switch -")"
+expect_eq "AC1/stash blocked"                       "2" "$(run_hook "$RL" "git stash")"
+# Same-branch / legitimate ops still allowed while locked.
+expect_eq "AC1/switch back to lock allowed"         "0" "$(run_hook "$RL" "git switch main")"
+expect_eq "AC1/checkout back to lock allowed"       "0" "$(run_hook "$RL" "git checkout main")"
+expect_eq "AC1/file restore allowed"                "0" "$(run_hook "$RL" "git checkout -- src/app.ts")"
+expect_eq "AC1/status allowed while locked"         "0" "$(run_hook "$RL" "git status")"
+expect_eq "AC1/worktree add allowed"                "0" "$(run_hook "$RL" "git worktree add ../wt feature")"
+# The guardrail patterns still fire while locked (idempotent with the work-loss family).
+expect_eq "AC1/push blocked while locked"           "2" "$(run_hook "$RL" "git push")"
+expect_eq "AC1/reset --hard blocked while locked"   "2" "$(run_hook "$RL" "git reset --hard")"
+
+# ===========================================================================
+# Scope — registered worktree lanes under .red/tmp/worktrees/ are exempt even with a lock.
+# ===========================================================================
+WT="$(mktemp -d)/red-skills/.red/tmp/worktrees/manual/fix-docs"
+mkdir -p "$(dirname "$WT")"
+mk_repo "$WT" main                                     # lockfile present, but it's a worktree path
+expect_eq "scope/worktree switch other allowed"     "0" "$(run_hook "$WT" "git switch feature")"
+mkdir -p "$WT/.red"
+cat > "$WT/.red/config.yaml" <<'EOF'
+dev:
+  lock:
+    primary-branch: true
+EOF
+expect_eq "scope/worktree primary guard allowed"     "0" "$(run_hook "$WT" "git switch feature")"
+# …but a worktree's own dangerous patterns still fire (guardrail is scope-independent).
+expect_eq "scope/worktree push still blocked"       "2" "$(run_hook "$WT" "git push")"
+
+# ===========================================================================
+# AC3 — no dependency on the branch-lock skill: the script must not source or
+# require any of its files. (Naming the skill in a comment is fine — what would
+# create a dependency is sourcing/dot-including its modules or reaching into its
+# directory.)
+# ===========================================================================
+if grep -qE '(source|^\s*\.)[[:space:]].*(lock-store|scope-resolver|git-command-classifier|branch-lock/)' "$HOOK"; then
+  echo "FAIL  AC3/no branch-lock dependency (sources a branch-lock module)"; fail=$((fail + 1))
+else
+  echo "PASS  AC3/no branch-lock dependency"; pass=$((pass + 1))
+fi
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]