@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/review/scripts/fix-round-seats.sh

@@ -0,0 +1,197 @@
+#!/usr/bin/env bash
+# fix-round-seats.sh — the single path→seat map for review fix-commit targeted
+# rounds AND the `none`-tier panel trigger-gating (ADR-267). One map, two
+# consumers, so no second prose predicate table can drift from it.
+#
+# Usage:
+#   fix-round-seats.sh --files <newline-or-comma file list> [--finding-seats <seat,...>]
+#
+# stdout: one seat leaf-name per line, deduped, deterministic order (the
+# never-shed safety floor seats emit first).
+#
+# LEAF→SPAWNABLE-ID MAPPING IS NOT UNIFORM: most review seats resolve to
+# `soleur:engineering:review:<leaf>`, but `git-history-analyzer` lives under
+# `soleur:engineering:research:` and `shellcheck`/`anti-slop`/`gdpr-gate`/
+# `structural-enumeration` are deterministic or SKILL-level seats with no
+# spawnable agent id at all — never mechanically prefix the output.
+#
+# Exit codes:
+#   0  seats emitted (or legitimately none: empty --files, or non-source paths
+#      that map to no seat)
+#   2  usage error
+#
+# --finding-seats carries the seats that reported the findings being fixed
+# (from the dedup ledger — see references/risk-tier-and-fix-rounds.md). Every
+# token is validated against the canonical seat registry below; unknown tokens
+# are dropped with an `unknown-seat:` stderr warning and NEVER echoed raw —
+# the input is model-emitted text, and a forged token carrying whitespace or
+# metacharacters must not smuggle an extra output line.
+#
+# Portability: POSIX/bash only — no timeout, sed -i, readlink -f, stat -c,
+# date -d (operator hosts include stock macOS).
+set -uo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: fix-round-seats.sh --files <newline-or-comma file list> [--finding-seats <seat,...>]
+
+Prints the review seats a fix-commit diff should re-spawn, one per line:
+{path-mapped seats} ∪ {--finding-seats} ∪ {conditional seats}. A source-touching
+fix never resolves empty — unmatched source files emit the code-quality-analyst
+floor. An empty --files list emits nothing plus a `note: empty fix diff` stderr
+line (a zero-change round legitimately spawns zero seats).
+
+Exit 0 on valid input; exit 2 on usage error.
+EOF
+}
+
+# Canonical seat registry (leaf names). Registry order IS the emission order —
+# the never-shed floor seats come first. The parity guard
+# plugins/soleur/test/review-tier-parity.test.ts pins this set against
+# review.workflow.js DIMENSIONS/agentType — extend both, never one.
+SEAT_REGISTRY='security-sentinel code-quality-analyst git-history-analyzer pattern-recognition-specialist architecture-strategist performance-oracle data-integrity-guardian agent-native-reviewer user-impact-reviewer data-migration-expert deployment-verification-agent code-simplicity-reviewer kieran-rails-reviewer dhh-rails-reviewer test-design-reviewer structural-enumeration semgrep-sast shellcheck anti-slop gdpr-gate'
+
+# --finding-seats vocabulary: callers may report seats by workflow DIMENSION
+# key or canonical agent id; both normalize to the leaf name here.
+dim_to_leaf() {
+  case "$1" in
+    security)              echo security-sentinel ;;
+    git-history)           echo git-history-analyzer ;;
+    pattern)               echo pattern-recognition-specialist ;;
+    architecture)          echo architecture-strategist ;;
+    performance)           echo performance-oracle ;;
+    data-integrity)        echo data-integrity-guardian ;;
+    agent-native)          echo agent-native-reviewer ;;
+    code-quality)          echo code-quality-analyst ;;
+    user-impact)           echo user-impact-reviewer ;;
+    data-migration)        echo data-migration-expert ;;
+    deploy-verify)         echo deployment-verification-agent ;;
+    code-simplicity)       echo code-simplicity-reviewer ;;
+    rails-kieran)          echo kieran-rails-reviewer ;;
+    rails-dhh)             echo dhh-rails-reviewer ;;
+    test-design)           echo test-design-reviewer ;;
+    semgrep)               echo semgrep-sast ;;
+    gdpr)                  echo gdpr-gate ;;
+    *)                     echo "$1" ;;
+  esac
+}
+
+# Byte-identical mirror of preflight Check 6 Step 6.1's SENSITIVE_PATH_RE (the
+# canonical literal lives in plugins/soleur/skills/preflight/SKILL.md). The
+# parity test pins this copy against the canonical one — edit together or not
+# at all.
+SENSITIVE_PATH_RE='^(apps/web-platform/(server|supabase|app/api|middleware\.ts$)|apps/web-platform/lib/(stripe|auth|byok|security-headers|csp|log-sanitize|safe-session|safe-return-to|supabase)|apps/web-platform/lib/(legal|auth)/|apps/[^/]+/infra/|.+/doppler[^/]*\.(yml|yaml|sh)$|\.github/workflows/.*(doppler|secret|token|deploy|release|version-bump|web-platform|infra-validation|cla|cf-token|linkedin-token).*\.ya?ml$)'
+
+# Byte-identical mirror of the gdpr-gate canonical path regex (source of truth:
+# plugins/soleur/skills/gdpr-gate/SKILL.md `## Path globs (canonical)`).
+GDPR_PATH_RE='^(apps/web-platform/supabase/migrations/|apps/web-platform/lib/auth/|apps/web-platform/server/.*auth.*\.(ts|tsx|js)|apps/web-platform/app/api/.*\.(ts|tsx)$|.*\.sql$)'
+
+SOURCE_RE='\.(ts|tsx|js|jsx|rb|py|go|rs|swift|kt|java|c|cpp|cs|php|sh|bash|zsh|mjs|cjs)$'
+MIGRATION_RE='(/migrations/|/migrate/|\.sql$)'
+PERSIST_RE='(apps/web-platform/(server|supabase|lib)/)'
+PERF_RE='(apps/web-platform/(server|supabase)/|inngest|cron|queue|worker|bench|perf)'
+AGENT_SURFACE_RE='(apps/web-platform/(app|components)/|plugins/soleur/(agents|skills|commands|docs)/)'
+TEST_RE='(\.test\.|\.spec\.|_test\.|_spec\.|(^|/)test_[^/]*\.py$|__tests__/|(^|/)tests?/|(^|/)spec/|Tests\.swift$|\.e2e\.[jt]sx?$|(^|/)e2e/|\.cy\.)'
+SHELL_RE='\.(sh|bash|zsh)$'
+ANTISLOP_RE='(apps/web-platform/(app|components)/.*\.(tsx|jsx|css)$|apps/web-platform/server/.*\.(ts|tsx)$|plugins/soleur/docs/.*\.(njk|css)$)'
+
+FILES_SEEN=""
+FILES_GIVEN=0
+FINDING_SEATS=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --files)
+      [[ $# -ge 2 ]] || { echo "fix-round-seats: --files needs a value" >&2; exit 2; }
+      FILES_SEEN="$2"; FILES_GIVEN=1; shift 2 ;;
+    --finding-seats)
+      [[ $# -ge 2 ]] || { echo "fix-round-seats: --finding-seats needs a value" >&2; exit 2; }
+      FINDING_SEATS="$2"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "fix-round-seats: unknown argument '$1'" >&2; exit 2 ;;
+  esac
+done
+[[ "$FILES_GIVEN" -eq 1 ]] || { usage >&2; exit 2; }
+
+if [[ -z "$FILES_SEEN" ]]; then
+  echo "note: empty fix diff" >&2
+fi
+
+# Emit at most once per seat: newline-ANCHORED membership, never substring —
+# a future seat name that is a substring of another must not dedup-fail.
+SEATS=$'\n'
+add() { case "$SEATS" in *$'\n'"$1"$'\n'*) ;; *) SEATS="${SEATS}${1}"$'\n' ;; esac; }
+has() { case "$SEATS" in *$'\n'"$1"$'\n'*) return 0 ;; *) return 1 ;; esac; }
+
+floor_needed=0
+UNMAPPED=""
+# Split on newlines AND commas. The while loop is heredoc-fed (not piped) so it
+# does NOT run in a subshell — SEATS/floor_needed/UNMAPPED survive it.
+while IFS= read -r f; do
+  f="${f%$'\r'}"
+  f="${f#"${f%%[![:space:]]*}"}"  # leading whitespace
+  f="${f%"${f##*[![:space:]]}"}"  # trailing whitespace
+  f="${f#\"}"; f="${f%\"}"        # quote-path wrapping (spaces/non-ASCII in git --name-only)
+  [[ -n "$f" ]] || continue
+  area=0
+  if grep -qE "$MIGRATION_RE" <<<"$f"; then
+    add data-integrity-guardian; add data-migration-expert; add deployment-verification-agent
+    area=1
+  fi
+  if grep -qE "$PERSIST_RE" <<<"$f"; then add data-integrity-guardian; area=1; fi
+  if grep -qE "$SENSITIVE_PATH_RE" <<<"$f"; then add security-sentinel; area=1; fi
+  if grep -qE "$GDPR_PATH_RE" <<<"$f"; then add gdpr-gate; area=1; fi
+  if grep -qE "$ANTISLOP_RE" <<<"$f"; then add anti-slop; area=1; fi
+  if grep -qE "$AGENT_SURFACE_RE" <<<"$f"; then add agent-native-reviewer; area=1; fi
+  if grep -qE "$PERF_RE" <<<"$f"; then add performance-oracle; area=1; fi
+  if grep -qE "$TEST_RE" <<<"$f"; then add test-design-reviewer; area=1; fi
+  if grep -qE "$SHELL_RE" <<<"$f"; then
+    add shellcheck
+  elif grep -qE "$SOURCE_RE" <<<"$f"; then
+    add semgrep-sast
+  fi
+  if grep -qE "$SOURCE_RE" <<<"$f"; then
+    # The floor guards "a source fix with no judgment seat". Deterministic
+    # seats (semgrep/shellcheck) do NOT satisfy it — they are scanners, not
+    # reviewers; only an area arm (a judgment seat) exempts the floor.
+    [[ "$area" -eq 1 ]] || { floor_needed=1; UNMAPPED="${UNMAPPED}${UNMAPPED:+,}${f}"; }
+  fi
+done <<EOF_FILES
+$(printf '%s\n' "$FILES_SEEN" | tr ',' '\n')
+EOF_FILES
+
+if [[ "$floor_needed" -eq 1 ]]; then
+  add code-quality-analyst
+  printf 'unmapped-paths: %s\n' "$UNMAPPED" >&2
+fi
+
+# --finding-seats: normalized (canonical `soleur:…:leaf` ids and workflow
+# dimension keys both reduce to leaf names), then validated against the
+# registry; unknown tokens are dropped with a sanitized stderr warning and
+# never echoed raw to stdout. `set -f` kills pathname expansion, so a forged
+# `*`/`?`/glob token cannot expand into cwd filenames mid-validation.
+_ctx_lib="$(cd "${BASH_SOURCE[0]%/*}/../../../scripts/lib" 2>/dev/null && pwd -P)/context-sanitize.sh"
+_ctx_lib="${_ctx_lib:-/nonexistent/context-sanitize.sh}"
+# shellcheck source=/dev/null
+[[ -r "$_ctx_lib" ]] && . "$_ctx_lib" || true
+# Ambient-locale [:cntrl:] on purpose — mirrors technical-ruling-gate.sh: a C-pinned
+# fallback could strip less than the pre-change site under UTF-8 locales (C1 range).
+declare -F soleur_ctx_sanitize >/dev/null 2>&1 \
+  || soleur_ctx_sanitize() { tr -d '[:cntrl:]'; }
+if [[ -n "$FINDING_SEATS" ]]; then
+  set -f
+  for tok in $(printf '%s' "$FINDING_SEATS" | tr ',' ' '); do
+    tok="$(dim_to_leaf "${tok##*:}")"
+    for s in $SEAT_REGISTRY; do
+      if [[ "$tok" == "$s" ]]; then add "$tok"; continue 2; fi
+    done
+    printf 'unknown-seat: %s\n' "$(printf '%s' "$tok" | soleur_ctx_sanitize)" >&2
+  done
+  set +f
+fi
+
+# Emit in registry order (floor seats first), deduped.
+for s in $SEAT_REGISTRY; do
+  if has "$s"; then printf '%s\n' "$s"; fi
+done
+exit 0
+

package/skills/review/test/emit-review-trailer.test.sh

@@ -0,0 +1,387 @@
+#!/usr/bin/env bash
+#
+# Tests for emit-review-trailer.sh's coverage field (#7066 follow-up).
+#
+# WHY THIS SUITE EXISTS. The script's whole value is that a downstream consumer can tell a
+# full review from a degraded one. Every way that can silently stop being true looks like
+# success: a value that does not parse as a trailer is invisible to `git log
+# --format='%(trailers:...)'` while reading fine to a human; an absent measurement defaulting
+# to the strongest value makes the field decorative; and a caller-supplied `--mode full`
+# alongside 2-of-10 counts overclaims in the one direction that matters.
+#
+# EVERY ARM RUNS AGAINST A THROWAWAY REPO, never the real one — the script COMMITS, so a
+# suite that ran in-tree would leave empty commits on whatever branch invoked it.
+set -uo pipefail
+export TMPDIR="${TMPDIR:-/var/tmp}"
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# ../scripts/ — this suite deliberately lives in skills/review/test/ and not beside the SUT
+# in skills/review/scripts/, because scripts/test-all.sh discovers
+# `plugins/soleur/skills/*/test/*.test.sh` and NOT `skills/*/scripts/*.test.sh`. Placed next
+# to the SUT it would be silent AND green: never run, never red (#3366).
+SUT="$(cd "${DIR}/../scripts" && pwd)/emit-review-trailer.sh"
+
+# assert_fixture_dir — the operand guard for the fixture repos below
+# (fixture-dir-operand-assert.test.sh scans this file).
+# shellcheck source=../../../test/test-helpers.sh
+source "${DIR}/../../../test/test-helpers.sh" || { echo "FATAL: test-helpers.sh" >&2; exit 2; }
+set +e  # the helper sets -e; restore this suite's verdict-counting contract
+
+TMP="$(mktemp -d -t emitrt.XXXXXXXX)" || { echo "mktemp failed" >&2; exit 2; }
+trap 'rm -rf "$TMP"' EXIT
+
+passes=0
+fails=0
+# The INDEPENDENT case counter (ADR-193 #2). It moves in assert() — the ASSERTION helper —
+# and NEVER in pass()/fail(), the VERDICT helpers. That split is the whole point: a counter
+# incremented inside the verdict helpers moves WITH the verdict, so stubbing fail() drops the
+# row and its count together and the conservation identity below holds under the exact fault
+# it exists to catch. Never increment this inside `$( )`; a subshell discards it.
+CASES=0
+
+# VERDICT helpers — they own passes/fails and nothing else.
+pass() { passes=$((passes + 1)); printf '  ok   %s\n' "$1"; }
+fail() {
+  fails=$((fails + 1))
+  printf '  FAIL %s\n' "$1"
+  [[ -n "${2:-}" ]] && printf '       %s\n' "$2"
+  return 0
+}
+
+# ASSERTION helper — owns CASES. $1 = description, $2 = condition (eval'd), $3 = failure detail.
+assert() {
+  CASES=$((CASES + 1))
+  if eval "$2"; then
+    pass "$1"
+  else
+    fail "$1" "${3:-$2}"
+  fi
+}
+
+printf '\n=== emit-review-trailer coverage field ===\n\n'
+
+# Reported DIRECTLY, not through fail(): with the SUT absent there is nothing to assert, so a
+# verdict-helper report here would be a row in a suite that never ran.
+[[ -f "$SUT" ]] || {
+  printf '\n[FATAL] SUT missing at %s — nothing to test.\n' "$SUT" >&2
+  exit 1
+}
+
+# A fresh repo on a feature branch with a `main` to scope against. The script refuses to run
+# on main/master, and its idempotence check scopes to `origin/main..HEAD`-equivalent, so both
+# refs have to exist for the arms below to exercise the real paths.
+new_repo() {
+  local d="$TMP/$1"; mkdir -p "$d"
+  git -C "$d" init -q -b main
+  # LOCAL config, not `-c` on our own commits. The SUT runs its OWN `git commit`, so an
+  # identity supplied only via `-c` on the fixture's setup commits does not reach it — it
+  # inherits whatever the ambient environment has. On a developer laptop that is the global
+  # config and every arm passes; on a bare CI runner there is none and the SUT dies with
+  # "Please tell me who you are", which surfaces as `git commit failed` and 8 of 12 arms red.
+  # Measured: this suite was 12/12 locally and 4/8 in CI on its first run (#7070).
+  git -C "$d" config user.email soleur-test@example.invalid
+  git -C "$d" config user.name  "Soleur Test"
+  # Some runners set commit.gpgsign globally; a throwaway repo has no key.
+  git -C "$d" config commit.gpgsign false
+  git -C "$d" commit -q --allow-empty -m "base"
+  git -C "$d" checkout -q -b feat-x
+  printf '%s' "$d"
+}
+
+coverage_of() {  # $1 = repo dir -> the parsed Reviewed-Coverage trailer value
+  git -C "$1" log -1 --format='%(trailers:key=Reviewed-Coverage,valueonly)' | tr -d '\n'
+}
+
+# ── ARM 1: full coverage ──────────────────────────────────────────────────────────
+d="$(new_repo full)"
+out="$(cd "$d" && bash "$SUT" --findings 0 --agents-ran 9 --agents-expected 9 2>&1)"; rc=$?
+assert "full coverage exits 0" '[[ "$rc" -eq 0 ]]' "rc=$rc out=$out"
+cov="$(coverage_of "$d")"
+assert "records 'full 9/9 agents'" '[[ "$cov" == *"full 9/9 agents"* ]]' "got: '$cov'"
+
+# ── ARM 2: degraded coverage, with the missing agents NAMED ───────────────────────
+#
+# This is the shape measured on PR #7066 (7 of 9 died on 529s). The named list is the part a
+# reader needs: "2/9" says how much ran, not WHICH lens is absent, and the agents that die
+# are not the ones you needed least.
+d="$(new_repo degraded)"
+out="$(cd "$d" && bash "$SUT" --findings 3 --agents-ran 2 --agents-expected 9 \
+        --agents-missing security-sentinel,test-design-reviewer 2>&1)"; rc=$?
+cov="$(coverage_of "$d")"
+assert "records 'degraded 2/9 agents'" \
+  '[[ "$rc" -eq 0 && "$cov" == *"degraded 2/9 agents"* ]]' "rc=$rc got: '$cov'"
+assert "names the missing agents in the trailer value" \
+  '[[ "$cov" == *"security-sentinel"* && "$cov" == *"test-design-reviewer"* ]]' "got: '$cov'"
+
+# ── ARM 3: zero agents => inline-fallback ─────────────────────────────────────────
+d="$(new_repo zero)"
+(cd "$d" && bash "$SUT" --findings 1 --agents-ran 0 --agents-expected 8 >/dev/null 2>&1)
+cov="$(coverage_of "$d")"
+assert "zero agents records 'inline-fallback'" \
+  '[[ "$cov" == *"inline-fallback 0/8 agents"* ]]' "got: '$cov'"
+
+# ── ARM 4: THE COUNTS OVERRIDE A CALLER'S LABEL ───────────────────────────────────
+#
+# A caller passing `--mode full` with 2-of-10 counts is either confused or overclaiming.
+# Deriving the mode from the counts is what makes the field non-forgeable by accident.
+d="$(new_repo overclaim)"
+(cd "$d" && bash "$SUT" --agents-ran 2 --agents-expected 10 --mode full >/dev/null 2>&1)
+cov="$(coverage_of "$d")"
+assert "counts override an overclaiming --mode full" \
+  '[[ "$cov" == *degraded* && "$cov" != *full* ]]' "got: '$cov'"
+
+# ── ARM 5: ABSENT measurement is 'unknown', NOT 'full' ────────────────────────────
+#
+# The load-bearing default. Every legacy call site omits the flags, so defaulting an absent
+# measurement to the strongest value would make the field decorative on exactly the calls
+# that predate it — and would read as a full review having run.
+d="$(new_repo legacy)"
+(cd "$d" && bash "$SUT" --findings 0 >/dev/null 2>&1)
+cov="$(coverage_of "$d")"
+assert "absent measurement records 'unknown', not 'full'" '[[ "$cov" == "unknown" ]]' "got: '$cov'"
+
+# ── ARM 6: the coverage trailer PARSES (it is last, so it splits first) ───────────
+#
+# git needs the whole final paragraph to be `Key: value` lines. Reviewed-Coverage sits LAST,
+# so it is the first casualty of a split — and a value that does not parse is invisible to
+# every consumer while looking like evidence in `git log`.
+d="$(new_repo parse)"
+(cd "$d" && bash "$SUT" --agents-ran 4 --agents-expected 4 >/dev/null 2>&1)
+cov="$(coverage_of "$d")"
+# shellcheck disable=SC2034  # consumed via `eval "$condition"` in assert()
+by="$(git -C "$d" log -1 --format='%(trailers:key=Reviewed-By-Soleur,valueonly)' | tr -d '[:space:]')"
+assert "both Reviewed-By-Soleur and Reviewed-Coverage parse as trailers" \
+  '[[ -n "$cov" && -n "$by" ]]' "$(git -C "$d" log -1 --format=%B)"
+
+# ── ARM 7: malformed input is REFUSED before any commit ───────────────────────────
+#
+# A bad count must not land in main's permanent history as an unparseable coverage claim.
+# Asserting "no commit was created" is the load-bearing half: exiting 2 while having already
+# committed would be strictly worse than accepting the value.
+for bad in "--agents-ran abc --agents-expected 5" \
+           "--agents-ran 5 --agents-expected 2" \
+           "--mode enthusiastic"; do
+  d="$(new_repo "bad$(echo "$bad" | tr -cd 'a-z0-9')")"
+  : "${d:?fixture dir is empty; git -C <empty> would retarget this write}"
+  before="$(git -C "$d" rev-parse HEAD)"
+  # shellcheck disable=SC2086
+  out="$(cd "$d" && bash "$SUT" $bad 2>&1)"; rc=$?
+  after="$(git -C "$d" rev-parse HEAD)"
+  # CASES moves here, once per loop iteration, because assert() is called once per iteration —
+  # the counter has to track the arms that actually run, not the arms written in the source.
+  assert "refuses '$bad' with no commit" '[[ "$rc" -eq 2 && "$before" == "$after" ]]' \
+    "rc=$rc committed=$([[ "$before" != "$after" ]] && echo yes || echo no) out=$out"
+done
+
+# ── ARM 9: sequential-fallback SURVIVES the count derivation ────────────────────
+#
+# sequential-fallback is not a count axis — it attests the plugin subagent
+# surface was absent (Devin Cloud) and the roles ran sequentially inline. A
+# cloud review that ran all N roles sequentially passes N/N; letting the
+# derivation "upgrade" that to `full` would emit a trailer claiming
+# independent-agent coverage that never ran, and the /ship gate (which keys on
+# the sequential-fallback PREFIX) would never fire. The explicit mode must win.
+d="$(new_repo seqfallback)"
+out="$(cd "$d" && bash "$SUT" --agents-ran 9 --agents-expected 9 \
+        --mode sequential-fallback 2>&1)"; rc=$?
+cov="$(coverage_of "$d")"
+assert "explicit sequential-fallback + N/N counts is NOT upgraded to full" \
+  '[[ "$rc" -eq 0 && "$cov" == sequential-fallback* && "$cov" == *"9/9 agents"* ]]' \
+  "rc=$rc got: '$cov'"
+assert "ship-gate prefix still matches (starts-with sequential-fallback)" \
+  '[[ "$cov" == sequential-fallback* ]]' "got: '$cov'"
+
+d="$(new_repo seqfallback_partial)"
+out="$(cd "$d" && bash "$SUT" --agents-ran 5 --agents-expected 9 \
+        --mode sequential-fallback 2>&1)"; rc=$?
+cov="$(coverage_of "$d")"
+assert "explicit sequential-fallback + partial counts is NOT rewritten to degraded" \
+  '[[ "$rc" -eq 0 && "$cov" == sequential-fallback* && "$cov" == *"5/9 agents"* ]]' \
+  "rc=$rc got: '$cov'"
+
+# ── ARM 8: still refuses to run on main ──────────────────────────────────────────
+# Guards against the coverage plumbing having disturbed the pre-existing branch guard.
+d="$(new_repo onmain)"
+: "${d:?fixture dir is empty; git -C <empty> would retarget this write}"
+git -C "$d" checkout -q main
+out="$(cd "$d" && bash "$SUT" --agents-ran 1 --agents-expected 1 2>&1)"; rc=$?
+assert "still skips on main (pre-existing guard intact)" \
+  '[[ "$rc" -eq 0 && "$out" == *"nothing to mark, skipping"* ]]' "rc=$rc out=$out"
+
+# ── Guard 2 (ADR-267): --risk-tier emits Reviewed-Risk-Tier from the resolved enum only ──
+tier_of() {  # $1 = repo dir -> the parsed Reviewed-Risk-Tier trailer value
+  git -C "$1" log -1 --format='%(trailers:key=Reviewed-Risk-Tier,valueonly)' | tr -d '\n'
+}
+
+# Every resolved-tier value produces a trailer that PARSES — a value that does not parse is
+# invisible to `git log --format=%(trailers:...)` while looking like evidence to a human.
+for tier in "none" "single-user incident" "aggregate pattern"; do
+  d="$(new_repo "tier$(printf '%s' "$tier" | tr -cd 'a-z0-9')")"
+  : "${d:?fixture dir is empty; git -C <empty> would retarget this write}"
+  out="$(cd "$d" && bash "$SUT" --risk-tier "$tier" 2>&1)"; rc=$?
+  t="$(tier_of "$d")"
+  assert "--risk-tier '$tier' emits a parseable trailer" \
+    '[[ "$rc" -eq 0 && "$t" == "$tier" ]]' "rc=$rc parsed='$t' out=$out"
+done
+
+# `undeclared` is a classifier parse state, never a resolved tier — rejected like any other
+# invalid value, BEFORE any commit exists to carry it.
+for bad in "bogus" "undeclared" "Full"; do
+  d="$(new_repo "badtier$(printf '%s' "$bad" | tr -cd 'a-z0-9')")"
+  : "${d:?fixture dir is empty; git -C <empty> would retarget this write}"
+  before="$(git -C "$d" rev-parse HEAD)"
+  out="$(cd "$d" && bash "$SUT" --risk-tier "$bad" 2>&1)"; rc=$?
+  after="$(git -C "$d" rev-parse HEAD)"
+  assert "--risk-tier '$bad' refused, no commit" \
+    '[[ "$rc" -eq 2 && "$before" == "$after" ]]' \
+    "rc=$rc committed=$([[ "$before" != "$after" ]] && echo yes || echo no) out=$out"
+done
+
+# Absent flag → absent field. A fabricated `unknown` literal would be a claim the caller
+# never measured (same honesty rule as Reviewed-Coverage's 'unknown').
+d="$(new_repo notier)"
+(cd "$d" && bash "$SUT" --findings 0 >/dev/null 2>&1)
+t="$(tier_of "$d")"
+assert "no --risk-tier → field absent, not 'unknown'" '[[ -z "$t" ]]' "parsed='$t'"
+
+# Coverage must remain the LAST trailer line — it is the first casualty of a
+# split trailers paragraph, and RISK_TIER_LINE now interpolates above it.
+d="$(new_repo lastline)"
+(cd "$d" && bash "$SUT" --risk-tier none --agents-ran 3 --agents-expected 3 >/dev/null 2>&1)
+last="$(git -C "$d" log -1 --format=%B | git interpret-trailers --parse | tail -1)"
+assert "Reviewed-Coverage stays the last trailer line" \
+  '[[ "$last" == "Reviewed-Coverage:"* ]]' "last='$last'"
+
+# ── Guard 3 (ADR-267): --fix-round emits fix-scoped keys, never Reviewed-Coverage ──
+#
+# The whole point of the separate keys: a targeted round covering `full` over the
+# fix range would misread as branch-level coverage on ship's gate, and the main
+# trailer's idempotence skip would swallow the emission anyway.
+
+# --fix-round requires --since; --since requires --fix-round — an orphaned flag is a
+# scope error, not a default to the whole branch.
+for bad in "--fix-round" "--since HEAD"; do
+  d="$(new_repo "frbad$(printf '%s' "$bad" | tr -cd 'a-z0-9')")"
+  : "${d:?fixture dir is empty; git -C <empty> would retarget this write}"
+  before="$(git -C "$d" rev-parse HEAD)"
+  out="$(cd "$d" && bash "$SUT" $bad 2>&1)"; rc=$?
+  after="$(git -C "$d" rev-parse HEAD)"
+  assert "refuses '$bad' with no commit" \
+    '[[ "$rc" -eq 2 && "$before" == "$after" ]]' \
+    "rc=$rc committed=$([[ "$before" != "$after" ]] && echo yes || echo no) out=$out"
+done
+
+# --since must resolve to a commit — an unresolvable sha cannot land in a range trailer.
+d="$(new_repo frbadsha)"
+before="$(git -C "$d" rev-parse HEAD)"
+out="$(cd "$d" && bash "$SUT" --fix-round --since 'not-a-sha' 2>&1)"; rc=$?
+after="$(git -C "$d" rev-parse HEAD)"
+assert "--fix-round --since <unresolvable> refused, no commit" \
+  '[[ "$rc" -eq 2 && "$before" == "$after" ]]' "rc=$rc out=$out"
+
+# A resolvable-but-not-ancestor --since (stale post-rebase sha) must refuse —
+# otherwise the recorded range spans unrelated history.
+d="$(new_repo frnonancestor)"
+assert_fixture_dir "$d"
+git -C "$d" checkout -qb sideline main
+git -C "$d" commit -q --allow-empty -m "work not on this branch"
+stale="$(git -C "$d" rev-parse HEAD)"
+git -C "$d" checkout -q feat-x
+before="$(git -C "$d" rev-parse HEAD)"
+out="$(cd "$d" && bash "$SUT" --fix-round --since "$stale" 2>&1)"; rc=$?
+after="$(git -C "$d" rev-parse HEAD)"
+assert "--fix-round --since <non-ancestor> refused, no commit" \
+  '[[ "$rc" -eq 2 && "$out" == *"not an ancestor"* && "$before" == "$after" ]]' "rc=$rc out=$out"
+
+# The load-bearing arm: branch already carries the MAIN trailer (the normal
+# post-panel state) — a fix round must still emit, with the fix keys, WITHOUT a
+# second Reviewed-Coverage claim.
+d="$(new_repo frhappy)"
+base="$(git -C "$d" rev-parse HEAD)"
+(cd "$d" && bash "$SUT" --agents-ran 7 --agents-expected 7 >/dev/null 2>&1)   # main-panel trailer
+out="$(cd "$d" && bash "$SUT" --fix-round --since "$base" --agents-ran 3 --agents-expected 3 \
+        --risk-tier none 2>&1)"; rc=$?
+fr="$(git -C "$d" log -1 --format='%(trailers:key=Reviewed-Fix-Round,valueonly)' | tr -d '\n')"
+rng="$(git -C "$d" log -1 --format='%(trailers:key=Reviewed-Fix-Range,valueonly)' | tr -d '\n')"
+cov2="$(coverage_of "$d")"
+by2="$(git -C "$d" log -1 --format='%(trailers:key=Reviewed-By-Soleur,valueonly)' | tr -d '\n')"
+t2="$(tier_of "$d")"
+assert "fix round emits after main trailer (not swallowed by idempotence)" \
+  '[[ "$rc" -eq 0 && "$fr" == *"3/3"* ]]' "rc=$rc fr='$fr' out=$out"
+assert "fix round records the range and carries NO Reviewed-Coverage" \
+  '[[ "$rng" == "$base"..* && -z "$cov2" ]]' "rng='$rng' cov='$cov2'"
+assert "fix round does not re-emit Reviewed-By-Soleur" \
+  '[[ -z "$by2" ]]' "by='$by2'"
+assert "fix round still records the risk tier" \
+  '[[ "$t2" == "none" ]]' "t='$t2'"
+
+# Same range twice → idempotent skip (the range is the dedup key, not the branch).
+out="$(cd "$d" && bash "$SUT" --fix-round --since "$base" --agents-ran 3 --agents-expected 3 2>&1)"; rc=$?
+n_commits="$(git -C "$d" rev-list --count main..feat-x)"
+assert "repeat fix round over the same range skips" \
+  '[[ "$rc" -eq 0 && "$out" == *"already exists"* && "$n_commits" -eq 2 ]]' \
+  "rc=$rc commits=$n_commits out=$out"
+
+# A SECOND round after more fix commits is a different range — the left edge
+# alone must not suppress it (idempotence keys on the full since..head).
+assert_fixture_dir "$d"
+git -C "$d" commit -q --allow-empty -m "fix: second round commit"
+out="$(cd "$d" && bash "$SUT" --fix-round --since "$base" --agents-ran 1 --agents-expected 1 2>&1)"; rc=$?
+fr2="$(git -C "$d" log -1 --format='%(trailers:key=Reviewed-Fix-Range,valueonly)' | tr -d '\n')"
+assert "second round over an extended range still emits" \
+  '[[ "$rc" -eq 0 && "$fr2" == "$base"..* ]]' "rc=$rc range='$fr2' out=$out"
+
+# A `review:`-subjected FIX commit is a real fix (SKILL.md's own convention),
+# not an attestation — it must extend the effective range, not be excluded.
+assert_fixture_dir "$d"
+git -C "$d" commit -q --allow-empty -m "review: fix finding (P2)"
+out="$(cd "$d" && bash "$SUT" --fix-round --since "$base" --agents-ran 2 --agents-expected 2 2>&1)"; rc=$?
+fr3="$(git -C "$d" log -1 --format='%(trailers:key=Reviewed-Fix-Range,valueonly)' | tr -d '\n')"
+fixsha="$(git -C "$d" rev-parse 'HEAD^')"
+assert "a review:-subjected fix commit extends the range (not excluded)" \
+  '[[ "$rc" -eq 0 && "$fr3" == "$base".."$fixsha" ]]' "rc=$rc range='$fr3' want-end=$fixsha out=$out"
+
+# ── Accounting conservation (ADR-193 #3) ─────────────────────────────────────────
+# Ordered BEFORE the floor per ADR-193 #4: a neutered fail() deflates the verdict counts, so
+# a floor reading them would ALSO trip and would report the misleading "arms were deleted".
+# This says "a verdict was discarded" instead. Reported with printf >&2 + exit 1 DIRECTLY,
+# never through pass()/fail(): a check that reports by calling a verdict helper increments the
+# very counter the exit status reads, so neutering the helper silences the rows AND the check
+# meant to notice the silence. The literal `[FATAL] accounting` is load-bearing —
+# guard-vacuity-floor's ARM 10 builds its conservation population by grepping that string.
+if [[ $((passes + fails)) -ne "$CASES" ]]; then
+  printf '\n[FATAL] accounting: passes+fails (%d) != CASES (%d).\n' \
+    "$((passes + fails))" "$CASES" >&2
+  if [[ $((passes + fails)) -lt "$CASES" ]]; then
+    printf '  An assertion was counted but its verdict was discarded — that is what a neutered pass()/fail() looks like.\n' >&2
+  else
+    printf '  A verdict was recorded at a call site with no `CASES=$((CASES + 1))` before it. This is a harness bug, not a product failure: add the increment at that call site.\n' >&2
+  fi
+  printf '\n=== emit-review-trailer coverage: %d passed, %d failed (%d assertions) ===\n\n' \
+    "$passes" "$fails" "$CASES"
+  exit 1
+fi
+
+# ── Anti-vacuity floor (ADR-193 #1) ──────────────────────────────────────────────
+# Reads the INDEPENDENT case counter, and reports with printf >&2 + exit 1 DIRECTLY. It
+# previously read `passes + fails` and reported via `fails=$((fails + 1))` — a tautology on
+# both counts: the operand moved WITH the verdict, and the report went into a counter that a
+# neutered fail() had already stopped feeding. Stub the assertion machinery and the suite
+# printed a clean total and exited 0.
+#
+# A floor, not equality: developer-incremented, so `-eq` would redden the suite on every added
+# arm. Ratchet when adding arms; read a floor failure on an otherwise-green run as "you added
+# assertions, update this number".
+TRAILER_MIN_ASSERTIONS=34
+if (( CASES < TRAILER_MIN_ASSERTIONS )); then
+  printf '\n[FATAL] anti-vacuity floor: only %d assertion(s) ran, expected >= %d.\n' \
+    "$CASES" "$TRAILER_MIN_ASSERTIONS" >&2
+  printf '  Arms were deleted or skipped; a green run here would be a coverage loss.\n' >&2
+  printf '\n=== emit-review-trailer coverage: %d passed, %d failed (%d assertions) ===\n\n' \
+    "$passes" "$fails" "$CASES"
+  exit 1
+fi
+
+printf '\n=== emit-review-trailer coverage: %d passed, %d failed (%d assertions) ===\n\n' \
+  "$passes" "$fails" "$CASES"
+[[ "$fails" -eq 0 ]]