@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/review/test/ensure-semgrep.test.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# Hermetic suite for ensure-semgrep.sh (#9964): a resolvable-but-dead semgrep
+# must NOT read as present. Every arm runs the SUT under `env -i` with a
+# curated PATH — no real brew/pipx/python3/timeout can leak in, and HOME is a
+# sandbox dir so the SUT's `$HOME/.local/bin` prepend cannot see the host.
+
+set -u
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SUT="$SCRIPT_DIR/../scripts/ensure-semgrep.sh"
+PASS=0; FAIL=0; TOTAL=0
+
+ok()   { PASS=$((PASS+1)); TOTAL=$((TOTAL+1)); echo "  PASS: $1"; }
+no()   { FAIL=$((FAIL+1)); TOTAL=$((TOTAL+1)); echo "  FAIL: $1"; }
+assert() { local desc="$1" cond="$2"; if eval "$cond"; then ok "$desc"; else no "$desc"; fi; }
+
+D="" D2="" D3="" D4="" D5="" D6="" D7="" D8="" D9=""
+cleanup() { [ -n "$D" ] && rm -rf "$D" "$D2" "$D3" "$D4" "$D5" "$D6" "$D7" "$D8" "$D9"; }
+trap cleanup EXIT
+
+# Each arm's dir carries: stubs (semgrep/installers), home/ (empty HOME), and
+# tools/ (symlinks to the real coreutils the stubs need — nothing else).
+mkarm() {
+  local dir
+  dir="$(mktemp -d)"
+  mkdir -p "$dir/home" "$dir/tools"
+  for t in chmod cat env ls cp mkdir; do
+    command -v "$t" >/dev/null 2>&1 && ln -sf "$(command -v "$t")" "$dir/tools/$t"
+  done
+  printf '%s\n' "$dir"
+}
+# run_sut <dir> [extra PATH dirs] — curated env: PATH=dir[:extra], HOME=dir/home.
+run_sut() { local dir="$1"; shift; env -i PATH="$dir:$dir/tools${1:+:$1}" HOME="$dir/home" /bin/bash "$SUT"; }
+
+dead_semgrep() { printf '#!/bin/sh\necho "ModuleNotFoundError: No module named semgrep" >&2\nexit 1\n' >"$1/semgrep"; chmod +x "$1/semgrep"; }
+live_semgrep() { printf '#!/bin/sh\nif [ "$1" = "--version" ]; then echo "1.99.0"; exit 0; fi\nexit 0\n' >"$1/semgrep"; chmod +x "$1/semgrep"; }
+probe_semgrep() { printf '#!/bin/sh\necho "$1" >>"%s/probe-log"\nif [ "$1" = "--version" ]; then echo "1.99.0"; exit 0; fi\nexit 0\n' "$1" >"$1/semgrep"; chmod +x "$1/semgrep"; }
+# installer stubs assert argv fidelity AND record invocation AND "install" a
+# probe-logging semgrep by copying the arm's pre-written `installed` stub to
+# the target (the SUT re-probes after install — every rc-0 path must show
+# --version ran).
+write_installed() { printf '#!/bin/sh\necho "$1" >>"%s/probe-log"\nif [ "$1" = "--version" ]; then echo "1.99.0"; exit 0; fi\nexit 0\n' "$1" >"$1/installed"; chmod +x "$1/installed"; }
+install_brew() {
+  write_installed "$1"
+  printf '#!/bin/sh\necho "brew:$1:$2" >>"%s/called"\nif [ "$1" = "install" ] && [ "$2" = "semgrep" ]; then cp "%s/installed" "%s/semgrep"; chmod +x "%s/semgrep"; exit 0; fi\nexit 1\n' "$1" "$1" "$1" "$1" >"$1/brew"; chmod +x "$1/brew"
+}
+fail_stub() { printf '#!/bin/sh\necho "%s" >>"%s/called"\nexit 1\n' "$2" "$1" >"$1/$2"; chmod +x "$1/$2"; }
+
+# --- arm A: live semgrep on PATH → rc 0, no installer invoked --------------
+D="$(mkarm)"; live_semgrep "$D"; fail_stub "$D" brew; fail_stub "$D" pipx
+OUT="$(run_sut "$D" 2>/dev/null)"; RC=$?
+assert "live semgrep: exit 0 and its path printed" "[ $RC -eq 0 ] && [[ \"$OUT\" == */semgrep ]]"
+assert "live semgrep: NO installer invoked" "[ ! -f '$D/called' ]"
+
+# --- arm B: dead shim + working brew → installs, re-probes, rc 0 -----------
+D2="$(mkarm)"; dead_semgrep "$D2"; install_brew "$D2"
+run_sut "$D2" >/dev/null 2>&1; RC=$?
+assert "dead shim + brew: exit 0 after install" "[ $RC -eq 0 ] && grep -q 'brew:install:semgrep' '$D2/called'"
+assert "dead shim + brew: the post-install re-probe ran --version" "grep -q -- '--version' '$D2/probe-log'"
+
+# --- arm C: dead shim + NO installer → rc 2, NOT reported present ----------
+D3="$(mkarm)"; dead_semgrep "$D3"
+ERR="$(run_sut "$D3" 2>&1 >/dev/null)"; RC=$?
+assert "dead shim + no installer: exit 2 (shim reads as absent)" "[ $RC -eq 2 ]"
+assert "dead shim + no installer: diagnostic names the dead shim" "[[ \"$ERR\" == *'resolves at'* ]]"
+assert "dead shim + no installer: points at shim removal, not a missing installer" "[[ \"$ERR\" == *[Ss]'him'* ]]"
+
+# --- arm D: installer produces a still-dead binary → falls through, rc 1 ---
+D4="$(mkarm)"; dead_semgrep "$D4"
+printf '#!/bin/sh\necho "brew" >>"%s/called"\nexit 0\n' "$D4" >"$D4/brew"; chmod +x "$D4/brew"   # brew "succeeds" but shim stays dead (shadowed)
+fail_stub "$D4" pipx; fail_stub "$D4" python3
+ERR="$(run_sut "$D4" 2>&1 >/dev/null)"; RC=$?
+assert "install-success-but-still-dead: exit 1 (attempted, still dead)" "[ $RC -eq 1 ]"
+assert "install-success-but-still-dead: diagnostic names the dead path" "[[ \"$ERR\" == *'still does not run'* ]]"
+
+# --- arm E: absent semgrep + working brew → rc 0 (regression) --------------
+D5="$(mkarm)"; install_brew "$D5"
+run_sut "$D5" >/dev/null 2>&1; RC=$?
+assert "absent + brew: exit 0 with installer invoked AND re-probed" "[ $RC -eq 0 ] && grep -q 'brew:install:semgrep' '$D5/called' && grep -q -- '--version' '$D5/probe-log'"
+
+# --- arm F: dead shim + brew fails + pipx succeeds → rc 0 ------------------
+D6="$(mkarm)"; dead_semgrep "$D6"; fail_stub "$D6" brew; fail_stub "$D6" python3
+write_installed "$D6"
+printf '#!/bin/sh\necho "pipx:$1:$2" >>"%s/called"\nif [ "$1" = "install" ] && [ "$2" = "semgrep" ]; then cp "%s/installed" "%s/home/.local/bin/semgrep"; chmod +x "%s/home/.local/bin/semgrep"; exit 0; fi\nexit 1\n' "$D6" "$D6" "$D6" "$D6" >"$D6/pipx"; chmod +x "$D6/pipx"
+mkdir -p "$D6/home/.local/bin"
+run_sut "$D6" >/dev/null 2>&1; RC=$?
+assert "dead shim + brew fails + pipx installs to HOME/.local/bin: exit 0" "[ $RC -eq 0 ] && grep -q 'pipx:install:semgrep' '$D6/called'"
+assert "arm F: the HOME/.local/bin prepend is what made the install visible" "grep -q -- '--version' '$D6/probe-log'"
+
+# --- arm G: the probe RUNS on every rc-0 path (vacuity pin) ----------------
+D7="$(mkarm)"; probe_semgrep "$D7"
+run_sut "$D7" >/dev/null 2>&1; RC=$?
+assert "probe runs semgrep --version on the rc-0 path" "[ $RC -eq 0 ] && grep -q -- '--version' '$D7/probe-log'"
+
+# --- arm H: python3 -m pip install --user success path, argv-faithful ------
+D8="$(mkarm)"; dead_semgrep "$D8"; fail_stub "$D8" brew; fail_stub "$D8" pipx
+write_installed "$D8"
+printf '#!/bin/sh\necho "python3:$*" >>"%s/called"\nif [ "$1" = "-m" ] && [ "$2" = "pip" ] && [ "$3" = "install" ] && [ "$4" = "--user" ] && [ "$5" = "semgrep" ]; then cp "%s/installed" "%s/home/.local/bin/semgrep"; chmod +x "%s/home/.local/bin/semgrep"; exit 0; fi\nexit 1\n' "$D8" "$D8" "$D8" "$D8" >"$D8/python3"; chmod +x "$D8/python3"
+mkdir -p "$D8/home/.local/bin"
+run_sut "$D8" >/dev/null 2>&1; RC=$?
+assert "dead shim + python3 -m pip --user success: exit 0, argv-faithful" "[ $RC -eq 0 ] && grep -q 'python3:-m pip install --user semgrep' '$D8/called'"
+assert "arm H: re-probe ran the pip-installed binary" "grep -q -- '--version' '$D8/probe-log'"
+
+# --- arm I: installer present but FAILED (nothing installed) → rc 1 ------
+D9="$(mkarm)"; dead_semgrep "$D9"; fail_stub "$D9" brew
+ERR="$(run_sut "$D9" 2>&1 >/dev/null)"; RC=$?
+assert "dead shim + brew fails + nothing else: exit 1 (attempted)" "[ $RC -eq 1 ]"
+assert "arm I: rc 1 not rc 2 — an installer WAS attempted" "[[ \"$ERR\" == *'still does not run'* ]]"
+
+echo
+echo "=== ensure-semgrep.test.sh: $PASS passed, $FAIL failed ($TOTAL assertions) ==="
+[ "$FAIL" -eq 0 ]

package/skills/review/test/fix-round-seats.test.sh

@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+#
+# Tests for fix-round-seats.sh — the single path→seat map consumed by both the
+# `none`-tier panel gating and the post-panel fix-commit targeted round (ADR-267).
+#
+# The suite needs NO filesystem fixtures — the SUT is a pure argv→stdout
+# function, so every arm is an invocation plus a stdout/stderr assertion. That
+# also means there is deliberately no mktemp/assert_fixture_dir machinery.
+#
+# Mutation axes covered (Guard 1 of the 9399 plan): per-arm membership, the
+# code-quality floor on unmatched source, multi-area unions, registry
+# validation of emitted AND --finding-seats tokens, the forged-token drop, and
+# the empty-diff contract.
+set -uo pipefail
+export TMPDIR="${TMPDIR:-/var/tmp}"
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SUT="$(cd "${DIR}/../scripts" && pwd)/fix-round-seats.sh"
+WORKFLOW="$(cd "${DIR}/../workflows" && pwd)/review.workflow.js"
+
+passes=0
+fails=0
+# INDEPENDENT case counter (ADR-193): moves in assert(), never in the verdict
+# helpers — a counter owned by pass()/fail() dies with the verdict it counts.
+CASES=0
+
+pass() { passes=$((passes + 1)); printf '  ok   %s\n' "$1"; }
+fail() {
+  fails=$((fails + 1))
+  printf '  FAIL %s\n' "$1"
+  [[ -n "${2:-}" ]] && printf '       %s\n' "$2"
+  return 0
+}
+
+assert() {
+  CASES=$((CASES + 1))
+  if eval "$2"; then
+    pass "$1"
+  else
+    fail "$1" "${3:-$2}"
+  fi
+}
+
+printf '\n=== fix-round-seats ===\n\n'
+
+[[ -f "$SUT" ]] || {
+  printf '\n[FATAL] SUT missing at %s — nothing to test.\n' "$SUT" >&2
+  exit 1
+}
+[[ -f "$WORKFLOW" ]] || {
+  printf '\n[FATAL] workflow missing at %s — registry cannot be derived.\n' "$WORKFLOW" >&2
+  exit 1
+}
+
+# Canonical seat registry, DERIVED — not restated. Agent-type leaves come from
+# the workflow's DIMENSIONS registry; the deterministic/non-agent seats the
+# workflow carries (shellcheck, anti-slop, gdpr) plus the SKILL-only
+# structural-enumeration seat are appended explicitly.
+registry() {
+  grep -oE "agentType: 'soleur:[a-z:-]+'" "$WORKFLOW" | tr -d "'" | awk -F: '{print $NF}'
+  printf '%s\n' shellcheck anti-slop gdpr-gate structural-enumeration code-simplicity-reviewer
+}
+
+run() { # $1=label; rest=args — captures stdout, stderr, rc without a subshell race
+  local label; label="$1"; : "$label"; shift
+  OUT="$(bash "$SUT" "$@" 2>"$TMPERR")"; RC=$?
+  ERR="$(cat "$TMPERR")"
+}
+TMPERR="$(mktemp -t fixseats-err.XXXXXXXX)"
+trap 'rm -f "$TMPERR"' EXIT
+
+# ── ARM 1: migration path → data-integrity + data-migration (+ deploy-verify) ──
+run mig --files 'apps/web-platform/supabase/migrations/20990101000000_x.sql'
+assert "migration path exits 0" '[[ "$RC" -eq 0 ]]' "rc=$RC err=$ERR"
+assert "migration path emits data-integrity-guardian" \
+  'grep -qx "data-integrity-guardian" <<<"$OUT"' "out=$OUT"
+assert "migration path emits data-migration-expert" \
+  'grep -qx "data-migration-expert" <<<"$OUT"' "out=$OUT"
+assert "migration path emits deployment-verification-agent" \
+  'grep -qx "deployment-verification-agent" <<<"$OUT"' "out=$OUT"
+
+# ── ARM 2: floor — an unmatched source path still emits code-quality-analyst ──
+# `scripts/lib/` hits no area arm (not web-platform, not plugins/soleur), so the
+# only mapped seat is the deterministic SAST one — the floor must still fire.
+run floor --files 'scripts/lib/foo.ts'
+assert "unmatched source emits code-quality floor" \
+  '[[ "$RC" -eq 0 ]] && grep -qx "code-quality-analyst" <<<"$OUT"' "rc=$RC out=$OUT"
+assert "unmatched source also emits semgrep (source extension)" \
+  'grep -qx "semgrep-sast" <<<"$OUT"' "out=$OUT"
+# Golden output pins membership AND order AND suppression: nothing else may be
+# emitted for a lone unmatched source path.
+assert "unmatched source emits EXACTLY code-quality + semgrep, in order" \
+  '[[ "$OUT" == $'"'"'code-quality-analyst\nsemgrep-sast'"'"' ]]' "out=$OUT"
+assert "unmatched source names the path on stderr (unmapped-paths)" \
+  'grep -q "unmapped-paths: scripts/lib/foo.ts" <<<"$ERR"' "err=$ERR"
+
+# ── ARM 3: multi-area union does not stop at the first member ─────────────────
+run multi --files $'plugins/soleur/skills/review/test/fix-round-seats.test.sh\napps/web-platform/supabase/migrations/20990101000000_x.sql'
+assert "test file + migration yields BOTH test-design and data-integrity" \
+  'grep -qx "test-design-reviewer" <<<"$OUT" && grep -qx "data-integrity-guardian" <<<"$OUT"' "out=$OUT"
+assert "test file + .sh extension also yields shellcheck" \
+  'grep -qx "shellcheck" <<<"$OUT"' "out=$OUT"
+
+# ── ARM 4: every emitted token resolves against the canonical registry ────────
+run reg --files $'apps/web-platform/supabase/migrations/20990101000000_x.sql\napps/web-platform/server/auth.ts\nplugins/soleur/skills/review/test/fix-round-seats.test.sh'
+_reg="$(registry | sort -u)"
+_bad="$(comm -23 <(sort -u <<<"$OUT") <(printf '%s\n' "$_reg"))"
+assert "all emitted seats resolve against the derived registry" \
+  '[[ -z "$_bad" ]]' "unregistered: $_bad"
+
+# ── ARM 5: --finding-seats unions the reporting seat ──────────────────────────
+run find --files 'docs/guide.md' --finding-seats user-impact-reviewer
+assert "finding-seat unions into an otherwise path-empty round" \
+  '[[ "$RC" -eq 0 ]] && grep -qx "user-impact-reviewer" <<<"$OUT"' "rc=$RC out=$OUT"
+
+# ── ARM 6: forged / unknown --finding-seats tokens never reach stdout ──────────
+run forge --files 'docs/guide.md' --finding-seats $'security-sentinel\nBUG-INJECTED'
+assert "newline-forged token is dropped, not echoed" \
+  '! grep -qx "BUG-INJECTED" <<<"$OUT"' "out=$OUT"
+assert "newline-forged token warns on stderr" \
+  'grep -q "unknown-seat:" <<<"$ERR"' "err=$ERR"
+assert "the real seat in the same arg survives" \
+  'grep -qx "security-sentinel" <<<"$OUT"' "out=$OUT"
+run unk --files 'docs/guide.md' --finding-seats 'not-a-seat'
+assert "unknown seat name dropped with warning" \
+  '[[ "$RC" -eq 0 ]] && ! grep -qx "not-a-seat" <<<"$OUT" && grep -q "unknown-seat: not-a-seat" <<<"$ERR"' \
+  "rc=$RC out=$OUT err=$ERR"
+
+# ── ARM 7: empty --files is a distinct exit-0 contract ────────────────────────
+run empty --files ''
+assert "empty file list exits 0 with empty stdout" \
+  '[[ "$RC" -eq 0 && -z "$OUT" ]]' "rc=$RC out=$OUT"
+assert "empty file list notes it on stderr" \
+  'grep -q "note: empty fix diff" <<<"$ERR"' "err=$ERR"
+
+# NB: sensitive-path fixtures name a NONEXISTENT path on purpose — the
+# battery-tag-authorship closure walks filesystem-real path mentions, and a
+# fixture naming a file that runs `git fetch`/`pull` would drag it into the
+# battery's offender census (measured live: session-sync.ts, 3 offenders).
+# ── ARM 8: sensitive path → security-sentinel ─────────────────────────────────
+run sens --files 'apps/web-platform/lib/stripe/__fixture__.ts'
+assert "sensitive path emits security-sentinel" \
+  'grep -qx "security-sentinel" <<<"$OUT"' "out=$OUT"
+
+# ── ARM 9: docs-only path emits no seats (floor is source-only) ───────────────
+run docs --files 'README.md'
+assert "non-source unmatched path emits nothing" \
+  '[[ "$RC" -eq 0 && -z "$OUT" ]]' "rc=$RC out=$OUT"
+
+# ── ARM 10: usage error exits 2 ───────────────────────────────────────────────
+run badflag --bogus
+assert "unknown flag exits 2" '[[ "$RC" -eq 2 ]]' "rc=$RC"
+run noargs
+assert "no args exits 2" '[[ "$RC" -eq 2 ]]' "rc=$RC"
+
+# ── ARM 11: every map arm has a presence pin ─────────────────────────────────
+# PERSIST isolated (a lib/ path that hits no other arm), PERF, GDPR, and
+# ANTISLOP/AGENT_SURFACE each get a fixture — deleting any single arm must red.
+run persist --files 'apps/web-platform/lib/util.ts'
+assert "persistence lib/ arm emits data-integrity-guardian" \
+  'grep -qx "data-integrity-guardian" <<<"$OUT"' "out=$OUT"
+run perf --files 'packages/inngest/foo.ts'
+assert "perf-arm path emits performance-oracle" \
+  'grep -qx "performance-oracle" <<<"$OUT"' "out=$OUT"
+run gdprarm --files 'apps/web-platform/lib/auth/x.ts'
+assert "gdpr-arm path emits gdpr-gate" \
+  'grep -qx "gdpr-gate" <<<"$OUT"' "out=$OUT"
+run sloparm --files 'apps/web-platform/components/ui/foo.tsx'
+assert "anti-slop+agent-surface arms both fire on a UI path" \
+  'grep -qx "anti-slop" <<<"$OUT" && grep -qx "agent-native-reviewer" <<<"$OUT"' "out=$OUT"
+
+# ── ARM 12: comma-separated --files must actually SPLIT ───────────────────────
+# SENSITIVE_PATH_RE is ^-anchored, so only the SPLIT second entry can emit
+# security-sentinel — the joined line never matches.
+run comma --files 'docs/a.md,apps/web-platform/lib/stripe/__fixture__.ts'
+assert "comma split is observable (anchored arm on the second entry)" \
+  'grep -qx "security-sentinel" <<<"$OUT"' "out=$OUT"
+
+# ── ARM 13: --finding-seats vocabulary normalization ─────────────────────────
+# Canonical ids and workflow dimension keys both reduce to leaf names; a forged
+# glob token is never pathname-expanded.
+run vocab --files 'docs/guide.md' --finding-seats 'soleur:engineering:review:security-sentinel,git-history,code-quality'
+assert "canonical id normalizes to leaf" \
+  'grep -qx "security-sentinel" <<<"$OUT"' "out=$OUT"
+assert "dimension keys normalize to leaves" \
+  'grep -qx "git-history-analyzer" <<<"$OUT" && grep -qx "code-quality-analyst" <<<"$OUT"' "out=$OUT"
+run dupfs --files 'docs/guide.md' --finding-seats 'security-sentinel,security-sentinel'
+assert "duplicate finding-seat dedupes to one line" \
+  '[[ "$(grep -c "^security-sentinel$" <<<"$OUT")" -eq 1 ]]' "out=$OUT"
+run glob --files '' --finding-seats '*'
+assert "a forged glob token cannot expand or reach stdout" \
+  '[[ "$RC" -eq 0 && -z "$OUT" ]]' "rc=$RC out=$OUT err=$ERR"
+# Discriminating: with `set -f` removed, '*' pathname-expands and stderr shows
+# the expanded filenames instead of the literal token.
+assert "forged glob is reported literally (set -f holds)" \
+  'grep -q "unknown-seat: \*" <<<"$ERR"' "err=$ERR"
+
+# ── ARM 14: whitespace-only and CRLF file entries are normalized ──────────────
+run blank --files $'  \n\t\n'
+assert "whitespace-only --files behaves like empty (no floor, no seats)" \
+  '[[ "$RC" -eq 0 && -z "$OUT" ]]' "rc=$RC out=$OUT err=$ERR"
+# Discriminating: a leading-whitespace path only matches the ^-anchored
+# sensitive arm after the leading-trim — removing the trim reds this arm.
+run wsanchored --files ' apps/web-platform/lib/stripe/__fixture__.ts'
+assert "leading-whitespace path still matches the anchored sensitive arm" \
+  'grep -qx "security-sentinel" <<<"$OUT"' "out=$OUT"
+# Discriminating: git quote-paths a filename containing spaces; the wrapping
+# quote would defeat the ^-anchored sensitive arm without the strip.
+run quoted --files '"apps/web-platform/lib/stripe/__fixture__.ts"'
+assert "quote-pathed entry still matches the anchored sensitive arm" \
+  'grep -qx "security-sentinel" <<<"$OUT"' "out=$OUT"
+run crlf --files $'scripts/lib/foo.ts\r'
+assert "CR-trailing path still matches the source arm" \
+  'grep -qx "code-quality-analyst" <<<"$OUT"' "out=$OUT"
+
+# ── Accounting conservation (ADR-193 #3) — reported directly, never via verdict helpers ──
+if [[ $((passes + fails)) -ne "$CASES" ]]; then
+  printf '\n[FATAL] accounting: passes+fails (%d) != CASES (%d).\n' \
+    "$((passes + fails))" "$CASES" >&2
+  printf '\n=== fix-round-seats: %d passed, %d failed (%d assertions) ===\n\n' \
+    "$passes" "$fails" "$CASES" >&2
+  exit 1
+fi
+
+# ── Anti-vacuity floor (ADR-193 #1) — reads the INDEPENDENT counter ───────────
+FIXSEATS_MIN_ASSERTIONS=36
+if (( CASES < FIXSEATS_MIN_ASSERTIONS )); then
+  printf '\n[FATAL] anti-vacuity floor: only %d assertion(s) ran, expected >= %d.\n' \
+    "$CASES" "$FIXSEATS_MIN_ASSERTIONS" >&2
+  printf '\n=== fix-round-seats: %d passed, %d failed (%d assertions) ===\n\n' \
+    "$passes" "$fails" "$CASES" >&2
+  exit 1
+fi
+
+printf '\n=== fix-round-seats: %d passed, %d failed (%d assertions) ===\n\n' \
+  "$passes" "$fails" "$CASES"
+[[ "$fails" -eq 0 ]]

package/skills/review/workflows/README.md

@@ -0,0 +1,147 @@
+# Workflow-backed `soleur:review` (prototype)
+
+`review.workflow.js` is a [dynamic workflow](https://claude.com/blog/introducing-dynamic-workflows-in-claude-code)
+re-implementation of the core engine of the `soleur:review` skill. It is a
+**prototype for A/B comparison** against the prose-driven SKILL.md — not a
+replacement. Both can coexist.
+
+> **Known divergence:** `SKILL.md` §"Change Classification Gate" step 4 adds a
+> **`design-risk`** signal — a mechanism-introducing PR gets a design-validity
+> pass (simplicity + architecture, plus economics only on a cost claim) *before*
+> the full panel, with mandatory dedup of lenses that already ran. This port does
+> not implement it: its classify agent returns the four classes and the `triggers`
+> object only. A run driven from this script therefore skips the design-validity
+> ordering. The prose skill remains the default and the authority.
+
+## What it does
+
+```
+Classify ──▶ Review ──▶ Verify ──▶ Synthesize ──▶ File
+ (1 agent)   (always-on  (1–3        (dedup +       (CONCUR-gated
+             + cond.     skeptics    provenance      scope-out,
+             dimensions) refute      disposition)    dry-run by
+                         each find.)                 default)
+```
+
+1. **Classify** — one agent runs the same change-class predicates as
+   `SKILL.md` §"Change Classification Gate" and returns a structured class
+   (`code` / `non-code` / `lockfile-only` / `deletion-dominated`) **plus a
+   `triggers` object** (Rails, migration, tests, source, bash-only, GDPR,
+   user-impact threshold).
+2. **Review** — the script (not the model) maps the class to its **always-on**
+   dimension list and the triggers to its **conditional** dimensions, then fans
+   out one agent per lens. Each lens reuses the **real Soleur reviewer agent**
+   via `agentType`, so it inherits that agent's system prompt.
+3. **Verify** — every finding is handed to 1–3 adversarial skeptics (a
+   perspective-diverse panel — correctness / scope / already-handled — when
+   `deepReview`) that default to `isReal=false` and must be argued *out* of
+   refutation; majority-real survives. **No-barrier pipeline**: a dimension's
+   findings start verifying the instant that dimension lands. The fan-out is
+   **budget-floored** — if `budget.remaining()` drops below the reserve, the
+   remaining findings are surfaced `UNVERIFIED` (kept, not dropped) and the
+   skipped set is logged. Never a silent cap.
+4. **Synthesize** — confirmed findings are deduped by `file+title`, then given
+   a deterministic `disposition` (`fix-inline` vs `scope-out-candidate`) from
+   the SKILL's cost-of-filing rule encoded in code.
+5. **File** — each `scope-out-candidate` is independently co-signed by a
+   simplicity-biased **CONCUR gate** (defaults to DISSENT). DISSENT flips the
+   finding back to `fix-inline`; CONCUR files a `deferred-scope-out` issue —
+   but only when invoked with `{ file: true }`. Otherwise it's a **dry run**
+   that emits the would-file issue body for inspection.
+
+   **Untrusted-input hardening:** finding titles derive from the diff under
+   review — potentially attacker-controlled PR content. The title is passed to
+   `gh` as a shell argv, so it runs through `safeTitle()` (strips control chars
+   + shell metacharacters, caps length) and a constant `review: ` prefix <!-- markdownlint-disable-line MD038 -->
+   (no leading `-` → no argv flag-smuggling); the body always goes via
+   `--body-file` so it is never shell-parsed. The agent writes both to temp
+   files with its Write tool rather than receiving an interpolated command.
+
+## How to run it
+
+From a session where the diff under review is reachable (`origin/main...HEAD`):
+
+```
+Workflow({ scriptPath: "plugins/soleur/skills/review/workflows/review.workflow.js",
+           args: "1234" })          // PR number, branch name, or "" for current branch
+```
+
+`args` may also be an object:
+
+| field | effect |
+|---|---|
+| `target` | PR number / branch / `""` (current branch) |
+| `deepReview` | force the full always-on 8-dimension pass **and** a 3-skeptic perspective-diverse verify panel. The literal phrases `deep review` / `full review` in a string `target` trigger the same override, matching the SKILL. |
+| `file` | actually create the `deferred-scope-out` GitHub issues for CONCUR'd candidates. Default (omit) is a dry run that only emits the would-file bodies. |
+
+e.g. `args: { target: "1234", deepReview: true, file: true }`.
+
+Iterate by editing the file and re-invoking with the same `scriptPath`. To
+resume an interrupted run, add `resumeFromRunId: "<runId>"` — unchanged
+`agent()` calls return cached results instantly.
+
+## What it inherits from Workflow that the SKILL can't express today
+
+| Capability | SKILL.md (Task-spawn prose) | This workflow |
+|---|---|---|
+| Class → fan-out decision | Model interprets a bash decision tree each run | Deterministic JS lookup (`CLASS_DIMENSIONS` + `conditionalDimensions`) |
+| Conditional agents | Prose "if PR contains X, spawn agent Y" | `triggers` flags → deterministic dimension list |
+| Risk-tier panel scaling | SKILL delegates to `references/risk-tier-and-fix-rounds.md` | `resolveTier` (fail-closed sensitive-path clamp) + `scaleAlwaysOn` trigger-gate {data-integrity, agent-native, performance} at `none` tier (ADR-267) |
+| Per-finding verification | None — CONCUR fires only on scope-out *filings* | Every finding adversarially refuted (1–3 skeptics) before surfacing |
+| Review→verify scheduling | Implicit barrier (waits for all reviewers) | No-barrier `pipeline()` — verify starts per-dimension |
+| Disposition (fix vs file) | Prose cost-of-filing gate, model-applied | `disposition()` — code, auditable, identical every run |
+| Scope-out CONCUR gate | Manual self-check the agent CONCUR'd | Structured CONCUR/DISSENT verdict; DISSENT auto-flips to fix-inline |
+| Resume after interruption | Restart from zero | Journaled — cached prefix replays instantly |
+| Token ceiling | Hand-written "API budget" warnings | `budget` floor on the verify fan-out; UNVERIFIED-not-dropped + logged |
+| Structured output | Parse agent prose by hand | Schema-validated, agents retry on mismatch |
+
+## Ported so far
+
++ always-on dimension agents (class-gated 2/4/8 fan-out)
++ conditional dimensions (Rails ×2, migration ×2, test-design, semgrep-SAST,
+  shellcheck (bash), real `gdpr-gate` skill, anti-slop Tier-1, user-impact)
+  from deterministic `triggers`
++ deterministic-tool findings auto-confirmed (skip adversarial verify)
++ 1–3 skeptic adversarial verification, no-barrier pipeline
++ provenance-driven deterministic disposition
++ CONCUR-gated `deferred-scope-out` filing (dry-run by default; `{ file: true }`
+  to create issues)
++ `budget` floor on the verify fan-out with logged UNVERIFIED coverage
+
+### Deterministic vs. judgment findings
+
+Dimensions split into two kinds:
+
++ **LLM-judgment** (the reviewer agents) → every finding is adversarially
+  verified (refute-by-default) before it surfaces.
++ **Deterministic tools/skills** (`semgrep`, `shellcheck`, `anti-slop`, the real
+  `gdpr-gate`) → findings are **auto-confirmed as ground truth**, skipping the
+  verify stage. Refuting an `SC2086` or a `BRAND-RAW-HEX` hit would be both wrong
+  and wasteful; the tool is authoritative. These carry `deterministic: true`.
+
+`bashOnly` routes the SAST slot to `shellcheck` instead of `semgrep` (semgrep's
+tree-sitter bash parser is vacuous — SKILL.md note). `anti-slop` high-severity
+`brand` findings are a **required-fix** gate (the scanner exits non-zero).
+
+## Still NOT ported (next increments)
+
++ **Follow-through auto-wiring** — filed scope-outs don't yet scaffold the
+  `<!-- soleur:followthrough -->` directive + verification script + `chmod`.
++ **semgrep `ensure-semgrep.sh` exit-code handling** — the `semgrep` dimension
+  prompts the bootstrap but doesn't hard-abort the run on a non-zero installer
+  exit (the SKILL does).
++ **Pipeline-mode compact-marker output** for `one-shot` / `work` callers (the
+  workflow returns structured JSON instead, which an orchestrator consumes
+  directly — arguably moot in workflow form).
++ **Fix-commit targeted rounds (ADR-267)** — `--fix-round`/`--since` arg
+  handling, `PANEL_SHA` snapshotting, and the `structural-enumeration` seat
+  (the `aggregate pattern` row's guard-shaped structural pass, a SKILL-only
+  `general-purpose` spawn) exist only in the prose skill; the workflow port
+  resolves the tier and gates the none-tier panel but does not run fix rounds.
+
+## Validation
+
+`review.workflow.js`'s control flow (conditional fan-out, pipeline verify,
+majority survival, CONCUR flip, dry-run filing, budget floor) is exercised by a
+stub harness with **no real agents / zero tokens** — see the PR description for
+the matrix. The live A/B on PR #5006 covers the real-agent path.