@soleur/opencode 0.0.0-stage → 1.0.0

package/scripts/sync-pr-behind.test.sh

@@ -0,0 +1,252 @@
+#!/usr/bin/env bash
+# Suite for plugins/soleur/scripts/sync-pr-behind.sh -- specifically its regenerable-conflict
+# arm (#8377, ADR-235).
+#
+# ── SCOPE, STATED HONESTLY ──────────────────────────────────────────────────────────────────
+# This covers the branch the resolver added and the two outcomes the caller must distinguish:
+#   resolver rc 0      -> the merge is already committed; DO NOT merge again; push; succeed.
+#   resolver non-zero  -> today's behaviour, unchanged: exit 6 with a clean tree.
+# It does NOT cover the gh-polling loop, the BEHIND cap, or exit 7 -- those predate this change
+# and have no suite; adding one is not this PR's subject. Saying so beats implying otherwise by
+# a suite name that suggests whole-script coverage.
+#
+# ── HOW THE SEAM IS BUILT ───────────────────────────────────────────────────────────────────
+# `gh` is a PATH stub that reports OPEN DIRTY once, then OPEN CLEAN. The stub REFUSES a request
+# it did not expect (exit 64) rather than answering every question identically -- a fake that
+# answers regardless of argv puts the seam above everything the caller's request shape encodes,
+# so a caller querying the wrong thing would still read the right fixture.
+export TMPDIR="${TMPDIR:-/var/tmp}"
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SUT="$SCRIPT_DIR/sync-pr-behind.sh"
+
+passes=0; fails=0; CASES_RUN=0; FAILED=()
+pass() { passes=$((passes + 1)); echo "  PASS: $1"; }
+fail() { fails=$((fails + 1)); FAILED+=("$1"); echo "  FAIL: $1" >&2; }
+
+_iv_p="$passes"; _iv_f="$fails"; _iv_n="${#FAILED[@]}"
+{ pass "self-test"; fail "self-test"; } >/dev/null 2>&1
+if [[ "$passes" -ne $((_iv_p + 1)) || "$fails" -ne $((_iv_f + 1)) || "${#FAILED[@]}" -ne $((_iv_n + 1)) ]]; then
+  printf '[FATAL] instrument self-test: the verdict helpers did not both record\n' >&2; exit 1
+fi
+passes=0; fails=0; FAILED=(); CASES_RUN=0
+
+[[ -f "$SUT" ]] || { echo "[FATAL] SUT not found at $SUT" >&2; exit 1; }
+
+assert_fixture_dir() {
+  case "${1-}" in
+    "") printf 'FATAL: fixture dir is EMPTY; git -C "" would operate on %s\n' "$PWD" >&2; exit 2 ;;
+    */../*|*/..) printf 'FATAL: fixture dir %s contains ..; refusing\n' "$1" >&2; exit 2 ;;
+    /proc/*|/sys/*|/dev/*) printf 'FATAL: fixture dir %s is a synthetic-fs path; refusing\n' "$1" >&2; exit 2 ;;
+    /|//|/.) printf 'FATAL: fixture dir resolves to the filesystem root; refusing\n' >&2; exit 2 ;;
+    /*) : ;;
+    *)  printf 'FATAL: fixture dir %s is RELATIVE; refusing\n' "$1" >&2; exit 2 ;;
+  esac
+}
+
+SANDBOX="$(mktemp -d)"; assert_fixture_dir "$SANDBOX"
+trap 'rm -rf "$SANDBOX"' EXIT
+# The resolver stages sources under XDG_CACHE_HOME; keep that inside the sandbox too.
+export XDG_CACHE_HOME="$SANDBOX/xdg-cache"
+
+MODEL="knowledge-base/engineering/architecture/diagrams/model.likec4.json"
+SRC="knowledge-base/engineering/architecture/diagrams/model.c4"
+_git() { git -C "$1" -c user.email=t@t -c user.name=t "${@:2}"; }
+
+# mkfix <name> <conflict-kind> — a repo with a real `origin` remote (a local bare clone, so the
+# push path is exercised for real rather than stubbed) and a conflict of the requested kind.
+mkfix() {
+  local name="$1" kind="$2"
+  local root="$SANDBOX/$name"; assert_fixture_dir "$root"
+  local up="$root/upstream.git" wt="$root/wt"
+  mkdir -p "$up" "$wt"
+  git init -q --bare "$up"
+
+  mkdir -p "$wt/knowledge-base/engineering/architecture/diagrams" \
+           "$wt/plugins/soleur/scripts" "$wt/plugins/soleur/.claude-plugin"
+  printf 'first\nx\nlast\n' > "$wt/$SRC"
+  printf '{"v":"base"}\n' > "$wt/$MODEL"
+  printf 'readme base\n' > "$wt/README.md"
+  # BOTH scripts are COPIED INTO THE FIXTURE, and for sync-pr-behind.sh that is mandatory,
+  # not stylistic: it resolves its own repo root from ${BASH_SOURCE[0]}/../../.. and `cd`s
+  # there. Run from the tracked path it would operate on the REAL repository regardless of
+  # this fixture -- measured: the first run of this suite reported the developer's own branch
+  # name and exited 6 against the live worktree. Copying it makes that walk land in $wt.
+  cp "$SCRIPT_DIR/sync-pr-behind.sh" "$wt/plugins/soleur/scripts/"
+  cp "$SCRIPT_DIR/resolve-regenerable-conflicts.sh" "$wt/plugins/soleur/scripts/"
+  # The resolver runs the renderer BESIDE ITSELF (ADR-235 amendment), so the stub goes there
+  # with a plugin.json the resolver's identity check accepts. It takes the real renderer's
+  # `--root <staging> --out <file>` argv as the resolver passes it, and refuses any other shape.
+  printf '{\n  "name": "soleur"\n}\n' > "$wt/plugins/soleur/.claude-plugin/plugin.json"
+  cat > "$wt/plugins/soleur/scripts/render-c4-model.sh" <<STUB
+#!/usr/bin/env bash
+set -euo pipefail
+[[ "\$#" -eq 4 && "\$1" == "--root" && -d "\$2" && "\$3" == "--out" ]] || { echo "stub renderer: bad argv: \$*" >&2; exit 64; }
+R="\$2"
+printf '{"from":"%s|%s"}\n' "\$(head -1 "\$R/$SRC")" "\$(tail -1 "\$R/$SRC")" | tee "\$4" >/dev/null
+STUB
+  chmod +x "$wt/plugins/soleur/scripts/render-c4-model.sh"
+  _git "$wt" init -q -b main
+  # Identity in LOCAL config, not only on `_git`'s `-c`: the SUT's own merge runs in this
+  # repo and reads config, so without these it only had an identity where the developer's
+  # GLOBAL config supplied one. Same defect as resolve-regenerable-conflicts.test.sh, which
+  # failed 14 rows on a CI runner (#8384, run 35588718251); this suite was found by sweeping
+  # the PR's suites under HOME=$(mktemp -d) GIT_CONFIG_GLOBAL=/dev/null.
+  git -C "$wt" config user.email t@t
+  git -C "$wt" config user.name t
+  _git "$wt" remote add origin "$up"
+  _git "$wt" add -A >/dev/null; _git "$wt" commit -q -m base
+  _git "$wt" push -q origin main
+
+  _git "$wt" checkout -q -b feature
+  sed -i 's/^last$/last-FEATURE/' "$wt/$SRC"
+  printf '{"v":"feature"}\n' > "$wt/$MODEL"
+  [[ "$kind" == "unresolvable" ]] && printf 'readme FEATURE\n' > "$wt/README.md"
+  _git "$wt" add -A >/dev/null; _git "$wt" commit -q -m feature
+  _git "$wt" push -q -u origin feature
+
+  _git "$wt" checkout -q main
+  sed -i 's/^first$/first-MAIN/' "$wt/$SRC"
+  printf '{"v":"main"}\n' > "$wt/$MODEL"
+  [[ "$kind" == "unresolvable" ]] && printf 'readme MAIN\n' > "$wt/README.md"
+  _git "$wt" add -A >/dev/null; _git "$wt" commit -q -m main
+  _git "$wt" push -q origin main
+  _git "$wt" checkout -q feature
+
+  # STRICT gh stub: answers only the query the SUT is expected to make, refuses anything else.
+  mkdir -p "$root/bin"
+  cat > "$root/bin/gh" <<'GH'
+#!/usr/bin/env bash
+# The merge-queue read (#9454) is the one other request the SUT makes: it asks
+# `gh api graphql ... isInMergeQueue` and expects `not_queued` / `queued` back (--jq).
+# This suite's PR is never queued; a graphql call WITHOUT the queue fields is still a miss.
+if [[ "$1 $2" == "api graphql" ]]; then
+  case "$*" in
+    *isInMergeQueue*mergeQueueEntry*) echo not_queued; exit 0 ;;
+    *) echo "STUB-MISS: gh api graphql without the merge-queue fields: $*" >&2; exit 64 ;;
+  esac
+fi
+if [[ "$1 $2" != "pr view" ]]; then
+  echo "STUB-MISS: unexpected gh invocation: $*" >&2; exit 64
+fi
+# The standalone loop first checks the PR's head branch (kind=wrong_branch, exit 12).
+# Answer it with the fixture branch; it is not a state read, so it is not counted.
+for a in "$@"; do [[ "$a" == "headRefName" ]] && { echo "feature"; exit 0; }; done
+for a in "$@"; do [[ "$a" == "state,mergeStateStatus" ]] && found=1; done
+if [[ -z "${found:-}" ]]; then
+  echo "STUB-MISS: gh pr view without the expected --json fields: $*" >&2; exit 64
+fi
+n="$(cat "${GH_CALLS:?}" 2>/dev/null || echo 0)"; echo $((n + 1)) > "$GH_CALLS"
+if [[ "$n" -eq 0 ]]; then echo "OPEN DIRTY"; else echo "OPEN CLEAN"; fi
+GH
+  chmod +x "$root/bin/gh"
+  printf '%s' "$root"
+}
+
+run_sut() {
+  # SPLIT, not `local root="$1" wt="$root/wt"`: within one `local` statement the later
+  # assignment does not see the earlier name, so under `set -u` that form aborts the function
+  # with "root: unbound variable" -- and the caller reads the empty output as a SUT that
+  # printed nothing, which looks exactly like the bug this suite is here to detect.
+  local root="$1"
+  local wt="$root/wt"
+  local out rc=0
+  out="$(cd "$wt" && GH_CALLS="$root/gh.calls" PATH="$root/bin:$PATH" \
+        bash "$wt/plugins/soleur/scripts/sync-pr-behind.sh" 123 2>&1)" || rc=$?
+  printf '%s\n%s' "$out" "$rc"
+}
+sut_rc()  { tail -n1 <<<"$1"; }
+sut_out() { sed '$d' <<<"$1"; }
+
+# RELOCATION SELF-TEST. The failure mode this guards is silent and total: a SUT that walks
+# to the real repo answers every case from a tree the fixture never built, and the verdicts
+# look ordinary. Require the fixture's own branch name in the output before reading anything.
+_rt_root="$(mkfix relocation resolvable)"
+_rt_out="$(sut_out "$(run_sut "$_rt_root")")"
+if ! grep -q 'branch: feature' <<<"$_rt_out"; then
+  printf '[FATAL] relocation self-test: the SUT did not report the fixture branch.\n' >&2
+  printf '        It is operating on some other repository, so every case below is void.\n' >&2
+  printf '        got: %s\n' "$_rt_out" >&2
+  exit 1
+fi
+
+echo "=== sync-pr-behind: regenerable-conflict arm ==="
+
+# ── rc 0: the conflict is regenerable -> merged, regenerated, pushed ───────────────────────
+echo ""
+echo "--- resolver rc 0: merge is completed and pushed ---"
+root="$(mkfix ok resolvable)"; wt="$root/wt"
+res="$(run_sut "$root")"
+CASES_RUN=$((CASES_RUN + 1))
+[[ "$(sut_rc "$res")" == "0" ]] && pass "exits 0 on a regenerable conflict" \
+  || fail "exited $(sut_rc "$res"): $(sut_out "$res")"
+CASES_RUN=$((CASES_RUN + 1))
+if grep -q 'regenerable conflict resolved' <<<"$(sut_out "$res")"; then
+  pass "reports that the regenerable path was taken"
+else
+  fail "the regenerable arm is invisible in the output: $(sut_out "$res")"
+fi
+CASES_RUN=$((CASES_RUN + 1))
+[[ "$(cat "$wt/$MODEL")" == *'first-MAIN|last-FEATURE'* ]] \
+  && pass "the artifact was regenerated from the MERGED sources" \
+  || fail "artifact is $(cat "$wt/$MODEL") — regen did not see the merged tree"
+CASES_RUN=$((CASES_RUN + 1))
+# The merge must have reached the REMOTE: this is what distinguishes "resolved" from
+# "resolved locally and silently not pushed", and the resolver deliberately never pushes.
+if _git "$root/upstream.git" rev-parse feature >/dev/null 2>&1 \
+   && [[ "$(_git "$wt" rev-parse feature)" == "$(_git "$root/upstream.git" rev-parse feature)" ]]; then
+  pass "the merge commit was pushed (the caller owns the push, not the resolver)"
+else
+  fail "the remote feature ref does not match local HEAD — the merge was never pushed"
+fi
+CASES_RUN=$((CASES_RUN + 1))
+[[ -z "$(_git "$wt" status --porcelain)" ]] && pass "the worktree is clean afterwards" \
+  || fail "worktree dirty: $(_git "$wt" status --porcelain)"
+
+# ── non-zero: a non-regenerable conflict is refused exactly as before ──────────────────────
+echo ""
+echo "--- resolver non-zero: unchanged exit 6, tree untouched ---"
+root="$(mkfix bad unresolvable)"; wt="$root/wt"
+head_before="$(_git "$wt" rev-parse HEAD)"
+res="$(run_sut "$root")"
+CASES_RUN=$((CASES_RUN + 1))
+[[ "$(sut_rc "$res")" == "6" ]] && pass "exits 6 on a non-regenerable conflict" \
+  || fail "expected exit 6, got $(sut_rc "$res"): $(sut_out "$res")"
+CASES_RUN=$((CASES_RUN + 1))
+[[ "$(_git "$wt" rev-parse HEAD)" == "$head_before" ]] && pass "HEAD did not move" \
+  || fail "HEAD moved on a conflict that should have been refused"
+CASES_RUN=$((CASES_RUN + 1))
+[[ -z "$(_git "$wt" status --porcelain)" ]] && pass "the tree is clean (merge aborted)" \
+  || fail "tree left dirty: $(_git "$wt" status --porcelain)"
+CASES_RUN=$((CASES_RUN + 1))
+if grep -q 'manual resolution required' <<<"$(sut_out "$res")"; then
+  pass "reports that manual resolution is required"
+else
+  fail "the refusal is not reported: $(sut_out "$res")"
+fi
+CASES_RUN=$((CASES_RUN + 1))
+if grep -q 'STUB-MISS' <<<"$(sut_out "$res")"; then
+  fail "the gh stub was called in a way it did not expect — the fixture is not exercising the real request shape"
+else
+  pass "no STUB-MISS: the SUT queried gh exactly as the stub expects"
+fi
+
+echo ""
+echo "cases_run=$CASES_RUN passes=$passes fails=$fails ledger=${#FAILED[@]}"
+_min_cases=10
+if [[ "$CASES_RUN" -lt "$_min_cases" ]]; then
+  printf '[FATAL] assertion floor: only %s case(s) ran, floor is %s\n' "$CASES_RUN" "$_min_cases" >&2; exit 1
+fi
+if [[ $((passes + fails)) -ne "$CASES_RUN" ]]; then
+  printf '[FATAL] %s verdicts for %s cases\n' "$((passes + fails))" "$CASES_RUN" >&2; exit 1
+fi
+if [[ "${#FAILED[@]}" -ne "$fails" ]]; then
+  printf '[FATAL] ledger/counter disagree: %s vs %s\n' "${#FAILED[@]}" "$fails" >&2; exit 1
+fi
+if [[ "${#FAILED[@]}" -ne 0 ]]; then
+  printf '[FATAL] %s failing assertion(s):\n' "${#FAILED[@]}" >&2
+  printf '  - %s\n' "${FAILED[@]}" >&2; exit 1
+fi
+echo "sync-pr-behind: all $passes assertions passed"

package/scripts/taste-profile-update.sh

@@ -0,0 +1,180 @@
+#!/usr/bin/env bash
+# taste-profile-update.sh — context-keyed design taste-profile writer/validator
+# (#5990 · FR7 · ADR-090). Rides FR6 declarative context-injection (ADR-086):
+# the committed taste-profile.md is agent-writable content, so per ADR-086
+# §Consequences (content-trust ≠ path-trust) THIS helper is the sanitizing
+# boundary — every model-supplied token (context, axis, value, date) is validated
+# before it reaches the committed file that FR6 re-injects.
+#
+# Modes:
+#   write:     taste-profile-update.sh <profile.md> <context> <axis> <value> <today-YYYY-MM-DD>
+#   validate:  taste-profile-update.sh --validate <profile.md>
+#
+# Model: entries keyed by (context, axis) → value, ordered by RECENCY
+# (last_reinforced, tie-break reinforce_count). No numeric weighting/scoring.
+# Contradiction fires only within the SAME (context, axis); resolution = supersede,
+# logged to contradictions[]. Automated writes bump `last_updated` only — never
+# `last_reviewed` (freshness convention / context-reviewed-gate.sh).
+#
+# jq + bash only. Whole-file re-render from the parsed frontmatter + transformed
+# JSON block (the machine block is the source of truth; the human tables are
+# regenerated). Atomic tmp+mv; original preserved on any failure.
+set -uo pipefail
+
+# --- allowlists / sanitizers (the content-trust boundary) --------------------
+CONTEXT_ALLOW=" landing-page marketing-site dashboard app-ui docs email component "
+AXIS_ALLOW=" aesthetic-direction "
+# value = a short lowercase-hyphen aesthetic-direction slug (≤40 chars). The closed
+# charset + length cap is the injection defense: no whitespace/punctuation means a
+# value can never encode imperative prose that could steer a future FR6-primed session.
+VALUE_RE='^[a-z][a-z0-9-]{0,39}$'
+DATE_RE='^[0-9]{4}-[0-9]{2}-[0-9]{2}$'
+
+die() { printf 'taste-profile-update: %s\n' "$1" >&2; exit 1; }
+
+extract_json() {
+  # Emit the JSON between the data markers, dropping the ``` fences.
+  awk '/taste-profile:data:start/{f=1;next} /taste-profile:data:end/{f=0} f' "$1" \
+    | sed -e '/^```/d'
+}
+
+# Frontmatter-scoped field read (house `c==1` idiom — only the block between the
+# first two `---` lines, so a body line beginning with the key never matches).
+fm_field() { awk -F': ' -v k="$1" 'FNR==1{c=0} /^---$/{c++; next} c==1 && $0 ~ "^"k":" {print $2; exit}' "$2"; }
+
+validate_json() {
+  # $1 = json string. Returns 0 iff EVERY entry AND contradiction is well-formed
+  # (same allowlists/regex a fresh write enforces). This is the consumer read-path
+  # trust gate (ADR-090): it must cover the whole machine block, not just entries.
+  local j="$1"
+  echo "$j" | jq -e '.schema == 1 and (.entries|type=="array") and (.contradictions|type=="array")' >/dev/null 2>&1 || return 1
+  local bad
+  bad=$(echo "$j" | jq -r \
+    --arg ctxs "$CONTEXT_ALLOW" --arg axes "$AXIS_ALLOW" \
+    --arg valre "$VALUE_RE" --arg datere "$DATE_RE" '
+    def ok_ctx($c): ($ctxs | contains(" " + $c + " "));
+    def ok_axis($a): ($axes | contains(" " + $a + " "));
+    ( [ .entries[]
+        | select(
+            ( ok_ctx(.context) | not ) or ( ok_axis(.axis) | not )
+            or ( (.value|type) != "string" ) or ( .value | test($valre) | not )
+            or ( .last_reinforced | test($datere) | not )
+            or ( (.reinforce_count|type) != "number" ) or ( .reinforce_count < 1 )
+          ) ] | length )
+    + ( [ .contradictions[]
+        | select(
+            ( ok_ctx(.context) | not ) or ( ok_axis(.axis) | not )
+            or ( (.old_value|type) != "string" ) or ( .old_value | test($valre) | not )
+            or ( (.new_value|type) != "string" ) or ( .new_value | test($valre) | not )
+            or ( .date | test($datere) | not )
+            or ( (.old_count|type) != "number" )
+          ) ] | length )' 2>/dev/null)
+  [[ "$bad" == "0" ]] || return 1
+  return 0
+}
+
+render_file() {
+  # $1 profile path, $2 preserved last_reviewed, $3 review_cadence, $4 owner,
+  # $5 today (new last_updated), $6 json
+  local out reviewed cadence owner today json tables flags
+  out="$1"; reviewed="$2"; cadence="$3"; owner="$4"; today="$5"; json="$6"
+  # Recency order: most-recent first, higher reinforce_count breaks a same-date tie.
+  tables=$(echo "$json" | jq -r '
+    if (.entries|length)==0 then "_None yet._"
+    else (["| context | axis | value | last_reinforced | reinforced |",
+           "|---|---|---|---|---|"]
+          + ( .entries | sort_by([.last_reinforced, .reinforce_count]) | reverse
+              | map("| \(.context) | \(.axis) | \(.value) | \(.last_reinforced) | \(.reinforce_count) |") ))
+         | join("\n")
+    end') || return 1
+  flags=$(echo "$json" | jq -r '
+    if (.contradictions|length)==0 then "_None yet._"
+    else ( .contradictions | sort_by(.date) | reverse
+           | map("- \(.date) — `\(.context)`/`\(.axis)`: `\(.old_value)` (reinforced \(.old_count)×) superseded by `\(.new_value)`") )
+         | join("\n")
+    end') || return 1
+  local compact
+  compact=$(echo "$json" | jq -c '.') || return 1
+  cat > "$out" <<EOF
+---
+last_updated: $today
+last_reviewed: $reviewed
+review_cadence: $cadence
+owner: $owner
+---
+# Design Taste Profile
+
+Learned operator design preferences, keyed by \`(context, axis)\` and ordered by
+recency. Loaded into design sessions via FR6 (\`frontend-design\` skill \`context_queries\`)
+and a direct Read (\`ux-design-lead\` agent). See ADR-090.
+
+<!-- Machine block owned by plugins/soleur/scripts/taste-profile-update.sh — do not hand-edit. -->
+<!-- taste-profile:data:start -->
+\`\`\`json
+$compact
+\`\`\`
+<!-- taste-profile:data:end -->
+
+## Reinforced Aesthetics
+
+$tables
+
+## Contradiction Flags
+
+$flags
+EOF
+}
+
+# --- validate mode -----------------------------------------------------------
+if [[ "${1:-}" == "--validate" ]]; then
+  profile="${2:-}"
+  [[ -n "$profile" && -f "$profile" ]] || die "validate: profile not found: ${2:-<none>}"
+  json="$(extract_json "$profile")"
+  [[ -n "$json" ]] || die "validate: no machine block in $profile"
+  validate_json "$json" || die "validate: profile failed schema/allowlist checks"
+  exit 0
+fi
+
+# --- write mode --------------------------------------------------------------
+[[ $# -eq 5 ]] || die "usage: <profile.md> <context> <axis> <value> <today> | --validate <profile.md>"
+profile="$1"; context="$2"; axis="$3"; value="$4"; today="$5"
+[[ -f "$profile" ]] || die "profile not found: $profile"
+
+# Token validation — the ADR-086 content-trust boundary. Reject → exit non-zero,
+# original untouched (no write attempted).
+[[ "$CONTEXT_ALLOW" == *" $context "* ]] || die "context not in allowlist: $context"
+[[ "$AXIS_ALLOW" == *" $axis "* ]]       || die "axis not in allowlist: $axis"
+[[ "$value" =~ $VALUE_RE ]]              || die "value must match $VALUE_RE"
+[[ "$today" =~ $DATE_RE ]]               || die "date must match $DATE_RE"
+
+json="$(extract_json "$profile")"
+[[ -n "$json" ]] || die "no machine block in $profile"
+validate_json "$json" || die "existing profile failed validation (refusing to write over a corrupt file)"
+
+new_json="$(echo "$json" | jq -c --arg ctx "$context" --arg axis "$axis" --arg val "$value" --arg today "$today" '
+  ( .entries | map(select(.context==$ctx and .axis==$axis)) | .[0] ) as $ex
+  | ( if ($ex != null) and ($ex.value != $val)
+      then .contradictions += [{context:$ctx, axis:$axis, old_value:$ex.value, new_value:$val, old_count:$ex.reinforce_count, date:$today}]
+      else . end )
+  | .entries = (
+      ( .entries | map(select((.context==$ctx and .axis==$axis) | not)) )
+      + [ { context:$ctx, axis:$axis, value:$val, last_reinforced:$today,
+            reinforce_count: ( if ($ex != null and $ex.value==$val) then ($ex.reinforce_count + 1) else 1 end ) } ]
+    )
+')" || die "jq transform failed"
+[[ -n "$new_json" ]] || die "jq produced empty output"
+
+reviewed="$(fm_field last_reviewed "$profile")"
+cadence="$(fm_field review_cadence "$profile")"
+owner="$(fm_field owner "$profile")"
+
+# lint-trap-ownership: ok — allocates "${profile}.tmp.XXXXXX" BESIDE the target
+# file (never /tmp); mv'd into place on success, rm -f'd on render failure.
+# Residual is one sibling file per SIGKILL inside a two-statement window.
+tmp="$(mktemp "${profile}.tmp.XXXXXX")" || die "mktemp failed"
+if render_file "$tmp" "$reviewed" "$cadence" "$owner" "$today" "$new_json"; then
+  mv -f "$tmp" "$profile"
+else
+  rm -f "$tmp"
+  die "render failed; original preserved"
+fi

package/scripts/taste-profile-update.test.sh

@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+# taste-profile-update.test.sh — fixture harness for the context-keyed taste-profile
+# helper (#5990 · FR7 · ADR-090). Pattern mirrors .claude/hooks/skill-context-queries.test.sh.
+#
+# jq + bash only. Each test builds a fresh fixture profile in a temp dir, runs the
+# helper, and asserts on the resulting file (or exit code). No network, no git needed.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd -P "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+HELPER="$SCRIPT_DIR/taste-profile-update.sh"
+
+pass=0
+fail=0
+pass() { printf '  \033[0;32mPASS\033[0m %s\n' "$1"; pass=$((pass + 1)); }
+fail() { printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; fail=$((fail + 1)); }
+
+TMP_ROOT="$(mktemp -d)"
+trap 'rm -rf "$TMP_ROOT"' EXIT
+
+# Build a fresh seed profile; echoes its path.
+mk_profile() {
+  local d p
+  d="$(mktemp -d "$TMP_ROOT/prof.XXXXXX")"
+  p="$d/taste-profile.md"
+  cat > "$p" <<'EOF'
+---
+last_updated: 2026-07-01
+last_reviewed: 2026-07-01
+review_cadence: quarterly
+owner: CPO
+---
+# Design Taste Profile
+
+<!-- Machine block owned by plugins/soleur/scripts/taste-profile-update.sh — do not hand-edit. -->
+<!-- taste-profile:data:start -->
+```json
+{"schema":1,"entries":[],"contradictions":[]}
+```
+<!-- taste-profile:data:end -->
+
+## Reinforced Aesthetics
+
+_None yet._
+
+## Contradiction Flags
+
+_None yet._
+EOF
+  echo "$p"
+}
+
+# Extract the JSON machine block from a profile file.
+data_of() {
+  awk '/taste-profile:data:start/{f=1;next} /taste-profile:data:end/{f=0} f' "$1" \
+    | sed -e '/^```/d'
+}
+
+echo "== taste-profile-update.sh =="
+
+# 1. Upsert + reinforce (reinforce_count increments; recency date set)
+p="$(mk_profile)"
+bash "$HELPER" "$p" dashboard aesthetic-direction minimalist 2026-07-05 >/dev/null 2>&1
+bash "$HELPER" "$p" dashboard aesthetic-direction minimalist 2026-07-06 >/dev/null 2>&1
+n=$(data_of "$p" | jq '[.entries[] | select(.context=="dashboard" and .value=="minimalist")] | length' 2>/dev/null)
+c=$(data_of "$p" | jq '.entries[] | select(.context=="dashboard" and .value=="minimalist") | .reinforce_count' 2>/dev/null)
+lr=$(data_of "$p" | jq -r '.entries[] | select(.context=="dashboard" and .value=="minimalist") | .last_reinforced' 2>/dev/null)
+if [[ "$n" == "1" && "$c" == "2" && "$lr" == "2026-07-06" ]]; then
+  pass "upsert+reinforce (one entry, count=2, recency updated)"
+else fail "upsert+reinforce (got n=$n count=$c lr=$lr)"; fi
+
+# 2. Same-context contradiction: differing value → contradictions[] entry + supersede
+p="$(mk_profile)"
+bash "$HELPER" "$p" landing-page aesthetic-direction editorial 2026-07-05 >/dev/null 2>&1
+bash "$HELPER" "$p" landing-page aesthetic-direction maximalist 2026-07-06 >/dev/null 2>&1
+cval=$(data_of "$p" | jq -r '.entries[] | select(.context=="landing-page") | .value' 2>/dev/null)
+flag=$(data_of "$p" | jq '[.contradictions[] | select(.context=="landing-page" and .old_value=="editorial" and .new_value=="maximalist")] | length' 2>/dev/null)
+if [[ "$cval" == "maximalist" && "$flag" == "1" ]]; then
+  pass "same-context contradiction flag fires + supersedes (old=editorial→new=maximalist)"
+else fail "same-context contradiction (got value=$cval flag=$flag)"; fi
+
+# 3. Cross-context is NOT a contradiction (dashboard + landing coexist)
+p="$(mk_profile)"
+bash "$HELPER" "$p" dashboard aesthetic-direction minimalist 2026-07-05 >/dev/null 2>&1
+bash "$HELPER" "$p" landing-page aesthetic-direction maximalist 2026-07-06 >/dev/null 2>&1
+ecount=$(data_of "$p" | jq '.entries | length' 2>/dev/null)
+ccount=$(data_of "$p" | jq '.contradictions | length' 2>/dev/null)
+if [[ "$ecount" == "2" && "$ccount" == "0" ]]; then
+  pass "cross-context NON-contradiction (2 entries, 0 flags)"
+else fail "cross-context (got entries=$ecount contradictions=$ccount)"; fi
+
+# 4. Reject out-of-allowlist context (preserve original)
+p="$(mk_profile)"; before="$(cat "$p")"
+if bash "$HELPER" "$p" 'prod; rm -rf /' aesthetic-direction minimalist 2026-07-05 >/dev/null 2>&1; then
+  fail "reject bad context (helper returned 0)"
+else
+  [[ "$(cat "$p")" == "$before" ]] && pass "reject bad context + preserve original" || fail "bad context mutated file"
+fi
+
+# 5. Reject out-of-allowlist axis
+p="$(mk_profile)"; before="$(cat "$p")"
+if bash "$HELPER" "$p" dashboard color-temperature minimalist 2026-07-05 >/dev/null 2>&1; then
+  fail "reject bad axis (helper returned 0)"
+else
+  [[ "$(cat "$p")" == "$before" ]] && pass "reject out-of-allowlist axis + preserve" || fail "bad axis mutated file"
+fi
+
+# 6. Reject metachar/whitespace value
+p="$(mk_profile)"; before="$(cat "$p")"
+if bash "$HELPER" "$p" dashboard aesthetic-direction 'max; touch /tmp/x' 2026-07-05 >/dev/null 2>&1; then
+  fail "reject metachar value (helper returned 0)"
+else
+  [[ "$(cat "$p")" == "$before" ]] && pass "reject metachar value + preserve" || fail "bad value mutated file"
+fi
+
+# 7. Reject malformed date
+p="$(mk_profile)"; before="$(cat "$p")"
+if bash "$HELPER" "$p" dashboard aesthetic-direction minimalist 'yesterday' >/dev/null 2>&1; then
+  fail "reject bad date (helper returned 0)"
+else
+  [[ "$(cat "$p")" == "$before" ]] && pass "reject malformed date + preserve" || fail "bad date mutated file"
+fi
+
+# 8. Freshness: last_updated bumped, last_reviewed byte-unchanged
+p="$(mk_profile)"
+rev_before=$(awk -F': ' '/^last_reviewed:/{print $2; exit}' "$p")
+bash "$HELPER" "$p" docs aesthetic-direction editorial 2026-07-09 >/dev/null 2>&1
+upd=$(awk -F': ' '/^last_updated:/{print $2; exit}' "$p")
+rev_after=$(awk -F': ' '/^last_reviewed:/{print $2; exit}' "$p")
+if [[ "$upd" == "2026-07-09" && "$rev_after" == "$rev_before" ]]; then
+  pass "freshness: last_updated bumped, last_reviewed unchanged"
+else fail "freshness (last_updated=$upd last_reviewed=$rev_after expected_rev=$rev_before)"; fi
+
+# 9. --validate: passes on a clean profile, fails on a tampered one
+p="$(mk_profile)"
+bash "$HELPER" "$p" app-ui aesthetic-direction brutalist 2026-07-05 >/dev/null 2>&1
+if bash "$HELPER" --validate "$p" >/dev/null 2>&1; then pass "--validate passes on clean profile"; else fail "--validate rejected a clean profile"; fi
+# tamper: inject an out-of-allowlist axis directly into the JSON
+python3 - "$p" <<'PY' 2>/dev/null || true
+import re,sys,json
+f=sys.argv[1]; s=open(f).read()
+m=re.search(r'```json\n(.*?)\n```', s, re.S)
+d=json.loads(m.group(1)); d["entries"].append({"context":"docs","axis":"evil-axis","value":"x","last_reinforced":"2026-07-05","reinforce_count":1})
+s=s[:m.start(1)]+json.dumps(d)+s[m.end(1):]; open(f,"w").write(s)
+PY
+if bash "$HELPER" --validate "$p" >/dev/null 2>&1; then fail "--validate passed a tampered profile"; else pass "--validate fails on tampered profile"; fi
+
+# 9b. --validate also covers contradictions[] (not just entries[]) — the consumer
+# read-path trust gate must certify the whole machine block (security P3-1 / user-impact F2).
+p="$(mk_profile)"
+bash "$HELPER" "$p" landing-page aesthetic-direction editorial 2026-07-05 >/dev/null 2>&1
+python3 - "$p" <<'PY' 2>/dev/null || true
+import re,sys,json
+f=sys.argv[1]; s=open(f).read()
+m=re.search(r'```json\n(.*?)\n```', s, re.S)
+d=json.loads(m.group(1)); d["contradictions"].append({"context":"landing-page","axis":"aesthetic-direction","old_value":"editorial; rm -rf /","new_value":"maximalist","old_count":1,"date":"2026-07-06"})
+s=s[:m.start(1)]+json.dumps(d)+s[m.end(1):]; open(f,"w").write(s)
+PY
+if bash "$HELPER" --validate "$p" >/dev/null 2>&1; then fail "--validate passed a poisoned contradictions[] entry"; else pass "--validate fails on poisoned contradictions[] (whole-block coverage)"; fi
+
+# 10. No decay/confidence tokens in the helper source (recency, not numeric decay)
+if grep -qiE 'halflife|confidence|decay_' "$HELPER" 2>/dev/null; then
+  fail "helper contains decay/confidence tokens"
+else pass "helper is recency-only (no decay/confidence tokens)"; fi
+
+echo ""
+echo "== $pass passed, $fail failed =="
+[[ "$fail" -eq 0 ]] || exit 1

package/scripts/write-budget-marker.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# write-budget-marker.sh <dim> — write the classified `budget-capped` artifact
+# for a ship/merge-pr phase-7 poll gate STOP (#9403). Emits nothing; exits 0
+# always (fail-open like the tally itself). Extracted so the ship↔merge-pr
+# mirror carries one implementation, not a byte-copied block.
+set -uo pipefail
+
+dim="${1:?usage: write-budget-marker.sh <dim>}"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+show="$(bash "$ROOT/scripts/pipeline-tally.sh" show 2>/dev/null || true)"
+cnt="$(printf '%s\n' "$show" | grep -o "${dim}=[0-9]*" | head -1 | cut -d= -f2 || true)"
+cap="$(printf '%s\n' "$show" | grep -o "cap:${dim}=[0-9]*" | head -1 | cut -d= -f2 || true)"
+# $() strips the newline before tr sees it; tr inside the substitution would
+# map it to a stray '-'. Marker lands in the specs/<feature>/ dir the resume
+# contract greps — the same shape the skills' classified-stop blocks write.
+b="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
+ss="knowledge-base/project/specs/$(printf '%s' "${b:-HEAD}" | tr -c 'A-Za-z0-9._-' '-')"
+mkdir -p "$ss" 2>/dev/null \
+  && printf 'status: budget-capped\nbudget-capped: %s=%s/%s\nresume: bash "%s/scripts/pipeline-tally.sh" init --max-%s <N>, then re-run the skill\n' \
+       "$dim" "${cnt:-0}" "${cap:-0}" "$ROOT" "$(printf '%s' "$dim" | tr '_' '-')" \
+       >> "$ss/session-state.md" || true
+exit 0