@soleur/opencode 0.0.0-stage → 3.354.2

package/skills/constraint-scaffold/test/emit-fix-constraints.test.sh

@@ -0,0 +1,193 @@
+#!/usr/bin/env bash
+# Emitter coverage for the two-stage `fix-constraints` recovery dispatcher (#5814, ADR-074).
+# Proves constraint-scaffold.sh emits BOTH stage workflows (Stage A = untrusted pull_request
+# producer; Stage B = privileged workflow_run consumer) into the target, refuses to overwrite,
+# fully substitutes __TARGET_DIR__, and that the security-load-bearing structural invariants
+# hold: Stage A is NOT the privileged issue_comment/pull_request_target trigger; Stage B never
+# checks out the untrusted tree / never bun-installs / never git-applies; and Stage A's `name:`
+# is coupled to Stage B's `on: workflow_run: workflows:` filter (a mismatch silently disables
+# recovery). Hermetic: every fixture is a throwaway `git init` repo under a mktemp dir targeted
+# via CONSTRAINT_SCAFFOLD_REPO_ROOT; the real apps/web-platform tree is never touched. No
+# dependency-cruiser needed — the emit (cp/sed) happens BEFORE baseline capture, so a
+# default-mode run writes the workflows and then bails at the origin/main merge-base step.
+#
+# Runs in the scripts shard (scripts/test-all.sh globs
+# plugins/soleur/skills/*/test/*.test.sh). Accumulate-then-exit; command-substitutions that
+# run grep/sed are guarded with `|| true` so `set -e` does not abort before fail() prints.
+set -euo pipefail
+
+REPO_ROOT="$(git -C "$(dirname "${BASH_SOURCE[0]}")" rev-parse --show-toplevel)"
+GEN="$REPO_ROOT/plugins/soleur/skills/constraint-scaffold/scripts/constraint-scaffold.sh"
+FIX_A="apps/web-platform/.github/workflows/fix-constraints-stage-a.yml"
+FIX_B="apps/web-platform/.github/workflows/fix-constraints-stage-b.yml"
+
+passes=0
+fails=0
+pass() { printf 'ok   - %s\n' "$1"; passes=$((passes + 1)); }
+fail() { printf 'FAIL - %s\n' "$1"; fails=$((fails + 1)); }
+
+TMPROOT="$(mktemp -d)"
+trap 'rm -rf "$TMPROOT"' EXIT
+# Hermetic git environment for the fixtures (the repo's chokepoint, #7849): a developer
+# commit.gpgsign / signing key / GIT_DIR must not reach the fixture commits or the scaffold under test.
+# shellcheck source=../../../test/lib/git-fixture-env.sh
+source "$REPO_ROOT/plugins/soleur/test/lib/git-fixture-env.sh"
+mkdir -p "$TMPROOT/anchor"
+git_fixture_env "$TMPROOT/anchor" || { echo "FATAL: git_fixture_env refused $TMPROOT/anchor" >&2; exit 1; }
+
+# Throwaway git repo with a valid Next.js-shaped app dir, committed clean, origin/main == HEAD, and
+# a fixture-owned stub `depcruise` (baseline -> [], clean err -> rc 0, probe err -> both rules on
+# their edges, rc 1) so a default-mode run COMPLETES. Since #8288 a run that fails anywhere after
+# the first write removes every artifact it emitted, so the workflows can only be observed after a
+# run that reaches exit 0 — the pre-#8288 "assert on the artifacts a failed run left behind" is the
+# residue class that PR closed.
+make_repo() {
+  local fx="$TMPROOT/$1"
+  mkdir -p "$fx/apps/web-platform/app" "$fx/apps/web-platform/components" "$fx/apps/web-platform/server"
+  git -C "$fx" init -q
+  git -C "$fx" config user.email "test@example.com"
+  git -C "$fx" config user.name "test"
+  printf 'node_modules\n' > "$fx/.gitignore"
+  printf 'module.exports = {};\n' > "$fx/apps/web-platform/next.config.js"
+  printf '{ "dependencies": { "next": "15.0.0" } }\n' > "$fx/apps/web-platform/package.json"
+  printf 'export default function Page() { return null; }\n' > "$fx/apps/web-platform/app/page.tsx"
+  printf '"use client";\nexport const G = () => "g";\n' > "$fx/apps/web-platform/components/g.tsx"
+  printf 'export const APP = "fixture";\n' > "$fx/apps/web-platform/server/config.ts"
+  git -C "$fx" add -A
+  git -C "$fx" commit -q -m "seed app"
+  git -C "$fx" update-ref refs/remotes/origin/main HEAD
+  local stub="$TMPROOT/stub-$1"
+  mkdir -p "$stub/.bin" "$stub/dependency-cruiser"
+  printf '{ "name": "dependency-cruiser", "version": "0.0.0-stub" }\n' > "$stub/dependency-cruiser/package.json"
+  cat > "$stub/.bin/depcruise" <<'STUB'
+#!/usr/bin/env bash
+case " $* " in
+  *" --output-type json "*)     printf '{"modules":[]}\n' ;;
+  *" --output-type baseline "*) printf '[]\n' ;;
+  *" --output-type err "*)
+    if [[ -e components/__constraint_scaffold_bite_probe__/direct.tsx ]]; then
+      printf '\n  error no-client-to-server-secret-transitive: components/__constraint_scaffold_bite_probe__/via-hop.tsx → server/__constraint_scaffold_bite_probe__.ts\n  error no-client-to-server-secret: components/__constraint_scaffold_bite_probe__/direct.tsx → server/__constraint_scaffold_bite_probe__.ts\n\nx 2 dependency violations (2 errors, 0 warnings). 5 modules, 3 dependencies cruised.\n'
+      exit 1
+    fi
+    printf '\n✔ no dependency violations found (1 modules, 0 dependencies cruised)\n\n'; exit 0 ;;
+  *) echo "stub depcruise: unhandled argv: $*" >&2; exit 64 ;;
+esac
+STUB
+  chmod +x "$stub/.bin/depcruise"
+  ln -s "$stub" "$fx/apps/web-platform/node_modules"
+  printf '%s' "$fx"
+}
+
+# --- Emit: default mode writes BOTH stage workflows -------------------------------------
+FX="$(make_repo emit)"
+set +e
+CONSTRAINT_SCAFFOLD_REPO_ROOT="$FX" TMPDIR="$TMPROOT" bash "$GEN" >"$TMPROOT/emit.out" 2>"$TMPROOT/emit.err"
+EMIT_RC=$?
+set -e
+# The run must COMPLETE (rc 0) for the artifacts to remain; a non-zero rc here is a real failure.
+if [[ "$EMIT_RC" == "0" ]]; then
+  pass "emit: default mode completed (rc 0) against the stub toolchain"
+else
+  fail "emit: default mode rc=$EMIT_RC (stdout: $(tail -2 "$TMPROOT/emit.out" | tr '\n' ' '))"
+fi
+for pair in "A:$FIX_A" "B:$FIX_B"; do
+  stage="${pair%%:*}"; rel="${pair#*:}"
+  if [[ -f "$FX/$rel" ]]; then
+    pass "emit: Stage $stage ($rel) written to the target"
+  else
+    fail "emit: Stage $stage ($rel) NOT written (run rc=$EMIT_RC)"
+  fi
+done
+
+# __TARGET_DIR__ must be fully substituted (no residual placeholder) in both stages.
+for pair in "A:$FIX_A" "B:$FIX_B"; do
+  stage="${pair%%:*}"; rel="${pair#*:}"
+  if grep -q '__TARGET_DIR__' "$FX/$rel" 2>/dev/null; then
+    fail "emit: __TARGET_DIR__ left UNSUBSTITUTED in Stage $stage"
+  else
+    pass "emit: __TARGET_DIR__ fully substituted in Stage $stage"
+  fi
+done
+
+# Runner path substituted to the target dir in Stage A (the gate it runs).
+if grep -qF 'bash apps/web-platform/scripts/constraint-gates.sh' "$FX/$FIX_A" 2>/dev/null; then
+  pass "emit: Stage A runner path substituted to the target dir (apps/web-platform)"
+else
+  fail "emit: substituted runner path not found in Stage A"
+fi
+
+# --- Trigger anchors (on syntactic `on:`-block keys, NOT header prose) ---------------
+# Stage A is the UNTRUSTED pull_request producer — never the privileged issue_comment /
+# pull_request_target trigger (the whole point of the redesign). Anchor on 2-space indent.
+if grep -qE '^[[:space:]]{2}pull_request:' "$FX/$FIX_A" 2>/dev/null; then
+  pass "trigger: Stage A fires on pull_request (anchored on:-block key)"
+else
+  fail "trigger: Stage A missing the pull_request trigger block"
+fi
+if grep -qE '^[[:space:]]{2}(issue_comment|pull_request_target|workflow_run):' "$FX/$FIX_A" 2>/dev/null; then
+  fail "trigger: Stage A declares a privileged/consumer trigger (issue_comment/pull_request_target/workflow_run) — must not"
+else
+  pass "trigger: Stage A declares no privileged issue_comment/pull_request_target (nor workflow_run) trigger"
+fi
+# Stage B is the PRIVILEGED workflow_run consumer — never an untrusted PR trigger.
+if grep -qE '^[[:space:]]{2}workflow_run:' "$FX/$FIX_B" 2>/dev/null; then
+  pass "trigger: Stage B fires on workflow_run (anchored on:-block key)"
+else
+  fail "trigger: Stage B missing the workflow_run trigger block"
+fi
+if grep -qE '^[[:space:]]{2}(pull_request|pull_request_target|issue_comment):' "$FX/$FIX_B" 2>/dev/null; then
+  fail "trigger: Stage B declares an untrusted PR trigger — must only be workflow_run"
+else
+  pass "trigger: Stage B declares no untrusted pull_request/issue_comment trigger"
+fi
+
+# --- Forbidden-pattern: Stage B never executes the untrusted tree --------------------
+# Stage B builds the commit via the Git Data API — no checkout of head, no git apply, no
+# bun install, no PR-script execution. The header/shell COMMENTS in Stage B legitimately
+# NAME these constructs ("never git-applies", "never runs bun install"), so strip comment
+# lines (both YAML `#` and shell `#`) before grepping the executable body.
+B_CODE="$(grep -vE '^[[:space:]]*#' "$FX/$FIX_B" || true)"
+# checkout is a `uses:` step — anchor on the action ref (comments have no `uses:`).
+if grep -qE '(^|[[:space:]-])uses:[[:space:]]*actions/checkout' "$FX/$FIX_B" 2>/dev/null; then
+  fail "forbidden: Stage B contains an actions/checkout step (must never check out any tree)"
+else
+  pass "forbidden: Stage B has no actions/checkout step (Git Data API only)"
+fi
+for tok in 'bun install' 'setup-bun' 'git apply'; do
+  if printf '%s\n' "$B_CODE" | grep -cF >/dev/null "$tok" 2>/dev/null; then
+    fail "forbidden: Stage B executable body contains '$tok' (must never run it)"
+  else
+    pass "forbidden: Stage B executable body has no '$tok'"
+  fi
+done
+
+# --- Name-coupling: Stage A `name:` == Stage B `workflows:` filter string ------------
+# The `workflows:` filter matches a workflow's `name:` field, NOT its filename — a mismatch
+# makes Stage B silently NEVER trigger (no error). Load-bearing (architecture-strategist P1).
+A_NAME="$(grep -E '^name:' "$FX/$FIX_A" 2>/dev/null | head -1 | sed -E 's/^name:[[:space:]]*//' || true)"
+B_WF="$(grep -E '^[[:space:]]+workflows:' "$FX/$FIX_B" 2>/dev/null | head -1 | sed -E 's/.*workflows:[[:space:]]*\[[[:space:]]*"?([^]"]*)"?[[:space:]]*\].*/\1/' || true)"
+if [[ -n "$A_NAME" && "$A_NAME" == "$B_WF" ]]; then
+  pass "name-coupling: Stage A name: ('$A_NAME') == Stage B workflows: filter ('$B_WF')"
+else
+  fail "name-coupling: Stage A name: ('$A_NAME') != Stage B workflows: filter ('$B_WF') — Stage B would never trigger"
+fi
+
+# --- Refuse-if-exists: a pre-existing stage file blocks the emit (exit 66) -----------
+FX2="$(make_repo refuse)"
+: "${FX2:?fixture dir is empty; git -C <empty> would retarget this write}"
+mkdir -p "$(dirname "$FX2/$FIX_A")"
+printf '# already here\n' > "$FX2/$FIX_A"
+git -C "$FX2" add -A && git -C "$FX2" commit -q -m "pre-place fix-constraints-stage-a"
+set +e
+REFUSE_OUT="$(CONSTRAINT_SCAFFOLD_REPO_ROOT="$FX2" bash "$GEN" 2>&1)"
+REFUSE_RC=$?
+set -e
+if [[ "$REFUSE_RC" == "66" ]] && printf '%s' "$REFUSE_OUT" | grep -c >/dev/null 'fix-constraints-stage-a.yml already present'; then
+  pass "refuse: pre-existing fix-constraints-stage-a.yml triggers refuse-if-exists (exit 66)"
+else
+  fail "refuse: expected exit 66 naming fix-constraints-stage-a.yml, got rc=$REFUSE_RC: $REFUSE_OUT"
+fi
+
+echo "---"
+echo "emit-fix-constraints.test.sh: $passes passed, $fails failed"
+[[ "$fails" -eq 0 ]]

package/skills/constraint-scaffold/test/generator.test.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Generator-script coverage for constraint-scaffold.sh (ADR-071). Exercises the
+# script's guard/exit-matrix paths against HERMETIC fixture repos — the real
+# apps/web-platform emitted files are never read or written. Each fixture is a
+# throwaway `git init` repo under a mktemp dir, targeted via the
+# CONSTRAINT_SCAFFOLD_REPO_ROOT override. None of these paths reach baseline
+# capture (they bail at a precondition/guard), so dependency-cruiser is not
+# needed.
+#
+# Covers:
+#   exit 65  not-a-Next.js-app detection (no next.config / no anchored "next").
+#   exit 66  refuse-if-exists: default mode on an already-emitted tree.
+#   exit 67  --refresh-baseline on a dirty working tree refuses.
+#
+# Runs in the scripts shard (scripts/test-all.sh globs
+# plugins/soleur/skills/*/test/*.test.sh). Accumulate-then-exit.
+set -euo pipefail
+
+REPO_ROOT="$(git -C "$(dirname "${BASH_SOURCE[0]}")" rev-parse --show-toplevel)"
+GEN="$REPO_ROOT/plugins/soleur/skills/constraint-scaffold/scripts/constraint-scaffold.sh"
+
+passes=0
+fails=0
+pass() { printf 'ok   - %s\n' "$1"; passes=$((passes + 1)); }
+fail() { printf 'FAIL - %s\n' "$1"; fails=$((fails + 1)); }
+
+TMPROOT="$(mktemp -d)"
+trap 'rm -rf "$TMPROOT"' EXIT
+
+# Build a throwaway git repo with an apps/web-platform-shaped app dir. $1 = name,
+# $2 = "next" to make it a valid Next.js app (next.config + anchored "next" dep).
+make_repo() {
+  local fx="$TMPROOT/$1"
+  mkdir -p "$fx/apps/web-platform/app"
+  git -C "$fx" init -q
+  git -C "$fx" config user.email "test@example.com"
+  git -C "$fx" config user.name "test"
+  if [[ "${2:-}" == "next" ]]; then
+    printf 'module.exports = {};\n' > "$fx/apps/web-platform/next.config.js"
+    printf '{ "dependencies": { "next": "15.0.0" } }\n' > "$fx/apps/web-platform/package.json"
+  fi
+  printf '%s' "$fx"
+}
+
+run_gen() {
+  # $1 = repo root, rest = args. Captures rc; never aborts the suite.
+  local root="$1"; shift
+  set +e
+  CONSTRAINT_SCAFFOLD_REPO_ROOT="$root" bash "$GEN" "$@" >/dev/null 2>&1
+  local rc=$?
+  set -e
+  printf '%s' "$rc"
+}
+
+# --- exit 65: not a Next.js app ----------------------------------------------
+FX="$(make_repo notnext)"   # no next.config, no package.json
+RC="$(run_gen "$FX")"
+if [[ "$RC" == "65" ]]; then
+  pass "exit 65: not-a-Next.js-app detected (no next.config / anchored \"next\")"
+else
+  fail "exit 65 expected for non-Next.js target, got rc=$RC"
+fi
+
+# --- exit 66: refuse-if-exists (default mode on an already-emitted tree) ------
+FX="$(make_repo emitted next)"
+# Pre-place an emitted artifact (untracked -> the clean-tree guard still passes,
+# since git diff ignores untracked files) so refuse-if-exists fires.
+printf '// already here\n' > "$FX/apps/web-platform/.dependency-cruiser.cjs"
+RC="$(run_gen "$FX")"
+if [[ "$RC" == "66" ]]; then
+  pass "exit 66: default mode refuses when an artifact already exists (no --force)"
+else
+  fail "exit 66 expected for already-emitted tree, got rc=$RC"
+fi
+
+# --- exit 67: --refresh-baseline on a dirty tree refuses ----------------------
+FX="$(make_repo dirty next)"
+: "${FX:?fixture dir is empty; git -C <empty> would retarget this write}"
+printf '// gate config\n' > "$FX/apps/web-platform/.dependency-cruiser.cjs"
+git -C "$FX" add apps/web-platform
+git -C "$FX" commit -q -m "seed gate"
+# Dirty a TRACKED file so `git diff --quiet` reports the tree dirty.
+printf '// edited\n' >> "$FX/apps/web-platform/.dependency-cruiser.cjs"
+RC="$(run_gen "$FX" --refresh-baseline)"
+if [[ "$RC" == "67" ]]; then
+  pass "exit 67: --refresh-baseline refuses on a dirty working tree"
+else
+  fail "exit 67 expected for --refresh-baseline on dirty tree, got rc=$RC"
+fi
+
+echo "---"
+echo "generator.test.sh: $passes passed, $fails failed"
+[[ "$fails" -eq 0 ]]

package/skills/constraint-scaffold/test/parity.test.sh

@@ -0,0 +1,285 @@
+#!/usr/bin/env bash
+# Template <-> emission parity for the constraint-scaffold L1 gate (ADR-071).
+#
+# The dependency-cruiser config and the shared runner are emitted as
+# BYTE-IDENTICAL copies of the skill's templates; the CI workflow is a single
+# `sed __TARGET_DIR__ -> apps/web-platform` substitution of the workflow
+# template; and the repo-root dogfood gate lives folded as `jobs.constraint-gates` inside
+# `.github/workflows/pr-quality-guards.yml` (#8902) — structurally compared to the template job. ANY edit to a template
+# MUST be mirrored into every emitted copy (and vice-versa), or the gate Soleur
+# ships diverges from the gate Soleur tests. This test fails loud on any drift.
+#
+# Runs in the scripts shard (scripts/test-all.sh globs
+# plugins/soleur/skills/*/test/*.test.sh). Accumulate-then-exit; diff
+# command-substitutions are guarded with `|| true` so `set -e` does not abort
+# before fail() prints.
+set -euo pipefail
+
+REPO_ROOT="$(git -C "$(dirname "${BASH_SOURCE[0]}")" rev-parse --show-toplevel)"
+REF="$REPO_ROOT/plugins/soleur/skills/constraint-scaffold/references"
+APP="$REPO_ROOT/apps/web-platform"
+TARGET_DIR="apps/web-platform"
+
+passes=0
+fails=0
+# The INDEPENDENT row counter (ADR-193 #2). Incremented at every CALL SITE, never inside
+# pass()/fail() — the VERDICT helpers touch only the verdict counters — so a stubbed fail() drops
+# a verdict without dropping its count and the conservation check below notices. Top level only,
+# never inside a `$( … )`.
+cases=0
+pass() { printf 'ok   - %s\n' "$1"; passes=$((passes + 1)); }
+fail() { printf 'FAIL - %s\n' "$1"; fails=$((fails + 1)); }
+# Instrument self-test — DIRECTION, not only presence (a fail() misrouted to `passes` keeps the
+# conservation check and the floor green). Reported via printf >&2 + exit 1, never through the
+# helper it checks (ADR-193).
+fail "instrument self-test (expected — proves fail() records a FAILURE)" >/dev/null
+pass "instrument self-test (expected — proves pass() records a PASS)" >/dev/null
+if [[ "$fails" != "1" || "$passes" != "1" ]]; then
+  printf '[FATAL] HELPER CONTROL BROKEN: after one fail() and one pass(), fails=%s passes=%s (want 1/1)\n' "$fails" "$passes" >&2
+  exit 1
+fi
+passes=0; fails=0
+
+# 1. dependency-cruiser config — byte-identical to the template.
+D="$(diff "$REF/depcruise-config.template" "$APP/.dependency-cruiser.cjs" 2>&1 || true)"
+cases=$((cases + 1))
+if [[ -z "$D" ]]; then
+  pass ".dependency-cruiser.cjs is byte-identical to depcruise-config.template"
+else
+  fail ".dependency-cruiser.cjs DIVERGES from depcruise-config.template"
+  printf '%s\n' "$D" | sed 's/^/    /'
+fi
+
+# 2. shared runner — byte-identical to the template.
+D="$(diff "$REF/shared-runner.template" "$APP/scripts/constraint-gates.sh" 2>&1 || true)"
+cases=$((cases + 1))
+if [[ -z "$D" ]]; then
+  pass "scripts/constraint-gates.sh is byte-identical to shared-runner.template"
+else
+  fail "scripts/constraint-gates.sh DIVERGES from shared-runner.template"
+  printf '%s\n' "$D" | sed 's/^/    /'
+fi
+
+# 3. apps/web-platform workflow == sed(__TARGET_DIR__ -> apps/web-platform) of the template.
+SUBST="$(sed "s|__TARGET_DIR__|$TARGET_DIR|g" "$REF/constraint-gates-workflow.template")"
+D="$(printf '%s\n' "$SUBST" | diff - "$APP/.github/workflows/constraint-gates.yml" 2>&1 || true)"
+cases=$((cases + 1))
+if [[ -z "$D" ]]; then
+  pass "apps/web-platform workflow == sed(__TARGET_DIR__) of the workflow template"
+else
+  fail "apps/web-platform workflow DIVERGES from the substituted template"
+  printf '%s\n' "$D" | sed 's/^/    /'
+fi
+
+# 4. The folded repo-root gate == the template's constraint-gates job. Since
+#    #8902 the dogfood instance lives as `jobs.constraint-gates` inside
+#    `.github/workflows/pr-quality-guards.yml` (the standalone root file was
+#    folded into the shared PR-gates workflow). Structural compare: parse both
+#    sides, drop the fold-added `if:` (PR-only gate — the template file has no
+#    merge_group so the arm is equivalent), and diff canonical YAML.
+strip_body() { grep -vE '^[[:space:]]*#' | grep -vE '^[[:space:]]*$' || true; }
+D="$(python3 - "$SUBST" "$REPO_ROOT/.github/workflows/pr-quality-guards.yml" <<'PY' 2>&1 || true
+import sys, yaml
+tmpl = yaml.safe_load(sys.argv[1])["jobs"]["constraint-gates"]
+root = yaml.safe_load(open(sys.argv[2]))["jobs"]["constraint-gates"]
+root.pop("if", None)  # fold-added: host file merges merge_group; job is PR-only
+a = yaml.safe_dump(tmpl, sort_keys=True)
+b = yaml.safe_dump(root, sort_keys=True)
+if a != b:
+    import difflib
+    print("\n".join(difflib.unified_diff(a.splitlines(), b.splitlines(),
+          "template.jobs.constraint-gates", "pr-quality-guards.jobs.constraint-gates",
+          lineterm="")))
+PY
+)"
+cases=$((cases + 1))
+if [[ -z "$D" ]]; then
+  pass "jobs.constraint-gates in pr-quality-guards.yml == substituted template job"
+else
+  fail "jobs.constraint-gates in pr-quality-guards.yml DIVERGES from template job"
+  printf '%s\n' "$D" | sed 's/^/    /'
+fi
+
+# 5. repo-root dogfood Stage B == sed(__TARGET_DIR__) of the Stage B template (comment-stripped
+#    body). Stage B is the PRIVILEGED, write-capable recovery consumer and carries the entire
+#    fork-defense (isCrossRepository gate, path allowlist, sha256 round-trip, mandatory
+#    base_tree); it has NO intentional dogfood divergence, so its body must match the tenant
+#    template exactly. Guards the silent-drift class the emit test — which only inspects emitted
+#    tenant fixtures, never the committed repo-root dogfood — structurally cannot catch (#5814).
+B_ROOT="$REPO_ROOT/.github/workflows/fix-constraints-stage-b.yml"
+STAGE_B_SUBST="$(sed "s|__TARGET_DIR__|$TARGET_DIR|g" "$REF/fix-constraints-stage-b.template")"
+ROOT_B_BODY="$(strip_body < "$B_ROOT")"
+TMPL_B_BODY="$(printf '%s\n' "$STAGE_B_SUBST" | strip_body)"
+D="$(diff <(printf '%s\n' "$ROOT_B_BODY") <(printf '%s\n' "$TMPL_B_BODY") 2>&1 || true)"
+cases=$((cases + 1))
+if [[ -z "$D" ]]; then
+  pass "repo-root fix-constraints-stage-b body == substituted Stage B template body"
+else
+  fail "repo-root fix-constraints-stage-b DIVERGES from the substituted template body"
+  printf '%s\n' "$D" | sed 's/^/    /'
+fi
+
+# 6. Dogfood security invariants on the two repo-root recovery workflows. Stage A intentionally
+#    diverges from its template (dogfood-only api-spend steps + a richer anthropic-preflight
+#    composite), so it gets invariant assertions rather than a body diff.
+A_ROOT="$REPO_ROOT/.github/workflows/fix-constraints-stage-a.yml"
+
+# 6a. Name-coupling: Stage A `name:` == Stage B `workflows:` filter (workflow_run matches by the
+#     workflow's name, NOT its filename — a drift makes Stage B silently never trigger).
+A_NAME="$(grep -E '^name:' "$A_ROOT" | head -1 | sed -E 's/^name:[[:space:]]*//' || true)"
+B_WF="$(grep -E '^[[:space:]]+workflows:' "$B_ROOT" | head -1 | sed -E 's/.*workflows:[[:space:]]*\[[[:space:]]*"?([^]"]*)"?[[:space:]]*\].*/\1/' || true)"
+cases=$((cases + 1))
+if [[ -n "$A_NAME" && "$A_NAME" == "$B_WF" ]]; then
+  pass "dogfood name-coupling: Stage A name: ('$A_NAME') == Stage B workflows: filter"
+else
+  fail "dogfood name-coupling BROKEN: Stage A name: ('$A_NAME') != Stage B workflows: ('$B_WF') — Stage B would never trigger"
+fi
+
+# 6a'. The same coupling on the TEMPLATES a founder repo receives: template A `name:` == template B
+#      `workflows:` filter (the dogfood pair above can hold while the emitted pair drifts).
+TA_NAME="$(grep -E '^name:' "$REF/fix-constraints-stage-a.template" | head -1 | sed -E 's/^name:[[:space:]]*//' || true)"
+TB_WF="$(grep -E '^[[:space:]]+workflows:' "$REF/fix-constraints-stage-b.template" | head -1 | sed -E 's/.*workflows:[[:space:]]*\[[[:space:]]*"?([^]"]*)"?[[:space:]]*\].*/\1/' || true)"
+cases=$((cases + 1))
+if [[ -n "$TA_NAME" && "$TA_NAME" == "$TB_WF" ]]; then
+  pass "template name-coupling: Stage A template name: ('$TA_NAME') == Stage B template workflows: filter"
+else
+  fail "template name-coupling BROKEN: Stage A template name: ('$TA_NAME') != Stage B template workflows: ('$TB_WF')"
+fi
+
+# 6b. Stage B (privileged) executes no untrusted tree: no checkout-of-head / bun install /
+#     git apply in its executable body (full-line comments stripped so the header's prose that
+#     NAMES these constructs cannot false-match).
+B_CODE="$(grep -vE '^[[:space:]]*#' "$B_ROOT" || true)"
+bfail=0
+if grep -qE '(^|[[:space:]-])uses:[[:space:]]*actions/checkout' "$B_ROOT"; then bfail=1; fi
+for tok in 'bun install' 'setup-bun' 'git apply'; do
+  if printf '%s\n' "$B_CODE" | grep -cF >/dev/null "$tok"; then bfail=1; fi
+done
+cases=$((cases + 1))
+if [[ "$bfail" -eq 0 ]]; then
+  pass "dogfood Stage B executes no untrusted tree (no checkout/bun-install/git-apply)"
+else
+  fail "dogfood Stage B contains a forbidden execution construct (checkout/bun-install/git-apply)"
+fi
+
+# 6c. Stage A (untrusted producer) is read-only: declares contents: read, never contents: write.
+cases=$((cases + 1))
+if grep -qE '^[[:space:]]*contents:[[:space:]]*read' "$A_ROOT" && ! grep -qE '^[[:space:]]*contents:[[:space:]]*write' "$A_ROOT"; then
+  pass "dogfood Stage A is read-only (contents: read, no contents: write)"
+else
+  fail "dogfood Stage A permission drift: expected contents: read only, found a write scope"
+fi
+
+# 7. Dogfood README block == the EMITTER's transform of boundary-readme.template (first-line
+#    attribution stripped, __TARGET_DIR__ substituted). `-s` FIRST: a `diff` of two empty
+#    operands passes, which is the parity vacuity that matters. The strip expression is pinned by
+#    `grep -cF` against the script's `content="$(sed …` ASSIGNMENT (a stale comment quoting the
+#    expression cannot stand in for the live one) so the two copies of the one transform cannot
+#    diverge silently. The comparison normalises trailing newlines exactly as the emitter does
+#    (`content="$(…)"` then `printf '%s\n'`), so a template ending in 0 or 2 newlines compares
+#    against what the emitter actually writes.
+README_TMPL="$REF/boundary-readme.template"
+README_DOG="$APP/server/README.md"
+STRIP_EXPR="sed -e '1{/^<!-- Inspired by /d;}' -e \"s|__TARGET_DIR__|\$TARGET_REL|g\""
+GEN_SCRIPT="$REPO_ROOT/plugins/soleur/skills/constraint-scaffold/scripts/constraint-scaffold.sh"
+STRIP_PIN="$(grep -E '^\s*content="\$\(sed ' "$GEN_SCRIPT" 2>/dev/null | grep -cF -- "$STRIP_EXPR" || true)"
+D=""
+if [[ ! -s "$README_TMPL" ]]; then
+  D="template $README_TMPL is missing or empty"
+elif [[ ! -s "$README_DOG" ]]; then
+  D="dogfood $README_DOG is missing or empty"
+elif [[ "$STRIP_PIN" != "1" ]]; then
+  D="strip expression pin: the script contains the literal emitter expression $STRIP_PIN time(s), expected exactly 1"
+elif ! head -1 "$README_TMPL" | grep -c >/dev/null '^<!-- Inspired by '; then
+  D="template line 1 is not the attribution comment (the emitter strips exactly that line)"
+else
+  EXPECTED_README="$(sed -e '1{/^<!-- Inspired by /d;}' -e "s|__TARGET_DIR__|$TARGET_DIR|g" "$README_TMPL")"
+  D="$(printf '%s\n' "$EXPECTED_README" | diff - "$README_DOG" 2>&1 || true)"
+fi
+cases=$((cases + 1))
+if [[ -z "$D" ]]; then
+  pass "apps/web-platform/server/README.md == emitter transform of boundary-readme.template (non-empty; strip expression pinned)"
+else
+  fail "apps/web-platform/server/README.md DIVERGES from the template transform"
+  printf '%s\n' "$D" | sed 's/^/    /'
+fi
+
+# 8. Repo-root CLAUDE.md carries the pointer marker EXACTLY once, on a line naming the dogfood
+#    README path, with no `@apps/` import form (an `@path` line is a Claude Code import and would
+#    load the README into every session). Four selections for a four-dimension claim.
+CLAUDE_MD="$REPO_ROOT/CLAUDE.md"
+POINTER_MARKER='<!-- constraint-scaffold:pointer -->'
+PTR_CT="$(grep -c -- "$POINTER_MARKER" "$CLAUDE_MD" 2>/dev/null || true)"
+PTR_LINE="$(grep -- "$POINTER_MARKER" "$CLAUDE_MD" 2>/dev/null | head -1 || true)"
+D=""
+if [[ ! -s "$CLAUDE_MD" ]]; then
+  D="CLAUDE.md is missing or empty"
+elif [[ "$PTR_CT" != "1" ]]; then
+  D="pointer marker appears $PTR_CT time(s), expected exactly 1"
+elif [[ "$PTR_LINE" != *"apps/web-platform/server/README.md"* ]]; then
+  D="pointer line does not name apps/web-platform/server/README.md: '$PTR_LINE'"
+elif [[ "$PTR_LINE" == *"@apps/"* ]]; then
+  D="pointer line uses the forbidden @apps/ import form: '$PTR_LINE'"
+fi
+cases=$((cases + 1))
+if [[ -z "$D" ]]; then
+  pass "CLAUDE.md carries the constraint-scaffold pointer once, naming the README path, without @apps/"
+else
+  fail "CLAUDE.md pointer: $D"
+fi
+
+# 9. Emission census: every `cp`/`sed` of a `$REF_DIR/*.template` in the script's default-mode
+#    emit block has a parity row above (rows 1–5 read one template each; the README template is
+#    row 7). A sixth emitted template with no dogfood row would otherwise red nothing here.
+EMITTED_TEMPLATES="$(grep -oE '"\$REF_DIR/[a-z-]+\.template"' "$GEN_SCRIPT" 2>/dev/null | sort -u | grep -c . || true)"
+ROW_TEMPLATES="$(grep -oE '"\$REF/[a-z-]+\.template"' "${BASH_SOURCE[0]}" | sort -u | grep -c . || true)"
+cases=$((cases + 1))
+if [[ "$EMITTED_TEMPLATES" -ge 6 && "$EMITTED_TEMPLATES" == "$ROW_TEMPLATES" ]]; then
+  pass "emission census: the script reads $EMITTED_TEMPLATES distinct templates and this suite has a row for each"
+else
+  fail "emission census: script reads $EMITTED_TEMPLATES distinct templates, this suite reads $ROW_TEMPLATES (want equal, >= 6)"
+fi
+
+echo "---"
+
+# --- Accounting conservation (ADR-193 #3) --------------------------------------------------
+# Ordered BEFORE the floor (ADR-193 #4): a neutered fail()/pass() deflates the verdict counters, so
+# the floor below would ALSO trip and would report the misleading "arms were deleted". This says
+# "a verdict was discarded" instead. Reported with `printf >&2` + `exit 1` DIRECTLY, never
+# through fail(): a check that reports by calling the verdict helper increments the very counter
+# the exit status reads, so neutering fail() silences the rows AND the check meant to notice the
+# silence. Every row records exactly one verdict, so passes+fails MUST equal cases; because
+# `cases` moves at the CALL SITE and not inside the verdict helpers, the identity is a real
+# constraint rather than a tautology. The literal `[FATAL] accounting` is load-bearing —
+# guard-vacuity-floor's ARM 10 builds its conservation population by grepping that exact string.
+if [[ $((passes + fails)) -ne "$cases" ]]; then
+  printf '\n[FATAL] accounting: passes+fails (%d) != cases (%d).\n' "$((passes + fails))" "$cases" >&2
+  if [[ $((passes + fails)) -lt "$cases" ]]; then
+    printf '  A row was counted but its verdict was not recorded — that is what a neutered pass()/fail() looks like.\n' >&2
+  else
+    printf '  A verdict was recorded at a call site with no `cases=$((cases + 1))` before it. This is a harness bug, not a product failure: add the increment at that call site.\n' >&2
+  fi
+  echo "parity.test.sh: $passes passed, $fails failed ($cases rows)"
+  exit 1
+fi
+
+# --- Anti-vacuity floor (ADR-193 #1) -------------------------------------------------------
+# Reads the INDEPENDENT `cases` counter, and reports with `printf >&2` + `exit 1` DIRECTLY.
+# This suite previously carried NO suite-level floor at all: a harness that silently asserted
+# nothing printed a clean smaller total and exited 0. MIN_ROWS is derived at commit time by
+# counting the `cases=$((cases + 1))` call sites in this file: 8 pre-existing verdict sites (rows
+# 1, 2, 3, 4, 5, 6a, 6b, 6c) + rows 7–8 = 10. The literal sits on the line directly above the `if`
+# because guard-vacuity-floor's backward slice carries only contiguous simple assignments into
+# its neutered-machinery mutant; bound anywhere else, the mutant dies unbound and the floor
+# scores CONSTRUCTION instead of FIRES.
+MIN_ROWS=12
+if [[ "$cases" -lt "$MIN_ROWS" ]]; then
+  printf '\n[FATAL] anti-vacuity floor: only %d row(s) ran, expected >= %d.\n' \
+    "$cases" "$MIN_ROWS" >&2
+  printf '  Rows were deleted or skipped; a green run here would be a coverage loss.\n' >&2
+  echo "parity.test.sh: $passes passed, $fails failed ($cases rows)"
+  exit 1
+fi
+
+echo "parity.test.sh: $passes passed, $fails failed ($cases rows)"
+[[ "$fails" -eq 0 ]]