@takuma-hirai/hirai-method 0.1.0

package/.claude/tests/draft-flow-guard-smoke.sh

@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+# draft-flow-guard-smoke.sh — task-22 W3 smoke for draft-flow-guard.sh
+#
+# 設計起源:
+#   docs/draft/hook-reliability-uplift.md W3
+#   docs/draft/system-reminder-attention-fix.md Wave 2.3
+#
+# 対象 hook:
+#   .claude/hooks/draft-flow-guard.sh (PreToolUse Edit/Write)
+#
+# 検証範囲 (5 ケース):
+#   Case 1: docs/foo.md 新規 Write、対応 draft 不在 → BLOCK (exit 2)
+#   Case 2: docs/foo.md 新規 Write、対応 docs/draft/foo.md 存在 → PASS (exit 0)
+#   Case 3: 既存 docs/foo.md の Edit → PASS (既存 file は素通し)
+#   Case 4: docs/sub/foo.md (深さ 2) → PASS (docs 直下のみが対象)
+#   Case 5: ECC_DRAFT_FLOW_GUARD_OVERRIDE=1 + 新規 BLOCK ケース → PASS (bypass env)
+#
+# 重要制約:
+#   - file-top に set -euo pipefail を書かない (feedback_set_e_in_sourced_libs)
+#   - tmp project root を /tmp/ に作って独立 docs ツリーを配置
+#   - hook は project-root.sh の resolve_project_root に依存するため、tmp_root に .git を作る
+#   - hook は exit 2 で BLOCK、exit 0 で PASS (decision JSON ではない点が他 hook と異なる)
+#
+# 実行:
+#   bash .claude/tests/draft-flow-guard-smoke.sh
+#
+# 終了コード:
+#   0 = 5/5 PASS / 1 = 1 件以上 FAIL
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+HOOK="$REPO_ROOT/.claude/hooks/draft-flow-guard.sh"
+
+# clean env
+unset ECC_DRAFT_FLOW_GUARD_OVERRIDE
+unset HC_DRAFT_FLOW_GUARD_WHITELIST
+
+# tmp project root に .git/ を作って resolve_project_root が安定して解決するように
+TMP_ROOT="$(mktemp -d /tmp/draft-flow-guard-smoke.XXXXXX)"
+mkdir -p "$TMP_ROOT/.git" "$TMP_ROOT/docs/draft" "$TMP_ROOT/docs/tasks" "$TMP_ROOT/docs/sub"
+
+trap 'rm -rf "$TMP_ROOT"' EXIT
+
+PASS=0
+FAIL=0
+FAILED_CASES=()
+
+# hook input JSON (PreToolUse Edit/Write)
+hook_input() {
+  local tool="$1"
+  local fp="$2"
+  TOOL="$tool" FP="$fp" python3 -c '
+import json, os
+print(json.dumps({
+    "tool_name": os.environ["TOOL"],
+    "tool_input": {"file_path": os.environ["FP"]}
+}))
+'
+}
+
+# hook を tmp project root cwd で実行 (resolve_project_root が pwd fallback)
+# exit code を捕捉する (set -e なし)。
+run_hook() {
+  local tool="$1"
+  local fp="$2"
+  shift 2
+  # 残りの引数は env 設定 (KEY=VALUE 形式)
+  (
+    cd "$TMP_ROOT" || exit 99
+    if [ $# -gt 0 ]; then
+      hook_input "$tool" "$fp" | env "$@" bash "$HOOK"
+    else
+      hook_input "$tool" "$fp" | bash "$HOOK"
+    fi
+  )
+}
+
+# === Case 1: 新規 Write w/o draft → BLOCK (exit 2) ===
+case1_no_draft_block() {
+  local label="Case 1: new docs/foo.md Write w/o draft → BLOCK (exit 2)"
+  local fp="${TMP_ROOT}/docs/case1-no-draft.md"
+  # file は実体不在のままで Write を試みる
+  local rc=0
+  run_hook Write "$fp" >/dev/null 2>&1 || rc=$?
+
+  if [ "$rc" -eq 2 ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (rc=$rc)")
+    printf "  FAIL: %s (rc=%d expected 2)\n" "$label" "$rc"
+  fi
+}
+
+# === Case 2: 新規 Write w/ matching draft → PASS (exit 0) ===
+case2_with_draft_pass() {
+  local label="Case 2: new docs/foo.md Write w/ matching draft → PASS"
+  local fp="${TMP_ROOT}/docs/case2-with-draft.md"
+  # 対応 draft を先に作る
+  touch "${TMP_ROOT}/docs/draft/case2-with-draft.md"
+  local rc=0
+  run_hook Write "$fp" >/dev/null 2>&1 || rc=$?
+
+  if [ "$rc" -eq 0 ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (rc=$rc)")
+    printf "  FAIL: %s (rc=%d expected 0)\n" "$label" "$rc"
+  fi
+}
+
+# === Case 3: 既存 docs/foo.md の Edit → PASS ===
+case3_existing_file_edit_pass() {
+  local label="Case 3: existing docs/foo.md Edit → PASS"
+  local fp="${TMP_ROOT}/docs/case3-existing.md"
+  # 既存 file (draft なくても OK)
+  echo "existing content" > "$fp"
+  local rc=0
+  run_hook Edit "$fp" >/dev/null 2>&1 || rc=$?
+
+  if [ "$rc" -eq 0 ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (rc=$rc)")
+    printf "  FAIL: %s (rc=%d expected 0)\n" "$label" "$rc"
+  fi
+}
+
+# === Case 4: docs/sub/foo.md (深さ 2) → PASS ===
+# hook は深さ 1 (docs 直下) のみが対象、それより深い path は対象外
+case4_deeper_path_pass() {
+  local label="Case 4: docs/sub/foo.md (depth 2) → PASS (out of scope)"
+  local fp="${TMP_ROOT}/docs/sub/case4-deep.md"
+  local rc=0
+  run_hook Write "$fp" >/dev/null 2>&1 || rc=$?
+
+  if [ "$rc" -eq 0 ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (rc=$rc)")
+    printf "  FAIL: %s (rc=%d expected 0)\n" "$label" "$rc"
+  fi
+}
+
+# === Case 5: ECC_DRAFT_FLOW_GUARD_OVERRIDE=1 + 本来 BLOCK case → PASS ===
+case5_bypass_env_pass() {
+  local label="Case 5: ECC_DRAFT_FLOW_GUARD_OVERRIDE=1 on BLOCK case → PASS"
+  local fp="${TMP_ROOT}/docs/case5-bypassed.md"
+  local rc=0
+  run_hook Write "$fp" ECC_DRAFT_FLOW_GUARD_OVERRIDE=1 >/dev/null 2>&1 || rc=$?
+
+  if [ "$rc" -eq 0 ]; then
+    PASS=$((PASS + 1))
+    printf "  PASS: %s\n" "$label"
+  else
+    FAIL=$((FAIL + 1))
+    FAILED_CASES+=("$label (rc=$rc)")
+    printf "  FAIL: %s (rc=%d expected 0)\n" "$label" "$rc"
+  fi
+}
+
+printf "===== draft-flow-guard-smoke (task-22 W3.5, 5 cases) =====\n\n"
+
+case1_no_draft_block
+case2_with_draft_pass
+case3_existing_file_edit_pass
+case4_deeper_path_pass
+case5_bypass_env_pass
+
+TOTAL=$((PASS + FAIL))
+printf "\n===== Result =====\n"
+printf "PASS: %d / %d\n" "$PASS" "$TOTAL"
+printf "FAIL: %d / %d\n" "$FAIL" "$TOTAL"
+
+if [ "$FAIL" -gt 0 ]; then
+  printf "Failed cases:\n"
+  for c in "${FAILED_CASES[@]}"; do
+    printf "  - %s\n" "$c"
+  done
+  printf "\nsummary: %d/%d PASS\n" "$PASS" "$TOTAL"
+  exit 1
+fi
+
+printf "\nsummary: %d/%d PASS\n" "$PASS" "$TOTAL"
+exit 0

package/.claude/tests/dual-mode-portability-smoke.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# dual-mode-portability-smoke.sh — task #12 W4 smoke test
+#
+# 4 cases:
+#   Case 1: HC_PROJECT_ROOT=/tmp/<fake>     → resolve_project_root returns /tmp/<fake>
+#   Case 2: env unset + in git repo         → returns git rev-parse --show-toplevel
+#   Case 3: env unset + non-git dir         → returns pwd
+#   Case 4: hook simulated from user-level path + HC_PROJECT_ROOT
+#           → hook resolves PROJECT_ROOT to env value (not SCRIPT_DIR/../..)
+#
+# 重要制約:
+#   - file-top に set -euo pipefail を書かない (feedback_set_e_in_sourced_libs)
+#   - 各 case 関数は ( set -uo pipefail; ... ) でラップ
+#
+# 実行:
+#   bash .claude/tests/dual-mode-portability-smoke.sh
+#
+# 終了コード: 0 = 4/4 PASS / 1 = 1 件以上 FAIL
+
+set -u
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+LIB="$PROJECT_ROOT/.claude/hooks/lib/project-root.sh"
+HOOK_CHECK_SERENA="$PROJECT_ROOT/.claude/hooks/check-serena-mcp.sh"
+TMP_DIR=$(mktemp -d "/tmp/dual-mode-portability-smoke.XXXXXX")
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+PASS=0
+FAIL=0
+FAILED_CASES=()
+
+run_case() {
+  local case_id="$1"
+  local desc="$2"
+  local test_fn="$3"
+  if ( set -uo pipefail; "$test_fn" ) >/dev/null 2>&1; then
+    printf '  PASS  Case %s: %s\n' "$case_id" "$desc"
+    PASS=$((PASS+1))
+  else
+    printf '  FAIL  Case %s: %s\n' "$case_id" "$desc"
+    FAIL=$((FAIL+1))
+    FAILED_CASES+=("$case_id")
+  fi
+}
+
+# === Case 1: env override ===
+case_1() {
+  local fake_root="$TMP_DIR/case1-fake"
+  mkdir -p "$fake_root"
+  local actual
+  actual=$(HC_PROJECT_ROOT="$fake_root" bash -c "source '$LIB'; resolve_project_root")
+  if [ "$actual" != "$fake_root" ]; then
+    printf 'expected %s, got %s\n' "$fake_root" "$actual" >&2
+    return 1
+  fi
+  return 0
+}
+
+# === Case 2: git rev-parse (inside this repo) ===
+case_2() {
+  # Run unset env from PROJECT_ROOT itself; git rev-parse should yield PROJECT_ROOT.
+  local actual
+  actual=$(cd "$PROJECT_ROOT" && unset HC_PROJECT_ROOT && bash -c "source '$LIB'; resolve_project_root")
+  # macOS /private/tmp symlink可能性は repo path には無いため strict 比較
+  if [ "$actual" != "$PROJECT_ROOT" ]; then
+    printf 'expected %s, got %s\n' "$PROJECT_ROOT" "$actual" >&2
+    return 1
+  fi
+  return 0
+}
+
+# === Case 3: pwd fallback (non-git dir) ===
+case_3() {
+  local nogit="$TMP_DIR/case3-nogit"
+  mkdir -p "$nogit"
+  # Ensure no .git in ancestors of $nogit
+  # /tmp 配下に .git は存在しない前提
+  local actual
+  actual=$(cd "$nogit" && unset HC_PROJECT_ROOT && bash -c "source '$LIB'; resolve_project_root")
+  # macOS では /tmp が /private/tmp の symlink (pwd は /tmp を返すが realpath 違い)
+  # 両許容: $nogit or /private<nogit>
+  if [ "$actual" != "$nogit" ] && [ "$actual" != "/private${nogit}" ]; then
+    printf 'expected %s (or /private prefix), got %s\n' "$nogit" "$actual" >&2
+    return 1
+  fi
+  return 0
+}
+
+# === Case 4: hook executed from user-level-style path + HC_PROJECT_ROOT ===
+# Simulate user-level install: copy hook + lib into a temp tree mimicking
+# ${HOME}/.claude/hooks/ layout, then invoke with HC_PROJECT_ROOT pointing
+# to a separate "project" dir. Expect PROJECT_ROOT inside the hook = env value.
+case_4() {
+  local user_install="$TMP_DIR/case4-user-install"
+  local target_project="$TMP_DIR/case4-target-project"
+  mkdir -p "$user_install/.claude/hooks/lib"
+  mkdir -p "$target_project"
+  cp "$HOOK_CHECK_SERENA" "$user_install/.claude/hooks/check-serena-mcp.sh"
+  cp "$LIB" "$user_install/.claude/hooks/lib/project-root.sh"
+  chmod +x "$user_install/.claude/hooks/check-serena-mcp.sh"
+  # Create .mcp.json missing serena in target_project so hook emits warning;
+  # warning content does not matter — what matters is hook completes (no
+  # silent crash from missing lib / wrong PROJECT_ROOT resolution).
+  printf '%s\n' '{"mcpServers": {}}' > "$target_project/.mcp.json"
+  local output
+  output=$(HC_PROJECT_ROOT="$target_project" bash "$user_install/.claude/hooks/check-serena-mcp.sh" </dev/null 2>/dev/null)
+  # Expect Serena warning (entry missing) — proves hook read target_project/.mcp.json
+  if ! printf '%s' "$output" | grep -q 'Serena MCP'; then
+    printf 'expected Serena MCP warning, got: %s\n' "$output" >&2
+    return 1
+  fi
+  if ! printf '%s' "$output" | grep -q 'system-reminder'; then
+    return 1
+  fi
+  return 0
+}
+
+printf '===== task #12 W4 dual-mode-portability smoke =====\n'
+run_case 1 'HC_PROJECT_ROOT env override' case_1
+run_case 2 'git rev-parse --show-toplevel' case_2
+run_case 3 'pwd fallback (non-git dir)' case_3
+run_case 4 'user-level hook path + HC_PROJECT_ROOT' case_4
+
+printf '\n===== Result =====\n'
+printf 'PASS: %d / 4\n' "$PASS"
+printf 'FAIL: %d / 4\n' "$FAIL"
+if [ "$FAIL" -gt 0 ]; then
+  printf 'Failed cases: %s\n' "${FAILED_CASES[*]}"
+  exit 1
+fi
+exit 0

package/.claude/tests/effective-hook-matrix-smoke.sh

@@ -0,0 +1,261 @@
+#!/usr/bin/env bash
+# effective-hook-matrix-smoke.sh — task-71 Step 8 S-D
+#
+# 目的:
+#   settings.json / preview / manifest / yml feature の整合性を検証する。
+#
+# 重要注意 (cutover 済、task-71 Step 7 完了後):
+#   - live settings.json は dispatcher 形式に cutover 済。これが SSoT。
+#     generate-settings.sh --check live は OK を返す (live == generated)。
+#   - したがって SD-4 は OK 期待。DRIFT (rc != 0) は FAIL とする
+#     (cutover 後に live が generated と乖離 = 配線回帰なので検出すべき)。
+#
+#   本 smoke の検証項目:
+#     SD-1: preview (settings.generated.preview.json) に対して --check → OK 期待
+#     SD-2: manifest の全 hook_command path が実在する
+#     SD-3: manifest 内の各 event/matcher が preview に 1 dispatcher として配線されている
+#     SD-4: live settings.json に対して --check → OK 期待 (cutover 済、DRIFT なら FAIL)
+#     SD-5: dispatcher scripts が実行可能 (755)
+#
+# 実行: bash .claude/tests/effective-hook-matrix-smoke.sh
+# 終了: 0 = SD-1/2/3/4/5 全 PASS / 1 = FAIL
+#
+# bash 3.2 互換 (macOS)。
+# 規約: file-top set -u + case 別 ( set -uo pipefail ) + run_case。
+
+set -u
+
+# --- root 解決 ---
+_resolve_root() (
+  set -uo pipefail
+  if [ -n "${HC_PROJECT_ROOT:-}" ] && [ -d "${HC_PROJECT_ROOT}" ]; then
+    printf '%s' "${HC_PROJECT_ROOT}"; return 0
+  fi
+  local _sdir
+  _sdir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  if command -v git >/dev/null 2>&1; then
+    local r
+    r=$(git -C "$_sdir" rev-parse --show-toplevel 2>/dev/null)
+    [ -n "$r" ] && [ -d "$r" ] && { printf '%s' "$r"; return 0; }
+  fi
+  if command -v git >/dev/null 2>&1; then
+    local r2
+    r2=$(git rev-parse --show-toplevel 2>/dev/null)
+    [ -n "$r2" ] && [ -d "$r2" ] && { printf '%s' "$r2"; return 0; }
+  fi
+  pwd
+)
+
+ROOT="$(_resolve_root)"
+MANIFEST="${ROOT}/.claude/hooks/dispatcher-manifest.tsv"
+PREVIEW="${ROOT}/.claude/settings.generated.preview.json"
+LIVE="${ROOT}/.claude/settings.json"
+GENERATE_SCRIPT="${ROOT}/.claude/scripts/generate-settings.sh"
+
+TMPBASE="$(mktemp -d "${TMPDIR:-/tmp}/hook-matrix-smoke.XXXXXX")"
+trap 'rm -rf "$TMPBASE"' EXIT
+
+PASS=0
+FAIL=0
+WARN=0
+
+ok()   { PASS=$((PASS+1)); printf '  PASS: %s\n' "$1"; }
+bad()  { FAIL=$((FAIL+1)); printf '  FAIL: %s\n' "$1"; }
+warn() { WARN=$((WARN+1)); printf '  WARN: %s\n' "$1"; }
+
+# ------------------------------------------------------------------
+printf "=== S-D: effective-hook-matrix-smoke ===\n\n"
+
+# --- SD-1: preview に対して --check が OK ---
+printf "SD-1: generate-settings.sh --check preview → OK\n"
+run_sd1() ( set -uo pipefail
+  local rc=0
+  bash "$GENERATE_SCRIPT" --check "$PREVIEW" >/dev/null 2>/dev/null || rc=$?
+  printf '%s\n' "$rc" > "${TMPBASE}/result-sd1"
+)
+if [ ! -f "$GENERATE_SCRIPT" ]; then
+  bad "SD-1 generate-settings.sh not found: $GENERATE_SCRIPT"
+elif [ ! -f "$PREVIEW" ]; then
+  bad "SD-1 preview not found: $PREVIEW (run: bash $GENERATE_SCRIPT)"
+elif ! command -v jq >/dev/null 2>&1; then
+  warn "SD-1 jq not available, skip"
+  ok "SD-1 skip (jq required)"
+else
+  run_sd1
+  sd1_rc="$(cat "${TMPBASE}/result-sd1" 2>/dev/null | tr -d '[:space:]')"
+  if [ "$sd1_rc" = "0" ]; then
+    ok "SD-1 --check preview: OK (in sync)"
+  else
+    bad "SD-1 --check preview: DRIFT (rc=${sd1_rc}) — preview may be stale, re-run generate-settings.sh"
+  fi
+fi
+
+# --- SD-2: manifest の全 hook_command path が実在 ---
+printf "\nSD-2: all hook_command paths in manifest exist\n"
+if [ ! -f "$MANIFEST" ]; then
+  bad "SD-2 manifest not found: $MANIFEST"
+else
+  missing=0
+  total=0
+  # awk で TAB 区切りを正確にパース (bash IFS=TAB は連続 TAB で field ずれが発生するため)
+  # hook_command (col 4) の先頭 token (space 前) = script path
+  while IFS= read -r hook_script; do
+    [ -z "$hook_script" ] && continue
+    hook_path="${ROOT}/.claude/hooks/${hook_script}"
+    total=$((total+1))
+    if [ ! -f "$hook_path" ]; then
+      printf '  MISSING: %s\n' "$hook_path"
+      missing=$((missing+1))
+    fi
+  done < <(awk -F'\t' 'NR>1 && NF>=4 && $1!="" && $4!="" { split($4, a, " "); print a[1] }' "$MANIFEST")
+  if [ "$missing" -eq 0 ]; then
+    ok "SD-2 all ${total} hook_command paths exist"
+  else
+    bad "SD-2 ${missing}/${total} hook_command paths missing"
+  fi
+fi
+
+# --- SD-3: preview 内の各 event が manifest の event と対応する (+ 逆方向 diff + feature_key 確認) ---
+printf "\nSD-3: preview hooks entries match manifest (event/matcher coverage)\n"
+if [ ! -f "$PREVIEW" ] || ! command -v jq >/dev/null 2>&1; then
+  if ! command -v jq >/dev/null 2>&1; then
+    warn "SD-3 jq not available"
+    ok "SD-3 skip"
+  else
+    bad "SD-3 preview not found"
+  fi
+else
+  # manifest から (event,matcher) pair を抽出 (awk で空 matcher も保持)
+  manifest_pairs="$(
+    awk -F'\t' '
+      NR==1{next} NF<6{next} $1==""{next}
+      {print $1 "|" $2}
+    ' "$MANIFEST" | sort -u
+  )"
+  # preview から dispatcher entries を抽出 (event / matcher)
+  preview_entries="$(
+    jq -r '
+      .hooks // {} | to_entries[] |
+      .key as $event |
+      .value[] |
+      ( $event + "|" + (.matcher // "") )
+    ' "$PREVIEW" | sort -u
+  )"
+  # 順方向: manifest → preview (manifest にあって preview にない)
+  drift=0
+  for pair in $manifest_pairs; do
+    if ! printf '%s\n' "$preview_entries" | grep -qxF "$pair"; then
+      printf '  MISSING in preview: event/matcher=%s\n' "$pair"
+      drift=$((drift+1))
+    fi
+  done
+  if [ "$drift" -eq 0 ]; then
+    ok "SD-3 all manifest (event,matcher) pairs covered in preview (forward)"
+  else
+    bad "SD-3 ${drift} manifest pair(s) missing in preview (forward)"
+  fi
+
+  # MED: 逆方向 diff — preview にあって manifest にない event/matcher を WARN 検出
+  # (preview が manifest と乖離している場合 = generator または manifest の設計乖離)
+  printf "\n  SD-3-rev: reverse diff (preview → manifest)\n"
+  rev_drift=0
+  for entry in $preview_entries; do
+    # dispatcher 形式の matcher は jq で取れるが event/matcher は manifest と比較
+    if ! printf '%s\n' "$manifest_pairs" | grep -qxF "$entry"; then
+      printf '  WARN: in preview but not in manifest: event/matcher=%s\n' "$entry"
+      rev_drift=$((rev_drift+1))
+    fi
+  done
+  if [ "$rev_drift" -eq 0 ]; then
+    ok "SD-3-rev no extra entries in preview vs manifest (reverse ok)"
+  else
+    warn "SD-3-rev ${rev_drift} preview entry/entries not in manifest — generator と manifest が乖離の可能性"
+    ok "SD-3-rev recorded (WARN のみ、hard fail しない)"
+  fi
+fi
+
+# --- SD-3-fk: manifest feature_key が harness-config.yml に宣言済か確認 (飾り toggle 検出) ---
+printf "\nSD-3-fk: manifest feature_key declared in harness-config.yml\n"
+YML_CONFIG="${ROOT}/.claude/harness-config.yml"
+if [ ! -f "$MANIFEST" ] || [ ! -f "$YML_CONFIG" ]; then
+  warn "SD-3-fk manifest or yml not found, skip"
+  ok "SD-3-fk skip"
+else
+  fk_undeclared=0
+  fk_total=0
+  # manifest の feature_key (col5) を抽出し、空でないものだけ確認
+  # manifest の feature_key 形式: 短縮形 "autonomous_action_guard"
+  # yml の feature toggle 形式: "feature_<key>_enabled" または "review_required_<key>"
+  while IFS= read -r fk; do
+    [ -z "$fk" ] && continue
+    fk_total=$((fk_total+1))
+    # 検索パターン: feature_<fk>_enabled または <fk> 直接マッチ (review_required_* 等) の 2 系統
+    if grep -qE "^[[:space:]]*(feature_${fk}_enabled|${fk})[[:space:]]*:" "$YML_CONFIG"; then
+      : # found
+    else
+      printf '  WARN: feature_key not declared in yml: %s (tried: feature_%s_enabled / %s)\n' "$fk" "$fk" "$fk"
+      fk_undeclared=$((fk_undeclared+1))
+    fi
+  done < <(awk -F'\t' 'NR>1 && NF>=5 && $5!="" { print $5 }' "$MANIFEST" | sort -u)
+  if [ "$fk_undeclared" -eq 0 ]; then
+    ok "SD-3-fk all ${fk_total} feature_key(s) declared in harness-config.yml"
+  else
+    warn "SD-3-fk ${fk_undeclared}/${fk_total} feature_key(s) not declared in yml — 飾り toggle の可能性"
+    ok "SD-3-fk recorded (WARN のみ、hard fail しない)"
+  fi
+fi
+
+# --- SD-4: live settings に対して --check (cutover 済: OK 期待、DRIFT なら FAIL) ---
+printf "\nSD-4: generate-settings.sh --check live (cutover complete → OK expected)\n"
+run_sd4() ( set -uo pipefail
+  local rc=0
+  bash "$GENERATE_SCRIPT" --check "$LIVE" >/dev/null 2>/dev/null || rc=$?
+  printf '%s\n' "$rc" > "${TMPBASE}/result-sd4"
+)
+if [ ! -f "$LIVE" ]; then
+  bad "SD-4 live settings.json not found"
+elif ! command -v jq >/dev/null 2>&1; then
+  warn "SD-4 jq not available, skip"
+  ok "SD-4 skip"
+else
+  run_sd4
+  sd4_rc="$(cat "${TMPBASE}/result-sd4" 2>/dev/null | tr -d '[:space:]')"
+  if [ "$sd4_rc" = "0" ]; then
+    ok "SD-4 --check live: OK (cutover complete, live=generated)"
+  else
+    # cutover 済なので DRIFT は配線回帰 — FAIL
+    bad "SD-4 --check live: DRIFT (rc=${sd4_rc}) — live settings.json diverged from generated. Re-run generate-settings.sh --out .claude/settings.json to re-sync."
+  fi
+fi
+
+# --- SD-5: dispatcher scripts themselves are executable ---
+printf "\nSD-5: all dispatcher scripts are executable (755)\n"
+dispatcher_fail=0
+for d in pre-tool-use-dispatcher.sh post-tool-use-dispatcher.sh stop-dispatcher.sh \
+          subagent-stop-dispatcher.sh session-start-dispatcher.sh \
+          user-prompt-submit-dispatcher.sh notification-dispatcher.sh; do
+  p="${ROOT}/.claude/hooks/${d}"
+  if [ ! -f "$p" ]; then
+    printf '  MISSING dispatcher: %s\n' "$d"
+    dispatcher_fail=$((dispatcher_fail+1))
+  elif [ ! -x "$p" ]; then
+    printf '  NOT EXECUTABLE: %s\n' "$p"
+    dispatcher_fail=$((dispatcher_fail+1))
+  fi
+done
+if [ "$dispatcher_fail" -eq 0 ]; then
+  ok "SD-5 all 7 dispatcher scripts present and executable"
+else
+  bad "SD-5 ${dispatcher_fail} dispatcher script(s) missing or not executable"
+fi
+
+# ------------------------------------------------------------------
+TOTAL=$((PASS + FAIL))
+printf "\n===== S-D Result =====\n"
+printf "PASS: %d / %d\n" "$PASS" "$TOTAL"
+printf "FAIL: %d / %d\n" "$FAIL" "$TOTAL"
+printf "WARN: %d\n" "$WARN"
+printf "Note: cutover 済 — SD-4 は live==generated の OK を期待する。\n"
+printf "      DRIFT なら配線回帰: generate-settings.sh --out .claude/settings.json で再生成する。\n"
+[ "$FAIL" -gt 0 ] && exit 1
+exit 0