@trycore/spec-build-harness 0.8.4 → 0.10.0

package/scripts/tests/test-skill-ops.sh

@@ -0,0 +1,847 @@
+#!/usr/bin/env bash
+# test-skill-ops.sh — operaciones de dominio que conducen las skills [EP-OR-08-C].
+# Cubre lib/runtime-ops.sh, slice-ops.sh, release-ops.sh y scripts/lib/graph-bundle.py
+# contra el stub HTTP local del sub-slice A (scripts/tests/lib/http-stub.py).
+set -uo pipefail
+ROOT="$(git rev-parse --show-toplevel)"
+fail=0
+TMP="$(mktemp -d)"
+PROJ="$TMP/proj"
+mkdir -p "$PROJ/.claude/state" "$PROJ/.claude/config"
+export CLAUDE_PROJECT_DIR="$PROJ"
+export BUILD_CONFIG_FILE="$PROJ/.claude/config/build-config.json"
+echo '{"runtime":{"mode":"runtime","stale_seconds":900}}' > "$BUILD_CONFIG_FILE"
+STUBS=""
+cleanup() {
+  for p in $STUBS; do kill "$p" 2>/dev/null; done
+  rm -rf "$TMP"
+}
+trap cleanup EXIT
+
+freeport() { python3 -c "import socket;s=socket.socket();s.bind(('',0));print(s.getsockname()[1]);s.close()"; }
+
+source "$ROOT/hooks/build/lib/runtime-ops.sh" 2>/dev/null || { echo "FAIL no existe lib/runtime-ops.sh"; exit 1; }
+
+# --- constantes del contrato ---
+[ "$OPS_RC_LEGACY" = 3 ] && [ "$OPS_RC_NO_SLICE" = 4 ] && [ "$OPS_RC_OFFLINE" = 5 ] \
+  && [ "$OPS_RC_REJECTED" = 6 ] && [ "$OPS_RC_NO_WORK" = 7 ] \
+  && echo "OK codigos de salida del contrato" || { echo "FAIL codigos de salida"; fail=1; }
+[ "$(ops_path_verdicts sl-1)" = "/slices/sl-1/verdicts" ] && echo "OK ops_path_verdicts" || { echo "FAIL ops_path_verdicts"; fail=1; }
+[ "$(ops_path_mirror p-1)" = "/projects/p-1/mirror/transitions" ] && echo "OK ops_path_mirror" || { echo "FAIL ops_path_mirror"; fail=1; }
+[ "$(ops_path_front_integration f-1 ak-1)" = "/fronts/f-1/members/ak-1/integration" ] && echo "OK ops_path_front_integration" || { echo "FAIL ops_path_front_integration"; fail=1; }
+
+# --- ops_json_str: comillas, saltos de línea y tildes por STDIN (nunca por argv) ---
+got="$(ops_json_str 'una "cita" con ñ y
+salto')"
+echo "$got" | python3 -c 'import json,sys; s=json.loads(sys.stdin.read()); print("SI" if s.count(chr(10))==1 and "ñ" in s and "\"cita\"" in s else "NO")' | grep -q SI \
+  && echo "OK ops_json_str escapa comillas/saltos/tildes" || { echo "FAIL ops_json_str ($got)"; fail=1; }
+[ "$(PATH=/var/empty ops_json_str hola)" = '""' ] && echo "OK ops_json_str sin python3 -> cadena vacia" || { echo "FAIL ops_json_str sin python3"; fail=1; }
+
+# --- ops_json_str_file: trunca en el tope y nunca lanza ---
+python3 -c "open('$TMP/big.txt','w').write('x'*9000)"
+got="$(ops_json_str_file "$TMP/big.txt" 100)"
+n="$(echo "$got" | python3 -c 'import json,sys; print(len(json.loads(sys.stdin.read())))')"
+[ "$n" -lt 200 ] && echo "OK ops_json_str_file trunca" || { echo "FAIL ops_json_str_file trunca ($n)"; fail=1; }
+[ "$(ops_json_str_file "$TMP/no-existe.txt")" = '""' ] && echo "OK ops_json_str_file fichero ausente" || { echo "FAIL ops_json_str_file ausente"; fail=1; }
+
+# --- ops_context_hashes: sha256 EFECTIVO local, no el del lock (detección de drift) ---
+mkdir -p "$PROJ/.claude/config"
+printf 'allow-list-v1' > "$PROJ/.claude/config/stack-allowlist.json"
+runtime_lock_write "sha256:v1" '[{"path":"config/stack-allowlist.json","sha256":"sha-del-servidor"},{"path":"rules/no-existe.md","sha256":"otro"}]'
+got="$(ops_context_hashes)"
+real="$(python3 -c "import hashlib;print(hashlib.sha256(open('$PROJ/.claude/config/stack-allowlist.json','rb').read()).hexdigest())")"
+echo "$got" | grep -q "$real" && echo "OK ops_context_hashes reporta el sha local efectivo" || { echo "FAIL ops_context_hashes ($got)"; fail=1; }
+echo "$got" | python3 -c 'import json,sys; d=json.load(sys.stdin); print("SI" if any(x["path"]=="rules/no-existe.md" and x["sha256"] is None for x in d) else "NO")' | grep -q SI \
+  && echo "OK ops_context_hashes marca null el fichero ausente" || { echo "FAIL ops_context_hashes ausente"; fail=1; }
+[ "$(PATH=/var/empty ops_context_hashes)" = "[]" ] && echo "OK ops_context_hashes sin python3 -> []" || { echo "FAIL ops_context_hashes sin python3"; fail=1; }
+
+# --- ops_enqueue_from_file: payload por FICHERO (sin límite de ARG_MAX) ---
+python3 -c "
+import json
+json.dump({'items':[{'item_id':'w%d'%i,'kind':'e2e'} for i in range(4000)]}, open('$TMP/payload.json','w'))"
+ops_enqueue_from_file wiring_checklist_seeded "$TMP/payload.json" sl-1
+n="$(find "$PROJ/.claude/state/outbox" -name '*.json' ! -name '.dispatch-state.json' | wc -l | tr -d ' ')"
+[ "$n" = 1 ] && echo "OK ops_enqueue_from_file encola 1 evento grande" || { echo "FAIL ops_enqueue_from_file ($n)"; fail=1; }
+f="$(find "$PROJ/.claude/state/outbox" -name '*.json' | head -1)"
+python3 -c "
+import json,sys
+d=json.load(open('$f'))
+ok = d['type']=='wiring_checklist_seeded' and d.get('slice_id')=='sl-1' and len(d['payload']['items'])==4000
+print('SI' if ok else 'NO')" | grep -q SI && echo "OK ops_enqueue_from_file conserva tipo/slice_id/payload" || { echo "FAIL contenido del evento encolado"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# --- lista protegida ampliada: la cota jamás descarta un hecho de dominio ---
+for t in slice_archived wiring_item_updated escalation_raised scaffold_confirmed design_source_declared project_kind_declared foundation_declared harness_phase_changed wiring_checklist_seeded front_integration_reported; do
+  case " $RUNTIME_OUTBOX_PROTECTED " in
+    *" $t "*) : ;;
+    *) echo "FAIL $t no está en RUNTIME_OUTBOX_PROTECTED"; fail=1 ;;
+  esac
+done
+echo "OK lista protegida ampliada (si no hubo FAIL arriba)"
+# Regresión de comportamiento (no de la constante): 6 MB de tool_use + 1 slice_archived.
+runtime_enqueue_event slice_archived '{"epic_code":"EP-001"}' sl-1
+python3 - "$PROJ/.claude/state/outbox" <<'PY'
+import json,os,sys,uuid,datetime
+d=sys.argv[1]
+big="y"*700000
+for i in range(10):
+    cid=str(uuid.uuid4())
+    ts=datetime.datetime.now(datetime.timezone.utc)
+    json.dump({"client_event_id":cid,"type":"tool_use_recorded","payload":{"blob":big},
+               "enqueued_at":ts.strftime("%Y-%m-%dT%H:%M:%S.%fZ")},
+              open(os.path.join(d,ts.strftime("%Y%m%d%H%M%S%f")+"-"+cid+".json"),"w"))
+PY
+runtime_outbox_enforce_cap >/dev/null
+if grep -lq '"type": "slice_archived"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null; then
+  echo "OK la cota conserva slice_archived"
+else
+  echo "FAIL la cota evictó slice_archived"; fail=1
+fi
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# --- ops_mirror: sólo tiene sentido con project_id; nunca lanza sin él ---
+ops_mirror gate_reported "$TMP/payload.json"; rc=$?
+[ "$rc" -ne 0 ] && echo "OK ops_mirror sin credenciales -> rc != 0" || { echo "FAIL ops_mirror sin credenciales"; fail=1; }
+
+# ══════════════ slice-ops.sh: mode / claim / next-step [Task 2] ══════════════
+SO="$ROOT/hooks/build/slice-ops.sh"
+
+# legacy: no-op absoluto, rc 3, y CERO red (curl falso al frente del PATH, subshell aislado).
+mkdir -p "$TMP/fakebin"
+cat > "$TMP/fakebin/curl" <<'FAKE'
+#!/usr/bin/env bash
+echo "$@" >> "$FAKE_CURL_LOG"
+exit 0
+FAKE
+chmod +x "$TMP/fakebin/curl"
+: > "$TMP/curl-legacy.log"
+rc=0
+out="$(bash -c "PATH=\"$TMP/fakebin:\$PATH\" FAKE_CURL_LOG=\"$TMP/curl-legacy.log\" TRYCORE_RUNTIME_MODE=legacy CLAUDE_PROJECT_DIR=\"$PROJ\" BUILD_CONFIG_FILE=\"$BUILD_CONFIG_FILE\" bash \"$SO\" claim")" || rc=$?
+[ "$rc" = 3 ] && echo "OK claim en legacy -> rc 3" || { echo "FAIL claim legacy rc ($rc)"; fail=1; }
+echo "$out" | grep -q LEGACY && echo "OK claim en legacy anuncia LEGACY" || { echo "FAIL claim legacy stdout ($out)"; fail=1; }
+[ ! -s "$TMP/curl-legacy.log" ] && echo "OK claim en legacy no abre socket" || { echo "FAIL claim legacy tocó la red"; fail=1; }
+
+# dual: tampoco reclama (el fichero decide el slice — spec §6.1).
+rc=0; out="$(TRYCORE_RUNTIME_MODE=dual bash "$SO" claim)" || rc=$?
+[ "$rc" = 3 ] && echo "OK claim en dual -> rc 3" || { echo "FAIL claim dual rc ($rc)"; fail=1; }
+echo "$out" | grep -q DUAL_NO_CLAIM && echo "OK claim en dual anuncia DUAL_NO_CLAIM" || { echo "FAIL claim dual stdout ($out)"; fail=1; }
+
+# runtime: claim feliz -> 200, refresca la caché y rinde el slice.
+PORT_CL="$(freeport)"
+cat > "$TMP/routes-cl.json" <<JSON
+{"POST /tasks/next": {"status": 200, "body": {"slice_id": "sl-7", "epic_code": "EP-003", "epic_title": "Cobros", "phase": "dor", "gates": {"dor": false}, "branch_base": "main", "openspec_change": "add-cobros", "docs_ref": "docs/03-backlog/epicas.md#ep-003", "stories": ["HU-011"], "lease": {"ttl_s": 300, "expires_at": "2026-08-19T12:00:00Z"}, "manifest_hash": "sha256:v1", "checkpoint": null}},
+ "GET /agent/context": {"status": 200, "body": {"project": {"scaffold_confirmed": true}, "active_slice": {"slice_id": "sl-7", "epic_code": "EP-003", "phase": "dor", "gates": {"dor": false, "tdd": false}, "branch": "feature/cobros", "wiring_failing": [{"item_id": "w1", "kind": "e2e"}], "resume_hint": "cablear w1"}, "context": {"manifest_hash": "sha256:v1", "version": 4}}},
+ "GET /projects/p-1/context/manifest": {"status": 200, "body": {"manifest_hash": "sha256:v1", "files": []}}}
+JSON
+: > "$TMP/calls-cl.jsonl"
+python3 "$ROOT/scripts/tests/lib/http-stub.py" "$PORT_CL" "$TMP/routes-cl.json" "$TMP/calls-cl.jsonl" &
+STUBS="$STUBS $!"
+sleep 0.3
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT_CL\",\"project_token\":\"tok-c\",\"project_id\":\"p-1\",\"agent_key\":\"ak-1\",\"manifest_hash\":\"sha256:v1\"}"
+
+rc=0; out="$(bash "$SO" claim --epic EP-003)" || rc=$?
+[ "$rc" = 0 ] && echo "OK claim 200 -> rc 0" || { echo "FAIL claim 200 rc ($rc)"; fail=1; }
+echo "$out" | grep -q "sl-7" && echo "OK claim rinde el slice reclamado" || { echo "FAIL claim render ($out)"; fail=1; }
+[ "$(python3 - "$TMP/calls-cl.jsonl" <<'PYX'
+import json,sys
+ok=False
+for line in open(sys.argv[1]):
+    c=json.loads(line)
+    if c["path"]=="/tasks/next":
+        b=json.loads(c["body"])
+        # POST siempre: el GET no acepta el reporte de hashes (spec §3.1 rev. 4).
+        ok = c["method"]=="POST" and isinstance(b.get("context_hashes"), list) and b.get("epic_code")=="EP-003"
+print("SI" if ok else "NO")
+PYX
+)" = SI ] && echo "OK el claim usa POST y reporta context_hashes y la épica" || { echo "FAIL cuerpo/método del claim"; fail=1; }
+[ "$(projection_get active_slice.slice_id "")" = "sl-7" ] && echo "OK el claim refresca la caché de proyección" || { echo "FAIL la caché no se refrescó"; fail=1; }
+
+# next-step: deriva del cliente (spec §2), prioridad resume_hint > wiring > sub-slices > gate.
+out="$(bash "$SO" next-step)"
+echo "$out" | grep -q "cablear w1" && echo "OK next-step prioriza resume_hint" || { echo "FAIL next-step ($out)"; fail=1; }
+
+# 204: sin trabajo.
+python3 - "$TMP/routes-cl.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /tasks/next"]={"status":204,"body":{}}
+json.dump(d,open(p,"w"))
+PYX
+rc=0; out="$(bash "$SO" claim)" || rc=$?
+[ "$rc" = 7 ] && echo "OK claim 204 -> rc 7 (NO_WORK)" || { echo "FAIL claim 204 rc ($rc)"; fail=1; }
+
+# 409 por CUERPO: contexto irresoluble no se reintenta.
+python3 - "$TMP/routes-cl.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /tasks/next"]={"status":409,"body":{"reason":"context_unresolvable","detail":"falta publicar el manifiesto"}}
+json.dump(d,open(p,"w"))
+PYX
+: > "$TMP/calls-cl.jsonl"
+rc=0; bash "$SO" claim >/dev/null 2>&1 || rc=$?
+[ "$rc" = 6 ] && echo "OK 409 context_unresolvable -> rc 6" || { echo "FAIL 409 irresoluble rc ($rc)"; fail=1; }
+n="$(grep -c '"path": "/tasks/next"' "$TMP/calls-cl.jsonl")"
+[ "$n" = 1 ] && echo "OK 409 irresoluble NO se reintenta" || { echo "FAIL se reintentó un 409 irresoluble ($n)"; fail=1; }
+
+# 409 por contención: un reintento y, si persiste, NO_WORK.
+python3 - "$TMP/routes-cl.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /tasks/next"]={"status":409,"body":{"reason":"contention"}}
+json.dump(d,open(p,"w"))
+PYX
+: > "$TMP/calls-cl.jsonl"
+rc=0; bash "$SO" claim >/dev/null 2>&1 || rc=$?
+[ "$rc" = 7 ] && echo "OK 409 contención agotada -> rc 7" || { echo "FAIL 409 contención rc ($rc)"; fail=1; }
+n="$(grep -c '"path": "/tasks/next"' "$TMP/calls-cl.jsonl")"
+[ "$n" = 2 ] && echo "OK 409 contención reintenta exactamente una vez" || { echo "FAIL reintentos de contención ($n)"; fail=1; }
+
+# 409 por DRIFT: el reintento debe refrescar el estado REAL del servidor (GET
+# /agent/context) antes de forzar el resync. Pasar "" a context-sync.sh es un no-op en
+# este escenario: su fallback cae en runtime.credentials.manifest_hash (caché del último
+# /agents/register), que en drift YA coincide con el lock local — eso es justo lo que
+# distingue "drift" del estado real del servidor — y el primer guard de context-sync.sh
+# corta en seco sin llegar a preguntarle nada al servidor (regresión del hallazgo de
+# revisión: 0 llamadas a /agent/context y 0 al manifiesto real).
+python3 - "$TMP/routes-cl.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /tasks/next"]={"status":409,"body":{"reason":"drift"}}
+d["GET /agent/context"]["body"]["context"]["manifest_hash"]="sha256:v9"
+d["GET /projects/p-1/context/manifest"]["body"]["manifest_hash"]="sha256:v9"
+json.dump(d,open(p,"w"))
+PYX
+: > "$TMP/calls-cl.jsonl"
+rc=0; bash "$SO" claim >/dev/null 2>&1 || rc=$?
+[ "$rc" = 7 ] && echo "OK 409 drift agotado -> rc 7" || { echo "FAIL 409 drift rc ($rc)"; fail=1; }
+n="$(grep -c '"path": "/tasks/next"' "$TMP/calls-cl.jsonl")"
+[ "$n" = 2 ] && echo "OK 409 drift reintenta exactamente una vez" || { echo "FAIL reintentos de drift ($n)"; fail=1; }
+n_ctx="$(grep -c '"path": "/agent/context"' "$TMP/calls-cl.jsonl")"
+[ "$n_ctx" -ge 1 ] && echo "OK 409 drift refresca /agent/context (no confía en la caché de credenciales)" || { echo "FAIL 409 drift no refrescó /agent/context ($n_ctx)"; fail=1; }
+n_mani="$(grep -c '"path": "/projects/p-1/context/manifest"' "$TMP/calls-cl.jsonl")"
+[ "$n_mani" -ge 1 ] && echo "OK 409 drift fuerza el GET del manifiesto real (el guard de context-sync.sh no corta en seco)" || { echo "FAIL 409 drift no forzó el manifiesto real ($n_mani)"; fail=1; }
+[ "$(runtime_lock_manifest_hash)" = "sha256:v9" ] \
+  && echo "OK 409 drift converge el lock al manifiesto real del servidor" || { echo "FAIL el lock no convergió tras el drift"; fail=1; }
+
+# 401: token revocado -> rechazo accionable, sin reintento.
+python3 - "$TMP/routes-cl.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /tasks/next"]={"status":401,"body":{"error":"invalid_token"}}
+json.dump(d,open(p,"w"))
+PYX
+rc=0; err="$(bash "$SO" claim 2>&1 >/dev/null)" || rc=$?
+[ "$rc" = 6 ] && echo "OK 401 -> rc 6" || { echo "FAIL 401 rc ($rc)"; fail=1; }
+echo "$err" | grep -qi "ADMIN" && echo "OK 401 da mensaje accionable" || { echo "FAIL 401 sin mensaje accionable"; fail=1; }
+
+# Runtime caído: OFFLINE, y la caché previa intacta. El puerto 9 (discard) está siempre
+# cerrado en el loopback: no hace falta matar el stub, que sigue sirviendo a otros bloques.
+runtime_credentials_merge '{"runtime_url":"http://127.0.0.1:9"}'
+rc=0; bash "$SO" claim >/dev/null 2>&1 || rc=$?
+[ "$rc" = 5 ] && echo "OK claim offline -> rc 5" || { echo "FAIL claim offline rc ($rc)"; fail=1; }
+[ "$(projection_get active_slice.slice_id "")" = "sl-7" ] && echo "OK claim offline preserva la caché" || { echo "FAIL la caché se perdió offline"; fail=1; }
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT_CL\"}"
+
+# ══════════════ slice-ops.sh: fact / propose-asset [Task 5] ══════════════
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# Los hechos de proyecto son de ÁMBITO PROYECTO: se encolan SIN slice_id (§3.1 rev. 3).
+rc=0; bash "$SO" fact scaffold-confirmed --by "ana@equipo" --notes "npm run dev arranca vacío" >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK fact scaffold-confirmed -> rc 0" || { echo "FAIL fact scaffold rc ($rc)"; fail=1; }
+f="$(grep -l '"type": "scaffold_confirmed"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null | head -1)"
+[ -n "$f" ] && [ "$(python3 -c "import json;print('slice_id' in json.load(open('$f')))")" = False ] \
+  && echo "OK el hecho de proyecto va SIN slice_id" || { echo "FAIL scaffold_confirmed con slice_id"; fail=1; }
+[ "$(python3 -c "import json;print(json.load(open('$f'))['payload']['confirmed_by'])")" = "ana@equipo" ] \
+  && echo "OK scaffold_confirmed lleva quién confirmó" || { echo "FAIL payload de scaffold_confirmed"; fail=1; }
+
+rc=0; bash "$SO" fact design-source --applies true --source "docs/05-prototipo/index.html" --confirmed true --by "ana@equipo" >/dev/null || rc=$?
+[ "$rc" = 0 ] && grep -lq '"type": "design_source_declared"' "$PROJ/.claude/state/outbox/"*.json \
+  && echo "OK fact design-source" || { echo "FAIL fact design-source ($rc)"; fail=1; }
+rc=0; bash "$SO" fact project-kind greenfield --source human >/dev/null || rc=$?
+[ "$rc" = 0 ] && grep -lq '"type": "project_kind_declared"' "$PROJ/.claude/state/outbox/"*.json \
+  && echo "OK fact project-kind" || { echo "FAIL fact project-kind ($rc)"; fail=1; }
+echo '[{"id":"homepage","applies":true},{"id":"login-authn","applies":false}]' > "$TMP/checklist.json"
+rc=0; bash "$SO" fact foundation --required true --epic EP-000 --checklist-file "$TMP/checklist.json" >/dev/null || rc=$?
+f="$(grep -l '"type": "foundation_declared"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null | head -1)"
+[ "$rc" = 0 ] && [ -n "$f" ] && [ "$(python3 -c "import json;print(len(json.load(open('$f'))['payload']['checklist']))")" = 2 ] \
+  && echo "OK fact foundation con checklist" || { echo "FAIL fact foundation"; fail=1; }
+
+# Valor inválido: rechazo local, sin encolar.
+rm -f "$PROJ/.claude/state/outbox/"*.json
+rc=0; bash "$SO" fact project-kind marciano >/dev/null 2>&1 || rc=$?
+[ "$rc" = 6 ] && [ "$(find "$PROJ/.claude/state/outbox" -name '*.json' | wc -l | tr -d ' ')" = 0 ] \
+  && echo "OK fact con valor inválido -> rc 6 sin encolar" || { echo "FAIL fact inválido ($rc)"; fail=1; }
+
+# Regresión: si ops_enqueue_from_file falla (outbox no escribible: permisos, disco lleno,
+# excepción de python3), _fact_emit NUNCA debe reportar éxito -- ni rc 0 ni el mensaje
+# "encolado". Condición REAL (no simulada): quitamos permiso de escritura al directorio
+# outbox y confirmamos que mkdir/tempfile fallan de verdad antes de aserir el rc.
+rm -f "$PROJ/.claude/state/outbox/"*.json
+chmod 555 "$PROJ/.claude/state/outbox"
+rc=0; out="$(bash "$SO" fact scaffold-confirmed --by "ana@equipo" 2>&1)" || rc=$?
+chmod 755 "$PROJ/.claude/state/outbox"
+n="$(find "$PROJ/.claude/state/outbox" -name '*.json' 2>/dev/null | wc -l | tr -d ' ')"
+[ "$rc" = "$OPS_RC_OFFLINE" ] && [ "$n" = 0 ] && ! echo "$out" | grep -q '"scaffold_confirmed" encolado' \
+  && echo "OK fact con outbox no escribible -> rc distinguible, sin encolar, sin aviso de éxito" \
+  || { echo "FAIL fact con outbox no escribible (rc=$rc n=$n out=$out)"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# propose-asset: cuerpo {path, type_key, content} contra la superficie de AGENTE.
+# El http-stub sigue usando routes-cl.json, así que agregamos la nueva ruta ahí.
+python3 - "$TMP/routes-cl.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /projects/p-1/context/agent-proposals"]={"status":202,"body":{"proposal_id":"pr-1","status":"pending_admin"}}
+json.dump(d,open(p,"w"))
+PYX
+: > "$TMP/calls-cl.jsonl"
+printf -- '---\nstyle: hexagonal\n---\n# Estilo elegido\nHexagonal.\n' > "$TMP/asset.md"
+rc=0; out="$(bash "$SO" propose-asset --type-key arch.style --path "docs/adr/0001-estilo.md" --content-file "$TMP/asset.md")" || rc=$?
+[ "$rc" = 0 ] && echo "OK propose-asset -> rc 0" || { echo "FAIL propose-asset rc ($rc)"; fail=1; }
+echo "$out" | grep -qi "ADMIN" && echo "OK propose-asset recuerda que publica un ADMIN" || { echo "FAIL propose-asset sin aviso de gobierno"; fail=1; }
+[ "$(python3 - "$TMP/calls-cl.jsonl" <<'PYX'
+import json,sys
+ok=False
+for line in open(sys.argv[1]):
+    c=json.loads(line)
+    if c["path"]=="/projects/p-1/context/agent-proposals":
+        b=json.loads(c["body"])
+        ok = set(b.keys())=={"path","type_key","content"} and "hexagonal" in b["content"]
+print("SI" if ok else "NO")
+PYX
+)" = SI ] && echo "OK propose-asset manda exactamente {path,type_key,content}" || { echo "FAIL cuerpo de propose-asset"; fail=1; }
+
+# 422 del schema del tipo: razón visible, sin reintento.
+python3 - "$TMP/routes-cl.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /projects/p-1/context/agent-proposals"]={"status":422,"body":{"error":"frontmatter_schema","detail":"falta 'style'"}}
+json.dump(d,open(p,"w"))
+PYX
+rc=0; err="$(bash "$SO" propose-asset --type-key arch.style --path "x.md" --content-file "$TMP/asset.md" 2>&1 >/dev/null)" || rc=$?
+[ "$rc" = 6 ] && echo "$err" | grep -q "style" && echo "OK propose-asset 422 muestra la razón" || { echo "FAIL propose-asset 422 ($rc)"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# ══════════════ slice-ops.sh: status / escalate / usage [Task 6] ══════════════
+out="$(bash "$SO" status --no-refresh)"
+rc=$?
+[ "$rc" = 0 ] && echo "OK status -> rc 0" || { echo "FAIL status rc ($rc)"; fail=1; }
+echo "$out" | grep -q "modo:" && echo "$out" | grep -q "sl-7" && echo "$out" | grep -qi "cola" \
+  && echo "OK status informa modo, slice y cola" || { echo "FAIL status incompleto: $out"; fail=1; }
+
+# status es informativo: NUNCA falla aunque no haya nada.
+rm -f "$PROJ/.claude/state/runtime-projection.json"
+rc=0; out="$(TRYCORE_RUNTIME_MODE=legacy bash "$SO" status --no-refresh)" || rc=$?
+[ "$rc" = 0 ] && echo "OK status en legacy sin caché -> rc 0" || { echo "FAIL status legacy rc ($rc)"; fail=1; }
+agent_context_fetch_and_cache
+
+# escalate: evento tipado + instrucción de gobierno humano.
+rm -f "$PROJ/.claude/state/outbox/"*.json
+rc=0; out="$(bash "$SO" escalate "el AC-3 contradice el prototipo" --gate fidelity)" || rc=$?
+[ "$rc" = 0 ] && echo "OK escalate -> rc 0" || { echo "FAIL escalate rc ($rc)"; fail=1; }
+f="$(grep -l '"type": "escalation_raised"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null | head -1)"
+[ -n "$f" ] && [ "$(python3 -c "import json;d=json.load(open('$f'));print('SI' if d['payload']['gate']=='fidelity' and d.get('slice_id')=='sl-7' else 'NO')")" = SI ] \
+  && echo "OK escalate encola con gate y slice_id" || { echo "FAIL payload de escalate"; fail=1; }
+echo "$out" | grep -qi "human" && echo "OK escalate declara que la decisión es humana" || { echo "FAIL escalate sin nota de gobierno"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# Regresión: si ops_enqueue_from_file falla (outbox no escribible), escalate NUNCA debe
+# reportar éxito -- ni rc 0, ni el mensaje "registrada", ni la nota de gobierno humano
+# (que solo tiene sentido si el evento de verdad quedó registrado). Condición REAL: quitamos
+# permiso de escritura al directorio outbox, igual que en la regresión de `fact` de arriba.
+rm -f "$PROJ/.claude/state/outbox/"*.json
+chmod 555 "$PROJ/.claude/state/outbox"
+rc=0; out="$(bash "$SO" escalate "el AC-3 contradice el prototipo" --gate fidelity 2>&1)" || rc=$?
+chmod 755 "$PROJ/.claude/state/outbox"
+n="$(find "$PROJ/.claude/state/outbox" -name '*.json' 2>/dev/null | wc -l | tr -d ' ')"
+[ "$rc" = "$OPS_RC_OFFLINE" ] && [ "$n" = 0 ] && ! echo "$out" | grep -qi "registrada" \
+  && echo "OK escalate con outbox no escribible -> rc distinguible, sin encolar, sin aviso de éxito" \
+  || { echo "FAIL escalate con outbox no escribible (rc=$rc n=$n out=$out)"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# usage: lista los 13 subcomandos REALMENTE implementados (contrato con la prosa de las
+# skills) — el plan queda completo con la Task 4 (wiring/progress/checkpoint).
+usage_out="$(bash "$SO" --help 2>&1)"
+for sub in mode claim next-step gate submit archive wiring progress checkpoint fact propose-asset status escalate; do
+  echo "$usage_out" | grep -q -- "$sub" || { echo "FAIL usage no documenta $sub"; fail=1; }
+done
+echo "$usage_out" | grep -qi "pendientes" \
+  && { echo "FAIL usage todavía anuncia pendientes tras completar la Task 4"; fail=1; } \
+  || echo "OK usage documenta los 13 subcomandos como implementados, sin pendientes"
+
+# Regresión de modo LEGACY sobre TODOS los subcomandos IMPLEMENTADOS que transicionan:
+# rc 3 y cero red (los 13, ya con wiring/progress/checkpoint de la Task 4).
+: > "$TMP/curl-legacy.log"
+for sub in "gate tdd pass" "submit" "archive" "wiring update w1 passing" "progress algo" "checkpoint --note algo" "fact project-kind greenfield" "propose-asset --type-key t --path p --content-file $TMP/asset.md" "escalate algo --gate fidelity"; do
+  rc=0
+  bash -c "PATH=\"$TMP/fakebin:\$PATH\" FAKE_CURL_LOG=\"$TMP/curl-legacy.log\" TRYCORE_RUNTIME_MODE=legacy CLAUDE_PROJECT_DIR=\"$PROJ\" BUILD_CONFIG_FILE=\"$BUILD_CONFIG_FILE\" bash \"$SO\" $sub" >/dev/null 2>&1 || rc=$?
+  [ "$rc" = 3 ] || { echo "FAIL «${sub}» en legacy devolvió $rc (esperado 3)"; fail=1; }
+done
+[ ! -s "$TMP/curl-legacy.log" ] && echo "OK los subcomandos implementados no tocan la red en legacy" || { echo "FAIL algún subcomando abrió socket en legacy"; fail=1; }
+
+# ══════════════ release-ops.sh [Task 7] ══════════════
+RO="$ROOT/hooks/build/release-ops.sh"
+python3 - "$TMP/routes-cl.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /releases/R1-mvp/verdicts"]={"status":200,"body":{"ok":True}}
+d["POST /fronts/fr-1/members/ak-1/integration"]={"status":200,"body":{"ok":True}}
+json.dump(d,open(p,"w"))
+PYX
+: > "$TMP/calls-cl.jsonl"
+
+# Gate de release desconocido: rechazo local, sin red.
+rc=0; bash "$RO" verdict R1-mvp tdd pass >/dev/null 2>&1 || rc=$?
+[ "$rc" = 6 ] && echo "OK verdict de release con gate de slice -> rc 6" || { echo "FAIL gate de release inválido ($rc)"; fail=1; }
+
+# Regresión: bajo `set -u`, este bash (3.2.57) confunde el límite del nombre de una
+# variable cuando queda pegada sin separador a un carácter multibyte como «»» — "$var»"
+# revienta con "unbound variable" aunque $var esté definida; "${var}»" no. Reproducido
+# de forma aislada antes de corregir (script mínimo: set -u; x=1; echo "«$x»" -> revienta).
+# El mensaje de rechazo debe interpolar el gate real y NO reventar por este bug.
+errout="$(bash -c "PATH=\"$TMP/fakebin:\$PATH\" CLAUDE_PROJECT_DIR=\"$PROJ\" BUILD_CONFIG_FILE=\"$BUILD_CONFIG_FILE\" bash \"$RO\" verdict R1-mvp tdd pass" 2>&1 >/dev/null)"
+echo "$errout" | grep -q "«tdd»" && echo "OK el gate rechazado se interpola literal (no «\$gate» roto)" || { echo "FAIL el mensaje de gate rechazado no interpola: $errout"; fail=1; }
+echo "$errout" | grep -qi "unbound variable" && { echo "FAIL el rechazo de gate revienta por el bug de bash 3.2 en «\$var»"; fail=1; } || echo "OK el rechazo de gate no revienta por el bug de bash 3.2 en «\$var»"
+
+# Veredicto feliz: los 6 gates del Release Gate son hechos MEDIDOS (superficie de agente).
+rc=0; bash "$RO" verdict R1-mvp security pass --evidence "0 hallazgos bloqueantes" >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK verdict de release -> rc 0" || { echo "FAIL verdict de release rc ($rc)"; fail=1; }
+[ "$(python3 - "$TMP/calls-cl.jsonl" <<'PYX'
+import json,sys
+ok=False
+for line in open(sys.argv[1]):
+    c=json.loads(line)
+    if c["path"]=="/releases/R1-mvp/verdicts":
+        b=json.loads(c["body"])
+        ok = b["gate"]=="security" and b["status"]=="pass" and "bloqueantes" in b["evidence"]
+print("SI" if ok else "NO")
+PYX
+)" = SI ] && echo "OK el veredicto de release viaja completo" || { echo "FAIL cuerpo del veredicto de release"; fail=1; }
+
+# `na` es legítimo (ux en una release sin UI).
+rc=0; bash "$RO" verdict R1-mvp ux na >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK verdict na" || { echo "FAIL verdict na ($rc)"; fail=1; }
+
+# El CIERRE es humano: close-hint no toca la red y lo dice.
+: > "$TMP/calls-cl.jsonl"
+out="$(bash "$RO" close-hint R1-mvp)"
+rc=$?
+[ "$rc" = 0 ] && [ ! -s "$TMP/calls-cl.jsonl" ] && echo "OK close-hint no llama al runtime" || { echo "FAIL close-hint tocó la red ($rc)"; fail=1; }
+echo "$out" | grep -qi "consola" && echo "OK close-hint remite a la consola humana" || { echo "FAIL close-hint sin instrucción de gobierno"; fail=1; }
+
+# Regresión: close-hint interpola la línea real (heredoc SIN comillas), no el literal "$line"
+# — con varias releases abiertas en paralelo el hint debe decir a cuál se refiere.
+echo "$out" | grep -q '«R1-mvp»' && echo "OK close-hint interpola la línea real" || { echo "FAIL close-hint no interpola \$line: $out"; fail=1; }
+echo "$out" | grep -q '\$line' && { echo "FAIL close-hint imprime el literal \$line en vez del valor"; fail=1; } || echo "OK close-hint no imprime el literal \$line"
+
+# Reporte de integración del miembro del front (cada worktree = agente propio).
+rc=0; bash "$RO" front-integration fr-1 --merge-status merged --resmoke pass --evidence "journey verde tras merge" >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK front-integration -> rc 0" || { echo "FAIL front-integration rc ($rc)"; fail=1; }
+[ "$(python3 - "$TMP/calls-cl.jsonl" <<'PYX'
+import json,sys
+ok=False
+for line in open(sys.argv[1]):
+    c=json.loads(line)
+    if c["path"]=="/fronts/fr-1/members/ak-1/integration":
+        b=json.loads(c["body"])
+        ok = b["merge_status"]=="merged" and b["re_smoke"]["status"]=="pass"
+print("SI" if ok else "NO")
+PYX
+)" = SI ] && echo "OK el reporte de integración lleva merge_status y re_smoke" || { echo "FAIL cuerpo de front-integration"; fail=1; }
+
+# merge_status inválido: rechazo local.
+rc=0; bash "$RO" front-integration fr-1 --merge-status casi >/dev/null 2>&1 || rc=$?
+[ "$rc" = 6 ] && echo "OK merge_status inválido -> rc 6" || { echo "FAIL merge_status inválido ($rc)"; fail=1; }
+
+# legacy: no-op sin red en los tres subcomandos.
+: > "$TMP/curl-legacy.log"
+for sub in "verdict R1-mvp security pass" "front-integration fr-1 --merge-status merged"; do
+  rc=0
+  bash -c "PATH=\"$TMP/fakebin:\$PATH\" FAKE_CURL_LOG=\"$TMP/curl-legacy.log\" TRYCORE_RUNTIME_MODE=legacy CLAUDE_PROJECT_DIR=\"$PROJ\" BUILD_CONFIG_FILE=\"$BUILD_CONFIG_FILE\" bash \"$RO\" $sub" >/dev/null 2>&1 || rc=$?
+  [ "$rc" = 3 ] || { echo "FAIL release-ops «${sub}» en legacy devolvió $rc"; fail=1; }
+done
+[ ! -s "$TMP/curl-legacy.log" ] && echo "OK release-ops no toca la red en legacy" || { echo "FAIL release-ops abrió socket en legacy"; fail=1; }
+
+# Offline: el veredicto de release se encola (protegido como verdict_reported).
+runtime_credentials_merge '{"runtime_url":"http://127.0.0.1:9"}'
+rm -f "$PROJ/.claude/state/outbox/"*.json
+rc=0; bash "$RO" verdict R1-mvp smell fail --evidence "3 smells" >/dev/null 2>&1 || rc=$?
+[ "$rc" = 5 ] && grep -lq '"type": "verdict_reported"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null \
+  && echo "OK verdict de release offline se encola" || { echo "FAIL verdict de release offline ($rc)"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT_CL\"}"
+
+# ══════════════ slice-ops.sh: gate / submit / archive [Task 3] ══════════════
+PORT_GA="$(freeport)"
+cat > "$TMP/routes-ga.json" <<JSON
+{"POST /slices/sl-7/verdicts": {"status": 200, "body": {"ok": true}},
+ "POST /slices/sl-7/submit": {"status": 200, "body": {"ok": true}},
+ "GET /agent/context": {"status": 200, "body": {"project": {"scaffold_confirmed": true}, "active_slice": {"slice_id": "sl-7", "phase": "tdd", "gates": {"dor": true, "tdd": false}}, "context": {"manifest_hash": "sha256:v1"}}},
+ "POST /projects/p-1/mirror/transitions": {"status": 202, "body": {"accepted": true}}}
+JSON
+: > "$TMP/calls-ga.jsonl"
+python3 "$ROOT/scripts/tests/lib/http-stub.py" "$PORT_GA" "$TMP/routes-ga.json" "$TMP/calls-ga.jsonl" &
+STUBS="$STUBS $!"
+sleep 0.3
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT_GA\"}"
+agent_context_fetch_and_cache
+
+# Gate desconocido: rechazo LOCAL, sin tocar la red.
+: > "$TMP/calls-ga.jsonl"
+rc=0; bash "$SO" gate inventado pass >/dev/null 2>&1 || rc=$?
+[ "$rc" = 6 ] && echo "OK gate desconocido -> rc 6" || { echo "FAIL gate desconocido rc ($rc)"; fail=1; }
+[ ! -s "$TMP/calls-ga.jsonl" ] && echo "OK gate desconocido no toca la red" || { echo "FAIL gate desconocido llamó al runtime"; fail=1; }
+
+# Gate feliz con evidencia por fichero (texto largo, tildes y comillas).
+python3 -c "open('$TMP/ev.txt','w').write('suite verde: 42/42 «ñ» \"ok\"\n'*50)"
+rc=0; out="$(bash "$SO" gate tdd pass --evidence-file "$TMP/ev.txt")" || rc=$?
+[ "$rc" = 0 ] && echo "OK gate pass -> rc 0" || { echo "FAIL gate pass rc ($rc)"; fail=1; }
+[ "$(python3 - "$TMP/calls-ga.jsonl" <<'PYX'
+import json,sys
+ok=False
+for line in open(sys.argv[1]):
+    c=json.loads(line)
+    if c["path"]=="/slices/sl-7/verdicts":
+        b=json.loads(c["body"])
+        ok = b["gate"]=="tdd" and b["status"]=="pass" and "42/42" in b["evidence"]
+print("SI" if ok else "NO")
+PYX
+)" = SI ] && echo "OK el veredicto viaja con gate/status/evidence" || { echo "FAIL cuerpo del veredicto"; fail=1; }
+
+# 422: compuerta mecánica del servidor -> rc 6, sin reintento y sin encolar.
+python3 - "$TMP/routes-ga.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /slices/sl-7/verdicts"]={"status":422,"body":{"error":"illegal_transition","detail":"dod exige wiring_verified"}}
+json.dump(d,open(p,"w"))
+PYX
+rm -f "$PROJ/.claude/state/outbox/"*.json
+rc=0; err="$(bash "$SO" gate dod pass 2>&1 >/dev/null)" || rc=$?
+[ "$rc" = 6 ] && echo "OK gate 422 -> rc 6" || { echo "FAIL gate 422 rc ($rc)"; fail=1; }
+echo "$err" | grep -q "wiring_verified" && echo "OK gate 422 muestra la razón del servidor" || { echo "FAIL gate 422 sin razón"; fail=1; }
+n="$(find "$PROJ/.claude/state/outbox" -name '*.json' | wc -l | tr -d ' ')"
+[ "$n" = 0 ] && echo "OK gate 422 no encola (no se reintenta lo rechazado)" || { echo "FAIL gate 422 encoló ($n)"; fail=1; }
+
+# Offline: el veredicto se encola como verdict_reported (protegido) y rc 5.
+runtime_credentials_merge '{"runtime_url":"http://127.0.0.1:9"}'
+rc=0; bash "$SO" gate journey_smoke pass --evidence "smoke verde" >/dev/null 2>&1 || rc=$?
+[ "$rc" = 5 ] && echo "OK gate offline -> rc 5" || { echo "FAIL gate offline rc ($rc)"; fail=1; }
+grep -lq '"type": "verdict_reported"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null \
+  && echo "OK gate offline encola verdict_reported" || { echo "FAIL gate offline no encoló"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# Regresión: revisión final de rama — _ops_post_or_queue (offline, la rama que gate/submit/
+# checkpoint comparten) NUNCA debe reportar "encolado" si ops_enqueue_from_file falla de
+# verdad. Red YA inalcanzable (runtime_url apunta a :9 desde el bloque anterior).
+chmod 555 "$PROJ/.claude/state/outbox"
+rc=0; out="$(bash "$SO" gate journey_smoke pass --evidence "x" 2>&1)" || rc=$?
+chmod 755 "$PROJ/.claude/state/outbox"
+n="$(find "$PROJ/.claude/state/outbox" -name '*.json' 2>/dev/null | wc -l | tr -d ' ')"
+[ "$rc" = "$OPS_RC_OFFLINE" ] && [ "$n" = 0 ] && ! echo "$out" | grep -q 'encolado (tipo protegido' \
+  && echo "OK gate offline con outbox no escribible -> sin encolar, sin aviso de éxito" \
+  || { echo "FAIL gate offline con outbox no escribible (rc=$rc n=$n out=$out)"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT_GA\"}"
+
+# submit
+python3 - "$TMP/routes-ga.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /slices/sl-7/verdicts"]={"status":200,"body":{"ok":True}}
+json.dump(d,open(p,"w"))
+PYX
+rc=0; bash "$SO" submit --pr-url "https://example.invalid/pr/1" --openspec-change add-cobros >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK submit -> rc 0" || { echo "FAIL submit rc ($rc)"; fail=1; }
+grep -q '"path": "/slices/sl-7/submit"' "$TMP/calls-ga.jsonl" && echo "OK submit llama a su endpoint" || { echo "FAIL submit endpoint"; fail=1; }
+
+# archive: SIEMPRE por la cola (opsx:archive corre dentro del PR) y protegido de la cota.
+rm -f "$PROJ/.claude/state/outbox/"*.json
+rc=0; bash "$SO" archive --epic EP-003 --openspec-change add-cobros --pr-url "https://example.invalid/pr/1" >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK archive -> rc 0" || { echo "FAIL archive rc ($rc)"; fail=1; }
+grep -lq '"type": "slice_archived"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null \
+  && echo "OK archive encola slice_archived" || { echo "FAIL archive no encoló"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# Regresión: revisión final de rama — si ops_enqueue_from_file falla, archive NUNCA debe
+# reportar éxito (era el mismo bug ya corregido en _fact_emit, reintroducido aquí).
+chmod 555 "$PROJ/.claude/state/outbox"
+rc=0; out="$(bash "$SO" archive --epic EP-003 --openspec-change add-cobros 2>&1)" || rc=$?
+chmod 755 "$PROJ/.claude/state/outbox"
+n="$(find "$PROJ/.claude/state/outbox" -name '*.json' 2>/dev/null | wc -l | tr -d ' ')"
+[ "$rc" = "$OPS_RC_OFFLINE" ] && [ "$n" = 0 ] && ! echo "$out" | grep -q 'slice_archived encolado' \
+  && echo "OK archive con outbox no escribible -> rc distinguible, sin encolar, sin aviso de éxito" \
+  || { echo "FAIL archive con outbox no escribible (rc=$rc n=$n out=$out)"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# dual: el fichero es primario -> se espeja la transición con la identidad LOCAL.
+cat > "$PROJ/.claude/state/build-state.json" <<'JSON'
+{"version":"1.0.0","active_slice":{"epica":"EP-009","openspec_change":"add-pagos","branch":"feature/pagos","phase":"tdd","gates":{"dor":true}}}
+JSON
+: > "$TMP/calls-ga.jsonl"
+rc=0; TRYCORE_RUNTIME_MODE=dual bash "$SO" gate tdd pass --evidence "verde" >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK gate en dual -> rc 0" || { echo "FAIL gate dual rc ($rc)"; fail=1; }
+[ "$(python3 - "$TMP/calls-ga.jsonl" <<'PYX'
+import json,sys
+ok=False
+for line in open(sys.argv[1]):
+    c=json.loads(line)
+    if c["path"]=="/projects/p-1/mirror/transitions":
+        b=json.loads(c["body"])
+        ok = b["kind"]=="verdict_reported" and b["origin"]=="mirror" and b["payload"]["slice_ref"]["epic_code"]=="EP-009"
+print("SI" if ok else "NO")
+PYX
+)" = SI ] && echo "OK dual espeja con la identidad fichero-primaria" || { echo "FAIL espejo dual"; fail=1; }
+[ ! -s "$PROJ/.claude/state/outbox" ] || true
+grep -q '"path": "/slices/' "$TMP/calls-ga.jsonl" && { echo "FAIL dual llamó a la superficie primaria"; fail=1; } || echo "OK dual no llama a /slices (el fichero decide)"
+
+# dual con espejo caído: avisa pero NO bloquea (rc 0).
+runtime_credentials_merge '{"runtime_url":"http://127.0.0.1:9"}'
+rc=0; TRYCORE_RUNTIME_MODE=dual bash "$SO" gate tdd pass >/dev/null 2>&1 || rc=$?
+[ "$rc" = 0 ] && echo "OK dual con espejo caído no bloquea" || { echo "FAIL dual espejo caído rc ($rc)"; fail=1; }
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT_GA\"}"
+
+# ══════════════ hooks/build/dual-compare.sh [Task E] ══════════════
+# build-state.json de arriba sigue en pie: EP-009, phase tdd, gates {dor:true}.
+# En dual, escalate NO encola: espeja por POST /projects/{id}/mirror/transitions (el
+# fichero es primario) — igual que el resto de cmd_* en dual (ver el bloque de arriba).
+DC="$ROOT/hooks/build/dual-compare.sh"
+mirror_escalated() {
+  # SI/NO: ¿calls-ga.jsonl tiene un POST a mirror/transitions con kind=escalation_raised?
+  python3 - "$TMP/calls-ga.jsonl" <<'PYX'
+import json,sys
+found=False
+for line in open(sys.argv[1]):
+    try:
+        c=json.loads(line)
+    except Exception:
+        continue
+    if c.get("path")=="/projects/p-1/mirror/transitions":
+        b=json.loads(c["body"])
+        if b.get("kind")=="escalation_raised":
+            found=True
+print("SI" if found else "NO")
+PYX
+}
+
+# legacy: no toca red ni outbox (fast exit).
+: > "$TMP/calls-ga.jsonl"
+rc=0; TRYCORE_RUNTIME_MODE=legacy bash "$DC" >/dev/null 2>&1 || rc=$?
+[ "$rc" = 0 ] && [ ! -s "$TMP/calls-ga.jsonl" ] \
+  && echo "OK dual-compare en legacy no toca red" || { echo "FAIL dual-compare legacy (rc=$rc)"; fail=1; }
+
+# runtime (no dual): tampoco corre — el comparador es específico de dual.
+: > "$TMP/calls-ga.jsonl"
+rc=0; TRYCORE_RUNTIME_MODE=runtime bash "$DC" >/dev/null 2>&1 || rc=$?
+[ "$rc" = 0 ] && [ ! -s "$TMP/calls-ga.jsonl" ] && echo "OK dual-compare en runtime no corre (solo aplica a dual)" || { echo "FAIL dual-compare en runtime"; fail=1; }
+
+# dual, proyección COINCIDENTE (épica/fase/gates iguales): sin discrepancia, sin escalar.
+python3 - "$TMP/routes-ga.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["GET /agent/context"]={"status":200,"body":{"active_slice":{"slice_id":"sl-9","epic_code":"EP-009","phase":"tdd","gates":{"dor":True}}}}
+json.dump(d,open(p,"w"))
+PYX
+: > "$TMP/calls-ga.jsonl"
+rc=0; err="$(TRYCORE_RUNTIME_MODE=dual bash "$DC" 2>&1 1>/dev/null)" || rc=$?
+[ "$rc" = 0 ] && [ -z "$err" ] && [ "$(mirror_escalated)" = NO ] \
+  && echo "OK dual-compare sin discrepancia -> silencioso, sin escalar" || { echo "FAIL dual-compare sin discrepancia (rc=$rc err=$err)"; fail=1; }
+
+# dual, épica DISTINTA en el runtime: discrepancia -> escala vía slice-ops.sh escalate (espejo).
+python3 - "$TMP/routes-ga.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["GET /agent/context"]={"status":200,"body":{"active_slice":{"slice_id":"sl-9","epic_code":"EP-999","phase":"tdd","gates":{"dor":True}}}}
+json.dump(d,open(p,"w"))
+PYX
+: > "$TMP/calls-ga.jsonl"
+rc=0; err="$(TRYCORE_RUNTIME_MODE=dual bash "$DC" 2>&1 1>/dev/null)" || rc=$?
+[ "$rc" = 0 ] && [ "$(mirror_escalated)" = SI ] && echo "$err" | grep -qi "discrepancia" \
+  && echo "$err" | grep -q "EP-009" && echo "$err" | grep -q "EP-999" \
+  && echo "OK dual-compare con épica distinta escala con el detalle de ambos lados" || { echo "FAIL dual-compare épica distinta (rc=$rc err=$err)"; fail=1; }
+
+# dual, gate DISTINTO (mismo epic/fase): también cuenta como discrepancia.
+python3 - "$TMP/routes-ga.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["GET /agent/context"]={"status":200,"body":{"active_slice":{"slice_id":"sl-9","epic_code":"EP-009","phase":"tdd","gates":{"dor":False}}}}
+json.dump(d,open(p,"w"))
+PYX
+: > "$TMP/calls-ga.jsonl"
+rc=0; TRYCORE_RUNTIME_MODE=dual bash "$DC" >/dev/null 2>&1 || rc=$?
+[ "$(mirror_escalated)" = SI ] && echo "OK dual-compare detecta gate distinto (dor: true vs false)" || { echo "FAIL dual-compare gate distinto"; fail=1; }
+
+# dual, runtime SIN slice activo (el fichero sí tiene): también es discrepancia.
+python3 - "$TMP/routes-ga.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["GET /agent/context"]={"status":200,"body":{"project":{"scaffold_confirmed":True}}}
+json.dump(d,open(p,"w"))
+PYX
+: > "$TMP/calls-ga.jsonl"
+rc=0; TRYCORE_RUNTIME_MODE=dual bash "$DC" >/dev/null 2>&1 || rc=$?
+[ "$(mirror_escalated)" = SI ] && echo "OK dual-compare detecta slice ausente en el runtime" || { echo "FAIL dual-compare slice ausente en runtime"; fail=1; }
+
+# fail-open: espejo caído (runtime inalcanzable) -> nunca lanza, nunca aborta (rc 0 siempre).
+python3 - "$TMP/routes-ga.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["GET /agent/context"]={"status":200,"body":{"active_slice":{"slice_id":"sl-9","epic_code":"EP-999","phase":"tdd","gates":{"dor":True}}}}
+json.dump(d,open(p,"w"))
+PYX
+runtime_credentials_merge '{"runtime_url":"http://127.0.0.1:9"}'
+rc=0; TRYCORE_RUNTIME_MODE=dual bash "$DC" >/dev/null 2>&1 || rc=$?
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT_GA\"}"
+[ "$rc" = 0 ] && echo "OK dual-compare con espejo caído sigue fail-open (rc 0)" || { echo "FAIL dual-compare espejo caído (rc=$rc)"; fail=1; }
+
+# sin build-state.json: nada que comparar, silencioso.
+rm -f "$PROJ/.claude/state/build-state.json"
+rc=0; TRYCORE_RUNTIME_MODE=dual bash "$DC" >/dev/null 2>&1 || rc=$?
+[ "$rc" = 0 ] && echo "OK dual-compare sin build-state.json -> no-op" || { echo "FAIL dual-compare sin build-state.json (rc=$rc)"; fail=1; }
+
+# Restaura /agent/context y la caché de proyección al estado que esperan los bloques
+# siguientes (slice_id=sl-7): el comparador de arriba mutó routes-ga.json varias veces.
+python3 - "$TMP/routes-ga.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["GET /agent/context"]={"status":200,"body":{"project":{"scaffold_confirmed":True},"active_slice":{"slice_id":"sl-7","phase":"tdd","gates":{"dor":True,"tdd":False}},"context":{"manifest_hash":"sha256:v1"}}}
+json.dump(d,open(p,"w"))
+PYX
+agent_context_fetch_and_cache
+
+# ══════════════ slice-ops.sh: wiring / progress / checkpoint [Task 4] ══════════════
+python3 - "$TMP/routes-ga.json" <<'PYX'
+import json,sys
+p=sys.argv[1]; d=json.load(open(p))
+d["POST /checkpoints"]={"status":200,"body":{"ok":True}}
+json.dump(d,open(p,"w"))
+PYX
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# wiring seed: un evento con TODOS los items, payload por fichero (sin ARG_MAX).
+python3 -c "
+import json
+json.dump([{'item_id':'w%d'%i,'kind':'ac' if i%2 else 'integration','ref':'HU-0%d'%i} for i in range(300)], open('$TMP/items.json','w'))"
+rc=0; bash "$SO" wiring seed --file "$TMP/items.json" >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK wiring seed -> rc 0" || { echo "FAIL wiring seed rc ($rc)"; fail=1; }
+f="$(grep -l '"type": "wiring_checklist_seeded"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null | head -1)"
+[ -n "$f" ] && [ "$(python3 -c "import json;print(len(json.load(open('$f'))['payload']['items']))")" = 300 ] \
+  && echo "OK wiring seed encola los 300 items en un evento" || { echo "FAIL wiring seed payload"; fail=1; }
+[ "$(python3 -c "import json;print(json.load(open('$f')).get('slice_id'))")" = "sl-7" ] \
+  && echo "OK wiring seed lleva slice_id" || { echo "FAIL wiring seed sin slice_id"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# Regresión: revisión final de rama — outbox no escribible -> wiring seed no reporta éxito.
+python3 -c "import json;json.dump([{'item_id':'w0','kind':'ac','ref':'HU-01'}], open('$TMP/items-small.json','w'))"
+chmod 555 "$PROJ/.claude/state/outbox"
+rc=0; out="$(bash "$SO" wiring seed --file "$TMP/items-small.json" 2>&1)" || rc=$?
+chmod 755 "$PROJ/.claude/state/outbox"
+n="$(find "$PROJ/.claude/state/outbox" -name '*.json' 2>/dev/null | wc -l | tr -d ' ')"
+[ "$rc" = "$OPS_RC_OFFLINE" ] && [ "$n" = 0 ] && ! echo "$out" | grep -q 'checklist de wiring sembrado' \
+  && echo "OK wiring seed con outbox no escribible -> rc distinguible, sin encolar, sin aviso de éxito" \
+  || { echo "FAIL wiring seed con outbox no escribible (rc=$rc n=$n out=$out)"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# wiring update: status + kind/ref/evidence (spec §4.1-C amplía el agregado slice).
+rc=0; bash "$SO" wiring update w1 passing --kind e2e --ref HU-011 --evidence "newman 12/12" >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK wiring update -> rc 0" || { echo "FAIL wiring update rc ($rc)"; fail=1; }
+f="$(grep -l '"type": "wiring_item_updated"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null | head -1)"
+[ "$(python3 -c "
+import json;d=json.load(open('$f'))['payload']
+print('SI' if d['item_id']=='w1' and d['status']=='passing' and d['kind']=='e2e' and d['ref']=='HU-011' and '12/12' in d['evidence'] else 'NO')")" = SI ] \
+  && echo "OK wiring update viaja completo" || { echo "FAIL wiring update payload"; fail=1; }
+# Estado inválido: rechazo local, nada encolado.
+rm -f "$PROJ/.claude/state/outbox/"*.json
+rc=0; bash "$SO" wiring update w1 verde >/dev/null 2>&1 || rc=$?
+[ "$rc" = 6 ] && echo "OK wiring update estado inválido -> rc 6" || { echo "FAIL wiring update inválido rc ($rc)"; fail=1; }
+[ "$(find "$PROJ/.claude/state/outbox" -name '*.json' | wc -l | tr -d ' ')" = 0 ] \
+  && echo "OK wiring update inválido no encola" || { echo "FAIL wiring update inválido encoló"; fail=1; }
+
+# Regresión: revisión final de rama — outbox no escribible -> wiring update no reporta éxito.
+chmod 555 "$PROJ/.claude/state/outbox"
+rc=0; out="$(bash "$SO" wiring update w1 passing --evidence "x" 2>&1)" || rc=$?
+chmod 755 "$PROJ/.claude/state/outbox"
+n="$(find "$PROJ/.claude/state/outbox" -name '*.json' 2>/dev/null | wc -l | tr -d ' ')"
+[ "$rc" = "$OPS_RC_OFFLINE" ] && [ "$n" = 0 ] && ! echo "$out" | grep -q 'evento encolado' \
+  && echo "OK wiring update con outbox no escribible -> rc distinguible, sin encolar, sin aviso de éxito" \
+  || { echo "FAIL wiring update con outbox no escribible (rc=$rc n=$n out=$out)"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# progress: nota por argumento y por fichero; tipo EVICTABLE (no protegido).
+rc=0; bash "$SO" progress "cableado el paso 2 del journey" >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK progress -> rc 0" || { echo "FAIL progress rc ($rc)"; fail=1; }
+case " $RUNTIME_OUTBOX_PROTECTED " in
+  *" progress_note_recorded "*) echo "FAIL progress_note_recorded no debe estar protegido"; fail=1 ;;
+  *) echo "OK progress_note_recorded es evictable" ;;
+esac
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# Regresión: revisión final de rama — outbox no escribible -> progress no reporta éxito.
+chmod 555 "$PROJ/.claude/state/outbox"
+rc=0; out="$(bash "$SO" progress "nota cualquiera" 2>&1)" || rc=$?
+chmod 755 "$PROJ/.claude/state/outbox"
+n="$(find "$PROJ/.claude/state/outbox" -name '*.json' 2>/dev/null | wc -l | tr -d ' ')"
+[ "$rc" = "$OPS_RC_OFFLINE" ] && [ "$n" = 0 ] && ! echo "$out" | grep -q 'nota de progreso encolada' \
+  && echo "OK progress con outbox no escribible -> rc distinguible, sin encolar, sin aviso de éxito" \
+  || { echo "FAIL progress con outbox no escribible (rc=$rc n=$n out=$out)"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+
+# checkpoint: POST con rama y commit reales del repo del PROYECTO.
+: > "$TMP/calls-ga.jsonl"
+rc=0; bash "$SO" checkpoint --note "parada por contexto crítico" >/dev/null || rc=$?
+[ "$rc" = 0 ] && echo "OK checkpoint -> rc 0" || { echo "FAIL checkpoint rc ($rc)"; fail=1; }
+[ "$(python3 - "$TMP/calls-ga.jsonl" <<'PYX'
+import json,sys
+ok=False
+for line in open(sys.argv[1]):
+    c=json.loads(line)
+    if c["path"]=="/checkpoints":
+        b=json.loads(c["body"])
+        ok = b.get("slice_id")=="sl-7" and "note" in b and "branch" in b and "commit_sha" in b
+print("SI" if ok else "NO")
+PYX
+)" = SI ] && echo "OK el checkpoint viaja con slice/branch/commit/note" || { echo "FAIL cuerpo del checkpoint"; fail=1; }
+
+# checkpoint offline: se encola como checkpoint_created (protegido).
+runtime_credentials_merge '{"runtime_url":"http://127.0.0.1:9"}'
+rm -f "$PROJ/.claude/state/outbox/"*.json
+rc=0; bash "$SO" checkpoint --note "sin red" >/dev/null 2>&1 || rc=$?
+[ "$rc" = 5 ] && echo "OK checkpoint offline -> rc 5" || { echo "FAIL checkpoint offline rc ($rc)"; fail=1; }
+grep -lq '"type": "checkpoint_created"' "$PROJ/.claude/state/outbox/"*.json 2>/dev/null \
+  && echo "OK checkpoint offline encola" || { echo "FAIL checkpoint offline no encoló"; fail=1; }
+rm -f "$PROJ/.claude/state/outbox/"*.json
+runtime_credentials_merge "{\"runtime_url\":\"http://127.0.0.1:$PORT_GA\"}"
+
+# ══════════════ scripts/lib/graph-bundle.py [Task 13] ══════════════
+GB="$ROOT/scripts/lib/graph-bundle.py"
+cat > "$TMP/epics.json" <<'JSON'
+{"project_ref":"acme","epics":[
+  {"code":"EP-002","title":"Cobros","layer":"business","files_scope":["src/pagos/**"],"depends_on":["EP-001"],"stories":[{"id":"HU-011","title":"Cobrar"}]},
+  {"code":"EP-001","title":"Cimiento","layer":"foundational","files_scope":["src/core/**"],"depends_on":[]},
+  {"code":"EP-002","title":"Duplicada","layer":"business"},
+  {"code":"EP-003","title":"Suelta","depends_on":["EP-404"]}
+],"release_lines":[{"id":"R1-mvp","epics":["EP-001","EP-002"]}]}
+JSON
+out="$(python3 "$GB" < "$TMP/epics.json" 2> "$TMP/gb.err")"
+rc=$?
+[ "$rc" = 0 ] && echo "OK graph-bundle rc 0" || { echo "FAIL graph-bundle rc ($rc)"; fail=1; }
+[ "$(echo "$out" | python3 -c 'import json,sys;d=json.load(sys.stdin);print(",".join(e["code"] for e in d["epics"]))')" = "EP-001,EP-002,EP-003" ] \
+  && echo "OK graph-bundle deduplica y ordena determinísticamente" || { echo "FAIL orden/dedup del bundle"; fail=1; }
+grep -q "EP-002" "$TMP/gb.err" && echo "OK graph-bundle avisa del código duplicado" || { echo "FAIL sin aviso de duplicado"; fail=1; }
+grep -q "EP-404" "$TMP/gb.err" && echo "OK graph-bundle avisa de la dependencia inexistente" || { echo "FAIL sin aviso de dep inexistente"; fail=1; }
+[ "$(echo "$out" | python3 -c 'import json,sys;d=json.load(sys.stdin);print(d["kind"],d["bundle_version"])')" = "graph 1" ] \
+  && echo "OK el bundle se autodescribe (kind/bundle_version)" || { echo "FAIL cabecera del bundle"; fail=1; }
+# El bundle es DETERMINISTA: dos corridas idénticas salvo el sello temporal.
+out2="$(python3 "$GB" < "$TMP/epics.json" 2>/dev/null)"
+a="$(echo "$out" | python3 -c 'import json,sys;d=json.load(sys.stdin);d.pop("generated_at");print(json.dumps(d,sort_keys=True))')"
+b="$(echo "$out2" | python3 -c 'import json,sys;d=json.load(sys.stdin);d.pop("generated_at");print(json.dumps(d,sort_keys=True))')"
+[ "$a" = "$b" ] && echo "OK el bundle es determinista" || { echo "FAIL el bundle no es determinista"; fail=1; }
+# Ciclo: se avisa, no se lanza.
+echo '{"epics":[{"code":"EP-A","depends_on":["EP-B"]},{"code":"EP-B","depends_on":["EP-A"]}]}' | python3 "$GB" > /dev/null 2> "$TMP/gb2.err"
+rc=$?
+[ "$rc" = 0 ] && grep -qi "ciclo" "$TMP/gb2.err" && echo "OK graph-bundle detecta ciclos sin lanzar" || { echo "FAIL ciclos ($rc)"; fail=1; }
+# Entrada ilegible: rc 1 y mensaje, jamás traceback.
+echo 'no-json' | python3 "$GB" > /dev/null 2> "$TMP/gb3.err"
+rc=$?
+[ "$rc" = 1 ] && ! grep -q "Traceback" "$TMP/gb3.err" && echo "OK graph-bundle con entrada ilegible -> rc 1 limpio" || { echo "FAIL entrada ilegible ($rc)"; fail=1; }
+
+exit $fail