@windyroad/architect 0.5.1 → 0.5.2

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "wr-architect",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Architecture decision enforcement for Claude Code"
 }

package/README.md

@@ -42,7 +42,7 @@ This walks you through creating an ADR in [MADR 4.0](https://adr.github.io/madr/
 | `architect-detect.sh` | Every prompt | Checks for `docs/decisions/` and injects the review instruction |
 | `architect-enforce-edit.sh` | Edit or Write | Blocks the edit if the architect hasn't reviewed yet |
 | `architect-plan-enforce.sh` | ExitPlanMode | Ensures plans are reviewed before execution |
-| `architect-mark-reviewed.sh` | Agent completes | Marks the review as done (TTL: 1800s) |
+| `architect-mark-reviewed.sh` | Agent completes | Marks the review as done (TTL: 3600s) |
 | `architect-refresh-hash.sh` | After edit | Refreshes the content hash so the next edit triggers a fresh review |
 
 ## Agent

package/hooks/architect-slide-marker.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Architecture - PostToolUse:Agent|Bash slide-marker hook (P111).
+# Slides the parent session's existing architect-reviewed marker forward on
+# subprocess return, treating subprocess wall-clock as continuous parent-
+# session work for TTL purposes. Only TOUCHES an existing marker — never
+# creates one (creation requires a real architect review parsed from the
+# agent's verdict text in architect-mark-reviewed.sh).
+#
+# This addresses P111 / ADR-009 "Subprocess-boundary refresh": Agent and Bash
+# tool calls that wrap long-running subprocesses (other subagents, `claude
+# -p` iteration subprocesses, run_in_background completions) would otherwise
+# let the parent's marker age past TTL even though the parent is still
+# actively working through the subprocess.
+#
+# Failed subprocesses (tool_response.is_error=true) do NOT extend the trust
+# window — see slide_marker_on_subprocess_return in lib/gate-helpers.sh.
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/lib/gate-helpers.sh"
+
+_parse_input
+
+SESSION_ID=$(_get_session_id)
+[ -n "$SESSION_ID" ] || exit 0
+
+slide_marker_on_subprocess_return "/tmp/architect-reviewed-${SESSION_ID}"
+slide_marker_on_subprocess_return "/tmp/architect-plan-reviewed-${SESSION_ID}"
+
+exit 0

package/hooks/hooks.json

@@ -9,7 +9,8 @@
     ],
     "PostToolUse": [
       { "matcher": "Agent", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/architect-mark-reviewed.sh" }] },
-      { "matcher": "Edit|Write", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/architect-refresh-hash.sh" }] }
+      { "matcher": "Edit|Write", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/architect-refresh-hash.sh" }] },
+      { "matcher": "Agent|Bash", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/architect-slide-marker.sh" }] }
     ]
   }
 }

package/hooks/lib/architect-gate.sh

@@ -12,7 +12,7 @@ source "$_ARCHITECT_GATE_DIR/gate-helpers.sh"
 check_architect_gate() {
   local SESSION_ID="$1"
   local MARKER="/tmp/architect-reviewed-${SESSION_ID}"
-  local TTL_SECONDS="${ARCHITECT_TTL:-1800}"
+  local TTL_SECONDS="${ARCHITECT_TTL:-3600}"
 
   if [ -n "$SESSION_ID" ] && [ -f "$MARKER" ]; then
     local NOW=$(date +%s)

package/hooks/lib/gate-helpers.sh

@@ -153,6 +153,56 @@ _risk_dir() {
   echo "$dir"
 }
 
+# ---------------------------------------------------------------------------
+# Subprocess-completion marker slide (P111, ADR-009 amendment)
+# ---------------------------------------------------------------------------
+
+# Slides an existing session-review marker forward on subprocess return,
+# treating subprocess wall-clock as continuous parent-session work for TTL
+# purposes. Intended for PostToolUse hooks on Agent / Bash that may have
+# been long-running subprocesses (Agent-tool delegations, `claude -p`
+# iteration subprocesses, run_in_background completions).
+#
+# Contract:
+#   - Touches the marker ONLY if it already exists. NEVER creates a marker
+#     (creating requires a real gate review with verdict parsing).
+#   - Skips the touch if tool_response.is_error == true. A failed
+#     subprocess MUST NOT extend the parent's trust window.
+#   - Fail-safe on parse error: if _HOOK_INPUT cannot be parsed, treat as
+#     error and skip the touch.
+#   - No-op when marker path is empty or marker file does not exist.
+#
+# Why this is NOT cross-process marker sharing (ADR-032 line 123 invariant):
+# the parent's PostToolUse hook touches the parent's OWN marker. The
+# subprocess's session id, marker, and gate state are never read or shared.
+# This is identical in shape to the existing PreToolUse:Edit slide; only
+# the trigger expands to subprocess return.
+#
+# Usage: slide_marker_on_subprocess_return "/tmp/architect-reviewed-${SESSION_ID}"
+slide_marker_on_subprocess_return() {
+    local MARKER="$1"
+    [ -n "$MARKER" ] || return 0
+    [ -f "$MARKER" ] || return 0
+
+    local IS_ERROR
+    IS_ERROR=$(echo "$_HOOK_INPUT" | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    tr = data.get('tool_response', {})
+    if isinstance(tr, dict):
+        print('true' if tr.get('is_error') is True else 'false')
+    else:
+        print('false')
+except Exception:
+    print('true')
+" 2>/dev/null || echo "true")
+
+    if [ "$IS_ERROR" = "false" ]; then
+        touch "$MARKER"
+    fi
+}
+
 # ---------------------------------------------------------------------------
 # Non-doc file detection for WIP gating
 # ---------------------------------------------------------------------------

package/hooks/test/architect-slide-marker.bats

@@ -0,0 +1,78 @@
+#!/usr/bin/env bats
+
+# Hook-level integration tests for architect-slide-marker.sh (P111).
+# Verifies that the PostToolUse:Agent|Bash hook correctly wires session_id
+# extraction + slide_marker_on_subprocess_return for the architect markers.
+
+setup() {
+  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
+  HOOK="$HOOKS_DIR/architect-slide-marker.sh"
+  TEST_SESSION="bats-arch-slide-$$-${BATS_TEST_NUMBER}"
+  REVIEW_MARKER="/tmp/architect-reviewed-${TEST_SESSION}"
+  PLAN_MARKER="/tmp/architect-plan-reviewed-${TEST_SESSION}"
+  rm -f "$REVIEW_MARKER" "$PLAN_MARKER"
+}
+
+teardown() {
+  rm -f "$REVIEW_MARKER" "$PLAN_MARKER"
+}
+
+_backdate() {
+  local file="$1" seconds="$2"
+  local stamp
+  stamp=$(date -v-${seconds}S +%Y%m%d%H%M.%S 2>/dev/null \
+       || date -d "${seconds} seconds ago" +%Y%m%d%H%M.%S 2>/dev/null)
+  touch -t "$stamp" "$file"
+}
+
+@test "hook: slides architect-reviewed marker on subprocess return" {
+  touch "$REVIEW_MARKER"
+  _backdate "$REVIEW_MARKER" 60
+  BEFORE=$(stat -c%Y "$REVIEW_MARKER" 2>/dev/null || /usr/bin/stat -f%m "$REVIEW_MARKER")
+  echo '{"session_id":"'"$TEST_SESSION"'","tool_name":"Agent","tool_response":{"content":[]}}' | "$HOOK"
+  AFTER=$(stat -c%Y "$REVIEW_MARKER" 2>/dev/null || /usr/bin/stat -f%m "$REVIEW_MARKER")
+  [ "$AFTER" -gt "$BEFORE" ]
+}
+
+@test "hook: slides architect-plan-reviewed marker too" {
+  touch "$PLAN_MARKER"
+  _backdate "$PLAN_MARKER" 60
+  BEFORE=$(stat -c%Y "$PLAN_MARKER" 2>/dev/null || /usr/bin/stat -f%m "$PLAN_MARKER")
+  echo '{"session_id":"'"$TEST_SESSION"'","tool_name":"Agent","tool_response":{"content":[]}}' | "$HOOK"
+  AFTER=$(stat -c%Y "$PLAN_MARKER" 2>/dev/null || /usr/bin/stat -f%m "$PLAN_MARKER")
+  [ "$AFTER" -gt "$BEFORE" ]
+}
+
+@test "hook: skips slide when tool_response.is_error=true" {
+  touch "$REVIEW_MARKER"
+  _backdate "$REVIEW_MARKER" 60
+  BEFORE=$(stat -c%Y "$REVIEW_MARKER" 2>/dev/null || /usr/bin/stat -f%m "$REVIEW_MARKER")
+  echo '{"session_id":"'"$TEST_SESSION"'","tool_name":"Bash","tool_response":{"is_error":true,"content":[]}}' | "$HOOK"
+  AFTER=$(stat -c%Y "$REVIEW_MARKER" 2>/dev/null || /usr/bin/stat -f%m "$REVIEW_MARKER")
+  [ "$BEFORE" = "$AFTER" ]
+}
+
+@test "hook: no-op when no marker exists (never creates)" {
+  [ ! -f "$REVIEW_MARKER" ]
+  echo '{"session_id":"'"$TEST_SESSION"'","tool_name":"Agent","tool_response":{"content":[]}}' | "$HOOK"
+  [ ! -f "$REVIEW_MARKER" ]
+}
+
+@test "hook: exits 0 when session_id is missing" {
+  run bash -c 'echo "{}" | '"$HOOK"
+  [ "$status" -eq 0 ]
+}
+
+@test "hook: P111 reproduction — long subprocess does not cause parent marker expiry on return" {
+  touch "$REVIEW_MARKER"
+  # Marker is 50 minutes old, well within default 60-min TTL but close.
+  # Without the slide on subprocess return, a 15-min subprocess would push
+  # the next PreToolUse check past TTL. With the slide, the next check sees
+  # a fresh marker.
+  _backdate "$REVIEW_MARKER" 3000
+  echo '{"session_id":"'"$TEST_SESSION"'","tool_name":"Bash","tool_input":{"command":"claude -p ..."},"tool_response":{"content":[{"type":"text","text":"OK"}]}}' | "$HOOK"
+  NOW=$(date +%s)
+  AFTER=$(stat -c%Y "$REVIEW_MARKER" 2>/dev/null || /usr/bin/stat -f%m "$REVIEW_MARKER")
+  AGE=$((NOW - AFTER))
+  [ "$AGE" -lt 5 ]
+}

package/hooks/test/slide-marker-on-subprocess-return.bats

@@ -0,0 +1,100 @@
+#!/usr/bin/env bats
+
+# Tests for slide_marker_on_subprocess_return helper (P111).
+#
+# Behavioural contract:
+# - Slides an existing marker forward (touch) on PostToolUse:Agent|Bash
+#   completion, treating subprocess wall-clock as continuous parent-session
+#   work for TTL purposes.
+# - Never CREATES a marker (creating requires a real gate review).
+# - Skips slide on subprocess error (tool_response.is_error=true) so a failed
+#   subprocess does NOT extend the parent's trust window (ADR-009 amendment).
+# - No-op when no marker exists or session_id is empty (fail-safe).
+
+setup() {
+  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
+  source "$HOOKS_DIR/lib/gate-helpers.sh"
+
+  TEST_SESSION="bats-slide-$$-${BATS_TEST_NUMBER}"
+  MARKER="/tmp/architect-reviewed-${TEST_SESSION}"
+  rm -f "$MARKER"
+}
+
+teardown() {
+  rm -f "$MARKER"
+}
+
+# Helper: backdate file mtime by N seconds (portable between macOS and Linux)
+_backdate() {
+  local file="$1" seconds="$2"
+  local stamp
+  stamp=$(date -v-${seconds}S +%Y%m%d%H%M.%S 2>/dev/null \
+       || date -d "${seconds} seconds ago" +%Y%m%d%H%M.%S 2>/dev/null)
+  touch -t "$stamp" "$file"
+}
+
+@test "slide: existing marker is touched on success response" {
+  touch "$MARKER"
+  _backdate "$MARKER" 60
+  BEFORE=$(_mtime "$MARKER")
+  _HOOK_INPUT='{"tool_response":{"content":[]}}'
+  slide_marker_on_subprocess_return "$MARKER"
+  AFTER=$(_mtime "$MARKER")
+  [ "$AFTER" -gt "$BEFORE" ]
+}
+
+@test "slide: long-running subprocess does NOT cause parent marker expiry on return (P111 reproduction)" {
+  # Simulate the P111 failure mode: parent's marker is set, then a long
+  # subprocess runs (we backdate the marker to simulate elapsed wall-clock),
+  # then PostToolUse fires with a successful tool_response. The marker mtime
+  # must be refreshed so the parent's NEXT PreToolUse gate check (which
+  # compares NOW - mtime against TTL) sees a fresh marker.
+  touch "$MARKER"
+  # Marker is 50 minutes old — under default 60-min TTL but close to expiry.
+  # Without the slide on subprocess return, a subsequent 15-min subprocess
+  # would push the mtime past TTL and the next PreToolUse would deny.
+  _backdate "$MARKER" 3000
+  BEFORE=$(_mtime "$MARKER")
+  _HOOK_INPUT='{"tool_response":{"content":[{"type":"text","text":"OK"}]}}'
+  slide_marker_on_subprocess_return "$MARKER"
+  AFTER=$(_mtime "$MARKER")
+  NOW=$(date +%s)
+  [ "$AFTER" -gt "$BEFORE" ]
+  # And the new mtime is approximately NOW (within 5 seconds of slide call)
+  AGE=$((NOW - AFTER))
+  [ "$AGE" -lt 5 ]
+}
+
+@test "slide: does NOT touch marker when tool_response.is_error=true" {
+  touch "$MARKER"
+  _backdate "$MARKER" 60
+  BEFORE=$(_mtime "$MARKER")
+  _HOOK_INPUT='{"tool_response":{"is_error":true,"content":[]}}'
+  slide_marker_on_subprocess_return "$MARKER"
+  AFTER=$(_mtime "$MARKER")
+  [ "$BEFORE" = "$AFTER" ]
+}
+
+@test "slide: no-op when marker does not exist (never creates)" {
+  [ ! -f "$MARKER" ]
+  _HOOK_INPUT='{"tool_response":{"content":[]}}'
+  slide_marker_on_subprocess_return "$MARKER"
+  [ ! -f "$MARKER" ]
+}
+
+@test "slide: no-op when marker path argument is empty" {
+  _HOOK_INPUT='{"tool_response":{"content":[]}}'
+  run slide_marker_on_subprocess_return ""
+  [ "$status" -eq 0 ]
+}
+
+@test "slide: malformed hook input is fail-safe (no slide)" {
+  touch "$MARKER"
+  _backdate "$MARKER" 60
+  BEFORE=$(_mtime "$MARKER")
+  _HOOK_INPUT='not valid json'
+  slide_marker_on_subprocess_return "$MARKER"
+  AFTER=$(_mtime "$MARKER")
+  # Fail-safe: when the hook input cannot be parsed, treat as error and skip
+  [ "$BEFORE" = "$AFTER" ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/architect",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Architecture decision enforcement for AI coding agents",
   "bin": {
     "windyroad-architect": "./bin/install.mjs"