@windyroad/itil 0.34.0 → 0.35.0-preview.344

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "wr-itil",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "ITIL-aligned IT service management for Claude Code"
 }

package/bin/wr-itil-plugin-maturity-render

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# packages/itil/bin/wr-itil-plugin-maturity-render
+#
+# ADR-049 shim — resolves the canonical body in this package's scripts/
+# dir. The canonical body lives at
+# `packages/itil/scripts/plugin-maturity-render.sh`; this shim is the
+# `$PATH`-resolvable entrypoint that adopter trees invoke.
+#
+# Phase 3b of the P087 plugin maturity rollout.
+
+exec "$(dirname "$0")/../scripts/plugin-maturity-render.sh" "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/itil",
-  "version": "0.34.0",
+  "version": "0.35.0-preview.344",
   "description": "ITIL-aligned IT service management for Claude Code (problem, and future incident/change skills)",
   "bin": {
     "windyroad-itil": "./bin/install.mjs"

package/scripts/plugin-maturity-render.sh

@@ -0,0 +1,394 @@
+#!/usr/bin/env bash
+# packages/itil/scripts/plugin-maturity-render.sh
+#
+# Phase 3b (P087 / P238) plugin-maturity README renderer.
+#
+# Reads each `packages/<plugin>/.claude-plugin/plugin.json` `maturity:`
+# field (populated by Phase 3a `wr-itil-plugin-maturity-populate`) and
+# writes:
+#
+#   1. Prose-woven rollup badge into the README.md value-framing lead
+#      prose line (the first **bold** line after the H1). Format:
+#        Post-bootstrap: `*Maturity: <Band>.*`
+#        Bootstrapping window: `*Maturity: <Band> (suite-bootstrap window;
+#                              <N> invocations / 30d).*`
+#      Markdown text only — no shields.io URL, no inline SVG (ADR-063
+#      §README badge rendering format).
+#
+#   2. Per-skill `Maturity` column populated in the existing `## Skills`
+#      table. Cell value is band name only (no compound — compound stays
+#      at the rollup per ADR-063). Adds the column header on first run;
+#      replaces cell values on subsequent runs.
+#
+# Idempotent: re-running with unchanged plugin.json + README produces
+# byte-identical README output. Replaces existing `*Maturity: ...*` span
+# rather than appending.
+#
+# Anti-patterns enforced (ADR-063 §Decision Outcome §"README badge
+# rendering format" + §"Bootstrapping clause rendering"):
+#   - NEVER emit a standalone `## Maturity` section
+#   - NEVER emit a header block immediately after H1 before any prose
+#   - NEVER emit a shields.io URL or inline SVG
+#   - Compound rendering stays at rollup only — per-skill cell carries
+#     band name only
+#
+# ADR-044 silent-framework carve-out: band has already been computed by
+# Phase 3a per ADR-053 §promotion criteria; the renderer is mechanical
+# and never invokes AskUserQuestion.
+#
+# Usage:
+#   wr-itil-plugin-maturity-render
+#     [--project-root=PATH]   # default: $PWD
+#     [--dry-run]             # print diff to stdout, do not write
+#
+# Exit codes:
+#   0 = always — ADR-013 Rule 6 fail-safe. Missing packages/ / opt-out
+#                marker / missing plugin.json / missing README / missing
+#                maturity field all hit no-write stderr-comment paths.
+#
+# Privacy (ADR-035 clauses adopted verbatim):
+#   - Opt-out marker `.claude/.skill-metrics-opt-out` disables writes.
+#   - No network egress — script body invokes no exfiltration primitive.
+#
+# @problem P238 (Phase 3b — README badge renderer + advisory drift detector)
+# @problem P087 (parent — no maturity signal on plugin features)
+# @adr ADR-063 (Plugin maturity presentation layer — Phase 3b contract)
+# @adr ADR-053 (Plugin maturity taxonomy — Bootstrapping clause rendering)
+# @adr ADR-051 (JTBD-anchored README — prose-weaving precedent)
+# @adr ADR-049 (Shim grammar — `wr-itil-plugin-maturity-render` on $PATH)
+# @adr ADR-044 (Decision delegation — silent-framework carve-out)
+# @adr ADR-035 (Privacy posture — opt-out marker, no network primitive)
+# @adr ADR-052 (Behavioural tests default)
+# @adr ADR-013 Rule 6 (non-interactive fail-safe — exit 0 always)
+# @jtbd JTBD-302 (Trust That the README Describes the Plugin I Just
+#   Installed — README is the contract surface)
+# @jtbd JTBD-101 (Extend the Suite — clear patterns include stability)
+# @jtbd JTBD-003 (Compose Only the Guardrails I Need — at-a-glance
+#   stability for composition decisions)
+
+set -uo pipefail
+
+# ── CLI parse ───────────────────────────────────────────────────────────────
+
+PROJECT_ROOT="$PWD"
+DRY_RUN=0
+
+for arg in "$@"; do
+  case "$arg" in
+    --project-root=*) PROJECT_ROOT="${arg#--project-root=}" ;;
+    --dry-run)        DRY_RUN=1 ;;
+    --help|-h)
+      sed -n '4,70p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *)
+      echo "# wr-itil-plugin-maturity-render: ignoring unknown argument: $arg" >&2
+      ;;
+  esac
+done
+
+# ── Opt-out marker check (ADR-035) ──────────────────────────────────────────
+
+OPT_OUT_MARKER="${PROJECT_ROOT}/.claude/.skill-metrics-opt-out"
+if [ -e "$OPT_OUT_MARKER" ]; then
+  echo "# wr-itil-plugin-maturity-render: opt-out marker present at ${OPT_OUT_MARKER}" >&2
+  exit 0
+fi
+
+# ── packages/ discovery check (ADR-013 Rule 6 fail-safe) ────────────────────
+
+if [ ! -d "${PROJECT_ROOT}/packages" ]; then
+  echo "# wr-itil-plugin-maturity-render: no packages/ directory at ${PROJECT_ROOT}" >&2
+  exit 0
+fi
+
+# ── Python body ─────────────────────────────────────────────────────────────
+
+export PMR_PROJECT_ROOT="$PROJECT_ROOT"
+export PMR_DRY_RUN="$DRY_RUN"
+
+python3 - <<'PYEOF'
+import json, os, re, sys
+from pathlib import Path
+
+project_root = Path(os.environ["PMR_PROJECT_ROOT"]).resolve()
+dry_run = os.environ.get("PMR_DRY_RUN", "0") == "1"
+
+packages_dir = project_root / "packages"
+plugin_dirs = sorted(
+    [d for d in packages_dir.iterdir()
+     if d.is_dir() and (d / ".claude-plugin" / "plugin.json").is_file()]
+)
+if not plugin_dirs:
+    print("# wr-itil-plugin-maturity-render: no plugins under packages/", file=sys.stderr)
+    sys.exit(0)
+
+# Match an existing prose-woven badge: `*Maturity: <body>.*` where body
+# may contain anything except a `*`. Anchored on word `Maturity:` to
+# avoid eating arbitrary italic spans.
+BADGE_RE = re.compile(r"\s*\*Maturity:\s+[^*]+\*")
+
+# Match a standalone `## Maturity` heading (anti-pattern enforcement —
+# never emitted; detector catches drift if introduced by hand).
+ANTI_SECTION_RE = re.compile(r"(?m)^##\s+Maturity\s*$")
+
+
+def format_rollup_badge(maturity_record):
+    """Render the prose-woven rollup badge per ADR-063.
+
+    During the suite-bootstrap window the rollup carries the compound
+    form per ADR-053 §Bootstrapping clause rendering; post-sunset it
+    renders the band name only.
+    """
+    band = maturity_record.get("band", "Experimental")
+    bootstrapping = bool(maturity_record.get("bootstrapping"))
+    inv = maturity_record.get("rollup_invocations_30d")
+    if bootstrapping and isinstance(inv, int) and inv > 0:
+        return f"*Maturity: {band} (suite-bootstrap window; {inv} invocations / 30d).*"
+    return f"*Maturity: {band}.*"
+
+
+def weave_rollup_into_lead_prose(readme_text, badge):
+    """Insert / replace the prose-woven rollup badge in the
+    value-framing lead-prose line (the first **bold** paragraph after
+    the H1). Returns the updated README text.
+
+    Idempotent: if the lead-prose line already ends with a `*Maturity:
+    ...*` span, replace it; otherwise append `<space><badge>` to the
+    end of that line.
+    """
+    lines = readme_text.split("\n")
+    h1_idx = None
+    for i, line in enumerate(lines):
+        if line.startswith("# "):
+            h1_idx = i
+            break
+    if h1_idx is None:
+        return readme_text  # no H1 — skip (defensive)
+
+    # Find first non-empty line after H1 that looks like value-framing
+    # prose. Preferred: starts with `**` (bold-lead pattern). Fallback:
+    # first non-empty non-heading line.
+    lead_idx = None
+    fallback_idx = None
+    for j in range(h1_idx + 1, len(lines)):
+        s = lines[j].strip()
+        if not s:
+            continue
+        if s.startswith("#"):
+            continue
+        if fallback_idx is None:
+            fallback_idx = j
+        if s.startswith("**"):
+            lead_idx = j
+            break
+    if lead_idx is None:
+        lead_idx = fallback_idx
+    if lead_idx is None:
+        return readme_text  # no prose found — skip (defensive)
+
+    line = lines[lead_idx]
+    # Strip any existing `*Maturity: ...*` span (idempotency contract).
+    stripped = BADGE_RE.sub("", line).rstrip()
+    new_line = f"{stripped} {badge}"
+    lines[lead_idx] = new_line
+    return "\n".join(lines)
+
+
+SKILLS_HEADER_RE = re.compile(r"(?m)^##\s+Skills\s*$")
+TABLE_ROW_RE = re.compile(r"^\|.*\|\s*$")
+SEPARATOR_RE = re.compile(r"^\|\s*[-:]+(\s*\|\s*[-:]+)+\s*\|\s*$")
+
+
+def split_row(row):
+    """Split a markdown table row by `|`. Returns the inner cells
+    (skips the leading + trailing empty splits from the outer `|`).
+    Cells are NOT stripped — preserves padding for round-trip.
+    """
+    parts = row.split("|")
+    # Drop the leading empty (before first `|`) and trailing empty
+    # (after last `|`) when present.
+    if parts and parts[0].strip() == "":
+        parts = parts[1:]
+    if parts and parts[-1].strip() == "":
+        parts = parts[:-1]
+    return parts
+
+
+def join_row(cells):
+    return "| " + " | ".join(c.strip() for c in cells) + " |"
+
+
+def extract_skill_name(cell):
+    """Extract the skill name from a `## Skills` cell. Skill cells
+    typically read `/wr-<plugin>:<name>` or `\`/wr-<plugin>:<name>\``.
+    Returns the bare skill name (after the colon), or None if the cell
+    doesn't carry a skill identifier.
+    """
+    text = cell.strip()
+    # Strip surrounding backticks.
+    text = text.strip("`")
+    m = re.search(r"/wr-[a-z0-9-]+:([a-z0-9-]+)", text)
+    if m:
+        return m.group(1)
+    return None
+
+
+def populate_skills_column(readme_text, skills_map):
+    """Insert / populate a `Maturity` column in the `## Skills` table.
+
+    `skills_map` is a dict[skill-name -> band]. If a cell's skill name
+    isn't in the map, the cell value is empty (not omitted). Idempotent:
+    if the `Maturity` column header already exists, cells are repopulated.
+    """
+    if not skills_map:
+        return readme_text
+
+    lines = readme_text.split("\n")
+    skills_idx = None
+    for i, line in enumerate(lines):
+        if SKILLS_HEADER_RE.match(line):
+            skills_idx = i
+            break
+    if skills_idx is None:
+        return readme_text  # no `## Skills` section — skip
+
+    # Find the first table row after the heading (header row of the
+    # markdown table). Skip blank lines.
+    header_idx = None
+    for j in range(skills_idx + 1, len(lines)):
+        s = lines[j].strip()
+        if not s:
+            continue
+        if TABLE_ROW_RE.match(lines[j]):
+            header_idx = j
+            break
+        # Hit a non-table non-blank line before any table — no table.
+        break
+    if header_idx is None:
+        return readme_text
+    if header_idx + 1 >= len(lines):
+        return readme_text
+    sep_line = lines[header_idx + 1]
+    if not SEPARATOR_RE.match(sep_line.rstrip()):
+        return readme_text  # second row isn't a separator — malformed; skip
+
+    header_cells = split_row(lines[header_idx])
+    sep_cells = split_row(sep_line)
+
+    # Check whether `Maturity` column already exists.
+    norm_headers = [c.strip().lower() for c in header_cells]
+    if "maturity" in norm_headers:
+        mat_col = norm_headers.index("maturity")
+    else:
+        mat_col = len(header_cells)
+        header_cells.append("Maturity")
+        sep_cells.append("---")
+
+    new_header = join_row(header_cells)
+    new_sep = "| " + " | ".join(c.strip() for c in sep_cells) + " |"
+    lines[header_idx] = new_header
+    lines[header_idx + 1] = new_sep
+
+    # Walk subsequent table rows until a blank line or non-table line.
+    body_idx = header_idx + 2
+    while body_idx < len(lines):
+        row = lines[body_idx]
+        if not row.strip():
+            break
+        if not TABLE_ROW_RE.match(row):
+            break
+        cells = split_row(row)
+        # Pad / truncate to the column count.
+        target_cols = len(header_cells)
+        while len(cells) < target_cols:
+            cells.append("")
+        if len(cells) > target_cols:
+            cells = cells[:target_cols]
+        # Identify the skill in the row's first cell that names a skill.
+        skill_name = None
+        for c in cells:
+            sn = extract_skill_name(c)
+            if sn:
+                skill_name = sn
+                break
+        band = skills_map.get(skill_name, "") if skill_name else ""
+        cells[mat_col] = band
+        lines[body_idx] = join_row(cells)
+        body_idx += 1
+
+    return "\n".join(lines)
+
+
+def render_plugin(pkg_dir):
+    """Render a single plugin. Returns (changed_bool, new_readme_text)
+    or (False, None) when skipped (no maturity, no README, etc).
+    """
+    plugin_json_path = pkg_dir / ".claude-plugin" / "plugin.json"
+    readme_path = pkg_dir / "README.md"
+    if not readme_path.is_file():
+        return (False, None)
+    try:
+        plugin_doc = json.loads(plugin_json_path.read_text(encoding="utf-8"))
+    except Exception as exc:
+        print(f"# wr-itil-plugin-maturity-render: skipping unreadable plugin.json at {plugin_json_path}: {exc}", file=sys.stderr)
+        return (False, None)
+    if not isinstance(plugin_doc, dict):
+        return (False, None)
+
+    maturity = plugin_doc.get("maturity")
+    if not isinstance(maturity, dict) or "band" not in maturity:
+        return (False, None)  # Phase 3a hasn't run for this plugin
+
+    badge = format_rollup_badge(maturity)
+    readme_text = readme_path.read_text(encoding="utf-8")
+    new_text = weave_rollup_into_lead_prose(readme_text, badge)
+
+    # Build per-skill band map from the plugin.json `skills:` map.
+    skills_map = {}
+    skills_section = plugin_doc.get("skills", {})
+    if isinstance(skills_section, dict):
+        for name, entry in skills_section.items():
+            if not isinstance(entry, dict):
+                continue
+            entry_mat = entry.get("maturity")
+            if isinstance(entry_mat, dict) and "band" in entry_mat:
+                skills_map[name] = entry_mat["band"]
+
+    new_text = populate_skills_column(new_text, skills_map)
+
+    if new_text == readme_text:
+        return (False, new_text)
+    return (True, new_text)
+
+
+plugins_processed = 0
+plugins_written = 0
+plugins_unchanged = 0
+
+for pkg_dir in plugin_dirs:
+    plugins_processed += 1
+    changed, new_text = render_plugin(pkg_dir)
+    if new_text is None:
+        continue
+    if not changed:
+        plugins_unchanged += 1
+        continue
+    readme_path = pkg_dir / "README.md"
+    if dry_run:
+        sys.stdout.write(f"--- {readme_path}\n+++ would-write\n")
+        sys.stdout.write(new_text)
+        sys.stdout.write("\n")
+    else:
+        readme_path.write_text(new_text, encoding="utf-8")
+    plugins_written += 1
+
+print(
+    f"# wr-itil-plugin-maturity-render: "
+    f"plugins={plugins_processed} written={plugins_written} "
+    f"unchanged={plugins_unchanged}",
+    file=sys.stderr,
+)
+PYEOF
+
+exit 0

package/scripts/test/plugin-maturity-render.bats

@@ -0,0 +1,412 @@
+#!/usr/bin/env bats
+
+# @problem P238 — Phase 3b renderer behavioural confirmation.
+# @problem P087 — parent: plugin maturity battle-hardening signal.
+#
+# Contract under test: `packages/itil/scripts/plugin-maturity-render.sh`
+# reads `plugin.json` `maturity:` field (per Phase 3a populate output)
+# and writes a prose-woven rollup badge into each plugin's README.md
+# value-framing lead prose AND populates a per-skill `Maturity` column
+# in the existing `## Skills` table. Idempotent — re-running with
+# unchanged inputs produces byte-identical README output.
+#
+# Anti-patterns enforced (ADR-063 §README badge rendering format):
+#   - NO standalone `## Maturity` section
+#   - NO header block immediately after H1 before any prose framing
+#   - NO shields.io URL or inline SVG (markdown text only)
+#
+# Bootstrapping rendering: rollup carries compound form during the
+# suite-bootstrap window; per-skill column carries band name only
+# (compound stays at rollup, never at cell).
+#
+# @adr ADR-063 (Plugin maturity presentation layer — Phase 3b contract)
+# @adr ADR-053 (Plugin maturity taxonomy — Bootstrapping clause rendering)
+# @adr ADR-051 (JTBD-anchored README — prose-weaving precedent)
+# @adr ADR-049 (Shim grammar — `wr-itil-plugin-maturity-render` on $PATH)
+# @adr ADR-052 (Behavioural tests default)
+# @adr ADR-013 Rule 6 (non-interactive fail-safe — exit 0 always)
+
+setup() {
+  SCRIPTS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
+  SCRIPT="$SCRIPTS_DIR/plugin-maturity-render.sh"
+  FIXTURE_DIR="$(mktemp -d)"
+  PROJECT_ROOT="$FIXTURE_DIR/project"
+  mkdir -p "$PROJECT_ROOT/packages"
+}
+
+teardown() {
+  rm -rf "$FIXTURE_DIR"
+}
+
+# Helper: write a synthetic plugin layout with plugin.json + README.md
+make_plugin() {
+  local name="$1"
+  local plugin_json="$2"
+  local readme="$3"
+  local pkg="$PROJECT_ROOT/packages/$name"
+  mkdir -p "$pkg/.claude-plugin"
+  printf '%s\n' "$plugin_json" > "$pkg/.claude-plugin/plugin.json"
+  printf '%s\n' "$readme" > "$pkg/README.md"
+}
+
+# ── Pre-checks ──────────────────────────────────────────────────────────────
+
+@test "script file exists and is executable" {
+  [ -f "$SCRIPT" ]
+  [ -x "$SCRIPT" ]
+}
+
+@test "missing packages dir exits 0 with stderr comment" {
+  run bash "$SCRIPT" --project-root="$FIXTURE_DIR/does-not-exist"
+  [ "$status" -eq 0 ]
+}
+
+@test "opt-out marker present: skips all writes" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub","maturity":{"schema_version":"1.0","band":"Alpha"}}' \
+"# @windyroad/stub
+
+**Stub plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+  mkdir -p "$PROJECT_ROOT/.claude"
+  touch "$PROJECT_ROOT/.claude/.skill-metrics-opt-out"
+  local before; before="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local after; after="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  [ "$before" = "$after" ]
+}
+
+# ── Confirmation #1 (ADR-063): rollup badge prose-woven into lead prose ─────
+
+@test "rollup badge: inserts prose-woven Maturity span into bold lead prose line" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub","maturity":{"schema_version":"1.0","band":"Alpha"}}' \
+"# @windyroad/stub
+
+**Stub plugin description.** Some more prose.
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local out; out="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  # Prose-woven Maturity span appears, italicised, in the lead-prose area
+  [[ "$out" == *"*Maturity: Alpha"* ]]
+}
+
+@test "rollup badge: bootstrapping window renders compound form with invocation count" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub","maturity":{"schema_version":"1.0","band":"Experimental","bootstrapping":true,"rollup_invocations_30d":796}}' \
+"# @windyroad/stub
+
+**Stub plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local out; out="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  [[ "$out" == *"Experimental"* ]]
+  [[ "$out" == *"suite-bootstrap window"* ]]
+  [[ "$out" == *"796 invocations"* ]]
+}
+
+@test "rollup badge: post-bootstrap renders band name only (no compound)" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub","maturity":{"schema_version":"1.0","band":"Beta"}}' \
+"# @windyroad/stub
+
+**Stub plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local out; out="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  [[ "$out" == *"*Maturity: Beta.*"* ]]
+  [[ "$out" != *"suite-bootstrap"* ]]
+  [[ "$out" != *"invocations"* ]]
+}
+
+# ── Confirmation #2 (ADR-063): per-skill Maturity column populated ──────────
+
+@test "per-skill column: adds Maturity column to existing Skills table" {
+  make_plugin "stub" '{
+"name":"wr-stub","version":"0.1.0","description":"Stub",
+"maturity":{"schema_version":"1.0","band":"Alpha"},
+"skills":{
+"thing":{"maturity":{"schema_version":"1.0","band":"Alpha","computed_at":"2026-05-18T00:00:00Z","evidence":{"invocations_30d":50,"days_shipped":30,"closed_tickets_window":5,"breaking_change_age_days":null}}},
+"widget":{"maturity":{"schema_version":"1.0","band":"Experimental","computed_at":"2026-05-18T00:00:00Z","evidence":{"invocations_30d":2,"days_shipped":5,"closed_tickets_window":0,"breaking_change_age_days":null}}}
+}
+}' \
+"# @windyroad/stub
+
+**Stub plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+| /wr-stub:widget | Widgets things |
+"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local out; out="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  # Header row gains Maturity column
+  [[ "$out" == *"| Skill | Purpose | Maturity |"* ]]
+  # Cells populated
+  [[ "$out" == *"/wr-stub:thing"*"| Alpha |"* ]]
+  [[ "$out" == *"/wr-stub:widget"*"| Experimental |"* ]]
+  # Per-skill cell carries band name ONLY (no compound)
+  [[ "$out" != *"| Alpha (suite"* ]]
+}
+
+# ── Idempotency: second run produces no diff ────────────────────────────────
+
+@test "idempotency: second run against unchanged plugin.json produces byte-equal README" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub","maturity":{"schema_version":"1.0","band":"Alpha"}}' \
+"# @windyroad/stub
+
+**Stub plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+  local first; first="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+  local second; second="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+
+  [ "$first" = "$second" ]
+}
+
+@test "idempotency: existing Maturity badge gets replaced (not appended)" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub","maturity":{"schema_version":"1.0","band":"Beta"}}' \
+"# @windyroad/stub
+
+**Stub plugin description.** *Maturity: Alpha.*
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local out; out="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  # Beta replaced Alpha (no duplication)
+  [[ "$out" == *"*Maturity: Beta"* ]]
+  [[ "$out" != *"*Maturity: Alpha"* ]]
+  # Single Maturity span (no duplication)
+  local count
+  count="$(grep -oE '\*Maturity: [^*]+\*' "$PROJECT_ROOT/packages/stub/README.md" | wc -l)"
+  [ "$count" -eq 1 ]
+}
+
+# ── Anti-pattern: no standalone ## Maturity section emitted ─────────────────
+
+@test "anti-pattern: renderer never emits a standalone ## Maturity section" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub","maturity":{"schema_version":"1.0","band":"Alpha"}}' \
+"# @windyroad/stub
+
+**Stub plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local out; out="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  [[ "$out" != *"## Maturity"* ]]
+  [[ "$out" != *"# Maturity"* ]]
+}
+
+@test "anti-pattern: no shields.io badge URL emitted" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub","maturity":{"schema_version":"1.0","band":"Alpha"}}' \
+"# @windyroad/stub
+
+**Stub plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local out; out="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  [[ "$out" != *"shields.io"* ]]
+  [[ "$out" != *"img.shields"* ]]
+}
+
+# ── Fail-safe: missing maturity field is a no-op (Phase 3a not yet run) ─────
+
+@test "fail-safe: plugin.json without maturity: field is skipped" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub"}' \
+"# @windyroad/stub
+
+**Stub plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+  local before; before="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local after; after="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  [ "$before" = "$after" ]
+}
+
+# ── Fail-safe: plugin without README is skipped ─────────────────────────────
+
+@test "fail-safe: plugin without README.md is silently skipped" {
+  local pkg="$PROJECT_ROOT/packages/no-readme"
+  mkdir -p "$pkg/.claude-plugin"
+  echo '{"name":"wr-no-readme","version":"0.1.0","description":"No README","maturity":{"schema_version":"1.0","band":"Alpha"}}' > "$pkg/.claude-plugin/plugin.json"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+  [ ! -f "$pkg/README.md" ]
+}
+
+# ── No-AskUserQuestion: ADR-044 silent-framework carve-out ──────────────────
+
+@test "ADR-044: renderer never invokes AskUserQuestion per re-render" {
+  # Negative-presence behavioural assertion per ADR-052 §carve-out — the
+  # renderer is mechanical (band already computed by Phase 3a) and must
+  # not surface a consent gate per re-render. Scans combined stdout +
+  # stderr output for any AskUserQuestion-token spelling, case-insensitive
+  # per architect adjustment G to plugin-maturity-populate.bats.
+  make_plugin "silentp" '{"name":"wr-silentp","version":"0.1.0","description":"Silent","maturity":{"schema_version":"1.0","band":"Alpha"}}' \
+"# @windyroad/silentp
+
+**Silent plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-silentp:thing | Does a thing |
+"
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+  printf '%s' "$output" | grep -i -E 'askuserquestion|<askuser' && return 1 || true
+}
+
+# ── No-network primitive: ADR-035 privacy posture ───────────────────────────
+
+@test "ADR-035: script body invokes no network primitive" {
+  # Negative-presence behavioural assertion — the renderer reads
+  # plugin.json + README.md from filesystem only; never reaches a
+  # network endpoint. Mirrors plugin-maturity-populate.bats.
+  run grep -E "(curl|wget|nc -|netcat|ssh |scp |rsync|http\.client|urllib|requests)" "$SCRIPT"
+  [ "$status" -ne 0 ]
+}
+
+# ── Multi-plugin: renders each plugin independently ─────────────────────────
+
+@test "multi-plugin: renders each packages/<plugin>/README.md independently" {
+  make_plugin "alpha" '{"name":"wr-alpha","version":"0.1.0","description":"Alpha","maturity":{"schema_version":"1.0","band":"Alpha"}}' \
+"# @windyroad/alpha
+
+**Alpha plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-alpha:thing | Does a thing |
+"
+  make_plugin "bravo" '{"name":"wr-bravo","version":"0.1.0","description":"Bravo","maturity":{"schema_version":"1.0","band":"Beta"}}' \
+"# @windyroad/bravo
+
+**Bravo plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-bravo:thing | Does a thing |
+"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT"
+  [ "$status" -eq 0 ]
+
+  local out_a; out_a="$(cat "$PROJECT_ROOT/packages/alpha/README.md")"
+  local out_b; out_b="$(cat "$PROJECT_ROOT/packages/bravo/README.md")"
+  [[ "$out_a" == *"*Maturity: Alpha"* ]]
+  [[ "$out_b" == *"*Maturity: Beta"* ]]
+}
+
+# ── Dry-run: prints diff to stdout, does not write ──────────────────────────
+
+@test "dry-run: --dry-run flag prints intended diff to stdout without modifying README" {
+  make_plugin "stub" '{"name":"wr-stub","version":"0.1.0","description":"Stub","maturity":{"schema_version":"1.0","band":"Alpha"}}' \
+"# @windyroad/stub
+
+**Stub plugin description.**
+
+## Skills
+
+| Skill | Purpose |
+|-------|---------|
+| /wr-stub:thing | Does a thing |
+"
+  local before; before="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+
+  run bash "$SCRIPT" --project-root="$PROJECT_ROOT" --dry-run
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Maturity: Alpha"* ]]
+
+  local after; after="$(cat "$PROJECT_ROOT/packages/stub/README.md")"
+  [ "$before" = "$after" ]
+}