@windyroad/itil 0.61.1 → 0.61.2

package/hooks/test/itil-claude-space-protection.bats

@@ -1,294 +0,0 @@
-#!/usr/bin/env bats
-
-# P131: itil-claude-space-protection.sh PreToolUse:Write|Edit hook must
-# block agent writes to project-scoped `.claude/` paths NOT in the
-# user-space allow-list, unless an approval marker is present.
-#
-# Per ADR-037 + P081 (feedback_behavioural_tests.md): behavioural
-# assertions — simulate the hook's payload on stdin and assert on
-# emitted JSON permissionDecision and exit status. No source-grep on
-# hook content.
-#
-# References:
-#   ADR-009 — marker lifecycle (this hook adds a new persistent class)
-#   ADR-013 Rule 6 — non-interactive fail-safe
-#   ADR-038 — progressive disclosure (deny message <500 bytes)
-#   ADR-045 — hook injection budget (silent on allow path)
-#   P131    — user-space write protection driver
-
-setup() {
-  SCRIPT_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  HOOK="$SCRIPT_DIR/itil-claude-space-protection.sh"
-  ORIG_DIR="$PWD"
-  TEST_DIR=$(mktemp -d)
-  cd "$TEST_DIR"
-  mkdir -p .claude/skills/myskill .claude/commands .claude/agents \
-    .claude/hooks .claude/projects/abc/memory .claude/worktrees \
-    docs/plans
-}
-
-teardown() {
-  cd "$ORIG_DIR"
-  rm -rf "$TEST_DIR"
-}
-
-run_hook() {
-  local tool="$1"
-  local file_path="$2"
-  local json
-  json=$(printf '{"tool_name":"%s","tool_input":{"file_path":"%s"},"session_id":"test-sid"}' \
-    "$tool" "$file_path")
-  echo "$json" | bash "$HOOK"
-}
-
-# Helper: compute approval-marker filename for a project-relative path
-marker_path_for() {
-  local rel_path="$1"
-  local hash
-  if command -v shasum >/dev/null 2>&1; then
-    hash=$(printf '%s' "$rel_path" | shasum -a 256 | awk '{print $1}')
-  else
-    hash=$(printf '%s' "$rel_path" | sha256sum | awk '{print $1}')
-  fi
-  echo ".claude/.agent-write-approved-${hash}"
-}
-
-# --- Core deny path: protected .claude/ writes without marker ---
-
-@test "deny: Write to .claude/plans/foo.md without marker" {
-  run run_hook "Write" "$PWD/.claude/plans/foo.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"\"permissionDecision\": \"deny\""* ]]
-  [[ "$output" == *"BLOCKED"* ]]
-}
-
-@test "deny: Write to .claude/audits/2026-04-28.md without marker" {
-  run run_hook "Write" "$PWD/.claude/audits/2026-04-28.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"BLOCKED"* ]]
-}
-
-@test "deny: Edit to existing agent-introduced .claude/plans file" {
-  mkdir -p .claude/plans
-  echo "stub" > .claude/plans/foo.md
-  run run_hook "Edit" "$PWD/.claude/plans/foo.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"BLOCKED"* ]]
-}
-
-@test "deny: Write to .claude/scratch/state.json without marker" {
-  run run_hook "Write" "$PWD/.claude/scratch/state.json"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"BLOCKED"* ]]
-}
-
-# --- Allow paths: user-space allow-list ---
-
-@test "allow: Write to .claude/settings.json" {
-  run run_hook "Write" "$PWD/.claude/settings.json"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-  [[ "$output" != *"\"permissionDecision\": \"deny\""* ]]
-}
-
-@test "allow: Write to .claude/settings.local.json" {
-  run run_hook "Write" "$PWD/.claude/settings.local.json"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to .claude/MEMORY.md" {
-  run run_hook "Write" "$PWD/.claude/MEMORY.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to .claude/.install-updates-consent" {
-  run run_hook "Write" "$PWD/.claude/.install-updates-consent"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to .claude/scheduled_tasks.lock" {
-  run run_hook "Write" "$PWD/.claude/scheduled_tasks.lock"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to .claude/skills/install-updates/SKILL.md (skills subtree)" {
-  run run_hook "Write" "$PWD/.claude/skills/install-updates/SKILL.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to .claude/commands/foo.md (commands subtree)" {
-  run run_hook "Write" "$PWD/.claude/commands/foo.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to .claude/agents/foo.md (agents subtree)" {
-  run run_hook "Write" "$PWD/.claude/agents/foo.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to .claude/hooks/foo.sh (hooks subtree)" {
-  run run_hook "Write" "$PWD/.claude/hooks/foo.sh"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to .claude/projects/abc/memory/MEMORY.md (Claude Code state)" {
-  run run_hook "Write" "$PWD/.claude/projects/abc/memory/MEMORY.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to .claude/worktrees/something (worktrees subtree)" {
-  run run_hook "Write" "$PWD/.claude/worktrees/something"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-# --- Allow paths: outside .claude/ ---
-
-@test "allow: Write to docs/plans/foo.md (not under .claude/)" {
-  run run_hook "Write" "$PWD/docs/plans/foo.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to packages/itil/hooks/foo.sh" {
-  mkdir -p packages/itil/hooks
-  run run_hook "Write" "$PWD/packages/itil/hooks/foo.sh"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to absolute path outside PWD project root" {
-  run run_hook "Write" "/Users/someone/.claude/plans/foo.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Write to ~/.claude path (user home, outside project)" {
-  run run_hook "Write" "$HOME/.claude/projects/xyz/foo.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-# --- Approval-marker bypass ---
-
-@test "allow: Write to .claude/plans/foo.md WHEN approval marker exists" {
-  marker=$(marker_path_for ".claude/plans/foo.md")
-  : > "$marker"
-  run run_hook "Write" "$PWD/.claude/plans/foo.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "deny: marker for one path does not authorize a different path" {
-  marker=$(marker_path_for ".claude/plans/foo.md")
-  : > "$marker"
-  run run_hook "Write" "$PWD/.claude/plans/bar.md"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"BLOCKED"* ]]
-}
-
-@test "allow: user can Write the approval marker itself" {
-  marker=$(marker_path_for ".claude/plans/foo.md")
-  run run_hook "Write" "$PWD/$marker"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-# --- Tool-name and edge cases ---
-
-@test "allow: Read tool on protected .claude/ path is unaffected" {
-  mkdir -p .claude/plans
-  echo "stub" > .claude/plans/foo.md
-  run bash -c "echo '{\"tool_name\":\"Read\",\"tool_input\":{\"file_path\":\"$PWD/.claude/plans/foo.md\"}}' | bash $HOOK"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: Glob tool on .claude/ is unaffected (pattern, not file_path)" {
-  run bash -c "echo '{\"tool_name\":\"Glob\",\"tool_input\":{\"pattern\":\".claude/**/*.md\"}}' | bash $HOOK"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-@test "allow: empty file_path exits 0 without action" {
-  run bash -c "echo '{\"tool_name\":\"Write\",\"tool_input\":{}}' | bash $HOOK"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-# --- Allow-list anchor depth (architect note) ---
-
-@test "deny: .claude/plans/foo.local.json (deeper than root) — *.local.json must not pass at arbitrary depth" {
-  run run_hook "Write" "$PWD/.claude/plans/foo.local.json"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"BLOCKED"* ]]
-}
-
-@test "allow: .claude/foo.local.json (root depth) — *.local.json convention" {
-  run run_hook "Write" "$PWD/.claude/foo.local.json"
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"BLOCKED"* ]]
-}
-
-# --- Deny message contract (ADR-038 progressive disclosure) ---
-
-@test "deny message names P131" {
-  run run_hook "Write" "$PWD/.claude/plans/foo.md"
-  [[ "$output" == *"P131"* ]]
-}
-
-@test "deny message suggests docs/ alternative" {
-  run run_hook "Write" "$PWD/.claude/plans/foo.md"
-  [[ "$output" == *"docs/"* ]]
-}
-
-@test "deny message names the approval-marker bypass" {
-  run run_hook "Write" "$PWD/.claude/plans/foo.md"
-  [[ "$output" == *".agent-write-approved-"* ]]
-}
-
-@test "deny message references project CLAUDE.md MANDATORY rule" {
-  run run_hook "Write" "$PWD/.claude/plans/foo.md"
-  [[ "$output" == *"CLAUDE.md"* ]]
-}
-
-@test "deny message stays under ADR-038 progressive-disclosure 500-byte cap" {
-  run run_hook "Write" "$PWD/.claude/plans/foo.md"
-  # Extract the permissionDecisionReason value and check its byte length.
-  reason=$(echo "$output" | python3 -c "
-import sys, json
-try:
-    data = json.load(sys.stdin)
-    print(data['hookSpecificOutput']['permissionDecisionReason'])
-except Exception as e:
-    print('')
-")
-  byte_len=$(printf '%s' "$reason" | wc -c)
-  # Bound: the deny message must be discoverable + actionable but
-  # progressive — < 500 bytes per ADR-038.
-  [ "$byte_len" -lt 500 ]
-}
-
-# --- ADR-045 silent-on-pass: allow path emits zero bytes ---
-
-@test "allow path emits no output (ADR-045 Pattern 1 silent-on-pass)" {
-  run run_hook "Write" "$PWD/.claude/settings.json"
-  [ "$status" -eq 0 ]
-  # Empty stdout — silent on allow.
-  [ -z "$output" ]
-}
-
-@test "non-Write|Edit tool emits no output (silent-on-pass)" {
-  run bash -c "echo '{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"ls\"}}' | bash $HOOK"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}

package/hooks/test/itil-commit-trailer-transition-advisory.bats

@@ -1,80 +0,0 @@
-#!/usr/bin/env bats
-
-# P378/RFC-030 Piece 2: itil-commit-trailer-transition-advisory.sh — the shared
-# RFC+story commit-trailer auto-transition DETECTOR. Advises (ADR-014: does not
-# perform) proposed/accepted RFC → in-progress and ACCEPTED story → in-progress on
-# the first non-capture commit carrying the Refs trailer. Behavioural.
-
-setup() {
-  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
-  HOOK="$REPO_ROOT/packages/itil/hooks/itil-commit-trailer-transition-advisory.sh"
-  DIR="$(mktemp -d)"; cd "$DIR"
-  git init -q; git config user.email t@e.x; git config user.name t
-  mkdir -p docs/rfcs docs/stories/draft
-  echo x > seed; git add -A; git commit -qm "chore: seed"
-}
-teardown() { cd /; rm -rf "$DIR"; }
-
-# Feed the hook a PostToolUse Bash payload for a `git commit` command.
-run_hook() {
-  printf '{"tool_name":"Bash","tool_input":{"command":"git commit -m x"}}' | bash "$HOOK"
-}
-
-commit() { git commit -q --allow-empty -m "$1"; }
-
-@test "advises proposed RFC → in-progress on a non-capture Refs commit" {
-  echo "---" > docs/rfcs/RFC-201-x.proposed.md; git add -A; commit "$(printf 'docs(rfcs): capture RFC-201 x\n\nRefs: RFC-201')"
-  commit "$(printf 'feat(itil): do slice 1\n\nRefs: RFC-201')"
-  run run_hook
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"RFC-201"* ]]
-  [[ "$output" == *"in-progress"* ]]
-  [[ "$output" == *"manage-rfc"* ]]
-}
-
-@test "silent on the capture commit itself" {
-  echo "---" > docs/rfcs/RFC-201-x.proposed.md; git add -A; commit "$(printf 'docs(rfcs): capture RFC-201 x\n\nRefs: RFC-201')"
-  run run_hook
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "silent when the RFC is already in-progress (no .proposed/.accepted file)" {
-  echo "---" > docs/rfcs/RFC-201-x.in-progress.md; git add -A; commit "$(printf 'feat(itil): more\n\nRefs: RFC-201')"
-  run run_hook
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "advises accepted story → in-progress on a non-capture Refs commit (ADR-096: draft is blocked, accepted is advised)" {
-  mkdir -p docs/stories/accepted
-  echo "---" > docs/stories/accepted/STORY-201-y.md; git add -A; commit "$(printf 'feat(itil): capture STORY-201 y\n\nRefs: STORY-201')"
-  commit "$(printf 'feat(itil): implement\n\nRefs: STORY-201')"
-  run run_hook
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"STORY-201"* ]]
-  [[ "$output" == *"manage-story"* ]]
-}
-
-@test "silent for a DRAFT story on a non-capture Refs commit (ADR-096: draft is gate-blocked, not advised to advance)" {
-  mkdir -p docs/stories/draft
-  echo "---" > docs/stories/draft/STORY-202-z.md; git add -A; commit "$(printf 'feat(itil): capture STORY-202 z\n\nRefs: STORY-202')"
-  commit "$(printf 'feat(itil): implement\n\nRefs: STORY-202')"
-  run run_hook
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"STORY-202"* ]]
-}
-
-@test "bypass env var suppresses the advisory" {
-  echo "---" > docs/rfcs/RFC-201-x.proposed.md; git add -A; commit "$(printf 'feat: s\n\nRefs: RFC-201')"
-  run env BYPASS_TRANSITION_ADVISORY=1 bash -c 'printf "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"git commit -m x\"}}" | bash "$0"' "$HOOK"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "silent when commit carries no Refs trailer" {
-  echo "---" > docs/rfcs/RFC-201-x.proposed.md; git add -A; commit "chore: untagged"
-  run run_hook
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}

package/hooks/test/itil-correction-detect.bats

@@ -1,189 +0,0 @@
-#!/usr/bin/env bats
-
-# P078: itil-correction-detect.sh UserPromptSubmit hook must detect
-# strong-signal correction patterns in the incoming user prompt
-# (FFS / DO NOT / direct contradiction / exasperation markers /
-# meta-correction "you always|you never|you keep") and inject a
-# MANDATORY systemMessage instructing the assistant to OFFER
-# /wr-itil:capture-problem (with /wr-itil:manage-problem fallback)
-# BEFORE addressing the operational request.
-#
-# Per ADR-038: full block emits once per session; subsequent prompts
-# emit a terse reminder (<250 bytes) preserving the MANDATORY signal,
-# the gate name, and the capture-problem affordance.
-#
-# Per feedback_behavioural_tests.md (P081): these are behavioural
-# assertions — they simulate the hook payload on stdin and assert on
-# what the hook emits, not on the source text of the hook file.
-
-setup() {
-  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
-  HOOK="$REPO_ROOT/packages/itil/hooks/itil-correction-detect.sh"
-  SID="itil-correction-test-$$-$RANDOM"
-  # An AFK iter exports WR_SUPPRESS_CORRECTION_DETECT=1, which the hook
-  # self-suppresses on. Unset it so the positive-detection cases below do not
-  # false-RED when this suite runs inside such an iter (the P391 hermeticity
-  # class). Suppression is asserted per-invocation via `run env ...` instead.
-  unset WR_SUPPRESS_CORRECTION_DETECT
-}
-
-teardown() {
-  unset WR_SUPPRESS_CORRECTION_DETECT
-  rm -f "/tmp/itil-correction-detect-announced-${SID}"
-  rm -f "/tmp/itil-correction-detect-announced-${SID}-alt"
-}
-
-run_hook() {
-  local sid="$1"
-  local prompt="$2"
-  echo "{\"session_id\":\"$sid\",\"prompt\":$(printf '%s' "$prompt" | jq -Rs .)}" | bash "$HOOK"
-}
-
-@test "correction-detect: 'FFS' triggers full MANDATORY block on first emission" {
-  run run_hook "$SID" "FFS, you didn't run the test"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -gt 300 ]
-  [[ "$output" == *"MANDATORY"* ]]
-  [[ "$output" == *"capture-problem"* ]] || [[ "$output" == *"manage-problem"* ]]
-}
-
-@test "correction-detect: writes the announcement marker on first emission" {
-  run run_hook "$SID" "FFS stop framing it that way"
-  [ "$status" -eq 0 ]
-  [ -f "/tmp/itil-correction-detect-announced-${SID}" ]
-}
-
-@test "correction-detect: all-caps imperative 'DO NOT' triggers the block" {
-  run run_hook "$SID" "DO NOT TELL ME the cache is stale when you haven't installed it"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -gt 300 ]
-  [[ "$output" == *"MANDATORY"* ]]
-}
-
-@test "correction-detect: meta-correction 'you always' triggers the block" {
-  run run_hook "$SID" "you always do this — frame your own failures as external"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -gt 300 ]
-  [[ "$output" == *"MANDATORY"* ]]
-}
-
-@test "correction-detect: direct contradiction 'that's wrong' triggers the block" {
-  run run_hook "$SID" "no, that's wrong — the cache wasn't refreshed because you didn't install"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -gt 300 ]
-  [[ "$output" == *"MANDATORY"* ]]
-}
-
-@test "correction-detect: exasperation '!!!' triggers the block" {
-  run run_hook "$SID" "stop framing your own failure as external!!!"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -gt 300 ]
-  [[ "$output" == *"MANDATORY"* ]]
-}
-
-@test "correction-detect: 'you're not listening' triggers the block" {
-  run run_hook "$SID" "you're not listening — install first then check the cache"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -gt 300 ]
-  [[ "$output" == *"MANDATORY"* ]]
-}
-
-@test "correction-detect: second correction prompt in same session emits terse reminder only" {
-  run_hook "$SID" "FFS that's not right" >/dev/null
-  run run_hook "$SID" "DO NOT do that again"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -lt 250 ]
-  [[ "$output" == *"capture-problem"* ]] || [[ "$output" == *"manage-problem"* ]]
-  [[ "$output" != *"NON-OPTIONAL RULES"* ]]
-}
-
-@test "correction-detect: terse reminder preserves MANDATORY / REQUIRED signal word" {
-  run_hook "$SID" "FFS" >/dev/null
-  run run_hook "$SID" "you keep doing this"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"MANDATORY"* ]] || [[ "$output" == *"REQUIRED"* ]] || [[ "$output" == *"NON-OPTIONAL"* ]]
-}
-
-@test "correction-detect: emitted block names capture-problem and manage-problem fallback" {
-  run run_hook "$SID" "FFS!"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"capture-problem"* ]]
-  [[ "$output" == *"manage-problem"* ]]
-}
-
-@test "correction-detect: different session_id re-emits the full block" {
-  run_hook "$SID" "FFS" >/dev/null
-  local SID2="${SID}-alt"
-  run run_hook "$SID2" "FFS"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -gt 300 ]
-  rm -f "/tmp/itil-correction-detect-announced-${SID2}"
-}
-
-@test "correction-detect: empty session_id emits the full block and writes no marker" {
-  run run_hook "" "FFS, that's wrong"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -gt 300 ]
-  [ ! -f "/tmp/itil-correction-detect-announced-" ]
-}
-
-@test "correction-detect: plain conversational prompt does not emit a block" {
-  run run_hook "$SID" "what does ADR-013 say about ambiguous decisions?"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-  [ ! -f "/tmp/itil-correction-detect-announced-${SID}" ]
-}
-
-@test "correction-detect: direction-pin 'yes' alone does not trigger" {
-  run run_hook "$SID" "yes, go ahead and update the ticket"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-  [ ! -f "/tmp/itil-correction-detect-announced-${SID}" ]
-}
-
-# --- P430 / STORY-047: prompt-authorship guard --------------------------------
-# A framework-authored iter prompt carrying an ordinary imperative ("DO NOT
-# skip the gate") is not a correction — nobody is correcting anything, and the
-# absent user cannot act on the nudge. Provenance is a property of the spawning
-# process, so the dispatcher asserts it via env var rather than the hook
-# guessing from content.
-
-run_hook_env() {
-  local guard="$1" sid="$2" prompt="$3"
-  echo "{\"session_id\":\"$sid\",\"prompt\":$(printf '%s' "$prompt" | jq -Rs .)}" \
-    | env WR_SUPPRESS_CORRECTION_DETECT="$guard" bash "$HOOK"
-}
-
-@test "correction-detect: WR_SUPPRESS_CORRECTION_DETECT=1 suppresses a correction prompt" {
-  run run_hook_env 1 "$SID" "DO NOT skip the architect gate"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "correction-detect: suppressed path writes no announcement marker" {
-  run run_hook_env 1 "$SID" "FFS, you didn't run the test"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-  # The once-per-session budget must survive a prompt that produced no output,
-  # or the first real correction in the orchestrator session emits only the
-  # terse reminder.
-  [ ! -f "/tmp/itil-correction-detect-announced-${SID}" ]
-}
-
-@test "correction-detect: same prompt still fires with the guard unset" {
-  run run_hook "$SID" "DO NOT skip the architect gate"
-  [ "$status" -eq 0 ]
-  [ "${#output}" -gt 300 ]
-  [[ "$output" == *"MANDATORY"* ]]
-}
-
-@test "correction-detect: only the literal value 1 suppresses" {
-  for v in 0 true yes ""; do
-    run run_hook_env "$v" "$SID-$RANDOM" "FFS, that's wrong"
-    [ "$status" -eq 0 ]
-    [ -n "$output" ] || {
-      echo "guard value '$v' wrongly suppressed"
-      false
-    }
-  done
-}