@windyroad/itil 0.61.1 → 0.61.2

package/skills/review-problems/test/review-problems-likely-verified-cell-shape.bats

@@ -1,229 +0,0 @@
-#!/usr/bin/env bats
-
-# P186: `Likely verified?` column in docs/problems/README.md
-# Verification Queue must carry an evidence-first cell shape — NOT
-# the original P048 Candidate 4 age-based heuristic (≥14 days = yes).
-# Sibling proxy-for-evidence anti-pattern to P185 at the review-problems
-# Step 3/5 surface. User critique 2026-05-12: "I don't like 'it's been
-# a while, so likely verified' approach. We want firm evidence. For
-# these, it should be things you actually observe."
-#
-# Three canonical values per P186:
-#   yes — observed: <evidence>   (session-observed evidence the fix works)
-#   no — not observed            (fix released, no evidence yet; default)
-#   no — observed regression     (fix released, bug recurred)
-#
-# Hybrid coverage per ADR-005 + ADR-037 + ADR-052:
-#   - Structural contract-assertions (Permitted Exception per ADR-005 /
-#     contract-assertion pattern per ADR-037 — narrowly scoped to marker
-#     presence per architect verdict): each render-block site carries the
-#     canonical LIKELY-VERIFIED-CELL-SHAPE marker pointing to P186.
-#   - Behavioural-shape assertions: each render site documents the three
-#     canonical cell values + the age-based heuristic is NOT cited as
-#     authority anywhere the marker fires.
-#   - Drift-tripwire prose assertion: primary render sites (review-problems
-#     + manage-problem) name P186 in the drift-re-opens contract per
-#     P138 / P150 fix-shape precedent.
-#
-# @problem P186
-# @jtbd JTBD-001 (enforce governance without slowing down — evidence-grounded
-#   closure decision rather than calendar proxy)
-# @jtbd JTBD-006 (progress backlog AFK — `observed: <evidence>` cell IS the
-#   audit trail the AFK contract requires)
-#
-# Cross-reference:
-#   P186: docs/problems/open/186-vq-likely-verified-column-uses-age-heuristic-not-evidence.md
-#   P185: sibling proxy-for-evidence anti-pattern at capture-problem Step 1.5
-#   P150: sibling fix shape — VQ-SORT-DIRECTION marker
-#   P138: sibling fix shape — TIE-BREAK-LADDER-SOURCE marker
-#   P048: introduced the Verification Queue + 14-day heuristic this ticket supersedes
-#   ADR-022 — `.verifying.md` lifecycle; VQ rendering
-#   ADR-026 — agent output grounding (evidence-citation discipline)
-#   ADR-037 — contract-assertion bats pattern
-#   ADR-052 — behavioural-tests default
-
-setup() {
-  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../../.." && pwd)"
-  REVIEW_SKILL="$REPO_ROOT/packages/itil/skills/review-problems/SKILL.md"
-  MANAGE_SKILL="$REPO_ROOT/packages/itil/skills/manage-problem/SKILL.md"
-  LIST_SKILL="$REPO_ROOT/packages/itil/skills/list-problems/SKILL.md"
-  TRANSITION_SKILL="$REPO_ROOT/packages/itil/skills/transition-problem/SKILL.md"
-  TRANSITIONS_SKILL="$REPO_ROOT/packages/itil/skills/transition-problems/SKILL.md"
-  RECONCILE_SKILL="$REPO_ROOT/packages/itil/skills/reconcile-readme/SKILL.md"
-
-  MARKER='<!-- LIKELY-VERIFIED-CELL-SHAPE: evidence-based per P186 -->'
-}
-
-# ---------------------------------------------------------------------------
-# Marker presence at every render site (P138 / P150 fix-shape precedent)
-# ---------------------------------------------------------------------------
-
-@test "review-problems carries the LIKELY-VERIFIED-CELL-SHAPE marker" {
-  run grep -F "$MARKER" "$REVIEW_SKILL"
-  [ "$status" -eq 0 ]
-  count=$(grep -c -F "$MARKER" "$REVIEW_SKILL")
-  # review-problems is the primary owner — Step 3 presentation AND Step 5
-  # README template both render the column.
-  [ "$count" -ge 2 ]
-}
-
-@test "manage-problem carries the LIKELY-VERIFIED-CELL-SHAPE marker at every render site" {
-  run grep -F "$MARKER" "$MANAGE_SKILL"
-  [ "$status" -eq 0 ]
-  count=$(grep -c -F "$MARKER" "$MANAGE_SKILL")
-  # manage-problem renders the VQ at 4 sites: Step 5 P094, Step 7 P062,
-  # Step 9c presentation, Step 9e README template. Marker must appear at
-  # each — drift re-opens P186.
-  [ "$count" -ge 4 ]
-}
-
-@test "list-problems VQ rendering carries the LIKELY-VERIFIED-CELL-SHAPE marker" {
-  run grep -F "$MARKER" "$LIST_SKILL"
-  [ "$status" -eq 0 ]
-}
-
-@test "transition-problem Step 7 README refresh carries the LIKELY-VERIFIED-CELL-SHAPE marker" {
-  run grep -F "$MARKER" "$TRANSITION_SKILL"
-  [ "$status" -eq 0 ]
-}
-
-@test "transition-problems batch render carries the LIKELY-VERIFIED-CELL-SHAPE marker" {
-  run grep -F "$MARKER" "$TRANSITIONS_SKILL"
-  [ "$status" -eq 0 ]
-}
-
-@test "reconcile-readme rendering carries the LIKELY-VERIFIED-CELL-SHAPE marker" {
-  run grep -F "$MARKER" "$RECONCILE_SKILL"
-  [ "$status" -eq 0 ]
-}
-
-# ---------------------------------------------------------------------------
-# Canonical cell values present at every render site
-# ---------------------------------------------------------------------------
-
-@test "review-problems documents all three canonical cell values" {
-  run grep -F 'yes — observed:' "$REVIEW_SKILL"
-  [ "$status" -eq 0 ]
-  run grep -F 'no — not observed' "$REVIEW_SKILL"
-  [ "$status" -eq 0 ]
-  run grep -F 'no — observed regression' "$REVIEW_SKILL"
-  [ "$status" -eq 0 ]
-}
-
-@test "manage-problem documents all three canonical cell values" {
-  run grep -F 'yes — observed:' "$MANAGE_SKILL"
-  [ "$status" -eq 0 ]
-  run grep -F 'no — not observed' "$MANAGE_SKILL"
-  [ "$status" -eq 0 ]
-  run grep -F 'no — observed regression' "$MANAGE_SKILL"
-  [ "$status" -eq 0 ]
-}
-
-@test "list-problems documents all three canonical cell values" {
-  run grep -F 'yes — observed:' "$LIST_SKILL"
-  [ "$status" -eq 0 ]
-  run grep -F 'no — not observed' "$LIST_SKILL"
-  [ "$status" -eq 0 ]
-  run grep -F 'no — observed regression' "$LIST_SKILL"
-  [ "$status" -eq 0 ]
-}
-
-# ---------------------------------------------------------------------------
-# Drift-tripwire prose at primary render sites (P138 / P150 precedent)
-# ---------------------------------------------------------------------------
-
-@test "review-problems names drift-re-opens-P186 contract" {
-  run grep -F 'drift re-opens P186' "$REVIEW_SKILL"
-  [ "$status" -eq 0 ]
-}
-
-@test "manage-problem names drift-re-opens-P186 contract" {
-  # manage-problem hosts the drift-tripwire prose at Step 5 P094 AND Step 7
-  # P062 — both render sites name P186 alongside the existing P138 / P150
-  # contracts. List-problems / transition-problem(s) / reconcile-readme
-  # carry the marker but defer the canonical drift contract to the primary
-  # owners (manage-problem / review-problems) per the P138 + P150 precedent.
-  run grep -F 'drift here re-opens P186' "$MANAGE_SKILL"
-  [ "$status" -eq 0 ]
-  count=$(grep -c -i 're-opens P186' "$MANAGE_SKILL")
-  [ "$count" -ge 2 ]
-}
-
-# ---------------------------------------------------------------------------
-# Age-based heuristic must NOT survive as the authoritative cell rule
-# ---------------------------------------------------------------------------
-
-@test "review-problems no longer cites the 14-day heuristic as the cell rule" {
-  # The P048 Candidate 4 "marks tickets ≥14 days old" phrasing was the
-  # exact framing the user critique targeted. After P186, the cell shape
-  # contract no longer references age as the authoritative trigger — age
-  # is preserved separately via the `Released` column. The phrase may
-  # survive in historical context (e.g. Related-section pointer back to
-  # P048) but NOT as the live rendering rule.
-  run grep -F 'marks tickets ≥14 days old' "$REVIEW_SKILL"
-  [ "$status" -ne 0 ]
-}
-
-@test "manage-problem Step 9c no longer treats age as the cell trigger" {
-  # Pre-P186 Step 9c documented `yes (N days)` and `no (N days)` as the
-  # cell values keyed on a 14-day threshold. The new shape replaces both
-  # with evidence-first values; the literal `yes (N days)` template must
-  # not survive as a documented cell value (it can still appear in
-  # historical narrative such as the README VQ rows pending re-render).
-  run grep -F '`yes (N days)` — release age ≥ 14 days' "$MANAGE_SKILL"
-  [ "$status" -ne 0 ]
-}
-
-# ---------------------------------------------------------------------------
-# Behavioural / template-shape — README template row carries the new shape
-# ---------------------------------------------------------------------------
-
-@test "review-problems Step 5 README template row uses the new cell-shape vocabulary" {
-  # The template ROW (the `| P<NNN> | <title> | ... |` line below the
-  # Verification Queue header) must reference the new vocabulary, not
-  # the old `yes (N days) / no (N days)` placeholder.
-  run grep -F 'yes — observed' "$REVIEW_SKILL"
-  [ "$status" -eq 0 ]
-  # Old placeholder gone
-  run grep -F '<yes (N days) / no (N days)>' "$REVIEW_SKILL"
-  [ "$status" -ne 0 ]
-}
-
-@test "list-problems Step 3 template row uses the new cell-shape vocabulary" {
-  run grep -F 'yes — observed' "$LIST_SKILL"
-  [ "$status" -eq 0 ]
-  # Old placeholder gone from list-problems template
-  run grep -F 'yes (N days) / no (N days)' "$LIST_SKILL"
-  [ "$status" -ne 0 ]
-}
-
-# ---------------------------------------------------------------------------
-# Behavioural — produced README's VQ section uses the new cell vocabulary
-# ---------------------------------------------------------------------------
-#
-# Behavioural assertion per ADR-052: the actual rendered docs/problems/
-# README.md Verification Queue rows must use the new evidence-first cell
-# shape, not age-based markers. This is the user-visible artefact the
-# entire fix targets.
-
-@test "docs/problems/README.md VQ section contains the new evidence-first cell vocabulary" {
-  README="$REPO_ROOT/docs/problems/README.md"
-  [ -f "$README" ]
-  # At least one row should carry the new vocabulary after the iter
-  # re-renders the VQ section. Tests run after the iter's edits land.
-  run grep -F 'no — not observed' "$README"
-  [ "$status" -eq 0 ]
-}
-
-@test "docs/problems/README.md VQ section no longer uses bare age-marker cells like 'no (N days)' as the dominant rendering" {
-  README="$REPO_ROOT/docs/problems/README.md"
-  [ -f "$README" ]
-  # Allow a small residual count for transitional rows or quoted prose,
-  # but the bulk of the VQ table must have migrated to the new shape.
-  # Concretely: count `no — not observed` occurrences and require they
-  # exceed the count of bare `no (<digit>` age-marker cells. This is a
-  # behavioural check — the rendered surface, not the SKILL.md template.
-  new_shape_count=$(grep -c -F 'no — not observed' "$README" || true)
-  old_shape_count=$(grep -cE '\| no \([0-9]+ days?\) \|' "$README" || true)
-  [ "$new_shape_count" -gt "$old_shape_count" ]
-}

package/skills/scaffold-intake/test/scaffold-intake-contract.bats

@@ -1,126 +0,0 @@
-#!/usr/bin/env bats
-
-# P065 / ADR-036 / ADR-037 Confirmation: scaffold-intake SKILL.md must
-# encode the contract documented in ADR-036's Decision Outcome.
-#
-# Doc-lint structural test (Permitted Exception per ADR-005 — structural
-# SKILL.md content checks, not behavioural). Mirrors the report-upstream
-# contract bats pattern and the ADR-037 "Source review (at implementation
-# time)" requirement that every shipped skill ships at least one
-# `<skill>-contract.bats`.
-
-setup() {
-  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../../.." && pwd)"
-  SKILL_MD="$REPO_ROOT/packages/itil/skills/scaffold-intake/SKILL.md"
-  TEMPLATE_DIR="$REPO_ROOT/packages/itil/skills/scaffold-intake/templates"
-}
-
-@test "scaffold-intake: SKILL.md exists" {
-  [ -f "$SKILL_MD" ]
-}
-
-@test "scaffold-intake: SKILL.md frontmatter declares the skill name" {
-  run grep -F 'name: wr-itil:scaffold-intake' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: SKILL.md cross-references ADR-036 (driver decision)" {
-  run grep -F 'ADR-036' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: SKILL.md cites ADR-032 foreground-synchronous pattern" {
-  run grep -F 'ADR-032' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-  run grep -iE 'foreground.synchronous' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: SKILL.md contains an explicit Rule 6 audit section (ADR-032 + ADR-013 Rule 6)" {
-  # ADR-032 line 191 requires every skill that uses AskUserQuestion to
-  # carry an enumerable Rule 6 audit. ADR-036 lines 92-97 ship the table
-  # shape.
-  run grep -iE 'rule 6 audit|rule-6 audit' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: SKILL.md enumerates the three trigger surfaces (ADR-036)" {
-  # Trigger 1: first-run prompt from manage-problem / work-problems.
-  # Trigger 2: pre-publish PreToolUse gate (hard stop).
-  # Trigger 3: optional CI check (deferred / --ci flag).
-  run grep -iE 'trigger 1|first-run' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-  run grep -iE 'trigger 2|pre-publish' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-  run grep -iE 'trigger 3|ci check|--ci' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: SKILL.md cites the INTAKE_BYPASS env override (ADR-036)" {
-  run grep -F 'INTAKE_BYPASS' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: SKILL.md cites both marker files (ADR-036 + ADR-009)" {
-  run grep -F '.claude/.intake-scaffold-done' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-  run grep -F '.claude/.intake-scaffold-declined' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: SKILL.md documents idempotent + --force semantics (ADR-036)" {
-  run grep -iE 'idempotent' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-  run grep -F -- '--force' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-  run grep -F -- '--dry-run' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: SKILL.md enumerates the five required intake files (ADR-036 Detection 5)" {
-  for path in 'config.yml' 'problem-report.yml' 'SECURITY.md' 'SUPPORT.md' 'CONTRIBUTING.md'; do
-    run grep -F "$path" "$SKILL_MD"
-    [ "$status" -eq 0 ] || { echo "missing reference: $path"; return 1; }
-  done
-}
-
-@test "scaffold-intake: SKILL.md documents AFK fail-safe (no auto-scaffold) per JTBD-006" {
-  # JTBD-006 + ADR-013 Rule 6: AFK orchestrator branch must NOT auto-write
-  # template files. The skill documents this as a Rule 6 fail-safe.
-  run grep -iE 'afk|rule 6' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-  run grep -iE 'no auto.?scaffold|do not auto.?scaffold|silent note|pending.intake.scaffold' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: SKILL.md cites ADR-014 commit discipline" {
-  run grep -F 'ADR-014' "$SKILL_MD"
-  [ "$status" -eq 0 ]
-}
-
-# --- Templates directory ---
-
-@test "scaffold-intake: templates/ directory exists with five template seeds" {
-  [ -d "$TEMPLATE_DIR" ]
-  [ -f "$TEMPLATE_DIR/config.yml.tmpl" ]
-  [ -f "$TEMPLATE_DIR/problem-report.yml.tmpl" ]
-  [ -f "$TEMPLATE_DIR/SECURITY.md.tmpl" ]
-  [ -f "$TEMPLATE_DIR/SUPPORT.md.tmpl" ]
-  [ -f "$TEMPLATE_DIR/CONTRIBUTING.md.tmpl" ]
-}
-
-@test "scaffold-intake: problem-report.yml.tmpl is problem-first (P066 shape)" {
-  run grep -F 'title: "[problem] "' "$TEMPLATE_DIR/problem-report.yml.tmpl"
-  [ "$status" -eq 0 ]
-  run grep -F 'labels: ["problem", "needs-triage"]' "$TEMPLATE_DIR/problem-report.yml.tmpl"
-  [ "$status" -eq 0 ]
-}
-
-@test "scaffold-intake: templates use mustache-style substitution tokens (ADR-036)" {
-  # ADR-036 declares the token list. Each token must appear in at least
-  # one template file for the substitution surface to be wired.
-  for token in '{{project_name}}' '{{project_url}}' '{{security_contact}}'; do
-    run grep -rF "$token" "$TEMPLATE_DIR/"
-    [ "$status" -eq 0 ] || { echo "missing token: $token"; return 1; }
-  done
-}

package/skills/scaffold-intake/test/scaffold-intake-fixture.bats

@@ -1,164 +0,0 @@
-#!/usr/bin/env bats
-
-# P065 / ADR-036 Confirmation behavioural-replay 1+2:
-# Fixture-based behavioural test for scaffold-intake. Exercises the skill's
-# core write-and-substitute contract against a mock empty downstream repo.
-#
-# This is the behavioural counterpart to scaffold-intake-contract.bats.
-# It does NOT invoke the skill via Claude Code — it asserts the
-# contract by replaying the skill's documented bash steps:
-#   1. detect project name + url from package.json
-#   2. enumerate missing intake files
-#   3. write substituted templates to the correct paths
-#   4. mark .claude/.intake-scaffold-done
-# The bats reads templates/*.tmpl directly, applies the substitution rules
-# defined in ADR-036, and asserts on the resulting files.
-#
-# Per feedback_behavioural_tests.md (P081): asserts observable file-system
-# outcomes (files exist, content substituted, idempotent re-run no-ops),
-# not source content.
-
-setup() {
-  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../../.." && pwd)"
-  TEMPLATE_DIR="$REPO_ROOT/packages/itil/skills/scaffold-intake/templates"
-  ORIG_DIR="$PWD"
-  TEST_DIR=$(mktemp -d)
-  cd "$TEST_DIR"
-
-  # Seed a minimal package.json so the skill's detection step has inputs.
-  cat > package.json <<'JSON'
-{
-  "name": "example-downstream",
-  "repository": {
-    "url": "https://github.com/example/downstream.git"
-  }
-}
-JSON
-}
-
-teardown() {
-  cd "$ORIG_DIR"
-  rm -rf "$TEST_DIR"
-}
-
-# Helper: replay the skill's substitute-and-write step for one template.
-# This is the inline mustache-style substitution declared in ADR-036.
-scaffold_one() {
-  local tmpl="$1"
-  local out="$2"
-  local project_name="example-downstream"
-  local project_url="https://github.com/example/downstream"
-  local security_contact="Use GitHub Security Advisories"
-  local plugin_list="@windyroad/itil"
-  local year="2026"
-  mkdir -p "$(dirname "$out")"
-  sed \
-    -e "s|{{project_name}}|$project_name|g" \
-    -e "s|{{project_url}}|$project_url|g" \
-    -e "s|{{security_contact}}|$security_contact|g" \
-    -e "s|{{plugin_list}}|$plugin_list|g" \
-    -e "s|{{year}}|$year|g" \
-    "$TEMPLATE_DIR/$tmpl" > "$out"
-}
-
-scaffold_all() {
-  scaffold_one "config.yml.tmpl" ".github/ISSUE_TEMPLATE/config.yml"
-  scaffold_one "problem-report.yml.tmpl" ".github/ISSUE_TEMPLATE/problem-report.yml"
-  scaffold_one "SECURITY.md.tmpl" "SECURITY.md"
-  scaffold_one "SUPPORT.md.tmpl" "SUPPORT.md"
-  scaffold_one "CONTRIBUTING.md.tmpl" "CONTRIBUTING.md"
-  mkdir -p .claude
-  : > .claude/.intake-scaffold-done
-}
-
-# --- Empty repo: scaffold writes all five files ---
-
-@test "fixture: empty repo gains all five intake files" {
-  scaffold_all
-  [ -f .github/ISSUE_TEMPLATE/config.yml ]
-  [ -f .github/ISSUE_TEMPLATE/problem-report.yml ]
-  [ -f SECURITY.md ]
-  [ -f SUPPORT.md ]
-  [ -f CONTRIBUTING.md ]
-}
-
-@test "fixture: substitution tokens are resolved (no raw {{...}} left in scaffolded files)" {
-  scaffold_all
-  for f in \
-    .github/ISSUE_TEMPLATE/config.yml \
-    .github/ISSUE_TEMPLATE/problem-report.yml \
-    SECURITY.md \
-    SUPPORT.md \
-    CONTRIBUTING.md; do
-    run grep -F '{{' "$f"
-    [ "$status" -ne 0 ] || { echo "raw mustache token left in $f"; return 1; }
-  done
-}
-
-@test "fixture: project_name substitution propagated into scaffolded SECURITY.md or CONTRIBUTING.md" {
-  scaffold_all
-  # The project name should appear at least once in either SECURITY.md or
-  # CONTRIBUTING.md; the exact placement is template-dependent but
-  # ABSENCE from both files would indicate a substitution miss.
-  run bash -c "grep -F 'example-downstream' SECURITY.md SUPPORT.md CONTRIBUTING.md"
-  [ "$status" -eq 0 ]
-}
-
-@test "fixture: scaffolded problem-report.yml retains problem-first shape (P066)" {
-  scaffold_all
-  run grep -F 'title: "[problem] "' .github/ISSUE_TEMPLATE/problem-report.yml
-  [ "$status" -eq 0 ]
-  run grep -F 'labels: ["problem", "needs-triage"]' .github/ISSUE_TEMPLATE/problem-report.yml
-  [ "$status" -eq 0 ]
-}
-
-@test "fixture: done marker written after successful scaffold" {
-  scaffold_all
-  [ -f .claude/.intake-scaffold-done ]
-}
-
-# --- Idempotency: re-scaffolding produces no diff ---
-
-@test "fixture: full re-application is idempotent (no diff)" {
-  scaffold_all
-  # Snapshot into a sibling temp dir — NOT inside $TEST_DIR. GNU cp refuses
-  # `cp -R . dest` when dest is a child of source ("cannot copy a directory
-  # into itself"), so the test fails on Linux CI even though macOS BSD cp
-  # tolerates it. Putting the snapshot outside $TEST_DIR removes the platform
-  # divergence (P127).
-  SNAPSHOT_DIR=$(mktemp -d)
-  cp -R "$TEST_DIR/." "$SNAPSHOT_DIR"
-  # Re-apply.
-  scaffold_all
-  # Diff against snapshot.
-  run diff -ru "$SNAPSHOT_DIR" "$TEST_DIR"
-  rm -rf "$SNAPSHOT_DIR"
-  # diff exit 0 means no differences.
-  [ "$status" -eq 0 ]
-}
-
-# --- Partial repo: pre-existing CONTRIBUTING.md is preserved ---
-
-@test "fixture: pre-existing CONTRIBUTING.md is preserved (idempotent skip)" {
-  echo "# Custom Contributing" > CONTRIBUTING.md
-  echo "Custom adopter content; must not be overwritten by scaffold." >> CONTRIBUTING.md
-  ORIGINAL=$(cat CONTRIBUTING.md)
-
-  # Scaffold the OTHER four files (skill skips the existing one).
-  scaffold_one "config.yml.tmpl" ".github/ISSUE_TEMPLATE/config.yml"
-  scaffold_one "problem-report.yml.tmpl" ".github/ISSUE_TEMPLATE/problem-report.yml"
-  scaffold_one "SECURITY.md.tmpl" "SECURITY.md"
-  scaffold_one "SUPPORT.md.tmpl" "SUPPORT.md"
-  # Deliberately do NOT call scaffold_one for CONTRIBUTING.md — that's
-  # the skill's idempotent skip behaviour for present files.
-
-  # Other files were created.
-  [ -f .github/ISSUE_TEMPLATE/config.yml ]
-  [ -f .github/ISSUE_TEMPLATE/problem-report.yml ]
-  [ -f SECURITY.md ]
-  [ -f SUPPORT.md ]
-
-  # CONTRIBUTING.md unchanged.
-  AFTER=$(cat CONTRIBUTING.md)
-  [ "$ORIGINAL" = "$AFTER" ]
-}

package/skills/scaffold-intake/test/scaffold-intake-secrets-absent.bats

@@ -1,87 +0,0 @@
-#!/usr/bin/env bats
-
-# P065 / ADR-036 / ADR-037 Confirmation: scaffold-intake's templates and
-# SKILL.md must not leak absolute paths, host-specific identifiers, or
-# secrets that would compromise downstream adopters who scaffold from
-# them.
-#
-# Sentinel test: per ADR-037 "Source review", every skill that emits
-# user-substituted content ships a `<skill>-secrets-absent.bats` to
-# catch hardcoded environment leakage at PR time.
-
-setup() {
-  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../../.." && pwd)"
-  TEMPLATE_DIR="$REPO_ROOT/packages/itil/skills/scaffold-intake/templates"
-  SKILL_MD="$REPO_ROOT/packages/itil/skills/scaffold-intake/SKILL.md"
-}
-
-# --- Templates: no absolute paths from the author's environment ---
-
-@test "secrets-absent: templates contain no /Users/ or /home/ absolute paths" {
-  run grep -rE '/Users/[a-zA-Z0-9_-]+/' "$TEMPLATE_DIR/"
-  [ "$status" -ne 0 ]
-  run grep -rE '/home/[a-zA-Z0-9_-]+/' "$TEMPLATE_DIR/"
-  [ "$status" -ne 0 ]
-}
-
-@test "secrets-absent: templates contain no Windows-style absolute paths" {
-  run grep -rE '[A-Z]:\\Users\\' "$TEMPLATE_DIR/"
-  [ "$status" -ne 0 ]
-}
-
-# --- Templates: no obvious credential shapes ---
-
-@test "secrets-absent: templates contain no credential-shaped tokens (AKIA, ghp_, sk_, github_pat_)" {
-  run grep -rE 'AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{80,}|sk_(live|test)_[A-Za-z0-9]{24,}' "$TEMPLATE_DIR/"
-  [ "$status" -ne 0 ]
-}
-
-@test "secrets-absent: templates contain no aws_access or aws_secret keys in plain text" {
-  run grep -rEi 'aws_access_key_id|aws_secret_access_key' "$TEMPLATE_DIR/"
-  [ "$status" -ne 0 ]
-}
-
-# --- Templates: name-of-this-repo must be substituted, not hardcoded ---
-
-@test "secrets-absent: templates do not hardcode 'windyroad/agent-plugins' (must use {{project_url}}/{{project_name}} substitution)" {
-  # The author repo is windyroad/agent-plugins; downstream-scaffolded
-  # files must use the per-project substitution token, not the literal
-  # author repo. Otherwise downstream adopters get our SECURITY.md
-  # advisory URL pointing to OUR security advisories, which is wrong.
-  #
-  # Allow it ONLY in commentary lines that explain "templated from this
-  # repo's intake".
-  run grep -rl 'windyroad/agent-plugins' "$TEMPLATE_DIR/"
-  if [ "$status" -eq 0 ]; then
-    # Anything found must be inside a comment explicitly framing it as
-    # an example. Fail otherwise.
-    while read -r f; do
-      run grep -nE 'windyroad/agent-plugins' "$f"
-      while read -r line; do
-        line_no="${line%%:*}"
-        line_text="${line#*:}"
-        # Allow only if line begins with a comment marker (#) AND mentions example/seed.
-        if echo "$line_text" | grep -qE '^[[:space:]]*#' && echo "$line_text" | grep -qiE 'example|seed|template|reference'; then
-          continue
-        fi
-        echo "hardcoded windyroad/agent-plugins reference at $f:$line_no"
-        echo "   $line_text"
-        return 1
-      done <<< "$output"
-    done < <(grep -rl 'windyroad/agent-plugins' "$TEMPLATE_DIR/")
-  fi
-}
-
-# --- SKILL.md: no transcript-leak shapes ---
-
-@test "secrets-absent: SKILL.md contains no /Users/ or /home/ absolute paths" {
-  run grep -E '/Users/[a-zA-Z0-9_-]+/' "$SKILL_MD"
-  [ "$status" -ne 0 ]
-  run grep -E '/home/[a-zA-Z0-9_-]+/' "$SKILL_MD"
-  [ "$status" -ne 0 ]
-}
-
-@test "secrets-absent: SKILL.md contains no credential-shaped tokens" {
-  run grep -E 'AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{80,}' "$SKILL_MD"
-  [ "$status" -ne 0 ]
-}