@windyroad/risk-scorer 0.13.4 → 0.13.5-preview.755

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.13.4"
+  "version": "0.13.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.13.4",
+  "version": "0.13.5-preview.755",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"

package/scripts/extract-risks-from-reports.sh

@@ -214,7 +214,7 @@ TODAY=$(date -u '+%Y-%m-%d')
 # slate. Filesystem-only is correct for the bootstrap case; ADR-019 still applies to
 # /wr-risk-scorer:create-risk for incremental adds post-bootstrap.
 LOCAL_MAX=$(ls "$TARGET_DIR/"R*.active.md "$TARGET_DIR/"R*.retired.md 2>/dev/null | sed 's|.*/R||' | grep -oE '^[0-9]+' | sort -n | tail -1 || true)
-NEXT_ID=$(( ${LOCAL_MAX:-0} + 1 ))
+NEXT_ID=$(( 10#${LOCAL_MAX:-0} + 1 ))
 
 CREATED=0
 APPENDED=0
@@ -347,7 +347,7 @@ cat > "$TARGET_DIR/README.md" <<README_HEADER
 
 ## Purpose
 
-This directory is the **persistent risk register** for the Windy Road Agent Plugins suite. It is distinct from:
+This directory is the **persistent risk register** for this project. It is distinct from:
 
 - \`RISK-POLICY.md\` — defines the *criteria* (impact/likelihood scales, appetite, treatment principles).
 - \`.risk-reports/\` — ephemeral **per-change** pipeline risk reports produced by the risk-scorer on each commit/push/release. Auto-deleted after 7 days.

package/scripts/test/extract-risks-from-reports.bats

@@ -259,6 +259,23 @@ EOF
   grep -q "ADR-059" docs/risks/README.md
 }
 
+@test "emitted README does NOT leak the publishing-suite brand name (P374 published-artefacts)" {
+  # The README heredoc must use project-neutral phrasing so an adopter's
+  # generated docs/risks/README.md never carries the source monorepo's
+  # brand into adopter-controlled prose. Witness substring from #273.
+  mkdir -p .risk-reports
+  cat > .risk-reports/r.md <<'EOF'
+RISK_REGISTER_HINT:
+- above-appetite-residual | brand-leak-test | Brand-leak absence check
+EOF
+  run "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ -f docs/risks/README.md ]
+  ! grep -q "Windy Road Agent Plugins suite" docs/risks/README.md
+  # Positive assertion: the neutral phrasing is present
+  grep -q "persistent risk register\*\* for this project" docs/risks/README.md
+}
+
 @test "README does NOT cite TEMPLATE.md (per user direction 2026-05-04)" {
   mkdir -p .risk-reports
   cat > .risk-reports/r.md <<'EOF'
@@ -314,3 +331,36 @@ EOF
   ls docs/risks/R*-derived-slug.active.md >/dev/null 2>&1
   rm -f /tmp/derived.tsv
 }
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Octal-eval regression (P164 Phase 2 — #273 witness)
+# ──────────────────────────────────────────────────────────────────────────────
+# Bash arithmetic $(( ... )) parses a leading-zero operand as octal; 008/009 are
+# invalid octal literals → `bash: 008: value too great for base`. The next-ID
+# compute (LOCAL_MAX from zero-padded R<NNN> filenames) must force base-10 with
+# 10#. Pre-seed an R008 entry so LOCAL_MAX="008" and assert the script allocates
+# R009 cleanly without the octal error.
+
+@test "allocates R009 cleanly when an R008 entry already exists (octal-eval regression, P164 Phase 2)" {
+  mkdir -p docs/risks
+  # Pre-existing zero-padded entry that drives LOCAL_MAX="008". Carries the
+  # full field shape the README generator reads (Category/Status/Curation) so
+  # the regression isolates the octal-eval boundary, not fixture malformation.
+  cat > docs/risks/R008-pre-existing.active.md <<'EOF'
+# Risk R008: Pre Existing
+**Status**: Active
+**Category**: operational
+**Curation**: (human-curated)
+EOF
+  mkdir -p .risk-reports
+  cat > .risk-reports/octal.md <<'EOF'
+RISK_REGISTER_HINT:
+- above-appetite-residual | octal-boundary-slug | New risk past the 008 boundary
+EOF
+  run "$SCRIPT"
+  [ "$status" -eq 0 ]
+  # No octal-base error in output
+  [[ "$output" != *"value too great for base"* ]]
+  # New entry allocated as R009, not a corrupted/duplicate ID
+  [ -f docs/risks/R009-octal-boundary-slug.active.md ]
+}