@windyroad/risk-scorer 0.16.3 → 0.16.4

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.16.3"
+  "version": "0.16.4"
 }

package/hooks/risk-score-commit-gate.sh

@@ -34,7 +34,10 @@ fi
 SESSION_ID=$(_get_session_id)
 [ -n "$SESSION_ID" ] || exit 0
 
-# RISK-POLICY.md must exist and not be stale (>14 days)
+# RISK-POLICY.md must exist and not be stale by its own stated review
+# cadence (`> Reviewed <cadence> ...` line; ADR-091 machine-read
+# contract). Fallback threshold 14 days when the cadence line is absent
+# or the word unrecognised. P408.
 if [ ! -f "RISK-POLICY.md" ] || [ ! -s "RISK-POLICY.md" ]; then
     risk_gate_deny "Commit blocked: RISK-POLICY.md is missing. Run /risk-policy to create it before committing."
     exit 0
@@ -42,19 +45,32 @@ fi
 POLICY_STALE=$(python3 -c "
 from datetime import date
 import re
+CADENCE_DAYS = {'weekly': 7, 'fortnightly': 14, 'biweekly': 14,
+                'monthly': 30, 'quarterly': 90, 'annually': 365, 'yearly': 365}
 try:
     text = open('RISK-POLICY.md').read()
     m = re.search(r'Last reviewed:\*{0,2}\s*(\d{4}-\d{2}-\d{2})', text)
+    # Case-sensitive capital-R match so the cadence line is never
+    # confused with the lowercase 'Last reviewed: <date>' line (ADR-091).
+    c = re.search(r'(?m)^>?\s*Reviewed\s+([A-Za-z]+)', text)
+    cadence = c.group(1) if c else ''
+    threshold = CADENCE_DAYS.get(cadence, 14)
+    if cadence not in CADENCE_DAYS:
+        cadence = ''
     if m:
         reviewed = date.fromisoformat(m.group(1))
-        print('yes' if (date.today() - reviewed).days > 14 else 'no')
+        if (date.today() - reviewed).days > threshold:
+            reason = ('per the policy\'s stated %s cadence' % cadence) if cadence else '(default threshold; no stated cadence)'
+            print('over %d days ago %s' % (threshold, reason))
+        else:
+            print('no')
     else:
         print('no')
 except:
     print('no')
 " 2>/dev/null || echo "no")
-if [ "$POLICY_STALE" = "yes" ]; then
-    risk_gate_deny "Commit blocked: RISK-POLICY.md is stale (last reviewed over 2 weeks ago). Run /risk-policy to update it before committing."
+if [ "$POLICY_STALE" != "no" ]; then
+    risk_gate_deny "Commit blocked: RISK-POLICY.md is stale (last reviewed ${POLICY_STALE}). Run /risk-policy to update it before committing."
     exit 0
 fi
 

package/hooks/test/risk-score-commit-gate-cadence-staleness.bats

@@ -0,0 +1,105 @@
+#!/usr/bin/env bats
+
+# P408 / ADR-091 / RFC-043 / STORY-037: the POLICY_STALE branch of
+# risk-score-commit-gate.sh derives its staleness threshold from the
+# policy's stated review cadence line (`> Reviewed <cadence> ...`)
+# instead of a hardcoded 14 days. Vocabulary: weekly=7,
+# fortnightly/biweekly=14, monthly=30, quarterly=90, annually/yearly=365;
+# fallback 14 when the line is absent or the word unrecognised. The
+# cadence regex is case-sensitive and must bind the capital-R
+# `Reviewed <word>` line, never the lowercase `Last reviewed: <date>`
+# line (ADR-091 machine-read contract).
+
+setup() {
+  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
+  GATE_SCRIPT="$HOOKS_DIR/risk-score-commit-gate.sh"
+  TEST_SESSION="bats-test-$$-${BATS_TEST_NUMBER}"
+  TMP_REPO="$(mktemp -d)"
+  cd "$TMP_REPO"
+}
+
+teardown() {
+  rm -rf "$TMP_REPO"
+  rm -rf "${TMPDIR:-/tmp}/claude-risk-${TEST_SESSION}"
+}
+
+# Helper: date N days ago, ISO format.
+days_ago() {
+  python3 -c "from datetime import date, timedelta; print(date.today() - timedelta(days=int('$1')))"
+}
+
+# Helper: write a RISK-POLICY.md reviewed N days ago with an optional
+# cadence line supplied verbatim as the second argument.
+write_policy() {
+  local reviewed_days_ago="$1"
+  local cadence_line="${2-}"
+  {
+    echo "# Risk Policy"
+    echo ""
+    echo "> Last reviewed: $(days_ago "$reviewed_days_ago")"
+    if [ -n "$cadence_line" ]; then
+      echo ""
+      echo "$cadence_line"
+    fi
+  } > RISK-POLICY.md
+}
+
+# Helper: invoke the gate with a git-commit Bash payload.
+invoke_gate() {
+  local input
+  input=$(python3 -c "
+import json, sys
+print(json.dumps({
+    'tool_name': 'Bash',
+    'tool_input': {'command': 'git commit -m \"feat: change\"'},
+    'session_id': sys.argv[1]
+}))
+" "$TEST_SESSION")
+  echo "$input" | bash "$GATE_SCRIPT"
+}
+
+@test "P408: monthly cadence, reviewed 16 days ago — NOT stale (witnessed case; deny is the score gate, not staleness)" {
+  write_policy 16 "> Reviewed monthly and after any significant change to distribution channels."
+  run invoke_gate
+  # The gate still denies (no risk score for this session) but the reason
+  # must NOT be policy staleness.
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" != *"stale"* ]]
+}
+
+@test "P408: no cadence line, reviewed 16 days ago — 14-day fallback still flags stale (behaviour preserved)" {
+  write_policy 16
+  run invoke_gate
+  [[ "$output" == *"stale"* ]]
+}
+
+@test "P408: unrecognised cadence word falls back to 14 days" {
+  write_policy 16 "> Reviewed sporadically whenever convenient."
+  run invoke_gate
+  [[ "$output" == *"stale"* ]]
+}
+
+@test "P408: regex binds the capital-R cadence line, never the lowercase 'Last reviewed:' date line" {
+  # Quarterly cadence, reviewed 20 days ago. If the regex wrongly bound
+  # the 'Last reviewed:' line the capture would fail and the 14-day
+  # fallback would flag stale at 20 days; correct capital-R binding
+  # derives 90 days and passes.
+  write_policy 20 "> Reviewed quarterly."
+  run invoke_gate
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" != *"stale"* ]]
+}
+
+@test "P408: elapsed monthly cadence denies and the message names the derived threshold and cadence word" {
+  write_policy 45 "> Reviewed monthly."
+  run invoke_gate
+  [[ "$output" == *"stale"* ]]
+  [[ "$output" == *"30"* ]]
+  [[ "$output" == *"monthly"* ]]
+}
+
+@test "P408: weekly cadence tightens the threshold below the default (10 days is stale under weekly)" {
+  write_policy 10 "> Reviewed weekly."
+  run invoke_gate
+  [[ "$output" == *"stale"* ]]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"