@windyroad/risk-scorer 0.17.4 → 0.18.0

package/skills/assess-wip/SKILL.md

@@ -1,13 +1,14 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:assess-wip
 description: On-demand WIP risk nudge. Scores the current uncommitted diff for pipeline risk. Use during development to catch high-risk changes before committing.
 allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # WIP Risk Assessment Skill
 
 Run a WIP (work-in-progress) risk assessment on demand. Scores the current uncommitted diff — staged and unstaged — for pipeline risk. Use during development to get early feedback before committing.

package/skills/bootstrap-catalog/SKILL.md

@@ -1,7 +1,3 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:bootstrap-catalog
 description: Bootstrap docs/risks/ standing-risk catalog from existing .risk-reports/ corpus. Walks reports, dedupes by ADR-056 slug, emits one R<NNN>-<slug>.active.md per unique slug with ## Source Evidence block citing originating reports. Idempotent — re-runs are no-ops by file-existence per slug. One-shot per project lifetime; install-updates Step 6.5 auto-triggers when catalog is empty AND .risk-reports/ is non-empty AND RISK-POLICY.md is present.
@@ -9,6 +5,11 @@ allowed-tools: Read, Write, Edit, Bash, Glob, Grep
 maturity: proposed
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # Risk Catalog Bootstrap
 
 Walk the project's `.risk-reports/*.md` corpus, dedupe by ADR-056 risk-slug, and emit one `R<NNN>-<slug>.active.md` register entry per unique slug with a `## Source Evidence` block citing originating reports. This is the **one-shot historical backfill** that Phase 3 of ADR-047's roadmap deferred — now landed via ADR-059.

package/skills/create-risk/SKILL.md

@@ -1,13 +1,14 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:create-risk
 description: Create a new standing-risk entry in docs/risks/. Examines existing risks, gathers impact/likelihood/controls from the user, writes a file using the entry shape inlined in this skill (no TEMPLATE.md dependency — the entry shape is owned by this skill per user direction 2026-05-04), and updates the register index.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # Risk Register Entry Generator
 
 Create a new standing-risk file in `docs/risks/` using the entry shape inlined in this skill (Step 5 below). The register captures persistent risks (distinct from the ephemeral per-change reports in `.risk-reports/`), and its criteria come from `RISK-POLICY.md`. **No `docs/risks/TEMPLATE.md` exists** — per user direction 2026-05-04 the entry shape lives in this skill (and the bootstrap-catalog extractor that reuses the same shape) so the directory is purely the inventory, not its own scaffolding.

package/skills/external-comms/SKILL.md

@@ -1,13 +1,14 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:external-comms
 description: Invokable SKILL wrapper around the wr-risk-scorer:external-comms leak-review agent. Delegates to the agent via the Agent tool and returns the agent's structured EXTERNAL_COMMS_RISK_VERDICT. Internal-use plumbing used by `/wr-risk-scorer:assess-external-comms` per ADR-015's Confirmation literal phrasing. End users should invoke `/wr-risk-scorer:assess-external-comms` instead.
 allowed-tools: Read, Glob, Grep, Bash, Agent
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # External-Comms Leak Review Skill (Wrapper)
 
 This SKILL is an **invokable wrapper** around the `wr-risk-scorer:external-comms` agent. It exists so consumer SKILLs can invoke the leak reviewer via the **Skill tool** with `skill: wr-risk-scorer:external-comms` — matching ADR-015's Confirmation literal phrasing.

package/skills/pipeline/SKILL.md

@@ -1,13 +1,14 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:pipeline
 description: Invokable SKILL wrapper around the wr-risk-scorer:pipeline scoring agent. Delegates to the agent via the Agent tool and returns the agent's structured RISK_SCORES output. Internal-use plumbing used by `/wr-risk-scorer:assess-release` and any other consumer SKILL that needs Skill-tool-shaped invocation of the pipeline scorer per ADR-015's Confirmation literal phrasing. End users should invoke `/wr-risk-scorer:assess-release` instead.
 allowed-tools: Read, Glob, Bash, Agent
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # Pipeline Scoring Skill (Wrapper)
 
 This SKILL is an **invokable wrapper** around the `wr-risk-scorer:pipeline` agent. It exists so consumer SKILLs can invoke the pipeline scorer via the **Skill tool** with `skill: wr-risk-scorer:pipeline` — matching ADR-015's Confirmation literal phrasing.

package/skills/update-policy/SKILL.md

@@ -1,13 +1,14 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:update-policy
 description: Create or update the project's RISK-POLICY.md per ISO 31000 and the risk-scorer agent. Examines the project to derive business-specific impact levels.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Agent
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # Risk Policy Generator
 
 Create or update `RISK-POLICY.md` per ISO 31000, tailored to this project's business context. The risk-scorer agent reads this file to score pipeline actions (commit, push, release).
@@ -168,7 +169,7 @@ Run the Codex policy reviewer with this prompt:
 >
 > [paste the full draft policy content here]
 
-Use a native Codex subagent workflow. Prefer the installed plugin agent named `wr-risk-scorer:policy` when available. In this source repo, the generated project-local alias `wr-risk-scorer-policy` may also be available for dogfooding. If neither custom agent is available in the current Codex session, spawn the built-in `default` subagent and instruct it to read `agents/policy.md` from this plugin in full before performing the review.
+Use a native Codex subagent workflow with the installed custom agent named `wr-risk-scorer:policy`. If it is not visible in the current session, restart Codex; do not substitute a different agent identity because the policy marker hook consumes it.
 
 The risk-scorer will check:
 - Impact levels describe business consequences (not file categories)

package/skills/wip/SKILL.md

@@ -1,13 +1,14 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:wip
 description: Invokable SKILL wrapper around the wr-risk-scorer:wip nudge agent. Delegates to the agent via the Agent tool and returns the agent's structured WIP risk verdict. Internal-use plumbing used by `/wr-risk-scorer:assess-wip` per ADR-015's Confirmation literal phrasing. End users should invoke `/wr-risk-scorer:assess-wip` instead.
 allowed-tools: Read, Glob, Bash, Agent
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # WIP Scoring Skill (Wrapper)
 
 This SKILL is an **invokable wrapper** around the `wr-risk-scorer:wip` agent. It exists so consumer SKILLs can invoke the WIP nudge scorer via the **Skill tool** with `skill: wr-risk-scorer:wip` — matching ADR-015's Confirmation literal phrasing.

package/agents/test/inbound-report-contract.bats

@@ -1,225 +0,0 @@
-#!/usr/bin/env bats
-# Contract assertions for the wr-risk-scorer:inbound-report subagent
-# (RFC-004 Slice B). Sibling of wr-risk-scorer:external-comms — NOT
-# extension. Reviews INBOUND third-party prose on two axes (Request-risk +
-# Fix-risk) per RISK-POLICY.md § Inbound Report Risk Classes.
-#
-# Structural assertions — Permitted Exception to the source-grep ban
-# per ADR-005 / P011 / ADR-037 / ADR-052 § Surface 2. Subagent prompt
-# prose governs LLM-driven verdict behaviour; behavioural-replay
-# testing requires a synthetic agent harness (P012 / P176). Until that
-# harness lands, contract bats assert the load-bearing rubric + structured
-# verdict format are present so future edits don't silently strip them.
-#
-# @problem P079
-# @rfc RFC-004
-# @adr ADR-062 (inbound discovery + assessment pipeline — § Sibling subagent)
-# @adr ADR-015 (on-demand assessment skills — § Scope table)
-# @adr ADR-026 (grounding discipline — every FAIL verdict cites policy class)
-# @adr ADR-029 (diagnose before implement — hypothesis / evidence / structured verdict)
-# @adr ADR-052 (behavioural-tests default + Permitted Exception)
-# @jtbd JTBD-301 (acknowledgement contract grounded in policy classes)
-# @jtbd JTBD-001 (mechanical-stage carve-out via structured verdict)
-
-setup() {
-  AGENTS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  AGENT_FILE="${AGENTS_DIR}/inbound-report.md"
-  POLICY_FILE="$(cd "${AGENTS_DIR}/../../.." && pwd)/RISK-POLICY.md"
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Frontmatter + tool surface
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "inbound-report.md exists and has frontmatter (RFC-004 Slice B)" {
-  [ -f "$AGENT_FILE" ]
-  run head -1 "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-  [ "$output" = "---" ]
-}
-
-@test "frontmatter name is 'inbound-report' (sibling of external-comms)" {
-  run grep -nE '^name: inbound-report$' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "frontmatter tools are read-only (Read, Glob, Grep)" {
-  # Per ADR-062 § Sibling subagent: read-only contract; subagent emits
-  # verdict, PostToolUse hook owns marker writes.
-  run grep -nE '  - Read' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-  run grep -nE '  - Glob' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-  run grep -nE '  - Grep' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "frontmatter tools do NOT include Write / Edit / Bash (read-only invariant)" {
-  run grep -nE '^  - (Write|Edit|Bash)$' "$AGENT_FILE"
-  [ "$status" -ne 0 ]
-}
-
-@test "frontmatter model is inherit" {
-  run grep -nE '^model: inherit$' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Sibling-not-extension positioning (ADR-062 § Sibling subagent)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "agent prose names sibling-not-extension positioning vs external-comms" {
-  # ADR-062 explicitly carves the inbound-report subagent as a sibling
-  # (NOT extension) of external-comms. Protects JTBD-101 plugin-developer
-  # constraint "must not break existing plugins" by preserving
-  # external-comms scope-purity.
-  run grep -inE 'sibling.*external-comms|external-comms.*sibling' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "agent prose names the inbound-direction framing (third-party prose flowing INWARD)" {
-  run grep -inE 'INWARD|inbound prose|third-party prose' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Two-axis review structure (Request-risk + Fix-risk)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "Axis 1 Request-risk documented (attack-vector axis)" {
-  run grep -nE 'Axis 1.*Request-risk' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "Axis 1 enumerates info-extraction / backdoor request / malicious-code injection classes" {
-  run grep -inE 'Info-extraction' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-  run grep -inE 'Backdoor request' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-  run grep -inE 'Malicious-code injection' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "Axis 2 Fix-risk documented (work-to-be-weighed axis)" {
-  run grep -nE 'Axis 2.*Fix-risk' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "Axis 2 enumerates privilege escalation / removal-of-safety-check / adopter-attack-surface-expansion classes" {
-  run grep -inE 'Privilege escalation' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-  run grep -inE 'Removal of load-bearing safety check' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-  run grep -inE 'Adopter-attack-surface expansion' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Structured verdict block (consumed by assessment-pipeline branch routing)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "verdict block defines INBOUND_REPORT_VERDICT" {
-  run grep -nE 'INBOUND_REPORT_VERDICT' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "verdict block defines INBOUND_REPORT_KEY (sha256 hex for marker matching)" {
-  run grep -nE 'INBOUND_REPORT_KEY' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "verdict block defines INBOUND_REPORT_CLASS (one of four classifications)" {
-  run grep -nE 'INBOUND_REPORT_CLASS' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "verdict block defines INBOUND_REPORT_REASON for FAIL path" {
-  run grep -nE 'INBOUND_REPORT_REASON' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Four classifications enumerated (branch-routing vocabulary)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "classification safe-low-fix-risk enumerated" {
-  run grep -nE 'safe-low-fix-risk' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "classification safe-high-fix-risk enumerated" {
-  run grep -nE 'safe-high-fix-risk' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "classification above-threshold-risk enumerated" {
-  run grep -nE 'above-threshold-risk' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "classification clear-malicious-request enumerated" {
-  run grep -nE 'clear-malicious-request' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Grounding discipline (ADR-026)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "FAIL verdict requires citing the specific RISK-POLICY.md class" {
-  run grep -inE 'cite|class violated' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "agent prose cites ADR-026 grounding discipline" {
-  run grep -nE 'ADR-026' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Read-only constraints + marker boundary
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "agent declares read-only (no file writes / commits / draft modifications)" {
-  run grep -inE 'read-only' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "agent forbids self-writing to /tmp/ or marker locations" {
-  # PostToolUse hook owns marker writes per ADR-009; the subagent
-  # emits the verdict and the hook computes the marker key.
-  run grep -inE 'NOT write to /tmp|PostToolUse hook owns' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Mechanical-stage carve-out integration (P132 — pipeline branch routing)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "agent prose names the mechanical-stage carve-out integration (P132)" {
-  run grep -nE 'P132|mechanical' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "agent does NOT make a block-list decision (P123 scope carve-out)" {
-  # Block-list enforcement is a separate ticket's concern; this subagent's
-  # verdict feeds the audit-log via the assessment-pipeline's clear-malicious
-  # branch and stops there.
-  run grep -inE 'NOT make a block-list|P123' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# RISK-POLICY.md integration (the policy classes the agent grounds verdicts against)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "RISK-POLICY.md has the '## Inbound Report Risk Classes' section the agent reads" {
-  [ -f "$POLICY_FILE" ]
-  run grep -nE '^## Inbound Report Risk Classes$' "$POLICY_FILE"
-  [ "$status" -eq 0 ]
-}
-
-@test "agent prose references RISK-POLICY.md § Inbound Report Risk Classes" {
-  run grep -nE 'Inbound Report Risk Classes' "$AGENT_FILE"
-  [ "$status" -eq 0 ]
-}

package/agents/test/risk-scorer-above-appetite-stop.bats

@@ -1,80 +0,0 @@
-#!/usr/bin/env bats
-# Doc-lint guard: risk-scorer agent prompts must contain an explicit
-# STOP / do-not-proceed directive in their Above-Appetite sections.
-#
-# Structural assertions — Permitted Exception to the source-grep ban (ADR-005 / P011).
-# These tests assert that the pipeline, wip, and plan scorer prompts forbid
-# "Proceed", "Continue", or "You may ship" nudges when cumulative risk
-# exceeds appetite.
-#
-# Background: P037 identified that scorer reports could include "Proceed
-# with release" or similar nudge language even when residual risk exceeded
-# appetite. The hook gate then correctly blocked the action, but only after
-# the agent wasted tool calls and tokens acting on the nudge. The scorer
-# is not the primary decision-maker, but its verbal verdict must match the
-# structured score — ambiguous "proceed" language undermines this.
-#
-# The Below-Appetite Output Rule (ADR-013 Rule 5) already requires silent
-# policy-authorised release when all scores are within appetite. This guard
-# enforces the inverse: an explicit STOP directive above appetite.
-#
-# Cross-reference:
-#   P037:    docs/problems/037-risk-scorer-proceeds-above-appetite.open.md
-#   ADR-013: docs/decisions/013-structured-user-interaction-for-governance-decisions.proposed.md
-#   @jtbd JTBD-001 (enforce governance without slowing down)
-#   @jtbd JTBD-002 (ship with confidence — verbal verdict must match structured score)
-#   @jtbd JTBD-202 (pre-flight governance — structured output is the only sanctioned channel)
-
-setup() {
-  AGENTS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  PIPELINE="${AGENTS_DIR}/pipeline.md"
-  WIP="${AGENTS_DIR}/wip.md"
-  PLAN="${AGENTS_DIR}/plan.md"
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# pipeline.md: Above-Appetite STOP directive
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "pipeline.md Above-Appetite section contains explicit STOP directive" {
-  # Must contain the word STOP (or BLOCKED) as the verdict above appetite.
-  run grep -qE "STOP|BLOCKED" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-@test "pipeline.md Above-Appetite section forbids Proceed nudges" {
-  # Must explicitly forbid emitting "Proceed" / "Continue" nudges
-  # when risk exceeds appetite.
-  run grep -qE "[Dd]o NOT emit.*Proceed|forbid.*Proceed|not emit.*Continue|must not.*proceed" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# wip.md: Above-Appetite STOP directive
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "wip.md Above-Appetite section contains explicit STOP directive" {
-  # PAUSE is the wip-mode verdict equivalent of STOP.
-  run grep -qE "STOP|BLOCKED|PAUSE" "$WIP"
-  [ "$status" -eq 0 ]
-}
-
-@test "wip.md Above-Appetite section forbids Proceed nudges" {
-  run grep -qE "[Dd]o NOT emit.*Proceed|forbid.*Proceed|not emit.*Continue|must not.*proceed" "$WIP"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# plan.md: FAIL directive (plan-mode equivalent of STOP)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "plan.md FAIL section contains explicit STOP directive" {
-  # FAIL is the plan-mode verdict; reinforces STOP language.
-  run grep -qE "STOP|BLOCKED|FAIL" "$PLAN"
-  [ "$status" -eq 0 ]
-}
-
-@test "plan.md FAIL section forbids Proceed nudges" {
-  run grep -qE "[Dd]o NOT emit.*Proceed|forbid.*Proceed|not emit.*Continue|must not.*proceed" "$PLAN"
-  [ "$status" -eq 0 ]
-}

package/agents/test/risk-scorer-catalog-consumption.bats

@@ -1,138 +0,0 @@
-#!/usr/bin/env bats
-# Doc-lint guard: pipeline scorer MUST define the catalog consumption protocol
-# per ADR-059 — read docs/risks/ first, hybrid filter (slug-token primary,
-# judgement fallback), residual reconciliation (per-action residual in
-# RISK_SCORES, catalog lifetime baseline in risk-item block), per-run
-# CATALOG_HIT_RATE observability line.
-#
-# Structural assertions — Permitted Exception to the source-grep ban (ADR-005 / P011).
-# Agent prompts are specification documents; behavioural verification of an LLM's
-# output is out of scope for bats — the contract document is what consuming
-# orchestrators and reviewers rely on. This pattern matches existing tests in
-# this directory (see risk-scorer-register-hint.bats).
-#
-# Cross-reference:
-#   ADR-059: docs/decisions/059-pipeline-consume-catalog-and-bootstrap-from-reports.proposed.md
-#   ADR-056: docs/decisions/056-risk-register-back-channel-write-contract.proposed.md (slug primitive consumed)
-#   ADR-015: docs/decisions/015-on-demand-assessment-skills.proposed.md (pure-scorer contract preserved)
-#   ADR-026: docs/decisions/026-agent-output-grounding.proposed.md
-#   P168:    docs/problems/168-risk-scorer-doesnt-consume-catalog-or-bootstrap.known-error.md
-#   P167:    docs/problems/167-risk-register-aggregate-reads-as-dont-ship.known-error.md
-#   @jtbd JTBD-001 (enforce governance without slowing down — closes missed-risk-class hazard)
-#   @jtbd JTBD-202 (pre-flight governance — catalog as ISO 31000/27001 audit-trail artefact)
-
-setup() {
-  AGENTS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  PIPELINE="${AGENTS_DIR}/pipeline.md"
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Contract surface: Catalog Consumption Protocol section exists
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "pipeline.md defines Catalog Consumption Protocol section" {
-  run grep -q "## Catalog Consumption Protocol" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-@test "pipeline.md cites ADR-059 in the catalog protocol section" {
-  run grep -q "ADR-059" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-@test "pipeline.md names docs/risks/ as the catalog read source" {
-  run grep -qE "READ.*docs/risks/|read.*standing-risk catalog at .docs/risks/" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Hybrid filter: slug-token-match primary, judgement fallback
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "pipeline.md describes slug-token-match as primary filter path" {
-  run grep -qE "[Ss]lug-token-match.*primary|[Ss]lug-token-match \(primary" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-@test "pipeline.md describes judgement as fallback filter path" {
-  run grep -qE "[Jj]udgement.*fallback|[Ff]ree-form judgement.*fallback" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Risk Item Format: Catalog match + Catalog baseline lines
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "pipeline.md Risk Item Format includes Catalog match line" {
-  run grep -q "Catalog match:" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-@test "pipeline.md Risk Item Format includes Catalog baseline line" {
-  run grep -q "Catalog baseline:" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-@test "pipeline.md names the three Catalog match values" {
-  # slug-token | judgement | none — matches the ADR-059 verdict E3 contract.
-  run grep -qE "slug-token.*judgement.*none|slug-token \| judgement \| none" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Residual reconciliation: per-action residual in RISK_SCORES, baseline contextual
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "pipeline.md names per-action residual as RISK_SCORES output" {
-  run grep -qE "RISK_SCORES.*per-action residual|per-action residual.*RISK_SCORES" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-@test "pipeline.md describes catalog lifetime baseline as context not RISK_SCORES" {
-  run grep -qE "lifetime baseline|Catalog baseline:" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Hit-rate observability: CATALOG_HIT_RATE line emitted per run
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "pipeline.md defines CATALOG_HIT_RATE observability line" {
-  run grep -q "CATALOG_HIT_RATE:" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-@test "pipeline.md names the CATALOG_HIT_RATE matched + missed columns" {
-  run grep -qE "matched=N missed=M|CATALOG_HIT_RATE: matched" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Empty catalog handling: nudge but do NOT halt or inflate residual
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "pipeline.md handles empty catalog with nudge not halt" {
-  run grep -qE "[Ee]mpty catalog|catalog is empty.*nudge|do NOT halt" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-@test "pipeline.md cites bootstrap-catalog skill in empty catalog nudge" {
-  run grep -qE "bootstrap-catalog|/install-updates.*bootstrap" "$PIPELINE"
-  [ "$status" -eq 0 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Pure-scorer contract preserved: no Write tool grant added
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "pipeline.md preserves pure-scorer contract (Read + Glob only)" {
-  # The agent's tool grant must remain Read + Glob per ADR-015.
-  # Adding Write would break the architectural boundary ADR-059 verdict F2 preserves.
-  run grep -qE "^  - Read$" "$PIPELINE"
-  [ "$status" -eq 0 ]
-  run grep -qE "^  - Glob$" "$PIPELINE"
-  [ "$status" -eq 0 ]
-  # Negative: Write tool MUST NOT appear in tool grant
-  run grep -qE "^  - Write$" "$PIPELINE"
-  [ "$status" -ne 0 ]
-}