@windyroad/risk-scorer 0.17.4 → 0.18.0

package/hooks/test/external-comms-gate.bats

@@ -1,528 +0,0 @@
-#!/usr/bin/env bats
-# Tests for external-comms-gate.sh (P064 / ADR-028 amended).
-# Behavioural: the gate denies outbound prose tool calls until the
-# wr-risk-scorer:external-comms subagent has reviewed the draft and a
-# per-evaluator marker has been written. Hard-fail leak patterns deny
-# immediately without delegation.
-#
-# Note: secret-shaped strings are constructed at runtime via concatenation
-# so this test file itself does not trip the secret-leak-gate hook.
-
-setup() {
-  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  HOOK="$HOOKS_DIR/external-comms-gate.sh"
-
-  TEST_SESSION="bats-extcomms-gate-$$-${BATS_TEST_NUMBER}"
-  RDIR="${TMPDIR:-/tmp}/claude-risk-${TEST_SESSION}"
-  rm -rf "$RDIR"
-  mkdir -p "$RDIR"
-
-  # Default: assume RISK-POLICY.md is present in repo root (it is).
-  TEST_PROJECT_DIR="$(mktemp -d)"
-  printf "## Confidential Information\n- Client names\n- Revenue figures\n" \
-    > "$TEST_PROJECT_DIR/RISK-POLICY.md"
-
-  unset BYPASS_RISK_GATE
-
-  # Construct secret-shaped strings at runtime to avoid tripping the
-  # repo's own secret-leak-gate when this file is committed/edited.
-  GH_TOKEN_LIKE="g""hp""_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-  AWS_KEY_LIKE="A""KIA""IOSFODNN7EXAMPLE"
-}
-
-teardown() {
-  rm -rf "$RDIR"
-  rm -rf "$TEST_PROJECT_DIR"
-  unset BYPASS_RISK_GATE
-}
-
-# ---------- Helpers ----------
-
-# Build a PreToolUse:Bash input for a given command via python so quoting is safe.
-build_bash_input() {
-  local cmd="$1"
-  python3 -c "
-import json, sys
-print(json.dumps({
-    'session_id': '$TEST_SESSION',
-    'tool_name': 'Bash',
-    'tool_input': {'command': sys.argv[1]},
-}))
-" "$cmd"
-}
-
-# Build a PreToolUse:Write input for a changeset path with body content.
-build_write_input() {
-  local file_path="$1"
-  local content="$2"
-  python3 -c "
-import json, sys
-print(json.dumps({
-    'session_id': '$TEST_SESSION',
-    'tool_name': 'Write',
-    'tool_input': {'file_path': sys.argv[1], 'content': sys.argv[2]},
-}))
-" "$file_path" "$content"
-}
-
-# Mock `gh repo view --json visibility` for the git-commit-message surface
-# repo-visibility precondition (P365). vis ∈ {PUBLIC,PRIVATE,INTERNAL}; pass the
-# literal "FAIL" to simulate gh absent / unauthenticated (non-zero exit). The
-# mock ignores args and prints the chosen visibility so the hook's
-# `gh repo view --json visibility -q .visibility` resolves deterministically.
-mock_gh_visibility() {
-  local vis="$1"
-  mkdir -p "$TEST_PROJECT_DIR/mockbin"
-  if [ "$vis" = "FAIL" ]; then
-    printf '#!/usr/bin/env bash\nexit 1\n' > "$TEST_PROJECT_DIR/mockbin/gh"
-  else
-    printf '#!/usr/bin/env bash\necho %s\n' "$vis" > "$TEST_PROJECT_DIR/mockbin/gh"
-  fi
-  chmod +x "$TEST_PROJECT_DIR/mockbin/gh"
-}
-
-# Run the hook in a project dir with RISK-POLICY.md present, piping JSON via stdin.
-# mockbin (if populated by mock_gh_visibility) is prepended to PATH so the
-# git-commit-message visibility precondition resolves against the mock.
-run_hook() {
-  local input="$1"
-  run bash -c "cd '$TEST_PROJECT_DIR' && export PATH='$TEST_PROJECT_DIR/mockbin':\$PATH && printf '%s' \"\$1\" | '$HOOK'" _ "$input"
-}
-
-# ---------- Tests ----------
-
-@test "non-matching Bash command (ls) is allowed silently" {
-  INPUT=$(build_bash_input "ls -la")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "gh issue create with clean draft denies and prompts external-comms delegation (no marker yet)" {
-  INPUT=$(build_bash_input "gh issue create --title T --body 'we observed a build failure on Node 20'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"permissionDecision"* ]]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-}
-
-# P377/RFC-029: the BYPASS_RISK_GATE env override was removed. The only
-# clearance path named in the deny is delegation to the external-comms subagent.
-@test "marker-absent deny names the reviewer and offers no env override (P377/RFC-029)" {
-  INPUT=$(build_bash_input "gh issue create --title T --body 'we observed a build failure on Node 20'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-  [[ "$output" != *"BYPASS_RISK_GATE=1"* ]]
-}
-
-@test "hard-fail credential pattern (GitHub token) denies immediately with leak reason" {
-  INPUT=$(build_bash_input "gh issue comment 42 --body 'token=${GH_TOKEN_LIKE}'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"permissionDecision"* ]]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"GitHub token"* ]] || [[ "$output" == *"credential"* ]]
-}
-
-@test "hard-fail credential pattern (AWS key) denies immediately" {
-  INPUT=$(build_bash_input "gh pr create --title T --body 'AWS=${AWS_KEY_LIKE}'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"AWS"* ]] || [[ "$output" == *"credential"* ]]
-}
-
-@test "BYPASS_RISK_GATE=1 does NOT bypass the gate (removed P377/RFC-029)" {
-  INPUT=$(build_bash_input "gh issue create --title T --body 'we observed a build failure'")
-  run bash -c "cd '$TEST_PROJECT_DIR' && BYPASS_RISK_GATE=1 printf '%s' \"\$1\" | BYPASS_RISK_GATE=1 '$HOOK'" _ "$INPUT"
-  [ "$status" -eq 0 ]
-  # The env override no longer short-circuits — the gate still denies the
-  # unreviewed external-comms draft.
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-}
-
-@test "per-evaluator marker (external-comms-risk-reviewed-<KEY>) allows the call (ADR-028 amended 2026-05-14)" {
-  DRAFT="we observed a build failure on Node 20"
-  SURFACE="gh-issue-create"
-  KEY=$(printf '%s\n%s' "$DRAFT" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
-  touch "${RDIR}/external-comms-risk-reviewed-${KEY}"
-
-  INPUT=$(build_bash_input "gh issue create --title T --body '$DRAFT'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "legacy combined marker (external-comms-reviewed-<KEY>) does NOT satisfy the risk gate (P038 per-evaluator scheme)" {
-  DRAFT="we observed a build failure on Node 20"
-  SURFACE="gh-issue-create"
-  KEY=$(printf '%s\n%s' "$DRAFT" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
-  # Pre-amendment combined marker — should NOT satisfy the new per-evaluator gate.
-  touch "${RDIR}/external-comms-reviewed-${KEY}"
-
-  INPUT=$(build_bash_input "gh issue create --title T --body '$DRAFT'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-}
-
-@test "RISK-POLICY.md absent yields advisory-only mode (permits)" {
-  rm -f "$TEST_PROJECT_DIR/RISK-POLICY.md"
-  INPUT=$(build_bash_input "gh issue create --title T --body 'we observed a failure'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  # Must NOT deny when policy file is absent.
-  [[ "$output" != *"\"permissionDecision\": \"deny\""* ]]
-  [[ "$output" != *"\"permissionDecision\":\"deny\""* ]]
-}
-
-@test "PreToolUse:Write on .changeset/*.md with revenue leak content denies" {
-  INPUT=$(build_write_input ".changeset/wr-risk-scorer-extcomms.md" "Add gate; covers Acme Corp \$2.4M ARR client.")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-}
-
-@test "PreToolUse:Write on .changeset/*.md with clean content denies-then-delegates (no marker yet)" {
-  INPUT=$(build_write_input ".changeset/wr-risk-scorer-extcomms.md" "Add external-comms gate covering gh issue and pr surfaces.")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-}
-
-@test "PreToolUse:Write on a non-changeset path is ignored" {
-  INPUT=$(build_write_input "src/foo.ts" "Acme Corp client revenue \$2.4M")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "gh api security-advisories triggers the gate" {
-  INPUT=$(build_bash_input "gh api repos/foo/bar/security-advisories --method POST --field summary='leak via X'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-}
-
-# ---------------------------------------------------------------------------
-# P405 — read-only `gh api` polls must NOT trip the gate. `gh api` defaults to
-# GET; it only carries an outbound prose body (the thing this gate reviews)
-# when a request-body flag (-f/--field, -F/--raw-field, --input) is present.
-# The `/wr-itil:review-problems` Step 4.5c security-advisories discovery poll
-# is read-only (`--jq` filter, no body flag) and was being denied as if it
-# were an advisory draft, silently blacking out one discovery channel.
-# ---------------------------------------------------------------------------
-
-@test "P405: read-only gh api security-advisories poll (--jq, no body flag) is not gated" {
-  INPUT=$(build_bash_input "gh api repos/foo/bar/security-advisories --jq '.[].ghsa_id'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P405: bare gh api security-advisories read (no flags) is not gated" {
-  INPUT=$(build_bash_input "gh api repos/foo/bar/security-advisories")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P405: read-only gh api comments poll (--jq, no body flag) is not gated" {
-  INPUT=$(build_bash_input "gh api repos/foo/bar/issues/1/comments --jq '.[].body'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P405: gh api security-advisories write with -f body flag still triggers the gate" {
-  INPUT=$(build_bash_input "gh api repos/foo/bar/security-advisories -f summary='new advisory'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-}
-
-@test "npm publish triggers the gate" {
-  INPUT=$(build_bash_input "npm publish")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-}
-
-# ---------------------------------------------------------------------------
-# P010 / ADR-028 amended 2026-05-25 — deny-after-PASS regression.
-# The gate sees the FULL Write content (YAML frontmatter + body) on the
-# changeset-author surface, but the mark hook keys the marker on the body
-# the agent wrapped in <draft>. Before the fix the gate hashed the full
-# content (incl. frontmatter), so the body-keyed PASS marker landed at a
-# key the gate never re-read → permanent deny-after-PASS. After the fix the
-# gate strips frontmatter before hashing, so a body-keyed marker permits.
-# ---------------------------------------------------------------------------
-
-@test "P010: changeset Write permits when the PASS marker is keyed on the <draft> body (frontmatter stripped before hash)" {
-  BODY="external-comms gate strips changeset frontmatter before key hash"
-  SURFACE="changeset-author"
-  # Marker keyed on the body the mark-hook helper derives from <draft> — for a
-  # frontmatter-free body the canonical key equals the raw printf-of-body key.
-  KEY=$(printf '%s\n%s' "$BODY" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
-  touch "${RDIR}/external-comms-risk-reviewed-${KEY}"
-
-  # The gate sees the full changeset file: frontmatter + blank line + body.
-  CONTENT=$'---\n"@windyroad/risk-scorer": patch\n---\n\n'"$BODY"
-  INPUT=$(build_write_input ".changeset/p010-fix.md" "$CONTENT")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-# ---------------------------------------------------------------------------
-# P082 Phase 1 — git commit message surface (risk evaluator).
-# Commit messages reach git log / PR commits tab / release notes /
-# CHANGELOG. The risk evaluator gates the body for leak patterns
-# (credentials, prod URLs, business-context-paired financials/user counts)
-# AND defers structured leak-free drafts to the wr-risk-scorer:external-comms
-# subagent. Editor flow (bare `git commit`) is out of scope per P082 SC1.
-# ---------------------------------------------------------------------------
-
-@test "P082: git commit -m with leak-shaped credential body denies via leak pre-filter" {
-  INPUT=$(build_bash_input "git commit -m \"docs: token=${GH_TOKEN_LIKE}\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"git-commit-message"* ]]
-  [[ "$output" == *"GitHub token"* ]] || [[ "$output" == *"credential"* ]]
-}
-
-@test "P082: git commit -m with leak-free body denies and delegates to risk evaluator" {
-  mock_gh_visibility PUBLIC
-  INPUT=$(build_bash_input "git commit -m \"fix(foo): handle null input\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"git-commit-message"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-}
-
-@test "P082: git commit --amend -m is intercepted (P082 SC2)" {
-  mock_gh_visibility PUBLIC
-  INPUT=$(build_bash_input "git commit --amend -m \"rewritten subject\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"git-commit-message"* ]]
-}
-
-@test "P082: git commit HEREDOC body is intercepted and the body becomes the marker key" {
-  # Build a HEREDOC-shaped command. The hook regex pulls the body BETWEEN
-  # the <<'EOF' opener and the closing EOF marker — the extracted DRAFT is
-  # the inner text, NOT the literal `$(cat <<'EOF' ... EOF)` wrapper.
-  mock_gh_visibility PUBLIC
-  BODY=$'feat(foo): add bar\n\nWe observed a build failure on Node 20.'
-  CMD=$'git commit -m "$(cat <<\'EOF\'\n'"$BODY"$'\nEOF\n)"'
-  INPUT=$(build_bash_input "$CMD")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"git-commit-message"* ]]
-
-  # Pre-place the per-evaluator marker keyed on the extracted HEREDOC body
-  # + the git-commit-message surface; the second run must permit silently.
-  SURFACE="git-commit-message"
-  KEY=$(printf '%s\n%s' "$BODY" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
-  touch "${RDIR}/external-comms-risk-reviewed-${KEY}"
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P082: bare git commit (editor flow) is silently allowed per SC1" {
-  # No -m / --message → .git/COMMIT_EDITMSG doesn't exist at PreToolUse
-  # time. Phase 1 skip is pragmatic; the editor flow has user-eyeballs.
-  INPUT=$(build_bash_input "git commit")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P082: git merge is silently allowed (not a git commit verb, SC3)" {
-  INPUT=$(build_bash_input "git merge --no-ff feature-branch")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P082→P377/RFC-029: BYPASS_RISK_GATE=1 is inert — does not short-circuit the gate" {
-  # gh-issue is an unconditionally-gated external surface (no visibility
-  # precondition). Setting BYPASS_RISK_GATE=1 has no effect: the unreviewed
-  # draft still denies, identically to the no-env-var case.
-  INPUT=$(build_bash_input "gh issue create --title T --body 'we observed a build failure on Node 20'")
-  run bash -c "cd '$TEST_PROJECT_DIR' && BYPASS_RISK_GATE=1 printf '%s' \"\$1\" | BYPASS_RISK_GATE=1 '$HOOK'" _ "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
-}
-
-@test "P082: per-evaluator marker keyed on (body, git-commit-message) permits the call" {
-  mock_gh_visibility PUBLIC
-  BODY="docs(retro): close iter 3 ask-hygiene trail"
-  SURFACE="git-commit-message"
-  KEY=$(printf '%s\n%s' "$BODY" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
-  touch "${RDIR}/external-comms-risk-reviewed-${KEY}"
-
-  INPUT=$(build_bash_input "git commit -m \"$BODY\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-# ---------------------------------------------------------------------------
-# P365 — repo-visibility precondition on the git-commit-message surface.
-# A commit message is external-facing prose ONLY when it lands in a PUBLIC
-# GitHub repo (git log / PR commits tab / release notes / CHANGELOG). In
-# private/internal repos — or any repo whose visibility cannot be confirmed
-# PUBLIC — the marker-review delegation deny is a pure false-positive
-# (user direction 2026-06-11: "this MUST NOT fire for private repos"). The
-# precondition silent-passes the marker gate for the git-commit-message
-# surface on any non-PUBLIC / indeterminate gh result. It is scoped to that
-# surface only and runs AFTER the leak pre-filter, so the credential/prod-URL
-# security net survives the short-circuit.
-# ---------------------------------------------------------------------------
-
-@test "P365: git commit -m in a PRIVATE repo silent-passes (no external-comms deny)" {
-  mock_gh_visibility PRIVATE
-  INPUT=$(build_bash_input "git commit -m \"fix(foo): handle null input\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P365: git commit -m in an INTERNAL repo silent-passes" {
-  mock_gh_visibility INTERNAL
-  INPUT=$(build_bash_input "git commit -m \"fix(foo): handle null input\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P365: git commit -m when gh is unavailable/indeterminate silent-passes (fail-non-public)" {
-  mock_gh_visibility FAIL
-  INPUT=$(build_bash_input "git commit -m \"fix(foo): handle null input\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P365: git commit -m in a PUBLIC repo still denies+delegates (gate intact, precondition surface-scoped)" {
-  mock_gh_visibility PUBLIC
-  INPUT=$(build_bash_input "git commit -m \"fix(foo): handle null input\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"git-commit-message"* ]]
-}
-
-@test "P360: empty EXTERNAL_COMMS_SKIP_SURFACES leaves the risk evaluator gating commit messages (divergence guard)" {
-  # The voice-tone evaluator skips git-commit-message (its policy disclaims it);
-  # the risk evaluator's .conf leaves EXTERNAL_COMMS_SKIP_SURFACES empty, so its
-  # leak check on commit bodies stays meaningful. Guards against a regression
-  # that accidentally skips this surface for risk-scorer (e.g. defaulting the
-  # knob non-empty, or syncing voice-tone's value into the shared gate body).
-  grep -qE '^EXTERNAL_COMMS_SKIP_SURFACES=$' "$HOOKS_DIR/external-comms-evaluator.conf"
-  mock_gh_visibility PUBLIC
-  INPUT=$(build_bash_input "git commit -m \"fix(foo): handle null input\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"git-commit-message"* ]]
-}
-
-@test "P365: leak-shaped credential in a PRIVATE-repo commit body still hard-fails (security net survives)" {
-  mock_gh_visibility PRIVATE
-  INPUT=$(build_bash_input "git commit -m \"docs: token=${GH_TOKEN_LIKE}\"")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"git-commit-message"* ]]
-}
-
-@test "P365: PRIVATE visibility does NOT short-circuit the gh-issue surface (still denies+delegates)" {
-  mock_gh_visibility PRIVATE
-  INPUT=$(build_bash_input "gh issue create --title x --body 'a clean issue body'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"gh-issue-create"* ]]
-}
-
-# ---------------------------------------------------------------------------
-# P364 — backtick-bearing double-quoted --body marker-key mismatch.
-# When an outbound body contains markdown backticks (a code span), the
-# orchestrator must backslash-escape them to survive bash double quotes:
-# `gh issue comment 42 --body "Fixed in \`foo\` ..."`. Before the fix the
-# gate extracted the RAW shell-escaped body (literal `\`` with backslash)
-# from the command text, while the PostToolUse mark hook hashed the LOGICAL
-# <draft> body (plain backticks). The two sha256 keys diverged → the PASS
-# marker landed at a key the gate never re-read → permanent deny-after-PASS.
-# After the fix the gate unescapes bash double-quote backslash-escapes on
-# the captured double-quoted body so its DRAFT is byte-equal to the logical
-# reviewed draft and the body-keyed marker permits. DISTINCT from P276 /
-# P010 (whitespace / frontmatter) — this is a shell-escaping-layer fix.
-# ---------------------------------------------------------------------------
-
-@test "P364: backtick-bearing double-quoted --body permits when marker keyed on the unescaped logical body" {
-  # Logical draft body (plain backticks) — what the agent wraps in <draft>
-  # and what the mark hook hashes via compute_external_comms_key.
-  LOGICAL='Fixed in `compute_external_comms_key` per the patch on Node 20.'
-  SURFACE="gh-issue-comment"
-  KEY=$(printf '%s\n%s' "$LOGICAL" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
-  touch "${RDIR}/external-comms-risk-reviewed-${KEY}"
-
-  # The orchestrator backslash-escapes the backticks to survive bash double
-  # quotes — this is the byte-different command text the gate actually sees.
-  CMD='gh issue comment 42 --body "Fixed in \`compute_external_comms_key\` per the patch on Node 20."'
-  INPUT=$(build_bash_input "$CMD")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P364: escaped backslash adjacent to escaped backtick (\\\\\\\`) unescapes to literal backslash + backtick (single left-to-right pass)" {
-  # Adjacency edge case (architect note): \\\` is escaped-backslash THEN
-  # escaped-backtick and must unescape to a literal backslash followed by a
-  # literal backtick — NOT mis-collapsed. The logical body therefore carries
-  # one backslash then one backtick.
-  LOGICAL=$'edge: \\`token here'
-  SURFACE="gh-issue-comment"
-  KEY=$(printf '%s\n%s' "$LOGICAL" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
-  touch "${RDIR}/external-comms-risk-reviewed-${KEY}"
-
-  # Command text carries \\\` (escaped backslash + escaped backtick).
-  CMD='gh issue comment 42 --body "edge: \\\`token here"'
-  INPUT=$(build_bash_input "$CMD")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}
-
-@test "P364: single-quoted --body with literal backticks stays literal (no unescaping applied)" {
-  # Inside single quotes bash does NOT process backslashes or backticks, so
-  # the orchestrator writes plain backticks and the captured body already
-  # equals the logical draft. The fix must NOT alter the single-quote path.
-  LOGICAL='Fixed in `plain_span` here.'
-  SURFACE="gh-issue-comment"
-  KEY=$(printf '%s\n%s' "$LOGICAL" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
-  touch "${RDIR}/external-comms-risk-reviewed-${KEY}"
-
-  INPUT=$(build_bash_input "gh issue comment 42 --body 'Fixed in \`plain_span\` here.'")
-  run_hook "$INPUT"
-  [ "$status" -eq 0 ]
-  [ -z "$output" ]
-}

package/hooks/test/external-comms-key-substance.bats

@@ -1,74 +0,0 @@
-#!/usr/bin/env bats
-# Behavioural tests for compute_external_comms_key substance-aware draft
-# normalization (P276 — external-comms gate marker over-fires on PASS-class
-# content edits).
-#
-# Contract (ADR-009 + ADR-028 amended 2026-06-06, ratified): the marker key
-# must survive TRIVIAL whitespace-class edits to the draft body — interior
-# CRLF/CR line endings and per-line trailing whitespace — so a PASS review
-# does not have to re-fire on a no-op reformat. The conservative boundary is
-# preserved: single-numeral edits and frontmatter-key changes remain
-# SUBSTANTIVE (the key changes → review re-fires) so the leak-detection
-# guarantee is never weakened.
-#
-# These exercise compute_external_comms_key directly (its stdout = the 64-char
-# sha256 key) — behavioural assertions on the function's output, not a
-# structural grep of the source.
-
-setup() {
-  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  # shellcheck source=../lib/external-comms-key.sh
-  source "$HOOKS_DIR/lib/external-comms-key.sh"
-}
-
-# ---------- Trivial edits must NOT change the key (P276) ----------
-
-@test "P276: interior CRLF line endings produce the same key as LF" {
-  lf=$(compute_external_comms_key $'Line one\nLine two\nLine three' 'gh-issue-comment')
-  crlf=$(compute_external_comms_key $'Line one\r\nLine two\r\nLine three' 'gh-issue-comment')
-  [ -n "$lf" ]
-  [ "$lf" = "$crlf" ]
-}
-
-@test "P276: per-line trailing whitespace produces the same key as clean lines" {
-  clean=$(compute_external_comms_key $'Line one\nLine two' 'gh-issue-comment')
-  trailing=$(compute_external_comms_key $'Line one   \nLine two\t' 'gh-issue-comment')
-  [ -n "$clean" ]
-  [ "$clean" = "$trailing" ]
-}
-
-@test "P276: trailing whitespace at end of draft produces the same key (regression guard for prior rstrip)" {
-  clean=$(compute_external_comms_key 'A short draft body' 'gh-issue-comment')
-  trailed=$(compute_external_comms_key $'A short draft body\n\n  ' 'gh-issue-comment')
-  [ "$clean" = "$trailed" ]
-}
-
-# ---------- Conservative boundary: substantive edits MUST change the key ----------
-
-@test "P276 boundary: a single-numeral edit changes the key (review re-fires)" {
-  before=$(compute_external_comms_key 'We support 12 plugins today' 'gh-issue-comment')
-  after=$(compute_external_comms_key 'We support 11 plugins today' 'gh-issue-comment')
-  [ "$before" != "$after" ]
-}
-
-@test "P276 boundary: a word/content edit changes the key (review re-fires)" {
-  before=$(compute_external_comms_key 'The release is ready' 'gh-issue-comment')
-  after=$(compute_external_comms_key 'The release is delayed' 'gh-issue-comment')
-  [ "$before" != "$after" ]
-}
-
-# ---------- Surface binding + changeset frontmatter strip preserved ----------
-
-@test "P276: the surface remains part of the key (same body, different surface → different key)" {
-  a=$(compute_external_comms_key 'Same body text' 'gh-issue-comment')
-  b=$(compute_external_comms_key 'Same body text' 'gh-pr-comment')
-  [ "$a" != "$b" ]
-}
-
-@test "P276: changeset frontmatter strip still holds — full content keys equal the body-only key" {
-  body=$'Add the substance-aware normalization to the external-comms key.'
-  full=$'---\n"@windyroad/risk-scorer": patch\n---\n\n'"$body"
-  body_key=$(compute_external_comms_key "$body" 'changeset-author')
-  full_key=$(compute_external_comms_key "$full" 'changeset-author')
-  [ "$body_key" = "$full_key" ]
-}

package/hooks/test/git-push-gate.bats

@@ -1,82 +0,0 @@
-#!/usr/bin/env bats
-# Tests for git-push-gate.sh — gh pr merge block and release:watch guidance
-
-setup() {
-  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  HOOK="$HOOKS_DIR/git-push-gate.sh"
-
-  TEST_SESSION="bats-push-gate-$$-${BATS_TEST_NUMBER}"
-  # Ensure a clean risk dir
-  RDIR="${TMPDIR:-/tmp}/claude-risk-${TEST_SESSION}"
-  rm -rf "$RDIR"
-  mkdir -p "$RDIR"
-
-  # Create a temp project dir for package.json detection
-  TEST_PROJECT_DIR="$(mktemp -d)"
-}
-
-teardown() {
-  rm -rf "$RDIR"
-  rm -rf "$TEST_PROJECT_DIR"
-}
-
-# Helper: build a PreToolUse Bash input with a given command
-build_input() {
-  local cmd="$1"
-  cat <<ENDJSON
-{
-  "session_id": "$TEST_SESSION",
-  "tool_name": "Bash",
-  "tool_input": {
-    "command": "$cmd"
-  }
-}
-ENDJSON
-}
-
-@test "gh pr merge is blocked with release:watch guidance when script exists" {
-  # Create a package.json with release:watch
-  cat > "$TEST_PROJECT_DIR/package.json" <<'PKG'
-{ "scripts": { "release:watch": "bash scripts/release-watch.sh" } }
-PKG
-
-  INPUT=$(build_input "gh pr merge 4 --merge")
-  run bash -c "cd '$TEST_PROJECT_DIR' && echo '$INPUT' | '$HOOK'"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"permissionDecision"* ]]
-  [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"release:watch"* ]]
-}
-
-@test "gh pr merge tells agent to create release:watch when script missing" {
-  # Create a package.json WITHOUT release:watch
-  cat > "$TEST_PROJECT_DIR/package.json" <<'PKG'
-{ "scripts": { "test": "echo test" } }
-PKG
-
-  INPUT=$(build_input "gh pr merge 4 --merge")
-  run bash -c "cd '$TEST_PROJECT_DIR' && echo '$INPUT' | '$HOOK'"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"permissionDecision"* ]]
-  [[ "$output" == *"deny"* ]]
-  # Should tell agent to create the script
-  [[ "$output" == *"no release:watch script"* ]]
-  [[ "$output" == *"gh pr merge"* ]]
-  [[ "$output" == *"gh run watch"* ]]
-}
-
-@test "gh pr merge tells agent to create release:watch when no package.json" {
-  local empty_dir="$(mktemp -d)"
-
-  INPUT=$(build_input "gh pr merge 4 --merge")
-  run bash -c "cd '$empty_dir' && echo '$INPUT' | '$HOOK'"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"permissionDecision"* ]]
-  [[ "$output" == *"deny"* ]]
-  # Should tell agent to create the script
-  [[ "$output" == *"no release:watch script"* ]]
-  [[ "$output" == *"gh pr merge"* ]]
-  [[ "$output" == *"gh run watch"* ]]
-
-  rm -rf "$empty_dir"
-}