@windyroad/risk-scorer 0.17.4 → 0.18.0

package/hooks/test/pipeline-state-changeset-partition.bats

@@ -1,181 +0,0 @@
-#!/usr/bin/env bats
-# Behavioural coverage for pipeline-state.sh --unreleased changeset partition
-# per P202: a changeset whose introducing commit is already on origin/<base>
-# is awaiting only the release-PR merge to npm and must NOT count as a
-# "pending consumer-facing change" at this commit's surface.
-#
-# Per ADR-052 (behavioural tests default) — fixture seeds two changesets
-# with distinct commit provenance and asserts pipeline-state.sh emits
-# distinct counts so the pipeline.md Layer-1 scoring contract can rely
-# on the partition without re-deriving it.
-
-setup() {
-  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  SCRIPT="$HOOKS_DIR/lib/pipeline-state.sh"
-
-  TEST_DIR="$(mktemp -d)"
-  REMOTE_DIR="$(mktemp -d)"
-
-  (cd "$REMOTE_DIR" && git init --bare --initial-branch=main >/dev/null 2>&1)
-
-  cd "$TEST_DIR"
-  git init --initial-branch=main >/dev/null 2>&1
-  git config user.email "test@example.com"
-  git config user.name "Test"
-  git remote add origin "$REMOTE_DIR"
-
-  echo "initial" > README.md
-  git add README.md
-  git commit -m "initial" >/dev/null 2>&1
-  git push -u origin main >/dev/null 2>&1
-
-  mkdir -p .changeset
-}
-
-teardown() {
-  cd /
-  rm -rf "$TEST_DIR" "$REMOTE_DIR"
-}
-
-# Helper: seed a changeset, commit it, and push to origin (queued state).
-seed_queued_changeset() {
-  local name="$1"
-  cat > ".changeset/${name}.md" <<EOF
----
-"@windyroad/itil": patch
----
-
-${name} changeset body.
-EOF
-  git add ".changeset/${name}.md"
-  git commit -m "add changeset ${name}" >/dev/null 2>&1
-  git push origin main >/dev/null 2>&1
-}
-
-# Helper: seed a changeset and commit it locally without pushing (pending state).
-seed_pending_changeset() {
-  local name="$1"
-  cat > ".changeset/${name}.md" <<EOF
----
-"@windyroad/itil": patch
----
-
-${name} changeset body.
-EOF
-  git add ".changeset/${name}.md"
-  git commit -m "add changeset ${name}" >/dev/null 2>&1
-}
-
-# Helper: seed a changeset file but leave it untracked (uncommitted-pending state).
-seed_untracked_changeset() {
-  local name="$1"
-  cat > ".changeset/${name}.md" <<EOF
----
-"@windyroad/itil": patch
----
-
-${name} changeset body.
-EOF
-}
-
-@test "emits queued+pending breakdown when changesets straddle origin" {
-  cd "$TEST_DIR"
-  seed_queued_changeset queued-one
-  seed_pending_changeset pending-one
-
-  run bash "$SCRIPT" --unreleased
-  [ "$status" -eq 0 ]
-
-  echo "$output" | grep -q "Queued changesets (commits already on origin): 1" || {
-    echo "Missing 'Queued changesets (commits already on origin): 1' line."
-    echo "Output was:"
-    echo "$output"
-    return 1
-  }
-  echo "$output" | grep -q "Pending changesets (commits unpushed): 1" || {
-    echo "Missing 'Pending changesets (commits unpushed): 1' line."
-    echo "Output was:"
-    echo "$output"
-    return 1
-  }
-}
-
-@test "all-on-origin scenario: Queued > 0, Pending = 0" {
-  cd "$TEST_DIR"
-  seed_queued_changeset on-origin-a
-  seed_queued_changeset on-origin-b
-
-  run bash "$SCRIPT" --unreleased
-  [ "$status" -eq 0 ]
-
-  echo "$output" | grep -q "Queued changesets (commits already on origin): 2" || {
-    echo "Missing 'Queued changesets (commits already on origin): 2' line."
-    echo "Output was:"
-    echo "$output"
-    return 1
-  }
-  echo "$output" | grep -q "Pending changesets (commits unpushed): 0" || {
-    echo "Missing 'Pending changesets (commits unpushed): 0' line."
-    echo "Output was:"
-    echo "$output"
-    return 1
-  }
-}
-
-@test "all-local scenario: Pending > 0, Queued = 0" {
-  cd "$TEST_DIR"
-  seed_pending_changeset local-a
-  seed_pending_changeset local-b
-
-  run bash "$SCRIPT" --unreleased
-  [ "$status" -eq 0 ]
-
-  echo "$output" | grep -q "Pending changesets (commits unpushed): 2" || {
-    echo "Missing 'Pending changesets (commits unpushed): 2' line."
-    echo "Output was:"
-    echo "$output"
-    return 1
-  }
-  echo "$output" | grep -q "Queued changesets (commits already on origin): 0" || {
-    echo "Missing 'Queued changesets (commits already on origin): 0' line."
-    echo "Output was:"
-    echo "$output"
-    return 1
-  }
-}
-
-@test "untracked changeset counts as pending" {
-  cd "$TEST_DIR"
-  seed_untracked_changeset draft-one
-
-  run bash "$SCRIPT" --unreleased
-  [ "$status" -eq 0 ]
-
-  echo "$output" | grep -q "Pending changesets (commits unpushed): 1" || {
-    echo "Untracked changeset should count as pending."
-    echo "Output was:"
-    echo "$output"
-    return 1
-  }
-}
-
-@test "no changesets emits no breakdown lines" {
-  cd "$TEST_DIR"
-  # .changeset dir exists but is empty (setup creates it).
-
-  run bash "$SCRIPT" --unreleased
-  [ "$status" -eq 0 ]
-
-  ! echo "$output" | grep -q "Queued changesets" || {
-    echo "Should not emit Queued line when no changesets present."
-    echo "Output was:"
-    echo "$output"
-    return 1
-  }
-  ! echo "$output" | grep -q "Pending changesets" || {
-    echo "Should not emit Pending line when no changesets present."
-    echo "Output was:"
-    echo "$output"
-    return 1
-  }
-}

package/hooks/test/pipeline-state-hash.bats

@@ -1,195 +0,0 @@
-#!/usr/bin/env bats
-# Tests for pipeline-state.sh --hash-inputs stability
-# Covers P054: the hash must be stable across both commit AND push so the
-# release gate does not fire spurious "state drift" denials after a
-# policy-authorised push advances origin/main.
-
-setup() {
-  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  SCRIPT="$HOOKS_DIR/lib/pipeline-state.sh"
-
-  # Set up a temp git repo with an origin remote so origin/main is meaningful.
-  TEST_DIR="$(mktemp -d)"
-  REMOTE_DIR="$(mktemp -d)"
-
-  # Bare remote
-  (cd "$REMOTE_DIR" && git init --bare --initial-branch=main >/dev/null 2>&1)
-
-  # Working repo
-  cd "$TEST_DIR"
-  git init --initial-branch=main >/dev/null 2>&1
-  git config user.email "test@example.com"
-  git config user.name "Test"
-  git remote add origin "$REMOTE_DIR"
-
-  # Seed initial commit
-  echo "initial" > README.md
-  git add README.md
-  git commit -m "initial" >/dev/null 2>&1
-  git push -u origin main >/dev/null 2>&1
-}
-
-teardown() {
-  rm -rf "$TEST_DIR" "$REMOTE_DIR"
-}
-
-# Helper: compute the hash of --hash-inputs output in the current directory.
-compute_hash() {
-  bash "$SCRIPT" --hash-inputs 2>/dev/null | shasum -a 256 | cut -d' ' -f1
-}
-
-@test "hash is stable across git commit of staged changes" {
-  cd "$TEST_DIR"
-
-  echo "line 1" > feature.ts
-  git add feature.ts
-
-  HASH_BEFORE=$(compute_hash)
-
-  git commit -m "add feature" >/dev/null 2>&1
-
-  HASH_AFTER=$(compute_hash)
-
-  [ "$HASH_BEFORE" = "$HASH_AFTER" ] || {
-    echo "Hash changed on commit."
-    echo "before: $HASH_BEFORE"
-    echo "after:  $HASH_AFTER"
-    return 1
-  }
-}
-
-@test "hash is stable across git push (P054 regression guard)" {
-  cd "$TEST_DIR"
-
-  echo "line 1" > feature.ts
-  git add feature.ts
-  git commit -m "add feature" >/dev/null 2>&1
-
-  HASH_BEFORE=$(compute_hash)
-
-  git push origin main >/dev/null 2>&1
-
-  HASH_AFTER=$(compute_hash)
-
-  [ "$HASH_BEFORE" = "$HASH_AFTER" ] || {
-    echo "Hash changed on push — this is the P054 regression."
-    echo "before: $HASH_BEFORE"
-    echo "after:  $HASH_AFTER"
-    return 1
-  }
-}
-
-@test "hash is stable across full commit-then-push sequence" {
-  cd "$TEST_DIR"
-
-  echo "line 1" > feature.ts
-  git add feature.ts
-
-  HASH_STAGED=$(compute_hash)
-
-  git commit -m "add feature" >/dev/null 2>&1
-  HASH_COMMITTED=$(compute_hash)
-
-  git push origin main >/dev/null 2>&1
-  HASH_PUSHED=$(compute_hash)
-
-  [ "$HASH_STAGED" = "$HASH_COMMITTED" ] || {
-    echo "Hash changed on commit step."
-    return 1
-  }
-  [ "$HASH_COMMITTED" = "$HASH_PUSHED" ] || {
-    echo "Hash changed on push step."
-    return 1
-  }
-}
-
-@test "hash changes when a new tracked file is edited" {
-  cd "$TEST_DIR"
-
-  echo "v1" > feature.ts
-  git add feature.ts
-  git commit -m "v1" >/dev/null 2>&1
-  git push origin main >/dev/null 2>&1
-
-  HASH_BEFORE=$(compute_hash)
-
-  echo "v2" > feature.ts
-
-  HASH_AFTER=$(compute_hash)
-
-  [ "$HASH_BEFORE" != "$HASH_AFTER" ] || {
-    echo "Hash did not change on content edit."
-    return 1
-  }
-}
-
-@test "hash changes when a new changeset is added" {
-  cd "$TEST_DIR"
-
-  mkdir -p .changeset
-  HASH_BEFORE=$(compute_hash)
-
-  cat > .changeset/abc.md <<'CS'
----
-"@windyroad/itil": patch
----
-
-Fix something.
-CS
-
-  HASH_AFTER=$(compute_hash)
-
-  [ "$HASH_BEFORE" != "$HASH_AFTER" ] || {
-    echo "Hash did not change on new changeset."
-    return 1
-  }
-}
-
-@test "hash is stable with no upstream remote (works on a fresh repo)" {
-  # Fresh repo with no remote tracking branch.
-  NO_REMOTE_DIR="$(mktemp -d)"
-  cd "$NO_REMOTE_DIR"
-  git init --initial-branch=main >/dev/null 2>&1
-  git config user.email "test@example.com"
-  git config user.name "Test"
-  echo "init" > README.md
-  git add README.md
-  git commit -m "init" >/dev/null 2>&1
-
-  # Should not error out, should emit a hash input
-  run bash "$SCRIPT" --hash-inputs
-  [ "$status" -eq 0 ]
-  [ -n "$output" ]
-
-  # Two consecutive calls should produce the same hash (deterministic)
-  HASH_A=$(compute_hash)
-  HASH_B=$(compute_hash)
-  [ "$HASH_A" = "$HASH_B" ]
-
-  rm -rf "$NO_REMOTE_DIR"
-}
-
-@test "hash is stable with clean working tree (no stash-create content)" {
-  cd "$TEST_DIR"
-  # Working tree is clean after setup's push. Two consecutive calls are stable.
-  HASH_A=$(compute_hash)
-  HASH_B=$(compute_hash)
-  [ "$HASH_A" = "$HASH_B" ] || {
-    echo "Hash is non-deterministic on clean tree."
-    return 1
-  }
-}
-
-@test "hash is stable with dirty working tree (uncommitted edits)" {
-  cd "$TEST_DIR"
-  echo "dirty" > work.txt
-  git add work.txt
-  echo "more dirty" > unstaged.txt
-
-  HASH_A=$(compute_hash)
-  HASH_B=$(compute_hash)
-  [ "$HASH_A" = "$HASH_B" ] || {
-    echo "Hash is non-deterministic on dirty tree."
-    return 1
-  }
-}

package/hooks/test/plan-risk-guidance-once-per-session.bats

@@ -1,95 +0,0 @@
-#!/usr/bin/env bats
-
-# P096 Phase 2: plan-risk-guidance.sh applies once-per-session gating
-# (ADR-038 progressive disclosure pattern) so the advisory body emits
-# in full only on the first EnterPlanMode of a session. Subsequent
-# EnterPlanMode events within the same session emit a terse reminder
-# (≤150 bytes payload after the systemMessage prefix).
-#
-# Reuses the shared session-marker.sh helper synced from
-# packages/shared/hooks/lib/session-marker.sh.
-
-setup() {
-  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
-  HOOK="$REPO_ROOT/packages/risk-scorer/hooks/plan-risk-guidance.sh"
-
-  WORKDIR="$(mktemp -d)"
-  # Minimal RISK-POLICY.md so the appetite extraction has something to read.
-  cat > "$WORKDIR/RISK-POLICY.md" <<'POLICY'
-# Risk Policy
-Threshold: 4
-POLICY
-
-  SID="plan-risk-guidance-test-$$-$RANDOM"
-}
-
-teardown() {
-  rm -f "/tmp/risk-scorer-plan-guidance-announced-${SID}"
-  rm -f "/tmp/risk-scorer-plan-guidance-announced-${SID}-alt"
-  rm -rf "$WORKDIR"
-}
-
-run_hook() {
-  local sid="$1"
-  (cd "$WORKDIR" && \
-    echo "{\"session_id\":\"$sid\",\"tool_name\":\"EnterPlanMode\"}" | \
-    bash "$HOOK")
-}
-
-@test "plan-risk-guidance: first invocation emits the full RELEASE RISK GUIDANCE body" {
-  run run_hook "$SID"
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"RELEASE RISK GUIDANCE FOR PLANNING"* ]]
-  [[ "$output" == *"Release risk:"* ]]
-  [[ "$output" == *"Appetite threshold"* ]]
-  [[ "$output" == *"release strategy"* ]] || [[ "$output" == *"release queue first"* ]]
-}
-
-@test "plan-risk-guidance: first invocation writes the announcement marker" {
-  run_hook "$SID" >/dev/null
-  [ -f "/tmp/risk-scorer-plan-guidance-announced-${SID}" ]
-}
-
-@test "plan-risk-guidance: second invocation in the same session emits a terse reminder" {
-  run_hook "$SID" >/dev/null
-  run run_hook "$SID"
-  [ "$status" -eq 0 ]
-  # Terse reminder MUST carry imperative signal word + gate name + cross-ref.
-  [[ "$output" == *"MANDATORY"* ]] || [[ "$output" == *"REQUIRED"* ]] || [[ "$output" == *"NON-OPTIONAL"* ]]
-  [[ "$output" == *"release-risk gate"* ]] || [[ "$output" == *"risk"* ]]
-  # Must NOT re-emit the full prose (release-strategy listing, projected-risk paragraph).
-  [[ "$output" != *"RELEASE RISK GUIDANCE FOR PLANNING"* ]]
-}
-
-@test "plan-risk-guidance: second invocation reminder payload is ≤300 bytes" {
-  run_hook "$SID" >/dev/null
-  run run_hook "$SID"
-  # Total response is JSON wrapper + systemMessage; reminder body must be
-  # short enough that the full response fits well under the ADR-038 budget.
-  [ "${#output}" -lt 600 ]
-}
-
-@test "plan-risk-guidance: different session_id re-emits the full body" {
-  run_hook "$SID" >/dev/null
-  local SID2="${SID}-alt"
-  run run_hook "$SID2"
-  [[ "$output" == *"RELEASE RISK GUIDANCE FOR PLANNING"* ]]
-  rm -f "/tmp/risk-scorer-plan-guidance-announced-${SID2}"
-}
-
-@test "plan-risk-guidance: empty session_id emits the full body and writes no marker" {
-  run run_hook ""
-  [[ "$output" == *"RELEASE RISK GUIDANCE FOR PLANNING"* ]]
-  # Empty SESSION_ID fallback per shared session-marker contract.
-  [ ! -f "/tmp/risk-scorer-plan-guidance-announced-" ]
-}
-
-@test "plan-risk-guidance: emits valid JSON with permissionDecision allow on both first and subsequent invocations" {
-  run run_hook "$SID"
-  [[ "$output" == *'"permissionDecision": "allow"'* ]]
-  [[ "$output" == *'"hookEventName": "PreToolUse"'* ]]
-
-  run run_hook "$SID"
-  [[ "$output" == *'"permissionDecision": "allow"'* ]]
-  [[ "$output" == *'"hookEventName": "PreToolUse"'* ]]
-}

package/hooks/test/reducing-marker-persistence.bats

@@ -1,236 +0,0 @@
-#!/usr/bin/env bats
-# P192: Risk-reducing/within-appetite bypass markers (`reducing-commit`,
-# `reducing-push`, `reducing-release`) must persist across multiple commits/
-# pushes/releases within the standard TTL window AS LONG AS the pipeline-state
-# hash still matches what was scored — eliminating the per-commit re-mint
-# round-trip that drives the 3+-rescores-per-session friction. Drift or TTL
-# expiry consumes the marker and forces a fresh `wr-risk-scorer:pipeline`
-# rescore. `incident-release` remains single-use (deliberate one-time
-# override).
-#
-# Behavioural contract:
-#   (a) reducing-* marker exists + tree hash matches stored state-hash + TTL
-#       not expired → gate allows AND marker persists (reusable).
-#   (b) reducing-* marker exists + tree hash differs from state-hash → marker
-#       consumed, gate falls through to check_risk_gate (which denies on
-#       drift or missing score).
-#   (c) reducing-* marker exists + TTL expired (relative to marker mtime) →
-#       marker consumed, gate falls through.
-#   (d) incident-release marker stays single-use (unchanged behaviour) —
-#       regression guard.
-#
-# Tests invoke the gate hooks directly (script + stdin JSON), the way the
-# Claude Code hook runtime calls them.
-
-setup() {
-  HOOKS_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
-  COMMIT_GATE="$HOOKS_DIR/risk-score-commit-gate.sh"
-  PUSH_GATE="$HOOKS_DIR/git-push-gate.sh"
-
-  TEST_SESSION="bats-p192-$$-${BATS_TEST_NUMBER}"
-  RDIR="${TMPDIR:-/tmp}/claude-risk-${TEST_SESSION}"
-  rm -rf "$RDIR"
-  mkdir -p "$RDIR"
-
-  # Minimal git repo so pipeline-state.sh --hash-inputs produces a stable
-  # tree hash (git stash create needs a real repo).
-  TMP_REPO="$(mktemp -d)"
-  cd "$TMP_REPO"
-  git init -q -b main
-  git config user.email "test@example.com"
-  git config user.name "Test"
-  cat > RISK-POLICY.md <<EOF
-# Risk Policy
-
-Last reviewed: $(date -u +%Y-%m-%d)
-
-## Risk Appetite
-
-Pipeline gates block when cumulative residual risk exceeds 4.
-EOF
-  git add RISK-POLICY.md
-  git commit -q -m "initial"
-
-  # Default short TTL so we can exercise expiry without slow tests.
-  export RISK_TTL=5
-}
-
-teardown() {
-  rm -rf "$RDIR"
-  rm -rf "$TMP_REPO"
-  unset RISK_TTL 2>/dev/null || true
-}
-
-# Compute the current pipeline-state hash the same way the gate does
-_current_hash() {
-  bash -c "
-    source '$HOOKS_DIR/lib/gate-helpers.sh'
-    '$HOOKS_DIR/lib/pipeline-state.sh' --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1
-  "
-}
-
-# Portable backdate by N seconds
-_backdate() {
-  local file="$1" seconds="$2"
-  local stamp
-  stamp=$(date -v-${seconds}S +%Y%m%d%H%M.%S 2>/dev/null \
-       || date -d "${seconds} seconds ago" +%Y%m%d%H%M.%S 2>/dev/null)
-  touch -t "$stamp" "$file"
-}
-
-invoke_commit_gate() {
-  local cmd="$1"
-  local input
-  input=$(python3 -c "
-import json, sys
-print(json.dumps({
-  'tool_name': 'Bash',
-  'tool_input': {'command': sys.argv[1]},
-  'session_id': sys.argv[2],
-}))
-" "$cmd" "$TEST_SESSION")
-  echo "$input" | bash "$COMMIT_GATE"
-}
-
-invoke_push_gate() {
-  local cmd="$1"
-  local input
-  input=$(python3 -c "
-import json, sys
-print(json.dumps({
-  'tool_name': 'Bash',
-  'tool_input': {'command': sys.argv[1]},
-  'session_id': sys.argv[2],
-}))
-" "$cmd" "$TEST_SESSION")
-  echo "$input" | bash "$PUSH_GATE"
-}
-
-# ---------------------------------------------------------------------------
-# Commit gate — reducing-commit persistence
-# ---------------------------------------------------------------------------
-
-@test "reducing-commit marker persists when tree hash matches stored state-hash" {
-  HASH=$(_current_hash)
-  echo "$HASH" > "$RDIR/state-hash"
-  touch "$RDIR/reducing-commit"
-
-  run invoke_commit_gate 'git commit -m "x"'
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"deny"* ]]
-
-  # Marker MUST still exist after a successful allow — this is the load-
-  # bearing behaviour change.
-  [ -f "$RDIR/reducing-commit" ]
-}
-
-@test "reducing-commit marker survives back-to-back commits (no rescore round-trip)" {
-  HASH=$(_current_hash)
-  echo "$HASH" > "$RDIR/state-hash"
-  touch "$RDIR/reducing-commit"
-
-  # Three sequential allows — current single-use marker consumes on first,
-  # leaving #2 and #3 to fall through to check_risk_gate (which denies on
-  # missing score). New persistent-within-TTL contract: all three pass.
-  run invoke_commit_gate 'git commit -m "1"'; [ "$status" -eq 0 ]; [[ "$output" != *"deny"* ]]
-  run invoke_commit_gate 'git commit -m "2"'; [ "$status" -eq 0 ]; [[ "$output" != *"deny"* ]]
-  run invoke_commit_gate 'git commit -m "3"'; [ "$status" -eq 0 ]; [[ "$output" != *"deny"* ]]
-
-  [ -f "$RDIR/reducing-commit" ]
-}
-
-@test "reducing-commit marker is consumed when tree hash drifts from stored state-hash" {
-  echo "stale-hash-value-from-prior-tree" > "$RDIR/state-hash"
-  touch "$RDIR/reducing-commit"
-
-  run invoke_commit_gate 'git commit -m "x"'
-  # Marker MUST be consumed when drift detected.
-  [ ! -f "$RDIR/reducing-commit" ]
-}
-
-@test "reducing-commit marker is consumed when TTL has expired" {
-  HASH=$(_current_hash)
-  echo "$HASH" > "$RDIR/state-hash"
-  touch "$RDIR/reducing-commit"
-  _backdate "$RDIR/reducing-commit" 10  # TTL is 5
-
-  run invoke_commit_gate 'git commit -m "x"'
-  # TTL-expired marker MUST be consumed and the gate must NOT silently allow
-  # purely on marker presence.
-  [ ! -f "$RDIR/reducing-commit" ]
-}
-
-@test "reducing-commit marker without state-hash file is consumed (no invariance proof)" {
-  rm -f "$RDIR/state-hash"
-  touch "$RDIR/reducing-commit"
-
-  run invoke_commit_gate 'git commit -m "x"'
-  # No way to verify tree-invariance → consume the marker rather than ride it.
-  [ ! -f "$RDIR/reducing-commit" ]
-}
-
-# ---------------------------------------------------------------------------
-# Push gate — reducing-push persistence
-# ---------------------------------------------------------------------------
-
-@test "reducing-push marker persists when tree hash matches stored state-hash" {
-  HASH=$(_current_hash)
-  echo "$HASH" > "$RDIR/state-hash"
-  touch "$RDIR/reducing-push"
-
-  run invoke_push_gate 'npm run push:watch'
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"deny"* ]]
-
-  [ -f "$RDIR/reducing-push" ]
-}
-
-@test "reducing-push marker is consumed when tree hash drifts" {
-  echo "stale-hash" > "$RDIR/state-hash"
-  touch "$RDIR/reducing-push"
-
-  run invoke_push_gate 'npm run push:watch'
-  [ ! -f "$RDIR/reducing-push" ]
-}
-
-# ---------------------------------------------------------------------------
-# Release gate — reducing-release persistence
-# ---------------------------------------------------------------------------
-
-@test "reducing-release marker persists when tree hash matches stored state-hash" {
-  HASH=$(_current_hash)
-  echo "$HASH" > "$RDIR/state-hash"
-  touch "$RDIR/reducing-release"
-
-  run invoke_push_gate 'npm run release:watch'
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"deny"* ]]
-
-  [ -f "$RDIR/reducing-release" ]
-}
-
-@test "reducing-release marker is consumed when tree hash drifts" {
-  echo "stale-hash" > "$RDIR/state-hash"
-  touch "$RDIR/reducing-release"
-
-  run invoke_push_gate 'npm run release:watch'
-  [ ! -f "$RDIR/reducing-release" ]
-}
-
-# ---------------------------------------------------------------------------
-# incident-release — single-use regression guard
-# ---------------------------------------------------------------------------
-
-@test "incident-release marker REMAINS single-use (regression guard)" {
-  HASH=$(_current_hash)
-  echo "$HASH" > "$RDIR/state-hash"
-  touch "$RDIR/incident-release"
-
-  run invoke_push_gate 'npm run release:watch'
-  [ "$status" -eq 0 ]
-  [[ "$output" != *"deny"* ]]
-
-  # incident bypass is a deliberate one-time override — must be consumed
-  # even when tree hash matches.
-  [ ! -f "$RDIR/incident-release" ]
-}