@windyroad/risk-scorer 0.7.3-preview.303 → 0.8.0-preview.304

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.7.3",
+  "version": "0.8.0",
   "description": "Pipeline risk scoring, commit/push/release gates for Claude Code"
 }

package/agents/pipeline.md

@@ -261,6 +261,61 @@ The hint is consumed by the calling orchestrator **after** the ADR-042 auto-appl
 
 Do NOT emit `RISK_REGISTER_HINT:` when all cumulative scores are within appetite AND no confidentiality disclosure AND no user-stated-precondition fired. The hint is additive to the existing Below-Appetite Output Rule — a silent pass MUST remain silent. Do not emit an empty `RISK_REGISTER_HINT:` header with no bullets either — omit the block entirely.
 
+## Held-Changeset Graduation Evaluation (ADR-061)
+
+When the pipeline state indicates **within-appetite drain mode** (cumulative push and release residual both ≤ 4/25 per `RISK-POLICY.md`) AND `docs/changesets-holding/` contains entries, evaluate each held changeset against ADR-061 Rule 1's symmetric graduation criterion: **reinstate when `release-risk(pipeline with held changeset hypothetically reinstated) ≤ problem-ticket Priority`**.
+
+This is the symmetric counterpart to ADR-042 Rule 2's move-to-holding contract. Material flows in when release-risk would exceed appetite; material flows out when release-risk falls at or below the originating problem-ticket Priority.
+
+### Mechanism — invoke the deterministic graduation evaluator
+
+The Rule 1a join (changeset → problem ID → ticket Priority) and the Rule 2 VP carve-out detection are deterministic lookups. Invoke the `wr-risk-scorer-evaluate-graduation` shim (ADR-049 `$PATH`-resolved) to read structured candidate lines for each held changeset:
+
+```
+GRADUATION_CANDIDATE: changeset=<filename> | ticket=P<NNN> | priority=<N> | class=3a | status=<resolved|vp-blocked|halt-no-resolution>
+GRADUATION_SUMMARY: total=<N> resolved=<N> vp_blocked=<N> halts=<N>
+```
+
+The script does NOT compute release-risk and does NOT apply Rule 4 evidence-floor judgement — those are LLM-judgement surfaces you own per ADR-015's pure-scorer contract. The script's job is to emit candidates with their joined Priority; your job is to decide whether each candidate's release-risk + evidence-floor profile justifies emitting a `reinstate-from-holding` remediation line.
+
+### Per-candidate evaluation rules
+
+For each `status=resolved` candidate:
+
+1. **Compute release-risk with hypothetical reinstate** (Rule 1) — re-score the current pipeline as if the held changeset were `git mv`'d back to `.changeset/`. Use the same scoring path as ADR-042 Rule 2's re-score; this is your existing pipeline-scoring competence applied to the symmetric hypothesis.
+2. **Compare** — `release-risk ≤ priority` from the candidate line. If false, the held entry stays held — no remediation emitted this cycle.
+3. **Verify Rule 4 evidence floor** — class-specific evidence shape per ADR-061 Rule 4:
+   - **PreToolUse:Bash gates**: ≥ 1 gate-fire log entry per intended trigger surface, with post-fire commit trail showing no false-block.
+   - **UserPromptSubmit detectors**: ≥ 1 detector firing logged to hook stderr or `.afk-run-state/<detector>.log`.
+   - **commit-hook-with-auto-fix**: ≥ 1 auto-fix commit log entry visible via `git log --grep=<hook-marker>` with the diff showing the correct fix shape.
+   - **SessionStart additionalContext hooks**: ≥ 1 session-trail entry showing the injection fired without regression in the immediate-next turn.
+
+   Per ADR-026 cite + persist + uncertainty: the evidence must ground in a re-readable artefact, not a bare count.
+4. **Emit `reinstate-from-holding` remediation** (Rule 5) when the comparison evaluates true AND the evidence floor is met:
+
+   ```
+   RISK_REMEDIATIONS:
+   - R<N> | reinstate-from-holding <changeset-name>: release-risk <release-score>/25 ≤ P<NNN> Priority <priority-value>; class 3a; evidence: <class-specific artefact citation> | S | -<release-score> | docs/changesets-holding/<changeset-name>, .changeset/<changeset-name>
+   ```
+
+   The `description` column (free-form prose per ADR-042 Rule 2a open vocabulary) carries the symmetric-balance verdict, the cited evidence artefact, and the class. The agent consuming this line applies it via `git mv docs/changesets-holding/<name>.md .changeset/<name>.md`.
+
+For each `status=vp-blocked` candidate (Rule 2 carve-out — originating ticket in Verification Pending):
+
+- **DO NOT emit a `reinstate-from-holding` line** for this changeset. ADR-022 establishes the user-owned verify-or-reject decision surface; auto-reinstating short-circuits that surface. The `.verifying.md` → `.closed.md` transition auto-clears the carve-out; the next Step 6.5 graduation pass evaluates the changeset normally.
+
+For each `status=halt-no-resolution` candidate (Rule 1a terminal — no ticket resolved):
+
+- **DO NOT auto-graduate**. Surface the unresolved candidate in your report body under an "Unresolvable graduation candidates" section so the caller (orchestrator) sees the join failure and can present it as a user-decision surface per ADR-013 + ADR-044 framework-resolution boundary. Per ADR-061 Rule 1a, join ambiguity is a user-decision surface, not an agent-decision surface.
+
+### Scope — Phase 2a only
+
+This evaluation surface covers **orthogonal-gate class (3a) only** per ADR-061 Rule 3. Atomic-cohort class (3b — RFC-shaped held changesets that graduate as a single atomic unit per ADR-060 finding 12) requires RFC ticket cohort enumeration and is **deferred to Phase 2b**. When the holding-area contains entries that belong to an RFC cohort, the Phase 2a evaluator emits each entry as an independent 3a candidate; treat such candidates conservatively (the symmetric-balance math is identical but the evaluation unit is wrong) and prefer a `RISK_REGISTER_HINT:` over auto-emitting `reinstate-from-holding` until Phase 2b lands the cohort enumeration.
+
+### Audit trail (Rule 6)
+
+Every emitted `reinstate-from-holding` line MUST cite the resolved problem-ticket ID and Priority value in the description column so the audit trail extends ADR-042 Rule 6. The consuming orchestrator additionally appends to `docs/changesets-holding/README.md` "Recently reinstated" per Rule 6 § 2.
+
 ## Confidential Information Disclosure
 
 Check diffs for business metrics (revenue, user counts, pricing, traffic volumes). Flag as a standalone risk if found.

package/bin/wr-risk-scorer-evaluate-graduation

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+exec "$(dirname "$0")/../scripts/evaluate-graduation.sh" "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.7.3-preview.303",
+  "version": "0.8.0-preview.304",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"

package/scripts/evaluate-graduation.sh

@@ -0,0 +1,231 @@
+#!/usr/bin/env bash
+# packages/risk-scorer/scripts/evaluate-graduation.sh
+#
+# Evaluates held-changeset graduation candidates per ADR-061
+# (Dogfood graduation criteria for held changesets — symmetric risk balance).
+# Phase 2a: orthogonal-gate class only (Class 3a per ADR-061 Rule 3).
+# Atomic-cohort class (3b) requires RFC ticket cohort enumeration and is
+# deferred to Phase 2b per the architect-approved Phase 2a/2b split.
+#
+# This script implements the deterministic Rule 1a join + Rule 2 VP carve-out
+# detection. It does NOT compute release-risk and does NOT apply Rule 4
+# evidence-floor judgement — those are LLM-judgement surfaces owned by the
+# wr-risk-scorer:pipeline agent (per ADR-015 pure-scorer contract).
+#
+# Usage:
+#   evaluate-graduation.sh [<project-root>]
+#
+# Default <project-root> is $(pwd).
+#
+# Behaviour:
+#   - Globs docs/changesets-holding/*.md (excludes README.md).
+#   - For each held changeset, applies Rule 1a join:
+#       1. Filename convention (primary): <package>-p<NNN>-<slug>.md → P<NNN>
+#       2. Body grep fallback (secondary): grep '\bP[0-9]+\b' in changeset body
+#       3. Multi-ticket: max(Priority) across the referenced set
+#   - Resolves the ticket file via dual-tolerant glob (ADR-031 + RFC-002):
+#       docs/problems/<NNN>-*.md (flat) AND docs/problems/*/<NNN>-*.md (per-state)
+#   - Extracts the Priority value from the ticket's `**Priority**: N (...)` line.
+#   - Detects Rule 2 VP carve-out (ticket file ends in .verifying.md).
+#   - Emits one structured candidate line per held changeset to stdout.
+#
+# Stdout format (one candidate per held changeset, agent-parseable):
+#   GRADUATION_CANDIDATE: changeset=<filename> | ticket=P<NNN> | priority=<N> | class=3a | status=<resolved|vp-blocked|halt-no-resolution>
+#
+# Stdout summary line at end:
+#   GRADUATION_SUMMARY: total=<N> resolved=<N> vp_blocked=<N> halts=<N>
+#
+# Exit codes:
+#   0 — script ran to completion (any number of halts is still exit 0;
+#       halts surface via per-candidate status=halt-no-resolution lines so
+#       the agent can present them as Rule 1a halt-and-prompt candidates)
+#   1 — no holding-area or empty holding-area (no-op caller signal)
+#   2 — invalid project root (missing docs/)
+#
+# @adr ADR-061 (graduation criteria — Phase 2a Rule 1a join + Rule 2 VP carve-out)
+# @adr ADR-049 (resolved via bin/wr-risk-scorer-evaluate-graduation shim)
+# @adr ADR-052 (behavioural-fixture coverage at scripts/test/evaluate-graduation.bats)
+# @adr ADR-015 (pure-scorer contract — script does deterministic join only;
+#               agent owns release-risk re-computation + evidence-floor judgement)
+# @adr ADR-031 (dual-tolerant problem-ticket layout per RFC-002 migration window)
+# @problem P162 (Phase 2a)
+
+set -uo pipefail
+
+PROJECT_ROOT="${1:-$(pwd)}"
+HOLDING_DIR="${PROJECT_ROOT}/docs/changesets-holding"
+PROBLEMS_DIR="${PROJECT_ROOT}/docs/problems"
+
+if [ ! -d "${PROJECT_ROOT}/docs" ]; then
+  echo "GRADUATION_ERROR: invalid project root (missing docs/): ${PROJECT_ROOT}" >&2
+  exit 2
+fi
+
+if [ ! -d "$HOLDING_DIR" ]; then
+  echo "GRADUATION_SUMMARY: total=0 resolved=0 vp_blocked=0 halts=0"
+  exit 1
+fi
+
+# Enumerate held changesets (exclude README.md). Use null-delim shape so
+# filenames-with-spaces never break iteration (defensive even though our
+# convention is kebab-case).
+HELD_FILES=()
+while IFS= read -r -d '' f; do
+  base=$(basename "$f")
+  if [ "$base" = "README.md" ]; then
+    continue
+  fi
+  HELD_FILES+=("$f")
+done < <(find "$HOLDING_DIR" -maxdepth 1 -type f -name '*.md' -print0 2>/dev/null)
+
+if [ "${#HELD_FILES[@]}" -eq 0 ]; then
+  echo "GRADUATION_SUMMARY: total=0 resolved=0 vp_blocked=0 halts=0"
+  exit 1
+fi
+
+# Delegate the per-candidate join + VP-check to python for re-readable
+# regex + dual-layout glob handling.
+EVAL_RESULT=$(python3 - "$HOLDING_DIR" "$PROBLEMS_DIR" "${HELD_FILES[@]}" <<'PYEOF'
+import os
+import re
+import sys
+import glob
+
+holding_dir = sys.argv[1]
+problems_dir = sys.argv[2]
+held_files = sys.argv[3:]
+
+FILENAME_TICKET_RE = re.compile(r'-p(\d+)-', re.IGNORECASE)
+BODY_TICKET_RE = re.compile(r'\bP(\d+)\b')
+PRIORITY_LINE_RE = re.compile(r'^\*\*Priority\*\*:\s*(\d+)\b')
+
+
+def find_ticket_file(ticket_id_padded: str):
+    """Dual-tolerant glob per ADR-031 / RFC-002 migration window.
+
+    Returns (path, status_suffix) where status_suffix is one of
+    'open', 'known-error', 'verifying', 'closed', 'parked' or None
+    if no file resolves.
+    """
+    # Per-state subdir layout
+    for state in ('open', 'known-error', 'verifying', 'closed', 'parked'):
+        candidates = glob.glob(os.path.join(problems_dir, state, f'{ticket_id_padded}-*.md'))
+        if candidates:
+            return candidates[0], state
+    # Flat layout
+    for state in ('open', 'known-error', 'verifying', 'closed', 'parked'):
+        candidates = glob.glob(os.path.join(problems_dir, f'{ticket_id_padded}-*.{state}.md'))
+        if candidates:
+            return candidates[0], state
+    return None, None
+
+
+def extract_priority(ticket_path: str):
+    """Read the `**Priority**: N (...)` line and return integer N, or None."""
+    try:
+        with open(ticket_path, 'r', encoding='utf-8') as f:
+            for line in f:
+                m = PRIORITY_LINE_RE.match(line.strip())
+                if m:
+                    return int(m.group(1))
+    except (OSError, IOError):
+        return None
+    return None
+
+
+def resolve_ticket_ids(changeset_path: str):
+    """Apply Rule 1a join: filename convention primary, body-grep fallback.
+
+    Returns a list of zero-padded ticket IDs (e.g. ['085']) referenced by
+    this changeset. Empty list means halt-no-resolution per Rule 1a terminal.
+    """
+    basename = os.path.basename(changeset_path)
+    # Primary: filename convention
+    filename_match = FILENAME_TICKET_RE.search(basename)
+    if filename_match:
+        return [f'{int(filename_match.group(1)):03d}']
+
+    # Fallback: body grep for P\d+ references
+    try:
+        with open(changeset_path, 'r', encoding='utf-8') as f:
+            body = f.read()
+    except (OSError, IOError):
+        return []
+
+    body_matches = BODY_TICKET_RE.findall(body)
+    if not body_matches:
+        return []
+
+    # De-duplicate while preserving order; zero-pad
+    seen = set()
+    ids = []
+    for raw_id in body_matches:
+        padded = f'{int(raw_id):03d}'
+        if padded not in seen:
+            seen.add(padded)
+            ids.append(padded)
+    return ids
+
+
+total = 0
+resolved = 0
+vp_blocked = 0
+halts = 0
+
+for changeset_path in held_files:
+    total += 1
+    basename = os.path.basename(changeset_path)
+    ticket_ids = resolve_ticket_ids(changeset_path)
+
+    if not ticket_ids:
+        # Rule 1a terminal — halt-and-prompt
+        print(f'GRADUATION_CANDIDATE: changeset={basename} | ticket=- | priority=- | class=3a | status=halt-no-resolution')
+        halts += 1
+        continue
+
+    # Resolve each referenced ticket; collect (ticket_id, priority, status_suffix) triples
+    resolutions = []
+    unresolved_ids = []
+    for tid in ticket_ids:
+        path, suffix = find_ticket_file(tid)
+        if path is None:
+            unresolved_ids.append(tid)
+            continue
+        priority = extract_priority(path)
+        if priority is None:
+            unresolved_ids.append(tid)
+            continue
+        resolutions.append((tid, priority, suffix))
+
+    if not resolutions:
+        # All referenced tickets failed to resolve — halt
+        print(f'GRADUATION_CANDIDATE: changeset={basename} | ticket={",".join(f"P{i}" for i in ticket_ids)} | priority=- | class=3a | status=halt-no-resolution')
+        halts += 1
+        continue
+
+    # Rule 1a multi-ticket: max(Priority) across the referenced set
+    # Pick the resolution with the highest priority; report its ticket ID.
+    resolutions.sort(key=lambda r: r[1], reverse=True)
+    chosen_tid, chosen_priority, chosen_suffix = resolutions[0]
+
+    # Rule 2 VP carve-out
+    if chosen_suffix == 'verifying':
+        print(f'GRADUATION_CANDIDATE: changeset={basename} | ticket=P{chosen_tid} | priority={chosen_priority} | class=3a | status=vp-blocked')
+        vp_blocked += 1
+        continue
+
+    print(f'GRADUATION_CANDIDATE: changeset={basename} | ticket=P{chosen_tid} | priority={chosen_priority} | class=3a | status=resolved')
+    resolved += 1
+
+print(f'GRADUATION_SUMMARY: total={total} resolved={resolved} vp_blocked={vp_blocked} halts={halts}')
+PYEOF
+)
+PY_STATUS=$?
+
+echo "$EVAL_RESULT"
+
+if [ "$PY_STATUS" -ne 0 ]; then
+  exit "$PY_STATUS"
+fi
+
+exit 0

package/scripts/test/evaluate-graduation.bats

@@ -0,0 +1,272 @@
+#!/usr/bin/env bats
+# Behavioural-fixture coverage for packages/risk-scorer/scripts/evaluate-graduation.sh
+# per ADR-052 (behavioural tests default) and ADR-061 (dogfood graduation criteria).
+#
+# Phase 2a coverage — orthogonal-gate class (Class 3a) only. Atomic-cohort
+# class (Class 3b — Rule 3b RFC cohort enumeration) is deferred to Phase 2b.
+# Maps to ADR-061 Confirmation criterion 2 items a-f (item g atomic-cohort
+# lands in Phase 2b alongside the RFC enumeration logic).
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
+  SCRIPT="$REPO_ROOT/packages/risk-scorer/scripts/evaluate-graduation.sh"
+  SHIM="$REPO_ROOT/packages/risk-scorer/bin/wr-risk-scorer-evaluate-graduation"
+  WORK_DIR="$(mktemp -d)"
+  cd "$WORK_DIR"
+  # Minimal git setup — fixture follows drain-register-queue.bats precedent
+  # so dual-layout problem-ticket lookup (flat + per-state subdir) exercises
+  # the same shape the script handles in canonical adopter trees.
+  git init --quiet
+  git config user.email "graduation-test@example.com"
+  git config user.name "Graduation Test"
+  git commit --quiet --allow-empty -m "init"
+  mkdir -p docs/changesets-holding docs/problems/open docs/problems/known-error \
+           docs/problems/verifying docs/problems/closed docs/problems/parked
+}
+
+teardown() {
+  cd /
+  rm -rf "$WORK_DIR"
+}
+
+# ----- Helpers -----
+
+seed_problem() {
+  # seed_problem <id-padded> <state> <priority> [<extra-body>]
+  local id="$1" state="$2" priority="$3" extra="${4:-}"
+  local path
+  # Use per-state subdir layout (RFC-002 canonical post-migration shape)
+  path="docs/problems/${state}/${id}-fixture-ticket.md"
+  cat > "$path" <<EOF
+# Problem ${id}: Fixture ticket
+
+**Status**: ${state}
+**Reported**: 2026-05-01
+**Priority**: ${priority} (label) — Impact: 3 x Likelihood: $(( priority / 3 ))
+
+## Description
+
+Fixture body for graduation-evaluator tests.
+
+${extra}
+EOF
+}
+
+seed_problem_flat() {
+  # seed_problem_flat <id-padded> <state> <priority>
+  # Exercises the flat-layout half of the RFC-002 dual-tolerant glob.
+  local id="$1" state="$2" priority="$3"
+  cat > "docs/problems/${id}-fixture-flat.${state}.md" <<EOF
+# Problem ${id}: Fixture flat ticket
+
+**Status**: ${state}
+**Reported**: 2026-05-01
+**Priority**: ${priority} (label) — Impact: 3 x Likelihood: $(( priority / 3 ))
+
+## Description
+
+Flat-layout fixture body for graduation-evaluator tests.
+EOF
+}
+
+seed_changeset() {
+  # seed_changeset <filename> [<body>]
+  local filename="$1" body="${2:-Default fixture changeset body.}"
+  cat > "docs/changesets-holding/${filename}" <<EOF
+---
+'@windyroad/itil': minor
+---
+
+${body}
+EOF
+}
+
+# ----- Smoke tests -----
+
+@test "shim wrapper exists and is executable" {
+  [ -x "$SHIM" ]
+}
+
+@test "shim resolves canonical script (not exit 127)" {
+  # Empty holding-area → exit 1 (no-op caller signal); but not exit 127.
+  run "$SHIM" "$WORK_DIR"
+  [ "$status" -ne 127 ]
+}
+
+@test "missing docs/ → exit 2 (invalid project root)" {
+  cd "$BATS_TEST_TMPDIR"
+  empty_dir=$(mktemp -d)
+  run bash "$SCRIPT" "$empty_dir"
+  [ "$status" -eq 2 ]
+}
+
+@test "missing holding dir → exit 1 (no-op signal)" {
+  rm -rf docs/changesets-holding
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 1 ]
+  echo "$output" | grep -q 'GRADUATION_SUMMARY: total=0'
+}
+
+@test "empty holding dir → exit 1 (no-op signal)" {
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 1 ]
+  echo "$output" | grep -q 'GRADUATION_SUMMARY: total=0'
+}
+
+@test "README.md in holding-area is ignored" {
+  echo "# Holding Area" > docs/changesets-holding/README.md
+  run bash "$SCRIPT" "$WORK_DIR"
+  # No other entries — exit 1 (empty after exclusion)
+  [ "$status" -eq 1 ]
+  echo "$output" | grep -q 'GRADUATION_SUMMARY: total=0'
+}
+
+# ----- ADR-061 Confirmation criterion 2 cases -----
+
+# Case (a) — filename-convention join resolves correctly
+@test "case (a): filename-convention join — wr-itil-p085-...md → P085 → Priority" {
+  seed_problem "085" "open" "9"
+  seed_changeset "wr-itil-p085-assistant-output-gate.md"
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'changeset=wr-itil-p085-assistant-output-gate.md'
+  echo "$output" | grep -q 'ticket=P085'
+  echo "$output" | grep -q 'priority=9'
+  echo "$output" | grep -q 'status=resolved'
+  echo "$output" | grep -q 'class=3a'
+  echo "$output" | grep -q 'GRADUATION_SUMMARY: total=1 resolved=1 vp_blocked=0 halts=0'
+}
+
+# Case (b) — body-grep fallback resolves when filename lacks convention
+@test "case (b): body-grep fallback — non-conventional filename resolves via P<NNN> in body" {
+  seed_problem "100" "known-error" "12"
+  seed_changeset "feature-rollout-cohort.md" "Fixes P100. Related to feature work."
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'changeset=feature-rollout-cohort.md'
+  echo "$output" | grep -q 'ticket=P100'
+  echo "$output" | grep -q 'priority=12'
+  echo "$output" | grep -q 'status=resolved'
+}
+
+# Case (c) — multi-ticket changeset uses max(Priority)
+@test "case (c): multi-ticket changeset uses max(Priority) across referenced set" {
+  seed_problem "200" "open" "6"
+  seed_problem "201" "open" "15"
+  seed_problem "202" "open" "9"
+  seed_changeset "multi-ticket-cohort.md" "References P200, P201, and P202 in body for max-priority test."
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  # Max priority across P200(6) P201(15) P202(9) is 15 → ticket=P201
+  echo "$output" | grep -q 'changeset=multi-ticket-cohort.md'
+  echo "$output" | grep -q 'ticket=P201'
+  echo "$output" | grep -q 'priority=15'
+  echo "$output" | grep -q 'status=resolved'
+}
+
+# Case (d) — halt-and-prompt when no resolution path succeeds
+@test "case (d.1): halt-no-resolution when filename lacks convention AND body has no P<NNN>" {
+  seed_changeset "no-ticket-reference.md" "Body has no problem-ticket references at all."
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'changeset=no-ticket-reference.md'
+  echo "$output" | grep -q 'status=halt-no-resolution'
+  echo "$output" | grep -q 'GRADUATION_SUMMARY: total=1 resolved=0 vp_blocked=0 halts=1'
+}
+
+@test "case (d.2): halt-no-resolution when filename references missing ticket" {
+  # Filename references P999 but ticket file does not exist in fixture
+  seed_changeset "wr-itil-p999-orphan.md"
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'status=halt-no-resolution'
+  echo "$output" | grep -q 'halts=1'
+}
+
+# Case (e) — VP-blocked ticket emitted with vp-blocked marker
+@test "case (e): VP-blocked ticket emits status=vp-blocked (Rule 2 carve-out)" {
+  seed_problem "300" "verifying" "10"
+  seed_changeset "wr-itil-p300-mid-verification.md"
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'changeset=wr-itil-p300-mid-verification.md'
+  echo "$output" | grep -q 'ticket=P300'
+  echo "$output" | grep -q 'priority=10'
+  echo "$output" | grep -q 'status=vp-blocked'
+  echo "$output" | grep -q 'GRADUATION_SUMMARY: total=1 resolved=0 vp_blocked=1 halts=0'
+}
+
+# Case (f) — status-agnostic Priority lookup (open, known-error, closed all resolve)
+@test "case (f.1): open ticket resolves" {
+  seed_problem "400" "open" "8"
+  seed_changeset "wr-itil-p400-open.md"
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'ticket=P400'
+  echo "$output" | grep -q 'status=resolved'
+}
+
+@test "case (f.2): known-error ticket resolves" {
+  seed_problem "401" "known-error" "8"
+  seed_changeset "wr-itil-p401-ke.md"
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'ticket=P401'
+  echo "$output" | grep -q 'status=resolved'
+}
+
+@test "case (f.3): closed ticket resolves (Priority still readable)" {
+  seed_problem "402" "closed" "8"
+  seed_changeset "wr-itil-p402-closed.md"
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'ticket=P402'
+  echo "$output" | grep -q 'status=resolved'
+}
+
+@test "case (f.4): parked ticket resolves" {
+  seed_problem "403" "parked" "8"
+  seed_changeset "wr-itil-p403-parked.md"
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'ticket=P403'
+  echo "$output" | grep -q 'status=resolved'
+}
+
+# Dual-tolerant layout coverage (ADR-031 / RFC-002 migration window)
+@test "flat-layout ticket resolves (RFC-002 pre-migration shape)" {
+  seed_problem_flat "500" "open" "12"
+  seed_changeset "wr-itil-p500-flat-layout.md"
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'ticket=P500'
+  echo "$output" | grep -q 'priority=12'
+  echo "$output" | grep -q 'status=resolved'
+}
+
+# Mixed-state holding-area — multiple changesets in one run
+@test "mixed-state holding-area — resolved + vp-blocked + halt in single run" {
+  seed_problem "600" "open" "9"
+  seed_problem "601" "verifying" "12"
+  seed_problem "602" "open" "6"
+  seed_changeset "wr-itil-p600-resolved.md"
+  seed_changeset "wr-itil-p601-vp.md"
+  seed_changeset "no-resolution-ref.md" "Generic body, no P references."
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  # Counts: 3 total, 1 resolved (P600), 1 vp-blocked (P601), 1 halt
+  echo "$output" | grep -q 'GRADUATION_SUMMARY: total=3 resolved=1 vp_blocked=1 halts=1'
+}
+
+# Filename-convention takes precedence over body-grep when both present
+@test "filename takes precedence over body — wr-itil-p700-fix.md with P800 in body resolves to P700" {
+  seed_problem "700" "open" "5"
+  seed_problem "800" "open" "20"
+  seed_changeset "wr-itil-p700-fix.md" "Also references P800 in body (should be ignored — filename wins)."
+  run bash "$SCRIPT" "$WORK_DIR"
+  [ "$status" -eq 0 ]
+  echo "$output" | grep -q 'ticket=P700'
+  echo "$output" | grep -q 'priority=5'
+  # Confirm body-referenced P800 was NOT picked up
+  ! echo "$output" | grep -q 'ticket=P800'
+}