bigpowers 2.86.1 → 2.86.2

package/.agents/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.agents/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.codebuddy/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.codebuddy/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.codex/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.codex/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.hermes/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.hermes/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.kilocode/rules/security-review.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.kilocode/rules/smoke-test.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.mimocode/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.mimocode/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.86.1",
+  "version": "2.86.2",
   "description": "80 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/.pi/prompts/security-review.md

@@ -57,6 +57,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -108,7 +110,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.pi/prompts/smoke-test.md

@@ -77,7 +77,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.pi/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.pi/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.trae/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.trae/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.windsurf/rules/security-review.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.windsurf/rules/smoke-test.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/.zcode/skills/security-review/SKILL.md

@@ -58,6 +58,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -109,7 +111,7 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`
 
 ---
 

package/.zcode/skills/smoke-test/SKILL.md

@@ -78,7 +78,7 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`
 
 ---
 

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [2.86.2](https://github.com/danielvm-git/bigpowers/compare/v2.86.1...v2.86.2) (2026-07-26)
+
+
+### Bug Fixes
+
+* **verify:** repair two gates that could not fail ([#97](https://github.com/danielvm-git/bigpowers/issues/97), [#98](https://github.com/danielvm-git/bigpowers/issues/98)) ([5f54699](https://github.com/danielvm-git/bigpowers/commit/5f54699f11875da2db1bae939f313d69c2fa7adf))
+
 ## [2.86.1](https://github.com/danielvm-git/bigpowers/compare/v2.86.0...v2.86.1) (2026-07-26)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.86.1",
+  "version": "2.86.2",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/verify-cwe-fixture-sync.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# story: e80s05
+# Assert security-review's CWE rule table and its fixtures/ directory agree.
+#
+# e80s05 ("security-review fixture table growth") was marked done while the
+# fixtures directory gained a class the table never listed. Remembering to
+# update both is exactly the kind of discipline that decays, so this makes the
+# drift mechanical instead: every fixture class needs a table row, and every
+# table row needs both fixtures on disk.
+#
+# Usage:
+#   bash scripts/verify-cwe-fixture-sync.sh [--self-test]
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SKILL_MD="$REPO_ROOT/skills/security-review/SKILL.md"
+FIXTURES="$REPO_ROOT/skills/security-review/fixtures"
+
+fail=0
+note() { echo "  $1"; }
+
+check_sync() {
+  local skill_md="$1" fixtures="$2"
+  local rc=0
+
+  [ -f "$skill_md" ] || { echo "FAIL: missing $skill_md"; return 1; }
+  [ -d "$fixtures" ] || { echo "FAIL: missing $fixtures"; return 1; }
+
+  # Classes present on disk, derived from the -positive fixture filenames.
+  local disk_classes
+  disk_classes=$(find "$fixtures" -name '*-positive.*' -exec basename {} \; 2>/dev/null \
+    | sed 's/-positive\..*$//' | sort -u)
+
+  # Every disk class must appear in the rule table.
+  local c
+  for c in $disk_classes; do
+    if ! grep -q "$c" "$skill_md"; then
+      note "FAIL: fixture class '$c' has no row in the CWE rule table"
+      rc=1
+    fi
+  done
+
+  # Every fixture referenced by the table must exist, both polarities.
+  local ref
+  for ref in $(grep -oE 'fixtures/[A-Za-z0-9._-]+' "$skill_md" | sed 's|fixtures/||' | sort -u); do
+    if [ ! -f "$fixtures/$ref" ]; then
+      note "FAIL: table references fixtures/$ref which does not exist"
+      rc=1
+    fi
+  done
+
+  for c in $disk_classes; do
+    local pos neg
+    pos=$(find "$fixtures" -name "$c-positive.*" | head -1)
+    neg=$(find "$fixtures" -name "$c-negative.*" | head -1)
+    if [ -z "$pos" ] || [ -z "$neg" ]; then
+      note "FAIL: class '$c' needs BOTH a -positive and a -negative fixture"
+      rc=1
+    fi
+  done
+
+  return $rc
+}
+
+# --self-test proves this gate can fail: point it at a fixtures dir holding a
+# class the table does not list, and require a non-zero exit.
+if [ "${1:-}" = "--self-test" ]; then
+  tmp=$(mktemp -d)
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/fixtures"
+  printf '| Rule | CWE | Positive fixture | Negative fixture |\n' > "$tmp/SKILL.md"
+  : > "$tmp/fixtures/CWE-999-unlisted-positive.py"
+  : > "$tmp/fixtures/CWE-999-unlisted-negative.py"
+
+  if check_sync "$tmp/SKILL.md" "$tmp/fixtures" >/dev/null 2>&1; then
+    echo "FAIL: self-test — gate passed on an unlisted fixture class (it cannot fail)"
+    exit 1
+  fi
+  echo "PASS: self-test — gate rejects a fixture class missing from the table"
+  exit 0
+fi
+
+if check_sync "$SKILL_MD" "$FIXTURES"; then
+  echo "PASS: CWE rule table and fixtures/ are in sync"
+  exit 0
+fi
+echo "FAIL: security-review CWE table and fixtures/ have drifted"
+exit 1

package/skills/security-review/SKILL.md

@@ -64,6 +64,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -115,4 +117,4 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`

package/skills/security-review/fixtures/CWE-639-idor-negative.go

@@ -0,0 +1,48 @@
+// story: e80s05
+// Negative fixture: correctly scoped tenant query (must NOT be flagged).
+//
+// The org comes from the authenticated context, never from the request, and it
+// is part of the WHERE clause. A caller from another organization gets zero
+// rows rather than someone else's site.
+//
+// Note the retrofit trap this deliberately avoids: bigbase's BUG-2026-07-24T184443
+// added `org_id INTEGER NOT NULL DEFAULT 0`, which passed tests on new rows and
+// hid 8 of 9 production sites whose legacy rows defaulted to org 0. Scope on a
+// real, backfilled org_id — never a placeholder default.
+package fixtures
+
+import (
+	"database/sql"
+	"net/http"
+)
+
+func orgIDFromContext(r *http.Request) (string, bool) {
+	v, ok := r.Context().Value(ctxOrgID).(string)
+	return v, ok && v != ""
+}
+
+type ctxKey string
+
+const ctxOrgID ctxKey = "org_id"
+
+func handleGetSiteNegative(w http.ResponseWriter, r *http.Request, db *sql.DB) {
+	orgID, ok := orgIDFromContext(r)
+	if !ok {
+		http.Error(w, "forbidden", http.StatusForbidden)
+		return
+	}
+	siteID := r.URL.Query().Get("site_id")
+
+	// SAFE: the tenant predicate is not optional and does not come from input.
+	row := db.QueryRow(
+		`SELECT id, name, domain FROM sites WHERE id = ? AND org_id = ?`,
+		siteID, orgID,
+	)
+
+	var id, name, domain string
+	if err := row.Scan(&id, &name, &domain); err != nil {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+	_, _ = w.Write([]byte(name + " " + domain))
+}

package/skills/security-review/fixtures/CWE-639-idor-positive.go

@@ -0,0 +1,29 @@
+// story: e80s05
+// Positive fixture: IDOR / missing tenant scoping (must be flagged).
+//
+// Modelled on the bigbase family (BUG-129/130/133/135/136/140/143): the
+// handler authenticates the caller, then trusts an ID from the request and
+// queries by that ID alone. Authentication is proven; authorization is not.
+// Nothing in the type system or a diff-scoped review makes this look wrong —
+// the bug is a predicate that was never written.
+package fixtures
+
+import (
+	"database/sql"
+	"net/http"
+)
+
+func handleGetSitePositive(w http.ResponseWriter, r *http.Request, db *sql.DB) {
+	siteID := r.URL.Query().Get("site_id")
+
+	// VULNERABLE: scoped by primary key only. Any authenticated caller from any
+	// organization can read any site by guessing or enumerating site_id.
+	row := db.QueryRow(`SELECT id, name, domain FROM sites WHERE id = ?`, siteID)
+
+	var id, name, domain string
+	if err := row.Scan(&id, &name, &domain); err != nil {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+	_, _ = w.Write([]byte(name + " " + domain))
+}

package/skills/smoke-test/SKILL.md

@@ -81,4 +81,4 @@ Part of **★ VERIFY ★**: `verify-work` → `validate-contracts` → `smoke-te
 
 ## Verify
 
-→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && grep -qv 'See \[REFERENCE.md\]' skills/smoke-test/SKILL.md && echo OK`
+→ verify: `test -x scripts/run-smoke.sh && grep -q 'run-smoke.sh' skills/smoke-test/SKILL.md && ! grep -q 'See \[REFERENCE.md\](REFERENCE.md)$' skills/smoke-test/SKILL.md && echo OK`

package/skills-lock.json

@@ -303,7 +303,7 @@
     },
     "security-review": {
       "description": ">",
-      "sha256": "0265010d9bd22e27",
+      "sha256": "3d046f443689fc1e",
       "path": "skills/security-reviewSKILL.md"
     },
     "seed-conventions": {
@@ -333,7 +333,7 @@
     },
     "smoke-test": {
       "description": "\"Post-deploy health-check against a live URL. Validates HTTP status, response content, and critical endpoints. Runnable standalone OR as the final step of the deploy skill.\"",
-      "sha256": "f75e9e57d4003209",
+      "sha256": "050170d66ada581e",
       "path": "skills/smoke-testSKILL.md"
     },
     "spike-prototype": {