bigpowers 2.86.1 → 2.86.3

package/scripts/run-skill-verify.sh

@@ -25,47 +25,11 @@ SKILLS_ROOT="$REPO_ROOT"
 PASS=0; FAIL=0; SKIP=0
 TARGET="${1:-}"
 
-# A directive is fail-open when it cannot exit non-zero on a broken repo.
-# Two families, both checked syntactically because a pipeline's exit status
-# is the status of its LAST command:
-#   1. explicit swallow  — `|| echo ...`, `|| true`, `|| :`, `; true`, `; exit 0`
-#   2. non-asserting tail — pipeline ends in a filter that always exits 0
-#      (head/wc/cat/tee/sort/tr/sed/awk/echo/true/:). `grep x | wc -l` is the
-#      canonical offender: wc always succeeds, so the grep result is discarded.
-# Use an assertion instead, e.g. [ "$(... | wc -l)" -gt 0 ].
-FAIL_OPEN_TAIL_CMDS='head|wc|cat|tee|sort|tr|sed|awk|echo|true|:'
-
-is_fail_open_directive() {
-  local cmd="$1"
-
-  # Family 1: explicit exit-status swallowing.
-  if echo "$cmd" | grep -qE '\|\|[[:space:]]*(echo|true|:)|;[[:space:]]*(true|:|exit[[:space:]]+0)[[:space:]]*$'; then
-    return 0
-  fi
-
-  # Family 2: pipeline whose last stage never fails.
-  # Strip $(...) first — a pipe inside a command substitution feeds an
-  # assertion, e.g. [ "$(ls x | wc -l)" -gt 0 ], and is NOT fail-open.
-  local stripped="$cmd" prev=""
-  while [ "$stripped" != "$prev" ]; do
-    prev="$stripped"
-    stripped=$(printf '%s' "$stripped" | sed 's/\$([^()]*)/SUBST/g')
-  done
-
-  # Only inspect the segment after the final `|` that is not part of `||`.
-  local tail_seg
-  tail_seg=$(printf '%s' "$stripped" | sed 's/||/\
-/g' | tail -1)
-  case "$tail_seg" in
-    *\|*)
-      tail_seg=${tail_seg##*|}
-      tail_seg=$(printf '%s' "$tail_seg" | sed 's/^[[:space:]]*//')
-      echo "$tail_seg" | grep -qE "^($FAIL_OPEN_TAIL_CMDS)([[:space:]]|$)" && return 0
-      ;;
-  esac
-
-  return 1
-}
+# is_fail_open_directive / is_executable_verify now live in the shared detector,
+# so tier-1 (here) and tier-2 (run-story-verify.sh, #106) reject the same
+# idioms. A new evasion must be closed in one place, not two.
+# shellcheck source=lib/fail-open-detect.sh
+source "$REPO_ROOT/scripts/lib/fail-open-detect.sh"
 
 normalize_verify_cmd() {
   local raw="$1"
@@ -74,11 +38,6 @@ normalize_verify_cmd() {
   echo "$raw"
 }
 
-is_executable_verify() {
-  local cmd="$1"
-  echo "$cmd" | grep -qE '^[a-zA-Z][a-zA-Z0-9_.-]*\b|^\['
-}
-
 run_verify_cmd() {
   local skill="$1"
   local cmd="$2"

package/scripts/run-story-verify.sh

@@ -0,0 +1,208 @@
+#!/usr/bin/env bash
+# story: BUG-2026-07-26-story-verify-never-executed
+# Execute story-level verify: commands declared in specs/epics/*/epic.yaml.
+# Tier 2 of the verify arc (GH #106). Tier 1 is run-skill-verify.sh.
+#
+# Only stories marked `status: done` are gated: a done story asserts its own
+# acceptance criteria hold. Backlog/in-progress stories are reported as SKIP.
+#
+# Usage:
+#   bash scripts/run-story-verify.sh              # gate all done stories
+#   bash scripts/run-story-verify.sh e80s05       # one story
+#   bash scripts/run-story-verify.sh --self-test  # prove the gate can fail
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+# shellcheck source=lib/fail-open-detect.sh
+source "$REPO_ROOT/scripts/lib/fail-open-detect.sh"
+# shellcheck source=lib/python-env.sh
+source "$REPO_ROOT/scripts/lib/python-env.sh"
+resolve_python || exit 1
+
+VERIFY_TIMEOUT_SECONDS=120
+
+# Portable timeout: macOS lacks GNU timeout; use perl alarm as fallback.
+# stdin is closed for every verify command: gate_all reads its record list on
+# fd 0, and a child that reads stdin (any test-*.sh sourcing a read loop) would
+# otherwise swallow the remaining records and silently shrink the gate.
+if command -v timeout >/dev/null 2>&1; then
+  run_with_timeout() { timeout "$VERIFY_TIMEOUT_SECONDS" bash -c "$1" </dev/null 2>&1; }
+elif command -v perl >/dev/null 2>&1; then
+  run_with_timeout() { perl -e "alarm $VERIFY_TIMEOUT_SECONDS; exec @ARGV" bash -c "$1" </dev/null 2>&1; }
+else
+  run_with_timeout() { bash -c "$1" </dev/null 2>&1; }
+fi
+
+GATED_STATUS="done"
+PASS=0; FAIL=0; SKIP=0
+TARGET="${1:-}"
+
+extract_records() {
+  "$PYTHON" "$REPO_ROOT/scripts/lib/extract-story-verify.py" "$REPO_ROOT"
+}
+
+# Report a story whose directive can never fail. Kept separate from execution so
+# a fail-open directive is a FAIL even when the command happens to exit 0.
+reject_fail_open() {
+  local sid="$1" src="$2" cmd="$3"
+  echo "FAIL: $sid [$src] — fail-open directive (cannot exit non-zero): $cmd"
+  FAIL=$((FAIL + 1))
+}
+
+reject_non_executable() {
+  local sid="$1" src="$2" cmd="$3"
+  echo "FAIL: $sid [$src] — verify is prose, not a runnable command: $cmd"
+  FAIL=$((FAIL + 1))
+}
+
+run_story_verify() {
+  local sid="$1" src="$2" cmd="$3"
+
+  if ! is_executable_verify "$cmd"; then
+    reject_non_executable "$sid" "$src" "$cmd"
+    return 1
+  fi
+  if is_fail_open_directive "$cmd"; then
+    reject_fail_open "$sid" "$src" "$cmd"
+    return 1
+  fi
+
+  local output
+  if output=$(run_with_timeout "$cmd"); then
+    echo "PASS: $sid"
+    PASS=$((PASS + 1))
+    return 0
+  fi
+  echo "FAIL: $sid [$src] — $cmd"
+  echo "      output: $(echo "$output" | tail -3 | tr '\n' ' ')"
+  FAIL=$((FAIL + 1))
+  return 1
+}
+
+gate_all() {
+  local sid src status cmd
+  while IFS=$'\t' read -r sid src status cmd; do
+    [ -z "${sid:-}" ] && continue
+    if [ -n "$TARGET" ] && [ "$sid" != "$TARGET" ]; then
+      continue
+    fi
+    if [ -z "$TARGET" ] && [ "$status" != "$GATED_STATUS" ]; then
+      echo "SKIP: $sid (status: $status)"
+      SKIP=$((SKIP + 1))
+      continue
+    fi
+    run_story_verify "$sid" "$src" "$cmd" || true
+  done < <(extract_records)
+}
+
+# Anti-vacuity proof: seed a capsule whose done story must fail, and one that
+# must pass, then require the runner to agree. A gate that cannot fail is the
+# defect this script exists to close (#96/#106) — so it must prove otherwise.
+run_self_test() {
+  echo "=== run-story-verify self-test ==="
+  local tmp_root
+  tmp_root=$(mktemp -d)
+  trap 'rm -rf "$tmp_root"' EXIT
+
+  mkdir -p "$tmp_root/specs/epics/e99-selftest"
+  cat > "$tmp_root/specs/epics/e99-selftest/epic.yaml" <<'YAML'
+id: e99
+title: self-test capsule
+stories:
+  - id: e99s01
+    title: passing story
+    status: done
+    verify: test -d specs
+  - id: e99s02
+    title: failing story
+    status: done
+    verify: test -f /nonexistent/path/for/story-verify-self-test
+  - id: e99s03
+    title: fail-open story
+    status: done
+    verify: test -f /nonexistent || true
+  - id: e99s04
+    title: prose story
+    status: done
+    verify: node bin/bigpowers.js setup (interactive in TTY)
+  - id: e99s05
+    title: backlog story is not gated
+    status: backlog
+    verify: test -f /nonexistent/should/not/run
+YAML
+
+  local records
+  records=$("$PYTHON" "$REPO_ROOT/scripts/lib/extract-story-verify.py" "$tmp_root")
+
+  local checked=0 problems=0
+  local sid src status cmd
+  while IFS=$'\t' read -r sid src status cmd; do
+    [ -z "${sid:-}" ] && continue
+    checked=$((checked + 1))
+    case "$sid" in
+      e99s01)
+        if is_fail_open_directive "$cmd" || ! is_executable_verify "$cmd"; then
+          echo "FAIL: self-test — genuine assertion rejected: $cmd"; problems=$((problems + 1))
+        elif ! run_with_timeout "$cmd" >/dev/null; then
+          echo "FAIL: self-test — passing fixture did not pass"; problems=$((problems + 1))
+        fi
+        ;;
+      e99s02)
+        if run_with_timeout "$cmd" >/dev/null; then
+          echo "FAIL: self-test — failing fixture exited 0 (gate cannot fail)"; problems=$((problems + 1))
+        fi
+        ;;
+      e99s03)
+        if ! is_fail_open_directive "$cmd"; then
+          echo "FAIL: self-test — fail-open directive not detected: $cmd"; problems=$((problems + 1))
+        fi
+        ;;
+      e99s04)
+        if is_executable_verify "$cmd"; then
+          echo "FAIL: self-test — prose accepted as a command: $cmd"; problems=$((problems + 1))
+        fi
+        ;;
+      e99s05)
+        if [ "$status" = "$GATED_STATUS" ]; then
+          echo "FAIL: self-test — backlog story reported as done"; problems=$((problems + 1))
+        fi
+        ;;
+    esac
+  done <<EOF
+$records
+EOF
+
+  rm -rf "$tmp_root"
+  trap - EXIT
+
+  if [ "$checked" -lt 5 ]; then
+    echo "FAIL: self-test — extractor found $checked/5 fixture stories"
+    return 1
+  fi
+  if [ "$problems" -gt 0 ]; then
+    echo "FAIL: self-test — $problems assertion(s) failed"
+    return 1
+  fi
+  echo "PASS: self-test — gate fails on broken stories, passes on sound ones"
+  return 0
+}
+
+if [ "$TARGET" = "--self-test" ]; then
+  run_self_test
+  exit $?
+fi
+
+gate_all
+
+echo ""
+echo "Results: $PASS PASS, $FAIL FAIL, $SKIP SKIP"
+
+if [ -n "$TARGET" ] && [ "$((PASS + FAIL))" -eq 0 ]; then
+  echo "ERROR: no story matching '$TARGET' declares a verify: command" >&2
+  exit 2
+fi
+
+[ "$FAIL" -eq 0 ]

package/scripts/test-adapters.sh

@@ -21,7 +21,6 @@ bash "$SCRIPT_DIR/validate-targets-yaml.sh" >/dev/null
 
 PASS=0
 FAIL=0
-TMPDIR=""
 TA_PASS=0
 TA_FAIL=0
 TA_TMPDIR=""
@@ -56,15 +55,22 @@ test_adapter() {
   if [[ "$has_context" == "true" && "$mode" != "native" ]]; then
     declare -f wire_context >/dev/null 2>&1 && ta_pass "$id: wire_context defined" || ta_fail "$id: wire_context missing"
 
-    TMPDIR=$(mktemp -d)
-    cp "$SCRIPT_DIR/../docs/templates/AGENTS.md" "$TMPDIR/AGENTS.md" 2>/dev/null || echo "# test" > "$TMPDIR/AGENTS.md"
-    (
-      cd "$TMPDIR"
+    TA_TMPDIR=$(mktemp -d)
+    cp "$SCRIPT_DIR/../docs/templates/AGENTS.md" "$TA_TMPDIR/AGENTS.md" 2>/dev/null || echo "# test" > "$TA_TMPDIR/AGENTS.md"
+    # The idempotency probe runs in a subshell (it cd's away), so its ta_pass/
+    # ta_fail would increment counters in a child and be lost — the script used
+    # to print 5 PASS lines and report 4. Capture the status, tally in-process.
+    if (
+      cd "$TA_TMPDIR"
       # shellcheck source=/dev/null
       source "$adapter_file"
-      wire_context 2>/dev/null || true
-      wire_context 2>/dev/null && ta_pass "$id: idempotent wire_context" || ta_fail "$id: wire_context failed"
-    )
+      wire_context >/dev/null 2>&1 || true
+      wire_context >/dev/null 2>&1
+    ); then
+      ta_pass "$id: idempotent wire_context"
+    else
+      ta_fail "$id: wire_context failed"
+    fi
   fi
 }
 

package/scripts/verify-cwe-fixture-sync.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# story: e80s05
+# Assert security-review's CWE rule table and its fixtures/ directory agree.
+#
+# e80s05 ("security-review fixture table growth") was marked done while the
+# fixtures directory gained a class the table never listed. Remembering to
+# update both is exactly the kind of discipline that decays, so this makes the
+# drift mechanical instead: every fixture class needs a table row, and every
+# table row needs both fixtures on disk.
+#
+# Usage:
+#   bash scripts/verify-cwe-fixture-sync.sh [--self-test]
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SKILL_MD="$REPO_ROOT/skills/security-review/SKILL.md"
+FIXTURES="$REPO_ROOT/skills/security-review/fixtures"
+
+fail=0
+note() { echo "  $1"; }
+
+check_sync() {
+  local skill_md="$1" fixtures="$2"
+  local rc=0
+
+  [ -f "$skill_md" ] || { echo "FAIL: missing $skill_md"; return 1; }
+  [ -d "$fixtures" ] || { echo "FAIL: missing $fixtures"; return 1; }
+
+  # Classes present on disk, derived from the -positive fixture filenames.
+  local disk_classes
+  disk_classes=$(find "$fixtures" -name '*-positive.*' -exec basename {} \; 2>/dev/null \
+    | sed 's/-positive\..*$//' | sort -u)
+
+  # Every disk class must appear in the rule table.
+  local c
+  for c in $disk_classes; do
+    if ! grep -q "$c" "$skill_md"; then
+      note "FAIL: fixture class '$c' has no row in the CWE rule table"
+      rc=1
+    fi
+  done
+
+  # Every fixture referenced by the table must exist, both polarities.
+  local ref
+  for ref in $(grep -oE 'fixtures/[A-Za-z0-9._-]+' "$skill_md" | sed 's|fixtures/||' | sort -u); do
+    if [ ! -f "$fixtures/$ref" ]; then
+      note "FAIL: table references fixtures/$ref which does not exist"
+      rc=1
+    fi
+  done
+
+  for c in $disk_classes; do
+    local pos neg
+    pos=$(find "$fixtures" -name "$c-positive.*" | head -1)
+    neg=$(find "$fixtures" -name "$c-negative.*" | head -1)
+    if [ -z "$pos" ] || [ -z "$neg" ]; then
+      note "FAIL: class '$c' needs BOTH a -positive and a -negative fixture"
+      rc=1
+    fi
+  done
+
+  return $rc
+}
+
+# --self-test proves this gate can fail: point it at a fixtures dir holding a
+# class the table does not list, and require a non-zero exit.
+if [ "${1:-}" = "--self-test" ]; then
+  tmp=$(mktemp -d)
+  trap 'rm -rf "$tmp"' EXIT
+  mkdir -p "$tmp/fixtures"
+  printf '| Rule | CWE | Positive fixture | Negative fixture |\n' > "$tmp/SKILL.md"
+  : > "$tmp/fixtures/CWE-999-unlisted-positive.py"
+  : > "$tmp/fixtures/CWE-999-unlisted-negative.py"
+
+  if check_sync "$tmp/SKILL.md" "$tmp/fixtures" >/dev/null 2>&1; then
+    echo "FAIL: self-test — gate passed on an unlisted fixture class (it cannot fail)"
+    exit 1
+  fi
+  echo "PASS: self-test — gate rejects a fixture class missing from the table"
+  exit 0
+fi
+
+if check_sync "$SKILL_MD" "$FIXTURES"; then
+  echo "PASS: CWE rule table and fixtures/ are in sync"
+  exit 0
+fi
+echo "FAIL: security-review CWE table and fixtures/ have drifted"
+exit 1

package/scripts/verify-install.sh

@@ -168,7 +168,19 @@ grep -q "'antigravity'" "$REPO_ROOT/bin/setup.js" && grep -q 'SUPPORTED_IDS' "$R
 grep -q "'agy'" "$REPO_ROOT/bin/setup.js" && ta_pass "setup.js: agy supported" || ta_fail "setup.js: agy not in SUPPORTED_IDS"
 grep -q "case 'antigravity'" "$REPO_ROOT/scripts/lib/install-helpers.js" && ta_pass "install-helpers: antigravity case" || ta_fail "install-helpers: missing antigravity case"
 grep -q "case 'agy'" "$REPO_ROOT/scripts/lib/install-helpers.js" && ta_pass "install-helpers: agy case" || ta_fail "install-helpers: missing agy case"
-! install_grep -q '\.gemini/extensions/bigpowers' <<< "$(sed -n '/install_agy/,/^}/p')" && ta_pass "source: agy avoids gemini extension path" || ta_fail "source: agy touches gemini extension path"
+# Scope this to install_agy's OWN body. The previous form piped a herestring into
+# install_grep(), which is `grep "$@" $(install_grep_paths)` — it always greps the
+# install files and ignores stdin, so the assertion actually searched every target.
+# install_gemini/install_claude legitimately use .gemini/extensions/bigpowers
+# (install-targets-a.sh:21,22,70), so the check could never pass. (#106)
+AGY_BODY="$(sed -n '/^install_agy()/,/^}/p' $(install_grep_paths) 2>/dev/null)"
+if [[ -z "$AGY_BODY" ]]; then
+  ta_fail "source: install_agy() body not found — assertion would pass vacuously"
+elif printf '%s' "$AGY_BODY" | grep -q '\.gemini/extensions/bigpowers'; then
+  ta_fail "source: agy touches gemini extension path"
+else
+  ta_pass "source: agy avoids gemini extension path"
+fi
 
 install_grep -q 'install_codex()' && ta_pass "source: install_codex()" || ta_fail "source: missing install_codex()"
 install_grep -q 'uninstall_codex()' && ta_pass "source: uninstall_codex()" || ta_fail "source: missing uninstall_codex()"

package/scripts/wire-ci.sh

@@ -0,0 +1,159 @@
+#!/usr/bin/env bash
+# story: GH-104-forge-neutrality
+# wire-ci.sh — resolve forge + stack and place a CI template, or skip honestly.
+#
+# GH #104: wire-ci declared itself a HARD GATE, then generated GitHub Actions
+# config copied from one person's personal repository. On GitLab it could not
+# work at all. This runner makes the template source configurable and turns an
+# unsupported forge into an explicit skip instead of a false guarantee.
+#
+# Usage:
+#   bash scripts/wire-ci.sh --detect            # report forge + stack, write nothing
+#   bash scripts/wire-ci.sh --plan              # show what would be written
+#   bash scripts/wire-ci.sh --apply             # write the workflow
+#   bash scripts/wire-ci.sh --self-test         # prove skip/apply paths behave
+#
+# Exit codes: 0 applied or cleanly skipped, 1 error, 3 unsupported forge.
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=lib/detect-forge.sh
+source "$REPO_ROOT/scripts/lib/detect-forge.sh"
+
+EXIT_UNSUPPORTED_FORGE=3
+MODE="${1:---detect}"
+TARGET_DIR="${WIRE_CI_TARGET:-$REPO_ROOT}"
+
+detect_stack() {
+  local root="$1"
+  if [[ -f "$root/Cargo.toml" ]]; then echo "rust"
+  elif [[ -f "$root/go.mod" ]]; then echo "go"
+  elif [[ -f "$root/pyproject.toml" || -f "$root/setup.py" ]]; then echo "python"
+  elif [[ -f "$root/package.json" ]]; then echo "node"
+  else echo "unknown"
+  fi
+}
+
+template_for() {
+  local forge="$1" stack="$2"
+  printf '%s/%s/test-build-release-%s.yml' "$(forge_template_root)" "$forge" "$stack"
+}
+
+# The honest-degradation path. An unsupported forge gets a named reason and a
+# non-zero-but-distinct exit code, never a GitHub workflow it cannot run.
+report_unsupported() {
+  local forge="$1"
+  echo "wire-ci: SKIP — no CI templates for forge '$forge'"
+  echo "  Supported: $FORGE_SUPPORTED_LIST"
+  echo "  wire-ci is NOT a hard gate on this forge; it cannot generate config it does not ship."
+  echo "  Options:"
+  echo "    - point at your own templates: BIGPOWERS_CI_TEMPLATES=/path/to/templates"
+  echo "    - pin the forge explicitly:    echo 'forge: github' > specs/forge.yaml"
+  echo "    - write CI by hand for $(forge_ci_path "$forge" || true)"
+}
+
+resolve_and_report() {
+  local root="$1"
+  FORGE=$(detect_forge "$root")
+  STACK=$(detect_stack "$root")
+  echo "wire-ci: forge=$FORGE stack=$STACK"
+
+  if ! forge_is_supported "$FORGE"; then
+    report_unsupported "$FORGE"
+    return "$EXIT_UNSUPPORTED_FORGE"
+  fi
+  if [[ "$STACK" == "unknown" ]]; then
+    echo "wire-ci: SKIP — no recognized manifest (Cargo.toml, go.mod, pyproject.toml, package.json)"
+    return "$EXIT_UNSUPPORTED_FORGE"
+  fi
+
+  TEMPLATE=$(template_for "$FORGE" "$STACK")
+  if [[ ! -f "$TEMPLATE" ]]; then
+    echo "wire-ci: SKIP — no bundled template at $TEMPLATE"
+    return "$EXIT_UNSUPPORTED_FORGE"
+  fi
+  echo "wire-ci: template=$TEMPLATE"
+  return 0
+}
+
+apply_template() {
+  local root="$1"
+  local dest_dir="$root/$(forge_ci_path "$FORGE")"
+  mkdir -p "$dest_dir"
+  cp "$TEMPLATE" "$dest_dir/test-build-release.yml"
+  echo "wire-ci: wrote $dest_dir/test-build-release.yml"
+}
+
+run_self_test() {
+  echo "=== wire-ci self-test ==="
+  local tmp problems=0
+  tmp=$(mktemp -d)
+  trap 'rm -rf "$tmp"' EXIT
+
+  # An unsupported forge must skip, not emit GitHub Actions config.
+  mkdir -p "$tmp/gitlab-project"
+  echo '{}' > "$tmp/gitlab-project/package.json"
+  echo 'forge: gitlab' > /dev/null
+  mkdir -p "$tmp/gitlab-project/specs"
+  printf 'forge: gitlab\n' > "$tmp/gitlab-project/specs/forge.yaml"
+  local out rc
+  out=$(BIGPOWERS_FORGE="" resolve_and_report "$tmp/gitlab-project" 2>&1); rc=$?
+  if [[ "$rc" -ne "$EXIT_UNSUPPORTED_FORGE" ]]; then
+    echo "FAIL: self-test — gitlab project did not skip (rc=$rc)"; problems=$((problems + 1))
+  fi
+  if printf '%s' "$out" | grep -q 'HARD GATE'; then
+    echo "FAIL: self-test — skip path still claims HARD GATE"; problems=$((problems + 1))
+  fi
+  if [[ -d "$tmp/gitlab-project/.github" ]]; then
+    echo "FAIL: self-test — wrote .github/ for a non-GitHub forge"; problems=$((problems + 1))
+  fi
+
+  # A supported forge must resolve to a bundled template — proving the runner
+  # does not depend on any external repository being reachable.
+  mkdir -p "$tmp/gh-project/specs"
+  echo '{}' > "$tmp/gh-project/package.json"
+  printf 'forge: github\n' > "$tmp/gh-project/specs/forge.yaml"
+  if ! out=$(resolve_and_report "$tmp/gh-project" 2>&1); then
+    echo "FAIL: self-test — github/node project did not resolve: $out"; problems=$((problems + 1))
+  elif ! printf '%s' "$out" | grep -q 'test-build-release-node.yml'; then
+    echo "FAIL: self-test — resolved the wrong template: $out"; problems=$((problems + 1))
+  fi
+
+  # The default template root must live inside the package, not in a user's home
+  # and not in the project being wired. Guards the #104 regression directly.
+  local root
+  root=$(forge_template_root)
+  case "$root" in
+    "$REPO_ROOT"/*) : ;;
+    *) echo "FAIL: self-test — default template root escapes the package: $root"; problems=$((problems + 1)) ;;
+  esac
+  if printf '%s' "$root" | grep -q 'danielvm-git\|~/Developer/.github'; then
+    echo "FAIL: self-test — template root still points at a personal repository"; problems=$((problems + 1))
+  fi
+
+  rm -rf "$tmp"
+  trap - EXIT
+
+  if [[ "$problems" -gt 0 ]]; then
+    echo "FAIL: wire-ci self-test — $problems problem(s)"
+    return 1
+  fi
+  echo "PASS: wire-ci self-test — unsupported forges skip, supported forges resolve bundled templates"
+  return 0
+}
+
+case "$MODE" in
+  --self-test) run_self_test; exit $? ;;
+  --detect|--plan)
+    resolve_and_report "$TARGET_DIR"; exit $?
+    ;;
+  --apply)
+    resolve_and_report "$TARGET_DIR" || exit $?
+    apply_template "$TARGET_DIR"
+    ;;
+  *)
+    echo "wire-ci: unknown mode '$MODE' (expected --detect, --plan, --apply, --self-test)" >&2
+    exit 1
+    ;;
+esac

package/skills/security-review/SKILL.md

@@ -64,6 +64,8 @@ Every **new detection rule** added to this skill MUST:
 |------|-----|------------------|------------------|
 | SQL injection | CWE-89 | `fixtures/CWE-89-sqli-positive.py` | `fixtures/CWE-89-sqli-negative.py` |
 | XSS (DOM) | CWE-79 | `fixtures/CWE-79-xss-positive.js` | `fixtures/CWE-79-xss-negative.js` |
+| Missing tenant scoping (IDOR) | CWE-639 | `fixtures/CWE-639-idor-positive.go` | `fixtures/CWE-639-idor-negative.go` |
+| Fail-open verify directive | CWE-754 | `fixtures/CWE-fail-open-verify-positive.sh` | `fixtures/CWE-fail-open-verify-negative.sh` |
 
 Before merging a new category, run both fixtures through the detection guidance and confirm positive flags / negative passes.
 
@@ -115,4 +117,4 @@ Each finding: **`File:Line` — Severity — Category**
 
 ## Verify
 
-→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && git rev-parse HEAD >/dev/null 2>&1`
+→ verify: `test -d specs/security && test -f scripts/lib/parallel-review-worktrees.sh && bash scripts/verify-cwe-fixture-sync.sh >/dev/null && git rev-parse HEAD >/dev/null 2>&1`

package/skills/security-review/fixtures/CWE-639-idor-negative.go

@@ -0,0 +1,48 @@
+// story: e80s05
+// Negative fixture: correctly scoped tenant query (must NOT be flagged).
+//
+// The org comes from the authenticated context, never from the request, and it
+// is part of the WHERE clause. A caller from another organization gets zero
+// rows rather than someone else's site.
+//
+// Note the retrofit trap this deliberately avoids: bigbase's BUG-2026-07-24T184443
+// added `org_id INTEGER NOT NULL DEFAULT 0`, which passed tests on new rows and
+// hid 8 of 9 production sites whose legacy rows defaulted to org 0. Scope on a
+// real, backfilled org_id — never a placeholder default.
+package fixtures
+
+import (
+	"database/sql"
+	"net/http"
+)
+
+func orgIDFromContext(r *http.Request) (string, bool) {
+	v, ok := r.Context().Value(ctxOrgID).(string)
+	return v, ok && v != ""
+}
+
+type ctxKey string
+
+const ctxOrgID ctxKey = "org_id"
+
+func handleGetSiteNegative(w http.ResponseWriter, r *http.Request, db *sql.DB) {
+	orgID, ok := orgIDFromContext(r)
+	if !ok {
+		http.Error(w, "forbidden", http.StatusForbidden)
+		return
+	}
+	siteID := r.URL.Query().Get("site_id")
+
+	// SAFE: the tenant predicate is not optional and does not come from input.
+	row := db.QueryRow(
+		`SELECT id, name, domain FROM sites WHERE id = ? AND org_id = ?`,
+		siteID, orgID,
+	)
+
+	var id, name, domain string
+	if err := row.Scan(&id, &name, &domain); err != nil {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+	_, _ = w.Write([]byte(name + " " + domain))
+}

package/skills/security-review/fixtures/CWE-639-idor-positive.go

@@ -0,0 +1,29 @@
+// story: e80s05
+// Positive fixture: IDOR / missing tenant scoping (must be flagged).
+//
+// Modelled on the bigbase family (BUG-129/130/133/135/136/140/143): the
+// handler authenticates the caller, then trusts an ID from the request and
+// queries by that ID alone. Authentication is proven; authorization is not.
+// Nothing in the type system or a diff-scoped review makes this look wrong —
+// the bug is a predicate that was never written.
+package fixtures
+
+import (
+	"database/sql"
+	"net/http"
+)
+
+func handleGetSitePositive(w http.ResponseWriter, r *http.Request, db *sql.DB) {
+	siteID := r.URL.Query().Get("site_id")
+
+	// VULNERABLE: scoped by primary key only. Any authenticated caller from any
+	// organization can read any site by guessing or enumerating site_id.
+	row := db.QueryRow(`SELECT id, name, domain FROM sites WHERE id = ?`, siteID)
+
+	var id, name, domain string
+	if err := row.Scan(&id, &name, &domain); err != nil {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+	_, _ = w.Write([]byte(name + " " + domain))
+}