bigpowers 2.86.2 → 2.86.3

package/scripts/run-skill-verify.sh

@@ -25,47 +25,11 @@ SKILLS_ROOT="$REPO_ROOT"
 PASS=0; FAIL=0; SKIP=0
 TARGET="${1:-}"
 
-# A directive is fail-open when it cannot exit non-zero on a broken repo.
-# Two families, both checked syntactically because a pipeline's exit status
-# is the status of its LAST command:
-#   1. explicit swallow  — `|| echo ...`, `|| true`, `|| :`, `; true`, `; exit 0`
-#   2. non-asserting tail — pipeline ends in a filter that always exits 0
-#      (head/wc/cat/tee/sort/tr/sed/awk/echo/true/:). `grep x | wc -l` is the
-#      canonical offender: wc always succeeds, so the grep result is discarded.
-# Use an assertion instead, e.g. [ "$(... | wc -l)" -gt 0 ].
-FAIL_OPEN_TAIL_CMDS='head|wc|cat|tee|sort|tr|sed|awk|echo|true|:'
-
-is_fail_open_directive() {
-  local cmd="$1"
-
-  # Family 1: explicit exit-status swallowing.
-  if echo "$cmd" | grep -qE '\|\|[[:space:]]*(echo|true|:)|;[[:space:]]*(true|:|exit[[:space:]]+0)[[:space:]]*$'; then
-    return 0
-  fi
-
-  # Family 2: pipeline whose last stage never fails.
-  # Strip $(...) first — a pipe inside a command substitution feeds an
-  # assertion, e.g. [ "$(ls x | wc -l)" -gt 0 ], and is NOT fail-open.
-  local stripped="$cmd" prev=""
-  while [ "$stripped" != "$prev" ]; do
-    prev="$stripped"
-    stripped=$(printf '%s' "$stripped" | sed 's/\$([^()]*)/SUBST/g')
-  done
-
-  # Only inspect the segment after the final `|` that is not part of `||`.
-  local tail_seg
-  tail_seg=$(printf '%s' "$stripped" | sed 's/||/\
-/g' | tail -1)
-  case "$tail_seg" in
-    *\|*)
-      tail_seg=${tail_seg##*|}
-      tail_seg=$(printf '%s' "$tail_seg" | sed 's/^[[:space:]]*//')
-      echo "$tail_seg" | grep -qE "^($FAIL_OPEN_TAIL_CMDS)([[:space:]]|$)" && return 0
-      ;;
-  esac
-
-  return 1
-}
+# is_fail_open_directive / is_executable_verify now live in the shared detector,
+# so tier-1 (here) and tier-2 (run-story-verify.sh, #106) reject the same
+# idioms. A new evasion must be closed in one place, not two.
+# shellcheck source=lib/fail-open-detect.sh
+source "$REPO_ROOT/scripts/lib/fail-open-detect.sh"
 
 normalize_verify_cmd() {
   local raw="$1"
@@ -74,11 +38,6 @@ normalize_verify_cmd() {
   echo "$raw"
 }
 
-is_executable_verify() {
-  local cmd="$1"
-  echo "$cmd" | grep -qE '^[a-zA-Z][a-zA-Z0-9_.-]*\b|^\['
-}
-
 run_verify_cmd() {
   local skill="$1"
   local cmd="$2"

package/scripts/run-story-verify.sh

@@ -0,0 +1,208 @@
+#!/usr/bin/env bash
+# story: BUG-2026-07-26-story-verify-never-executed
+# Execute story-level verify: commands declared in specs/epics/*/epic.yaml.
+# Tier 2 of the verify arc (GH #106). Tier 1 is run-skill-verify.sh.
+#
+# Only stories marked `status: done` are gated: a done story asserts its own
+# acceptance criteria hold. Backlog/in-progress stories are reported as SKIP.
+#
+# Usage:
+#   bash scripts/run-story-verify.sh              # gate all done stories
+#   bash scripts/run-story-verify.sh e80s05       # one story
+#   bash scripts/run-story-verify.sh --self-test  # prove the gate can fail
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+# shellcheck source=lib/fail-open-detect.sh
+source "$REPO_ROOT/scripts/lib/fail-open-detect.sh"
+# shellcheck source=lib/python-env.sh
+source "$REPO_ROOT/scripts/lib/python-env.sh"
+resolve_python || exit 1
+
+VERIFY_TIMEOUT_SECONDS=120
+
+# Portable timeout: macOS lacks GNU timeout; use perl alarm as fallback.
+# stdin is closed for every verify command: gate_all reads its record list on
+# fd 0, and a child that reads stdin (any test-*.sh sourcing a read loop) would
+# otherwise swallow the remaining records and silently shrink the gate.
+if command -v timeout >/dev/null 2>&1; then
+  run_with_timeout() { timeout "$VERIFY_TIMEOUT_SECONDS" bash -c "$1" </dev/null 2>&1; }
+elif command -v perl >/dev/null 2>&1; then
+  run_with_timeout() { perl -e "alarm $VERIFY_TIMEOUT_SECONDS; exec @ARGV" bash -c "$1" </dev/null 2>&1; }
+else
+  run_with_timeout() { bash -c "$1" </dev/null 2>&1; }
+fi
+
+GATED_STATUS="done"
+PASS=0; FAIL=0; SKIP=0
+TARGET="${1:-}"
+
+extract_records() {
+  "$PYTHON" "$REPO_ROOT/scripts/lib/extract-story-verify.py" "$REPO_ROOT"
+}
+
+# Report a story whose directive can never fail. Kept separate from execution so
+# a fail-open directive is a FAIL even when the command happens to exit 0.
+reject_fail_open() {
+  local sid="$1" src="$2" cmd="$3"
+  echo "FAIL: $sid [$src] — fail-open directive (cannot exit non-zero): $cmd"
+  FAIL=$((FAIL + 1))
+}
+
+reject_non_executable() {
+  local sid="$1" src="$2" cmd="$3"
+  echo "FAIL: $sid [$src] — verify is prose, not a runnable command: $cmd"
+  FAIL=$((FAIL + 1))
+}
+
+run_story_verify() {
+  local sid="$1" src="$2" cmd="$3"
+
+  if ! is_executable_verify "$cmd"; then
+    reject_non_executable "$sid" "$src" "$cmd"
+    return 1
+  fi
+  if is_fail_open_directive "$cmd"; then
+    reject_fail_open "$sid" "$src" "$cmd"
+    return 1
+  fi
+
+  local output
+  if output=$(run_with_timeout "$cmd"); then
+    echo "PASS: $sid"
+    PASS=$((PASS + 1))
+    return 0
+  fi
+  echo "FAIL: $sid [$src] — $cmd"
+  echo "      output: $(echo "$output" | tail -3 | tr '\n' ' ')"
+  FAIL=$((FAIL + 1))
+  return 1
+}
+
+gate_all() {
+  local sid src status cmd
+  while IFS=$'\t' read -r sid src status cmd; do
+    [ -z "${sid:-}" ] && continue
+    if [ -n "$TARGET" ] && [ "$sid" != "$TARGET" ]; then
+      continue
+    fi
+    if [ -z "$TARGET" ] && [ "$status" != "$GATED_STATUS" ]; then
+      echo "SKIP: $sid (status: $status)"
+      SKIP=$((SKIP + 1))
+      continue
+    fi
+    run_story_verify "$sid" "$src" "$cmd" || true
+  done < <(extract_records)
+}
+
+# Anti-vacuity proof: seed a capsule whose done story must fail, and one that
+# must pass, then require the runner to agree. A gate that cannot fail is the
+# defect this script exists to close (#96/#106) — so it must prove otherwise.
+run_self_test() {
+  echo "=== run-story-verify self-test ==="
+  local tmp_root
+  tmp_root=$(mktemp -d)
+  trap 'rm -rf "$tmp_root"' EXIT
+
+  mkdir -p "$tmp_root/specs/epics/e99-selftest"
+  cat > "$tmp_root/specs/epics/e99-selftest/epic.yaml" <<'YAML'
+id: e99
+title: self-test capsule
+stories:
+  - id: e99s01
+    title: passing story
+    status: done
+    verify: test -d specs
+  - id: e99s02
+    title: failing story
+    status: done
+    verify: test -f /nonexistent/path/for/story-verify-self-test
+  - id: e99s03
+    title: fail-open story
+    status: done
+    verify: test -f /nonexistent || true
+  - id: e99s04
+    title: prose story
+    status: done
+    verify: node bin/bigpowers.js setup (interactive in TTY)
+  - id: e99s05
+    title: backlog story is not gated
+    status: backlog
+    verify: test -f /nonexistent/should/not/run
+YAML
+
+  local records
+  records=$("$PYTHON" "$REPO_ROOT/scripts/lib/extract-story-verify.py" "$tmp_root")
+
+  local checked=0 problems=0
+  local sid src status cmd
+  while IFS=$'\t' read -r sid src status cmd; do
+    [ -z "${sid:-}" ] && continue
+    checked=$((checked + 1))
+    case "$sid" in
+      e99s01)
+        if is_fail_open_directive "$cmd" || ! is_executable_verify "$cmd"; then
+          echo "FAIL: self-test — genuine assertion rejected: $cmd"; problems=$((problems + 1))
+        elif ! run_with_timeout "$cmd" >/dev/null; then
+          echo "FAIL: self-test — passing fixture did not pass"; problems=$((problems + 1))
+        fi
+        ;;
+      e99s02)
+        if run_with_timeout "$cmd" >/dev/null; then
+          echo "FAIL: self-test — failing fixture exited 0 (gate cannot fail)"; problems=$((problems + 1))
+        fi
+        ;;
+      e99s03)
+        if ! is_fail_open_directive "$cmd"; then
+          echo "FAIL: self-test — fail-open directive not detected: $cmd"; problems=$((problems + 1))
+        fi
+        ;;
+      e99s04)
+        if is_executable_verify "$cmd"; then
+          echo "FAIL: self-test — prose accepted as a command: $cmd"; problems=$((problems + 1))
+        fi
+        ;;
+      e99s05)
+        if [ "$status" = "$GATED_STATUS" ]; then
+          echo "FAIL: self-test — backlog story reported as done"; problems=$((problems + 1))
+        fi
+        ;;
+    esac
+  done <<EOF
+$records
+EOF
+
+  rm -rf "$tmp_root"
+  trap - EXIT
+
+  if [ "$checked" -lt 5 ]; then
+    echo "FAIL: self-test — extractor found $checked/5 fixture stories"
+    return 1
+  fi
+  if [ "$problems" -gt 0 ]; then
+    echo "FAIL: self-test — $problems assertion(s) failed"
+    return 1
+  fi
+  echo "PASS: self-test — gate fails on broken stories, passes on sound ones"
+  return 0
+}
+
+if [ "$TARGET" = "--self-test" ]; then
+  run_self_test
+  exit $?
+fi
+
+gate_all
+
+echo ""
+echo "Results: $PASS PASS, $FAIL FAIL, $SKIP SKIP"
+
+if [ -n "$TARGET" ] && [ "$((PASS + FAIL))" -eq 0 ]; then
+  echo "ERROR: no story matching '$TARGET' declares a verify: command" >&2
+  exit 2
+fi
+
+[ "$FAIL" -eq 0 ]

package/scripts/test-adapters.sh

@@ -21,7 +21,6 @@ bash "$SCRIPT_DIR/validate-targets-yaml.sh" >/dev/null
 
 PASS=0
 FAIL=0
-TMPDIR=""
 TA_PASS=0
 TA_FAIL=0
 TA_TMPDIR=""
@@ -56,15 +55,22 @@ test_adapter() {
   if [[ "$has_context" == "true" && "$mode" != "native" ]]; then
     declare -f wire_context >/dev/null 2>&1 && ta_pass "$id: wire_context defined" || ta_fail "$id: wire_context missing"
 
-    TMPDIR=$(mktemp -d)
-    cp "$SCRIPT_DIR/../docs/templates/AGENTS.md" "$TMPDIR/AGENTS.md" 2>/dev/null || echo "# test" > "$TMPDIR/AGENTS.md"
-    (
-      cd "$TMPDIR"
+    TA_TMPDIR=$(mktemp -d)
+    cp "$SCRIPT_DIR/../docs/templates/AGENTS.md" "$TA_TMPDIR/AGENTS.md" 2>/dev/null || echo "# test" > "$TA_TMPDIR/AGENTS.md"
+    # The idempotency probe runs in a subshell (it cd's away), so its ta_pass/
+    # ta_fail would increment counters in a child and be lost — the script used
+    # to print 5 PASS lines and report 4. Capture the status, tally in-process.
+    if (
+      cd "$TA_TMPDIR"
       # shellcheck source=/dev/null
       source "$adapter_file"
-      wire_context 2>/dev/null || true
-      wire_context 2>/dev/null && ta_pass "$id: idempotent wire_context" || ta_fail "$id: wire_context failed"
-    )
+      wire_context >/dev/null 2>&1 || true
+      wire_context >/dev/null 2>&1
+    ); then
+      ta_pass "$id: idempotent wire_context"
+    else
+      ta_fail "$id: wire_context failed"
+    fi
   fi
 }
 

package/scripts/verify-install.sh

@@ -168,7 +168,19 @@ grep -q "'antigravity'" "$REPO_ROOT/bin/setup.js" && grep -q 'SUPPORTED_IDS' "$R
 grep -q "'agy'" "$REPO_ROOT/bin/setup.js" && ta_pass "setup.js: agy supported" || ta_fail "setup.js: agy not in SUPPORTED_IDS"
 grep -q "case 'antigravity'" "$REPO_ROOT/scripts/lib/install-helpers.js" && ta_pass "install-helpers: antigravity case" || ta_fail "install-helpers: missing antigravity case"
 grep -q "case 'agy'" "$REPO_ROOT/scripts/lib/install-helpers.js" && ta_pass "install-helpers: agy case" || ta_fail "install-helpers: missing agy case"
-! install_grep -q '\.gemini/extensions/bigpowers' <<< "$(sed -n '/install_agy/,/^}/p')" && ta_pass "source: agy avoids gemini extension path" || ta_fail "source: agy touches gemini extension path"
+# Scope this to install_agy's OWN body. The previous form piped a herestring into
+# install_grep(), which is `grep "$@" $(install_grep_paths)` — it always greps the
+# install files and ignores stdin, so the assertion actually searched every target.
+# install_gemini/install_claude legitimately use .gemini/extensions/bigpowers
+# (install-targets-a.sh:21,22,70), so the check could never pass. (#106)
+AGY_BODY="$(sed -n '/^install_agy()/,/^}/p' $(install_grep_paths) 2>/dev/null)"
+if [[ -z "$AGY_BODY" ]]; then
+  ta_fail "source: install_agy() body not found — assertion would pass vacuously"
+elif printf '%s' "$AGY_BODY" | grep -q '\.gemini/extensions/bigpowers'; then
+  ta_fail "source: agy touches gemini extension path"
+else
+  ta_pass "source: agy avoids gemini extension path"
+fi
 
 install_grep -q 'install_codex()' && ta_pass "source: install_codex()" || ta_fail "source: missing install_codex()"
 install_grep -q 'uninstall_codex()' && ta_pass "source: uninstall_codex()" || ta_fail "source: missing uninstall_codex()"

package/scripts/wire-ci.sh

@@ -0,0 +1,159 @@
+#!/usr/bin/env bash
+# story: GH-104-forge-neutrality
+# wire-ci.sh — resolve forge + stack and place a CI template, or skip honestly.
+#
+# GH #104: wire-ci declared itself a HARD GATE, then generated GitHub Actions
+# config copied from one person's personal repository. On GitLab it could not
+# work at all. This runner makes the template source configurable and turns an
+# unsupported forge into an explicit skip instead of a false guarantee.
+#
+# Usage:
+#   bash scripts/wire-ci.sh --detect            # report forge + stack, write nothing
+#   bash scripts/wire-ci.sh --plan              # show what would be written
+#   bash scripts/wire-ci.sh --apply             # write the workflow
+#   bash scripts/wire-ci.sh --self-test         # prove skip/apply paths behave
+#
+# Exit codes: 0 applied or cleanly skipped, 1 error, 3 unsupported forge.
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=lib/detect-forge.sh
+source "$REPO_ROOT/scripts/lib/detect-forge.sh"
+
+EXIT_UNSUPPORTED_FORGE=3
+MODE="${1:---detect}"
+TARGET_DIR="${WIRE_CI_TARGET:-$REPO_ROOT}"
+
+detect_stack() {
+  local root="$1"
+  if [[ -f "$root/Cargo.toml" ]]; then echo "rust"
+  elif [[ -f "$root/go.mod" ]]; then echo "go"
+  elif [[ -f "$root/pyproject.toml" || -f "$root/setup.py" ]]; then echo "python"
+  elif [[ -f "$root/package.json" ]]; then echo "node"
+  else echo "unknown"
+  fi
+}
+
+template_for() {
+  local forge="$1" stack="$2"
+  printf '%s/%s/test-build-release-%s.yml' "$(forge_template_root)" "$forge" "$stack"
+}
+
+# The honest-degradation path. An unsupported forge gets a named reason and a
+# non-zero-but-distinct exit code, never a GitHub workflow it cannot run.
+report_unsupported() {
+  local forge="$1"
+  echo "wire-ci: SKIP — no CI templates for forge '$forge'"
+  echo "  Supported: $FORGE_SUPPORTED_LIST"
+  echo "  wire-ci is NOT a hard gate on this forge; it cannot generate config it does not ship."
+  echo "  Options:"
+  echo "    - point at your own templates: BIGPOWERS_CI_TEMPLATES=/path/to/templates"
+  echo "    - pin the forge explicitly:    echo 'forge: github' > specs/forge.yaml"
+  echo "    - write CI by hand for $(forge_ci_path "$forge" || true)"
+}
+
+resolve_and_report() {
+  local root="$1"
+  FORGE=$(detect_forge "$root")
+  STACK=$(detect_stack "$root")
+  echo "wire-ci: forge=$FORGE stack=$STACK"
+
+  if ! forge_is_supported "$FORGE"; then
+    report_unsupported "$FORGE"
+    return "$EXIT_UNSUPPORTED_FORGE"
+  fi
+  if [[ "$STACK" == "unknown" ]]; then
+    echo "wire-ci: SKIP — no recognized manifest (Cargo.toml, go.mod, pyproject.toml, package.json)"
+    return "$EXIT_UNSUPPORTED_FORGE"
+  fi
+
+  TEMPLATE=$(template_for "$FORGE" "$STACK")
+  if [[ ! -f "$TEMPLATE" ]]; then
+    echo "wire-ci: SKIP — no bundled template at $TEMPLATE"
+    return "$EXIT_UNSUPPORTED_FORGE"
+  fi
+  echo "wire-ci: template=$TEMPLATE"
+  return 0
+}
+
+apply_template() {
+  local root="$1"
+  local dest_dir="$root/$(forge_ci_path "$FORGE")"
+  mkdir -p "$dest_dir"
+  cp "$TEMPLATE" "$dest_dir/test-build-release.yml"
+  echo "wire-ci: wrote $dest_dir/test-build-release.yml"
+}
+
+run_self_test() {
+  echo "=== wire-ci self-test ==="
+  local tmp problems=0
+  tmp=$(mktemp -d)
+  trap 'rm -rf "$tmp"' EXIT
+
+  # An unsupported forge must skip, not emit GitHub Actions config.
+  mkdir -p "$tmp/gitlab-project"
+  echo '{}' > "$tmp/gitlab-project/package.json"
+  echo 'forge: gitlab' > /dev/null
+  mkdir -p "$tmp/gitlab-project/specs"
+  printf 'forge: gitlab\n' > "$tmp/gitlab-project/specs/forge.yaml"
+  local out rc
+  out=$(BIGPOWERS_FORGE="" resolve_and_report "$tmp/gitlab-project" 2>&1); rc=$?
+  if [[ "$rc" -ne "$EXIT_UNSUPPORTED_FORGE" ]]; then
+    echo "FAIL: self-test — gitlab project did not skip (rc=$rc)"; problems=$((problems + 1))
+  fi
+  if printf '%s' "$out" | grep -q 'HARD GATE'; then
+    echo "FAIL: self-test — skip path still claims HARD GATE"; problems=$((problems + 1))
+  fi
+  if [[ -d "$tmp/gitlab-project/.github" ]]; then
+    echo "FAIL: self-test — wrote .github/ for a non-GitHub forge"; problems=$((problems + 1))
+  fi
+
+  # A supported forge must resolve to a bundled template — proving the runner
+  # does not depend on any external repository being reachable.
+  mkdir -p "$tmp/gh-project/specs"
+  echo '{}' > "$tmp/gh-project/package.json"
+  printf 'forge: github\n' > "$tmp/gh-project/specs/forge.yaml"
+  if ! out=$(resolve_and_report "$tmp/gh-project" 2>&1); then
+    echo "FAIL: self-test — github/node project did not resolve: $out"; problems=$((problems + 1))
+  elif ! printf '%s' "$out" | grep -q 'test-build-release-node.yml'; then
+    echo "FAIL: self-test — resolved the wrong template: $out"; problems=$((problems + 1))
+  fi
+
+  # The default template root must live inside the package, not in a user's home
+  # and not in the project being wired. Guards the #104 regression directly.
+  local root
+  root=$(forge_template_root)
+  case "$root" in
+    "$REPO_ROOT"/*) : ;;
+    *) echo "FAIL: self-test — default template root escapes the package: $root"; problems=$((problems + 1)) ;;
+  esac
+  if printf '%s' "$root" | grep -q 'danielvm-git\|~/Developer/.github'; then
+    echo "FAIL: self-test — template root still points at a personal repository"; problems=$((problems + 1))
+  fi
+
+  rm -rf "$tmp"
+  trap - EXIT
+
+  if [[ "$problems" -gt 0 ]]; then
+    echo "FAIL: wire-ci self-test — $problems problem(s)"
+    return 1
+  fi
+  echo "PASS: wire-ci self-test — unsupported forges skip, supported forges resolve bundled templates"
+  return 0
+}
+
+case "$MODE" in
+  --self-test) run_self_test; exit $? ;;
+  --detect|--plan)
+    resolve_and_report "$TARGET_DIR"; exit $?
+    ;;
+  --apply)
+    resolve_and_report "$TARGET_DIR" || exit $?
+    apply_template "$TARGET_DIR"
+    ;;
+  *)
+    echo "wire-ci: unknown mode '$MODE' (expected --detect, --plan, --apply, --self-test)" >&2
+    exit 1
+    ;;
+esac

package/skills/wire-ci/REFERENCE.md

@@ -16,19 +16,26 @@
 ### Create CI for a Go project (TBR + optional deploy)
 
 ```bash
-# Copy org templates
-cp ~/Developer/.github/workflow-templates/test-build-release-go.yml .github/workflows/test-build-release.yml
-cp ~/Developer/.github/workflow-templates/deploy-go.yml .github/workflows/deploy.yml
+# Resolve forge + stack, then apply the bundled template
+bash scripts/wire-ci.sh --detect
+bash scripts/wire-ci.sh --apply
 
 wire-ci --validate
 wire-ci --dry-run
 ```
 
+To use your own org templates instead of the bundled ones:
+
+```bash
+BIGPOWERS_CI_TEMPLATES=/path/to/your/templates bash scripts/wire-ci.sh --apply
+```
+
 ### Create CI for a CLI tool (TBR only, no deploy)
 
 ```bash
-cp ~/Developer/.github/workflow-templates/test-build-release-go.yml .github/workflows/test-build-release.yml
+bash scripts/wire-ci.sh --apply
 # Edit release job to download build artifact — see big-release dogfood
+# CLI/library repos: delete deploy.yml; the release job is terminal.
 
 wire-ci --validate
 ```
@@ -172,6 +179,10 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ github.event.workflow_run.id }}
           path: deploy-meta
+      # BigBase-specific composite action, not a bigpowers default: this deploy
+      # example targets the author's own hosting stack. Replace it with your
+      # platform's deploy step (or drop the deploy job entirely for CLI and
+      # library repos). bigpowers itself ships no deploy templates. (GH #104)
       - uses: danielvm-git/.github/actions/bigbase-deploy@9c56ac10c629f3baa110ddb19136579e3c90d690  # v1
         with:
           site_id: ${{ secrets.BIGBASE_SITE_ID }}