bigpowers 2.86.5 → 2.86.6

package/scripts/generate-workflow-diagrams.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# story: e37s05
+# generate-workflow-diagrams.sh — render docs/WORKFLOWS.md from specs/workflows/*.yaml.
+#
+# specs/assets/bigpowers-workflow.svg was a find-and-replace of a BMad Method
+# chart with bigpowers skill names dropped into BMad's slots. Nothing regenerated
+# it, so it drifted: it routed PLAN through define-success (archived), placed
+# seed-conventions in PHASE 4 when it is the greenfield entry point, omitted the
+# whole planning spine, build-epic and the entire verify/release arc, and used
+# "Sprints" — a word absent from every bigpowers doctrine file.
+#
+# A diagram nothing regenerates is a diagram that lies. This derives the chains
+# from the same YAML the /slash commands read, so the source cannot drift from
+# the picture without the picture changing.
+#
+# Usage: bash scripts/generate-workflow-diagrams.sh [--check]
+#   --check  fail if the committed output is stale (for CI)
+
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/python-env.sh"
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+
+OUT="docs/WORKFLOWS.md"
+CHECK=0
+[[ "${1:-}" == "--check" ]] && CHECK=1
+
+TMP=$(mktemp)
+trap 'rm -f "$TMP"' EXIT
+
+$PYTHON - "$TMP" <<'PY'
+import sys, glob, os
+import yaml
+
+out = open(sys.argv[1], "w", encoding="utf-8")
+w = out.write
+
+w("# bigpowers Workflows\n\n")
+w("<!-- story: e37s05 -->\n\n")
+w("> **Generated** by `scripts/generate-workflow-diagrams.sh` from\n")
+w("> `specs/workflows/*.yaml`. Do not hand-edit — change the YAML and re-run.\n")
+w("> CI enforces freshness via `--check`.\n\n")
+w("Each recipe below is a composed chain of skills, invocable as a slash command.\n\n")
+
+recipes = []
+for path in sorted(glob.glob("specs/workflows/*.yaml")):
+    d = yaml.safe_load(open(path, encoding="utf-8")) or {}
+    if d.get("name") and d.get("skills"):
+        recipes.append(d)
+
+w("## Recipes\n\n")
+w("| Command | Chain | Purpose |\n|---|---|---|\n")
+for r in recipes:
+    chain = " → ".join("`%s`" % s for s in r["skills"])
+    desc = (r.get("description") or "").replace("|", "\\|").strip()
+    w("| `%s` | %s | %s |\n" % (r.get("command", "/" + r["name"]), chain, desc))
+w("\n")
+
+w("## Chains\n\n```mermaid\nflowchart LR\n")
+for i, r in enumerate(recipes):
+    w("  subgraph %s[\"%s\"]\n" % ("w%d" % i, r.get("command", r["name"])))
+    prev = None
+    for j, s in enumerate(r["skills"]):
+        node = "n%d_%d" % (i, j)
+        w("    %s[\"%s\"]\n" % (node, s))
+        if prev:
+            w("    %s --> %s\n" % (prev, node))
+        prev = node
+    w("  end\n")
+w("```\n\n")
+
+# Skill reuse across recipes is the interesting structural fact: it shows which
+# skills are load-bearing across the catalog.
+counts = {}
+for r in recipes:
+    for s in r["skills"]:
+        counts[s] = counts.get(s, 0) + 1
+shared = sorted([(v, k) for k, v in counts.items() if v > 1], reverse=True)
+if shared:
+    w("## Skills shared across recipes\n\n")
+    w("| Skill | Recipes |\n|---|---|\n")
+    for v, k in shared:
+        w("| `%s` | %d |\n" % (k, v))
+    w("\n")
+
+w("_%d recipes, %d distinct skills._\n" % (len(recipes), len(counts)))
+out.close()
+PY
+
+if [[ "$CHECK" -eq 1 ]]; then
+  if [[ ! -f "$OUT" ]] || ! diff -q "$TMP" "$OUT" >/dev/null 2>&1; then
+    echo "generate-workflow-diagrams: $OUT is stale — run bash scripts/generate-workflow-diagrams.sh" >&2
+    exit 1
+  fi
+  echo "generate-workflow-diagrams: $OUT is current"
+  exit 0
+fi
+
+mkdir -p "$(dirname "$OUT")"
+cp "$TMP" "$OUT"
+echo "generate-workflow-diagrams: wrote $OUT"

package/scripts/golden-g13-test-orphans.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# story: e37s05
+# golden-g13-test-orphans.sh — every scripts/test-*.sh must be wired into a gate.
+#
+# Before this gate, 33 of 35 test scripts were reachable from nothing: not CI,
+# not Preflight, not package.json, not another script. Writing a test was not
+# enough to make it run, so tests accumulated as dead weight and regressions
+# they would have caught shipped anyway (test-adapters.sh silently exercised 1
+# of 21 adapters for months).
+#
+# Usage: bash scripts/golden-g13-test-orphans.sh [--self-test]
+# Exit 0: every test script is referenced by the gate list
+# Exit 1: at least one orphan (or, under --self-test, the gate failed to notice
+#         a deliberately unlisted script)
+
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+GATES_FILE="scripts/lib/golden-suite-gates.sh"
+
+find_orphans() { # $1 = extra script basename to consider (may be empty)
+  local extra="${1:-}"
+  local orphans=""
+  local f b
+  for f in scripts/test-*.sh; do
+    [[ -e "$f" ]] || continue
+    b="$(basename "$f")"
+    grep -q "$b" "$GATES_FILE" || orphans+="  $b"$'\n'
+  done
+  if [[ -n "$extra" ]]; then
+    grep -q "$extra" "$GATES_FILE" || orphans+="  $extra"$'\n'
+  fi
+  printf '%s' "$orphans"
+}
+
+if [[ "${1:-}" == "--self-test" ]]; then
+  echo "=== G-13 self-test: prove the gate can fail ==="
+  # A name that is definitely not in the gate list must be reported.
+  if [[ -n "$(find_orphans "test-definitely-not-wired.sh")" ]]; then
+    echo -e "${GREEN}PASS${NC} G-13 reports an unlisted test script"
+    echo "G-13 self-test: PASS"
+    exit 0
+  fi
+  echo -e "${RED}FAIL${NC} G-13 did not report an unlisted script — vacuous gate"
+  echo "G-13 self-test: FAIL"
+  exit 1
+fi
+
+echo "=== G-13: test-script orphan check ==="
+ORPHANS="$(find_orphans "")"
+TOTAL=$(ls scripts/test-*.sh 2>/dev/null | wc -l | tr -d ' ')
+
+if [[ -z "$ORPHANS" ]]; then
+  echo "  ok  : all $TOTAL test script(s) are wired into $GATES_FILE"
+  echo -e "${GREEN}PASS${NC}"
+  echo "G-13: PASS"
+  exit 0
+fi
+
+echo "  orphaned test scripts (present but reachable from no gate):"
+printf '%s' "$ORPHANS"
+echo -e "${RED}FAIL${NC} add them to GOLDEN_GATES in $GATES_FILE, or delete them"
+echo "G-13: FAIL"
+exit 1

package/scripts/golden-g14-adapter-dispatch.sh

@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+# story: e37s05
+# golden-g14-adapter-dispatch.sh — an adapter that can render must be dispatched.
+#
+# scripts/lib/srp-engine.py builds its dispatch list from targets.yaml entries
+# carrying a skill.adapter. An adapter that defines render_skill() but is
+# declared `skill: null` therefore never runs during sync, while its install
+# function still reads a rendered directory that is never produced — the target
+# reports success and installs nothing
+# (BUG-2026-07-26-null-skill-adapters-install-nothing).
+#
+# Context-only bridges (aider, goose, ...) are exempt by construction: they
+# define no render_skill, so there is nothing to dispatch.
+#
+# Usage: bash scripts/golden-g14-adapter-dispatch.sh [--self-test]
+# Exit 0: every rendering adapter is dispatched
+# Exit 1: at least one rendering adapter is undispatched (or, under
+#         --self-test, the gate failed to notice an injected one)
+
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/python-env.sh"
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+check() { # $1 = targets.yaml path
+  $PYTHON - "$1" <<'PY'
+import sys, os, re
+import yaml
+
+targets_path = sys.argv[1]
+data = yaml.safe_load(open(targets_path, encoding="utf-8")) or {}
+
+dispatched = set()
+for t in data.get("targets") or []:
+    skill = t.get("skill")
+    if isinstance(skill, dict) and skill.get("adapter"):
+        dispatched.add(skill["adapter"])
+
+problems = []
+adapter_dir = os.path.join("scripts", "adapters")
+for fn in sorted(os.listdir(adapter_dir)):
+    if not fn.endswith(".sh"):
+        continue
+    aid = fn[:-3]
+    src = open(os.path.join(adapter_dir, fn), encoding="utf-8").read()
+    if not re.search(r"^render_skill\(\)", src, re.M):
+        continue  # context-only bridge — nothing to dispatch
+    if aid not in dispatched:
+        problems.append(
+            f"{aid}: defines render_skill() but targets.yaml does not dispatch it "
+            f"(skill.adapter missing or null) — sync renders nothing for it"
+        )
+
+if problems:
+    for p in problems:
+        print(f"  UNDISPATCHED {p}")
+    print(f"\n{len(problems)} rendering adapter(s) never run during sync")
+    sys.exit(1)
+
+print(f"  ok  : all rendering adapters are dispatched ({len(dispatched)} in registry)")
+sys.exit(0)
+PY
+}
+
+if [[ "${1:-}" == "--self-test" ]]; then
+  echo "=== G-14 self-test: prove the gate can fail ==="
+  TMP=$(mktemp -d)
+  trap 'rm -rf "$TMP"' EXIT
+  $PYTHON - "$TMP/targets.yaml" <<'PY'
+import sys, yaml
+d = yaml.safe_load(open("scripts/targets.yaml", encoding="utf-8"))
+# Null out the first dispatched adapter — the gate must notice.
+for t in d.get("targets") or []:
+    s = t.get("skill")
+    if isinstance(s, dict) and s.get("adapter"):
+        print(f"injected: {t['id']} skill -> null")
+        t["skill"] = None
+        break
+yaml.dump(d, open(sys.argv[1], "w", encoding="utf-8"), default_flow_style=False, sort_keys=False)
+PY
+  set +e
+  check "$TMP/targets.yaml" >/dev/null 2>&1
+  rc=$?
+  set -e
+  if [[ $rc -ne 0 ]]; then
+    echo -e "${GREEN}PASS${NC} G-14 detected an injected undispatched adapter"
+    echo "G-14 self-test: PASS"
+    exit 0
+  fi
+  echo -e "${RED}FAIL${NC} G-14 passed on an injected null adapter — vacuous gate"
+  echo "G-14 self-test: FAIL"
+  exit 1
+fi
+
+echo "=== G-14: adapter dispatch coverage ==="
+set +e
+out=$(check "scripts/targets.yaml" 2>&1)
+rc=$?
+set -e
+echo "$out"
+if [[ $rc -eq 0 ]]; then
+  echo -e "${GREEN}PASS${NC}"
+  echo "G-14: PASS"
+  exit 0
+fi
+echo -e "${RED}FAIL${NC} see BUG-2026-07-26-null-skill-adapters-install-nothing"
+echo "G-14: FAIL"
+exit 1

package/scripts/lib/adapter-guard.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# story: e37s05
+# adapter-guard.sh — shared skill-name validation for every render adapter.
+#
+# Adapters interpolate the SkillIR `name` straight into a filesystem path
+# (mkdir -p "$dir/$IR_NAME"). A name containing "/" or ".." therefore writes
+# outside the destination directory.
+#
+# Ten adapters carried a private copy of this check (qwen_is_unsafe_skill_name
+# and friends) and nine had none at all — and the nine unguarded ones were
+# exactly the nine that never got a per-target test. One guard, sourced by every
+# adapter, replaces both the duplication and the gap.
+
+# Returns 0 (true) when the name must not be used as a path component.
+bp_is_unsafe_skill_name() {
+  local name="${1-}"
+  [[ -z "$name" || "$name" == "null" || "$name" == *"/"* || "$name" == *".."* || "$name" == .* ]]
+}
+
+# Echoes the name when safe; otherwise reports on stderr and returns 1.
+# Usage inside render_skill:  name="$(bp_assert_safe_skill_name "$IR_NAME" adaptername)" || return 1
+bp_assert_safe_skill_name() {
+  local name="${1-}"
+  local adapter="${2:-adapter}"
+  if bp_is_unsafe_skill_name "$name"; then
+    echo "${adapter}: refusing unsafe skill name: ${name:-<empty>}" >&2
+    return 1
+  fi
+  printf '%s' "$name"
+}

package/scripts/lib/golden-suite-gates.sh

@@ -22,7 +22,31 @@ GOLDEN_GATES=(
   # Anti-vacuity for the target-contract seam: every contract declared in
   # targets.yaml must have a real assertion, and an unknown contract must FAIL
   # rather than SKIP+exit 0 (seven contracts were fail-open before this).
+  # Writing a test must be enough to make it run: G-13 fails if any
+  # scripts/test-*.sh is absent from this list.
+  "g13-test-orphans-selftest:bash scripts/golden-g13-test-orphans.sh --self-test:false"
+  "g13-test-orphans:bash scripts/golden-g13-test-orphans.sh:false"
+  # An adapter that defines render_skill() must be dispatched by targets.yaml,
+  # or sync renders nothing for it while its install still claims success.
+  # docs/WORKFLOWS.md is generated from specs/workflows/*.yaml; a diagram nothing
+  # regenerates is a diagram that lies (see specs/archive/assets/README.md).
+  "workflow-diagrams-fresh:bash scripts/generate-workflow-diagrams.sh --check:false"
+  "g14-adapter-dispatch-selftest:bash scripts/golden-g14-adapter-dispatch.sh --self-test:false"
+  "g14-adapter-dispatch:bash scripts/golden-g14-adapter-dispatch.sh:false"
   "target-contracts:bash scripts/test-target-contracts.sh:false"
+  # Registry-driven replacements for the 25 hand-written per-target scripts.
+  "install-hub:bash scripts/test-install-hub.sh:false"
+  "adapter-render:bash scripts/test-adapter-render.sh:false"
+  "adapters:bash scripts/test-adapters.sh:false"
+  # Previously orphaned: present in scripts/ but reachable from no gate.
+  "tombstone-mechanism:bash scripts/test-tombstone-mechanism.sh:false"
+  "trace-strict:bash scripts/test-trace-strict.sh:false"
+  "trace-matrix-size:bash scripts/test-trace-matrix-size.sh:false"
+  "setup-no-pyyaml:bash scripts/test-setup-no-pyyaml.sh:false"
+  "install-distribute-only:bash scripts/test-install-distribute-only.sh:false"
+  "completeness-critic-scope:bash scripts/test-completeness-critic-scope.sh:false"
+  "epics-wiki-zero-stories:bash scripts/test-generate-epics-wiki-zero-stories.sh:false"
+  "golden-g11-worktree-venv:bash scripts/test-golden-g11-worktree-venv.sh:false"
   "install-helpers:bash scripts/test-install-helpers.sh:false"
   "import-boundaries:bash scripts/check-import-boundaries.sh:false"
   "skill-catalog:bash scripts/validate-skill-catalog.sh:false"

package/scripts/lib/install-targets-b.sh

@@ -107,10 +107,6 @@ install_agy() {
   echo "  NOTE: Antigravity uses ~/.gemini/antigravity-cli/skills/ — not .gemini/extensions/ (Gemini CLI)"
 }
 
-install_antigravity() {
-  install_agy
-}
-
 uninstall_agy() {
   echo ""
   echo "Antigravity CLI → removing management from $AGY_CONFIG_DIR/"
@@ -122,10 +118,6 @@ uninstall_agy() {
   fi
 }
 
-uninstall_antigravity() {
-  uninstall_agy
-}
-
 # ── Codex CLI (e65s02) ───────────────────────────────────────────────────────
 
 CODEX_CONFIG_DIR="$HOME/.codex"

package/scripts/lib/sync-render.sh

@@ -54,49 +54,6 @@ render_gemini_command() {
   } > "$GEMINI_COMMANDS/$IR_NAME.toml"
 }
 
-render_gemini_hooks_manifest() {
-  local hookdir="${GEMINI_HOOKS_DIR:-$GEMINI_EXT_DIR/hooks}"
-  mkdir -p "$hookdir"
-  cat > "$hookdir/hooks-manifest.json" <<'JSON'
-{
-  "schema_version": 1,
-  "target": "gemini",
-  "config_path": "~/.gemini/settings.json",
-  "events_total": 11,
-  "events": [
-    "BeforeTool",
-    "AfterTool",
-    "BeforeAgent",
-    "AfterAgent",
-    "BeforeModel",
-    "BeforeToolSelection",
-    "AfterModel",
-    "SessionStart",
-    "SessionEnd",
-    "Notification",
-    "PreCompress"
-  ],
-  "shipped_hooks": [
-    {
-      "event": "SessionStart",
-      "script": "session-start",
-      "matcher": "startup|clear|compact",
-      "wave": "a",
-      "status": "shipped"
-    },
-    {
-      "event": "BeforeTool",
-      "script": "before-tool-git-guard.sh",
-      "matcher": "run_shell_command",
-      "wave": "a",
-      "status": "template"
-    }
-  ],
-  "polyglot_launcher": "run-hook.cmd"
-}
-JSON
-}
-
 render_pi_skill() {
   mkdir -p "$PI_SKILLS/$IR_NAME"
   {

package/scripts/targets.yaml

@@ -47,7 +47,9 @@ targets:
   - id: cline
     name: Cline
     tier: default_on
-    skill: null
+    skill:
+      adapter: cline
+      output: .cline/skills
     context:
       adapter: cline
       mode: native
@@ -164,7 +166,9 @@ targets:
     # story: e68s02
     name: Qwen (Alibaba)
     tier: opt_in
-    skill: null
+    skill:
+      adapter: qwen
+      output: .qwen/skills
     context:
       adapter: qwen
       mode: symlink
@@ -172,17 +176,6 @@ targets:
     contracts:
       - agents_md_exists
       - qwen_hooks_manifest
-    name: Kilocode
-    tier: opt_in
-    skill:
-      adapter: kilocode
-      output: .kilocode/rules
-    context:
-      adapter: kilocode
-      mode: copy
-      file: AGENTS.md
-    contracts:
-      - agents_md_exists
 
   # Wave D (e37s12)
   - id: continue
@@ -303,3 +296,32 @@ targets:
       file: AGENTS.md
     contracts:
       - windsurf_hooks_manifest
+
+  # Registered by BUG-2026-07-26-null-skill-adapters-install-nothing: both ship
+  # a render_skill() adapter and an install function, but had no registry row,
+  # so srp-engine never rendered for them and install found nothing.
+  - id: opencode
+    name: OpenCode
+    tier: opt_in
+    skill:
+      adapter: opencode
+      output: .opencode/skills
+    context:
+      adapter: opencode
+      mode: symlink
+      file: AGENTS.md
+    contracts:
+      - agents_md_exists
+
+  - id: copilot
+    name: Copilot CLI
+    tier: opt_in
+    skill:
+      adapter: copilot
+      output: .copilot/skills
+    context:
+      adapter: copilot
+      mode: copy
+      file: AGENTS.md
+    contracts:
+      - agents_md_exists

package/scripts/test-adapter-render.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# story: e37s05
+# test-adapter-render.sh — render, path-traversal and hook-guard checks for
+# every adapter, replacing 11 hand-written test-<target>-adapter.sh scripts.
+#
+# The 11 originals were the same five assertions with the target name
+# substituted, none of them reachable from any gate, and they covered 11 of the
+# 18 adapters that define render_skill(). Their fifth assertion was pure
+# delegation to test-adapters.sh, which is already registry-driven.
+#
+# Adapters are discovered from scripts/adapters/*.sh, and each adapter's output
+# directory variable is read out of its own source (they vary: *_SKILLS,
+# *_RULES, *_EXT_DIR), so adding an adapter needs no edit here.
+#
+# Usage: bash scripts/test-adapter-render.sh
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+
+PASS=0
+FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
+
+TMP_ROOT=$(mktemp -d)
+trap 'rm -rf "$TMP_ROOT"' EXIT
+
+
+
+
+echo "=== test-adapter-render.sh ==="
+
+for adapter in scripts/adapters/*.sh; do
+  id="$(basename "$adapter" .sh)"
+
+  grep -q "^render_skill()" "$adapter" || continue
+
+  # Adapters are sourced, not executed: several (continue, omp, zed) are stubs
+  # with no stdin entrypoint and would silently no-op — and exit 0 — if run as
+  # scripts. Sourcing and calling render_skill directly is how test-adapters.sh
+  # drives them, and it exercises every adapter the same way.
+  #
+  # An adapter may read more than one output variable (gemini uses GEMINI_SKILLS
+  # and GEMINI_EXT_DIR), so point all of them at the sandbox rather than
+  # guessing which one matters.
+  mapfile -t outvars < <(grep -oE '\$\{?[A-Z][A-Z0-9_]*_(SKILLS|RULES|EXT_DIR|OUT|COMMANDS|PROMPTS|HOOKS_DIR)[:-]' "$adapter" \
+    | tr -d '${:-' | sort -u)
+  if [[ ${#outvars[@]} -eq 0 ]]; then
+    echo "  skip: $id — no output directory variable found"
+    continue
+  fi
+
+  render_into() { # $1 = destination dir, $2 = skill name
+    local dir="$1" nm="$2" v
+    local -a envs=()
+    for v in "${outvars[@]}"; do envs+=("$v=$dir"); done
+    ( set +e
+      env "${envs[@]}" bash -c '
+        source "$1" 2>/dev/null || exit 1
+        IR_NAME="$2"; IR_DESCRIPTION="test desc"; IR_BODY="test body"
+        IR_DESC_ESCAPED="test desc"; IR_MODEL=""
+        declare -f render_skill >/dev/null || exit 1
+        render_skill
+      ' _ "$PWD/$adapter" "$nm" >/dev/null 2>&1 )
+  }
+
+  dest="$TMP_ROOT/$id"
+  mkdir -p "$dest"
+  if render_into "$dest" "test-skill" && [[ -n "$(find "$dest" -mindepth 1 2>/dev/null)" ]]; then
+    pass "$id: render_skill writes an artifact from a SkillIR"
+  else
+    fail "$id: render_skill produced no artifact (${outvars[*]})"
+  fi
+
+  # Path traversal must be refused — this is the security assertion the
+  # per-target scripts carried and nothing else covers.
+  #
+  # Each adapter gets its own sandbox parent so the escape probe is isolated:
+  # ../escape from <sandbox>/out lands in <sandbox>, and a single shared parent
+  # would make one adapter's artifact fail every later adapter.
+  sandbox="$TMP_ROOT/sandbox-$id"
+  mkdir -p "$sandbox/out"
+  if render_into "$sandbox/out" "../escape"; then
+    fail "$id: accepted a path-traversal skill name"
+  else
+    pass "$id: rejects path traversal in skill name"
+  fi
+  if [[ -e "$sandbox/escape" ]]; then
+    fail "$id: path traversal escaped into $sandbox"
+  else
+    pass "$id: traversal wrote nothing outside the destination"
+  fi
+
+  # Hook bundle + guard behaviour, only where the target ships hooks.
+  hookdir="scripts/hooks/$id"
+  guard="$hookdir/pre-tool-git-guard.sh"
+  if [[ -f "$guard" ]]; then
+    out="$(echo '{"tool_input":{"command":"git push --force origin main"}}' \
+      | bash "$guard" 2>/dev/null || true)"
+    grep -q 'block' <<<"$out" \
+      && pass "$id: pre-tool guard blocks a dangerous git command" \
+      || fail "$id: pre-tool guard did not block git push --force"
+  fi
+done
+
+# The generic adapter-contract runner stays the source of truth for
+# render_skill/wire_context wiring; assert it is green rather than restating it.
+if bash scripts/test-adapters.sh 2>&1 | grep -q '0 failed'; then
+  pass "test-adapters.sh reports 0 failed across the registry"
+else
+  fail "test-adapters.sh reported failures"
+fi
+
+echo "test-adapter-render: $PASS passed, $FAIL failed"
+[[ "$FAIL" -eq 0 ]] || exit 1

package/scripts/test-adapters.sh

@@ -40,8 +40,13 @@ test_adapter() {
   [[ -f "$adapter_file" ]] || { ta_fail "$id: adapter missing"; return; }
   ta_pass "$id: exists"
 
+  # </dev/null is load-bearing. The caller feeds the target list into a
+  # `while read` loop, so a sourced adapter inherits it on fd 0 — and every
+  # adapter ends in a main block that reads stdin. agy.sh was consuming the
+  # remaining target list and running render_skill with an empty IR_NAME, so
+  # this "registry-driven" runner silently tested exactly one adapter.
   # shellcheck source=/dev/null
-  source "$adapter_file" 2>/dev/null && ta_pass "$id: sourceable" || { ta_fail "$id: source error"; return; }
+  source "$adapter_file" </dev/null 2>/dev/null && ta_pass "$id: sourceable" || { ta_fail "$id: source error"; return; }
 
   local has_skill has_context mode
   has_skill=$(yq -r ".targets[] | select(.id==\"$id\") | .skill != null" "$TARGETS_FILE")
@@ -62,11 +67,13 @@ test_adapter() {
     # to print 5 PASS lines and report 4. Capture the status, tally in-process.
     if (
       cd "$TA_TMPDIR"
+      # </dev/null for the same reason as above — this subshell also inherits
+      # the caller's target list on fd 0.
       # shellcheck source=/dev/null
-      source "$adapter_file"
+      source "$adapter_file" </dev/null
       wire_context >/dev/null 2>&1 || true
       wire_context >/dev/null 2>&1
-    ); then
+    ) </dev/null; then
       ta_pass "$id: idempotent wire_context"
     else
       ta_fail "$id: wire_context failed"