bigpowers 2.90.2 → 2.91.0

package/scripts/verify-tdd-red-commit.sh

@@ -78,7 +78,45 @@ if [[ -z "$VERIFY_CMD" ]]; then
   fi
 fi
 
-RED_SHA=$(git rev-parse HEAD~1)
+LATEST_MSG=$(git log -1 --format=%s 2>/dev/null || echo "")
+
+# Enforce during fix_bug flow, bug-fix commits, or when explicitly requested
+IS_FIX_FLOW=false
+if [ -f specs/state.yaml ] && grep -qE "active_flow:[[:space:]]*fix_bug" specs/state.yaml 2>/dev/null; then
+  IS_FIX_FLOW=true
+elif [[ -n "${TDD_ENFORCE_RED:-}" ]]; then
+  IS_FIX_FLOW=true
+elif [[ "$LATEST_MSG" =~ ^fix\(bug ]] || [[ "$LATEST_MSG" =~ BUG-[0-9] ]]; then
+  IS_FIX_FLOW=true
+fi
+
+if [ "$IS_FIX_FLOW" = false ] && [[ "${CHECK_PENDING_FIX:-0}" != "1" ]]; then
+  echo "SKIP: verify-tdd-red-commit only enforces during fix_bug flow or bug-fix commits"
+  exit 0
+fi
+
+if [[ "$LATEST_MSG" =~ ^fix ]]; then
+  RED_SHA=$(git rev-parse HEAD~1 2>/dev/null || echo "")
+  RED_MSG=$(git log -1 --format=%s "$RED_SHA" 2>/dev/null || echo "")
+  if [[ ! "$RED_MSG" =~ ^test ]]; then
+    echo "FAIL: preceding commit $RED_SHA is not a test-only commit (found: '$RED_MSG') — RED gate violated"
+    exit 1
+  fi
+elif [[ "$LATEST_MSG" =~ ^test ]]; then
+  RED_SHA=$(git rev-parse HEAD 2>/dev/null || echo "")
+else
+  if [[ "${CHECK_PENDING_FIX:-0}" == "1" ]]; then
+    echo "FAIL: latest commit '$LATEST_MSG' is not a test-only (RED) commit — RED gate violated"
+    exit 1
+  fi
+  RED_SHA=$(git rev-parse HEAD~1 2>/dev/null || echo "")
+fi
+
+if [[ -z "$RED_SHA" ]]; then
+  echo "FAIL: could not identify RED commit"
+  exit 1
+fi
+
 WORKTREE=$(mktemp -d)
 trap 'git worktree remove -f "$WORKTREE" 2>/dev/null || rm -rf "$WORKTREE"' EXIT
 

package/skills/build-epic/SKILL.md

@@ -68,7 +68,7 @@ Orchestrates the **build** flow for a single epic: survey → plan tasks → kic
 After step 5 (verify-work) completes successfully, step 6 runs `audit-code` automatically in `--gate` mode:
 
 1. **Run audit:** Invoke `audit-code --gate` on the complete diff for this story.
-2. **Pass (exit 0):** All checklist sections pass → advance to step 7 (commit-message). Record `epic_cycle.audit_result: pass` in `state.yaml`.
+2. **Pass (exit 0):** All checklist sections pass → run `bash scripts/lib/assert-epic-gate.sh advance` to mechanically confirm the audit pass, then advance to step 7 (commit-message). Record `epic_cycle.audit_result: pass` in `state.yaml`.
 3. **Fail (exit 1):** One or more checklist sections fail → **reset `epic_cycle.current_step` to `4`** (develop-tdd) and add the failing section IDs to `completed_steps` as `"1,2,3,4,5,6(fail: ...)"`. Record `epic_cycle.audit_result: fail` in `state.yaml`. Do NOT advance past step 6 until audit passes.
 4. **Audit artifact:** Full audit report saved to `specs/verifications/AUDIT-<epic>-<story>.md` regardless of pass/fail, for reviewer traceability.
 5. **Enforce F.I.R.S.T:** After audit-code passes, run `enforce-first --quick` on new/modified tests. Append F.I.R.S.T violations (if any) to the audit report. Failing F.I.R.S.T criteria trigger the same loop-back to step 4.

package/skills/commit-message/SKILL.md

@@ -37,6 +37,7 @@ description: Reviews working-tree changes, then drafts a Conventional Commits ti
 
 ## Checklist before finalizing
 
+- [ ] **Audit pass confirmed (HARD GATE — Issue #182):** In active epic flow, `bash scripts/lib/assert-epic-gate.sh commit` passes.
 - [ ] Type matches the **dominant** user-visible outcome (`feat` vs `fix` vs `perf`, etc.).
 - [ ] **Scope** is a short noun in parentheses if it helps (e.g. `fix(api): …`).
 - [ ] Breaking changes are explicit (`!` and/or `BREAKING CHANGE:` in the body/footer).

package/skills/release-branch/SKILL.md

@@ -58,13 +58,12 @@ git log main...HEAD --format="%B" | grep -qiE 'co[- ]authored[- ]by' && echo "
 ### 2a. Security gate
 
 - [ ] `specs/security/REVIEW.md` exists and is fresh (matches current branch diff)
-- [ ] No unresolved HIGH findings with confidence ≥ 8 (or all documented in `specs/security/EXCEPTIONS.md` with sign-off rationale)
 
-If REVIEW.md is missing or stale → run `security-review` inline. Findings block the merge unless documented in EXCEPTIONS.md.
+### 2b. Audit-code & Traceability gates (HARD GATES — Issue #182)
 
-### 2b. Traceability gate
-
-Run `gate-trace` before merge. FAIL blocks merge; CONCERNS requires explicit override in `specs/state.yaml` (`traceability_override: CONCERNS accepted, reason: <explanation>`). WAIVED if no matrix available.
+- [ ] Run `bash scripts/lib/assert-epic-gate.sh release` (asserts `specs/AUDIT_LATEST.md` passed; blocks release on failure).
+- [ ] No unresolved HIGH security findings with confidence ≥ 8 (or documented in `specs/security/EXCEPTIONS.md`).
+- [ ] Run `gate-trace`. FAIL blocks merge; CONCERNS requires explicit override in `specs/state.yaml`. WAIVED if no matrix available.
 
 > **Adversarial refute framing (e45s32):** The final pre-merge check is **refute, not rubber-stamp**. Before declaring ready, actively try to disprove traceability completeness — missing story tags, absent verify evidence, stale security review. Only proceed when refutation fails.
 

package/skills/run-planning/SKILL.md

@@ -62,7 +62,12 @@ if written:
    - `plan-release` — sequence epics by WSJF
    - `slice-tasks` — cut vertical slices
 
-4. **Update status** — On successful completion, set `status: done` for that workflow key in `planning-status.yaml`.
+4. **Mechanical artifact assertion before status update (HARD GATE — Issue #183):**
+   Before marking any workflow key `status: done`, run:
+   ```bash
+   bash scripts/lib/assert-planning-artifacts.sh <workflow-key>
+   ```
+   If the artifact assertion fails, do NOT advance status. Remediate missing output files before continuing. On success, set `status: done` for that workflow key in `planning-status.yaml`.
 
 5. **Advance** — Set `state.yaml` `active_flow: planning` while in this chain. When all required keys are done, set `handoff.next_skill` to `plan-work`.
 

package/skills/verify-work/SKILL.md

@@ -63,7 +63,8 @@ Review answers "is the code good?"; Verify answers "does the built thing do what
 5a. **Blind-spot check** — run `bash scripts/check-blind-spots.sh`. This detects structural quality gaps (verify-gap, test-gap, stale-tag, etc.) beyond percentage coverage. If any HIGH-severity findings exist → **block the verify-work PASS gate**. Findings are written to `specs/blind-spots.json`. MEDIUM/LOW findings warn but don't block.
 5a2. **Completeness critic (e45s05)** — `bash scripts/lib/completeness-critic.sh`. **BLOCKER** aborts merge gate; WARNING → gaps loop; FILLED = evidence only.
 
-5b. **NFR Evidence Gate** (P0 only) — Produces go/no-go output on three dimensions: Performance (response time, throughput), Reliability (error rate, recovery), and Operability (logging, health checks). Reads thresholds from `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` and writes evidence as OKF verification-report bundles to `specs/verifications/NFR-eNNsYY.json`. FAIL on any dimension blocks the gate.
+5b. **NFR Evidence Gate** (P0 only) — Go/no-go on Performance, Reliability, Operability against `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`. Evidence written to `specs/verifications/NFR-eNNsYY.json`. FAIL blocks gate.
+5c. **Adversarial Defect Mutation Gate (HARD GATE — e86 / ab-20)** — `bash scripts/verify-adversarial.sh`. Boundary fuzzing & parameter injection against modified interfaces. Crashes or failures block PASS gate; evidence in `specs/verifications/ADVERSARIAL_LATEST.yaml`.
 6. **Step-by-step UAT** (skip if P2/P3) — one user-observable action at a time.
 7. **Gaps loop** — failures → log → `plan-work` → re-verify. Unaddressed HIGH findings from step 5 feed into this loop alongside other quality gaps.
 

package/skills-lock.json

@@ -23,7 +23,7 @@
     },
     "build-epic": {
       "description": "Eight-step epic build cycle — reads state.yaml, execution-status.yaml, and one epic capsule; updates status via bp-yaml-set or direct edit. Resume mode runs one step per invocation. Use instead of ad-hoc execute-plan for release work.",
-      "sha256": "a524120e0bf940c2",
+      "sha256": "c1687698f60f5df1",
       "path": "skills/build-epic/SKILL.md"
     },
     "change-request": {
@@ -33,7 +33,7 @@
     },
     "commit-message": {
       "description": "Reviews working-tree changes, then drafts a Conventional Commits title/body and states the semantic-release version bump a single such commit would imply. Also notes which defensive-code categories were touched. Use when the user wants to commit recent work, prepare a Conventional Commits message, or asks for semantic-release / semver-consistent messaging before git commit.",
-      "sha256": "9c21fead0938a924",
+      "sha256": "58bc72a02aa4ce00",
       "path": "skills/commit-message/SKILL.md"
     },
     "compose-workflow": {
@@ -248,7 +248,7 @@
     },
     "release-branch": {
       "description": "Make the merge/PR/keep/discard decision for a feature branch, verify coverage gates, create the PR with gh, and clean up the worktree. Use when a feature is done and ready to ship, or when user says \"release\", \"merge\", or \"open a PR\".",
-      "sha256": "4c3509bc9fd4a8a1",
+      "sha256": "41b42f5d409de4cb",
       "path": "skills/release-branch/SKILL.md"
     },
     "request-review": {
@@ -283,7 +283,7 @@
     },
     "run-planning": {
       "description": "\"DISCOVER-PHASE ADVANCER — Drive the discover-phase checklist (specs/planning-status.yaml) through survey-context → scope-work → research-first → elaborate-spec → plan-release → slice-tasks. NOT a duplicate of plan-work or the planning spine; it orchestrates the pre-coding discover phase only.\"",
-      "sha256": "9a28211414df158a",
+      "sha256": "5cdd1e03360f0f6c",
       "path": "skills/run-planning/SKILL.md"
     },
     "scope-work": {
@@ -378,7 +378,7 @@
     },
     "verify-work": {
       "description": "Multi-phase UAT gate — cold-start smoke, build, typecheck, lint, tests, step-by-step manual verification, gaps-closure loop. Use after execute-plan or develop-tdd, before audit-code.",
-      "sha256": "518ffc602775b589",
+      "sha256": "b395c44051f4ac3c",
       "path": "skills/verify-work/SKILL.md"
     },
     "visual-dashboard": {

package/tests/test-artifact-assertions.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# story: e86 / GH #182 / GH #183
+# Tests for mechanical artifact assertions and epic audit gate.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+pass_count=0
+fail_count=0
+
+assert_true() {
+  local label="$1"
+  shift
+  if "$@"; then
+    echo "  PASS $label"
+    pass_count=$((pass_count + 1))
+  else
+    echo "  FAIL $label"
+    fail_count=$((fail_count + 1))
+  fi
+}
+
+assert_false() {
+  local label="$1"
+  shift
+  if ! "$@"; then
+    echo "  PASS $label"
+    pass_count=$((pass_count + 1))
+  else
+    echo "  FAIL $label"
+    fail_count=$((fail_count + 1))
+  fi
+}
+
+echo "=== Artifact & Gate Assertion Tests (GH #182, GH #183) ==="
+
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+cd "$TMP_DIR"
+mkdir -p specs/product specs/epics/e01-test
+
+# 1. Test assert-planning-artifacts.sh for scope-work (missing -> fail, present -> pass)
+assert_false "scope-work fails when SCOPE_LATEST.yaml missing" \
+  bash "$REPO_ROOT/scripts/lib/assert-planning-artifacts.sh" scope-work
+
+echo "scope: test" > specs/product/SCOPE_LATEST.yaml
+assert_true "scope-work passes when SCOPE_LATEST.yaml exists and non-empty" \
+  bash "$REPO_ROOT/scripts/lib/assert-planning-artifacts.sh" scope-work
+
+# 2. Test assert-planning-artifacts.sh for slice-tasks
+assert_false "slice-tasks fails when no *-tasks.yaml exists" \
+  bash "$REPO_ROOT/scripts/lib/assert-planning-artifacts.sh" slice-tasks
+
+cat > specs/epics/e01-test/e01s01-tasks.yaml <<'YAML'
+story_id: e01s01
+tasks: []
+YAML
+assert_true "slice-tasks passes when *-tasks.yaml exists" \
+  bash "$REPO_ROOT/scripts/lib/assert-planning-artifacts.sh" slice-tasks
+
+# 3. Test assert-epic-gate.sh (Issue #182)
+assert_false "assert-epic-gate fails when no audit report exists" \
+  bash "$REPO_ROOT/scripts/lib/assert-epic-gate.sh" commit
+
+cat > specs/AUDIT_LATEST.md <<'MD'
+# Audit Report
+VERDICT: FAIL
+MD
+assert_false "assert-epic-gate fails when audit report is FAIL" \
+  bash "$REPO_ROOT/scripts/lib/assert-epic-gate.sh" commit
+
+cat > specs/AUDIT_LATEST.md <<'MD'
+# Audit Report
+VERDICT: PASS
+MD
+assert_true "assert-epic-gate passes when audit report is PASS" \
+  bash "$REPO_ROOT/scripts/lib/assert-epic-gate.sh" commit
+
+echo ""
+echo "=== Summary: $pass_count passed, $fail_count failed ==="
+if [ "$fail_count" -gt 0 ]; then
+  exit 1
+fi
+exit 0

package/tests/test-verify-adversarial.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# story: e86 / verify-work adversarial mutation
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+echo "=== Testing verify-adversarial.sh ==="
+
+# 1. Run self-test
+bash "$REPO_ROOT/scripts/verify-adversarial.sh" --self-test
+echo "  PASS verify-adversarial self-test"
+
+# 2. Run normal invocation in repo root
+bash "$REPO_ROOT/scripts/verify-adversarial.sh"
+echo "  PASS verify-adversarial repo root run"
+
+# 3. Assert artifact was created
+if [[ -f "$REPO_ROOT/specs/verifications/ADVERSARIAL_LATEST.yaml" ]]; then
+  echo "  PASS ADVERSARIAL_LATEST.yaml created"
+else
+  echo "  FAIL ADVERSARIAL_LATEST.yaml missing"
+  exit 1
+fi
+
+echo "=== All verify-adversarial tests passed ==="
+exit 0