bigpowers 2.90.2 → 2.91.1

package/scripts/lib/git-argv.py

@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+"""Normalize git argv before applying the guard-git deny rules (#184).
+
+The old guard matched literal substrings, so `git -C repo reset --hard`,
+`git reset -q --hard` and `git checkout -- .` all slipped through: the
+destructive tokens are still there, only their position or a global flag
+changed. Matching on the raw command string cannot see that.
+
+This module tokenizes the command (quote-aware), finds every `git` invocation,
+strips the global options that precede the subcommand (`-C <path>`,
+`--no-pager`, `-c k=v`, `--git-dir=…`, …), and then decides on the
+(subcommand, arguments) pair. `extensions/omp-hooks.ts` implements the same
+rules in TypeScript; `scripts/test-guard-git-normalize.sh` fails if the two
+disagree on any fixture row.
+
+Rule table (keep in sync with the TS port):
+
+  reset     block when any argument is --hard
+  clean     block when any short flag carries `f` (-f, -fd, -fdx) or --force
+  branch    block on -D, or on --delete together with --force/-f
+  checkout  block on -f/--force, or on a `.` pathspec (with or without --)
+  restore   block on --worktree, or on a `.` pathspec
+  push      block on -f/--force/+refspec, unless --force-with-lease is given
+
+CLI:  git-argv.py --command "<shell command>"   → prints `block: <reason>` or `allow`
+Exit: 0 allow, 10 block, 2 usage error.
+"""
+from __future__ import annotations
+
+import shlex
+import sys
+
+# Global options that consume the next token as their value.
+VALUE_FLAGS = {
+    "-C",
+    "-c",
+    "--exec-path",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "--super-prefix",
+    "--config-env",
+}
+
+# Global options that stand alone.
+BARE_FLAGS = {
+    "-p",
+    "--paginate",
+    "--no-pager",
+    "--bare",
+    "--no-replace-objects",
+    "--literal-pathspecs",
+    "--glob-pathspecs",
+    "--icase-pathspecs",
+    "--no-optional-locks",
+    "--version",
+    "--help",
+}
+
+# Command separators: the guard judges each git invocation on its own.
+SEPARATORS = {";", "&&", "||", "|", "&", "(", ")", "\n"}
+
+
+def tokenize(command: str) -> list[str]:
+    """Quote-aware split. Bad quoting degrades to whitespace splitting, never to eval."""
+    try:
+        return shlex.split(command, comments=False, posix=True)
+    except ValueError:
+        return command.split()
+
+
+def git_invocations(tokens: list[str]) -> list[tuple[str, list[str], int]]:
+    """Yield (subcommand, args, index) for every git call in the token stream."""
+    found: list[tuple[str, list[str], int]] = []
+    i = 0
+    while i < len(tokens):
+        token = tokens[i]
+        if token.rsplit("/", 1)[-1] != "git":
+            i += 1
+            continue
+        start = i
+        j = i + 1
+        # Skip global options between `git` and the subcommand.
+        while j < len(tokens):
+            opt = tokens[j]
+            if opt in SEPARATORS:
+                break
+            name = opt.split("=", 1)[0]
+            if name in VALUE_FLAGS:
+                j += 2 if "=" not in opt else 1
+                continue
+            if name in BARE_FLAGS or (opt.startswith("-") and not opt.startswith("--") and len(opt) > 1):
+                j += 1
+                continue
+            break
+        if j >= len(tokens) or tokens[j] in SEPARATORS:
+            i = j + 1
+            continue
+        sub = tokens[j]
+        args: list[str] = []
+        k = j + 1
+        while k < len(tokens) and tokens[k] not in SEPARATORS:
+            args.append(tokens[k])
+            k += 1
+        found.append((sub, args, start))
+        i = k
+    return found
+
+
+def _short_flag_has(args: list[str], letter: str) -> bool:
+    for arg in args:
+        if arg.startswith("-") and not arg.startswith("--") and letter in arg[1:]:
+            return True
+    return False
+
+
+def classify_git(sub: str, args: list[str]) -> str | None:
+    """Return a block reason, or None to allow."""
+    if sub == "reset" and "--hard" in args:
+        return "git reset --hard discards uncommitted work"
+    if sub == "clean" and (_short_flag_has(args, "f") or "--force" in args):
+        return "git clean -f deletes untracked files"
+    if sub == "branch":
+        forced = "-D" in args or ("--delete" in args and ("--force" in args or _short_flag_has(args, "f")))
+        if forced:
+            return "git branch -D deletes an unmerged branch"
+    if sub == "checkout":
+        if "-f" in args or "--force" in args:
+            return "git checkout -f discards local changes"
+        if "." in args:
+            return "git checkout . discards local changes"
+    if sub == "restore":
+        if "--worktree" in args or "." in args:
+            return "git restore discards local changes"
+    if sub == "push":
+        leased = any(a == "--force-with-lease" or a.startswith("--force-with-lease=") for a in args)
+        forced = (
+            "-f" in args
+            or "--force" in args
+            or any(a.startswith("+") and not a.startswith("++") for a in args)
+        )
+        if forced and not leased:
+            return "force push rewrites remote history"
+    return None
+
+
+def classify(command: str) -> str | None:
+    for sub, args, _idx in git_invocations(tokenize(command)):
+        reason = classify_git(sub, args)
+        if reason:
+            return reason
+    return None
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) == 3 and argv[1] == "--command":
+        reason = classify(argv[2])
+        if reason:
+            print(f"block: {reason}")
+            return 10
+        print("allow")
+        return 0
+    print(__doc__, file=sys.stderr)
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

package/scripts/lib/golden-suite-gates.sh

@@ -76,6 +76,8 @@ GOLDEN_GATES=(
   "import-boundaries:bash scripts/check-import-boundaries.sh:false"
   "security-dashboard-render:node tests/security/dashboard-render.cjs:false"
   "skill-catalog:bash scripts/validate-skill-catalog.sh:false"
+  # Guard-git judges git argv, not substrings; shell and TS must agree (#184).
+  "guard-git-normalize:bash scripts/test-guard-git-normalize.sh:false"
   "specs-parse:bash scripts/validate-specs-yaml.sh:false"
   # The runner itself: failing output is shown, skips are named and reasoned.
   "golden-gate-runner:bash scripts/test-golden-gate-runner.sh:false"

package/scripts/omp-guard-probe.ts

@@ -0,0 +1,46 @@
+// story: BUG-2026-11-03-guard-git-flag-normalize
+// story: BUG-2026-11-03-guard-normalize-branch-context
+// omp-guard-probe.ts — evaluate shell commands through the extension's guard,
+// so the TypeScript rules can be held to the same fixture table as
+// hooks/pre-tool-use.sh (scripts/test-guard-git-normalize.sh).
+//
+// Usage: echo '[{"command":"git status","branch":"main"}, …]' | node scripts/omp-guard-probe.ts
+// Prints a JSON array of "block" | "allow", one per input row.
+//
+// It calls evaluateBashCall(), the same pure function the tool_call handler
+// calls — destructive argv rules AND the protected-branch/commit rules. Probing
+// only dangerousGitCommand() compared one rule against a whole hook, which is
+// how "git push --force-with-lease origin main" passed here and failed there.
+//
+// The branch context is supplied per row instead of fixed: protected-branch
+// rules answer differently on `main` than on a feature branch, so a hardcoded
+// branch made the table agree in one direction only and the gate went red the
+// moment it ran on `main`. The harness gives the shell hook the same per-row
+// branch (a throwaway repo checked out on it) and strips GIT_BIGPOWERS_LAND, so
+// neither verdict can depend on the machine or the checked-out branch.
+
+import { readFileSync } from "node:fs";
+import { evaluateBashCall } from "../extensions/omp-hooks.ts";
+
+const source = readFileSync(new URL("../extensions/omp-hooks.ts", import.meta.url), "utf8");
+const handlerStart = source.indexOf('pi.on("tool_call"');
+if (handlerStart < 0) throw new Error("tool_call handler not found in extensions/omp-hooks.ts");
+if (!source.slice(handlerStart).includes("evaluateBashCall(")) {
+  throw new Error("tool_call handler does not call evaluateBashCall() — the guard is not wired");
+}
+
+const DEFAULT_BRANCH = "fix/guard-git-normalize";
+type Row = { command: string; branch?: string };
+
+const input = JSON.parse(readFileSync(0, "utf8")) as Array<Row | string>;
+const rows: Row[] = input.map((row) => (typeof row === "string" ? { command: row } : row));
+const verdicts = rows.map((row) =>
+  evaluateBashCall(row.command, {
+    landMode: false,
+    hasRepo: true,
+    branchFor: () => row.branch ?? DEFAULT_BRANCH,
+  })
+    ? "block"
+    : "allow",
+);
+process.stdout.write(`${JSON.stringify(verdicts)}\n`);

package/scripts/test-generated-path-hook.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# story: e86s01
+# Test suite for generated-path edit blocking in pre-tool-use.sh.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+HOOK="$REPO_ROOT/hooks/pre-tool-use.sh"
+
+pass_count=0
+fail_count=0
+
+assert_denied() {
+  local label="$1"
+  local input="$2"
+  local output exit_code=0
+  output=$(echo "$input" | bash "$HOOK" 2>&1) || exit_code=$?
+  if [ "$exit_code" -ne 0 ] || echo "$output" | grep -q '"decision"[[:space:]]*:[[:space:]]*"deny"'; then
+    echo "  PASS $label"
+    pass_count=$((pass_count + 1))
+  else
+    echo "  FAIL $label (expected deny, got allow: $output)"
+    fail_count=$((fail_count + 1))
+  fi
+}
+
+assert_allowed() {
+  local label="$1"
+  local input="$2"
+  local output exit_code=0
+  output=$(echo "$input" | bash "$HOOK" 2>&1) || exit_code=$?
+  if [ "$exit_code" -eq 0 ] && ! echo "$output" | grep -q '"decision"[[:space:]]*:[[:space:]]*"deny"'; then
+    echo "  PASS $label"
+    pass_count=$((pass_count + 1))
+  else
+    echo "  FAIL $label (expected allow, got deny: $output)"
+    fail_count=$((fail_count + 1))
+  fi
+}
+
+echo "=== Generated Path Hook Tests (e86s01) ==="
+
+assert_denied "Deny direct edit to .cursor/rules" \
+  '{"tool": "Edit", "file_path": ".cursor/rules/skill.mdc"}'
+
+assert_denied "Deny direct edit to .gemini/extensions" \
+  '{"tool": "Write", "file_path": ".gemini/extensions/bigpowers/skills/skill.md"}'
+
+assert_allowed "Allow edit to source skills/ directory" \
+  '{"tool": "Edit", "file_path": "skills/plan-work/SKILL.md"}'
+
+echo ""
+echo "=== Summary: $pass_count passed, $fail_count failed ==="
+if [ "$fail_count" -gt 0 ]; then
+  exit 1
+fi
+exit 0

package/scripts/test-guard-git-normalize.sh

@@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+# story: BUG-2026-11-03-guard-git-flag-normalize
+# test-guard-git-normalize.sh — the guard must judge git ARGV, not substrings (#184).
+#
+# Literal patterns miss `git -C repo <destructive>` and `reset -q --hard`: the
+# destructive tokens survive, only their position changes. One fixture table
+# pins four things:
+#
+#   (a) the shell hook (hooks/pre-tool-use.sh) reaches the expected verdict
+#   (b) the TS extension reaches the same verdict — through evaluateBashCall(),
+#       the function the tool_call handler calls, so protected-branch and commit
+#       rules are compared too, not only the destructive-argv table
+#   (c) the two agree with each other on every row — that is what "consistent
+#       across Claude Code, Cursor and Gemini CLI modes" means
+#   (d) the rules that share the hook (commits, protected branch, JSON
+#       envelopes, the pi/OMP fallback) still behave
+#
+# Both sides run with GIT_BIGPOWERS_LAND stripped: land mode disables the
+# protected-branch block, so an inherited value would let a developer's shell
+# turn a red gate green (BUG-2026-11-03-guard-normalize-parity-vacuous).
+#
+# Both sides also run in a throwaway repo checked out on the row's `branch:`
+# (default: a feature branch). Protected-branch rules answer differently on
+# `main`, so pinning only the probe to a feature branch made the table agree in
+# one direction and go red as soon as CI ran it on `main`
+# (BUG-2026-11-03-guard-normalize-branch-context).
+#
+# The row loop runs inside one Python process: every row x (hook + probe) with a
+# Python start per row cost ~70s on a pyenv host, which is too much for a gate.
+#
+# Usage: bash scripts/test-guard-git-normalize.sh
+
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+source scripts/lib/python-env.sh
+source scripts/lib/test-assertions.sh
+resolve_python
+TA_PASS=0
+TA_FAIL=0
+FIXTURE="specs/verifications/fixtures/guard-git-normalize.yaml"
+
+echo "=== test-guard-git-normalize.sh ==="
+
+if [[ ! -f "$FIXTURE" ]]; then
+  ta_fail "fixture missing: $FIXTURE"
+  echo "$TA_PASS passed, $TA_FAIL failed"
+  exit 1
+fi
+
+REPORT=$($PYTHON - "$FIXTURE" <<'PY'
+import json, os, subprocess, sys, tempfile, yaml
+
+fixture = sys.argv[1]
+# Ambient LAND mode disables the protected-branch block. A gate that depends on
+# the developer's shell is not a gate (this masked a CI failure once).
+ENV = {k: v for k, v in os.environ.items() if k != "GIT_BIGPOWERS_LAND"}
+DEFAULT_BRANCH = "fix/guard-git-normalize"
+cases = yaml.safe_load(open(fixture, encoding="utf-8"))["cases"]
+rows = [{"command": c["command"], "branch": c.get("branch", DEFAULT_BRANCH)} for c in cases]
+
+# (b) one node start for every row.
+probe = subprocess.run(
+    ["node", "scripts/omp-guard-probe.ts"],
+    input=json.dumps(rows), capture_output=True, text=True,
+)
+if probe.returncode != 0:
+    print(f"PROBE_ERROR {probe.stderr.strip().splitlines()[-1][:300] if probe.stderr.strip() else 'no stderr'}")
+    sys.exit(0)
+ts = json.loads(probe.stdout.strip().splitlines()[-1])
+
+
+def make_repo(root, branch):
+    """A throwaway repo on `branch`, so the hook resolves that branch as HEAD."""
+    path = os.path.join(root, f"repo-{len(os.listdir(root))}")
+    def git(*args):
+        subprocess.run(["git", "-C", path, *args], check=True, capture_output=True)
+    subprocess.run(["git", "init", "-q", "-b", "main", path], check=True, capture_output=True)
+    git("config", "user.email", "fixture@example.com")
+    git("config", "user.name", "fixture")
+    git("commit", "-q", "--allow-empty", "-m", "init")
+    if branch != "main":
+        git("checkout", "-q", "-b", branch)
+    return path
+
+
+hook = os.path.abspath("hooks/pre-tool-use.sh")
+shell_fails = ts_fails = disagree = 0
+with tempfile.TemporaryDirectory() as tmp:
+    repos = {}
+    for case, row, ts_verdict in zip(cases, rows, ts):
+        branch = row["branch"]
+        if branch not in repos:
+            repos[branch] = make_repo(tmp, branch)
+        payload = json.dumps({"command": row["command"]})
+        run = subprocess.run(
+            ["bash", hook], input=payload, capture_output=True, text=True,
+            env=ENV, cwd=repos[branch],
+        )
+        shell_verdict = "block" if run.returncode == 2 else "allow"
+        expected = case["verdict"]
+        if shell_verdict != expected:
+            shell_fails += 1
+            print(f"SHELL_FAIL expected={expected} got={shell_verdict} :: {row['command']}")
+        if ts_verdict != expected:
+            ts_fails += 1
+            print(f"TS_FAIL expected={expected} got={ts_verdict} :: {row['command']}")
+        if shell_verdict != ts_verdict:
+            disagree += 1
+            print(f"PARITY_FAIL shell={shell_verdict} ts={ts_verdict} :: {row['command']}")
+
+print(f"RESULT rows={len(cases)} shell_fails={shell_fails} ts_fails={ts_fails} disagree={disagree}")
+PY
+)
+
+if [[ "$REPORT" == PROBE_ERROR* ]]; then
+  ta_fail "TS probe failed: ${REPORT#PROBE_ERROR }"
+else
+  # sed, not grep: grep exits 1 when there is nothing to show, and pipefail
+  # would turn a perfectly green run into a failure.
+  printf '%s\n' "$REPORT" | sed -n 's/^\(SHELL_FAIL\|TS_FAIL\|PARITY_FAIL\)/  \1/p'
+  read -r _ ROWS SHELL_FAILS TS_FAILS DISAGREE <<< "$(grep '^RESULT' <<< "$REPORT")"
+  ROWS=${ROWS#rows=}; SHELL_FAILS=${SHELL_FAILS#shell_fails=}
+  TS_FAILS=${TS_FAILS#ts_fails=}; DISAGREE=${DISAGREE#disagree=}
+
+  [ "${SHELL_FAILS:-1}" -eq 0 ] \
+    && ta_pass "(a) shell hook matches all $ROWS fixture rows" \
+    || ta_fail "(a) shell hook missed $SHELL_FAILS of $ROWS rows (see above)"
+  [ "${TS_FAILS:-1}" -eq 0 ] \
+    && ta_pass "(b) TS extension matches all $ROWS fixture rows" \
+    || ta_fail "(b) TS extension missed $TS_FAILS of $ROWS rows (see above)"
+  [ "${DISAGREE:-1}" -eq 0 ] \
+    && ta_pass "(c) shell and TS agree on all $ROWS rows" \
+    || ta_fail "(c) shell and TS disagree on $DISAGREE of $ROWS rows (see above)"
+fi
+
+# ── (d) the rules that share this hook must keep working ────────────────────
+# The normalizer replaced the pattern loop in the same handler; a regression in
+# the neighbouring checks (protected branches, Conventional Commits, the gemini
+# JSON envelope, the pi/OMP fallback) would be invisible to the rows above.
+#
+# These run in a throwaway repo on a feature branch, like the rows: "a commit is
+# allowed" is only true off `main`, and the gate itself runs on `main` after a
+# merge. Duplicating the repo setup here keeps each block self-contained.
+json_cmd() { $PYTHON -c 'import json,sys;print(json.dumps({"command": sys.argv[1]}))' "$1"; }
+FEATURE_REPO="$($PYTHON - "$(mktemp -d)" <<'PY'
+import subprocess, sys
+path = sys.argv[1]
+def git(*args):
+    subprocess.run(["git", "-C", path, *args], check=True, capture_output=True)
+subprocess.run(["git", "init", "-q", "-b", "main", path], check=True, capture_output=True)
+git("config", "user.email", "fixture@example.com")
+git("config", "user.name", "fixture")
+git("commit", "-q", "--allow-empty", "-m", "init")
+git("checkout", "-q", "-b", "fix/guard-git-normalize")
+print(path)
+PY
+)"
+adjacent() { # name want_rc command [hook]
+  local name="$1" want="$2" command="$3" hook="${4:-}" rc
+  hook="${hook:-$REPO_ROOT/hooks/pre-tool-use.sh}"
+  cd "$FEATURE_REPO" || ta_fail "(d) $name: cannot enter fixture repo"
+  json_cmd "$command" | env -u GIT_BIGPOWERS_LAND bash "$hook" >/dev/null 2>&1 && rc=0 || rc=$?
+  cd "$REPO_ROOT" || true
+  [ "$rc" -eq "$want" ] || ta_fail "(d) $name: rc=$rc (want $want) — $command"
+}
+adjacent "plain status allowed" 0 "git status"
+adjacent "conventional commit allowed" 0 'git commit -m "fix(scope): subject"'
+adjacent "feature push allowed" 0 "git push origin feature/x"
+adjacent "non-conventional commit blocked" 2 'git commit -m "bad message"'
+rm -rf "$FEATURE_REPO"
+
+DESTRUCTIVE="git reset --hard"
+GEMINI_OUT=$(json_cmd "$DESTRUCTIVE" | env -u GIT_BIGPOWERS_LAND GIT_GUARDRAILS_MODE=gemini bash hooks/pre-tool-use.sh 2>&1)
+echo "$GEMINI_OUT" | grep -q '"decision": *"deny"' \
+  || ta_fail "(d) gemini mode must emit deny JSON, got: $(echo "$GEMINI_OUT" | head -c 120)"
+
+PI_OUT=$(json_cmd "$DESTRUCTIVE" | env -u GIT_BIGPOWERS_LAND bash hooks/pre/bash.sh 2>&1)
+echo "$PI_OUT" | grep -q '"decision":"block"' \
+  || ta_fail "(d) pi/OMP fallback must emit block JSON, got: $(echo "$PI_OUT" | head -c 120)"
+
+bash -n hooks/pre/bash.sh || ta_fail "(d) hooks/pre/bash.sh must parse"
+grep -q "classify_git_argv" hooks/pre/bash.sh \
+  || ta_fail "(d) pi/OMP fallback must use the normalized classifier"
+ta_pass "(d) adjacent rules: commits, pushes, gemini JSON, pi fallback"
+
+echo "$TA_PASS passed, $TA_FAIL failed"
+[[ "$TA_FAIL" -eq 0 ]]

package/scripts/test-test-lock-hook.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# story: e86s02
+# Test suite for test-lock hook and RED-commit verification in pre-tool-use.sh.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+HOOK="$REPO_ROOT/hooks/pre-tool-use.sh"
+
+pass_count=0
+fail_count=0
+
+assert_denied() {
+  local label="$1"
+  local input="$2"
+  local expected_substr="${3:-}"
+  local output exit_code=0
+  output=$(echo "$input" | bash "$HOOK" 2>&1) || exit_code=$?
+  if [ "$exit_code" -ne 0 ] || echo "$output" | grep -q '"decision"[[:space:]]*:[[:space:]]*"deny"'; then
+    if [ -n "$expected_substr" ] && ! echo "$output" | grep -qi "$expected_substr"; then
+      echo "  FAIL $label (expected to contain '$expected_substr', got: $output)"
+      fail_count=$((fail_count + 1))
+    else
+      echo "  PASS $label"
+      pass_count=$((pass_count + 1))
+    fi
+  else
+    echo "  FAIL $label (expected deny, but was allowed: $output)"
+    fail_count=$((fail_count + 1))
+  fi
+}
+
+assert_allowed() {
+  local label="$1"
+  local input="$2"
+  local output exit_code=0
+  output=$(echo "$input" | bash "$HOOK" 2>&1) || exit_code=$?
+  if [ "$exit_code" -eq 0 ] && ! echo "$output" | grep -q '"decision"[[:space:]]*:[[:space:]]*"deny"'; then
+    echo "  PASS $label"
+    pass_count=$((pass_count + 1))
+  else
+    echo "  FAIL $label (expected allow, but was denied: $output)"
+    fail_count=$((fail_count + 1))
+  fi
+}
+
+echo "=== Test Locking Hook Tests (e86s02) ==="
+
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+cd "$TMP_DIR"
+git init -q
+git config user.email "test@bigpowers.local"
+git config user.name "test"
+mkdir -p specs test src
+
+cat > specs/state.yaml <<'YAML'
+active_flow: fix_bug
+YAML
+
+echo "initial" > src/app.js
+git add .
+git commit -q -m "feat(app): initial commit"
+
+# 1. Without a RED commit yet during fix_bug, test edits should be allowed (to author the RED test)
+assert_allowed "Test file edit allowed when authoring RED test" \
+  '{"tool": "Edit", "file_path": "test/app.test.js"}'
+
+# 2. Commit a RED test
+echo "test red" > test/app.test.js
+git add test/app.test.js
+git commit -q -m "test(app): red test reproducing defect"
+
+# 3. Now that a RED commit exists and active_flow is fix_bug, test edits must be LOCKED
+assert_denied "Test file edit denied after RED commit in fix_bug" \
+  '{"tool": "Edit", "file_path": "test/app.test.js"}' \
+  "locked"
+
+assert_denied "Test file write denied after RED commit in fix_bug" \
+  '{"tool": "Write", "file_path": "tests/test_other.py"}' \
+  "locked"
+
+# 4. Source file edits must remain allowed
+assert_allowed "Source file edit allowed after RED commit in fix_bug" \
+  '{"tool": "Edit", "file_path": "src/app.js"}'
+
+# 5. When active_flow is not fix_bug, test edits are allowed
+cat > specs/state.yaml <<'YAML'
+active_flow: build_epic
+YAML
+assert_allowed "Test file edit allowed when active_flow is not fix_bug" \
+  '{"tool": "Edit", "file_path": "test/app.test.js"}'
+
+echo ""
+echo "=== Summary: $pass_count passed, $fail_count failed ==="
+if [ "$fail_count" -gt 0 ]; then
+  exit 1
+fi
+exit 0

package/scripts/validate-doctrine.sh

@@ -79,7 +79,7 @@ fi
 #   specs/verifications/reports/ (generated reports), PLAN-evolve-structure.md
 #   (migration plan that documents the before→after paths as historical record).
 echo "--- [Epic 2] canonical specs/ subpaths ---"
-LEGACY_SPECS=$(grep -rE "specs/(requirements|plans|audit)\b" \
+LEGACY_SPECS=$(grep -rE --exclude-dir=.claude --exclude-dir=.venv "specs/(requirements|plans|audit)\b" \
   --include="*.md" --include="*.sh" --include="*.yaml" --include="*.yml" --include="*.json" . \
   2>/dev/null \
   | grep -v "specs/archive\|specs/epics/archive\|docs/archive/\|\.git\|node_modules\|\.gemini\|\.cursor" \
@@ -89,7 +89,7 @@ if [[ "$LEGACY_SPECS" -eq 0 ]]; then
   doctrine_pass "no legacy specs/ subpaths (requirements/, plans/, audit/)"
 else
   doctrine_fail "legacy specs/ subpaths found ($LEGACY_SPECS occurrences)"
-  grep -rE "specs/(requirements|plans|audit)\b" \
+  grep -rE --exclude-dir=.claude --exclude-dir=.venv "specs/(requirements|plans|audit)\b" \
     --include="*.md" --include="*.sh" --include="*.yaml" --include="*.yml" --include="*.json" . \
     2>/dev/null \
     | grep -v "specs/archive\|specs/epics/archive\|docs/archive/\|\.git\|node_modules\|\.gemini\|\.cursor" \
@@ -99,14 +99,14 @@ fi
 
 # ── Epic 3: BCP slop guard ────────────────────────────────────────────────────
 echo "--- [Epic 3] BCP terminology ---"
-BCP_SLOP=$(grep -ri "build commit point" . 2>/dev/null \
+BCP_SLOP=$(grep -ri --exclude-dir=.claude --exclude-dir=.venv --exclude-dir=.git --exclude-dir=node_modules "build commit point" . 2>/dev/null \
   | grep -v "specs/archive\|\.git\|node_modules\|\.gemini\|\.cursor\|validate-doctrine\.sh" \
   | wc -l | tr -d ' ') || true
 if [[ "$BCP_SLOP" -eq 0 ]]; then
   doctrine_pass "no 'Build Commit Point' slop — BCP = Business Complexity Points"
 else
   doctrine_fail "'Build Commit Point' found ($BCP_SLOP hits) — canonical term is 'Business Complexity Points'; see docs/references/bcp.md"
-  grep -ri "build commit point" . 2>/dev/null \
+  grep -ri --exclude-dir=.claude --exclude-dir=.venv --exclude-dir=.git --exclude-dir=node_modules "build commit point" . 2>/dev/null \
     | grep -v "specs/archive\|\.git\|node_modules\|\.gemini\|\.cursor\|validate-doctrine\.sh" | sed -n '1,5p' >&2
 fi