cleargate 0.14.0 → 0.15.1

package/templates/cleargate-planning/.cleargate/scripts/test/cr078_init.test.sh

@@ -0,0 +1,309 @@
+#!/usr/bin/env bash
+# cr078_init.test.sh — CR-078 verification harness.
+#
+# Verifies F1 (.active sentinel write) and F2 (SDR lane audit ingest) are
+# correctly implemented in init_sprint.mjs.
+#
+# All assertions run in FULL ISOLATION — mktemp -d scratch project dirs with
+# their own .cleargate/sprint-runs/ trees. The REAL repo .active is NEVER touched.
+# Safety invariant: after this harness exits, cat <repo>/.cleargate/sprint-runs/.active
+# MUST still read SPRINT-34 (the running sprint).
+#
+# Assertions:
+#   1. .active write: init a scratch SPRINT-99 → cat <temp>/.active == SPRINT-99
+#   2. WARN on differing prior: seed .active=SPRINT-50, init SPRINT-99 →
+#      stderr contains WARN, .active becomes SPRINT-99
+#   3. Lane ingest via waves.json: seed lane_assignments marking one story fast →
+#      state.json lane==fast + lane_assigned_by==sdr-lane-audit; undeclared story stays standard
+#   4. Lane ingest fallback via §2.4: no waves.json but Sprint Plan with §2.4 Lane Audit
+#      marking a story fast → same result
+#   5. Regression: grep -c '\.active' init_sprint.mjs ≥ 1 (was 0 before CR-078)
+#
+# Exit 0 = PASS (all assertions pass); exit 1 = one or more FAIL.
+#
+# Harness self-cleans (trap EXIT removes temp dirs). NEVER touches the real repo .active.
+# macOS bash 3.2 portable.
+# FLASHCARD #test-harness #bash 2026-06-04: use CLEARGATE_REPO_ROOT + CLEARGATE_ADVISORY=1
+#   to isolate init_sprint.mjs into a scratch tmpdir without real delivery files.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+INIT_SCRIPT="${REPO_ROOT}/.cleargate/scripts/init_sprint.mjs"
+CONSTANTS_SCRIPT="${REPO_ROOT}/.cleargate/scripts/constants.mjs"
+
+PASS=0
+FAIL=0
+
+# Track temp dirs for cleanup
+TEMP_DIRS=()
+
+pass() {
+  echo "PASS: $1"
+  PASS=$((PASS + 1))
+}
+
+fail() {
+  echo "FAIL: $1"
+  echo "      detail: $2"
+  FAIL=$((FAIL + 1))
+}
+
+# ── Teardown / trap ───────────────────────────────────────────────────────────
+cleanup() {
+  for d in "${TEMP_DIRS[@]+"${TEMP_DIRS[@]}"}"; do
+    if [[ -d "${d}" ]]; then
+      rm -rf "${d}"
+    fi
+  done
+}
+trap cleanup EXIT
+
+# ── Helper: create a minimal scratch project dir ──────────────────────────────
+# Each scratch dir gets its own .cleargate/sprint-runs/ tree.
+# We seed a minimal constants.mjs symlink so the script can import it.
+make_scratch() {
+  local tmpdir
+  tmpdir="$(mktemp -d)"
+  TEMP_DIRS+=("${tmpdir}")
+  # Create the sprint-runs dir
+  mkdir -p "${tmpdir}/.cleargate/sprint-runs"
+  # Create a minimal scripts dir (symlink to real scripts so import works)
+  mkdir -p "${tmpdir}/.cleargate/scripts"
+  # Symlink constants.mjs so the import resolves (init_sprint.mjs uses __dirname
+  # for the scripts dir, NOT CLEARGATE_REPO_ROOT — so we pass CLEARGATE_REPO_ROOT
+  # only for file-path resolution, not for module loading).
+  echo "${tmpdir}"
+}
+
+# ── Pre-check: init_sprint.mjs must exist ────────────────────────────────────
+if [[ ! -f "${INIT_SCRIPT}" ]]; then
+  fail "pre-check" "init_sprint.mjs not found at ${INIT_SCRIPT}"
+  echo ""
+  echo "cr078_init.test.sh: ${PASS} passed, ${FAIL} failed"
+  exit 1
+fi
+
+# ── ASSERTION 5 (regression): grep count for .active references ───────────────
+# Was 0 before CR-078; must be ≥ 1 after.
+ACTIVE_COUNT="$(grep -c '\.active' "${INIT_SCRIPT}" || true)"
+if [[ "${ACTIVE_COUNT}" -ge 1 ]]; then
+  pass "5-regression: init_sprint.mjs contains ≥1 .active reference (count=${ACTIVE_COUNT})"
+else
+  fail "5-regression: init_sprint.mjs has 0 .active references — F1 not implemented" \
+    "grep -c '.active' returned ${ACTIVE_COUNT}"
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION 1: .active write — init SPRINT-99 in scratch dir → .active == SPRINT-99
+# ────────────────────────────────────────────────────────────────────────────
+SCRATCH1="$(make_scratch)"
+mkdir -p "${SCRATCH1}/.cleargate/sprint-runs/SPRINT-99"
+
+# Run init_sprint.mjs with CLEARGATE_REPO_ROOT pointing to scratch dir.
+# CLEARGATE_ADVISORY=1 bypasses story-file assertion (no delivery/ in scratch dir).
+INIT_STDERR1="$(
+  CLEARGATE_REPO_ROOT="${SCRATCH1}" CLEARGATE_ADVISORY=1 \
+    node "${INIT_SCRIPT}" SPRINT-99 --stories STORY-99-01 --force 2>&1 >/dev/null
+)"
+INIT_EXIT1=$?
+
+ACTIVE_VAL1=""
+if [[ -f "${SCRATCH1}/.cleargate/sprint-runs/.active" ]]; then
+  ACTIVE_VAL1="$(cat "${SCRATCH1}/.cleargate/sprint-runs/.active" | tr -d '\n')"
+fi
+
+if [[ "${ACTIVE_VAL1}" = "SPRINT-99" ]]; then
+  pass "1-active-write: .active == SPRINT-99 after init"
+else
+  fail "1-active-write: .active not set to SPRINT-99" \
+    "got '${ACTIVE_VAL1}'; init exit=${INIT_EXIT1}; stderr: ${INIT_STDERR1}"
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION 2: WARN on differing prior — seed .active=SPRINT-50, init SPRINT-99
+# ────────────────────────────────────────────────────────────────────────────
+SCRATCH2="$(make_scratch)"
+mkdir -p "${SCRATCH2}/.cleargate/sprint-runs/SPRINT-99"
+# Pre-seed .active with a different sprint
+printf 'SPRINT-50\n' > "${SCRATCH2}/.cleargate/sprint-runs/.active"
+
+INIT_STDERR2="$(
+  CLEARGATE_REPO_ROOT="${SCRATCH2}" CLEARGATE_ADVISORY=1 \
+    node "${INIT_SCRIPT}" SPRINT-99 --stories STORY-99-01 --force 2>&1 >/dev/null
+)"
+
+ACTIVE_VAL2=""
+if [[ -f "${SCRATCH2}/.cleargate/sprint-runs/.active" ]]; then
+  ACTIVE_VAL2="$(cat "${SCRATCH2}/.cleargate/sprint-runs/.active" | tr -d '\n')"
+fi
+
+# Check .active updated
+if [[ "${ACTIVE_VAL2}" = "SPRINT-99" ]]; then
+  pass "2a-warn-prior: .active updated to SPRINT-99 despite prior SPRINT-50"
+else
+  fail "2a-warn-prior: .active not updated" \
+    "got '${ACTIVE_VAL2}'"
+fi
+
+# Check WARN emitted
+if echo "${INIT_STDERR2}" | grep -q "WARN: .active was SPRINT-50"; then
+  pass "2b-warn-prior: WARN message emitted on stderr"
+else
+  fail "2b-warn-prior: expected WARN about prior .active on stderr" \
+    "stderr was: ${INIT_STDERR2}"
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION 3: Lane ingest via waves.json
+# ────────────────────────────────────────────────────────────────────────────
+SCRATCH3="$(make_scratch)"
+mkdir -p "${SCRATCH3}/.cleargate/sprint-runs/SPRINT-99/plans"
+
+# Seed waves.json with lane_assignments marking STORY-99-01 as fast
+cat > "${SCRATCH3}/.cleargate/sprint-runs/SPRINT-99/plans/waves.json" <<'EOF'
+{
+  "sprint": "SPRINT-99",
+  "generated_at": "2026-06-04T00:00:00Z",
+  "waves": [
+    {
+      "wave": "wave1",
+      "stories": ["STORY-99-01", "STORY-99-02"],
+      "parallel": false,
+      "rationale": "test wave"
+    }
+  ],
+  "lane_assignments": {
+    "STORY-99-01": "fast"
+  }
+}
+EOF
+
+INIT_STDERR3="$(
+  CLEARGATE_REPO_ROOT="${SCRATCH3}" CLEARGATE_ADVISORY=1 \
+    node "${INIT_SCRIPT}" SPRINT-99 --stories STORY-99-01,STORY-99-02 --force 2>&1 >/dev/null
+)"
+
+STATE3="${SCRATCH3}/.cleargate/sprint-runs/SPRINT-99/state.json"
+if [[ ! -f "${STATE3}" ]]; then
+  fail "3-waves-lane: state.json not written" \
+    "init stderr: ${INIT_STDERR3}"
+else
+  LANE3_01="$(node -e "const s=require('${STATE3}'); process.stdout.write(s.stories['STORY-99-01'].lane)" 2>/dev/null || echo 'ERROR')"
+  LANE_BY3_01="$(node -e "const s=require('${STATE3}'); process.stdout.write(s.stories['STORY-99-01'].lane_assigned_by)" 2>/dev/null || echo 'ERROR')"
+  LANE3_02="$(node -e "const s=require('${STATE3}'); process.stdout.write(s.stories['STORY-99-02'].lane)" 2>/dev/null || echo 'ERROR')"
+  LANE_BY3_02="$(node -e "const s=require('${STATE3}'); process.stdout.write(s.stories['STORY-99-02'].lane_assigned_by)" 2>/dev/null || echo 'ERROR')"
+
+  if [[ "${LANE3_01}" = "fast" ]]; then
+    pass "3a-waves-lane: STORY-99-01 lane==fast (declared in waves.json)"
+  else
+    fail "3a-waves-lane: STORY-99-01 lane expected 'fast'" \
+      "got '${LANE3_01}'"
+  fi
+
+  if [[ "${LANE_BY3_01}" = "sdr-lane-audit" ]]; then
+    pass "3b-waves-lane: STORY-99-01 lane_assigned_by==sdr-lane-audit"
+  else
+    fail "3b-waves-lane: STORY-99-01 lane_assigned_by expected 'sdr-lane-audit'" \
+      "got '${LANE_BY3_01}'"
+  fi
+
+  if [[ "${LANE3_02}" = "standard" ]]; then
+    pass "3c-waves-lane: STORY-99-02 (undeclared) lane==standard"
+  else
+    fail "3c-waves-lane: STORY-99-02 lane expected 'standard' (undeclared)" \
+      "got '${LANE3_02}'"
+  fi
+
+  if [[ "${LANE_BY3_02}" = "migration-default" ]]; then
+    pass "3d-waves-lane: STORY-99-02 lane_assigned_by==migration-default (undeclared)"
+  else
+    fail "3d-waves-lane: STORY-99-02 lane_assigned_by expected 'migration-default'" \
+      "got '${LANE_BY3_02}'"
+  fi
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION 4: Lane ingest fallback via §2.4 — no waves.json, sprint plan with Lane Audit
+# ────────────────────────────────────────────────────────────────────────────
+SCRATCH4="$(make_scratch)"
+mkdir -p "${SCRATCH4}/.cleargate/sprint-runs/SPRINT-99"
+mkdir -p "${SCRATCH4}/.cleargate/delivery/pending-sync"
+
+# Create a minimal sprint plan with a §2.4 Lane Audit table (no waves.json)
+cat > "${SCRATCH4}/.cleargate/delivery/pending-sync/SPRINT-99_Test_Sprint.md" <<'EOF'
+---
+status: Active
+approved: true
+---
+# SPRINT-99: Test Sprint
+
+## 0. Frontmatter
+- **Sprint Goal:** Test lane ingest fallback
+
+## 2. Execution Strategy
+
+### 2.4 Lane Audit
+
+| Story | Lane | Rationale (≤80 chars) |
+|---|---|---|
+| `STORY-99-01` | fast | Isolated fix, no agent surface |
+
+### 2.5 ADR-Conflict Flags
+None.
+EOF
+
+INIT_STDERR4="$(
+  CLEARGATE_REPO_ROOT="${SCRATCH4}" CLEARGATE_ADVISORY=1 \
+    node "${INIT_SCRIPT}" SPRINT-99 --stories STORY-99-01,STORY-99-02 --force 2>&1 >/dev/null
+)"
+
+STATE4="${SCRATCH4}/.cleargate/sprint-runs/SPRINT-99/state.json"
+if [[ ! -f "${STATE4}" ]]; then
+  fail "4-plan-lane: state.json not written" \
+    "init stderr: ${INIT_STDERR4}"
+else
+  LANE4_01="$(node -e "const s=require('${STATE4}'); process.stdout.write(s.stories['STORY-99-01'].lane)" 2>/dev/null || echo 'ERROR')"
+  LANE_BY4_01="$(node -e "const s=require('${STATE4}'); process.stdout.write(s.stories['STORY-99-01'].lane_assigned_by)" 2>/dev/null || echo 'ERROR')"
+  LANE4_02="$(node -e "const s=require('${STATE4}'); process.stdout.write(s.stories['STORY-99-02'].lane)" 2>/dev/null || echo 'ERROR')"
+
+  if [[ "${LANE4_01}" = "fast" ]]; then
+    pass "4a-plan-lane: STORY-99-01 lane==fast (declared in §2.4 Lane Audit table)"
+  else
+    fail "4a-plan-lane: STORY-99-01 lane expected 'fast'" \
+      "got '${LANE4_01}'; stderr: ${INIT_STDERR4}"
+  fi
+
+  if [[ "${LANE_BY4_01}" = "sdr-lane-audit" ]]; then
+    pass "4b-plan-lane: STORY-99-01 lane_assigned_by==sdr-lane-audit"
+  else
+    fail "4b-plan-lane: STORY-99-01 lane_assigned_by expected 'sdr-lane-audit'" \
+      "got '${LANE_BY4_01}'"
+  fi
+
+  if [[ "${LANE4_02}" = "standard" ]]; then
+    pass "4c-plan-lane: STORY-99-02 (undeclared) lane==standard"
+  else
+    fail "4c-plan-lane: STORY-99-02 lane expected 'standard'" \
+      "got '${LANE4_02}'"
+  fi
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# SAFETY: Verify the real repo .active is still SPRINT-34
+# ────────────────────────────────────────────────────────────────────────────
+REAL_ACTIVE="$(cat "${REPO_ROOT}/.cleargate/sprint-runs/.active" | tr -d '\n')"
+if [[ "${REAL_ACTIVE}" = "SPRINT-34" ]]; then
+  pass "safety: real repo .active still == SPRINT-34 (not clobbered)"
+else
+  fail "SAFETY VIOLATION: real repo .active clobbered!" \
+    "expected SPRINT-34, got '${REAL_ACTIVE}'"
+fi
+
+# ── Summary ───────────────────────────────────────────────────────────────────
+echo ""
+echo "cr078_init.test.sh: ${PASS} passed, ${FAIL} failed"
+if [[ "${FAIL}" -gt 0 ]]; then
+  exit 1
+fi
+exit 0

package/templates/cleargate-planning/.cleargate/scripts/test/cr079_provision.red.sh

@@ -0,0 +1,262 @@
+#!/usr/bin/env bash
+# cr079_provision.red.sh — CR-079 QA-Red provision test harness.
+#
+# RED: fails against clean baseline — provision_worktree_config.sh does not yet
+# exist, so the .env is never provisioned into the test worktree, and the
+# stray_env_files scan has no exemption for provisioned config.
+# GREEN: passes after Developer implements CR-079 (provision script created +
+# pre_gate_runner.sh exemption branch + config.yml worktree.provision_config).
+#
+# Assertions (per M1 §5 / CR §4):
+#   1. Provision (symlink): provision script creates .env symlink in worktree
+#      pointing to absolute repo-root .env.
+#   2. Scan PASS (exempted): with the provisioned .env present, stray_env_files
+#      scan records PASS (provisioned file is exempt, not stray).
+#   3. Negative control: a non-provisioned .env.local in the worktree makes the
+#      scan record stray_env_files FAIL (exemption is scoped, not blanket).
+#   4. Teardown: no dangling symlink at repo root; fixture .env cleaned up; no
+#      leftover worktree.
+#
+# The harness is self-cleaning even on assertion failure: trap EXIT removes the
+# test worktree, any fixture .env created at repo root, and the test branch.
+#
+# Mirrors: cr077_eviction.red.sh / test_prep_qa_context.sh harness shape.
+# macOS bash 3.2 portable.
+# FLASHCARD #test-harness #bash 2026-06-03: never use `grep -c … || echo 0`
+#   (doubles on zero-match). Use grep -q or grep -c … | head -1.
+#
+# Exit 0 = PASS (all assertions pass); exit 1 = one or more FAIL.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+
+PASS=0
+FAIL=0
+
+pass() {
+  echo "PASS: $1"
+  PASS=$((PASS + 1))
+}
+
+fail() {
+  echo "FAIL: $1"
+  echo "      detail: $2"
+  FAIL=$((FAIL + 1))
+}
+
+# ── Constants ────────────────────────────────────────────────────────────────
+TEST_BRANCH="test/079"
+TEST_WORKTREE="${REPO_ROOT}/.worktrees/TEST-079"
+PROVISION_SCRIPT="${REPO_ROOT}/.cleargate/scripts/provision_worktree_config.sh"
+PRE_GATE_SCRIPT="${REPO_ROOT}/.cleargate/scripts/pre_gate_runner.sh"
+FIXTURE_ENV="${REPO_ROOT}/.env"
+# Report path written by pre_gate_runner.sh arch mode
+SCAN_REPORT="${TEST_WORKTREE}/.cleargate/reports/pre-arch-scan.txt"
+
+# Track whether the harness created the fixture .env at repo root
+HARNESS_CREATED_ENV=0
+
+# ── Teardown / trap ───────────────────────────────────────────────────────────
+cleanup() {
+  # Remove test worktree (force — even if dirty)
+  if git -C "${REPO_ROOT}" worktree list 2>/dev/null | grep -q "${TEST_WORKTREE}"; then
+    git -C "${REPO_ROOT}" worktree remove --force "${TEST_WORKTREE}" 2>/dev/null || true
+    git -C "${REPO_ROOT}" worktree prune 2>/dev/null || true
+  fi
+  # Remove worktree directory if still present
+  if [[ -d "${TEST_WORKTREE}" ]]; then
+    rm -rf "${TEST_WORKTREE}"
+  fi
+  # Remove test branch if it exists
+  if git -C "${REPO_ROOT}" branch --list "${TEST_BRANCH}" | grep -q "${TEST_BRANCH}"; then
+    git -C "${REPO_ROOT}" branch -D "${TEST_BRANCH}" 2>/dev/null || true
+  fi
+  # Remove fixture .env only if harness created it and it's still a real file
+  if [[ "${HARNESS_CREATED_ENV}" -eq 1 && -f "${FIXTURE_ENV}" && ! -L "${FIXTURE_ENV}" ]]; then
+    rm -f "${FIXTURE_ENV}"
+  fi
+}
+trap cleanup EXIT
+
+# ── Pre-check: fixture .env at repo root ─────────────────────────────────────
+# The repo has no .env (gitignored). Create a fixture so the provision script
+# has a real source file to symlink from.
+if [[ ! -e "${FIXTURE_ENV}" ]]; then
+  printf 'CR079_FIXTURE=1\n' > "${FIXTURE_ENV}"
+  HARNESS_CREATED_ENV=1
+fi
+
+# ── Setup: create test worktree ───────────────────────────────────────────────
+# Clean up any stale worktree/branch from a previous interrupted run.
+if git -C "${REPO_ROOT}" worktree list 2>/dev/null | grep -q "TEST-079"; then
+  git -C "${REPO_ROOT}" worktree remove --force "${TEST_WORKTREE}" 2>/dev/null || true
+  git -C "${REPO_ROOT}" worktree prune 2>/dev/null || true
+fi
+if [[ -d "${TEST_WORKTREE}" ]]; then
+  rm -rf "${TEST_WORKTREE}"
+fi
+if git -C "${REPO_ROOT}" branch --list "${TEST_BRANCH}" | grep -q "${TEST_BRANCH}"; then
+  git -C "${REPO_ROOT}" branch -D "${TEST_BRANCH}" 2>/dev/null || true
+fi
+
+git -C "${REPO_ROOT}" worktree add "${TEST_WORKTREE}" -b "${TEST_BRANCH}" HEAD \
+  > /dev/null 2>&1
+if [[ ! -d "${TEST_WORKTREE}" ]]; then
+  fail "setup-worktree" "git worktree add failed — ${TEST_WORKTREE} does not exist"
+  echo ""
+  echo "cr079_provision.red.sh: ${PASS} passed, ${FAIL} failed"
+  exit 1
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION 1: Provision script creates .env symlink in worktree
+# ────────────────────────────────────────────────────────────────────────────
+# On the clean baseline: provision_worktree_config.sh does not exist → fails.
+
+if [[ ! -f "${PROVISION_SCRIPT}" ]]; then
+  fail "provision-script-exists" \
+    "provision_worktree_config.sh does not exist at ${PROVISION_SCRIPT}"
+else
+  pass "provision-script-exists"
+  # Script exists — run it and check the resulting symlink
+  bash "${PROVISION_SCRIPT}" "${TEST_WORKTREE}" > /dev/null 2>&1 || true
+fi
+
+if [[ -L "${TEST_WORKTREE}/.env" ]]; then
+  SYMLINK_TARGET="$(readlink "${TEST_WORKTREE}/.env")"
+  if [[ "${SYMLINK_TARGET}" = "${FIXTURE_ENV}" ]]; then
+    pass "provision-symlink-target — readlink resolves to absolute repo-root .env"
+  else
+    fail "provision-symlink-target" \
+      "readlink='${SYMLINK_TARGET}' — expected absolute path '${FIXTURE_ENV}'"
+  fi
+else
+  # Expected on clean baseline: provision script never ran → no symlink
+  fail "provision-symlink-exists" \
+    "${TEST_WORKTREE}/.env does not exist (provision script never ran or failed)"
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION 2: Scan records PASS for provisioned .env (exemption in place)
+# ────────────────────────────────────────────────────────────────────────────
+# Pre-condition: the .env must actually be present in the worktree for this
+# assertion to be meaningful. On clean baseline, no .env was provisioned, so
+# the scan trivially PASSes (nothing to flag). This means assertion 2 does NOT
+# fail on the baseline solely due to the missing script — but we need it to
+# FAIL to prove the exemption logic. We therefore MANUALLY place a .env symlink
+# into the worktree here (mirroring what a real provision step would do), then
+# run the scan. On clean baseline the scan will record FAIL because the
+# exemption branch does not exist. After implementation the scan records PASS
+# because the provisioned .env is exempt.
+
+# Ensure a .env (symlink) is present in the worktree before running scan.
+# If the provision step (assertion 1) already created it, this is a no-op.
+if [[ ! -L "${TEST_WORKTREE}/.env" && ! -f "${TEST_WORKTREE}/.env" ]]; then
+  # Create the symlink manually for this assertion so we can test the scan
+  # exemption independently of the provision script.
+  ln -s "${FIXTURE_ENV}" "${TEST_WORKTREE}/.env"
+fi
+
+# Remove any stale scan report so we get a fresh run.
+rm -f "${SCAN_REPORT}" 2>/dev/null || true
+
+# Run pre_gate_runner.sh arch mode with ABSOLUTE worktree path (FLASHCARD
+# #pre-gate #cwd-leak #worktree 2026-06-03: pass absolute path to avoid leak).
+bash "${PRE_GATE_SCRIPT}" arch "${TEST_WORKTREE}" HEAD > /dev/null 2>&1 || true
+
+if [[ -f "${SCAN_REPORT}" ]]; then
+  if grep -q '^\[PASS\] stray_env_files' "${SCAN_REPORT}"; then
+    pass "scan-exemption — stray_env_files PASS for provisioned .env"
+  else
+    # Expected on clean baseline: no exemption branch → records FAIL on .env
+    STRAY_LINE="$(grep 'stray_env_files' "${SCAN_REPORT}" | head -1 || echo '(no stray_env_files line)')"
+    fail "scan-exemption — stray_env_files should record PASS for provisioned .env" \
+      "report line: ${STRAY_LINE}"
+  fi
+else
+  fail "scan-report-exists" \
+    "pre-arch-scan.txt not written at ${SCAN_REPORT}"
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION 3: Negative control — .env.local still triggers FAIL
+# ────────────────────────────────────────────────────────────────────────────
+# .env.local is in stray_env_files list but NOT in provision_config default.
+# Drop it into the worktree, run a fresh scan, assert stray_env_files FAIL.
+
+printf 'NOT_PROVISIONED=1\n' > "${TEST_WORKTREE}/.env.local"
+
+# Remove the previous scan report so we get a completely fresh scan.
+rm -f "${SCAN_REPORT}" 2>/dev/null || true
+
+bash "${PRE_GATE_SCRIPT}" arch "${TEST_WORKTREE}" HEAD > /dev/null 2>&1 || true
+
+if [[ -f "${SCAN_REPORT}" ]]; then
+  if grep -q '^\[FAIL\] stray_env_files' "${SCAN_REPORT}"; then
+    pass "negative-control — .env.local (non-provisioned) triggers stray_env_files FAIL"
+  else
+    NEG_LINE="$(grep 'stray_env_files' "${SCAN_REPORT}" | head -1 || echo '(no stray_env_files line)')"
+    fail "negative-control — .env.local should trigger stray_env_files FAIL (exemption must be scoped)" \
+      "report line: ${NEG_LINE}"
+  fi
+else
+  fail "negative-control-report-exists" \
+    "pre-arch-scan.txt not written at ${SCAN_REPORT} for negative-control scan"
+fi
+
+# Remove the negative-control file so teardown sees a clean worktree
+rm -f "${TEST_WORKTREE}/.env.local"
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION 4: Teardown verification
+# ────────────────────────────────────────────────────────────────────────────
+# Remove the worktree and verify no dangling symlink at repo root and no
+# leftover fixture .env. The EXIT trap is the safety net; here we verify
+# explicitly so we can record PASS/FAIL before returning.
+
+git -C "${REPO_ROOT}" worktree remove --force "${TEST_WORKTREE}" 2>/dev/null || true
+git -C "${REPO_ROOT}" worktree prune 2>/dev/null || true
+if [[ -d "${TEST_WORKTREE}" ]]; then
+  rm -rf "${TEST_WORKTREE}"
+fi
+if git -C "${REPO_ROOT}" branch --list "${TEST_BRANCH}" | grep -q "${TEST_BRANCH}"; then
+  git -C "${REPO_ROOT}" branch -D "${TEST_BRANCH}" 2>/dev/null || true
+fi
+
+# Assertion: no dangling symlink at repo root (.env symlink lives INSIDE the
+# worktree pointing OUT; removing the worktree removes the symlink).
+if [[ -L "${FIXTURE_ENV}" ]]; then
+  fail "teardown-no-dangling-symlink" \
+    ".env at repo root is a symlink after worktree removal — dangling"
+else
+  pass "teardown-no-dangling-symlink — no dangling symlink at repo root"
+fi
+
+# Assertion: worktree is no longer registered
+if git -C "${REPO_ROOT}" worktree list 2>/dev/null | grep -q "TEST-079"; then
+  fail "teardown-worktree-removed" \
+    ".worktrees/TEST-079 still registered in git worktree list"
+else
+  pass "teardown-worktree-removed — .worktrees/TEST-079 removed"
+fi
+
+# Assertion: fixture .env at repo root is cleaned up (if harness created it)
+if [[ "${HARNESS_CREATED_ENV}" -eq 1 ]]; then
+  rm -f "${FIXTURE_ENV}"
+  HARNESS_CREATED_ENV=0   # prevent double-remove in trap
+  if [[ -e "${FIXTURE_ENV}" ]]; then
+    fail "teardown-fixture-env-removed" \
+      "fixture .env still present at ${FIXTURE_ENV} after cleanup"
+  else
+    pass "teardown-fixture-env-removed — fixture .env cleaned up"
+  fi
+fi
+
+# ── Summary ───────────────────────────────────────────────────────────────────
+echo ""
+echo "cr079_provision.red.sh: ${PASS} passed, ${FAIL} failed"
+if [[ "${FAIL}" -gt 0 ]]; then
+  exit 1
+fi
+exit 0