cleargate 0.14.0 → 0.15.1

package/templates/cleargate-planning/.cleargate/scripts/test/cr080_wrapper.test.sh

@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# cr080_wrapper.test.sh — CR-080 verification harness.
+#
+# Verifies F5 (pre_gate_runner.sh realpath-at-entry) and F8 (run_script.sh
+# env pass-through) are correctly implemented.
+#
+# Assertions:
+#   F5-1: Relative worktree path — report written to correct location, no ENOENT.
+#   F5-2: Absolute worktree path — identical report location, no path doubling.
+#   F8-3: CLEARGATE_STATE_FILE exported before wrapper — reaches the child process.
+#   F8-4 (optional allowlist): RUN_SCRIPT_ENV_ALLOWLIST=FOO prevents non-listed
+#         var from being actively required (documents opt-in behavior).
+#
+# Exit 0 = PASS (all assertions pass); exit 1 = one or more FAIL.
+#
+# Self-cleaning: trap EXIT removes the stub worktree and any tmp files.
+# Mirrors the cr077/cr079 harness shape.
+# macOS bash 3.2 portable.
+# FLASHCARD #test-harness #bash 2026-06-03: use grep -q not grep -c || echo.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+
+PASS=0
+FAIL=0
+
+pass() {
+  echo "PASS: $1"
+  PASS=$((PASS + 1))
+}
+
+fail() {
+  echo "FAIL: $1"
+  echo "      detail: $2"
+  FAIL=$((FAIL + 1))
+}
+
+# ── Constants ────────────────────────────────────────────────────────────────
+TEST_STUB_DIR="${REPO_ROOT}/.worktrees/CR-080-smoke"
+PRE_GATE_SCRIPT="${REPO_ROOT}/.cleargate/scripts/pre_gate_runner.sh"
+RUN_SCRIPT="${REPO_ROOT}/.cleargate/scripts/run_script.sh"
+
+# Temp file for F8 env probe
+TMP_STATE_FILE="/tmp/cr080-probe-$$.json"
+
+# ── Teardown / trap ───────────────────────────────────────────────────────────
+cleanup() {
+  # Remove stub worktree directory
+  if [[ -d "${TEST_STUB_DIR}" ]]; then
+    rm -rf "${TEST_STUB_DIR}"
+  fi
+  # Remove tmp files
+  rm -f "${TMP_STATE_FILE}" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+# ── Pre-checks ───────────────────────────────────────────────────────────────
+if [[ ! -f "${PRE_GATE_SCRIPT}" ]]; then
+  fail "pre-check" "pre_gate_runner.sh not found at ${PRE_GATE_SCRIPT}"
+  echo ""
+  echo "cr080_wrapper.test.sh: ${PASS} passed, ${FAIL} failed"
+  exit 1
+fi
+
+if [[ ! -f "${RUN_SCRIPT}" ]]; then
+  fail "pre-check" "run_script.sh not found at ${RUN_SCRIPT}"
+  echo ""
+  echo "cr080_wrapper.test.sh: ${PASS} passed, ${FAIL} failed"
+  exit 1
+fi
+
+# ── Setup: create a stub worktree dir with the expected .cleargate structure ──
+# We use a simple stub directory rather than a real git worktree because the
+# pre_gate_runner.sh only requires the directory to exist for path normalization;
+# the typecheck/test/stray checks are skipped when no package.json is present.
+rm -rf "${TEST_STUB_DIR}" 2>/dev/null || true
+mkdir -p "${TEST_STUB_DIR}/.cleargate/reports"
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION F5-1: Relative worktree path writes report to correct location
+# ────────────────────────────────────────────────────────────────────────────
+# Run from REPO_ROOT with a relative path (.worktrees/CR-080-smoke).
+# The report should land at <absolute-stub-dir>/.cleargate/reports/pre-qa-scan.txt.
+
+RELATIVE_PATH=".worktrees/CR-080-smoke"
+# Use qa mode (matches CR §4 verification command); report file = pre-qa-scan.txt.
+# qa mode skips typecheck + test when no package.json is present in the worktree.
+EXPECTED_REPORT="${TEST_STUB_DIR}/.cleargate/reports/pre-qa-scan.txt"
+
+# Remove any stale report from a previous run
+rm -f "${EXPECTED_REPORT}" 2>/dev/null || true
+
+# Run from repo root with the RELATIVE path (the bug scenario).
+# We use a non-existent branch (sprint/S-99) — pre_gate_runner.sh tolerates it
+# (qa mode skips package.json checks when no package.json exists).
+cd "${REPO_ROOT}"
+bash "${PRE_GATE_SCRIPT}" qa "${RELATIVE_PATH}" "sprint/S-99" > /dev/null 2>&1 || true
+
+if [[ -f "${EXPECTED_REPORT}" ]]; then
+  pass "F5-1: relative-worktree-path — report written at correct absolute location"
+else
+  fail "F5-1: relative-worktree-path — report not found at ${EXPECTED_REPORT}" \
+    "expected report at ${EXPECTED_REPORT} after running with relative path ${RELATIVE_PATH}"
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION F5-2: Absolute worktree path writes report to the same location
+# ────────────────────────────────────────────────────────────────────────────
+# Run from repo root with ABSOLUTE path — identical report location expected.
+
+rm -f "${EXPECTED_REPORT}" 2>/dev/null || true
+
+cd "${REPO_ROOT}"
+bash "${PRE_GATE_SCRIPT}" qa "${TEST_STUB_DIR}" "sprint/S-99" > /dev/null 2>&1 || true
+
+if [[ -f "${EXPECTED_REPORT}" ]]; then
+  pass "F5-2: absolute-worktree-path — report written at correct location"
+else
+  fail "F5-2: absolute-worktree-path — report not found at ${EXPECTED_REPORT}" \
+    "expected report at ${EXPECTED_REPORT} after running with absolute path ${TEST_STUB_DIR}"
+fi
+
+# Regression: verify no path-doubling (the ENOENT symptom was a doubled path like
+# <worktree>/<worktree>/.cleargate/... — which can't exist). The report is at the
+# expected location = no doubling occurred. Verified implicitly by F5-1 passing
+# from a relative-path invocation (the bug only triggered on relative paths).
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION F8-3: CLEARGATE_STATE_FILE exported before wrapper reaches child
+# ────────────────────────────────────────────────────────────────────────────
+# Export the var, then run run_script.sh wrapping a node -e that reads it.
+# The child should print the value, not "MISSING".
+
+PROBE_RESULT="$(
+  export CLEARGATE_STATE_FILE="${TMP_STATE_FILE}"
+  bash "${RUN_SCRIPT}" node -e 'process.stdout.write(process.env.CLEARGATE_STATE_FILE || "MISSING")' 2>/dev/null
+)"
+
+if [[ "${PROBE_RESULT}" = "${TMP_STATE_FILE}" ]]; then
+  pass "F8-3: CLEARGATE_STATE_FILE forwarded to child — got '${PROBE_RESULT}'"
+else
+  fail "F8-3: CLEARGATE_STATE_FILE not forwarded to child" \
+    "expected '${TMP_STATE_FILE}', got '${PROBE_RESULT}'"
+fi
+
+# ────────────────────────────────────────────────────────────────────────────
+# ASSERTION F8-4 (optional allowlist): RUN_SCRIPT_ENV_ALLOWLIST is opt-in only
+# ────────────────────────────────────────────────────────────────────────────
+# When RUN_SCRIPT_ENV_ALLOWLIST is set to "FOO", a var NOT in the allowlist
+# (e.g. CLEARGATE_STATE_FILE) should still reach the child because the
+# allowlist is advisory/documentation-only — the current implementation does
+# NOT strip the env (it only populates _allowed_env for future use).
+# This assertion documents that the default pass-through is preserved even
+# when the allowlist var is set: the child still sees CLEARGATE_STATE_FILE.
+
+PROBE_ALLOWLIST_RESULT="$(
+  export CLEARGATE_STATE_FILE="${TMP_STATE_FILE}"
+  export RUN_SCRIPT_ENV_ALLOWLIST="FOO"
+  bash "${RUN_SCRIPT}" node -e 'process.stdout.write(process.env.CLEARGATE_STATE_FILE || "MISSING")' 2>/dev/null
+)"
+
+if [[ "${PROBE_ALLOWLIST_RESULT}" = "${TMP_STATE_FILE}" ]]; then
+  pass "F8-4: allowlist opt-in — full pass-through preserved when RUN_SCRIPT_ENV_ALLOWLIST set"
+else
+  fail "F8-4: allowlist opt-in — CLEARGATE_STATE_FILE unexpectedly dropped" \
+    "expected '${TMP_STATE_FILE}', got '${PROBE_ALLOWLIST_RESULT}'"
+fi
+
+# ── Summary ───────────────────────────────────────────────────────────────────
+echo ""
+echo "cr080_wrapper.test.sh: ${PASS} passed, ${FAIL} failed"
+
+if [[ $FAIL -gt 0 ]]; then
+  exit 1
+fi
+exit 0

package/templates/cleargate-planning/.cleargate/scripts/test/cr081_qa_red_lint.red.sh

@@ -0,0 +1,348 @@
+#!/usr/bin/env bash
+# cr081_qa_red_lint.red.sh — CR-081 QA-Red semantic-fixture lint harness.
+#
+# RED: fails against clean baseline — qa_red_lint.mjs does not yet exist,
+# pre_gate_runner.sh has no qa_red_lint invocation, and qa.md has no
+# red-now-green clause. All six scenarios therefore FAIL.
+# GREEN: passes after Developer implements CR-081 (qa_red_lint.mjs created,
+# pre_gate_runner.sh wired, qa.md red-now-green clause added).
+#
+# Scenarios (per M3 plan CR-081 §test / dispatch §Scenarios):
+#   1. R-enum positive:   fixture with out-of-set literal → exit non-zero + R-enum message
+#   2. R-query positive:  fixture with duplicate-text queryByText → exit non-zero + R-query message
+#   3. Negative — clean: valid literal + unique query → exit 0 (no false positive)
+#   4. Negative — NON-APPLICABLE (CRITICAL): plain node:test (assert-based, no Pydantic
+#      Literal, no queryByText) shaped like CR-082's own close-gate test → exit 0.
+#      Proves qa_red_lint won't phantom-flag CR-082's own *.red.node.test.ts when it goes live.
+#   5. Wiring grep: grep -q "qa_red_lint" .cleargate/scripts/pre_gate_runner.sh
+#   6. qa.md red-now-green clause grep
+#
+# Self-cleaning: trap EXIT removes any mktemp fixture dirs.
+# macOS bash 3.2 portable.
+# FLASHCARD #test-harness #bash 2026-06-03: use grep -q (not grep -c || echo 0).
+# FLASHCARD #pre-gate #live-on-merge #qa-red-lint 2026-06-04: Class-3 pre-gate
+#   checks MUST exit 0 on non-applicable files (plain node:test, no Pydantic/RTL).
+#
+# Exit 0 = PASS (all scenarios pass); exit non-zero = one or more FAIL.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+
+PASS=0
+FAIL=0
+
+pass() {
+  echo "PASS: $1"
+  PASS=$((PASS + 1))
+}
+
+fail() {
+  echo "FAIL: $1"
+  echo "      detail: $2"
+  FAIL=$((FAIL + 1))
+}
+
+# ── Constants ─────────────────────────────────────────────────────────────────
+LINT_SCRIPT="${REPO_ROOT}/.cleargate/scripts/qa_red_lint.mjs"
+PRE_GATE_SCRIPT="${REPO_ROOT}/.cleargate/scripts/pre_gate_runner.sh"
+QA_MD="${REPO_ROOT}/cleargate-planning/.claude/agents/qa.md"
+
+# ── Fixture temp dirs — tracked for cleanup ───────────────────────────────────
+FIXTURE_DIR_ENUM=""
+FIXTURE_DIR_QUERY=""
+FIXTURE_DIR_CLEAN=""
+FIXTURE_DIR_NONAPPLICABLE=""
+
+cleanup() {
+  [[ -n "${FIXTURE_DIR_ENUM}"          ]] && rm -rf "${FIXTURE_DIR_ENUM}"
+  [[ -n "${FIXTURE_DIR_QUERY}"         ]] && rm -rf "${FIXTURE_DIR_QUERY}"
+  [[ -n "${FIXTURE_DIR_CLEAN}"         ]] && rm -rf "${FIXTURE_DIR_CLEAN}"
+  [[ -n "${FIXTURE_DIR_NONAPPLICABLE}" ]] && rm -rf "${FIXTURE_DIR_NONAPPLICABLE}"
+}
+trap cleanup EXIT
+
+# ── Pre-check: qa_red_lint.mjs must exist for scenarios 1-4 ──────────────────
+# On clean baseline it does NOT exist → scenarios 1-4 fail with "script absent".
+LINT_PRESENT=0
+if [[ -f "${LINT_SCRIPT}" ]]; then
+  LINT_PRESENT=1
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+# SCENARIO 1: R-enum positive
+# A fixture with an out-of-set Literal — mirrors DeckSpec(theme="dark") against
+# Literal["technical-dark","business-warm","minimal-light"].
+# We write a .py file with BOTH the Literal declaration AND the bad constructor
+# call statically visible, plus a .ts mirror with a TS string-union + bad prop.
+# Expected: qa_red_lint.mjs exits NON-ZERO and stderr mentions "dark" + R-enum.
+# ═════════════════════════════════════════════════════════════════════════════
+echo "--- Scenario 1: R-enum positive ---"
+
+FIXTURE_DIR_ENUM="$(mktemp -d)"
+
+# Python fixture: Literal declaration + out-of-set constructor call
+cat > "${FIXTURE_DIR_ENUM}/deck_spec_fixture.red.node.test.ts" << 'PYEOF'
+# fixture: deck_spec with invalid enum literal
+# Simulates a QA-Red test that constructs a typed model with a bad literal.
+#
+# Pydantic-style Literal declaration (statically visible in this file):
+#   theme: Literal["technical-dark", "business-warm", "minimal-light"]
+#
+# Constructor call with out-of-set value (R-enum violation):
+#   DeckSpec(theme="dark")   # "dark" is NOT in ["technical-dark","business-warm","minimal-light"]
+
+from typing import Literal
+from pydantic import BaseModel
+
+class DeckSpec(BaseModel):
+    theme: Literal["technical-dark", "business-warm", "minimal-light"]
+
+# This is the bad fixture line — "dark" is NOT a valid member of the Literal set.
+spec = DeckSpec(theme="dark")  # R-enum: "dark" not in Literal set
+PYEOF
+
+if [[ "${LINT_PRESENT}" -eq 0 ]]; then
+  fail "scenario-1-r-enum-positive" \
+    "qa_red_lint.mjs absent at ${LINT_SCRIPT} — cannot run; baseline FAIL as expected (RED)"
+else
+  LINT_OUT="$(node "${LINT_SCRIPT}" "${FIXTURE_DIR_ENUM}" 2>&1)" || LINT_EXIT=$?
+  LINT_EXIT="${LINT_EXIT:-0}"
+  if [[ "${LINT_EXIT}" -ne 0 ]] && echo "${LINT_OUT}" | grep -qi "dark"; then
+    pass "scenario-1-r-enum-positive — exit non-zero + R-enum message names 'dark'"
+  elif [[ "${LINT_EXIT}" -eq 0 ]]; then
+    fail "scenario-1-r-enum-positive" \
+      "qa_red_lint.mjs exited 0 (expected non-zero) — R-enum rule not triggered for out-of-set 'dark'"
+  else
+    fail "scenario-1-r-enum-positive" \
+      "qa_red_lint.mjs exited non-zero but stderr did not mention 'dark' — R-enum message missing or wrong. Output: ${LINT_OUT}"
+  fi
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+# SCENARIO 2: R-query positive
+# A fixture (.tsx) where 'Connected' appears on TWO render-input rows AND a
+# queryByText('Connected') call targets it.
+# Expected: exit NON-ZERO + R-query message recommends queryAllByText/getByTestId.
+# ═════════════════════════════════════════════════════════════════════════════
+echo "--- Scenario 2: R-query positive ---"
+
+FIXTURE_DIR_QUERY="$(mktemp -d)"
+
+cat > "${FIXTURE_DIR_QUERY}/status_table_fixture.red.node.test.ts" << 'QEOF'
+// fixture: status table with duplicate text — R-query violation
+// Both postgres and redis rows have detail: 'Connected', so queryByText('Connected')
+// will throw "Found multiple elements" at runtime.
+
+import { render } from '@testing-library/react';
+import StatusTable from '../StatusTable';
+
+const rows = [
+  { service: 'postgres', status: 'ok', detail: 'Connected' },
+  { service: 'redis',    status: 'ok', detail: 'Connected' },  // duplicate detail text
+];
+
+test('shows connected status', () => {
+  render(<StatusTable rows={rows} />);
+  // R-query violation: 'Connected' appears on >=2 rows in the render input above.
+  // queryByText will throw "Found multiple elements with text 'Connected'".
+  const el = queryByText('Connected');  // bad — duplicate text, use queryAllByText('Connected')[0]
+  expect(el).toBeTruthy();
+});
+QEOF
+
+if [[ "${LINT_PRESENT}" -eq 0 ]]; then
+  fail "scenario-2-r-query-positive" \
+    "qa_red_lint.mjs absent at ${LINT_SCRIPT} — cannot run; baseline FAIL as expected (RED)"
+else
+  LINT_OUT2="$(node "${LINT_SCRIPT}" "${FIXTURE_DIR_QUERY}" 2>&1)" || LINT_EXIT2=$?
+  LINT_EXIT2="${LINT_EXIT2:-0}"
+  if [[ "${LINT_EXIT2}" -ne 0 ]] && \
+     (echo "${LINT_OUT2}" | grep -qiE "queryAllByText|getByTestId|R-query"); then
+    pass "scenario-2-r-query-positive — exit non-zero + R-query recommendation present"
+  elif [[ "${LINT_EXIT2}" -eq 0 ]]; then
+    fail "scenario-2-r-query-positive" \
+      "qa_red_lint.mjs exited 0 (expected non-zero) — R-query rule not triggered for duplicate 'Connected' + queryByText"
+  else
+    fail "scenario-2-r-query-positive" \
+      "qa_red_lint.mjs exited non-zero but R-query recommendation (queryAllByText/getByTestId) not in output. Output: ${LINT_OUT2}"
+  fi
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+# SCENARIO 3: Negative — clean (no false positive)
+# A fixture with a valid in-set literal + a uniquely-matched queryByText.
+# Expected: exit 0 (no flags).
+# ═════════════════════════════════════════════════════════════════════════════
+echo "--- Scenario 3: Negative — clean (no false positive) ---"
+
+FIXTURE_DIR_CLEAN="$(mktemp -d)"
+
+cat > "${FIXTURE_DIR_CLEAN}/clean_fixture.red.node.test.ts" << 'CEOF'
+// fixture: clean — valid literal + unique query text
+// theme="technical-dark" IS in Literal["technical-dark","business-warm","minimal-light"].
+// 'Postgres' appears exactly once in the render input, so getByText('Postgres') is safe.
+
+from typing import Literal
+from pydantic import BaseModel
+
+class DeckSpec(BaseModel):
+    theme: Literal["technical-dark", "business-warm", "minimal-light"]
+
+# Valid in-set value — no R-enum violation
+spec = DeckSpec(theme="technical-dark")
+
+const rows = [
+  { service: 'postgres', status: 'ok', detail: 'Postgres' },   // unique detail
+  { service: 'redis',    status: 'ok', detail: 'Redis' },      // different text
+];
+
+test('shows postgres row', () => {
+  render(<StatusTable rows={rows} />);
+  // Safe: 'Postgres' appears exactly once in the render input above.
+  const el = getByText('Postgres');
+  expect(el).toBeTruthy();
+});
+CEOF
+
+if [[ "${LINT_PRESENT}" -eq 0 ]]; then
+  fail "scenario-3-negative-clean" \
+    "qa_red_lint.mjs absent at ${LINT_SCRIPT} — cannot run; baseline FAIL as expected (RED)"
+else
+  node "${LINT_SCRIPT}" "${FIXTURE_DIR_CLEAN}" > /dev/null 2>&1
+  CLEAN_EXIT=$?
+  if [[ "${CLEAN_EXIT}" -eq 0 ]]; then
+    pass "scenario-3-negative-clean — exit 0 (no false positive on valid literal + unique query)"
+  else
+    fail "scenario-3-negative-clean" \
+      "qa_red_lint.mjs exited ${CLEAN_EXIT} (expected 0) — false positive on clean fixture"
+  fi
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+# SCENARIO 4: Negative — NON-APPLICABLE file (CRITICAL live-on-merge safety)
+# A plain node:test file using only assert, no Pydantic Literal, no queryByText/
+# getByText — shaped exactly like CR-082's own close_sprint.deferred-verify.red.node.test.ts.
+# Expected: exit 0. Proves qa_red_lint won't phantom-flag CR-082's red test on merge.
+# THIS SCENARIO IS MANDATORY.
+# ═════════════════════════════════════════════════════════════════════════════
+echo "--- Scenario 4: Negative — NON-APPLICABLE file (CRITICAL) ---"
+
+FIXTURE_DIR_NONAPPLICABLE="$(mktemp -d)"
+
+# Write a file that is intentionally shaped like CR-082's own node:test:
+# - uses node:test + assert only
+# - no import from pydantic, no Literal[...], no string-union type
+# - no queryByText, getByText, queryAllByText
+# - no RTL imports
+cat > "${FIXTURE_DIR_NONAPPLICABLE}/close_sprint.deferred-verify.red.node.test.ts" << 'NAEOF'
+// close_sprint.deferred-verify.red.node.test.ts
+// CR-082 QA-Red node:test — shaped as a plain node:test + assert file.
+// No Pydantic Literal, no queryByText/getByText, no RTL — NOT a QA-Red lint target.
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { execSync } from 'node:child_process';
+import path from 'node:path';
+
+const SCRIPT = path.resolve(import.meta.dirname, '../../close_sprint.mjs');
+
+describe('close_sprint deferred-verification gate (Step 2.9)', () => {
+  it('declared + NO result file → exits non-zero', () => {
+    // Env-seam: CLEARGATE_FORCE_DEFERRED_VERIFY drives the test without real files
+    const env = {
+      ...process.env,
+      CLEARGATE_FORCE_DEFERRED_VERIFY: JSON.stringify({
+        'STORY-099-01': { declared: [{ command: 'docker build .', blocks: 'close' }], result: null }
+      }),
+      CLEARGATE_SKIP_WORKTREE_CHECK: '1',
+      CLEARGATE_SKIP_MERGE_CHECK: '1',
+    };
+    let threw = false;
+    try {
+      execSync(`node ${SCRIPT} SPRINT-00`, { env, stdio: 'pipe' });
+    } catch {
+      threw = true;
+    }
+    assert.ok(threw, 'Expected close_sprint.mjs to exit non-zero when deferred result is absent');
+  });
+
+  it('declared + green result → gate passes', () => {
+    const env = {
+      ...process.env,
+      CLEARGATE_FORCE_DEFERRED_VERIFY: JSON.stringify({
+        'STORY-099-01': { declared: [{ command: 'docker build .', blocks: 'close' }], result: 'green' }
+      }),
+      CLEARGATE_SKIP_WORKTREE_CHECK: '1',
+      CLEARGATE_SKIP_MERGE_CHECK: '1',
+    };
+    // Should NOT throw — gate passes on green
+    assert.doesNotThrow(() => {
+      execSync(`node ${SCRIPT} SPRINT-00`, { env, stdio: 'pipe' });
+    });
+  });
+
+  it('none declared → silent no-op, continues', () => {
+    const env = {
+      ...process.env,
+      CLEARGATE_FORCE_DEFERRED_VERIFY: JSON.stringify({}),
+      CLEARGATE_SKIP_WORKTREE_CHECK: '1',
+      CLEARGATE_SKIP_MERGE_CHECK: '1',
+    };
+    // No deferred entries declared → gate is a no-op → should not throw
+    assert.doesNotThrow(() => {
+      execSync(`node ${SCRIPT} SPRINT-00`, { env, stdio: 'pipe' });
+    });
+  });
+});
+NAEOF
+
+if [[ "${LINT_PRESENT}" -eq 0 ]]; then
+  fail "scenario-4-nonapplicable" \
+    "qa_red_lint.mjs absent at ${LINT_SCRIPT} — cannot run; baseline FAIL as expected (RED)"
+else
+  node "${LINT_SCRIPT}" "${FIXTURE_DIR_NONAPPLICABLE}" > /dev/null 2>&1
+  NA_EXIT=$?
+  if [[ "${NA_EXIT}" -eq 0 ]]; then
+    pass "scenario-4-nonapplicable — exit 0 on plain node:test file (no phantom R-enum/R-query flag)"
+  else
+    fail "scenario-4-nonapplicable" \
+      "qa_red_lint.mjs exited ${NA_EXIT} (expected 0) — CRITICAL: false-flagged CR-082's own node:test shape; live-on-merge self-block risk"
+  fi
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+# SCENARIO 5: Wiring grep — qa_red_lint invoked in pre_gate_runner.sh run_arch()
+# Expected: grep -q "qa_red_lint" .cleargate/scripts/pre_gate_runner.sh → 0
+# FAILS on clean baseline (not yet wired).
+# ═════════════════════════════════════════════════════════════════════════════
+echo "--- Scenario 5: Wiring grep ---"
+
+if grep -q "qa_red_lint" "${PRE_GATE_SCRIPT}" 2>/dev/null; then
+  pass "scenario-5-wiring-grep — 'qa_red_lint' found in pre_gate_runner.sh"
+else
+  fail "scenario-5-wiring-grep" \
+    "'qa_red_lint' not found in ${PRE_GATE_SCRIPT} — CR-081 wiring not yet applied (expected RED)"
+fi
+
+# ═════════════════════════════════════════════════════════════════════════════
+# SCENARIO 6: qa.md red-now-green clause grep
+# Expected: grep -qiE "red-now-green|now PASSES|failing at baseline" in qa.md → 0
+# FAILS on clean baseline (clause not yet added).
+# ═════════════════════════════════════════════════════════════════════════════
+echo "--- Scenario 6: qa.md red-now-green clause ---"
+
+if grep -qiE "red-now-green|now PASSES|failing at baseline" "${QA_MD}" 2>/dev/null; then
+  pass "scenario-6-qa-md-clause — red-now-green clause found in qa.md"
+else
+  fail "scenario-6-qa-md-clause" \
+    "red-now-green clause not found in ${QA_MD} — CR-081 qa.md edit not yet applied (expected RED)"
+fi
+
+# ── Summary ───────────────────────────────────────────────────────────────────
+echo ""
+echo "cr081_qa_red_lint.red.sh: ${PASS} passed, ${FAIL} failed"
+if [[ "${FAIL}" -gt 0 ]]; then
+  exit 1
+fi
+exit 0

package/templates/cleargate-planning/.cleargate/sprint-runs/_off-sprint/.session-totals.json

@@ -0,0 +1 @@
+{"d7d1579f-97a4-4ed2-953e-1364ce697de7":{"input":166100,"output":1238677,"cache_creation":4905569,"cache_read":90028882,"last_ts":"2026-06-04T08:59:03Z","last_turn_index":0},"cd330896-e59e-4b46-b2ab-f420cbfa89d2":{"input":35856,"output":273596,"cache_creation":532880,"cache_read":12920963,"last_ts":"2026-06-04T09:22:15Z","last_turn_index":0},"a7ff198a-7354-4390-ba21-ec7df60ef4a1":{"input":71371,"output":934473,"cache_creation":4350709,"cache_read":91569515,"last_ts":"2026-06-04T14:17:56Z","last_turn_index":0},"00c82e3f-17dc-49cc-ab08-981ba1d9c6e2":{"input":155691,"output":1522802,"cache_creation":7137389,"cache_read":113485679,"last_ts":"2026-06-05T20:15:13Z","last_turn_index":0},"80279738-6cfd-4774-a2d3-50547d214129":{"input":34535,"output":50008,"cache_creation":993677,"cache_read":1958700,"last_ts":"2026-06-06T19:14:48Z","last_turn_index":0}}