create-claude-cabinet 0.48.0 → 0.49.0

package/templates/engagement/pib-db-patches/pib-db-lib.mjs

@@ -44,7 +44,11 @@ function today() {
 //   6 — added projects.tags (symmetric with actions.tags at v2)
 //   7 — added client-facing copy columns on actions + projects (4 each)
 //   8 — added engagement_events.visibility (client|internal, default internal)
-export const SCHEMA_VERSION = 8;
+//   9 — audit finding ids run-prefixed (run_id || '/' || id) — same change
+//       as BASE v7 (act:4ec70792); numbered 9 here because the patch owns
+//       7-8. Keep base and patch bumped in the same release
+//       (engagement-setup's base-ahead guard enforces it).
+export const SCHEMA_VERSION = 9;
 
 // Each entry: { version, sql }. A single version may have multiple SQL
 // statements (e.g. column add + index). Statements run in array order;
@@ -53,8 +57,8 @@ export const SCHEMA_VERSION = 8;
 // gate — try/catch is a safety net for pre-pragma DBs.
 //
 // NOTE on version numbering (base vs patch):
-//   Base (work-tracking): v1-v6 (v6 = client columns)
-//   Patch (engagement):   v1-v7 (v5 = engagement_events, v6 = projects.tags, v7 = client columns)
+//   Base (work-tracking): v1-v7 (v6 = client columns, v7 = audit id prefix)
+//   Patch (engagement):   v1-v9 (v5 = engagement_events, v6 = projects.tags, v7 = client columns, v9 = audit id prefix)
 //   The same physical columns appear at different version numbers because
 //   base and patch have different migration histories. The try/catch on
 //   "duplicate column" makes the overlap safe — a DB that already has
@@ -86,6 +90,10 @@ const MIGRATIONS = [
   { version: 7, sql: "ALTER TABLE projects ADD COLUMN client_generated_at TEXT" },
   { version: 7, sql: "ALTER TABLE projects ADD COLUMN client_generated_status TEXT" },
   { version: 8, sql: "ALTER TABLE engagement_events ADD COLUMN visibility TEXT NOT NULL DEFAULT 'internal' CHECK(visibility IN ('client','internal'))" },
+  // v9: prefix legacy audit finding ids with their run id (base v7 twin —
+  // act:4ec70792). Idempotent via the NOT LIKE guard. skipOn: a db that
+  // predates the audit tables has nothing to prefix.
+  { version: 9, sql: "UPDATE audit_findings SET id = run_id || '/' || id WHERE run_id IS NOT NULL AND run_id != '' AND id NOT LIKE run_id || '/%'", skipOn: /no such table: audit_findings/i },
 ];
 
 export function migrate(db) {
@@ -102,7 +110,11 @@ export function migrate(db) {
       if (m.version <= current) continue;
       try { db.exec(m.sql); applied++; }
       catch (e) {
-        if (!/already exists|duplicate column/i.test(e.message || '')) throw e;
+        const msg = e.message || '';
+        // Per-entry skip condition (explicit, never a general widening):
+        // e.g. the v9 audit-id prefix on a db that predates audit tables.
+        if (m.skipOn && m.skipOn.test(msg)) continue;
+        if (!/already exists|duplicate column/i.test(msg)) throw e;
       }
     }
     db.pragma(`user_version = ${SCHEMA_VERSION}`);
@@ -438,37 +450,69 @@ export function ingestFindings(db, { runDir }) {
   const timestamp = data.meta?.timestamp || new Date().toISOString();
   const dateStr = timestamp.slice(0, 10);
 
+  // Same-run re-ingest refreshes the run row; cross-run id collisions are
+  // structurally impossible now that run ids carry the date
+  // (run-<YYYY-MM-DD>-<HH-MM-SS>, minted by merge-findings).
   db.prepare(`
-    INSERT OR REPLACE INTO audit_runs (id, date, timestamp, trigger, finding_count)
+    INSERT INTO audit_runs (id, date, timestamp, trigger, finding_count)
     VALUES (?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      date = excluded.date, timestamp = excluded.timestamp,
+      trigger = excluded.trigger, finding_count = excluded.finding_count
   `).run(runId, dateStr, timestamp, data.meta?.trigger || 'manual', data.findings?.length || 0);
 
-  // Try the full INSERT with deliberation columns first; fall back to the
+  // Stored finding ids are RUN-PREFIXED (<runId>/<member-NNNN>): member ids
+  // restart every run, and the old bare-id INSERT OR REPLACE silently
+  // destroyed prior runs' rows AND their triage columns on collision
+  // (act:4ec70792, demonstrated live 2026-07-13). The upsert updates
+  // CONTENT columns only — the four triage columns (triage_status,
+  // triage_notes, triaged_at, fix_description) are never in the SET list,
+  // so a same-run re-ingest can never reset an operator's dispositions.
+  // Try the full shape with deliberation columns first; fall back to the
   // legacy shape for existing databases that haven't added them yet.
   let insert;
   let hasDeliberationCols = true;
   try {
     insert = db.prepare(`
-      INSERT OR REPLACE INTO audit_findings
+      INSERT INTO audit_findings
         (id, run_id, cabinet_member, severity, title, description, assumption,
          evidence, question, file, line, suggested_fix, auto_fixable, type,
          status, annotations, rebuttal)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        run_id = excluded.run_id, cabinet_member = excluded.cabinet_member,
+        severity = excluded.severity, title = excluded.title,
+        description = excluded.description, assumption = excluded.assumption,
+        evidence = excluded.evidence, question = excluded.question,
+        file = excluded.file, line = excluded.line,
+        suggested_fix = excluded.suggested_fix,
+        auto_fixable = excluded.auto_fixable, type = excluded.type,
+        status = excluded.status, annotations = excluded.annotations,
+        rebuttal = excluded.rebuttal
     `);
   } catch {
     hasDeliberationCols = false;
     insert = db.prepare(`
-      INSERT OR REPLACE INTO audit_findings
+      INSERT INTO audit_findings
         (id, run_id, cabinet_member, severity, title, description, assumption,
          evidence, question, file, line, suggested_fix, auto_fixable, type)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        run_id = excluded.run_id, cabinet_member = excluded.cabinet_member,
+        severity = excluded.severity, title = excluded.title,
+        description = excluded.description, assumption = excluded.assumption,
+        evidence = excluded.evidence, question = excluded.question,
+        file = excluded.file, line = excluded.line,
+        suggested_fix = excluded.suggested_fix,
+        auto_fixable = excluded.auto_fixable, type = excluded.type
     `);
   }
 
   let count = 0;
   for (const f of (data.findings || [])) {
+    const storedId = String(f.id).startsWith(`${runId}/`) ? f.id : `${runId}/${f.id}`;
     const base = [
-      f.id, runId, f['cabinet-member'], f.severity, f.title,
+      storedId, runId, f['cabinet-member'], f.severity, f.title,
       f.description || null, f.assumption || null, f.evidence || null,
       f.question || null, f.file || null, f.line || null,
       f.suggestedFix || null, f.autoFixable ? 1 : 0, f.type || 'finding'

package/templates/mux/__tests__/mux-fail-loud.fixture.sh

@@ -266,11 +266,10 @@ assert "a worktree window opened" test "$(win_count)" -eq $((before + 1))
 seedf=$(ls -t "$SEED_DIR"/sess-*.txt 2>/dev/null | head -1)
 assert "a seed-prompt file was written" test -n "$seedf"
 if [[ -n "$seedf" ]]; then
-  assert "auto_orient=1 prepends the orient instruction as line 1" \
-    bash -c "head -1 '$seedf' | grep -qx 'Run /orient-quick first to load state, then:'"
-  tail -n +3 "$seedf" > "$SANDBOX/got-body.txt"
-  assert "multi-line prompt body preserved byte-identical (quotes/\$/backticks intact)" \
-    diff "$SANDBOX/expected-body.txt" "$SANDBOX/got-body.txt"
+  # No orient prefix: /orient is retired — the watchtower SessionStart hook
+  # loads state; the seed file carries the prompt VERBATIM.
+  assert "seed file carries the prompt verbatim, no injected preamble (quotes/\$/backticks intact)" \
+    diff "$SANDBOX/expected-body.txt" "$seedf"
 fi
 
 echo "== T12: the prompt is an ARG to claude, never executed as shell (auto-submit safety)"

package/templates/mux/__tests__/worktree-lifecycle.fixture.sh

@@ -0,0 +1,214 @@
+#!/bin/bash
+# Sandboxed AC verification for act:dc80380c — worktree lane lifecycle
+# hygiene: spawn-time env provisioning, preflight, and container reaping
+# (grp:wt-noise-immunity, Lane E).
+#
+# Drives templates/mux/config/worktree-session-health.sh directly against a
+# throwaway repo + worktree under mktemp with HOME overridden — never touches
+# the real ~/.mux/worktrees, ~/.config/mux, or any live worktree. Docker is
+# PATH-shimmed with a recording fake: npm test must never depend on a live
+# docker daemon (or reap anything real).
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+SANDBOX=$(mktemp -d /tmp/cc-lifecycle-test.XXXXXX)
+FAKE_HOME="$SANDBOX/home"
+PROJ="$SANDBOX/proj"
+WT="$SANDBOX/wt"
+HEALTH="$REPO_ROOT/templates/mux/config/worktree-session-health.sh"
+MUX_BIN="$REPO_ROOT/templates/mux/bin/mux"
+CLEANUP_HOOK="$REPO_ROOT/templates/mux/config/worktree-cleanup.sh"
+
+pass=0; fail=0
+ok()  { echo "  PASS: $1"; pass=$((pass+1)); }
+bad() { echo "  FAIL: $1"; fail=$((fail+1)); }
+assert() { # assert <desc> <cmd...>
+  local desc="$1"; shift
+  if "$@" >/dev/null 2>&1; then ok "$desc"; else bad "$desc"; fi
+}
+run_health() { HOME="$FAKE_HOME" bash "$HEALTH" "$PROJ" "$WT" "$@" 2>&1; }
+
+mkdir -p "$FAKE_HOME/.local/share/mux/wt-health" "$FAKE_HOME/.claude/projects"
+trap 'rm -rf "$SANDBOX"' EXIT
+
+# --- fixture main repo --------------------------------------------------------
+git init -q "$PROJ"
+git -C "$PROJ" config user.email t@t.t; git -C "$PROJ" config user.name t
+mkdir -p "$PROJ/platform" "$PROJ/e2e" "$PROJ/.claude/plans"
+echo plan > "$PROJ/.claude/plans/p.md"
+printf '%s\n' 'platform/.env' 'e2e/.env.local' > "$PROJ/.gitignore"
+printf '%s\n' 'DB_URL=postgres://main' 'KEY=s3cret' > "$PROJ/platform/.env"
+echo 'E2E=1' > "$PROJ/e2e/.env.local"
+cat > "$PROJ/.mux-worktree-provision" <<'EOF'
+# lane env provisioning (comments + blanks ignored)
+
+platform/.env
+e2e/.env.local
+check: test -f platform/.env
+EOF
+echo code > "$PROJ/file.txt"
+git -C "$PROJ" add -A && git -C "$PROJ" commit -qm init
+MAIN_SLUG=$(echo "$PROJ" | sed 's|[/.]|-|g')
+mkdir -p "$FAKE_HOME/.claude/projects/$MAIN_SLUG"
+
+git -C "$PROJ" worktree add -q "$WT" -b mux/lane HEAD
+
+echo "== T1: spawn-time provisioning — declared env files land without hand-copying (AC1)"
+run_health --refresh >"$SANDBOX/t1.out"
+assert "platform/.env provisioned into worktree" \
+  grep -qx 'KEY=s3cret' "$WT/platform/.env"
+assert "e2e/.env.local provisioned into worktree" \
+  grep -qx 'E2E=1' "$WT/e2e/.env.local"
+assert "provisioning reported positively" \
+  grep -q 'provisioned platform/.env from main' "$SANDBOX/t1.out"
+assert "health output never prints env-file contents" \
+  bash -c "! grep -q 's3cret' '$SANDBOX/t1.out'"
+assert "health run exits 0" run_health
+
+echo "== T2: freshness — stale-but-untouched copy refreshes; identical reports current"
+run_health >"$SANDBOX/t2a.out"
+assert "identical copy reports current" \
+  grep -q 'platform/.env current with main' "$SANDBOX/t2a.out"
+printf '%s\n' 'DB_URL=postgres://main' 'KEY=rotated' > "$PROJ/platform/.env"
+run_health >"$SANDBOX/t2b.out"
+assert "untouched worktree copy refreshed after main moved" \
+  grep -qx 'KEY=rotated' "$WT/platform/.env"
+assert "refresh reported as stale-but-untouched" \
+  grep -q 'refreshed from main' "$SANDBOX/t2b.out"
+
+echo "== T3: divergence — a locally-modified worktree copy is NEVER clobbered"
+printf '%s\n' 'DB_URL=postgres://lane' 'PORT=5433' > "$WT/platform/.env"
+printf '%s\n' 'DB_URL=postgres://main' 'KEY=rotated-again' > "$PROJ/platform/.env"
+run_health >"$SANDBOX/t3.out"
+assert "lane-local edit preserved (main's newer copy did not overwrite)" \
+  grep -qx 'PORT=5433' "$WT/platform/.env"
+assert "divergence reported, not silently skipped" \
+  grep -q 'left alone' "$SANDBOX/t3.out"
+
+echo "== T4: refusal — a declared file that is NOT gitignored fails loudly, no copy"
+echo 'tracked/.env' >> "$PROJ/.mux-worktree-provision"
+mkdir -p "$PROJ/tracked" && echo 'LEAK=1' > "$PROJ/tracked/.env"
+run_health >"$SANDBOX/t4.out"
+rc=$?
+assert "health exits 1 on a non-gitignored declared file" test "$rc" -ne 0
+assert "the non-ignored file was NOT copied" test ! -f "$WT/tracked/.env"
+assert "refusal names the file and the reason" \
+  grep -q 'tracked/.env is NOT gitignored' "$SANDBOX/t4.out"
+# restore declaration for later tests
+grep -v 'tracked/.env' "$PROJ/.mux-worktree-provision" > "$PROJ/.p.tmp" && mv "$PROJ/.p.tmp" "$PROJ/.mux-worktree-provision"
+
+echo "== T5: missing source in main fails loudly (never a silent skip)"
+echo 'platform/.env.missing' >> "$PROJ/.mux-worktree-provision"
+run_health >"$SANDBOX/t5.out"
+rc=$?
+assert "health exits 1 on a declared-but-missing source" test "$rc" -ne 0
+assert "missing source named in output" \
+  grep -q 'source missing in main: platform/.env.missing' "$SANDBOX/t5.out"
+grep -v '.env.missing' "$PROJ/.mux-worktree-provision" > "$PROJ/.p.tmp" && mv "$PROJ/.p.tmp" "$PROJ/.mux-worktree-provision"
+
+echo "== T6: no declaration → provisioning is a silent no-op"
+PROJ2="$SANDBOX/proj2"; WT2="$SANDBOX/wt2"
+git init -q "$PROJ2"
+git -C "$PROJ2" config user.email t@t.t; git -C "$PROJ2" config user.name t
+mkdir -p "$PROJ2/.claude/plans"; echo plan > "$PROJ2/.claude/plans/p.md"
+echo x > "$PROJ2/f.txt"; git -C "$PROJ2" add -A; git -C "$PROJ2" commit -qm init
+MAIN2_SLUG=$(echo "$PROJ2" | sed 's|[/.]|-|g'); mkdir -p "$FAKE_HOME/.claude/projects/$MAIN2_SLUG"
+git -C "$PROJ2" worktree add -q "$WT2" -b mux/lane2 HEAD
+HOME="$FAKE_HOME" bash "$HEALTH" "$PROJ2" "$WT2" >"$SANDBOX/t6.out" 2>&1
+assert "no-declaration health run exits 0" test $? -eq 0
+assert "no provision lines emitted without a declaration" \
+  bash -c "! grep -q 'provision' '$SANDBOX/t6.out'"
+
+echo "== T7: preflight — green when sources + checks pass, red on failure, gates via exit code"
+HOME="$FAKE_HOME" bash "$HEALTH" "$PROJ" --preflight >"$SANDBOX/t7a.out" 2>&1
+assert "preflight passes on sound main environment" test $? -eq 0
+assert "preflight reports each file positively" \
+  grep -q 'present in main: platform/.env' "$SANDBOX/t7a.out"
+assert "preflight runs declared check: lines" \
+  grep -q 'check passed: test -f platform/.env' "$SANDBOX/t7a.out"
+echo 'check: false' >> "$PROJ/.mux-worktree-provision"
+HOME="$FAKE_HOME" bash "$HEALTH" "$PROJ" --preflight >"$SANDBOX/t7b.out" 2>&1
+assert "preflight exits 1 on a failing check" test $? -ne 0
+assert "failing check named" grep -q 'check FAILED' "$SANDBOX/t7b.out"
+grep -v '^check: false$' "$PROJ/.mux-worktree-provision" > "$PROJ/.p.tmp" && mv "$PROJ/.p.tmp" "$PROJ/.mux-worktree-provision"
+mv "$PROJ/platform/.env" "$PROJ/platform/.env.bak"
+HOME="$FAKE_HOME" bash "$HEALTH" "$PROJ" --preflight >"$SANDBOX/t7c.out" 2>&1
+assert "preflight exits 1 on a missing declared file" test $? -ne 0
+mv "$PROJ/platform/.env.bak" "$PROJ/platform/.env"
+HOME="$FAKE_HOME" bash "$HEALTH" "$PROJ2" --preflight >"$SANDBOX/t7d.out" 2>&1
+assert "preflight trivially passes with no declaration" test $? -eq 0
+assert "no-declaration preflight says so positively" \
+  grep -q 'nothing to verify' "$SANDBOX/t7d.out"
+
+# --- docker shim for reap tests -----------------------------------------------
+# Records every invocation; serves canned container ids for EXACTLY the
+# expected compose-project label and nothing else (sibling-lane survival).
+SHIM_DIR="$SANDBOX/bin"; mkdir -p "$SHIM_DIR"
+DOCKER_LOG="$SANDBOX/docker.log"
+WT_NAME=$(basename "$WT" | tr '[:upper:]' '[:lower:]')
+cat > "$SHIM_DIR/docker" <<EOF
+#!/bin/bash
+echo "\$@" >> "$DOCKER_LOG"
+case "\$1" in
+  info) exit \${FAKE_DOCKER_INFO_RC:-0} ;;
+  ps)
+    for a in "\$@"; do
+      [[ "\$a" == "label=com.docker.compose.project=${WT_NAME}" ]] && { \
+        if [[ -f "$SANDBOX/reaped" ]]; then exit 0; fi; \
+        echo c0ffee1; echo c0ffee2; exit 0; }
+    done
+    exit 0 ;;
+  rm) touch "$SANDBOX/reaped"; exit 0 ;;
+esac
+exit 0
+EOF
+chmod +x "$SHIM_DIR/docker"
+run_reap() { rm -f "$SANDBOX/reaped"; : > "$DOCKER_LOG"; HOME="$FAKE_HOME" PATH="$SHIM_DIR:$PATH" bash "$HEALTH" "$PROJ" "$WT" --reap 2>&1; }
+
+echo "== T8: reap — exact compose-label match, containers removed, loud positive report (AC2)"
+run_reap >"$SANDBOX/t8.out"
+assert "reap exits 0" test $? -eq 0
+assert "docker queried with the EXACT compose-project label (no glob)" \
+  grep -q -- "label=com.docker.compose.project=${WT_NAME}" "$DOCKER_LOG"
+assert "no substring/name filter used (sibling lanes safe)" \
+  bash -c "! grep -q -- '--filter name=' '$DOCKER_LOG'"
+assert "matched containers removed via rm -f" \
+  bash -c "grep -q '^rm -f c0ffee1 c0ffee2' '$DOCKER_LOG' || grep -q '^rm -f' '$DOCKER_LOG'"
+assert "reap reported positively (containers only, volumes kept)" \
+  grep -q 'volumes kept' "$SANDBOX/t8.out"
+assert "no volume-destroying verbs ever issued" \
+  bash -c "! grep -qE 'down|volume' '$DOCKER_LOG'"
+
+echo "== T9: reap failure modes — docker absent / daemon down never block, never lie"
+# "absent" = a PATH of core system dirs only (docker lives in /usr/local/bin
+# or homebrew on macOS). If this machine has docker in a core dir, skip the
+# absent case rather than touch a real daemon.
+if PATH="/usr/bin:/bin" command -v docker >/dev/null 2>&1; then
+  ok "docker absent: SKIPPED (docker present in core PATH on this machine)"
+else
+  HOME="$FAKE_HOME" PATH="/usr/bin:/bin" bash "$HEALTH" "$PROJ" "$WT" --reap >"$SANDBOX/t9a.out" 2>&1
+  assert "docker absent: reap exits 0 silently" test $? -eq 0
+fi
+rm -f "$SANDBOX/reaped"; : > "$DOCKER_LOG"
+HOME="$FAKE_HOME" PATH="$SHIM_DIR:$PATH" FAKE_DOCKER_INFO_RC=1 bash "$HEALTH" "$PROJ" "$WT" --reap >"$SANDBOX/t9b.out" 2>&1
+assert "daemon down: reap exits 0 (removal never blocked)" test $? -eq 0
+assert "daemon down: reported loudly as unverified, not silent" \
+  grep -q 'daemon unreachable' "$SANDBOX/t9b.out"
+assert "daemon down: no rm attempted" \
+  bash -c "! grep -q '^rm' '$DOCKER_LOG'"
+
+echo "== T10: both removal paths delegate to the ONE reap implementation (drift guard)"
+assert "bin/mux delegates removal-time reaping to health --reap" \
+  grep -q -- 'worktree-session-health.sh" "$proj_path" "$wt_path" --reap' "$MUX_BIN"
+assert "bin/mux reaps on the clean-cleanup path" \
+  bash -c "grep -B3 'Worktree cleaned up (no changes)' '$MUX_BIN' | grep -q worktree_reap_containers || grep -A8 'verdict\" == \"clean\"' '$MUX_BIN' | grep -q worktree_reap_containers"
+assert "pane-exited hook delegates to the same --reap mode" \
+  grep -q -- '--reap' "$CLEANUP_HOOK"
+assert "contract doc references the preflight command" \
+  grep -q 'mux worktree preflight' "$REPO_ROOT/templates/cabinet/worktree-invocation-contract.md"
+assert "contract doc references the provisioning declaration" \
+  grep -q '.mux-worktree-provision' "$REPO_ROOT/templates/cabinet/worktree-invocation-contract.md"
+
+echo ""
+echo "RESULT: ${pass} passed, ${fail} failed"
+[[ "$fail" -eq 0 ]]

package/templates/mux/__tests__/worktree-lifecycle.test.mjs

@@ -0,0 +1,44 @@
+// Guard test for the worktree lane lifecycle (act:dc80380c, Lane E of
+// grp:wt-noise-immunity): spawn-time env provisioning from a per-project
+// .mux-worktree-provision declaration, the pre-spawn preflight, and
+// removal-time container reaping.
+//
+// Drives worktree-lifecycle.fixture.sh, which builds a throwaway repo +
+// worktree under mktemp with HOME overridden and a PATH-shimmed recording
+// fake docker — it never touches the real ~/.mux/worktrees, ~/.config/mux,
+// any live worktree, or a real docker daemon.
+//
+// The rules under test:
+//   - declared gitignored env files land in a fresh worktree without
+//     hand-copying; freshness refreshes only a locally-UNTOUCHED copy
+//     (a lane's deliberate divergence is never clobbered)
+//   - a declared file that is not gitignored is refused loudly (secrets
+//     must never land as committable untracked files)
+//   - preflight verifies main's sources + declared checks, exit-code gated
+//   - reaping matches the EXACT compose-project label (sibling lanes
+//     survive), removes containers only (never volumes), fails open for
+//     the removal but never silently (docker absent/daemon down)
+//   - both removal paths (bin/mux + the pane-exited hook) delegate to the
+//     one implementation in worktree-session-health.sh --reap
+
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const fixture = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  'worktree-lifecycle.fixture.sh'
+);
+
+test('worktree lane lifecycle: provision / preflight / reap (sandboxed fixture suite)', () => {
+  const res = spawnSync('bash', [fixture], { encoding: 'utf8', timeout: 120_000 });
+  const output = `${res.stdout}\n${res.stderr}`;
+  assert.strictEqual(
+    res.status,
+    0,
+    `fixture suite reported failures:\n${output}`
+  );
+  assert.match(output, /RESULT: \d+ passed, 0 failed/);
+});

package/templates/mux/__tests__/worktree-status-clean.fixture.sh

@@ -0,0 +1,245 @@
+#!/bin/bash
+# Sandboxed AC verification for act:c008862c (mux half) — the worktree
+# "MERGE OR LOSE" false-positive class: mux-manufactured churn (identity
+# symlink typechange, node_modules/pib.db symlinks, machine-written
+# generated state) must never render as dirt or count as unmerged work,
+# while authored files, real edits, and real commits ALWAYS surface.
+#
+# Mechanism note (verified live 2026-07-13): git reads info/exclude from the
+# COMMON git dir only — the per-worktree worktrees/<name>/info/exclude was a
+# file git never consulted, and exclude rules can never hide a TRACKED
+# file's typechange. The implementation therefore (a) points a per-worktree
+# core.excludesFile (extensions.worktreeConfig) at the managed exclude so it
+# becomes live, and (b) holds skip-worktree on tracked identity files WHILE
+# they are mux symlinks into main, clearing the bit the moment a real file
+# returns. The dirty-check carries three independent guards so a deletion
+# can never race the health heal: symlink-gated untracked exclusions (5),
+# skip-worktree'd non-symlinks count dirty (5b), and hidden real files at
+# identity paths count dirty (5c).
+#
+# Fully sandboxed: throwaway repos under mktemp, HOME + GIT_CONFIG_GLOBAL +
+# XDG_CONFIG_HOME overridden, TMUX unset (never touches the operator's
+# live window indicators). Dirty-check verdicts are asserted BEFORE the
+# first health run wherever possible — the live exclude otherwise shadows
+# the dirty-check's own exclusions and a revert would pass green
+# (mutation-testing lesson from this lane's CP).
+set -uo pipefail
+unset TMUX
+
+REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+SANDBOX=$(mktemp -d /tmp/cc-statusclean-test.XXXXXX)
+FAKE_HOME="$SANDBOX/home"
+PROJ="$SANDBOX/proj"
+WT="$SANDBOX/wt"
+HEALTH="$REPO_ROOT/templates/mux/config/worktree-session-health.sh"
+DIRTY="$REPO_ROOT/templates/mux/config/worktree-dirty-check.sh"
+
+export GIT_CONFIG_GLOBAL="$SANDBOX/gitconfig-global"
+export XDG_CONFIG_HOME="$FAKE_HOME/.config"
+
+pass=0; fail=0
+ok()  { echo "  PASS: $1"; pass=$((pass+1)); }
+bad() { echo "  FAIL: $1"; fail=$((fail+1)); }
+assert() { # assert <desc> <cmd...>
+  local desc="$1"; shift
+  if "$@" >/dev/null 2>&1; then ok "$desc"; else bad "$desc"; fi
+}
+run_health() { HOME="$FAKE_HOME" bash "$HEALTH" "$PROJ" "$WT" "$@" 2>&1; }
+run_dirty()  { HOME="$FAKE_HOME" bash "$DIRTY" "$WT" "$PROJ" 2>/dev/null; }
+wt_status()  { git -C "$WT" status --porcelain --untracked-files=all; }
+
+mkdir -p "$FAKE_HOME/.local/share/mux/wt-health" "$FAKE_HOME/.claude/projects" "$XDG_CONFIG_HOME/git"
+echo '.DS_Store' > "$XDG_CONFIG_HOME/git/ignore"
+trap 'rm -rf "$SANDBOX"' EXIT
+
+# --- fixture main repo: consumer-shaped ---------------------------------------
+# Tracked: .mcp.json, .claudeignore, .claude/plans + .claude/cabinet docs
+# (cabinet/ is the tracked-holding dir the generated state hides inside).
+# NO project .gitignore coverage for .claude/ infra — the consumer case where
+# the dead per-worktree exclude left everything visible.
+git init -q "$PROJ"
+git -C "$PROJ" config user.email t@t.t; git -C "$PROJ" config user.name t
+mkdir -p "$PROJ/.claude/plans" "$PROJ/.claude/cabinet" "$PROJ/.claude/skills"
+echo '{"mcpServers":{}}' > "$PROJ/.mcp.json"
+echo 'node_modules' > "$PROJ/.claudeignore"
+echo plan > "$PROJ/.claude/plans/p.md"
+echo checkpoint-doc > "$PROJ/.claude/cabinet/checkpoint.md"
+echo code > "$PROJ/file.txt"
+printf '%s\n' 'node_modules/' > "$PROJ/.gitignore"
+git -C "$PROJ" add -A && git -C "$PROJ" commit -qm init
+echo skill > "$PROJ/.claude/skills/s.md"   # untracked infra in main
+mkdir -p "$PROJ/node_modules"
+touch "$PROJ/pib.db"
+MAIN_SLUG=$(echo "$PROJ" | sed 's|[/.]|-|g')
+mkdir -p "$FAKE_HOME/.claude/projects/$MAIN_SLUG"
+
+git -C "$PROJ" worktree add -q "$WT" -b mux/lane HEAD
+
+# Simulate exactly what create_worktree manufactures (bin/mux :247-252).
+for f in .mcp.json .claudeignore; do
+  rm -f "$WT/$f"; ln -s "$PROJ/$f" "$WT/$f"
+done
+ln -s "$PROJ/pib.db" "$WT/pib.db"
+ln -s "$PROJ/node_modules" "$WT/node_modules"
+
+echo "== T0: PRE-HEALTH — status shows the churn, but the dirty-check already classifies honestly"
+st0=$(git -C "$WT" status --porcelain)
+assert "typechange renders before any health run (precondition)" \
+  grep -q ' T .mcp.json' <<<"$st0"
+echo '{"dismissed":[]}' > "$WT/.claude/cabinet/advisories-state.json"
+echo newplan > "$WT/.claude/plans/new-doc.md"
+d0=$(run_dirty)
+assert "pre-health: authored doc counts, generated state does NOT (uncommitted=1)" \
+  grep -q 'uncommitted=1 verdict=dirty' <<<"$d0"
+rm -f "$WT/.claude/plans/new-doc.md"
+d0b=$(run_dirty)
+assert "pre-health: typechange + symlinks + generated state alone read clean" \
+  grep -q 'commits=0 uncommitted=0 verdict=clean' <<<"$d0b"
+rm -f "$WT/.claude/cabinet/advisories-state.json"
+
+echo "== T1: fresh worktree shows clean git status after creation health run (AC4)"
+run_health --refresh >"$SANDBOX/t1.out"; rc=$?
+assert "creation-time health run exits 0" test "$rc" -eq 0
+assert "git status is EMPTY (no typechange, no symlink churn, no infra)" \
+  test -z "$(wt_status)"
+sw1=$(git -C "$WT" ls-files -v .mcp.json)
+assert "skip-worktree bit held on .mcp.json" grep -q '^S ' <<<"$sw1"
+excf=$(git -C "$WT" config --worktree --get core.excludesFile)
+assert "per-worktree excludesFile is live (worktreeConfig)" \
+  test "$excf" = "$(git -C "$WT" rev-parse --path-format=absolute --git-dir)/info/exclude"
+assert "health reports exclude liveness positively (read-back, not attempt)" \
+  grep -q 'per-worktree exclude rules live' "$SANDBOX/t1.out"
+d1=$(run_dirty)
+assert "dirty-check verdict: clean" grep -q 'verdict=clean' <<<"$d1"
+
+echo "== T2: user-global ignore patterns survive the excludesFile displacement"
+touch "$WT/.DS_Store"
+assert ".DS_Store stays hidden in the worktree" test -z "$(wt_status)"
+rm -f "$WT/.DS_Store"
+
+echo "== T3: git add -A stages NOTHING on a churn-only worktree (the ELOOP class)"
+git -C "$WT" add -A 2>/dev/null
+assert "index unchanged after add -A" \
+  test -z "$(git -C "$WT" diff --cached --name-only)"
+
+echo "== T4: authored uncommitted file still surfaces and still counts (AC2, mux side)"
+echo newplan > "$WT/.claude/plans/new-doc.md"
+st4=$(wt_status)
+assert "authored plans doc visible in status" \
+  grep -q '.claude/plans/new-doc.md' <<<"$st4"
+d4=$(run_dirty)
+assert "dirty-check counts the authored doc (uncommitted=1, dirty)" \
+  grep -q 'uncommitted=1 verdict=dirty' <<<"$d4"
+rm -f "$WT/.claude/plans/new-doc.md"
+
+echo "== T5: generated state inside a tracked-holding dir is churn, not work (AC1, mux side)"
+echo '{"dismissed":[]}' > "$WT/.claude/cabinet/advisories-state.json"
+echo '{"fires":{}}' > "$WT/.claude/cabinet/checklist-stats.json"
+run_health >/dev/null 2>&1
+assert "generated state hidden from status (re-exclude beats the cabinet/ negation)" \
+  test -z "$(wt_status)"
+d5=$(run_dirty)
+assert "dirty-check verdict clean with only generated state present" \
+  grep -q 'verdict=clean' <<<"$d5"
+
+echo "== T6: commits ahead still produce the dirty verdict (AC3, mux side)"
+echo work >> "$WT/file.txt"
+git -C "$WT" commit -qam "real work"
+d6=$(run_dirty)
+assert "dirty-check reports commits=1, verdict=dirty" \
+  grep -q 'commits=1 uncommitted=0 verdict=dirty' <<<"$d6"
+git -C "$PROJ" merge -q mux/lane --no-edit 2>/dev/null
+d6b=$(run_dirty)
+assert "after merge to main the verdict returns to clean" \
+  grep -q 'verdict=clean' <<<"$d6b"
+
+echo "== T7: a REAL .mcp.json edit is never frozen — bit clears at health, edit surfaces"
+rm -f "$WT/.mcp.json"
+echo '{"mcpServers":{"new":{}}}' > "$WT/.mcp.json"
+run_health >/dev/null 2>&1
+sw7=$(git -C "$WT" ls-files -v .mcp.json)
+assert "skip-worktree bit CLEARED once the path holds a real file" grep -q '^H ' <<<"$sw7"
+st7=$(git -C "$WT" status --porcelain)
+assert "the real edit renders in status" grep -q '.mcp.json' <<<"$st7"
+d7=$(run_dirty)
+assert "dirty-check counts the real .mcp.json edit as work" grep -q 'verdict=dirty' <<<"$d7"
+rm -f "$WT/.mcp.json"; ln -s "$PROJ/.mcp.json" "$WT/.mcp.json"
+run_health >/dev/null 2>&1
+
+echo "== T7b: mid-session symlink→real swap, NO health run — deletion must not race the heal"
+rm -f "$WT/.mcp.json"
+echo '{"mcpServers":{"midsession":{}}}' > "$WT/.mcp.json"   # bit still set, porcelain blind
+st7b=$(git -C "$WT" status --porcelain)
+assert "hazard precondition: porcelain is EMPTY while the real edit hides behind the bit" \
+  test -z "$st7b"
+d7b=$(run_dirty)
+assert "dirty-check STILL reads dirty (skip-worktree'd non-symlink counted, 5b)" \
+  grep -q 'verdict=dirty' <<<"$d7b"
+rm -f "$WT/.mcp.json"; ln -s "$PROJ/.mcp.json" "$WT/.mcp.json"
+run_health >/dev/null 2>&1
+
+echo "== T7c: a foreign-target symlink never earns skip-worktree"
+rm -f "$WT/.mcp.json"; ln -s "$SANDBOX/elsewhere.json" "$WT/.mcp.json"
+run_health >/dev/null 2>&1
+sw7c=$(git -C "$WT" ls-files -v .mcp.json)
+assert "foreign symlink: bit NOT held (H, typechange stays visible)" grep -q '^H ' <<<"$sw7c"
+st7c=$(git -C "$WT" status --porcelain)
+assert "foreign symlink renders as a typechange" grep -q ' T .mcp.json' <<<"$st7c"
+rm -f "$WT/.mcp.json"; ln -s "$PROJ/.mcp.json" "$WT/.mcp.json"
+run_health >/dev/null 2>&1
+
+echo "== T9: root-anchored patterns — a NESTED authored .mcp.json is never hidden"
+mkdir -p "$WT/packages/svc"
+echo '{"mcpServers":{"svc":{}}}' > "$WT/packages/svc/.mcp.json"
+run_health >/dev/null 2>&1
+st9=$(wt_status)
+assert "nested .mcp.json visible in status after a health rebuild" \
+  grep -q 'packages/svc/.mcp.json' <<<"$st9"
+d9=$(run_dirty)
+assert "nested .mcp.json counts as work (dirty)" grep -q 'verdict=dirty' <<<"$d9"
+rm -rf "$WT/packages"
+
+echo "== T10: a REAL untracked pib.db (symlink replaced) is work, even before the exclude rebuilds"
+rm -f "$WT/pib.db"
+echo 'sqlite-data' > "$WT/pib.db"      # stale /pib.db exclude line still live
+d10=$(run_dirty)
+assert "pre-rebuild: hidden real pib.db counts dirty (5c)" grep -q 'verdict=dirty' <<<"$d10"
+run_health >/dev/null 2>&1              # rebuild drops the /pib.db line (no symlink)
+st10=$(wt_status)
+assert "post-rebuild: real pib.db visible in status" grep -q 'pib.db' <<<"$st10"
+d10b=$(run_dirty)
+assert "post-rebuild: real pib.db still dirty (symlink gate off)" grep -q 'verdict=dirty' <<<"$d10b"
+rm -f "$WT/pib.db"; ln -s "$PROJ/pib.db" "$WT/pib.db"
+run_health >/dev/null 2>&1
+
+echo "== T8: idempotence — repeat health runs, still clean, no duplicate exclude lines"
+run_health >/dev/null 2>&1; run_health >/dev/null 2>&1
+assert "status still empty after repeat runs" test -z "$(wt_status)"
+ex_file="$(git -C "$WT" rev-parse --path-format=absolute --git-dir)/info/exclude"
+assert "managed exclude lines not duplicated" \
+  bash -c "[ \"\$(grep -cxF '/pib.db' '$ex_file')\" -eq 1 ] && [ \"\$(grep -cxF '.claude/cabinet/advisories-state.json' '$ex_file')\" -eq 1 ]"
+assert "marker blocks not duplicated" \
+  bash -c "[ \"\$(grep -c '>>> mux-managed worktree rules' '$ex_file')\" -eq 1 ] && [ \"\$(grep -c '>>> mux-managed user ignore copy' '$ex_file')\" -eq 1 ]"
+assert "user ignore copy precedes managed rules (authored negations win)" \
+  bash -c "[ \"\$(grep -n 'mux-managed user ignore copy' '$ex_file' | head -1 | cut -d: -f1)\" -lt \"\$(grep -n 'mux-managed worktree rules' '$ex_file' | head -1 | cut -d: -f1)\" ]"
+
+echo "== T11: core.bare guard — a bare-repo layout is never half-migrated to worktreeConfig"
+BARE="$SANDBOX/bare.git"; BPROJ="$SANDBOX/bareproj"; BWT="$SANDBOX/barewt"
+git init -q --bare "$BARE"
+git clone -q "$BARE" "$SANDBOX/seed" 2>/dev/null
+( cd "$SANDBOX/seed" && git config user.email t@t.t && git config user.name t \
+  && mkdir -p .claude/plans && echo p > .claude/plans/p.md && echo x > f.txt \
+  && git add -A && git commit -qm init && git push -q origin HEAD:main )
+git -C "$BARE" worktree add -q "$BWT" main 2>/dev/null
+mkdir -p "$BPROJ/.claude"   # fake proj dir so the health flow reaches the rebuild
+HOME="$FAKE_HOME" bash "$HEALTH" "$BPROJ" "$BWT" >"$SANDBOX/t11.out" 2>&1 || true
+wtc=$(git -C "$BWT" config --get extensions.worktreeConfig 2>/dev/null) || wtc=""
+assert "extensions.worktreeConfig NOT enabled on a bare shared config" test -z "$wtc"
+assert "bare guard reported visibly, not silently" \
+  grep -q 'core.bare=true' "$SANDBOX/t11.out"
+assert "git status still works in the bare repo's worktree" \
+  git -C "$BWT" status --porcelain
+
+echo ""
+echo "RESULT: ${pass} passed, ${fail} failed"
+[[ "$fail" -eq 0 ]]