harness-everything 0.5.3 → 0.6.1

package/ci/mechanism-2ac-atomic-commit-check.test.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const { execFileSync, spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const canonical = path.join(ROOT, 'hooks', 'scripts', 'atomic-commit-check.js');
+const plugin = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'atomic-commit-check.js');
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-atomic-commit-'));
+const repo = path.join(temp, 'repo');
+const outside = path.join(temp, 'outside');
+const stateHome = path.join(temp, 'state');
+
+function git(args) {
+  return execFileSync('git', args, { cwd: repo, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+}
+
+function invoke({ session, tool = 'Edit', target, patch }) {
+  const toolInput = tool === 'apply_patch'
+    ? { patch }
+    : { file_path: target };
+  const payload = {
+    session_id: session,
+    hook_event_name: 'PostToolUse',
+    tool_name: tool,
+    tool_input: toolInput,
+    cwd: repo,
+  };
+  return spawnSync(process.execPath, [canonical], {
+    cwd: repo,
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    env: { ...process.env, HARNESS_STATE_HOME: stateHome },
+  });
+}
+
+function sixInvocations(args) {
+  const results = [];
+  for (let i = 0; i < 6; i++) results.push(invoke(args));
+  return results;
+}
+
+try {
+  fs.mkdirSync(repo, { recursive: true });
+  fs.mkdirSync(outside, { recursive: true });
+  git(['init']);
+  git(['config', 'user.email', 'harness@example.invalid']);
+  git(['config', 'user.name', 'Harness Test']);
+  fs.writeFileSync(path.join(repo, 'tracked.txt'), 'base\n', 'utf8');
+  git(['add', 'tracked.txt']);
+  git(['commit', '-m', 'initial']);
+
+  assert.strictEqual(
+    fs.readFileSync(canonical, 'utf8'),
+    fs.readFileSync(plugin, 'utf8'),
+    'canonical and packaged atomic-commit hooks must remain byte-identical',
+  );
+
+  // Negative control for #90: keep the repository dirty with a pre-existing,
+  // unrelated file. Six host edits outside the workspace must still never
+  // increment the repository edit counter or emit a commit nudge.
+  fs.writeFileSync(path.join(repo, 'pre-existing-unrelated.txt'), 'unrelated\n', 'utf8');
+  const outsideTarget = path.join(outside, 'scratch.txt');
+  const outsideResults = sixInvocations({ session: 'outside-edit', target: outsideTarget });
+  assert.ok(outsideResults.every(result => result.status === 0), 'outside-workspace Edit calls must never nudge even when the repo is already dirty');
+  assert.ok(outsideResults.every(result => !String(result.stderr || '').includes('Atomic Commit Check')), 'outside-workspace Edit calls must stay silent');
+
+  const outsidePatchResults = sixInvocations({
+    session: 'outside-patch',
+    tool: 'apply_patch',
+    patch: `*** Begin Patch\n*** Update File: ${outsideTarget}\n@@\n-old\n+new\n*** End Patch`,
+  });
+  assert.ok(outsidePatchResults.every(result => result.status === 0), 'outside-workspace apply_patch headers must not increment the count');
+  fs.rmSync(path.join(repo, 'pre-existing-unrelated.txt'));
+
+  // A clean worktree is never a valid reason to request a commit. The sixth
+  // in-workspace event therefore stays non-blocking and resets the stale count.
+  const cleanResults = sixInvocations({ session: 'clean-tree', target: path.join(repo, 'tracked.txt') });
+  assert.ok(cleanResults.every(result => result.status === 0), 'clean worktree must not nudge at the threshold');
+  assert.ok(cleanResults.every(result => !String(result.stderr || '').includes('Atomic Commit Check')), 'clean worktree must not print a commit reminder');
+
+  // Real in-workspace edits with Git-visible changes still preserve the nudge.
+  fs.writeFileSync(path.join(repo, 'tracked.txt'), 'changed\n', 'utf8');
+  const dirtyResults = sixInvocations({ session: 'dirty-tree', target: path.join(repo, 'tracked.txt') });
+  assert.ok(dirtyResults.slice(0, 5).every(result => result.status === 0), 'first five in-workspace edits remain non-blocking');
+  assert.strictEqual(dirtyResults[5].status, 2, 'sixth in-workspace edit with uncommitted changes nudges');
+  assert.match(String(dirtyResults[5].stderr || ''), /6 edits since the last commit/, 'nudge wording is tool-neutral');
+  assert.doesNotMatch(String(dirtyResults[5].stderr || ''), /apply_patch calls/, 'nudge no longer claims all edits are apply_patch calls');
+
+  // apply_patch paths inside the repository count too.
+  const patchResults = sixInvocations({
+    session: 'inside-patch',
+    tool: 'apply_patch',
+    patch: '*** Begin Patch\n*** Update File: tracked.txt\n@@\n-old\n+new\n*** End Patch',
+  });
+  assert.strictEqual(patchResults[5].status, 2, 'in-workspace apply_patch header participates in the threshold');
+
+  // Moving HEAD resets the counter for the same session.
+  git(['add', 'tracked.txt']);
+  git(['commit', '-m', 'save change']);
+  const afterCommit = invoke({ session: 'dirty-tree', target: path.join(repo, 'tracked.txt') });
+  assert.strictEqual(afterCommit.status, 0, 'counter resets after a commit moves HEAD');
+
+  console.log('PASS: atomic commit check scopes edits to the workspace and suppresses clean-tree false nudges');
+} finally {
+  fs.rmSync(temp, { recursive: true, force: true });
+}

package/ci/mechanism-2ad-action-gate-classifier-hardening.test.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const canonicalScript = path.join(ROOT, 'hooks', 'scripts', 'action-gate.js');
+const pluginScript = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'action-gate.js');
+const canonicalRules = path.join(ROOT, 'hooks', 'scripts', 'action-gate-rules.json');
+const pluginRules = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'action-gate-rules.json');
+const actionGate = require(canonicalScript);
+
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-action-gate-hardening-'));
+const sessionDir = path.join(temp, 'session');
+fs.mkdirSync(path.join(sessionDir, 'scratch'), { recursive: true });
+
+function payload(command, tool = 'Bash', cwd = ROOT) {
+  return {
+    session_id: 'classifier-hardening',
+    hook_event_name: 'PreToolUse',
+    tool_name: tool,
+    tool_input: { command },
+    cwd,
+  };
+}
+
+function matched(table, command, expected, tool = 'Bash', cwd = ROOT) {
+  const rule = actionGate.classify(payload(command, tool, cwd), table.rules, sessionDir);
+  assert.ok(rule, `${command} should match ${expected}`);
+  assert.strictEqual(rule.id, expected, `${command} should match ${expected}, got ${rule && rule.id}`);
+}
+
+function allowed(table, command, tool = 'Bash', cwd = ROOT) {
+  const rule = actionGate.classify(payload(command, tool, cwd), table.rules, sessionDir);
+  assert.strictEqual(rule, null, `${command} should not be classified as destructive`);
+}
+
+try {
+  assert.strictEqual(fs.readFileSync(canonicalScript, 'utf8'), fs.readFileSync(pluginScript, 'utf8'), 'canonical and packaged action-gate scripts must remain byte-identical');
+  assert.strictEqual(fs.readFileSync(canonicalRules, 'utf8'), fs.readFileSync(pluginRules, 'utf8'), 'canonical and packaged action-gate rule tables must remain byte-identical');
+
+  const table = actionGate.loadRuleTable(canonicalRules);
+  assert.strictEqual(table.degraded, false, 'production rule table must load normally');
+
+  const builtinById = new Map(actionGate.BUILTIN_RULES.map(rule => [rule.id, rule]));
+  for (const rule of table.rules) {
+    const fallback = builtinById.get(rule.id);
+    assert.ok(fallback, `built-in fallback must contain ${rule.id}`);
+    assert.deepStrictEqual(
+      { tools: fallback.tools, pattern: fallback.pattern, flags: fallback.flags, reason: fallback.reason, scope: fallback.scope },
+      { tools: rule.tools, pattern: rule.pattern, flags: rule.flags, reason: rule.reason, scope: rule.scope },
+      `built-in fallback must stay aligned with configured rule ${rule.id}`,
+    );
+  }
+
+  // Confirmed fail-open variants from #100.
+  matched(table, 'git -C . push --force origin main', 'git-force-push');
+  matched(table, 'git push origin +main', 'git-force-push');
+  matched(table, 'git push -uf origin main', 'git-force-push');
+  matched(table, 'git reset -q --hard HEAD~1', 'git-reset-hard');
+  matched(table, 'git -c key=value reset --hard', 'git-reset-hard');
+  matched(table, 'sudo rm -rf /opt/app', 'recursive-delete');
+  matched(table, 'bash -c "rm -rf C:/important"', 'recursive-delete');
+  matched(table, 'ri -Recurse -Force C:\\repo\\x', 'powershell-recursive-force-delete', 'PowerShell');
+  matched(table, 'rm -r -fo C:\\repo\\x', 'powershell-recursive-force-delete', 'PowerShell');
+
+  // Quoted/descriptive text is not an executable destructive command.
+  allowed(table, 'node -e "console.log(\'Remove-Item -Recurse -Force C:\\\\repo\\\\x\')"', 'Bash');
+  allowed(table, 'echo "never DROP TABLE users"');
+  allowed(table, 'grep -rn "npm publish" docs/');
+  allowed(table, 'git push origin main');
+
+  // Scratch cleanup keeps working for direct commands and PowerShell aliases.
+  const bashScratch = process.platform === 'win32' ? '/tmp/harness-action-gate-safe' : path.join(os.tmpdir(), 'harness-action-gate-safe');
+  allowed(table, `rm -rf "${bashScratch}"`, 'Bash');
+  const psScratch = path.join(sessionDir, 'scratch', 'build');
+  allowed(table, `rm -r -fo "${psScratch}"`, 'PowerShell');
+  allowed(table, `ri -Recurse -Force "${psScratch}"`, 'PowerShell');
+
+  // An unresolved variable remains conservative rather than creating a new
+  // fail-open path: the gate cannot prove that the target is scratch space.
+  matched(table, 'rm -rf "$S"', 'recursive-delete');
+
+  console.log('PASS: destructive-command classifier covers confirmed bypasses while suppressing quoted-text false positives');
+} finally {
+  fs.rmSync(temp, { recursive: true, force: true });
+}

package/ci/mechanism-31-opencode-hardlock-evidence.test.js

@@ -0,0 +1,138 @@
+const fs = require('fs');
+const path = require('path');
+const helper = require('./test-helper');
+const {
+  BLOCKED_MARKER,
+  HARDLOCK_MESSAGE,
+  INSTALLED_PLUGIN_NAME,
+  POST_REFLECTION_MARKER,
+  PRELOCK_MARKER,
+  verifyEvidence,
+} = require('../behavioral-evals/opencode-hardlock-live');
+
+console.log('\n[31] opencode live hard-lock evidence contract...');
+
+function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(value, null, 2));
+}
+
+function makeEvidence() {
+  const dir = helper.tempDir('.mechanism-test-opencode-live-evidence');
+  fs.mkdirSync(path.join(dir, 'workspace'), { recursive: true });
+  fs.mkdirSync(path.join(dir, 'state'), { recursive: true });
+  const pluginHash = 'a'.repeat(64);
+  writeJson(path.join(dir, 'metadata.json'), {
+    schemaVersion: 1,
+    stateIsolated: true,
+    installedPluginName: INSTALLED_PLUGIN_NAME,
+    pluginSha256: pluginHash,
+    installedPluginSha256: pluginHash,
+  });
+  const toolEvent = (input) => JSON.stringify({
+    type: 'tool',
+    part: { tool: 'edit', state: { input } },
+  });
+  fs.writeFileSync(path.join(dir, 'transcript.jsonl'), [
+    toolEvent({ filePath: 'probe.txt', text: PRELOCK_MARKER }),
+    toolEvent({ filePath: 'probe.txt', text: POST_REFLECTION_MARKER }),
+    toolEvent({ filePath: 'probe.txt', text: BLOCKED_MARKER }),
+    JSON.stringify({ type: 'text', part: { text: `${HARDLOCK_MESSAGE} after a repeat failure post-reflection.` } }),
+    '',
+  ].join('\n'));
+  fs.writeFileSync(path.join(dir, 'stderr.txt'), '', 'utf8');
+  fs.writeFileSync(path.join(dir, 'workspace', 'probe.txt'), `baseline\n${PRELOCK_MARKER}\n${POST_REFLECTION_MARKER}\n`, 'utf8');
+  writeJson(path.join(dir, 'state', 'circuit-breaker.json'), {
+    failures: {
+      'npm test: HARNESS_LIVE_PROBE_RED': { count: 4, firstSeen: 1, lastSeen: 5 },
+    },
+    hardLock: true,
+    lastReflection: 4,
+    lastReflectionSignature: 'npm test: HARNESS_LIVE_PROBE_RED',
+    reflectionPending: false,
+    reflectionRequestedAt: null,
+    reflectionToken: null,
+    reflectionSignature: null,
+  });
+  fs.writeFileSync(path.join(dir, 'state', 'zoom-out-report.md'), [
+    '## Goal',
+    'exercise the breaker',
+    '## Failed Attempts',
+    'three controlled failures',
+    '## Verified Facts',
+    'the verification fixture intentionally stays red',
+    '## Diagnosis',
+    'this is a live enforcement probe',
+    '## Decision',
+    'RESUME: reproduce the same failure once after reflection',
+    'Reflection token: abc123',
+    '',
+  ].join('\n'));
+  return dir;
+}
+
+try {
+  const valid = makeEvidence();
+  let result = verifyEvidence(valid);
+  helper.check('31. complete attributed hard-lock evidence passes', result.passed, JSON.stringify(result.checks.filter((entry) => !entry.pass)));
+
+  const wrongPlugin = makeEvidence();
+  const metadataFile = path.join(wrongPlugin, 'metadata.json');
+  const metadata = JSON.parse(fs.readFileSync(metadataFile, 'utf8'));
+  metadata.installedPluginSha256 = 'b'.repeat(64);
+  writeJson(metadataFile, metadata);
+  result = verifyEvidence(wrongPlugin);
+  helper.check(
+    '31. evidence fails when the installed plugin hash differs from the canonical source hash',
+    !result.passed && result.checks.some((entry) => entry.name === 'installed plugin is byte-identical to the recorded canonical source' && !entry.pass),
+    JSON.stringify(result.checks),
+  );
+
+  const landed = makeEvidence();
+  fs.appendFileSync(path.join(landed, 'workspace', 'probe.txt'), `${BLOCKED_MARKER}\n`);
+  result = verifyEvidence(landed);
+  helper.check(
+    '31. negative control fails if the blocked marker reached the filesystem',
+    !result.passed && result.checks.some((entry) => entry.name === 'blocked marker did not reach the filesystem' && !entry.pass),
+    JSON.stringify(result.checks),
+  );
+
+  const unlocked = makeEvidence();
+  const breakerFile = path.join(unlocked, 'state', 'circuit-breaker.json');
+  const breaker = JSON.parse(fs.readFileSync(breakerFile, 'utf8'));
+  breaker.hardLock = false;
+  writeJson(breakerFile, breaker);
+  result = verifyEvidence(unlocked);
+  helper.check(
+    '31. evidence fails without a pre-reset hard-lock snapshot',
+    !result.passed && result.checks.some((entry) => entry.name === 'pre-reset breaker snapshot is hard-locked' && !entry.pass),
+    JSON.stringify(result.checks),
+  );
+
+  const noAttempt = makeEvidence();
+  const transcript = fs.readFileSync(path.join(noAttempt, 'transcript.jsonl'), 'utf8')
+    .split(/\r?\n/)
+    .filter((line) => !line.includes(BLOCKED_MARKER))
+    .join('\n');
+  fs.writeFileSync(path.join(noAttempt, 'transcript.jsonl'), transcript);
+  result = verifyEvidence(noAttempt);
+  helper.check(
+    '31. evidence fails when the final blocked edit was never observed as a structured tool attempt',
+    !result.passed && result.checks.some((entry) => entry.name === 'structured tool trace contains the final blocked edit attempt' && !entry.pass),
+    JSON.stringify(result.checks),
+  );
+
+  const noReflection = makeEvidence();
+  fs.rmSync(path.join(noReflection, 'state', 'zoom-out-report.md'));
+  result = verifyEvidence(noReflection);
+  helper.check(
+    '31. evidence fails without the preserved reflection artifact',
+    !result.passed && result.checks.some((entry) => entry.name === 'reflection artifact is valid and preserved' && !entry.pass),
+    JSON.stringify(result.checks),
+  );
+
+  helper.finish();
+} catch (error) {
+  helper.check('31. OpenCode hard-lock live evidence contract', false, error.stack);
+  helper.finish();
+}

package/ci/mechanism-32-paired-benchmark.test.js

@@ -0,0 +1,254 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const helper = require('./test-helper');
+const {
+  mcnemarExactP,
+  prepareArmWorkspace,
+  summarizePairs,
+  validatePairRecord,
+  validateRunConfig,
+} = require('../behavioral-evals/paired-benchmark');
+
+console.log('\n[32] paired behavioral benchmark contract...');
+
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable(value[key])]));
+}
+
+function hash(value) {
+  return crypto.createHash('sha256').update(JSON.stringify(stable(value))).digest('hex');
+}
+
+function skillContract(caseId = 'case-a') {
+  return {
+    schema_version: 1,
+    effect_type: 'skill-text',
+    engine: 'opencode',
+    requested_model: 'test/model',
+    case_id: caseId,
+    max_turns: 8,
+    loaded_skills: ['tdd'],
+    fixture_sha256: 'fixture-hash',
+    prompt_sha256: 'prompt-hash',
+    rubric_sha256: 'rubric-hash',
+    execution_policy: 'opencode-auto',
+  };
+}
+
+function arm(outcome, treatment, overrides = {}) {
+  return {
+    outcome,
+    model_name: 'test/model',
+    intervention: {
+      skill_text: treatment,
+      plugin_enforcement: false,
+    },
+    loaded_skills: treatment ? ['tdd'] : [],
+    plugin_sha256: null,
+    plugin_attribution: null,
+    cost: treatment ? 2 : 1,
+    total_tokens: treatment ? 120 : 100,
+    tool_call_count: treatment ? 4 : 3,
+    duration_ms: treatment ? 1200 : 1000,
+    ...overrides,
+  };
+}
+
+function skillPair(id, baselineOutcome, treatmentOutcome, overrides = {}) {
+  const contract = skillContract(overrides.caseId || id);
+  return {
+    schema_version: 1,
+    id: overrides.caseId || id,
+    pair_id: id,
+    effect_type: 'skill-text',
+    contract,
+    contract_sha256: hash(contract),
+    arms: {
+      baseline: arm(baselineOutcome, false, overrides.baseline || {}),
+      treatment: arm(treatmentOutcome, true, overrides.treatment || {}),
+    },
+  };
+}
+
+try {
+  const missingThreshold = validateRunConfig({
+    effect_type: 'skill-text', engine: 'opencode', model: 'test/model',
+    min_effect_pp: NaN, repeats: 1,
+  });
+  helper.check(
+    '32. a paired study cannot start without a predeclared minimum effect',
+    missingThreshold.some((problem) => problem.includes('min-effect-pp')),
+    missingThreshold.join('; '),
+  );
+
+  const noModel = validateRunConfig({
+    effect_type: 'skill-text', engine: 'opencode', model: '',
+    min_effect_pp: 10, repeats: 1,
+  });
+  helper.check(
+    '32. an explicit model is required so both arms share the same model contract',
+    noModel.some((problem) => problem.includes('explicit --model')),
+    noModel.join('; '),
+  );
+
+  const badPluginEngine = validateRunConfig({
+    effect_type: 'plugin-enforcement', engine: 'claude', model: 'test/model',
+    min_effect_pp: 10, repeats: 1,
+  });
+  helper.check(
+    '32. plugin-enforcement is not generalized beyond the currently attributed OpenCode surface',
+    badPluginEngine.some((problem) => problem.includes('opencode only')),
+    badPluginEngine.join('; '),
+  );
+
+  const fixtureCase = {
+    id: 'workspace-shape',
+    discipline: 'tdd',
+    fixture: { files: [{ path: 'probe.txt', content: 'baseline\n' }] },
+  };
+  const skillBaseline = prepareArmWorkspace(fixtureCase, 'skill-text', 'baseline', 'opencode');
+  const skillTreatment = prepareArmWorkspace(fixtureCase, 'skill-text', 'treatment', 'opencode');
+  helper.check(
+    '32. skill-text control contains no Harness skill or plugin',
+    !fs.existsSync(path.join(skillBaseline.ws, '.claude', 'skills', 'tdd', 'SKILL.md')) &&
+      !fs.existsSync(path.join(skillBaseline.ws, '.opencode', 'plugins', 'harness-enforcement.js')),
+    skillBaseline.ws,
+  );
+  helper.check(
+    '32. skill-text treatment installs the named skill without installing hooks/plugin enforcement',
+    fs.existsSync(path.join(skillTreatment.ws, '.claude', 'skills', 'tdd', 'SKILL.md')) &&
+      !fs.existsSync(path.join(skillTreatment.ws, '.claude', 'settings.json')) &&
+      !fs.existsSync(path.join(skillTreatment.ws, '.opencode', 'plugins', 'harness-enforcement.js')),
+    skillTreatment.ws,
+  );
+  fs.rmSync(skillBaseline.ws, { recursive: true, force: true });
+  fs.rmSync(skillTreatment.ws, { recursive: true, force: true });
+
+  const pluginBaseline = prepareArmWorkspace(fixtureCase, 'plugin-enforcement', 'baseline', 'opencode');
+  const pluginTreatment = prepareArmWorkspace(fixtureCase, 'plugin-enforcement', 'treatment', 'opencode');
+  helper.check(
+    '32. plugin experiment holds skill text constant and changes only enforcement installation',
+    fs.existsSync(path.join(pluginBaseline.ws, '.claude', 'skills', 'tdd', 'SKILL.md')) &&
+      fs.existsSync(path.join(pluginTreatment.ws, '.claude', 'skills', 'tdd', 'SKILL.md')) &&
+      !fs.existsSync(path.join(pluginBaseline.ws, '.opencode', 'plugins', 'harness-enforcement.js')) &&
+      fs.existsSync(path.join(pluginTreatment.ws, '.opencode', 'plugins', 'harness-enforcement.js')),
+    JSON.stringify({ baseline: pluginBaseline.ws, treatment: pluginTreatment.ws }),
+  );
+  fs.rmSync(pluginBaseline.ws, { recursive: true, force: true });
+  fs.rmSync(pluginTreatment.ws, { recursive: true, force: true });
+
+  const validSkillPair = skillPair('p1', 'fail', 'pass');
+  helper.check('32. a correctly isolated skill-text pair is includable', validatePairRecord(validSkillPair).included, JSON.stringify(validatePairRecord(validSkillPair)));
+
+  const modelMismatch = skillPair('model-mismatch', 'fail', 'pass', {
+    treatment: { model_name: 'other/model' },
+  });
+  helper.check(
+    '32. actual model mismatch excludes the pair instead of counting it as behavior',
+    !validatePairRecord(modelMismatch).included && validatePairRecord(modelMismatch).reason === 'actual-model-mismatch',
+    JSON.stringify(validatePairRecord(modelMismatch)),
+  );
+
+  const pluginContract = {
+    schema_version: 1,
+    effect_type: 'plugin-enforcement',
+    engine: 'opencode',
+    requested_model: 'test/model',
+    case_id: 'plugin-case',
+    max_turns: 8,
+    loaded_skills: ['tdd'],
+    fixture_sha256: 'fixture-hash',
+    prompt_sha256: 'prompt-hash',
+    rubric_sha256: 'rubric-hash',
+    execution_policy: 'opencode-auto',
+  };
+  const pluginPair = {
+    id: 'plugin-case',
+    pair_id: 'plugin-pair',
+    effect_type: 'plugin-enforcement',
+    contract: pluginContract,
+    contract_sha256: hash(pluginContract),
+    preflight: { passed: true, plugin_sha256: 'plugin-hash' },
+    arms: {
+      baseline: {
+        ...arm('fail', true),
+        intervention: { skill_text: true, plugin_enforcement: false },
+        loaded_skills: ['tdd'],
+      },
+      treatment: {
+        ...arm('pass', true),
+        intervention: { skill_text: true, plugin_enforcement: true },
+        loaded_skills: ['tdd'],
+        plugin_sha256: 'plugin-hash',
+        plugin_attribution: { fired: true, state_files: ['workspaces/x/state/sessions/y/edit-state.json'] },
+      },
+    },
+  };
+  helper.check(
+    '32. plugin pair is includable only when preflight, hash, constant skill text, and per-arm attribution agree',
+    validatePairRecord(pluginPair).included,
+    JSON.stringify(validatePairRecord(pluginPair)),
+  );
+  const unattributedPlugin = JSON.parse(JSON.stringify(pluginPair));
+  unattributedPlugin.pair_id = 'plugin-unattributed';
+  unattributedPlugin.arms.treatment.plugin_attribution.fired = false;
+  helper.check(
+    '32. missing live plugin attribution is infrastructure/inconclusive, not a behavioral result',
+    !validatePairRecord(unattributedPlugin).included && validatePairRecord(unattributedPlugin).reason === 'plugin-attribution-missing',
+    JSON.stringify(validatePairRecord(unattributedPlugin)),
+  );
+
+  const records = [
+    skillPair('a-r1', 'fail', 'pass', { caseId: 'a' }),
+    skillPair('a-r2', 'fail', 'pass', { caseId: 'a' }),
+    skillPair('b-r1', 'pass', 'fail', { caseId: 'b' }),
+    skillPair('c-r1', 'pass', 'pass', { caseId: 'c' }),
+    skillPair('infra-r1', 'pass', 'session-error', { caseId: 'infra' }),
+  ];
+  const summary = summarizePairs(records, 10);
+  helper.check(
+    '32. summary excludes infrastructure outcomes and reports paired transitions',
+    summary.requested_pairs === 5 && summary.included_pairs === 4 && summary.excluded_pairs === 1 &&
+      summary.transitions['fail->pass'] === 2 && summary.transitions['pass->fail'] === 1 &&
+      summary.transitions['pass->pass'] === 1 && summary.transitions['fail->fail'] === 0,
+    JSON.stringify(summary),
+  );
+  helper.check(
+    '32. paired effect is derived from within-pair transitions and carries a deterministic uncertainty interval',
+    summary.paired_effect_pp === 25 && Array.isArray(summary.paired_effect_ci95_pp) && summary.paired_effect_ci95_pp.length === 2,
+    JSON.stringify(summary),
+  );
+  helper.check(
+    '32. repeated runs remain separate samples and expose per-case variance instead of overwriting',
+    summary.repeat_variance.a.repeats === 2 && summary.repeat_variance.a.paired_difference_variance === 0,
+    JSON.stringify(summary.repeat_variance),
+  );
+  helper.check(
+    '32. cost and execution overhead are reported separately from correctness',
+    summary.cost_and_execution_overhead.cost_delta.mean === 1 &&
+      summary.cost_and_execution_overhead.token_delta.mean === 20 &&
+      summary.cost_and_execution_overhead.tool_call_delta.mean === 1 &&
+      summary.cost_and_execution_overhead.duration_ms_delta.mean === 200,
+    JSON.stringify(summary.cost_and_execution_overhead),
+  );
+  helper.check(
+    '32. exact discordant-pair statistic is available without turning it into an unpaired pass-rate verdict',
+    mcnemarExactP(2, 1) === 1 && summary.mcnemar_exact_p === 1,
+    JSON.stringify({ direct: mcnemarExactP(2, 1), summary: summary.mcnemar_exact_p }),
+  );
+  helper.check(
+    '32. the predeclared practical threshold is retained in the summary decision contract',
+    summary.decision.min_effect_pp === 10 && /predeclared/i.test(summary.decision.rule),
+    JSON.stringify(summary.decision),
+  );
+
+  helper.finish();
+} catch (error) {
+  helper.check('32. paired behavioral benchmark contract', false, error.stack);
+  helper.finish();
+}

package/hooks/scripts/action-gate-rules.json

@@ -4,7 +4,7 @@
     {
       "id": "git-force-push",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))",
       "flags": "i",
       "reason": "Force-pushing can rewrite remote history.",
       "scope": "always"
@@ -12,7 +12,7 @@
     {
       "id": "git-reset-hard",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+reset\\s+--hard\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b",
       "flags": "i",
       "reason": "git reset --hard can discard local work.",
       "scope": "always"
@@ -20,7 +20,7 @@
     {
       "id": "git-clean-force-delete",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))",
       "flags": "i",
       "reason": "git clean with force and directory deletion can remove untracked work.",
       "scope": "always"
@@ -28,15 +28,15 @@
     {
       "id": "recursive-delete",
       "tools": ["Bash"],
-      "pattern": "(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\\"']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
       "flags": "i",
       "reason": "Recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
     },
     {
       "id": "powershell-recursive-force-delete",
-      "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
+      "tools": ["PowerShell"],
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
       "flags": "i",
       "reason": "PowerShell recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
@@ -44,7 +44,7 @@
     {
       "id": "sql-destructive-ddl",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
       "flags": "i",
       "reason": "Destructive SQL DDL can irreversibly remove production data or schema state.",
       "scope": "always"
@@ -52,7 +52,7 @@
     {
       "id": "package-publish",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
       "flags": "i",
       "reason": "Publishing creates an external package/release side effect.",
       "scope": "always"
@@ -60,7 +60,7 @@
     {
       "id": "github-release-create",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgh\\s+release\\s+create\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b",
       "flags": "i",
       "reason": "Creating a GitHub release is an external irreversible publication action.",
       "scope": "always"
@@ -68,7 +68,7 @@
     {
       "id": "production-deploy",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
       "flags": "i",
       "reason": "Deployment changes an external environment and requires explicit approval.",
       "scope": "always"