hypomnema 1.2.0 → 1.3.0

package/scripts/install-git-hooks.mjs

@@ -0,0 +1,258 @@
+#!/usr/bin/env node
+/**
+ * scripts/install-git-hooks.mjs — idempotent git pre-commit hook installer.
+ *
+ * Wired into package.json as the `prepare` script so it runs after every
+ * `npm install` / `npm ci` in this checkout. The installer is FULLY fail-open:
+ * any filesystem or git error → silent exit 0. The CLAUDE.md formatter rule
+ * is best-effort; a failed install must never block contributor onboarding.
+ *
+ * Trust model:
+ *   - `expectedRoot` is derived from THIS script's filesystem location (via
+ *     `import.meta.url` → realpath), NOT from `git rev-parse`. Git probes
+ *     can be redirected by ambient GIT_DIR/GIT_WORK_TREE; the script's own
+ *     path cannot.
+ *   - All git probes use a scrubbed env (every name from `--local-env-vars`
+ *     plus GIT_NAMESPACE / GIT_CEILING_DIRECTORIES / GIT_CONFIG_*).
+ *   - Probes run with `cwd: expectedRoot` so npm `--prefix` invocations
+ *     can't redirect resolution either.
+ *   - Generated shim embeds `HYPOMNEMA_ROOT` + `HYPOMNEMA_GIT_DIR`. Runtime
+ *     shim refuses to exec unless both literals match the current values.
+ *
+ * Refusal conditions (all exit 0):
+ *   - `CI=true` env (npm ci on CI runs prepare; we must not touch hooks)
+ *   - `npm_command` in {pack, publish} or `npm_lifecycle_event=prepublishOnly`
+ *   - `.git/` absent (consumer install of the published tarball)
+ *   - linked worktree (--absolute-git-dir != --git-common-dir)
+ *   - toplevel != expectedRoot
+ *   - hooks dir / pre-commit file is a symlink
+ *   - existing non-marker pre-commit (don't clobber the user's own hook)
+ *   - any filesystem error (ENOENT, EPERM, EACCES, …)
+ *
+ * Verbose mode: set HYPOMNEMA_HOOK_VERBOSE=1 to see skip/install reasons.
+ */
+
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+
+function exitSilent(msg) {
+  if (process.env.HYPOMNEMA_HOOK_VERBOSE === '1') {
+    process.stderr.write(`[install-git-hooks] ${msg}\n`);
+  }
+  process.exit(0);
+}
+
+// Static fallback list for `--local-env-vars`. Used when we don't yet have a
+// trusted git invocation (the installer is bootstrapping its own trust chain),
+// and also when git is too old to support `--local-env-vars`.
+const STATIC_LOCAL_ENV_VARS = [
+  'GIT_DIR',
+  'GIT_WORK_TREE',
+  'GIT_INDEX_FILE',
+  'GIT_OBJECT_DIRECTORY',
+  'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+  'GIT_COMMON_DIR',
+  'GIT_CONFIG',
+  'GIT_CONFIG_PARAMETERS',
+  'GIT_PREFIX',
+  'GIT_IMPLICIT_WORK_TREE',
+  'GIT_GRAFT_FILE',
+  'GIT_NO_REPLACE_OBJECTS',
+  'GIT_REPLACE_REF_BASE',
+  'GIT_SHALLOW_FILE',
+];
+
+function buildScrubbedEnv(localEnvList) {
+  const scrub = new Set([
+    ...(localEnvList || STATIC_LOCAL_ENV_VARS),
+    'GIT_NAMESPACE',
+    'GIT_CEILING_DIRECTORIES',
+    ...Object.keys(process.env).filter((k) => /^GIT_CONFIG_/.test(k)),
+  ]);
+  return Object.fromEntries(Object.entries(process.env).filter(([k]) => !scrub.has(k)));
+}
+
+function shellSingleQuote(s) {
+  // POSIX-safe: 'x' → 'x', x'y → 'x'\''y'
+  return `'` + s.replace(/'/g, `'\\''`) + `'`;
+}
+
+function shimBody(root, gitDir) {
+  return `#!/bin/sh
+# hypomnema-pre-commit-marker v1
+# Fail-open at every guard. Only the .mjs (after identity checks) can exit nonzero.
+set +e
+HYPOMNEMA_ROOT=${shellSingleQuote(root)}
+HYPOMNEMA_GIT_DIR=${shellSingleQuote(gitDir)}
+TOPLEVEL="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+[ -z "$TOPLEVEL" ] && exit 0
+[ "$TOPLEVEL" = "$HYPOMNEMA_ROOT" ] || exit 0
+ABSGITDIR="$(git rev-parse --absolute-git-dir 2>/dev/null)" || exit 0
+[ "$ABSGITDIR" = "$HYPOMNEMA_GIT_DIR" ] || exit 0
+SCRIPT="$HYPOMNEMA_ROOT/scripts/pre-commit-format.mjs"
+[ -f "$SCRIPT" ] || exit 0
+command -v node >/dev/null 2>&1 || exit 0
+# Sentinel: tells the .mjs it is running under our trusted shim (not direct
+# attacker invocation). The .mjs preserves inherited GIT_INDEX_FILE only when
+# this sentinel is present — direct invocation drops it and falls back to the
+# default \`.git/index\`. This closes prefix-matching attacks on the index
+# whitelist (e.g. attacker-crafted .git/next-index-attack.lock).
+HYPOMNEMA_HOOK_INVOCATION=1 exec node "$SCRIPT"
+`;
+}
+
+function writeShim(target, root, gitDir) {
+  try {
+    fs.writeFileSync(target, shimBody(root, gitDir), { mode: 0o755 });
+    try {
+      fs.chmodSync(target, 0o755);
+    } catch {}
+    return exitSilent(`installed pre-commit hook for ${root}`);
+  } catch (e) {
+    return exitSilent(`write hook failed: ${e.code || e.message}; skipping`);
+  }
+}
+
+async function main() {
+  try {
+    // (0) CI / lifecycle guards.
+    if (process.env.CI === 'true') return exitSilent('CI=true; skipping');
+    const lc = process.env.npm_command;
+    if (lc === 'pack' || lc === 'publish') {
+      return exitSilent(`npm_command=${lc}; skipping`);
+    }
+    if (process.env.npm_lifecycle_event === 'prepublishOnly') {
+      return exitSilent('prepublishOnly; skipping');
+    }
+
+    // (1) Derive expectedRoot from THIS script's location, not from git.
+    const here = path.dirname(url.fileURLToPath(import.meta.url));
+    let expectedRoot;
+    try {
+      expectedRoot = fs.realpathSync(path.resolve(here, '..'));
+    } catch {
+      return exitSilent('cannot resolve script location; skipping');
+    }
+
+    // (2) Bootstrap scrubbed env with the static fallback list, just enough to
+    //     get a trusted git probe running. Then enrich from --local-env-vars at
+    //     runtime (modern git) so the scrub list always tracks git's own truth.
+    let cleanEnv = buildScrubbedEnv(null);
+    let run = (args) =>
+      execFileSync('git', args, {
+        encoding: 'utf-8',
+        env: cleanEnv,
+        cwd: expectedRoot,
+      }).trim();
+    try {
+      const list = run(['rev-parse', '--local-env-vars']).split(/\r?\n/).filter(Boolean);
+      cleanEnv = buildScrubbedEnv(list);
+      run = (args) =>
+        execFileSync('git', args, {
+          encoding: 'utf-8',
+          env: cleanEnv,
+          cwd: expectedRoot,
+        }).trim();
+    } catch {
+      // Old git without --local-env-vars; keep static-list cleanEnv.
+    }
+
+    // (3) Probe git with sanitized env.
+    let topR, absGitDir, commonDir;
+    try {
+      topR = fs.realpathSync(run(['rev-parse', '--show-toplevel']));
+      absGitDir = fs.realpathSync(run(['rev-parse', '--absolute-git-dir']));
+      const cd = run(['rev-parse', '--git-common-dir']);
+      commonDir = fs.realpathSync(path.isAbsolute(cd) ? cd : path.join(absGitDir, '..', cd));
+    } catch {
+      return exitSilent('git probe failed; skipping');
+    }
+
+    // (4) Identity + worktree + containment.
+    if (topR !== expectedRoot) {
+      return exitSilent('toplevel != expectedRoot; skipping');
+    }
+    if (absGitDir !== commonDir) {
+      return exitSilent('linked worktree; skipping');
+    }
+    if (!absGitDir.startsWith(expectedRoot + path.sep)) {
+      return exitSilent('gitDir outside expectedRoot; skipping');
+    }
+
+    // (5) Resolve hooks dir (still under sanitized env).
+    let rawHooksDir;
+    try {
+      rawHooksDir = run(['rev-parse', '--git-path', 'hooks']);
+    } catch {
+      return exitSilent('cannot resolve hooks dir; skipping');
+    }
+    if (!path.isAbsolute(rawHooksDir)) {
+      rawHooksDir = path.resolve(expectedRoot, rawHooksDir);
+    }
+
+    if (!fs.existsSync(rawHooksDir)) {
+      // Git creates .git/hooks lazily. Only create when it would land inside
+      // absGitDir — protects against `core.hooksPath=/elsewhere`.
+      if (!rawHooksDir.startsWith(absGitDir + path.sep)) {
+        return exitSilent('hooks dir outside gitDir; skipping');
+      }
+      try {
+        fs.mkdirSync(rawHooksDir, { recursive: true });
+      } catch {
+        return exitSilent('mkdir hooks dir failed; skipping');
+      }
+    }
+
+    let absHooksDir;
+    try {
+      absHooksDir = fs.realpathSync(rawHooksDir);
+    } catch {
+      return exitSilent('realpath hooks dir failed; skipping');
+    }
+
+    // (6) Symlink rejection + containment.
+    try {
+      if (fs.lstatSync(rawHooksDir).isSymbolicLink()) {
+        return exitSilent('hooks dir is symlink; skipping');
+      }
+    } catch {
+      return exitSilent('lstat hooks dir failed; skipping');
+    }
+    const rel = path.relative(absGitDir, absHooksDir);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
+      return exitSilent('hooks dir outside .git/; skipping');
+    }
+
+    // (7) Existing pre-commit logic.
+    const target = path.join(absHooksDir, 'pre-commit');
+    let existing;
+    try {
+      existing = fs.lstatSync(target);
+    } catch (e) {
+      if (e.code === 'ENOENT') {
+        return writeShim(target, expectedRoot, absGitDir);
+      }
+      return exitSilent(`stat target failed: ${e.code}; skipping`);
+    }
+    if (existing.isSymbolicLink()) {
+      return exitSilent('pre-commit is symlink; not overwriting');
+    }
+    let head;
+    try {
+      head = fs.readFileSync(target, 'utf-8').split('\n').slice(0, 3).join('\n');
+    } catch {
+      return exitSilent('read existing pre-commit failed; skipping');
+    }
+    if (head.includes('hypomnema-pre-commit-marker v1')) {
+      // Same marker — regenerate (refreshes embedded root if checkout moved).
+      return writeShim(target, expectedRoot, absGitDir);
+    }
+    return exitSilent('existing non-marker pre-commit; not overwriting');
+  } catch (e) {
+    return exitSilent(`unexpected: ${e.code || e.message}; skipping`);
+  }
+}
+
+main();

package/scripts/lib/adr-corpus.mjs

@@ -0,0 +1,79 @@
+/**
+ * adr-corpus — fs-backed production-code corpus search for the ADR-line grep.
+ *
+ * Kept separate from the pure verifier (scripts/lib/fix-status-verify.mjs) so
+ * that layer stays IO-free and unit-testable with injected searchFns. This
+ * module is itself testable against real temp directories.
+ *
+ * CRITICAL (self-match): the manifest module (scripts/lib/fix-manifest.mjs)
+ * lives *inside* the scripts/ corpus and holds every adrKeyLine as a literal.
+ * If it were scanned, every line would self-match and ADR_LINE_MISSING could
+ * never fire — the gate would be silently vacuous. The builder therefore
+ * excludes caller-supplied paths, resolved absolute, BEFORE reading any file.
+ */
+
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const DEFAULT_EXTENSIONS = ['.mjs', '.js', '.md', '.json', '.cjs'];
+
+function* walk(dir, excludeAbs, extensions) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return; // missing corpus dir is not fatal — other dirs may exist
+  }
+  for (const ent of entries) {
+    const full = join(dir, ent.name);
+    if (excludeAbs.has(resolve(full))) continue;
+    if (ent.isDirectory()) {
+      if (ent.name === 'node_modules' || ent.name === '.git') continue;
+      yield* walk(full, excludeAbs, extensions);
+    } else if (ent.isFile()) {
+      if (extensions.some((e) => ent.name.endsWith(e))) yield full;
+    }
+  }
+}
+
+/**
+ * Build a fixed-string corpus search function.
+ *
+ *   buildCorpusSearch({ repoRoot, includeDirs, excludePaths, extensions })
+ *     → (literal:string) => boolean
+ *
+ * - includeDirs / excludePaths are resolved relative to repoRoot.
+ * - excludePaths are matched by resolved absolute path (handles symlinks of the
+ *   caller-supplied path consistently with the walk's resolve()).
+ * - search is case-sensitive String.includes (fixed string, not regex).
+ *
+ * Files are read once and cached so repeated searches (one per manifest row)
+ * do not re-walk the tree.
+ */
+export function buildCorpusSearch({
+  repoRoot,
+  includeDirs,
+  excludePaths = [],
+  extensions = DEFAULT_EXTENSIONS,
+}) {
+  const excludeAbs = new Set(excludePaths.map((p) => resolve(repoRoot, p)));
+  const contents = [];
+  for (const dir of includeDirs) {
+    const abs = resolve(repoRoot, dir);
+    let isDir = false;
+    try {
+      isDir = statSync(abs).isDirectory();
+    } catch {
+      isDir = false;
+    }
+    if (!isDir) continue;
+    for (const file of walk(abs, excludeAbs, extensions)) {
+      try {
+        contents.push(readFileSync(file, 'utf-8'));
+      } catch {
+        /* unreadable file — skip */
+      }
+    }
+  }
+  return (literal) => contents.some((text) => text.includes(literal));
+}

package/scripts/lib/check-bilingual.mjs

@@ -0,0 +1,141 @@
+/**
+ * lib/check-bilingual.mjs — pure validators for the bilingual release-doc rule.
+ *
+ * Rule source: CLAUDE.md learned_behaviors release-doc-bilingual (2026-05-24).
+ * Every Hypomnema OSS ship must carry an English body PLUS a Korean summary
+ * block in both the CHANGELOG section and the git tag annotation. This module
+ * exports the parsing/validation primitives; the CLI wrapper in
+ * scripts/check-bilingual.mjs handles I/O and exit codes.
+ *
+ * Scope (deliberate): this gate only enforces the KOREAN half. The English
+ * half has been historically present in every ship — the rule exists because
+ * the Korean half is what gets silently dropped under time pressure (see
+ * release-doc-bilingual feedback page). A tag body of "---" + Korean with an
+ * empty English section would technically pass these validators, but that's
+ * acceptable because such a body is not a realistic failure mode for a
+ * maintainer who already wrote the English release notes. If "English missing"
+ * ever becomes a real regression vector, add an English-half threshold.
+ *
+ * Why pure functions: lets tests/runner.mjs construct synthetic CHANGELOG /
+ * tag-body strings without touching real git or real CHANGELOG.md.
+ */
+
+// AC00–D7A3 covers all precomposed Hangul syllables. We NFC-normalize the
+// input before counting so jamo-only inputs (decomposed) still match after
+// composition.
+export const HANGUL_RE = /[가-힣]/g;
+export const HANGUL_BODY_THRESHOLD = 10;
+
+export function countHangul(text) {
+  return (text.normalize('NFC').match(HANGUL_RE) || []).length;
+}
+
+export function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Validate that CHANGELOG.md content has a "## [<version>]" section containing
+ * a "### 한글 요약" sub-section with >= HANGUL_BODY_THRESHOLD Hangul chars.
+ *
+ * @param {string} content  CHANGELOG.md raw content (CRLF tolerated).
+ * @param {string} version  Semver string to look up (e.g. "1.2.1").
+ * @returns {{ok: true, hangulCount: number} | {ok: false, reason: string}}
+ */
+export function validateChangelog(content, version) {
+  if (!version) return { ok: false, reason: 'no version supplied' };
+  const lines = content.replace(/\r\n/g, '\n').split('\n');
+  const versionEsc = escapeRegex(version);
+  // Anchor closing bracket so 1.2.1 does NOT match the prefix of 1.2.10.
+  // Allow trailing " - YYYY-MM-DD" or nothing.
+  const sectionRe = new RegExp(`^## \\[${versionEsc}\\](\\s.*)?$`);
+
+  const startIndices = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (sectionRe.test(lines[i])) startIndices.push(i);
+  }
+  if (startIndices.length === 0) {
+    return { ok: false, reason: `no "## [${version}]" section in CHANGELOG.md` };
+  }
+  if (startIndices.length > 1) {
+    return {
+      ok: false,
+      reason: `duplicate "## [${version}]" sections (${startIndices.length}) in CHANGELOG.md`,
+    };
+  }
+
+  const start = startIndices[0];
+  let sectionEnd = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (/^## /.test(lines[i])) {
+      sectionEnd = i;
+      break;
+    }
+  }
+  const sectionLines = lines.slice(start, sectionEnd);
+
+  const koreanHeadIdx = sectionLines.findIndex((l) => l.trim() === '### 한글 요약');
+  if (koreanHeadIdx === -1) {
+    return { ok: false, reason: `section [${version}] missing "### 한글 요약" sub-section` };
+  }
+
+  // Bound the Korean block: stop at the next H2 OR H3. CHANGELOG.md has
+  // sibling H3s like "### Internal", "### Fixed" — Hangul in those sections
+  // does not count toward the "### 한글 요약" requirement.
+  let koreanEnd = sectionLines.length;
+  for (let i = koreanHeadIdx + 1; i < sectionLines.length; i++) {
+    if (/^(##|###) /.test(sectionLines[i])) {
+      koreanEnd = i;
+      break;
+    }
+  }
+  const body = sectionLines.slice(koreanHeadIdx + 1, koreanEnd).join('\n');
+  const count = countHangul(body);
+  if (count < HANGUL_BODY_THRESHOLD) {
+    return {
+      ok: false,
+      reason:
+        `section [${version}] "### 한글 요약" body has ${count} Hangul chars ` +
+        `(threshold: ${HANGUL_BODY_THRESHOLD}). Heading alone does not count — write real Korean summary.`,
+    };
+  }
+  return { ok: true, hangulCount: count };
+}
+
+/**
+ * Validate that a git tag annotation body has a "---" separator with Korean
+ * text after the LAST such separator. Tolerates earlier "---" markdown
+ * horizontal rules in the English body.
+ *
+ * @param {string} body  Tag annotation body, as returned by
+ *                       `git tag -l --format='%(contents)' <ref>`.
+ * @returns {{ok: true, hangulCount: number} | {ok: false, reason: string}}
+ */
+export function validateTagBody(body) {
+  const lines = body.replace(/\r\n/g, '\n').split('\n');
+  let lastSepIdx = -1;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (lines[i].trim() === '---') {
+      lastSepIdx = i;
+      break;
+    }
+  }
+  if (lastSepIdx === -1) {
+    return {
+      ok: false,
+      reason:
+        'tag annotation has no "---" separator line (expected: English body + "---" + Korean)',
+    };
+  }
+  const tail = lines.slice(lastSepIdx + 1).join('\n');
+  const count = countHangul(tail);
+  if (count < HANGUL_BODY_THRESHOLD) {
+    return {
+      ok: false,
+      reason:
+        `tag body after the last "---" has only ${count} Hangul chars ` +
+        `(threshold: ${HANGUL_BODY_THRESHOLD}). Write a real Korean summary after the separator.`,
+    };
+  }
+  return { ok: true, hangulCount: count };
+}

package/scripts/lib/extensions.mjs

@@ -80,8 +80,8 @@ function pkgRootDir(target) {
 
 /**
  * Discover sync-eligible extensions under `extDir`. Returns a per-type map plus a
- * `warnings` array. Applies the `.hypoignore` filter (#30), the basename
- * whitelist (#9), and pairs each file with its optional `<name>.manifest.json`.
+ * `warnings` array. Applies the `.hypoignore` filter (fix #30), the basename
+ * whitelist (plan §5 #9), and pairs each file with its optional `<name>.manifest.json`.
  * No-ops gracefully when extDir is absent (e.g. --from-remote clones, plan §5 #8).
  */
 export function discoverExtensions(extDir, hypoignorePatterns, hypoDir) {
@@ -364,7 +364,7 @@ export function syncExtensions({
   const discovered = discoverExtensions(extDir, patterns, hypoDir);
   result.warnings.push(...discovered.warnings);
 
-  // E4 (#32): Codex supports hooks + commands only. If the user authored
+  // E4 (fix #32): Codex supports hooks + commands only. If the user authored
   // skills/agents extensions, surface a one-time notice that they are skipped
   // for this target rather than silently dropping them (plan §2 E4).
   if (target === 'codex') {

package/scripts/lib/feedback-scope.mjs

@@ -0,0 +1,21 @@
+// Feedback page `scope:` field vocabulary — shared single source of truth.
+//
+// Consumed by:
+//   - scripts/lint.mjs      (lint-time validation of feedback page frontmatter)
+//   - scripts/feedback.mjs  (create-time --scope validation in /hypo:feedback)
+// Keep this the ONLY definition; both consumers import it so the two validators
+// never drift (ADR 0034 / OQ-34). feedback-sync.mjs matches scope by plain string
+// equality (not this regex), so it is intentionally not a consumer.
+//
+// Accepts `global` or `project:<id>`. The `<id>` charset matches what
+// deriveProjectId() (feedback-sync.mjs) emits from a cwd: `/` and `.` are both
+// replaced with `-`, producing leading-dash, mixed-case ids like
+// `-Users-you-Workspace-Project`. So the class allows a leading `-`, mixed case,
+// and `_`/`-` — but deliberately NOT `.`:
+//   - deriveProjectId never emits `.` (it is replaced), so excluding it loses
+//     nothing for the derived path; and
+//   - the resolved project-id is path-joined in feedback-sync.mjs:213, so keeping
+//     `.` out of the vocabulary avoids ever blessing `project:.` / `project:..`.
+// Known limit: a cwd containing spaces (or other path chars outside [A-Za-z0-9_-])
+// still derives an id this regex rejects; pass `--project-id=<id>` for those.
+export const FEEDBACK_SCOPE_RE = /^(global|project:[A-Za-z0-9_-]+)$/;

package/scripts/lib/fix-manifest.mjs

@@ -0,0 +1,109 @@
+/**
+ * fix-manifest — evidence mapping for claimed-merged fixes (Phase 2, A-sot).
+ *
+ * ADR 0036: this module is the *evidence* SoT (fix → test + ADR-line), NOT the
+ * *status* SoT. "Is fix N merged?" is answered solely by the wiki spec
+ * (parseStatus). A manifest row says "if the spec claims N merged, here is the
+ * test that proves the behavior and the production-code line that proves the
+ * ADR's core decision shipped."
+ *
+ * Shape (ADR 0036 decision 2 — NO `status` field):
+ *   { fixId:number, testNames:string[], adrPath:string|null, adrKeyLine:string }
+ *
+ *  - testNames: MUST set-equal the `// @fix #N:` anchors in tests/runner.mjs
+ *    (drift is an error — MANIFEST_TEST_DRIFT). Multiple anchors → multiple
+ *    names. The NO_AUTO_TEST sentinel is the ONLY allowed lone entry; it may
+ *    not be mixed with real test names.
+ *  - adrPath: path (relative to the wiki root) of the ADR whose core decision
+ *    this fix implements. `null` iff adrKeyLine is the NO_ADR sentinel.
+ *  - adrKeyLine: a maintainer-curated literal that embodies the fix's shipped
+ *    decision and exists verbatim in production code (scripts/ hooks/ commands/
+ *    skills/ templates/). Verified by fixed-string grep — 0 hits is
+ *    ADR_LINE_MISSING. The NO_ADR sentinel exempts a fix that has no ADR (small
+ *    / doctor fixes); the test-green check still applies. NO_ADR is NOT for
+ *    fixes that have an ADR but whose evidence lives outside the corpus.
+ *
+ * Coverage contract: every fix that is BOTH claimed-merged in the spec AND
+ * anchored in the runner must have exactly one row here (MANIFEST_MISSING_ROW
+ * is an error). Fixes anchored but not claimed (e.g. #18) are ORPHAN_ANCHOR
+ * warnings and need no row.
+ *
+ * Corpus note (spec §A amendment, 2026-06-07): the ADR-line grep corpus is
+ * scripts/ hooks/ commands/ skills/ AND templates/. templates/ ships via npm
+ * `files`, so prompt-driven fixes whose decision is installed as template text
+ * (e.g. #20 proactive close offer) are honestly verifiable there.
+ */
+
+export const NO_ADR = 'NO_ADR';
+export const NO_AUTO_TEST = 'NO_AUTO_TEST';
+
+export const FIX_MANIFEST = [
+  {
+    fixId: 15,
+    testNames: ['all type-conditional fields present → green'],
+    adrPath: 'decisions/0030-hypoignore-enforce-all-injection-hooks.md',
+    adrKeyLine: 'isIgnored(path, HYPO_DIR, patterns)',
+  },
+  {
+    fixId: 17,
+    testNames: [
+      '5 mandatory memory files fresh → suppressOutput:true',
+      'project hot.md not updated today → block, reason names the file',
+      'open-questions.md absent/stale → still passes (conditional, not gated)',
+    ],
+    adrPath: 'decisions/0022-session-close-ux-automation.md',
+    adrKeyLine: 'sessionCloseFileStatus',
+  },
+  {
+    // Behavioral / prompt-driven: no automated test, evidence is the installed
+    // template prompt (templates/hypo-guide.md). Has an ADR (0022), so NOT
+    // NO_ADR — the adrKeyLine greps the shipped template text.
+    fixId: 20,
+    testNames: [NO_AUTO_TEST],
+    adrPath: 'decisions/0022-session-close-ux-automation.md',
+    adrKeyLine: '이 작업이 마무리되었나요? 세션을 정리(crystallize)할까요?',
+  },
+  {
+    fixId: 25,
+    testNames: [
+      'replay-compact-guard-detects-slash-clear: /clear with incomplete wiki → WIKI_AUTOCLOSE',
+    ],
+    adrPath: 'decisions/0022-session-close-ux-automation.md',
+    adrKeyLine: '[WIKI_AUTOCLOSE]',
+  },
+  {
+    // Removal fix (capacity bypass deleted). The shipped evidence is the
+    // deliberate removal-marker comment + the negative-control test.
+    fixId: 26,
+    testNames: [
+      'replay-personal-check-bypass-order: wiki-context-critical.json does NOT bypass (fix #26 negative control)',
+    ],
+    adrPath: 'decisions/0022-session-close-ux-automation.md',
+    adrKeyLine: 'Capacity bypass (≥90%) REMOVED — fix #26',
+  },
+  {
+    fixId: 27,
+    testNames: [
+      'replay-auto-minimal-crystallize-on-incomplete-close: mutating + no marker + close-intent → block',
+      'replay-auto-minimal-crystallize-on-incomplete-close: valid marker → continue (even with close-intent)',
+    ],
+    adrPath: 'decisions/0022-session-close-ux-automation.md',
+    adrKeyLine: 'The hook NEVER writes the marker',
+  },
+  {
+    // No dedicated ADR (schema-vocab tag validation); test-green only.
+    fixId: 36,
+    testNames: ['PascalCase tag → error', 'unknown tag (not in vocab) → error'],
+    adrPath: null,
+    adrKeyLine: NO_ADR,
+  },
+  {
+    fixId: 38,
+    testNames: [
+      'clean-wiki payload → ok:true, new entries appended (apply dedup is exact-entry, not date-based)',
+      'idempotent: re-running same payload produces no new bytes (file mtimes unchanged)',
+    ],
+    adrPath: 'decisions/0029-crystallize-session-close-depth-expansion.md',
+    adrKeyLine: 'exact-entry append dedup',
+  },
+];