jules-orchestrator-kit 0.59.0 → 0.63.0

package/README.md

@@ -204,7 +204,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **940 unit tests across 130 suites passing in < 15.0s**.
+* **Verified Test Suite:** Tested with **1015 unit tests across 145 suites passing in < 15.0s**.
 
 <br/>
 
@@ -237,7 +237,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 | `doctor` | `agentctl doctor [--probe] [--json]` | Diagnostic check runner. `--probe` additionally starts the configured provider's CLI to confirm it answers, rather than only finding it on `PATH`. | `0` (Healthy), `1` (Failures) |
 | `queue` | `agentctl queue [--dag] [--concurrency <n>] [--dry-run] [--json]` | Consumes and executes task envelopes in `.agent/jules-queue/` with Kahn's DAG dependency resolution. Non-task files (manifests, `README.md`) are skipped, and `--dry-run` previews without moving anything. | `0` (Complete) |
 | `swarm` | `agentctl swarm [--json]` | Runs parallel multi-agent swarm across worker slots with PID liveness detection. | `0` (Complete) |
-| `check` / `gate` / `audit`| `agentctl check [--mode working-tree] [--fix] [--allow-protected] [--allow-test-modifications] [--json] [--json-report <path>]` | Runs security, secret scanning, rules budget audit, and tiered verification gates (with declarative assertion support) against working tree or branch. | `0` (Approved), `1` (Budget/Arg), `3` (Scope), `4` (Verify), `5` (Diff >75K), `6` (Secret), `8` (Flaky) |
+| `check` / `gate` / `audit`| `agentctl check [--mode working-tree] [--fix] [--allow-protected] [--allow-test-change <kind>] [--json] [--json-report <path>]` | Runs security, secret scanning, rules budget audit, and tiered verification gates (with declarative assertion support) against working tree or branch. | `0` (Approved), `1` (Budget/Arg), `3` (Scope), `4` (Verify), `5` (Diff >75K), `6` (Secret), `8` (Flaky) |
 | `mutate` / `mutation` | `agentctl mutate [--min-score <n>] [--max-mutants <n>] [--cmd <testCmd>] [--json]` | Runs zero-dependency diff mutation testing harness on changed hunks with operator inversion and safety rollback. | `0` (Passed), `1` (Score Low) |
 | `coverage` | `agentctl coverage [--min <pct>] [--cmd <testCmd>] [--base <ref>] [--json]` | Runs native zero-dependency V8 diff coverage check against added diff lines. | `0` (Passed), `1` (Low Coverage) |
 | `probe` / `stability` | `agentctl probe [--repeat <n>] [--min <passRate>] [--cmd <testCmd>] [--json]` | Probes test suite flakiness across N consecutive iterations with oscillation detection. | `0` (Passed), `1` (Flaky) |

package/bin/agentctl.mjs

@@ -388,7 +388,12 @@ async function main() {
           // of spec, which necessarily rewrites what a test expects, hit a
           // CRITICAL finding at exit 6 with no documented way past it. A guard
           // with no override is not a guard, it is an outage.
+          //
+          // This one is the blunt form and turns off all six checks. Prefer
+          // `--allow-test-change <kind>`: answering one finding should not
+          // silence five other checks nobody looked at.
           "allow-test-modifications": { type: "boolean" },
+          "allow-test-change": { type: "string", multiple: true },
           json: { type: "boolean", short: "j" },
           "json-report": { type: "string" },
           "dry-run": { type: "boolean", short: "d" },
@@ -409,6 +414,7 @@ async function main() {
         fix: values.fix,
         allowProtected: values["allow-protected"],
         allowTestModifications: values["allow-test-modifications"],
+        allowTestChanges: values["allow-test-change"],
         jsonReport: values["json-report"],
       });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.59.0",
+  "version": "0.63.0",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",
@@ -55,6 +55,7 @@
     "jules:rules-lint": "node scripts/rules-lint.mjs",
     "jules:doc-sync": "node scripts/doc-sync-check.mjs",
     "release": "node scripts/release.mjs",
+    "guard-reach": "node scripts/guard-reach-check.mjs",
     "lint": "eslint ."
   },
   "engines": {

package/scripts/guard-reach-check.mjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+
+/**
+ * Activation coverage: proof that every blocking check can still be made red.
+ *
+ * A defect that turns a check off cannot be found by the check it turns off.
+ * That is not a hypothetical — `isTestFile` matched the substring `/test/`,
+ * which does not occur in `tests/test_calc.py`, so the entire tamper guard was
+ * silent for the standard pytest, Rust and RSpec layouts. Every mechanism that
+ * should have caught it was working exactly as designed:
+ *
+ *   - the unit suite sampled the same distribution the implementation was
+ *     written from, so its fixtures re-confirmed the dialect it already knew;
+ *   - the doc-sync gate compares counts and versions, and a guard that guards
+ *     nothing still contributes passing tests;
+ *   - the nine-way CI matrix varies OS and Node version — dimensions
+ *     orthogonal to the defect. Nine runs of `test/foo.test.js` never explore
+ *     `tests/test_calc.py`;
+ *   - cold review reads the code against its stated intent, and here the code
+ *     and the intent agreed. The eye supplies the leading slash;
+ *   - the release gate is a conjunction over those four, and a signal that
+ *     silently goes absent contributes `true`.
+ *
+ * The common property: `ok: true` from a check that examined nothing is
+ * byte-identical to `ok: true` from a check that examined everything. There is
+ * no denominator. This script supplies one.
+ *
+ * Three steps, all in-process, no dependencies, well under a second:
+ *
+ *   1. POLICY   — the hand-written witness table in test/fixtures/guard-policy.mjs
+ *                 must hold. It is derived from what the tool advertises, never
+ *                 from the regexes that implement it.
+ *   2. CANARIES — every known-bad input must produce the finding it names. A
+ *                 canary that comes back clean is not a pass; it is proof that
+ *                 the rule stopped being reachable.
+ *   3. MUTANTS  — each hand-written mutant of the applicability predicate must
+ *                 kill at least one canary. A surviving mutant means no canary
+ *                 ever required the guard to activate, so the suite would stay
+ *                 green if it silently stopped looking.
+ *
+ * Usage: node scripts/guard-reach-check.mjs [--json]
+ * Exit codes: 0 = every guard reachable, 1 = a guard has gone silent.
+ */
+
+import { checkTestTampering, checkScope } from "../src/security.mjs";
+import { isTestPath } from "../src/test-paths.mjs";
+import { normalizeScope } from "../src/config.mjs";
+import { parseCollectedTests } from "../src/ops/test-collection.mjs";
+import {
+  TEST_PATH_CASES,
+  TAMPER_CANARIES,
+  PREDICATE_MUTANTS,
+  EMPTY_RUN_CANARIES,
+  SCOPE_CANARIES,
+} from "../test/fixtures/guard-policy.mjs";
+
+/** Build a unified diff for one canary. */
+function canaryDiff(c) {
+  const lines = [`--- a/${c.file}`, `+++ b/${c.file}`, "@@ -1,20 +1,20 @@", " // context"];
+  for (const l of c.removed) lines.push(`-${l}`);
+  for (const l of c.added) lines.push(`+${l}`);
+  lines.push(" // context");
+  return lines.join("\n");
+}
+
+const failures = [];
+const checks = [];
+const add = (name, ok, detail) => {
+  checks.push({ name, ok, detail });
+  if (!ok) failures.push(`${name}: ${detail}`);
+};
+
+// --- 1. Policy contract -----------------------------------------------------
+{
+  const wrong = TEST_PATH_CASES.filter((c) => isTestPath(c.path) !== c.expected);
+  add(
+    "policy: test-path domain",
+    wrong.length === 0,
+    wrong.length
+      ? wrong.map((c) => `${c.path} → ${isTestPath(c.path)}, policy says ${c.expected} (${c.why})`).join("; ")
+      : `${TEST_PATH_CASES.length} witnesses hold`
+  );
+}
+
+{
+  const scope = normalizeScope({ deny: [], allow: [], protect: [] });
+  const wrong = [];
+  for (const c of SCOPE_CANARIES) {
+    const res = checkScope([c.path], scope);
+    const rule = res.ok ? "none" : res.violations[0].rule;
+    if (rule !== c.rule) wrong.push(`${c.path} → ${rule}, policy says ${c.rule} (${c.why})`);
+  }
+  add("policy: scope tiers", wrong.length === 0, wrong.length ? wrong.join("; ") : `${SCOPE_CANARIES.length} paths tiered as declared`);
+}
+
+{
+  const missed = EMPTY_RUN_CANARIES.filter((c) => parseCollectedTests(c.output, "").count !== 0);
+  add(
+    "policy: empty-run detection",
+    missed.length === 0,
+    missed.length ? `${missed.map((m) => m.id).join(", ")} report zero tests in a spelling the floor cannot read` : `${EMPTY_RUN_CANARIES.length} runners recognised`
+  );
+}
+
+// --- 2. Canaries ------------------------------------------------------------
+const canaryResults = new Map();
+{
+  const silent = [];
+  const noDenominator = [];
+  for (const c of TAMPER_CANARIES) {
+    const res = checkTestTampering(canaryDiff(c));
+    const hit = (res.violations || []).some((v) => v.type === c.expect);
+    canaryResults.set(c.id, hit);
+    if (!hit) silent.push(`${c.id} expected ${c.expect}, got ${JSON.stringify((res.violations || []).map((v) => v.type))}`);
+    // A finding with no denominator is the shape this script exists to reject.
+    if (hit && !(res.inputsSeen > 0)) noDenominator.push(c.id);
+  }
+  add("canaries: every tamper rule still fires", silent.length === 0, silent.length ? silent.join("; ") : `${TAMPER_CANARIES.length} canaries red as required`);
+  add("canaries: every finding carries a denominator", noDenominator.length === 0, noDenominator.length ? noDenominator.join(", ") : "inputsSeen > 0 on every hit");
+}
+
+// --- 3. Predicate mutants ---------------------------------------------------
+{
+  const survivors = [];
+  for (const mutant of PREDICATE_MUTANTS) {
+    let killed = false;
+    for (const c of TAMPER_CANARIES) {
+      // Only canaries the healthy predicate catches can kill a mutant.
+      if (!canaryResults.get(c.id)) continue;
+      const res = checkTestTampering(canaryDiff(c), { isTestPath: mutant.fn });
+      if (!(res.violations || []).some((v) => v.type === c.expect)) {
+        killed = true;
+        break;
+      }
+    }
+    if (!killed) survivors.push(`${mutant.id} (${mutant.why})`);
+  }
+  add(
+    "mutants: blinding the predicate breaks a canary",
+    survivors.length === 0,
+    survivors.length
+      ? `survived: ${survivors.join(", ")} — no canary required the guard to activate`
+      : `${PREDICATE_MUTANTS.length} mutants killed`
+  );
+}
+
+// --- Report -----------------------------------------------------------------
+const json = process.argv.includes("--json");
+const activated = [...canaryResults.values()].filter(Boolean).length;
+
+if (json) {
+  console.log(
+    JSON.stringify(
+      {
+        ok: failures.length === 0,
+        checks,
+        activationCoverage: { canaries: canaryResults.size, activated },
+      },
+      null,
+      2
+    )
+  );
+} else {
+  console.log("\n🎯 Guard Reach Check (activation coverage)");
+  console.log("-------------------------------------------------------");
+  for (const c of checks) console.log(`  ${c.ok ? "✅" : "❌"} ${c.name.padEnd(46)} ${c.detail}`);
+  console.log("-------------------------------------------------------");
+  console.log(`  canaries activated: ${activated}/${canaryResults.size}`);
+  console.log(
+    failures.length === 0
+      ? "✅ Every blocking guard can still be made red.\n"
+      : `\n❌ ${failures.length} guard(s) may have gone silent. A check that cannot be made red is not a check.\n`
+  );
+}
+
+process.exit(failures.length === 0 ? 0 : 1);

package/scripts/release.mjs

@@ -41,6 +41,23 @@ try {
   process.exit(1);
 }
 
+// 1a. Activation coverage (blocking).
+//
+// Step 1 proved the suite is green. Green is only evidence if the guards were
+// switched on: a check that silently stopped applying contributes passing
+// tests and a zero exit code exactly like one that ran. This asks the question
+// the suite cannot — can every blocking guard still be made red? — and it runs
+// before the doc-sync gate because a silent guard makes every later signal
+// meaningless.
+console.log("1a. Verifying every blocking guard can still be made red...");
+try {
+  execSync("node scripts/guard-reach-check.mjs", { cwd: root, stdio: "inherit" });
+  console.log("");
+} catch (_) {
+  console.error("\n❌ Release Aborted: a guard has gone silent. See the failing rows above.");
+  process.exit(1);
+}
+
 // 1b. Documentation / version consistency gate (blocking).
 console.log("1b. Verifying documentation is in sync with package.json & test suite...");
 {

package/src/config.mjs

@@ -54,6 +54,9 @@ const CI_DEFINITIONS = [
   "appveyor.yml",
   ".teamcity/**",
   ".githooks/**",
+  "buildspec.yml",
+  "**/buildspec.yml",
+  ".buildspec/**",
 ];
 
 export const BUILTIN_DENY = [
@@ -64,6 +67,24 @@ export const BUILTIN_DENY = [
   "**/*.key",
   "**/id_rsa*",
   ".agent/jules-queue/**",
+
+  // Shell that runs on `cd`, and credentials in plaintext. Same class as a CI
+  // definition: code or secrets that take effect before anyone reviews them.
+  "**/.envrc",
+  "**/.git-credentials",
+  "**/.aws/**",
+  "**/.ssh/**",
+  "**/.kube/**",
+  "**/kubeconfig*",
+  "**/.docker/config.json",
+  "**/*.p12",
+  "**/*.pfx",
+  "**/*.p8",
+  "**/id_ed25519*",
+  "**/credentials.json",
+  "**/service-account*.json",
+  "**/*.tfstate",
+  "**/*.tfstate.*",
   ...CI_DEFINITIONS,
 ];
 
@@ -110,6 +131,53 @@ export const BUILTIN_PROTECT = [
   "Dockerfile",
   "**/Dockerfile",
 
+  // Lockfiles decide which code actually *runs*. `package.json` was protected
+  // and `package-lock.json` was not, so an agent could change a resolved URL
+  // or an integrity hash — swapping the code that gets installed — without
+  // touching a single declared dependency, and the gate said nothing. The
+  // entropy scanner is deliberately blind to lockfiles too (they are full of
+  // hashes), so the change was invisible twice over. `BUILTIN_RESTRICTED` in
+  // risk.mjs already knew these mattered; only the risk tier consumed it,
+  // never checkScope.
+  "package-lock.json",
+  "**/package-lock.json",
+  "pnpm-lock.yaml",
+  "**/pnpm-lock.yaml",
+  "yarn.lock",
+  "**/yarn.lock",
+  "bun.lockb",
+  "bun.lock",
+  "Cargo.lock",
+  "**/Cargo.lock",
+  "go.sum",
+  "**/go.sum",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "Gemfile.lock",
+  "composer.lock",
+  "gradle.lockfile",
+  "npm-shrinkwrap.json",
+  "mix.lock",
+  "pubspec.lock",
+  "Podfile.lock",
+  "Package.resolved",
+  ".terraform.lock.hcl",
+
+  // Toolchain pins choose the compiler that runs the whole suite.
+  ".nvmrc",
+  ".tool-versions",
+  ".mise.toml",
+  "rust-toolchain",
+  "rust-toolchain.toml",
+  "**/gradle/wrapper/gradle-wrapper.properties",
+  "**/gradle/wrapper/gradle-wrapper.jar",
+
+  // Who has to approve a change, and what runs on every developer's machine.
+  "CODEOWNERS",
+  "docs/CODEOWNERS",
+  ".pre-commit-config.yaml",
+
   // Test-runner configuration decides which tests run and what counts as a
   // pass. Rewriting it is the cheapest way to make a suite green without
   // touching a single assertion — `--passWithNoTests`, an added ignore

package/src/coverage.mjs

@@ -300,12 +300,27 @@ export function calculateDiffCoverage(coverageByFile, diffStr = "", options = {}
     }
   }
 
-  const score = totalLines > 0 ? Math.round((coveredLines / totalLines) * 10000) / 100 : 100;
-  const ok = score >= minCoverage;
+  // 100% of nothing is not 100%.
+  //
+  // The denominator counts only the added lines V8 actually mapped, and V8
+  // maps nothing outside Node. So a Python diff adding three executable lines
+  // measured zero of them and was reported as `score: 100` — the best possible
+  // number, produced by a measurement that never happened, on 20-odd of the 25
+  // stacks this kit claims to support. `mutation.mjs` had the identical bug and
+  // was fixed in v0.57.0; this is the same shape one module over.
+  //
+  // `ok` stays true because nothing failed to be covered, and a gate that
+  // blocks every non-Node diff gets switched off. What changes is the claim:
+  // `scored: false` and a reason, instead of a number nobody measured.
+  const scored = totalLines > 0;
+  const score = scored ? Math.round((coveredLines / totalLines) * 10000) / 100 : null;
+  const ok = scored ? score >= minCoverage : true;
 
   return {
     ok,
     score,
+    scored,
+    ...(scored ? {} : { reason: "No added executable lines were measurable — V8 coverage only observes code Node itself ran, so nothing was scored." }),
     minCoverage,
     totalLines,
     coveredLines,

package/src/engine.mjs

@@ -1,5 +1,6 @@
 import { loadConfig, parseYaml, normalizeScope } from "./config.mjs";
 import { isTestPath } from "./test-paths.mjs";
+import { checkCollectionFloor } from "./ops/test-collection.mjs";
 import { checkScope, scanDiff, scanBinaryPayloads, redactSecrets } from "./security.mjs";
 import { changedFiles, diffBytes, diffText, binaryDiffEntries, symlinkChanges, showFromOrigin, runCmd } from "./git.mjs";
 import { createProvider, ProviderRateLimitError, ProviderUnavailableError } from "./provider.mjs";
@@ -275,7 +276,11 @@ export async function gate(opts = {}) {
   }
 
   // Phase 3: Diff Secret Scanner & Security Checks
-  const secretResult = scanDiff(diffStr, { root, allowTestModifications: opts.allowTestModifications === true });
+  const secretResult = scanDiff(diffStr, {
+    root,
+    allowTestModifications: opts.allowTestModifications === true,
+    allowTestChanges: opts.allowTestChanges,
+  });
   // A binary file reaches the scanner as one summary line, so its contents were
   // never looked at — a NUL byte in front of a token was enough to hide it.
   // Inspect those files directly and fold the verdict in.
@@ -517,7 +522,25 @@ export async function gate(opts = {}) {
   const ranNoVerification = !executionRecords.some((r) => r && r.kind !== "assert");
   const missingOracle = verificationRequired && ranNoVerification;
 
-  const verifyOk = !failingCmd && !testTampered && !missingOracle;
+  // A command that ran is not the same as a command that tested something.
+  //
+  // `missingOracle` above catches "no stage executed". It cannot catch the
+  // case where a stage executed, exited 0, and collected zero tests — which
+  // several runners report as success by design: `go test ./...` prints
+  // "[no test files]" and exits 0, jest has --passWithNoTests, and
+  // `npm test --workspaces` is green when the one package the diff touched
+  // has no suite. A repository could invert a function, add an untested one
+  // and collect five green phases, verified against nothing at all.
+  //
+  // The count is read out of the runner's own summary and only a *stated*
+  // zero counts. An unrecognised runner yields null and passes: failing on
+  // "I could not tell" would break every runner not on the list.
+  const collectionFloor = verificationRequired
+    ? checkCollectionFloor(testResult, { minTests: trustedVerify.minTests })
+    : { ok: true, count: null, runner: null, reason: null };
+  const emptySuite = !collectionFloor.ok;
+
+  const verifyOk = !failingCmd && !testTampered && !missingOracle && !emptySuite;
 
   // What actually broke. Without this the verify phase reported `ok: false` and
   // nothing else — not the stage, not the exit code, not a line of output — so
@@ -564,7 +587,18 @@ export async function gate(opts = {}) {
               "The gate approves a change because verification passed. Zero stages executed is not a pass.",
             ],
           }
-        : null;
+        : emptySuite
+          ? {
+              stageId: "empty-suite",
+              command: testResult?.command || null,
+              exitCode: 0,
+              stdout: "",
+              stderr: collectionFloor.reason,
+              diagnostics: [
+                "An exit code of 0 from a runner that collected no tests is not evidence about this change.",
+              ],
+            }
+          : null;
 
   // Generate & persist Evidence Manifest
   const evidenceManifest = generateEvidenceManifest(root, {
@@ -579,6 +613,7 @@ export async function gate(opts = {}) {
     failedStage: failingCmd?.stageId || failingCmd?.phase || null,
     diagnostics: failingCmd?.diagnostics?.length ? failingCmd.diagnostics : (failingCmd?.stderr ? [failingCmd.stderr] : []),
     metrics: failingCmd?.metrics || {},
+    collection: collectionFloor,
     ok: verifyOk,
   });
   if (testTampered) {

package/src/evidence.mjs

@@ -129,7 +129,20 @@ export function computeDirectoryHash(root, options = {}) {
       .filter((p) => existsSync(join(root, p)) && statSync(join(root, p)).isFile())
       .sort();
   } else {
-    const targetDirs = options.directories || ["test", "tests", "__tests__", "spec", "src"];
+    // A sixth spelling of "where do the tests live?", and the one that got
+    // missed when the other five were unified behind `isTestPath`: this is a
+    // list of *directory names at the repository root*, not a predicate. Go
+    // puts its tests beside the code (`internal/calc/calc_test.go`), and every
+    // monorepo puts them under `packages/*/test/`. Neither is under a
+    // root-level `test/`, so the walk found nothing, `fileCount` was 0, and
+    // `strictTestLock` — which requires `fileCount > 0` — switched itself off
+    // without saying so. The tree hash then became the SHA-256 of the empty
+    // string, and the evidence manifest attested to it.
+    //
+    // The named directories stay as a fast path; when they yield nothing, walk
+    // the repository and let the shared predicate decide. The walk already
+    // skips node_modules, vendor, target and the build caches.
+    const targetDirs = options.directories || ["test", "tests", "__tests__", "spec", "specs", "src"];
     for (const dirName of targetDirs) {
       const dirPath = join(root, dirName);
       if (existsSync(dirPath)) {
@@ -137,6 +150,11 @@ export function computeDirectoryHash(root, options = {}) {
         fileList.push(...found);
       }
     }
+    if (options.testOnly && !fileList.some((f) => isTestPath(f))) {
+      for (const f of findFilesRecursively(root, root)) {
+        if (isTestPath(f)) fileList.push(f);
+      }
+    }
 
     // Plenty of projects keep `app.test.mjs` or `index.js` beside package.json
     // rather than under one of the directories above, and those files were
@@ -201,6 +219,7 @@ export function computeEvidenceHash(manifest) {
     intent: manifest.intent,
     provenance: manifest.provenance,
     testIntegrity: manifest.testIntegrity,
+    ...(manifest.verification ? { verification: manifest.verification } : {}),
     ...(manifest.sourceIntegrity ? { sourceIntegrity: manifest.sourceIntegrity } : {}),
     executionRecords: manifest.executionRecords,
     securityChecks: manifest.securityChecks,
@@ -342,6 +361,24 @@ export function generateEvidenceManifest(root = process.cwd(), options = {}) {
       maxDiffKb: options.maxDiffKb || 75,
       protectedScopeOk: options.protectedScopeOk ?? true,
     },
+    // How many tests the runner said it collected, and whether it said at all.
+    //
+    // The collection floor fails a *stated* zero and lets an unstated count
+    // pass, because failing on "I could not tell" would break every runner not
+    // on the list. That is the right call for the verdict and the wrong thing
+    // to leave out of the record: a manifest that says nothing here reads as
+    // though a suite ran. `counted: false` is the honest shape for a run where
+    // the number was never observable — a quiet runner (`cargo test --quiet`,
+    // `pytest -q`) suppresses the very line the floor reads.
+    ...(options.collection
+      ? {
+          verification: {
+            testsCollected: options.collection.count,
+            counted: options.collection.count !== null,
+            runner: options.collection.runner,
+          },
+        }
+      : {}),
     ...(diagnostics.length > 0 ? { diagnostics } : {}),
     ...(Object.keys(metrics).length > 0 ? { metrics } : {}),
   };

package/src/ops/test-collection.mjs

@@ -0,0 +1,149 @@
+/**
+ * How many tests the runner actually collected, read out of its own output.
+ *
+ * The gate's oracle is one number: the exit code of the verification command.
+ * That number cannot distinguish "every test passed" from "there were no
+ * tests". Several runners report the second case as success, by design:
+ *
+ *   go test ./...        →  "?  example.com/app  [no test files]", exit 0
+ *   jest --passWithNoTests →  "No tests found, exiting with code 0"
+ *   npm test --workspaces →  exit 0 when the changed package has no suite
+ *   pytest --exitfirst on a path that matches nothing, in some configurations
+ *
+ * So a repository could invert a function, add an untested one, and collect
+ * five green phases — verified against nothing. `verify.required: false` is
+ * the switch for a repository that genuinely has no oracle; silently passing
+ * is not.
+ *
+ * The parsing is deliberately one-sided. A count is only returned when the
+ * runner stated one in a form recognised here; an unrecognised runner yields
+ * `null`, and null is not a failure. Failing on "I could not tell" would break
+ * every runner not on this list, which is most of them.
+ */
+
+/**
+ * Patterns that state a test count, per runner family.
+ *
+ * Each entry captures a single number. The first pattern that matches wins,
+ * so the more specific summaries come first.
+ */
+const COUNT_PATTERNS = [
+  // node:test — spec reporter ("ℹ tests 940") and tap ("# tests 940")
+  { name: "node:test", re: /^[^\n]*?(?:ℹ|#)\s*tests\s+(\d+)\s*$/m },
+  // pytest — "collected 12 items", "12 passed", "no tests ran in 0.01s"
+  { name: "pytest", re: /^\s*collected\s+(\d+)\s+items?/m },
+  { name: "pytest", re: /=+\s*(\d+)\s+passed/m },
+  // cargo — "running 7 tests"
+  { name: "cargo", re: /^\s*running\s+(\d+)\s+tests?\s*$/m },
+  // jest / vitest — "Tests:       12 passed, 12 total"
+  { name: "jest", re: /^\s*Tests:\s+.*?(\d+)\s+total\s*$/m },
+  // mocha — "12 passing"
+  { name: "mocha", re: /^\s*(\d+)\s+passing/m },
+  // Maven / Surefire — "Tests run: 12, Failures: 0"
+  { name: "surefire", re: /\bTests run:\s*(\d+)/i },
+  // PHPUnit — "OK (12 tests, 30 assertions)"
+  { name: "phpunit", re: /\bOK\s*\((\d+)\s+tests?/i },
+  // RSpec / ExUnit — "12 examples, 0 failures" / "12 tests, 0 failures"
+  { name: "rspec", re: /^\s*(\d+)\s+examples?,\s*\d+\s+failures?/m },
+  { name: "exunit", re: /^\s*(\d+)\s+tests?,\s*\d+\s+failures?/m },
+  // dotnet test — "Total tests: 12" / "Passed!  - Failed: 0, Passed: 12"
+  { name: "dotnet", re: /\bTotal(?:\s+tests)?:\s*(\d+)/i },
+  // swift test / XCTest — "Executed 12 tests"
+  { name: "xctest", re: /\bExecuted\s+(\d+)\s+tests?/i },
+];
+
+/** Per-test lines, which `go test` only prints under -v. */
+const GO_PER_TEST = /^\s*--- (?:PASS|FAIL|SKIP):/gm;
+
+/** Phrases that state, in so many words, that nothing was collected. */
+const EXPLICIT_ZERO = [
+  { name: "pytest", re: /\bno tests ran\b/i },
+  { name: "pytest", re: /^\s*collected\s+0\s+items?/m },
+  { name: "jest", re: /\bNo tests found\b/i },
+  { name: "vitest", re: /\bNo test files found\b/i },
+  { name: "mocha", re: /^\s*0\s+passing/m },
+  { name: "cargo", re: /^\s*running\s+0\s+tests?\s*$/m },
+  { name: "phpunit", re: /\bNo tests executed!/i },
+  { name: "gradle", re: /^>\s*Task\s+:\S*test\S*\s+NO-SOURCE\s*$/mi },
+  { name: "ctest", re: /\bNo tests were found\b/i },
+  { name: "flutter", re: /\bNo tests ran\.?/i },
+];
+
+/** Go prints this per package that has no test files at all. */
+const GO_NO_TEST_FILES = /\[no test files\]/;
+/** Any sign that a Go package did run tests. */
+const GO_RAN_SOMETHING = /^(?:ok|FAIL|---\s+(?:PASS|FAIL|SKIP)):?\s/m;
+
+/**
+ * Read a collected-test count out of a runner's output.
+ *
+ * @param {string} [stdout]
+ * @param {string} [stderr]
+ * @returns {{ count: number|null, runner: string|null }}
+ *   `count` is null when no recognised runner stated one — which is not a
+ *   finding, only an absence of evidence.
+ */
+export function parseCollectedTests(stdout = "", stderr = "") {
+  const text = `${stdout || ""}\n${stderr || ""}`;
+  if (!text.trim()) return { count: null, runner: null };
+
+  for (const rule of EXPLICIT_ZERO) {
+    if (rule.re.test(text)) return { count: 0, runner: rule.name };
+  }
+
+  // Go states absence per package rather than as a count, so it needs its own
+  // pass before the generic patterns.
+  if (GO_NO_TEST_FILES.test(text) || GO_RAN_SOMETHING.test(text)) {
+    // Only a run where *no* package did anything is a zero: a monorepo where
+    // one package has no tests and three do is a normal, healthy repository.
+    if (!GO_RAN_SOMETHING.test(text)) return { count: 0, runner: "go" };
+    // Something ran. `--- PASS:` lines are per-test but appear only under -v,
+    // so their absence means the count was not stated — not that it was zero.
+    // Reporting zero here would have failed every ordinary `go test ./...`.
+    const perTest = text.match(GO_PER_TEST);
+    return { count: perTest && perTest.length > 0 ? perTest.length : null, runner: "go" };
+  }
+
+  for (const rule of COUNT_PATTERNS) {
+    const m = rule.re.exec(text);
+    if (!m) continue;
+    const n = Number(m[1]);
+    if (Number.isFinite(n)) return { count: n, runner: rule.name };
+  }
+
+  return { count: null, runner: null };
+}
+
+/**
+ * Decide whether a passing verification command actually verified anything.
+ *
+ * @param {object} testResult - the test stage's result ({ ok, stdout, stderr, command })
+ * @param {object} [opts]
+ * @param {number} [opts.minTests=1] - the floor, from `verify.minTests`.
+ * @returns {{ ok: boolean, count: number|null, runner: string|null, reason: string|null }}
+ */
+export function checkCollectionFloor(testResult, opts = {}) {
+  const minTests = Number.isFinite(opts.minTests) ? opts.minTests : 1;
+  if (minTests <= 0) return { ok: true, count: null, runner: null, reason: null };
+  // Only a *passing* command can lie about this. A failing one already fails.
+  if (!testResult || testResult.ok !== true) {
+    return { ok: true, count: null, runner: null, reason: null };
+  }
+
+  const { count, runner } = parseCollectedTests(testResult.stdout, testResult.stderr);
+  if (count === null || count >= minTests) {
+    return { ok: true, count, runner, reason: null };
+  }
+
+  return {
+    ok: false,
+    count,
+    runner,
+    reason:
+      `The verification command exited 0 without running any tests` +
+      (runner ? ` (${runner} reported ${count})` : "") +
+      `, so this change was approved against nothing. ` +
+      `Point verify.test at a suite that covers this repository, lower the floor with verify.minTests, ` +
+      `or — if this repository intentionally uses only the scope and secret phases — set verify.required: false.`,
+  };
+}

package/src/security.mjs

@@ -1138,8 +1138,11 @@ function locateFindingLine(lines, type, file = null) {
 // assertion — identical once every literal is blanked out — with different
 // values. That does not distinguish an attack from a deliberate change of
 // spec; nothing can, from a diff alone. This reports rather than decides,
-// and `--allow-test-modifications` is the answer when the new expectation is
-// the correct one.
+// and `--allow-test-change expectation` is the answer when the new
+// expectation is the correct one. Narrow on purpose: the blunt
+// `--allow-test-modifications` turns off the other five checks too, and a
+// check that can only be answered by disabling its neighbours ends up
+// disabling its neighbours.
 
 // An assertion that states a *specific* expected value. Counting assertions
 // alone let a test be gutted while looking untouched: swapping
@@ -1627,6 +1630,135 @@ const hasLiteralPlaceholder = (shape) =>
 const collapseWhitespace = (s) => s.replace(/\s+/g, " ").trim();
 const shorten = (s) => (s.length > 160 ? `${s.slice(0, 157)}…` : s);
 
+/**
+ * Split the argument list of the outermost assertion call in `clean`.
+ *
+ * Comments are already stripped by the caller, so only string state has to be
+ * tracked. Returns null whenever the shape is not confidently understood — a
+ * truncated fragment, an unbalanced hunk, a quoting form not handled here —
+ * because every caller uses this to *suppress* a finding, and failing to
+ * understand a statement must never become a reason to stay quiet about it.
+ *
+ * @param {string} clean - comment-stripped statement text
+ * @param {string} lang
+ * @returns {string[] | null} top-level arguments, trimmed
+ */
+function splitAssertionArgs(clean, lang) {
+  SPECIFIC_ASSERTION.lastIndex = 0;
+  const m = SPECIFIC_ASSERTION.exec(clean);
+  if (!m) return null;
+
+  let i = m.index + m[0].length; // just past the opening paren
+  let depth = 1;
+  let quote = null;
+  let triple = false;
+  const args = [];
+  let start = i;
+
+  while (i < clean.length) {
+    const c = clean[i];
+
+    if (quote !== null) {
+      if (c === "\\") { i += 2; continue; }
+      if (triple && c === quote && clean[i + 1] === quote && clean[i + 2] === quote) {
+        quote = null; triple = false; i += 3; continue;
+      }
+      if (!triple && c === quote) { quote = null; i += 1; continue; }
+      i += 1;
+      continue;
+    }
+
+    if (c === '"' || c === "'" || c === "`") {
+      if (lang === "python" && clean[i + 1] === c && clean[i + 2] === c) {
+        quote = c; triple = true; i += 3; continue;
+      }
+      quote = c; i += 1; continue;
+    }
+
+    if (c === "(" || c === "[" || c === "{") { depth += 1; i += 1; continue; }
+    if (c === ")" || c === "]" || c === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        args.push(clean.slice(start, i).trim());
+        return args;
+      }
+      i += 1;
+      continue;
+    }
+    if (c === "," && depth === 1) {
+      args.push(clean.slice(start, i).trim());
+      start = i + 1;
+      i += 1;
+      continue;
+    }
+    i += 1;
+  }
+  return null; // never closed: an unbalanced fragment, so no suppression
+}
+
+/** One plain string literal and nothing else. */
+const PURE_STRING_LITERAL = new RegExp(
+  [
+    "^'(?:\\\\.|[^'\\\\])*'$",
+    '^"(?:\\\\.|[^"\\\\])*"$',
+    "^`(?:\\\\.|[^`\\\\])*`$",
+    '^"""[\\s\\S]*"""$',
+    "^'''[\\s\\S]*'''$",
+  ].join("|")
+);
+
+function isPureStringLiteral(arg) {
+  if (!arg) return false;
+  return PURE_STRING_LITERAL.test(arg.trim());
+}
+
+/**
+ * Argument positions that carry a message for a human rather than an expected
+ * value.
+ *
+ * Trailing, for `assert.equal(got, want, "message")` and
+ * `assert_eq!(a, b, "message")`; leading, for Go's
+ * `t.Errorf("got %d want %d", got, want)`. Two arguments is the classic
+ * `(actual, expected)` shape, so a string in last position *there* is the
+ * expected value: `assert.equal(name, "Alice")` must still be judged when
+ * "Alice" becomes "Bob".
+ */
+function messageArgIndices(args) {
+  const idx = new Set();
+  if (args.length >= 3 && isPureStringLiteral(args[args.length - 1])) idx.add(args.length - 1);
+  if (args.length >= 2 && isPureStringLiteral(args[0])) idx.add(0);
+  return idx;
+}
+
+/**
+ * True when two assertions differ only in text written to be read by a person.
+ *
+ * Rewording the message on a failing assertion is among the most common edits
+ * any test file receives, and it says nothing whatsoever about what the suite
+ * checks. But a message is a literal, so blanking literals made the two
+ * statements the same shape and the pairing reported a rewritten expectation
+ * every time somebody improved the wording of a failure. Firing on that is
+ * how an operator learns to pass the override without reading it.
+ */
+function differsOnlyInMessage(cleanRemoved, cleanAdded, lang) {
+  const a = splitAssertionArgs(cleanRemoved, lang);
+  const b = splitAssertionArgs(cleanAdded, lang);
+  if (!a || !b || a.length !== b.length || a.length === 0) return false;
+
+  const msgIdx = messageArgIndices(a);
+  if (msgIdx.size === 0) return false;
+
+  let sawDifference = false;
+  for (let i = 0; i < a.length; i++) {
+    if (a[i].replace(/\s+/g, "") === b[i].replace(/\s+/g, "")) continue;
+    // A difference outside a message position, or in a position that stopped
+    // being a plain string, is a real change.
+    if (!msgIdx.has(i) || !isPureStringLiteral(b[i])) return false;
+    sawDifference = true;
+  }
+  return sawDifference;
+}
+
 /**
  * Pair rewritten expectations across the removed and added images of every
  * hunk of one file, and report each pair.
@@ -1664,14 +1796,14 @@ function detectExpectationRewrites(file, hunks, stats, violations) {
       if (s.removedLines.length === 0) continue;
       const clean = stripComments(s.text, lang);
       if (!isSpecificAssertion(clean)) continue;
-      oldCands.push({ s, shape: blankLiterals(clean), canon: clean.replace(/\s+/g, "") });
+      oldCands.push({ s, clean, shape: blankLiterals(clean), canon: clean.replace(/\s+/g, "") });
     }
     const newCands = [];
     for (const s of newStmts) {
       if (s.addedLines.length === 0) continue;
       const clean = stripComments(s.text, lang);
       if (!isSpecificAssertion(clean)) continue;
-      newCands.push({ s, shape: blankLiterals(clean), canon: clean.replace(/\s+/g, "") });
+      newCands.push({ s, clean, shape: blankLiterals(clean), canon: clean.replace(/\s+/g, "") });
     }
 
     // The t-th removed candidate of a shape pairs with the t-th added
@@ -1698,11 +1830,32 @@ function detectExpectationRewrites(file, hunks, stats, violations) {
     const pairs = [];
     for (const [shape, olds] of oldByShape) {
       const news = newByShape.get(shape) || [];
-      const k = Math.min(olds.length, news.length);
+
+      // Cancel the assertions that are byte-identical on both sides before
+      // aligning anything.
+      //
+      // Reordering two assertions removes both and adds both back unchanged.
+      // Positional alignment then matched the first removed against the first
+      // added — a different assertion — and reported two rewritten
+      // expectations for an edit that changed no expected value at all. The
+      // same happened to an assertion that simply moved within its block.
+      // What is present unchanged on both sides did not change; only the
+      // residue can have been rewritten.
+      const survivingNew = news.slice();
+      const survivingOld = [];
+      for (const o of olds) {
+        const twin = survivingNew.findIndex((n) => n.canon === o.canon);
+        if (twin === -1) survivingOld.push(o);
+        else survivingNew.splice(twin, 1);
+      }
+
+      const k = Math.min(survivingOld.length, survivingNew.length);
       for (let t = 0; t < k; t++) {
-        if (olds[t].canon !== news[t].canon) {
-          pairs.push({ r: olds[t].s, a: news[t].s });
-        }
+        const r = survivingOld[t];
+        const a = survivingNew[t];
+        if (r.canon === a.canon) continue;
+        if (differsOnlyInMessage(r.clean, a.clean, lang)) continue;
+        pairs.push({ r: r.s, a: a.s });
       }
     }
 
@@ -1717,9 +1870,11 @@ function detectExpectationRewrites(file, hunks, stats, violations) {
         const sr = blankLiterals(stripComments(r.text, lang));
         const sa = blankLiterals(stripComments(a.text, lang));
         if (sr === sa && hasLiteralPlaceholder(sr)) {
-          const cr = stripComments(r.text, lang).replace(/\s+/g, "");
-          const ca = stripComments(a.text, lang).replace(/\s+/g, "");
-          if (cr !== ca) pairs.push({ r, a });
+          const clr = stripComments(r.text, lang);
+          const cla = stripComments(a.text, lang);
+          if (clr.replace(/\s+/g, "") !== cla.replace(/\s+/g, "") && !differsOnlyInMessage(clr, cla, lang)) {
+            pairs.push({ r, a });
+          }
         }
       }
     }
@@ -1736,9 +1891,10 @@ function detectExpectationRewrites(file, hunks, stats, violations) {
           `"${shorten(collapseWhitespace(p.r.text))}" became "${shorten(collapseWhitespace(p.a.text))}". ` +
           `A deliberately changed spec looks identical to a test bent to match broken ` +
           `output, and a diff alone cannot tell the two apart, so this is flagged for ` +
-          `review rather than assumed. If the new expectation is correct, re-run with ` +
-          `--allow-test-modifications (which also silences the skip, vacuous, removal ` +
-          `and weakening checks for this diff).`,
+          `review rather than assumed. If the new expectation is the correct one, ` +
+          `re-run with --allow-test-change expectation — which allows exactly this ` +
+          `check and leaves the skip, vacuous, commented, removal and weakening ` +
+          `checks doing their job.`,
       });
 
       // Both sides are accounted for here, so they must not also feed the
@@ -1771,17 +1927,85 @@ function detectExpectationRewrites(file, hunks, stats, violations) {
   return allPairs;
 }
 
+/**
+ * The tamper checks, by the name an operator uses to allow one of them.
+ *
+ * There was one override for all six, and it was a switch marked "off". A
+ * deliberate change of spec rewrites what a test expects, which is
+ * indistinguishable from bending a test to match broken output — so the honest
+ * answer to that finding is sometimes an override. But reaching for it also
+ * silenced injected `.skip()`, `expect(true).toBe(true)`, commented-out
+ * assertions and outright deletions, none of which the operator had looked at.
+ * The check with the highest firing rate therefore set the ceiling for every
+ * other check in the bundle: the more useful this one became, the more often
+ * it would be used to turn the others off.
+ */
+export const TAMPER_KINDS = new Map([
+  ["TEST_SKIP_INJECTION", "skip"],
+  ["VACUOUS_ASSERTION", "vacuous"],
+  ["COMMENTED_ASSERTION", "commented"],
+  ["ASSERTION_REMOVAL", "removal"],
+  ["ASSERTION_WEAKENED", "weakening"],
+  ["ASSERTION_EXPECTATION_CHANGED", "expectation"],
+]);
+
+/** Every kind name, for CLI validation and help text. */
+export const TAMPER_KIND_NAMES = Object.freeze([...new Set(TAMPER_KINDS.values())].sort());
+
+/**
+ * Which tamper checks this run is allowed to stay quiet about.
+ *
+ * @param {object} options
+ * @param {boolean} [options.allowTestModifications] - the blunt form: all of them.
+ * @param {string|string[]} [options.allowTestChanges] - kind names, comma-separated or an array.
+ * @returns {{ all: boolean, kinds: Set<string>, unknown: string[] }}
+ */
+export function resolveAllowedTamperKinds(options = {}) {
+  if (options.allowTestModifications === true) {
+    return { all: true, kinds: new Set(TAMPER_KIND_NAMES), unknown: [] };
+  }
+  const raw = options.allowTestChanges;
+  const list = (Array.isArray(raw) ? raw : [raw])
+    .flatMap((v) => String(v == null ? "" : v).split(","))
+    .map((v) => v.trim().toLowerCase())
+    .filter(Boolean);
+
+  if (list.includes("all")) {
+    return { all: true, kinds: new Set(TAMPER_KIND_NAMES), unknown: [] };
+  }
+  const kinds = new Set();
+  const unknown = [];
+  for (const name of list) {
+    if (TAMPER_KIND_NAMES.includes(name)) kinds.add(name);
+    else unknown.push(name);
+  }
+  return { all: false, kinds, unknown };
+}
+
 /**
  * Detects test file assertion tampering, weakening, or test skips.
  *
  * @param {string} diffOrText - Unified git diff
  * @param {Object} [options]
  * @param {boolean} [options.allowTestModifications=false]
- * @returns {{ ok: boolean, violations: Array<{ file: string, type: string, line?: number, reason: string }> }}
+ * @returns {{ ok: boolean, violations: Array<object>, inputsSeen: number, status: "PASS"|"FAIL"|"NOT_APPLICABLE" }}
+ *   `status` distinguishes "checked and clean" from "nothing was checked";
+ *   `ok: true` alone cannot, and that ambiguity is the defect class this
+ *   field exists to make visible.
  */
 export function checkTestTampering(diffOrText = "", options = {}) {
-  if (!diffOrText || typeof diffOrText !== "string") return { ok: true, violations: [] };
-  if (options.allowTestModifications === true) return { ok: true, violations: [] };
+  if (!diffOrText || typeof diffOrText !== "string") {
+    return { ok: true, violations: [], inputsSeen: 0, status: "NOT_APPLICABLE", reason: "empty diff" };
+  }
+  const allowed = resolveAllowedTamperKinds(options);
+  if (allowed.all) {
+    return { ok: true, violations: [], inputsSeen: 0, status: "NOT_APPLICABLE", reason: "all kinds allowed" };
+  }
+
+  // Which predicate decides what this guard even looks at. Injectable so the
+  // meta-check can mutate it: a canary that still passes when the predicate is
+  // replaced by `() => false` was never requiring this guard to activate.
+  const isTestPath_ = typeof options.isTestPath === "function" ? options.isTestPath : isTestPath;
 
   const violations = [];
   const lines = diffOrText.split("\n");
@@ -1790,7 +2014,7 @@ export function checkTestTampering(diffOrText = "", options = {}) {
   let currentOldLineNo = null;
   let currentNewLineNo = null;
 
-  const isTestFile = isTestPath;
+  const isTestFile = isTestPath_;
 
   const SKIP_INJECTIONS = [
     { pattern: /\b(?:it|test|describe|context)\.skip\s*\(/i, desc: "Injected test skip (.skip())" },
@@ -1987,9 +2211,31 @@ export function checkTestTampering(diffOrText = "", options = {}) {
     }
   }
 
+  // A kind the operator has already looked at and accepted is dropped here
+  // rather than never being computed, so the reasoning above stays one code
+  // path regardless of what any given run allows.
+  const reported =
+    allowed.kinds.size === 0
+      ? violations
+      : violations.filter((v) => !allowed.kinds.has(TAMPER_KINDS.get(v.type)));
+
+  // What was examined, not only what was found.
+  //
+  // `ok: true` from a guard that looked at nothing is byte-identical to
+  // `ok: true` from a guard that looked at everything and approved it. That
+  // ambiguity is how a substring bug in the file classifier switched this
+  // entire guard off for the standard pytest, Rust and RSpec layouts while
+  // every signal stayed green. A verdict without a denominator is not a
+  // verdict, so `inputsSeen` reports the number of test files this run
+  // actually reasoned about, and `status` distinguishes "nothing to check"
+  // from "checked and clean".
+  const inputsSeen = fileAssertions.size;
+
   return {
-    ok: violations.length === 0,
-    violations,
+    ok: reported.length === 0,
+    violations: reported,
+    inputsSeen,
+    status: reported.length > 0 ? "FAIL" : inputsSeen > 0 ? "PASS" : "NOT_APPLICABLE",
   };
 }
 

package/src/stack-detector.mjs

@@ -39,7 +39,65 @@ export function pytestCmd(env = process.env) {
 }
 
 /**
- * Generate a zero-dependency smoke test file using node:test for untested JS/Generic repos.
+ * Does this Makefile declare a `test` target?
+ *
+ * Read rather than assumed: the presence of the file says nothing about
+ * whether `make test` will run.
+ */
+function makefileHasTestTarget(root) {
+  try {
+    const text = readFileSync(join(root, "Makefile"), "utf-8");
+    return /^\.PHONY:.*\btest\b/m.test(text) || /^test\s*:/m.test(text);
+  } catch (_) {
+    return false;
+  }
+}
+
+/**
+ * A declared test script that runs no tests and exits 0.
+ *
+ * This is the single most dangerous input the gate can receive, because every
+ * downstream check reads "a command ran and passed". `bootstrapZeroTestRepo`
+ * called `"test": "echo 'no tests yet' && exit 0"` an
+ * EXISTING_VERIFICATION_ORACLE — it asked whether the field was set, never
+ * what was in it.
+ *
+ * npm's own default (`echo "Error: no test specified" && exit 1`) is not a
+ * placeholder by this definition, and correctly so: it exits non-zero, which
+ * fails loudly rather than certifying nothing.
+ */
+export function isPlaceholderTestScript(cmd) {
+  if (typeof cmd !== "string") return false;
+  const trimmed = cmd.trim();
+  if (!trimmed) return true;
+  // Drop the announcements; what matters is what the shell is left doing.
+  const remainder = trimmed
+    .split(/&&|;/)
+    .map((part) => part.trim())
+    .filter((part) => part && !/^(?:echo|printf|:)\b/.test(part));
+  if (remainder.length === 0) return true;
+  return remainder.every((part) => /^(?:exit\s+0|true|:)$/.test(part));
+}
+
+/**
+ * Generate the fallback verification oracle for a JS/generic repo with no tests.
+ *
+ * What this used to write could not fail:
+ *
+ *   assert.ok(fs.existsSync(process.cwd()));
+ *   assert.ok(fs.readdirSync(process.cwd()).length > 0);
+ *
+ * Both hold for every repository and every change, so the generated "oracle"
+ * was green against arbitrary broken code — and worse, it *silenced* the
+ * `missingOracle` guard in engine.mjs, which fires only when no command ran at
+ * all. A repository that honestly had no oracle was converted into one that
+ * claimed to have one. That is the tool writing its own blindness to disk.
+ *
+ * The other stacks already get a real static gate at this point — `tsc
+ * --noEmit`, `cargo check`, `go vet`, `compileall` — each of which fails on a
+ * real class of defect. This is the JavaScript equivalent: every source file
+ * must parse. It proves the code compiles, not that it works, and the caller
+ * says so; but a syntax error fails it, which is one more than before.
  */
 export function generateSmokeTestScript(root = process.cwd()) {
   const agentDir = join(root, ".agent");
@@ -48,15 +106,45 @@ export function generateSmokeTestScript(root = process.cwd()) {
   } catch (_) {}
 
   const smokePath = join(agentDir, "smoke.test.mjs");
-  const content = `// Auto-generated zero-dependency smoke test gate (.agent/smoke.test.mjs)
+  const content = `// Auto-generated zero-dependency parse gate (.agent/smoke.test.mjs)
+//
+// Written by \`agentctl bootstrap\` for a repository that had no test suite.
+// It proves that every source file still parses. It does NOT prove the code
+// is correct — replace it with real tests as soon as there are any.
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import fs from "node:fs";
+import { readdirSync, statSync } from "node:fs";
+import { join, extname } from "node:path";
+import { spawnSync } from "node:child_process";
+
+const SKIP = new Set([".git", "node_modules", "vendor", "dist", "build", "coverage", ".venv", "venv", ".next", ".agent"]);
+const SOURCE = new Set([".js", ".mjs", ".cjs"]);
+
+function sources(dir, acc = [], depth = 0) {
+  if (depth > 8) return acc;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name.startsWith(".") && entry.name !== ".agent") continue;
+    if (SKIP.has(entry.name)) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) sources(full, acc, depth + 1);
+    else if (SOURCE.has(extname(entry.name))) acc.push(full);
+  }
+  return acc;
+}
+
+test("every source file parses", () => {
+  const files = sources(process.cwd());
 
-test("Zero-Test Bootstrapped Smoke Verification", () => {
-  assert.ok(fs.existsSync(process.cwd()), "Working directory exists and is accessible");
-  const entries = fs.readdirSync(process.cwd());
-  assert.ok(entries.length > 0, "Repository contains files");
+  // A gate with nothing to check is not a passing gate. Reporting success
+  // over an empty file list is exactly the vacuous oracle this replaced.
+  assert.ok(files.length > 0, "No JavaScript sources found to verify — this is not an oracle. Set verify.test in .agent/config.yml.");
+
+  const broken = [];
+  for (const file of files) {
+    const res = spawnSync(process.execPath, ["--check", file], { encoding: "utf-8" });
+    if (res.status !== 0) broken.push(\`\${file}: \${(res.stderr || "").trim().split("\\n")[0]}\`);
+  }
+  assert.deepEqual(broken, [], \`\${broken.length} file(s) failed to parse\`);
 });
 `;
   writeFileSync(smokePath, content, "utf-8");
@@ -173,7 +261,15 @@ export function detectPolyglotStack(projectRoot = process.cwd()) {
   if (existsSync(join(projectRoot, "Package.swift"))) {
     return { ...container, stack: "swift", testCmd: "swift test", buildCmd: "swift build", triggerFile: "Package.swift" };
   }
-  if (existsSync(join(projectRoot, "app.json")) || existsSync(join(projectRoot, "react-native.config.js"))) {
+  // `app.json` is not a manifest, it is an Expo/React Native *configuration*
+  // file, and the name is generic enough that unrelated projects use it. Its
+  // test command is `npm test`, so without a package.json beside it the
+  // detector was claiming a Node stack for a repository that has no Node in
+  // it: `Cargo.toml` + `app.json` was measured as `react-native` / `npm test`.
+  if (
+    (existsSync(join(projectRoot, "app.json")) && existsSync(join(projectRoot, "package.json"))) ||
+    existsSync(join(projectRoot, "react-native.config.js"))
+  ) {
     const triggerFile = existsSync(join(projectRoot, "app.json")) ? "app.json" : "react-native.config.js";
     return { ...container, stack: "react-native", testCmd: "npm test", buildCmd: "npx react-native bundle --platform android --dev false --entry-file index.js --bundle-output android/main.jsbundle", triggerFile };
   }
@@ -188,7 +284,14 @@ export function detectPolyglotStack(projectRoot = process.cwd()) {
   if (existsSync(join(projectRoot, "go.mod"))) {
     return { ...container, stack: "go", testCmd: "go test ./...", buildCmd: "go build ./...", triggerFile: "go.mod" };
   }
-  if (existsSync(join(projectRoot, "Makefile"))) {
+  // A Makefile is only an oracle if it declares the target we are about to
+  // run. `make test` on a Makefile with only a `build:` target exits 2 with
+  // "No rule to make target 'test'" — measured on a repository whose
+  // package.json declared a perfectly good `vitest run`, because the Makefile
+  // was checked first and the presence of the *file* was the whole test. A
+  // hard red on day one is how a user learns the gate is broken and turns it
+  // off, so the file must earn the claim.
+  if (existsSync(join(projectRoot, "Makefile")) && makefileHasTestTarget(projectRoot)) {
     return { ...container, stack: "make", testCmd: "make test", buildCmd: "make build", triggerFile: "Makefile" };
   }
 
@@ -715,7 +818,7 @@ export function bootstrapZeroTestRepo(root = process.cwd(), options = {}) {
   if (existsSync(join(root, "package.json"))) {
     try {
       const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf-8"));
-      hasPkgTest = Boolean(pkg?.scripts?.test);
+      hasPkgTest = Boolean(pkg?.scripts?.test) && !isPlaceholderTestScript(pkg.scripts.test);
     } catch (_) {}
   }
 

package/src/task-optimizer.mjs

@@ -265,9 +265,13 @@ export function scorePromptFalsifiability(promptText, options = {}) {
   let isTrivial = false;
 
   if (!verifyCmd) {
-    const detectedOracles = detectStackOracles(rootDir);
-    if (detectedOracles.length > 0 && detectedOracles[0].testCmd) {
-      verifyCmd = detectedOracles[0].testCmd;
+    // `detectStackOracles` returns an object, not an array: `.length` was
+    // undefined, so this branch never ran and every task without an explicit
+    // --verify-cmd was scored MISSING_ORACLE even in a repository with a
+    // working suite.
+    const detected = detectStackOracles(rootDir);
+    if (detected?.candidates?.testCmd) {
+      verifyCmd = detected.candidates.testCmd;
       autoDetected = true;
     }
   }