psyclaw 0.27.22 → 0.28.0

package/vendor/ars/scripts/test_check_ci_pytest_manifest.py

@@ -0,0 +1,425 @@
+"""Unit tests for scripts/check_ci_pytest_manifest.py (issue #156).
+
+Lint guards 6 failure modes on the unified pytest manifest:
+1. manifest entry path does not exist on disk
+2. duplicate `id` across entries
+3. duplicate exact (path, args) invocation across entries (unless an explicit
+   allowlist marker is present)
+4. malformed `args` (not a list, or list elements not strings)
+5. unknown keys in a manifest entry (catches typos like `arg` for `args`)
+6. `.github/workflows/spec-consistency.yml` contains a direct
+   `pytest scripts/test_*.py` invocation outside the runner — including
+   bypass variants with flags, quotes, `./` prefix, `python -m pytest`,
+   `py.test`, and backslash line continuations
+
+The lint reads the manifest at scripts/_ci_pytest_manifest.toml by default and
+the workflow at .github/workflows/spec-consistency.yml.
+"""
+from __future__ import annotations
+
+import subprocess
+import sys
+import textwrap
+from pathlib import Path
+
+import pytest
+
+
+SCRIPT = Path(__file__).resolve().parent / "check_ci_pytest_manifest.py"
+
+
+def _run(
+    manifest_path: Path,
+    workflow_path: Path,
+    *,
+    root: Path | None = None,
+    extra_args: list[str] | None = None,
+) -> subprocess.CompletedProcess[str]:
+    cmd = [
+        sys.executable,
+        str(SCRIPT),
+        "--manifest",
+        str(manifest_path),
+        "--workflow",
+        str(workflow_path),
+    ]
+    if root is not None:
+        cmd.extend(["--root", str(root)])
+    if extra_args:
+        cmd.extend(extra_args)
+    return subprocess.run(cmd, capture_output=True, text=True)
+
+
+def _write(path: Path, content: str) -> None:
+    path.write_text(textwrap.dedent(content).lstrip(), encoding="utf-8")
+
+
+@pytest.fixture
+def workdir(tmp_path: Path) -> Path:
+    (tmp_path / "scripts").mkdir()
+    (tmp_path / ".github" / "workflows").mkdir(parents=True)
+    # Plant two real test files referenced by happy-path manifest entries.
+    (tmp_path / "scripts" / "test_real_a.py").write_text("def test_a(): assert True\n")
+    (tmp_path / "scripts" / "test_real_b.py").write_text("def test_b(): assert True\n")
+    return tmp_path
+
+
+def test_clean_manifest_passes(workdir: Path) -> None:
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+
+    [[pytest]]
+    id = "real-b"
+    path = "scripts/test_real_b.py"
+    args = ["-k", "fast"]
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, """
+    name: Spec Consistency
+    on: [pull_request]
+    jobs:
+      spec:
+        runs-on: ubuntu-latest
+        steps:
+          - run: python scripts/run_ci_pytest_manifest.py
+    """)
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode == 0, result.stderr + result.stdout
+    assert "ok" in result.stdout.lower() or result.stdout.strip() != ""
+
+
+def test_missing_path_fails(workdir: Path) -> None:
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "ghost"
+    path = "scripts/test_does_not_exist.py"
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, """
+    jobs:
+      spec:
+        runs-on: ubuntu-latest
+        steps:
+          - run: python scripts/run_ci_pytest_manifest.py
+    """)
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode != 0
+    combined = result.stdout + result.stderr
+    assert "ghost" in combined
+    assert "test_does_not_exist.py" in combined
+
+
+def test_duplicate_id_fails(workdir: Path) -> None:
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_b.py"
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, "jobs: {}\n")
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode != 0
+    combined = result.stdout + result.stderr
+    assert "duplicate" in combined.lower() and "real-a" in combined
+
+
+def test_duplicate_invocation_fails(workdir: Path) -> None:
+    """Two distinct ids pointing at the same (path, args) is bypass-prone."""
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a-1"
+    path = "scripts/test_real_a.py"
+
+    [[pytest]]
+    id = "real-a-2"
+    path = "scripts/test_real_a.py"
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, "jobs: {}\n")
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode != 0
+    combined = result.stdout + result.stderr
+    assert "duplicate" in combined.lower()
+    assert "test_real_a.py" in combined
+
+
+def test_duplicate_invocation_with_distinct_args_passes(workdir: Path) -> None:
+    """Same path with DIFFERENT -k filters is the legitimate use case."""
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a-unit"
+    path = "scripts/test_real_a.py"
+    args = ["-k", "micro"]
+
+    [[pytest]]
+    id = "real-a-integration"
+    path = "scripts/test_real_a.py"
+    args = ["-k", "integration"]
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, """
+    jobs:
+      spec:
+        runs-on: ubuntu-latest
+        steps:
+          - run: python scripts/run_ci_pytest_manifest.py
+    """)
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode == 0, result.stdout + result.stderr
+
+
+def test_malformed_args_fails(workdir: Path) -> None:
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+    args = "this should be a list, not a string"
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, "jobs: {}\n")
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode != 0
+    combined = result.stdout + result.stderr
+    assert "args" in combined.lower()
+
+
+def test_direct_pytest_invocation_in_workflow_fails(workdir: Path) -> None:
+    """Drift guard: spec-consistency.yml must NOT have `pytest scripts/test_*.py` outside runner."""
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, """
+    name: Spec Consistency
+    jobs:
+      spec:
+        runs-on: ubuntu-latest
+        steps:
+          - run: python scripts/run_ci_pytest_manifest.py
+          - run: pytest scripts/test_real_a.py -v
+    """)
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode != 0
+    combined = result.stdout + result.stderr
+    assert "pytest" in combined.lower()
+    assert "scripts/test_real_a.py" in combined
+
+
+def test_unittest_invocations_in_workflow_pass(workdir: Path) -> None:
+    """`python3 -m unittest scripts.test_X` is out of scope for #156 — should NOT trigger drift guard."""
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, """
+    jobs:
+      spec:
+        runs-on: ubuntu-latest
+        steps:
+          - run: python scripts/run_ci_pytest_manifest.py
+          - run: python3 -m unittest scripts.test_real_b -v
+    """)
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode == 0, result.stdout + result.stderr
+
+
+def test_missing_manifest_fails(workdir: Path) -> None:
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, "jobs: {}\n")
+    result = _run(workdir / "scripts" / "missing_manifest.toml", workflow, root=workdir)
+    assert result.returncode != 0
+
+
+def test_missing_workflow_fails(workdir: Path) -> None:
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+    """)
+    result = _run(manifest, workdir / ".github" / "workflows" / "missing.yml", root=workdir)
+    assert result.returncode != 0
+
+
+def test_unknown_entry_key_fails(workdir: Path) -> None:
+    """A typo'd key (e.g., `arg` instead of `args`) must NOT silently pass —
+    otherwise the runner would skip the intended -k filter and run the full
+    test set."""
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+    arg = ["-k", "this-should-be-args"]
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, """
+    jobs:
+      spec:
+        runs-on: ubuntu-latest
+        steps:
+          - run: python scripts/run_ci_pytest_manifest.py
+    """)
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode != 0
+    combined = result.stdout + result.stderr
+    assert "arg" in combined.lower()
+
+
+@pytest.mark.parametrize(
+    "bypass_invocation",
+    [
+        # intermediate flags
+        "          - run: pytest -v scripts/test_real_a.py",
+        "          - run: pytest --tb=short scripts/test_real_a.py",
+        "          - run: pytest -xvs --tb=short scripts/test_real_a.py",
+        # quoted paths
+        '          - run: pytest "scripts/test_real_a.py"',
+        "          - run: pytest 'scripts/test_real_a.py'",
+        # explicit relative prefix
+        "          - run: pytest ./scripts/test_real_a.py",
+        # alternative invocations
+        "          - run: python -m pytest scripts/test_real_a.py",
+        "          - run: python3 -m pytest scripts/test_real_a.py",
+        "          - run: python -m pytest -q scripts/test_real_a.py",
+        "          - run: py.test scripts/test_real_a.py",
+        "          - run: uv run pytest scripts/test_real_a.py",
+        # quoted + flag combo
+        '          - run: pytest -v "scripts/test_real_a.py"',
+    ],
+    ids=[
+        "flag-first-short",
+        "flag-first-long",
+        "multiple-flags",
+        "double-quoted-path",
+        "single-quoted-path",
+        "relative-path-prefix",
+        "python-m-pytest",
+        "python3-m-pytest",
+        "python-m-pytest-with-flag",
+        "py.test-shorthand",
+        "uv-run-pytest",
+        "flag-and-quote-combo",
+    ],
+)
+def test_direct_pytest_bypass_variants_fail(workdir: Path, bypass_invocation: str) -> None:
+    """Drift-guard regex must catch every common bypass pattern: flags
+    between `pytest` and the path, quoted paths, `./` prefix, `python -m
+    pytest`, `py.test`, `uv run pytest`. (Dual-track review: gemini P1.1-P1.2
+    + codex empirical probe.)"""
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    workflow_body = (
+        "jobs:\n"
+        "  spec:\n"
+        "    runs-on: ubuntu-latest\n"
+        "    steps:\n"
+        "      - run: python scripts/run_ci_pytest_manifest.py\n"
+        f"{bypass_invocation}\n"
+    )
+    workflow.write_text(workflow_body, encoding="utf-8")
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode != 0, (
+        f"bypass variant should have failed lint but did not: "
+        f"{bypass_invocation!r}\nstdout={result.stdout!r} stderr={result.stderr!r}"
+    )
+    combined = result.stdout + result.stderr
+    assert "test_real_a.py" in combined
+
+
+def test_line_continuation_bypass_fails(workdir: Path) -> None:
+    """Backslash-newline line continuations must be normalized so the regex
+    sees one logical command. (Dual-track review: gemini P1.3.)"""
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    workflow.write_text(
+        "jobs:\n"
+        "  spec:\n"
+        "    runs-on: ubuntu-latest\n"
+        "    steps:\n"
+        "      - run: python scripts/run_ci_pytest_manifest.py\n"
+        "      - run: |\n"
+        "          pytest \\\n"
+        "            scripts/test_real_a.py\n",
+        encoding="utf-8",
+    )
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode != 0
+    combined = result.stdout + result.stderr
+    assert "test_real_a.py" in combined
+
+
+def test_pytest_path_substring_in_comment_does_not_match(workdir: Path) -> None:
+    """The drift guard strips YAML comments before scanning, so an example
+    inside a `#` comment must NOT trip the lint. This test pins that
+    behavior so the comment-strip can't be regressed accidentally."""
+    manifest = workdir / "scripts" / "_ci_pytest_manifest.toml"
+    _write(manifest, """
+    [[pytest]]
+    id = "real-a"
+    path = "scripts/test_real_a.py"
+    """)
+    workflow = workdir / ".github" / "workflows" / "spec-consistency.yml"
+    _write(workflow, """
+    # The drift guard rejects direct `pytest scripts/test_real_a.py` calls
+    # outside the runner — this comment must not trip it.
+    jobs:
+      spec:
+        runs-on: ubuntu-latest
+        steps:
+          - run: python scripts/run_ci_pytest_manifest.py
+    """)
+
+    result = _run(manifest, workflow, root=workdir)
+
+    assert result.returncode == 0, result.stdout + result.stderr

package/vendor/ars/scripts/test_check_claim_standing_candidate_ledger_integration.py

@@ -0,0 +1,256 @@
+"""Mutation tests for the static #655 Track A integration guard."""
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+import pytest
+
+from scripts import check_claim_standing_candidate_ledger_integration as guard
+
+
+ROOT = Path(__file__).resolve().parents[1]
+COPIED = tuple(
+    dict.fromkeys(
+        (
+            *(guard.SCHEMA_DIR / name for name in guard.SCHEMAS),
+            guard.RUNTIME,
+            guard.PROTOCOL,
+            guard.PHASE_E_PROTOCOL,
+            guard.DESIGN,
+            guard.CONTRACT_README,
+            guard.MANIFEST,
+            guard.WORKFLOW,
+            guard.CHANGELOG,
+            *guard.FIXTURES,
+            *guard.RESOLVER_HASHES,
+        )
+    )
+)
+
+
+def _tree(tmp_path: Path) -> Path:
+    root = tmp_path / "repo"
+    for relative in COPIED:
+        target = root / relative
+        target.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(ROOT / relative, target)
+    return root
+
+
+def _replace(root: Path, relative: Path, old: str, new: str) -> None:
+    path = root / relative
+    text = path.read_text(encoding="utf-8")
+    assert old in text
+    path.write_text(text.replace(old, new), encoding="utf-8")
+
+
+def test_current_repository_passes() -> None:
+    assert guard.run_checks(ROOT) == []
+
+
+def test_schema_identity_and_closure_are_pinned(tmp_path: Path) -> None:
+    root = _tree(tmp_path)
+    schema = guard.SCHEMA_DIR / "query_plan.schema.json"
+    _replace(root, schema, "claim-standing-query-plan/1.0", "claim-standing-query-plan/2.0")
+    _replace(root, schema, '"additionalProperties": false', '"additionalProperties": true')
+    errors = guard.run_checks(root)
+    assert any("schema_version drifted" in error for error in errors)
+    assert any("root must remain closed" in error for error in errors)
+
+
+def test_shared_contract_definitions_and_track_boundary_are_pinned(tmp_path: Path) -> None:
+    root = _tree(tmp_path)
+    candidate = guard.SCHEMA_DIR / "candidate_ledger.schema.json"
+    _replace(root, candidate, '"returned_count": { "type": "integer"', '"returned_count": { "type": "number"')
+    errors = guard.run_checks(root)
+    assert any("shared attempt/attempt definitions drifted" in error for error in errors)
+    root = _tree(tmp_path / "boundary")
+    query = guard.SCHEMA_DIR / "query_plan.schema.json"
+    _replace(root, query, '"created_at": { "$ref":', '"stance": { "type": "string" },\n    "created_at": { "$ref":')
+    assert any("Track B/live fields entered Track A" in error for error in guard.run_checks(root))
+
+
+def test_network_or_dispatch_capability_is_rejected(tmp_path: Path) -> None:
+    root = _tree(tmp_path)
+    path = root / guard.RUNTIME
+    path.write_text("import requests\n" + path.read_text(encoding="utf-8"), encoding="utf-8")
+    errors = guard.run_checks(root)
+    assert any("non-allowlisted transport/model/process-capable imports" in error for error in errors)
+    _replace(root, guard.RUNTIME, 'add_parser("build"', 'add_parser("dispatch"')
+    assert any("forbidden capability marker" in error for error in guard.run_checks(root))
+
+
+def test_non_allowlisted_and_dynamic_imports_are_rejected(tmp_path: Path) -> None:
+    root = _tree(tmp_path / "direct")
+    path = root / guard.RUNTIME
+    path.write_text("import httpx\n" + path.read_text(encoding="utf-8"), encoding="utf-8")
+    errors = guard.run_checks(root)
+    assert any("non-allowlisted" in error and "httpx" in error for error in errors)
+
+    root = _tree(tmp_path / "dynamic")
+    path = root / guard.RUNTIME
+    path.write_text(
+        "_process_module = __import__('subprocess')\n"
+        + path.read_text(encoding="utf-8"),
+        encoding="utf-8",
+    )
+    errors = guard.run_checks(root)
+    assert any("dynamic import, introspection" in error for error in errors)
+
+
+@pytest.mark.parametrize(
+    ("payload", "symbol"),
+    [
+        (
+            "from sys import modules as registry\n"
+            "registry['os'].spawnl(0, '/bin/true', 'true')\n",
+            "sys.modules",
+        ),
+        (
+            "from sys import _getframe as frame\n"
+            "_scope = frame().f_globals\n",
+            "sys._getframe",
+        ),
+    ],
+)
+def test_from_import_requires_an_exact_per_module_symbol_allowlist(
+    tmp_path: Path, payload: str, symbol: str
+) -> None:
+    root = _tree(tmp_path)
+    path = root / guard.RUNTIME
+    path.write_text(payload + path.read_text(encoding="utf-8"), encoding="utf-8")
+    errors = guard.run_checks(root)
+    assert any("non-allowlisted" in error and symbol in error for error in errors)
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        "_runner = eval\n_runner('1 + 1')\n",
+        "sys.modules['os'].system('true')\n",
+        (
+            "getattr(globals()['__built' + 'ins__'], "
+            "'__im' + 'port__')('socket')\n"
+        ),
+    ],
+)
+def test_alias_introspection_and_allowed_module_capability_bypasses_are_rejected(
+    tmp_path: Path, payload: str
+) -> None:
+    root = _tree(tmp_path)
+    path = root / guard.RUNTIME
+    path.write_text(payload + path.read_text(encoding="utf-8"), encoding="utf-8")
+    errors = guard.run_checks(root)
+    assert any("dynamic import, introspection" in error for error in errors)
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        "argparse._os.spawnl(0, '/bin/true', 'true')\n",
+        "hashlib.__spec__.loader.load_module('os')\n",
+        (
+            "import argparse as parser_alias\n"
+            "parser_alias._os.spawnl(0, '/bin/true', 'true')\n"
+        ),
+        "_escaped_module = argparse\n",
+        "import hashlib as hash_alias\n_escaped_module = hash_alias\n",
+        "_escaped_attribute = hashlib.sha256\n",
+        "_escaped_stream = sys.stderr\n",
+        "os.system('true')\n",
+        "os.O_EXCL = 0\n",
+        "del os.O_NOFOLLOW\n",
+    ],
+)
+def test_direct_module_uses_are_exact_and_cannot_escape(
+    tmp_path: Path, payload: str
+) -> None:
+    root = _tree(tmp_path)
+    path = root / guard.RUNTIME
+    path.write_text(payload + path.read_text(encoding="utf-8"), encoding="utf-8")
+    errors = guard.run_checks(root)
+    assert any("exact current-use" in error for error in errors)
+
+
+def test_safe_direct_module_alias_is_tracked_and_allowed(tmp_path: Path) -> None:
+    root = _tree(tmp_path)
+    _replace(root, guard.RUNTIME, "import hashlib", "import hashlib as hash_alias")
+    path = root / guard.RUNTIME
+    path.write_text(
+        path.read_text(encoding="utf-8").replace(
+            "hashlib.sha256", "hash_alias.sha256"
+        ),
+        encoding="utf-8",
+    )
+    assert guard.run_checks(root) == []
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        "hashlib = object()\n",
+        "def escape(os):\n    return os.open('/tmp/x', 0)\n",
+        "from pathlib import Path as json\n",
+    ],
+)
+def test_direct_module_bindings_cannot_be_shadowed(
+    tmp_path: Path, payload: str
+) -> None:
+    root = _tree(tmp_path)
+    path = root / guard.RUNTIME
+    path.write_text(payload + path.read_text(encoding="utf-8"), encoding="utf-8")
+    errors = guard.run_checks(root)
+    assert any("cannot be shadowed" in error for error in errors)
+
+
+def test_existing_resolver_change_is_rejected(tmp_path: Path) -> None:
+    root = _tree(tmp_path)
+    path = root / next(iter(guard.RESOLVER_HASHES))
+    path.write_text(path.read_text(encoding="utf-8") + "\n# drift\n", encoding="utf-8")
+    assert any("existing resolver changed" in error for error in guard.run_checks(root))
+
+
+def test_documentation_manifest_and_workflow_markers_are_required(tmp_path: Path) -> None:
+    root = _tree(tmp_path)
+    _replace(root, guard.PROTOCOL, "STANCE CLASSIFICATION UNMEASURED", "MEASURED")
+    _replace(
+        root,
+        guard.MANIFEST,
+        'id = "655-claim-standing-candidate-ledger"',
+        'id = "removed"',
+    )
+    _replace(
+        root,
+        guard.WORKFLOW,
+        "Check claim-standing candidate-ledger integration (#655)",
+        "removed",
+    )
+    errors = guard.run_checks(root)
+    assert any(str(guard.PROTOCOL) in error for error in errors)
+    assert any(str(guard.MANIFEST) in error for error in errors)
+    assert any(str(guard.WORKFLOW) in error for error in errors)
+
+
+def test_phase_e_probe_offer_markers_are_required(tmp_path: Path) -> None:
+    root = _tree(tmp_path)
+    _replace(
+        root,
+        guard.PHASE_E_PROTOCOL,
+        "`ALL` is not permission to probe every claim",
+        "ALL rows may be probed",
+    )
+    errors = guard.run_checks(root)
+    assert any(str(guard.PHASE_E_PROTOCOL) in error for error in errors)
+
+
+def test_stale_deferred_wiring_sentence_is_forbidden(tmp_path: Path) -> None:
+    root = _tree(tmp_path)
+    path = root / guard.PROTOCOL
+    path.write_text(
+        path.read_text(encoding="utf-8")
+        + "\nA dedicated contract is deferred to the pipeline-wiring slice.\n",
+        encoding="utf-8",
+    )
+    errors = guard.run_checks(root)
+    assert any("must not appear" in error for error in errors)