qualia-framework 3.4.0 → 4.0.0

package/tests/runner.js

@@ -814,6 +814,390 @@ waves: 1
       fs.rmSync(tmpDir, { recursive: true, force: true });
     }
   });
+
+  // ─── v3.4.2: init guard ────────────────────────────────
+  it("init refuses to clobber an existing project (no --force)", () => {
+    const tmpDir = makeProject();
+    try {
+      const r = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "init",
+        "--project", "TestProject",
+        "--phases", '[{"name":"X","goal":"Y"}]',
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 1);
+      const out = JSON.parse(r.stdout);
+      assert.equal(out.error, "ALREADY_INITIALIZED");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("init --force overwrites an existing project (preserves lifetime)", () => {
+    const tmpDir = makeProject();
+    try {
+      // Seed lifetime via close-milestone first. --force bypasses the v4
+      // readiness guards (MILESTONE_NOT_READY) since this test doesn't
+      // exercise the verification flow — it's focused on lifetime preservation.
+      const c = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "close-milestone", "--force",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(c.status, 0);
+      const tBefore = JSON.parse(fs.readFileSync(path.join(tmpDir, ".planning", "tracking.json"), "utf8"));
+      assert.ok(tBefore.lifetime.milestones_completed >= 1);
+
+      const r = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "init",
+        "--project", "TestProject",
+        "--phases", '[{"name":"NewFoundation","goal":"X"}]',
+        "--force",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 0);
+      const tAfter = JSON.parse(fs.readFileSync(path.join(tmpDir, ".planning", "tracking.json"), "utf8"));
+      assert.equal(tAfter.lifetime.milestones_completed, tBefore.lifetime.milestones_completed);
+      assert.equal(tAfter.phase, 1);
+      assert.equal(tAfter.status, "setup");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  // ─── v3.4.2: close-milestone idempotency ───────────────
+  it("close-milestone refuses double-close (idempotency)", () => {
+    const tmpDir = makeProject();
+    try {
+      // First close uses --force to bypass v4 readiness guards — this test
+      // focuses on the ALREADY_CLOSED sentinel, not phase-verification gates.
+      const r1 = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "close-milestone", "--force",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r1.status, 0);
+      const out1 = JSON.parse(r1.stdout);
+      assert.equal(out1.lifetime.milestones_completed, 1);
+
+      // Manually rewind milestone counter to simulate a re-run on the same closed milestone.
+      // (Real close-milestone advances t.milestone, so a true double-close requires
+      // putting milestone back to its prior value.)
+      const tFile = path.join(tmpDir, ".planning", "tracking.json");
+      const t = JSON.parse(fs.readFileSync(tFile, "utf8"));
+      t.milestone = out1.closed_milestone; // rewind
+      fs.writeFileSync(tFile, JSON.stringify(t, null, 2) + "\n");
+
+      // Second close (without --force) must fail with ALREADY_CLOSED, which
+      // is checked BEFORE the readiness guards in cmdCloseMilestone.
+      const r2 = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "close-milestone",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r2.status, 1);
+      const out2 = JSON.parse(r2.stdout);
+      assert.equal(out2.error, "ALREADY_CLOSED");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("close-milestone --force allows re-close", () => {
+    const tmpDir = makeProject();
+    try {
+      const r1 = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "close-milestone", "--force",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r1.status, 0);
+
+      const tFile = path.join(tmpDir, ".planning", "tracking.json");
+      const t = JSON.parse(fs.readFileSync(tFile, "utf8"));
+      t.milestone = JSON.parse(r1.stdout).closed_milestone;
+      fs.writeFileSync(tFile, JSON.stringify(t, null, 2) + "\n");
+
+      const r2 = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "close-milestone", "--force",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r2.status, 0);
+      const out2 = JSON.parse(r2.stdout);
+      assert.equal(out2.lifetime.milestones_completed, 2);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  // ─── v3.4.2: backfill never reduces lifetime (Math.max) ─
+  it("backfill-lifetime never reduces existing counters", () => {
+    const tmpDir = makeProject();
+    try {
+      // Seed lifetime with high values (simulating prior close-milestone)
+      const tFile = path.join(tmpDir, ".planning", "tracking.json");
+      const t = JSON.parse(fs.readFileSync(tFile, "utf8"));
+      t.lifetime.tasks_completed = 100;
+      t.lifetime.phases_completed = 20;
+      fs.writeFileSync(tFile, JSON.stringify(t, null, 2) + "\n");
+
+      // Backfill on a project with NO completed phases would compute 0/0
+      const r = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "backfill-lifetime",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 0);
+      const tAfter = JSON.parse(fs.readFileSync(tFile, "utf8"));
+      assert.equal(tAfter.lifetime.tasks_completed, 100, "backfill must NOT reduce tasks_completed");
+      assert.equal(tAfter.lifetime.phases_completed, 20, "backfill must NOT reduce phases_completed");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  // ─── v3.4.2: atomic write leaves no .tmp file ──────────
+  it("transition leaves no .tmp file on success (atomic write)", () => {
+    const tmpDir = makeProject();
+    try {
+      makeValidPlan(tmpDir, 1);
+      const r = runState(["transition", "--to", "planned"], tmpDir);
+      assert.equal(r.status, 0);
+      const planning = path.join(tmpDir, ".planning");
+      const tmps = fs.readdirSync(planning).filter(f => f.includes(".tmp."));
+      assert.equal(tmps.length, 0, `Stale .tmp files: ${tmps.join(", ")}`);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  // ─── v3.6.0: tracking.json schema additions ────────────
+  it("init writes new schema fields (team_id, project_id, build_count, etc.)", () => {
+    const tmpDir = makeProject();
+    try {
+      const t = JSON.parse(fs.readFileSync(path.join(tmpDir, ".planning", "tracking.json"), "utf8"));
+      // New v3.6 fields (default to empty / 0, but must be present)
+      assert.ok("team_id" in t, "team_id missing");
+      assert.ok("project_id" in t, "project_id missing");
+      assert.ok("git_remote" in t, "git_remote missing");
+      assert.ok("session_started_at" in t, "session_started_at missing");
+      assert.ok("last_pushed_at" in t, "last_pushed_at missing");
+      assert.ok("build_count" in t, "build_count missing");
+      assert.ok("deploy_count" in t, "deploy_count missing");
+      assert.ok("submitted_by" in t, "submitted_by missing");
+      assert.ok("last_closed_milestone" in t.lifetime, "lifetime.last_closed_milestone missing");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("init --force defensively hydrates partial lifetime (no NaN)", () => {
+    const tmpDir = makeProject();
+    try {
+      // Write a partial lifetime that's missing keys
+      const tFile = path.join(tmpDir, ".planning", "tracking.json");
+      const t = JSON.parse(fs.readFileSync(tFile, "utf8"));
+      t.lifetime = { tasks_completed: 5 }; // partial — missing other keys
+      fs.writeFileSync(tFile, JSON.stringify(t, null, 2) + "\n");
+
+      const r = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "init",
+        "--project", "TestProject",
+        "--phases", '[{"name":"X","goal":"Y"}]',
+        "--force",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 0);
+      const tAfter = JSON.parse(fs.readFileSync(tFile, "utf8"));
+      // Original partial value preserved
+      assert.equal(tAfter.lifetime.tasks_completed, 5);
+      // Missing keys defaulted to 0, never NaN
+      assert.equal(tAfter.lifetime.phases_completed, 0);
+      assert.equal(tAfter.lifetime.milestones_completed, 0);
+      assert.equal(tAfter.lifetime.total_phases, 0);
+      assert.equal(tAfter.lifetime.last_closed_milestone, 0);
+      assert.ok(!Number.isNaN(tAfter.lifetime.phases_completed));
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  // ─── v4.0.0: milestone readiness guards + milestones[] summary ─
+  it("close-milestone refuses unverified phases (MILESTONE_NOT_READY)", () => {
+    const tmpDir = makeProject();
+    try {
+      // No phases verified yet — close-milestone (without --force) must refuse.
+      const r = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "close-milestone",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 1);
+      const out = JSON.parse(r.stdout);
+      assert.equal(out.error, "MILESTONE_NOT_READY");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("close-milestone refuses single-phase milestones (MILESTONE_TOO_SMALL)", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-single-"));
+    try {
+      const init = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "init",
+        "--project", "SingleProject",
+        "--phases", '[{"name":"Only","goal":"Y"}]',
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(init.status, 0);
+
+      // Single-phase milestone — even if the phase were verified, the size
+      // guard catches it first. A milestone needs ≥ 2 phases without --force.
+      const r = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "close-milestone",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 1);
+      const out = JSON.parse(r.stdout);
+      assert.equal(out.error, "MILESTONE_TOO_SMALL");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("close-milestone appends a summary to milestones[]", () => {
+    const tmpDir = makeProject();
+    try {
+      const r = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "close-milestone", "--force",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 0);
+
+      const tFile = path.join(tmpDir, ".planning", "tracking.json");
+      const t = JSON.parse(fs.readFileSync(tFile, "utf8"));
+      assert.ok(Array.isArray(t.milestones), "milestones[] must exist");
+      assert.equal(t.milestones.length, 1);
+      const m1 = t.milestones[0];
+      assert.equal(m1.num, 1);
+      assert.ok(m1.total_phases >= 2, "total_phases should reflect seeded phases");
+      assert.ok(typeof m1.closed_at === "string" && m1.closed_at.length > 0);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("milestone summary captures cumulative tasks_completed, not current phase only", () => {
+    const tmpDir = makeProject();
+    try {
+      // Simulate 2 phases each with 3 tasks verified pass. This bumps
+      // lifetime.tasks_completed to 6. The milestone close summary should
+      // reflect 6, not just 3 (the last phase's tasks_done).
+      for (const phase of [1, 2]) {
+        const planFile = path.join(tmpDir, ".planning", `phase-${phase}-plan.md`);
+        fs.writeFileSync(planFile, `---
+phase: ${phase}
+goal: "x"
+tasks: 1
+waves: 1
+---
+
+## Task 1 — x
+**Wave:** 1
+**Files:** x.ts
+**Depends on:** none
+**Acceptance Criteria:**
+- ok
+`);
+        const verFile = path.join(tmpDir, ".planning", `phase-${phase}-verification.md`);
+        // Plan → built → verified
+        let r = spawnSync(process.execPath, [path.join(BIN, "state.js"), "transition", "--to", "planned", "--phase", String(phase)],
+          { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+        assert.equal(r.status, 0, `planned transition failed for phase ${phase}: ${r.stderr || r.stdout}`);
+        r = spawnSync(process.execPath, [path.join(BIN, "state.js"), "transition", "--to", "built", "--phase", String(phase), "--tasks-done", "3", "--tasks-total", "3"],
+          { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+        assert.equal(r.status, 0, `built transition failed for phase ${phase}: ${r.stderr || r.stdout}`);
+        fs.writeFileSync(verFile, "result: PASS");
+        r = spawnSync(process.execPath, [path.join(BIN, "state.js"), "transition", "--to", "verified", "--phase", String(phase), "--verification", "pass"],
+          { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+        assert.equal(r.status, 0, `verified transition failed for phase ${phase}: ${r.stderr || r.stdout}`);
+      }
+
+      // Close milestone
+      const r = spawnSync(process.execPath, [path.join(BIN, "state.js"), "close-milestone"],
+        { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 0, `close-milestone failed: ${r.stderr || r.stdout}`);
+
+      const t = JSON.parse(fs.readFileSync(path.join(tmpDir, ".planning", "tracking.json"), "utf8"));
+      assert.equal(t.lifetime.tasks_completed, 6, "lifetime should have 6 tasks (2 phases × 3 tasks)");
+      assert.equal(t.milestones.length, 1);
+      assert.equal(t.milestones[0].tasks_completed, 6, "milestone summary should cumulate all 6 tasks, not just the last phase's 3");
+      assert.equal(t.milestones[0].phases_completed, 2);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("build_count bumps on each 'built' transition", () => {
+    const tmpDir = makeProject();
+    try {
+      const tFile = path.join(tmpDir, ".planning", "tracking.json");
+      const before = JSON.parse(fs.readFileSync(tFile, "utf8")).build_count || 0;
+
+      fs.writeFileSync(path.join(tmpDir, ".planning", "phase-1-plan.md"), `---
+phase: 1
+goal: "x"
+tasks: 1
+waves: 1
+---
+
+## Task 1 — x
+**Wave:** 1
+**Files:** x.ts
+**Depends on:** none
+**Acceptance Criteria:**
+- ok
+`);
+      spawnSync(process.execPath, [path.join(BIN, "state.js"), "transition", "--to", "planned", "--phase", "1"],
+        { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      const r = spawnSync(process.execPath, [path.join(BIN, "state.js"), "transition", "--to", "built", "--phase", "1", "--tasks-done", "1", "--tasks-total", "1"],
+        { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 0);
+
+      const after = JSON.parse(fs.readFileSync(tFile, "utf8")).build_count || 0;
+      assert.equal(after, before + 1, "build_count should bump on 'built' transition");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("check exposes milestones[] and milestone_name in output", () => {
+    const tmpDir = makeProject();
+    try {
+      const r = spawnSync(process.execPath, [
+        path.join(BIN, "state.js"), "check",
+      ], { encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+      assert.equal(r.status, 0);
+      const out = JSON.parse(r.stdout);
+      assert.ok(Array.isArray(out.milestones), "check must expose milestones[]");
+      assert.ok(typeof out.milestone_name === "string", "check must expose milestone_name");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  // ─── v3.5.0: CRLF tolerance in parseStateMd ────────────
+  it("parseStateMd tolerates CRLF line endings (Windows-edited STATE.md)", () => {
+    const tmpDir = makeProject();
+    try {
+      const stateFile = path.join(tmpDir, ".planning", "STATE.md");
+      const lf = fs.readFileSync(stateFile, "utf8");
+      // Simulate Windows editor save: convert all \n to \r\n
+      const crlf = lf.replace(/\n/g, "\r\n");
+      fs.writeFileSync(stateFile, crlf);
+      const r = runState(["check"], tmpDir);
+      assert.equal(r.status, 0, `check failed on CRLF STATE.md: ${r.stdout} ${r.stderr}`);
+      const out = JSON.parse(r.stdout);
+      assert.equal(out.phase_name, "Foundation", "phase_name must NOT contain trailing \\r");
+      assert.equal(out.status, "setup", "status must NOT contain trailing \\r");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  // ─── v3.4.2: lock file is released after mutation ──────
+  it("transition releases the .state.lock", () => {
+    const tmpDir = makeProject();
+    try {
+      makeValidPlan(tmpDir, 1);
+      runState(["transition", "--to", "planned"], tmpDir);
+      const lockExists = fs.existsSync(path.join(tmpDir, ".planning", ".state.lock"));
+      assert.equal(lockExists, false, "lock file should be released after transition");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
 });
 
 // ═══════════════════════════════════════════════════════════
@@ -912,6 +1296,53 @@ describe("Hooks", () => {
     assert.match(content, /last_commit/);
   });
 
+  // v3.4.2: behavioral test — the stamp must actually mutate tracking.json
+  // AND create a real commit so the push includes it.
+  it("pre-push.js mutates tracking.json AND commits the stamp", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-push-real-"));
+    try {
+      // Init a real git repo
+      const gitOpts = { cwd: tmpDir, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] };
+      spawnSync("git", ["init", "--initial-branch=main"], gitOpts);
+      spawnSync("git", ["config", "user.email", "test@example.com"], gitOpts);
+      spawnSync("git", ["config", "user.name", "Test"], gitOpts);
+      spawnSync("git", ["config", "commit.gpgsign", "false"], gitOpts);
+
+      // Seed .planning/tracking.json + an initial commit
+      fs.mkdirSync(path.join(tmpDir, ".planning"));
+      const tFile = path.join(tmpDir, ".planning", "tracking.json");
+      fs.writeFileSync(tFile, JSON.stringify({
+        project: "test", phase: 1, status: "setup", last_commit: "OLD", last_updated: "2020-01-01T00:00:00Z",
+      }, null, 2) + "\n");
+      spawnSync("git", ["add", "."], gitOpts);
+      spawnSync("git", ["commit", "-m", "seed", "--no-verify"], gitOpts);
+
+      const headBefore = spawnSync("git", ["rev-parse", "HEAD"], gitOpts).stdout.trim();
+
+      // Run the hook
+      const r = spawnSync(process.execPath, [path.join(HOOKS, "pre-push.js")], {
+        encoding: "utf8", cwd: tmpDir, timeout: 10000, stdio: ["pipe", "pipe", "pipe"],
+      });
+      assert.equal(r.status, 0, `pre-push exited ${r.status}: ${r.stderr}`);
+
+      // tracking.json must have been mutated
+      const t = JSON.parse(fs.readFileSync(tFile, "utf8"));
+      assert.notEqual(t.last_commit, "OLD", "last_commit should have been updated");
+      assert.notEqual(t.last_updated, "2020-01-01T00:00:00Z", "last_updated should have been updated");
+      assert.match(t.last_updated, /^\d{4}-\d{2}-\d{2}T/);
+
+      // A NEW commit must exist (this is the smoking-gun fix from v3.4.2)
+      const headAfter = spawnSync("git", ["rev-parse", "HEAD"], gitOpts).stdout.trim();
+      assert.notEqual(headAfter, headBefore, "pre-push must commit the stamp so it ships with the push");
+
+      // The new commit must be authored by the bot, not the user
+      const author = spawnSync("git", ["log", "-1", "--format=%an <%ae>"], gitOpts).stdout.trim();
+      assert.match(author, /Qualia Framework/);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
   it("pre-push.js exits 0 with no tracking.json", () => {
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-push-"));
     try {
@@ -1303,6 +1734,135 @@ describe("Hooks", () => {
       fs.rmSync(tmpDir, { recursive: true, force: true });
     }
   });
+
+  // v3.5.0: refspec bypass — EMPLOYEE on a feature branch trying to push
+  // `feature/x:main` MUST be blocked, even though current branch isn't main.
+  it("branch-guard: EMPLOYEE refspec push to main -> blocked", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-bg-"));
+    try {
+      const projDir = path.join(tmpDir, "proj");
+      fs.mkdirSync(projDir, { recursive: true });
+      fs.mkdirSync(path.join(tmpDir, ".claude"), { recursive: true });
+      spawnSync("git", ["init", "-q"], { cwd: projDir });
+      spawnSync("git", ["checkout", "-b", "feature/x", "-q"], { cwd: projDir, stdio: "pipe" });
+      fs.writeFileSync(path.join(tmpDir, ".claude", ".qualia-config.json"), JSON.stringify({ role: "EMPLOYEE" }));
+      // Send Claude Code hook payload via stdin
+      const payload = JSON.stringify({
+        tool_input: { command: "git push origin feature/x:main" },
+      });
+      const r = spawnSync(process.execPath, [path.join(HOOKS, "branch-guard.js")], {
+        encoding: "utf8", cwd: projDir, timeout: 5000,
+        env: { ...process.env, HOME: tmpDir, USERPROFILE: tmpDir },
+        input: payload,
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      assert.equal(r.status, 2, "refspec push to main must be blocked for EMPLOYEE");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("branch-guard: EMPLOYEE refspec push to master -> blocked", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-bg-"));
+    try {
+      const projDir = path.join(tmpDir, "proj");
+      fs.mkdirSync(projDir, { recursive: true });
+      fs.mkdirSync(path.join(tmpDir, ".claude"), { recursive: true });
+      spawnSync("git", ["init", "-q"], { cwd: projDir });
+      spawnSync("git", ["checkout", "-b", "feature/x", "-q"], { cwd: projDir, stdio: "pipe" });
+      fs.writeFileSync(path.join(tmpDir, ".claude", ".qualia-config.json"), JSON.stringify({ role: "EMPLOYEE" }));
+      const payload = JSON.stringify({
+        tool_input: { command: "git push origin HEAD:master" },
+      });
+      const r = spawnSync(process.execPath, [path.join(HOOKS, "branch-guard.js")], {
+        encoding: "utf8", cwd: projDir, timeout: 5000,
+        env: { ...process.env, HOME: tmpDir, USERPROFILE: tmpDir },
+        input: payload,
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      assert.equal(r.status, 2, "refspec push to master must be blocked for EMPLOYEE");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("branch-guard: OWNER refspec push to main -> allowed", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-bg-"));
+    try {
+      const projDir = path.join(tmpDir, "proj");
+      fs.mkdirSync(projDir, { recursive: true });
+      fs.mkdirSync(path.join(tmpDir, ".claude"), { recursive: true });
+      spawnSync("git", ["init", "-q"], { cwd: projDir });
+      spawnSync("git", ["checkout", "-b", "feature/x", "-q"], { cwd: projDir, stdio: "pipe" });
+      fs.writeFileSync(path.join(tmpDir, ".claude", ".qualia-config.json"), JSON.stringify({ role: "OWNER" }));
+      const payload = JSON.stringify({
+        tool_input: { command: "git push origin feature/x:main" },
+      });
+      const r = spawnSync(process.execPath, [path.join(HOOKS, "branch-guard.js")], {
+        encoding: "utf8", cwd: projDir, timeout: 5000,
+        env: { ...process.env, HOME: tmpDir, USERPROFILE: tmpDir },
+        input: payload,
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      assert.equal(r.status, 0, "OWNER may push to main via refspec");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  // v3.5.0: migration-guard — comments stripped before pattern match
+  it("migration-guard: commented-out DROP TABLE is NOT blocked", () => {
+    const r = runHook("migration-guard.js", {
+      tool_input: {
+        file_path: "supabase/migrations/001_init.sql",
+        content: "-- DROP TABLE old_users; (rolled back, kept for reference)\nCREATE TABLE foo (id uuid) WITH (security_invoker = true);\nALTER TABLE foo ENABLE ROW LEVEL SECURITY;",
+      },
+    });
+    assert.equal(r.status, 0, `commented DROP should not block: ${r.stdout || r.stderr}`);
+  });
+
+  // v3.5.0: migration-guard — new destructive patterns
+  it("migration-guard: ALTER TABLE DROP COLUMN -> blocked", () => {
+    const r = runHook("migration-guard.js", {
+      tool_input: { file_path: "supabase/migrations/002.sql", content: "ALTER TABLE users DROP COLUMN ssn;" },
+    });
+    assert.equal(r.status, 2, "ALTER TABLE DROP COLUMN must block");
+  });
+
+  it("migration-guard: DROP DATABASE -> blocked", () => {
+    const r = runHook("migration-guard.js", {
+      tool_input: { file_path: "supabase/migrations/003.sql", content: "DROP DATABASE production;" },
+    });
+    assert.equal(r.status, 2, "DROP DATABASE must block");
+  });
+
+  it("migration-guard: UPDATE without WHERE -> blocked", () => {
+    const r = runHook("migration-guard.js", {
+      tool_input: { file_path: "supabase/migrations/004.sql", content: "UPDATE users SET email = NULL;" },
+    });
+    assert.equal(r.status, 2, "UPDATE without WHERE must block");
+  });
+
+  it("migration-guard: GRANT TO PUBLIC -> blocked", () => {
+    const r = runHook("migration-guard.js", {
+      tool_input: { file_path: "supabase/migrations/005.sql", content: "GRANT ALL ON users TO PUBLIC;" },
+    });
+    assert.equal(r.status, 2, "GRANT TO PUBLIC must block");
+  });
+
+  it("migration-guard: CREATE TEMP TABLE without RLS -> NOT blocked", () => {
+    const r = runHook("migration-guard.js", {
+      tool_input: { file_path: "supabase/migrations/006.sql", content: "CREATE TEMP TABLE scratch (id int);" },
+    });
+    assert.equal(r.status, 0, "TEMP tables should be exempt from the RLS requirement");
+  });
+
+  it("migration-guard: MigrationModal.tsx is NOT scanned", () => {
+    const r = runHook("migration-guard.js", {
+      tool_input: { file_path: "src/components/MigrationModal.tsx", content: "DROP TABLE users;" },
+    });
+    assert.equal(r.status, 0, "files with 'migration' in the name but not in a migrations/ dir should not be scanned");
+  });
 });
 
 // ═══════════════════════════════════════════════════════════

package/tests/state.test.sh

@@ -895,6 +895,46 @@ else
   fail_case "first-time init lifetime" "got=$RESULT expected=1,0,0,0,0"
 fi
 
+# ─── Backfill lifetime ───────────────────────────────────
+echo ""
+echo "backfill-lifetime:"
+
+# 50. backfill-lifetime reconstructs from completed phases
+TMP=$(make_project)
+make_valid_plan "$TMP" 1
+touch "$TMP/.planning/phase-1-verification.md"
+(cd "$TMP" && $NODE "$STATE_JS" transition --to planned >/dev/null 2>&1)
+(cd "$TMP" && $NODE "$STATE_JS" transition --to built --tasks-done 3 --tasks-total 3 >/dev/null 2>&1)
+(cd "$TMP" && $NODE "$STATE_JS" transition --to verified --verification pass >/dev/null 2>&1)
+# Wipe lifetime to simulate pre-v3.4.0 state
+$NODE -e "
+  const t = JSON.parse(require('fs').readFileSync('$TMP/.planning/tracking.json','utf8'));
+  t.lifetime = { tasks_completed: 0, phases_completed: 0, milestones_completed: 0, total_phases: 0 };
+  require('fs').writeFileSync('$TMP/.planning/tracking.json', JSON.stringify(t, null, 2));
+"
+OUT=$(cd "$TMP" && $NODE "$STATE_JS" backfill-lifetime 2>&1)
+EXIT=$?
+if [ "$EXIT" -eq 0 ] \
+   && echo "$OUT" | grep -q '"action": "backfill-lifetime"' \
+   && echo "$OUT" | grep -q '"phases_completed": 1' \
+   && echo "$OUT" | grep -q '"tasks_completed": 1'; then
+  pass "backfill-lifetime reconstructs 1 phase, 1 task from plan file"
+else
+  fail_case "backfill-lifetime" "exit=$EXIT out=$OUT"
+fi
+
+# 51. backfill-lifetime is idempotent
+OUT2=$(cd "$TMP" && $NODE "$STATE_JS" backfill-lifetime 2>&1)
+RESULT=$($NODE -e "
+  const t = JSON.parse(require('fs').readFileSync('$TMP/.planning/tracking.json','utf8'));
+  console.log([t.lifetime.tasks_completed, t.lifetime.phases_completed].join(','));
+")
+if [ "$RESULT" = "1,1" ]; then
+  pass "backfill-lifetime is idempotent (same result on re-run)"
+else
+  fail_case "backfill idempotent" "got=$RESULT"
+fi
+
 # ─── Summary ─────────────────────────────────────────────
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="