qualia-framework 4.5.0 → 5.3.0

package/tests/bin.test.sh

@@ -9,6 +9,7 @@ NODE="${NODE:-node}"
 CLI_JS="$FRAMEWORK_DIR/bin/cli.js"
 UI_JS="$FRAMEWORK_DIR/bin/qualia-ui.js"
 INSTALL_JS="$FRAMEWORK_DIR/bin/install.js"
+STATE_JS="$FRAMEWORK_DIR/bin/state.js"
 PKG_VERSION=$($NODE -e 'console.log(require("'"$FRAMEWORK_DIR"'/package.json").version)')
 
 # Track tmp dirs we create so we can clean them up on exit
@@ -476,11 +477,12 @@ else
   fail_case "CLAUDE.md role substitution"
 fi
 
-# 31. All 9 hooks installed (block-env-edit removed in v3.2.0;
-# git-guardrails + stop-session-log added in v4.2.0)
+# 31. All 12 hooks installed (block-env-edit removed in v3.2.0;
+# git-guardrails + stop-session-log added in v4.2.0;
+# vercel-account-guard + env-empty-guard + supabase-destructive-guard added in v5.0.0)
 HOOK_COUNT=$(ls "$TMP/.claude/hooks/"*.js 2>/dev/null | wc -l)
-if [ "$HOOK_COUNT" -eq 9 ]; then
-  pass "9 hooks installed in hooks/"
+if [ "$HOOK_COUNT" -eq 12 ]; then
+  pass "12 hooks installed in hooks/"
 else
   fail_case "hook count" "got $HOOK_COUNT"
 fi
@@ -496,7 +498,7 @@ else
   fail_case "settings.json contents"
 fi
 
-# 33. settings.json contains all 9 hooks wired correctly
+# 33. settings.json contains all 12 hooks wired correctly
 if grep -q 'branch-guard.js' "$TMP/.claude/settings.json" \
    && grep -q 'migration-guard.js' "$TMP/.claude/settings.json" \
    && grep -q 'pre-push.js' "$TMP/.claude/settings.json" \
@@ -505,8 +507,11 @@ if grep -q 'branch-guard.js' "$TMP/.claude/settings.json" \
    && grep -q 'session-start.js' "$TMP/.claude/settings.json" \
    && grep -q 'pre-compact.js' "$TMP/.claude/settings.json" \
    && grep -q 'git-guardrails.js' "$TMP/.claude/settings.json" \
-   && grep -q 'stop-session-log.js' "$TMP/.claude/settings.json"; then
-  pass "settings.json has all 9 hooks wired"
+   && grep -q 'stop-session-log.js' "$TMP/.claude/settings.json" \
+   && grep -q 'vercel-account-guard.js' "$TMP/.claude/settings.json" \
+   && grep -q 'env-empty-guard.js' "$TMP/.claude/settings.json" \
+   && grep -q 'supabase-destructive-guard.js' "$TMP/.claude/settings.json"; then
+  pass "settings.json has all 12 hooks wired"
 else
   fail_case "settings.json missing hooks"
 fi
@@ -992,6 +997,592 @@ else
   fail_case "help missing flush" "exit=$EXIT"
 fi
 
+echo ""
+echo "--- v5.0.0 (alignment substrate + new skills) ---"
+
+# 79. CONTEXT.md template installs to qualia-templates/
+TMP=$(mktmp)
+echo "QS-FAWZI-01" | HOME="$TMP" $NODE "$INSTALL_JS" >/dev/null 2>&1
+if [ -f "$TMP/.claude/qualia-templates/CONTEXT.md" ]; then
+  pass "CONTEXT.md template installs to qualia-templates/"
+else
+  fail_case "CONTEXT.md template missing"
+fi
+
+# 80. decisions/ADR-template.md installs (validates nested template dir copy)
+if [ -f "$TMP/.claude/qualia-templates/decisions/ADR-template.md" ]; then
+  pass "decisions/ADR-template.md installs (nested template dir)"
+else
+  fail_case "decisions/ADR-template.md missing"
+fi
+
+# 81-84. The 4 new v5 skills install with their SKILL.md
+for SKILL in qualia-zoom qualia-road qualia-issues qualia-triage; do
+  if [ -f "$TMP/.claude/skills/$SKILL/SKILL.md" ]; then
+    pass "$SKILL skill installs"
+  else
+    fail_case "$SKILL skill missing after install"
+  fi
+done
+
+# 85. qualia-discuss SKILL.md mentions "grilling" (validates v5 fold of qualia-grill into discuss)
+if grep -qi "grilling" "$TMP/.claude/skills/qualia-discuss/SKILL.md"; then
+  pass "qualia-discuss documents grilling pattern (folded from qualia-grill)"
+else
+  fail_case "qualia-discuss missing grilling reference"
+fi
+
+# 86. qualia-discuss SKILL.md references CONTEXT.md (validates v5 substrate wiring)
+if grep -q "CONTEXT.md" "$TMP/.claude/skills/qualia-discuss/SKILL.md"; then
+  pass "qualia-discuss references CONTEXT.md"
+else
+  fail_case "qualia-discuss missing CONTEXT.md reference"
+fi
+
+# 87. qualia-road has disable-model-invocation: true (pure reference skill, user-only)
+if grep -q "disable-model-invocation: true" "$TMP/.claude/skills/qualia-road/SKILL.md"; then
+  pass "qualia-road has disable-model-invocation: true"
+else
+  fail_case "qualia-road missing disable-model-invocation"
+fi
+
+# 88. qualia-road has NO dead skill refs (qualia-grill, qualia-deepen, qualia-tdd, qualia-onboard
+# were folded; if they appear as bare /qualia-* commands the road documentation is broken)
+if grep -qE '/qualia-(grill|deepen|tdd|onboard)\b' "$TMP/.claude/skills/qualia-road/SKILL.md"; then
+  fail_case "qualia-road still references folded skills as commands"
+else
+  pass "qualia-road has no dead-skill references"
+fi
+
+# 89. CONTEXT.md template has NO /qualia-grill reference (was folded into /qualia-discuss)
+if grep -q '/qualia-grill\b' "$TMP/.claude/qualia-templates/CONTEXT.md"; then
+  fail_case "CONTEXT.md template still references /qualia-grill"
+else
+  pass "CONTEXT.md template has no /qualia-grill reference"
+fi
+
+# 90. Builder agent has trust-boundary block (defends against CONTEXT.md prompt injection)
+if grep -q "Trust boundary" "$TMP/.claude/agents/builder.md"; then
+  pass "builder.md has Trust boundary block (prompt-injection defense)"
+else
+  fail_case "builder.md missing Trust boundary block"
+fi
+
+# 91. qualia-issues uses --body-file (not vulnerable heredoc) for gh issue create
+if grep -q -- "--body-file" "$TMP/.claude/skills/qualia-issues/SKILL.md" \
+   && ! grep -q "gh issue create.*--body \"\$(cat <<" "$TMP/.claude/skills/qualia-issues/SKILL.md"; then
+  pass "qualia-issues uses --body-file (no heredoc shell injection)"
+else
+  fail_case "qualia-issues still uses heredoc for gh issue body"
+fi
+
+# 92-94. v5.0 insights-driven hooks parse as valid Node and install
+for HOOK in vercel-account-guard env-empty-guard supabase-destructive-guard; do
+  HOOK_FILE="$TMP/.claude/hooks/${HOOK}.js"
+  if [ -f "$HOOK_FILE" ]; then
+    EXIT=0; $NODE -c "$HOOK_FILE" 2>/dev/null || EXIT=$?
+    if [ "$EXIT" -eq 0 ]; then
+      pass "${HOOK}.js installs and parses as valid Node"
+    else
+      fail_case "${HOOK}.js parse error"
+    fi
+  else
+    fail_case "${HOOK}.js missing after install"
+  fi
+done
+
+# 95. cmdInit guards against suspicious project names (insights friction: throwaway projects)
+TMP_PROJ=$(mktemp -d)
+EXIT=0; OUT=$(cd "$TMP_PROJ" && $NODE "$STATE_JS" init --project "test" --phases '[{"name":"X","goal":"y"}]' 2>&1) || EXIT=$?
+if [ "$EXIT" -ne 0 ] && echo "$OUT" | grep -q "SUSPICIOUS_NAME"; then
+  pass "state.js init blocks suspicious project name 'test' without --force"
+else
+  fail_case "state.js init allowed 'test' as project name"
+fi
+rm -rf "$TMP_PROJ"
+
+# 96. cmdInit allows real client name
+TMP_PROJ=$(mktemp -d)
+EXIT=0; OUT=$(cd "$TMP_PROJ" && $NODE "$STATE_JS" init --project "RealClient" --phases '[{"name":"X","goal":"y"}]' 2>&1) || EXIT=$?
+if [ "$EXIT" -eq 0 ] && echo "$OUT" | grep -q '"action": "init"'; then
+  pass "state.js init allows real project name 'RealClient'"
+else
+  fail_case "state.js init rejected real name" "exit=$EXIT"
+fi
+rm -rf "$TMP_PROJ"
+
+# 97. cmdInit allows suspicious name with --force (escape hatch)
+TMP_PROJ=$(mktemp -d)
+EXIT=0; OUT=$(cd "$TMP_PROJ" && $NODE "$STATE_JS" init --project "test" --phases '[{"name":"X","goal":"y"}]' --force 2>&1) || EXIT=$?
+if [ "$EXIT" -eq 0 ]; then
+  pass "state.js init --force bypasses suspicious-name guard"
+else
+  fail_case "state.js init --force was blocked" "exit=$EXIT"
+fi
+rm -rf "$TMP_PROJ"
+
+# 98. pre-deploy-gate honors QUALIA_SKIP_LINT escape (insights friction: lint blocks ship)
+if grep -q "QUALIA_SKIP_LINT" "$TMP/.claude/hooks/pre-deploy-gate.js"; then
+  pass "pre-deploy-gate.js honors QUALIA_SKIP_LINT escape"
+else
+  fail_case "pre-deploy-gate missing QUALIA_SKIP_LINT escape"
+fi
+
+echo ""
+echo "--- v5.0.0 (visual-polish loop addendum) ---"
+
+# 99. qualia-polish-loop SKILL.md installs
+TMP=$(mktmp)
+echo "QS-FAWZI-01" | HOME="$TMP" $NODE "$INSTALL_JS" >/dev/null 2>&1
+if [ -f "$TMP/.claude/skills/qualia-polish-loop/SKILL.md" ]; then
+  pass "qualia-polish-loop SKILL.md installs"
+else
+  fail_case "qualia-polish-loop SKILL.md missing after install"
+fi
+
+# 100. qualia-polish-loop REFERENCE.md installs
+if [ -f "$TMP/.claude/skills/qualia-polish-loop/REFERENCE.md" ]; then
+  pass "qualia-polish-loop REFERENCE.md installs"
+else
+  fail_case "qualia-polish-loop REFERENCE.md missing after install"
+fi
+
+# 101. qualia-polish-loop SKILL.md references the design rubric
+if grep -q "design-rubric.md" "$TMP/.claude/skills/qualia-polish-loop/SKILL.md"; then
+  pass "qualia-polish-loop references design-rubric.md"
+else
+  fail_case "qualia-polish-loop missing rubric reference"
+fi
+
+# 102. qualia-polish-loop REFERENCE.md has the anchored vision eval prompt
+if grep -q "DEFAULT TO 3" "$TMP/.claude/skills/qualia-polish-loop/REFERENCE.md"; then
+  pass "qualia-polish-loop REFERENCE.md has anchored rubric prompt"
+else
+  fail_case "qualia-polish-loop REFERENCE.md missing anchored rubric"
+fi
+
+# 103. qualia-polish-loop SKILL.md has regression detection (LOOP_REGRESSION_DETECTED)
+if grep -q "LOOP_REGRESSION_DETECTED" "$TMP/.claude/skills/qualia-polish-loop/SKILL.md"; then
+  pass "qualia-polish-loop has regression kill-switch"
+else
+  fail_case "qualia-polish-loop missing regression kill-switch"
+fi
+
+# 104. score.mjs exists in the framework skill scripts
+if [ -f "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/score.mjs" ]; then
+  pass "score.mjs exists in skill scripts"
+else
+  fail_case "score.mjs missing from skill scripts"
+fi
+
+# 105. score.mjs computes pass correctly (all dims >= 3)
+SCORE_OUT=$(echo '{"typography":3,"color":3,"spatial":3,"layout":3,"shadow":3,"motion":3,"microcopy":3,"container":3}' | $NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/score.mjs" 2>&1)
+EXIT=$?
+if [ "$EXIT" -eq 0 ] && echo "$SCORE_OUT" | grep -q '"pass": true'; then
+  pass "score.mjs pass on all-3 scores"
+else
+  fail_case "score.mjs pass computation" "exit=$EXIT"
+fi
+
+# 106. score.mjs computes fail correctly (one dim < 3)
+SCORE_OUT=$(echo '{"typography":2,"color":3,"spatial":3,"layout":3,"shadow":3,"motion":3,"microcopy":3,"container":3}' | $NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/score.mjs" 2>&1)
+EXIT=$?
+if [ "$EXIT" -eq 1 ] && echo "$SCORE_OUT" | grep -q '"pass": false'; then
+  pass "score.mjs fail on dim < 3"
+else
+  fail_case "score.mjs fail computation" "exit=$EXIT"
+fi
+
+# 107. qualia-road references qualia-polish-loop
+if grep -q "qualia-polish-loop" "$TMP/.claude/skills/qualia-road/SKILL.md"; then
+  pass "qualia-road references qualia-polish-loop"
+else
+  fail_case "qualia-road missing qualia-polish-loop reference"
+fi
+
+# 108. package.json version is 5.x (5.1+ accepted; v5.1 / v5.2 share the v5 line)
+if grep -qE '"5\.[123]\.' "$FRAMEWORK_DIR/package.json"; then
+  pass "package.json version is 5.x"
+else
+  fail_case "package.json version not 5.x"
+fi
+
+# 109. loop.mjs installs (orchestrator)
+if [ -f "$TMP/.claude/skills/qualia-polish-loop/scripts/loop.mjs" ]; then
+  pass "qualia-polish-loop scripts/loop.mjs installs"
+else
+  fail_case "scripts/loop.mjs missing — install.js scripts/ subfolder copy broken"
+fi
+
+# 110. playwright-capture.mjs installs (capture helper)
+if [ -f "$TMP/.claude/skills/qualia-polish-loop/scripts/playwright-capture.mjs" ]; then
+  pass "qualia-polish-loop scripts/playwright-capture.mjs installs"
+else
+  fail_case "scripts/playwright-capture.mjs missing"
+fi
+
+# 111. fixtures/ subfolder installs (self-test pages)
+if [ -f "$TMP/.claude/skills/qualia-polish-loop/fixtures/clean.html" ] && \
+   [ -f "$TMP/.claude/skills/qualia-polish-loop/fixtures/broken.html" ]; then
+  pass "qualia-polish-loop fixtures/ installs (clean.html + broken.html)"
+else
+  fail_case "fixtures/ subfolder not copied by install.js"
+fi
+
+# 112. visual-evaluator agent installs
+if [ -f "$TMP/.claude/agents/visual-evaluator.md" ]; then
+  pass "agents/visual-evaluator.md installs"
+else
+  fail_case "visual-evaluator agent missing after install"
+fi
+
+# 113. loop.mjs parses as valid Node ESM
+EXIT=0; $NODE --check "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/loop.mjs" 2>/dev/null || EXIT=$?
+if [ "$EXIT" -eq 0 ]; then
+  pass "loop.mjs parses as valid Node ESM"
+else
+  fail_case "loop.mjs parse error"
+fi
+
+# 114. playwright-capture.mjs parses as valid Node ESM
+EXIT=0; $NODE --check "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/playwright-capture.mjs" 2>/dev/null || EXIT=$?
+if [ "$EXIT" -eq 0 ]; then
+  pass "playwright-capture.mjs parses as valid Node ESM"
+else
+  fail_case "playwright-capture.mjs parse error"
+fi
+
+# 115. loop.mjs init creates a valid state file
+TMP_STATE=$(mktmp)/qpl-state.json
+mkdir -p "$(dirname "$TMP_STATE")"
+EXIT=0; $NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/loop.mjs" init \
+  --state "$TMP_STATE" --url "http://localhost:3000" --max 4 --budget 50000 >/dev/null 2>&1 || EXIT=$?
+if [ "$EXIT" -eq 0 ] && [ -f "$TMP_STATE" ] && grep -q '"verdict": "pending"' "$TMP_STATE"; then
+  pass "loop.mjs init creates valid state.json"
+else
+  fail_case "loop.mjs init failed (exit=$EXIT, state present? $([ -f "$TMP_STATE" ] && echo yes || echo no))"
+fi
+
+# 116. loop.mjs record kill-switch fires on 3 consecutive recurrences of same fingerprint
+TMP_STATE2=$(mktmp)/qpl-kill.json
+TMP_EVAL=$(mktmp)/qpl-eval.json
+mkdir -p "$(dirname "$TMP_STATE2")" "$(dirname "$TMP_EVAL")"
+$NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/loop.mjs" init \
+  --state "$TMP_STATE2" --url "http://localhost:3000" --max 8 >/dev/null 2>&1
+# write 3 identical evals
+KILL_OK=true
+for ITER in 1 2 3; do
+  cat > "$TMP_EVAL" <<EOF
+{
+  "iteration": $ITER,
+  "tokens_used": 100,
+  "viewport_results": [],
+  "aggregate_scores": {"typography":1,"color":3,"spatial":3,"layout":3,"shadow":3,"motion":3,"microcopy":3,"container":3},
+  "top_issues": [{"dim":"typography","severity":"critical","description":"banned font Inter visible","likely_file":"src/styles.css","fix":"replace"}],
+  "pass": false
+}
+EOF
+  EXIT=0; $NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/loop.mjs" record \
+    --state "$TMP_STATE2" --eval "$TMP_EVAL" >/dev/null 2>&1 || EXIT=$?
+  if [ "$ITER" -lt 3 ] && [ "$EXIT" -ne 1 ]; then KILL_OK=false; fi
+  if [ "$ITER" -eq 3 ] && [ "$EXIT" -ne 3 ]; then KILL_OK=false; fi
+done
+if [ "$KILL_OK" = true ] && grep -q '"verdict": "killed_regression"' "$TMP_STATE2"; then
+  pass "loop.mjs kill-switch fires after 3 consecutive recurrences"
+else
+  fail_case "loop.mjs kill-switch did not fire correctly"
+fi
+
+# 117. visual-evaluator agent has trust-boundary block (security-critical)
+if grep -q "Trust boundary" "$TMP/.claude/agents/visual-evaluator.md"; then
+  pass "visual-evaluator has trust-boundary block (refuses inlined-file injection)"
+else
+  fail_case "visual-evaluator missing trust-boundary block"
+fi
+
+echo ""
+echo "--- v5.1.0 (multi-target install: Claude / Codex / Both) ---"
+
+# 118. Target=1 (Claude only) installs to ~/.claude/, not ~/.codex/
+TMP=$(mktmp)
+printf 'QS-FAWZI-01\n1\n' | HOME="$TMP" $NODE "$INSTALL_JS" > "$TMP/log.txt" 2>&1
+EXIT=$?
+if [ "$EXIT" -eq 0 ] \
+   && [ -f "$TMP/.claude/.qualia-config.json" ] \
+   && [ ! -d "$TMP/.codex" ]; then
+  pass "target=1 → ~/.claude/ populated, ~/.codex/ untouched"
+else
+  fail_case "target=1 Claude-only" "exit=$EXIT codex_exists=$(test -d "$TMP/.codex" && echo yes || echo no)"
+fi
+
+# 119. Target=2 (Codex only) writes ~/.codex/AGENTS.md, skips ~/.claude/
+TMP=$(mktmp)
+printf 'QS-FAWZI-01\n2\n' | HOME="$TMP" $NODE "$INSTALL_JS" > "$TMP/log.txt" 2>&1
+EXIT=$?
+if [ "$EXIT" -eq 0 ] \
+   && [ -f "$TMP/.codex/AGENTS.md" ] \
+   && [ ! -d "$TMP/.claude" ] \
+   && grep -q "Role: OWNER" "$TMP/.codex/AGENTS.md" \
+   && ! grep -q "{{ROLE}}" "$TMP/.codex/AGENTS.md"; then
+  pass "target=2 → ~/.codex/AGENTS.md with Role: OWNER, ~/.claude/ skipped"
+else
+  fail_case "target=2 Codex-only" "exit=$EXIT claude_exists=$(test -d "$TMP/.claude" && echo yes || echo no)"
+fi
+
+# 120. Target=3 (Both) populates both directories with the right artifacts
+TMP=$(mktmp)
+printf 'QS-FAWZI-01\n3\n' | HOME="$TMP" $NODE "$INSTALL_JS" > "$TMP/log.txt" 2>&1
+EXIT=$?
+if [ "$EXIT" -eq 0 ] \
+   && [ -f "$TMP/.claude/.qualia-config.json" ] \
+   && [ -f "$TMP/.codex/AGENTS.md" ] \
+   && grep -q "Role: OWNER" "$TMP/.codex/AGENTS.md"; then
+  pass "target=3 → both ~/.claude/ and ~/.codex/AGENTS.md populated"
+else
+  fail_case "target=3 Both" "exit=$EXIT"
+fi
+
+# 121. Backward compat: legacy single-line piped install (no target line)
+# defaults to Claude only. Same exact invocation as pre-v5.1.
+TMP=$(mktmp)
+echo "QS-FAWZI-01" | HOME="$TMP" $NODE "$INSTALL_JS" > "$TMP/log.txt" 2>&1
+EXIT=$?
+if [ "$EXIT" -eq 0 ] \
+   && [ -f "$TMP/.claude/.qualia-config.json" ] \
+   && [ ! -d "$TMP/.codex" ]; then
+  pass "legacy single-line piped install → defaults to Claude only"
+else
+  fail_case "backward compat" "exit=$EXIT"
+fi
+
+# 122. Codex AGENTS.md is backed up before overwrite (matches v5.0 CLAUDE.md
+# / settings.json discipline — never silently destroy user-edited files).
+TMP=$(mktmp)
+mkdir -p "$TMP/.codex"
+echo "OLD USER CONTENT" > "$TMP/.codex/AGENTS.md"
+printf 'QS-FAWZI-01\n2\n' | HOME="$TMP" $NODE "$INSTALL_JS" > "$TMP/log.txt" 2>&1
+EXIT=$?
+BAK_COUNT=$(ls "$TMP/.codex/"AGENTS.md.bak.* 2>/dev/null | wc -l)
+if [ "$EXIT" -eq 0 ] \
+   && [ "$BAK_COUNT" -ge 1 ] \
+   && grep -q "OLD USER CONTENT" "$TMP/.codex/"AGENTS.md.bak.* \
+   && ! grep -q "OLD USER CONTENT" "$TMP/.codex/AGENTS.md"; then
+  pass "Codex AGENTS.md backup-before-overwrite preserves prior content"
+else
+  fail_case "Codex backup discipline" "exit=$EXIT bak_count=$BAK_COUNT"
+fi
+
+# 123. Codex install with same content does NOT create a redundant .bak
+# (the v5.0 CLAUDE.md backup discipline only backs up if content differs).
+TMP=$(mktmp)
+printf 'QS-FAWZI-01\n2\n' | HOME="$TMP" $NODE "$INSTALL_JS" > "$TMP/log.txt" 2>&1
+# Re-run with same input — content should be identical, no new backup.
+printf 'QS-FAWZI-01\n2\n' | HOME="$TMP" $NODE "$INSTALL_JS" > "$TMP/log2.txt" 2>&1
+BAK_COUNT=$(ls "$TMP/.codex/"AGENTS.md.bak.* 2>/dev/null | wc -l)
+if [ "$BAK_COUNT" -eq 0 ]; then
+  pass "Codex re-install with identical content → no redundant .bak"
+else
+  fail_case "Codex backup over-zealous" "bak_count=$BAK_COUNT"
+fi
+
+# 124. Non-TTY install log is free of cursor-control / line-clear escape
+# sequences (\r, \x1b[?25l/h hide-cursor, \x1b[2K clear-line). Spinner +
+# overwrite primitives must degrade cleanly when output is piped.
+TMP=$(mktmp)
+printf 'QS-FAWZI-01\n3\n' | HOME="$TMP" $NODE "$INSTALL_JS" > "$TMP/log.txt" 2>&1
+# Look for any of: bare CR, hide-cursor (?25), clear-line (\x1b[2K).
+if [ -s "$TMP/log.txt" ] \
+   && ! grep -q $'\r' "$TMP/log.txt" \
+   && ! grep -q '?25' "$TMP/log.txt" \
+   && ! grep -q '\[2K' "$TMP/log.txt"; then
+  pass "non-TTY install log degrades cleanly (no cursor-control escapes)"
+else
+  fail_case "non-TTY log has orphan escape sequences"
+fi
+
+# 125. Final summary card includes the new "Targets" + "Time" rows
+TMP=$(mktmp)
+printf 'QS-FAWZI-01\n3\n' | HOME="$TMP" $NODE "$INSTALL_JS" > "$TMP/log.txt" 2>&1
+CLEAN=$(strip_ansi < "$TMP/log.txt")
+if echo "$CLEAN" | grep -q "Targets" \
+   && echo "$CLEAN" | grep -q "Claude Code · Codex" \
+   && echo "$CLEAN" | grep -qE "Time +[0-9]+(\.[0-9]+s|ms|s)"; then
+  pass "summary card shows Targets + Time rows"
+else
+  fail_case "summary card missing v5.1 rows"
+fi
+
+# 126. qualia-ui.js exports the v5.1 live-progress primitives
+EXPORTED=$($NODE -e 'const u=require("'"$UI_JS"'"); console.log(["step","spinner","progress","box","kv","divider","section","sectionClose"].every(k=>typeof u[k]==="function") ? "ok" : "missing")')
+if [ "$EXPORTED" = "ok" ]; then
+  pass "qualia-ui.js exports step/spinner/progress/box/kv/divider/section/sectionClose"
+else
+  fail_case "qualia-ui exports missing" "got=$EXPORTED"
+fi
+
+# 127. qualia-ui.js still works as CLI when invoked directly (require-vs-CLI gate)
+OUT=$($NODE "$UI_JS" ok "test" 2>&1)
+if echo "$OUT" | grep -q "test"; then
+  pass "qualia-ui.js CLI dispatch still works after exports refactor"
+else
+  fail_case "qualia-ui CLI broke"
+fi
+
+# 128. package.json bumped to 5.x (5.1+ accepted; 5.2 is the v5.2 release)
+PKG_V=$($NODE -e 'console.log(require("'"$FRAMEWORK_DIR"'/package.json").version)')
+if echo "$PKG_V" | grep -qE "^5\.[123]\."; then
+  pass "package.json version bumped to 5.x ($PKG_V)"
+else
+  fail_case "package.json version not 5.x" "got=$PKG_V"
+fi
+
+echo ""
+echo "--- v5.2.0 (polish-loop reliability) ---"
+
+# 129. loop.mjs init accepts --routes and stores the URL list
+TMP_S=$(mktmp)/qpl-routes.json
+mkdir -p "$(dirname "$TMP_S")"
+EXIT=0; $NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/loop.mjs" init \
+  --state "$TMP_S" \
+  --routes "http://x.test/a,http://x.test/b,http://x.test/c" \
+  --max 4 >/dev/null 2>&1 || EXIT=$?
+if [ "$EXIT" -eq 0 ] \
+   && grep -q '"urls"' "$TMP_S" \
+   && grep -q '"http://x.test/a"' "$TMP_S" \
+   && grep -q '"http://x.test/b"' "$TMP_S" \
+   && grep -q '"http://x.test/c"' "$TMP_S"; then
+  pass "loop.mjs init --routes stores URL list (multi-route)"
+else
+  fail_case "loop.mjs --routes failed (exit=$EXIT)"
+fi
+
+# 130. state.url is the first --routes entry (backward compat with single-route SKILL.md)
+if grep -q '"url": "http://x.test/a"' "$TMP_S"; then
+  pass "loop.mjs init --routes sets state.url = first URL (backward compat)"
+else
+  fail_case "loop.mjs --routes did not set state.url to first entry"
+fi
+
+# 131. loop.mjs init accepts --reduced-motion and records it in state
+TMP_S2=$(mktmp)/qpl-rm.json
+mkdir -p "$(dirname "$TMP_S2")"
+EXIT=0; $NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/loop.mjs" init \
+  --state "$TMP_S2" --url "http://x.test/" --reduced-motion >/dev/null 2>&1 || EXIT=$?
+if [ "$EXIT" -eq 0 ] && grep -q '"reduced_motion": true' "$TMP_S2"; then
+  pass "loop.mjs init --reduced-motion records state.reduced_motion=true"
+else
+  fail_case "loop.mjs --reduced-motion not recorded (exit=$EXIT)"
+fi
+
+# 132. playwright-capture.mjs accepts --reduced-motion (parses without error)
+EXIT=0; OUT=$($NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/playwright-capture.mjs" --help 2>&1) || EXIT=$?
+if [ "$EXIT" -eq 0 ] && echo "$OUT" | grep -q -- "--reduced-motion"; then
+  pass "playwright-capture.mjs --help documents --reduced-motion"
+else
+  fail_case "playwright-capture --reduced-motion not in --help"
+fi
+
+# 133. loop.mjs init rejects when neither --url nor --routes given
+TMP_S3=$(mktmp)/qpl-nourl.json
+mkdir -p "$(dirname "$TMP_S3")"
+EXIT=0; $NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/loop.mjs" init \
+  --state "$TMP_S3" --max 4 >/dev/null 2>&1 || EXIT=$?
+if [ "$EXIT" -eq 2 ]; then
+  pass "loop.mjs init rejects missing --url/--routes (exit 2)"
+else
+  fail_case "loop.mjs init did not reject missing URL (exit=$EXIT)"
+fi
+
+# 134. loop.mjs report mentions multi-route when state.urls > 1
+TMP_S4=$(mktmp)/qpl-rep.json
+mkdir -p "$(dirname "$TMP_S4")"
+$NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/loop.mjs" init \
+  --state "$TMP_S4" --routes "http://a/,http://b/" >/dev/null 2>&1
+REP=$($NODE "$FRAMEWORK_DIR/skills/qualia-polish-loop/scripts/loop.mjs" report --state "$TMP_S4" 2>&1)
+if echo "$REP" | grep -q "URLs (2)"; then
+  pass "loop.mjs report renders multi-route header"
+else
+  fail_case "loop.mjs report missing multi-route header"
+fi
+
+echo ""
+echo "--- v5.3.0 (Matt Pocock gaps: prd, hook-gen, parallel-interface) ---"
+
+# Re-install for v5.3 assertions (TMP from #99 may have v5.1 state)
+TMP=$(mktmp)
+echo "QS-FAWZI-01" | HOME="$TMP" $NODE "$INSTALL_JS" >/dev/null 2>&1
+
+# 135. qualia-prd skill installs
+if [ -f "$TMP/.claude/skills/qualia-prd/SKILL.md" ]; then
+  pass "qualia-prd skill installs"
+else
+  fail_case "qualia-prd SKILL.md missing after install"
+fi
+
+# 136. qualia-prd description mentions PRD synthesis from conversation
+if grep -q "synthesize\|Synthesize" "$TMP/.claude/skills/qualia-prd/SKILL.md" \
+   && grep -q "/qualia-issues" "$TMP/.claude/skills/qualia-prd/SKILL.md"; then
+  pass "qualia-prd describes synthesis flow + pairs with /qualia-issues"
+else
+  fail_case "qualia-prd missing synthesis or /qualia-issues link"
+fi
+
+# 137. qualia-prd documents fork-based token discipline
+if grep -qE "[Ff]orked subagent|fork.*subagent" "$TMP/.claude/skills/qualia-prd/SKILL.md" \
+   && grep -q "Token discipline" "$TMP/.claude/skills/qualia-prd/SKILL.md"; then
+  pass "qualia-prd documents fork-based synthesis (token discipline)"
+else
+  fail_case "qualia-prd missing fork/token-discipline section"
+fi
+
+# 138. qualia-hook-gen skill installs
+if [ -f "$TMP/.claude/skills/qualia-hook-gen/SKILL.md" ]; then
+  pass "qualia-hook-gen skill installs"
+else
+  fail_case "qualia-hook-gen SKILL.md missing after install"
+fi
+
+# 139. qualia-hook-gen documents the three enforcement patterns (block/rewrite/warn)
+if grep -q "Block" "$TMP/.claude/skills/qualia-hook-gen/SKILL.md" \
+   && grep -q "Rewrite" "$TMP/.claude/skills/qualia-hook-gen/SKILL.md" \
+   && grep -q "Warn" "$TMP/.claude/skills/qualia-hook-gen/SKILL.md"; then
+  pass "qualia-hook-gen documents block/rewrite/warn patterns"
+else
+  fail_case "qualia-hook-gen missing one of block/rewrite/warn patterns"
+fi
+
+# 140. qualia-hook-gen mandates Node hooks (cross-platform), not .sh scripts
+if grep -q "pure Node\|pure-node\|cross-platform" "$TMP/.claude/skills/qualia-hook-gen/SKILL.md" \
+   && grep -q "No \`.sh\`\|No \\.sh\|exit 0/2\|exit 2 to" "$TMP/.claude/skills/qualia-hook-gen/SKILL.md"; then
+  pass "qualia-hook-gen mandates pure-Node hooks (cross-platform discipline)"
+else
+  fail_case "qualia-hook-gen missing pure-Node mandate"
+fi
+
+# 141. qualia-optimize SKILL.md adds Step 5b (parallel-interface design)
+if grep -q "Step 5b\|Parallel Interface Design\|Wave 3" "$TMP/.claude/skills/qualia-optimize/SKILL.md" \
+   && grep -q "radically different" "$TMP/.claude/skills/qualia-optimize/SKILL.md"; then
+  pass "qualia-optimize Step 5b parallel-interface fan-out documented"
+else
+  fail_case "qualia-optimize missing Step 5b parallel-interface stage"
+fi
+
+# 142. qualia-optimize REFERENCE.md has the parallel-interface spawn template
+if grep -q "Parallel interface design prompt" "$TMP/.claude/skills/qualia-optimize/REFERENCE.md" \
+   && grep -q "Variant 1\|variant 1" "$TMP/.claude/skills/qualia-optimize/REFERENCE.md"; then
+  pass "qualia-optimize REFERENCE.md has parallel-interface spawn template"
+else
+  fail_case "qualia-optimize REFERENCE.md missing parallel-interface template"
+fi
+
+# 143. package.json version is 5.x (5.1+ accepted; v5.3 is the v5.3 release)
+PKG_V=$($NODE -e 'console.log(require("'"$FRAMEWORK_DIR"'/package.json").version)')
+if echo "$PKG_V" | grep -qE "^5\.[123]\."; then
+  pass "package.json version is 5.x ($PKG_V) — v5.3 accepted"
+else
+  fail_case "package.json version not 5.x" "got=$PKG_V"
+fi
+
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ] && exit 0 || exit 1