qualia-framework 5.9.1 → 6.2.7

package/tests/install-smoke.test.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# install-smoke.test.sh — package-level install smoke test.
+# Builds the npm tarball, extracts it, and runs the packaged installer into an
+# isolated HOME for the Claude + Codex target. This catches files that pass
+# source-tree tests but are missing from the published package.
+
+set -u
+
+PASS=0
+FAIL=0
+
+pass() {
+  echo "  ✓ $1"
+  PASS=$((PASS + 1))
+}
+
+fail_case() {
+  echo "  ✗ $1"
+  [ -n "${2:-}" ] && echo "    $2"
+  FAIL=$((FAIL + 1))
+}
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+NODE="${NODE:-node}"
+TMP="$(mktemp -d 2>/dev/null || mktemp -d -t qualia-install-smoke)"
+HOME_DIR="$TMP/home"
+PACK_DIR="$TMP/pack"
+CACHE_DIR="$TMP/npm-cache"
+LOGS_DIR="$TMP/npm-logs"
+USERCONFIG="$TMP/npmrc"
+mkdir -p "$HOME_DIR" "$PACK_DIR" "$CACHE_DIR" "$LOGS_DIR"
+: >"$USERCONFIG"
+
+cleanup() {
+  rm -rf "$TMP"
+}
+trap cleanup EXIT
+
+echo "install-smoke.test.sh — packaged Claude + Codex install"
+echo ""
+
+PACK_OUT="$TMP/npm-pack.out"
+PACK_ERR="$TMP/npm-pack.err"
+(cd "$ROOT" && env \
+  NPM_CONFIG_CACHE="$CACHE_DIR" \
+  NPM_CONFIG_LOGS_DIR="$LOGS_DIR" \
+  NPM_CONFIG_USERCONFIG="$USERCONFIG" \
+  npm pack --silent --pack-destination "$PACK_DIR" >"$PACK_OUT" 2>"$PACK_ERR")
+PACK_EXIT=$?
+TARBALL=$(tail -1 "$PACK_OUT" 2>/dev/null | tr -d '[:space:]')
+TARBALL_PATH="$PACK_DIR/$TARBALL"
+
+if [ -f "$TARBALL_PATH" ]; then
+  pass "npm pack produced $TARBALL"
+else
+  fail_case "npm pack tarball missing" "exit=$PACK_EXIT expected=$TARBALL_PATH stderr=$(cat "$PACK_ERR" 2>/dev/null)"
+  echo ""
+  echo "Results: $PASS passed, $FAIL failed"
+  exit 1
+fi
+
+tar -xzf "$TARBALL_PATH" -C "$TMP" 2>"$TMP/tar.err"
+if [ -f "$TMP/package/bin/install.js" ] \
+  && [ -f "$TMP/package/bin/report-payload.js" ] \
+  && [ -f "$TMP/package/bin/project-snapshot.js" ] \
+  && [ -f "$TMP/package/AGENTS.md" ] \
+  && [ -f "$TMP/package/CLAUDE.md" ]; then
+  pass "tarball contains installer + Claude/Codex instruction roots"
+else
+  fail_case "tarball missing install surfaces" "$(cat "$TMP/tar.err" 2>/dev/null)"
+fi
+
+printf 'QS-FAWZI-01\n3\n' | HOME="$HOME_DIR" "$NODE" "$TMP/package/bin/install.js" >"$TMP/install.log" 2>&1
+EXIT=$?
+if [ "$EXIT" -eq 0 ]; then
+  pass "packaged installer exits 0 for target=Both"
+else
+  fail_case "packaged installer failed" "exit=$EXIT log=$(tail -20 "$TMP/install.log" 2>/dev/null)"
+fi
+
+if [ -f "$HOME_DIR/.claude/CLAUDE.md" ] \
+  && grep -q "Role: OWNER" "$HOME_DIR/.claude/CLAUDE.md" \
+  && ! grep -q "{{ROLE}}" "$HOME_DIR/.claude/CLAUDE.md"; then
+  pass "Claude CLAUDE.md installed with OWNER role"
+else
+  fail_case "Claude CLAUDE.md role substitution failed"
+fi
+
+if [ -f "$HOME_DIR/.codex/AGENTS.md" ] \
+  && [ -f "$HOME_DIR/.codex/hooks.json" ] \
+  && [ -f "$HOME_DIR/.codex/config.toml" ] \
+  && [ -f "$HOME_DIR/.codex/bin/statusline.js" ] \
+  && [ -f "$HOME_DIR/.codex/bin/project-snapshot.js" ] \
+  && [ -f "$HOME_DIR/.codex/agents/planner.toml" ] \
+  && [ -f "$HOME_DIR/.codex/skills/qualia-new/SKILL.md" ] \
+  && [ -f "$HOME_DIR/.codex/qualia-references/questioning.md" ] \
+  && grep -q "Role: OWNER" "$HOME_DIR/.codex/AGENTS.md" \
+  && ! grep -q "{{ROLE}}" "$HOME_DIR/.codex/AGENTS.md" \
+  && grep -q "Qualia deploy gate" "$HOME_DIR/.codex/hooks.json" \
+  && ! grep -R "\.claude/bin" "$HOME_DIR/.codex/skills" >/dev/null 2>&1; then
+  pass "Codex runtime installed with OWNER role"
+else
+  fail_case "Codex runtime install failed"
+fi
+
+if [ -d "$HOME_DIR/.claude/hooks" ] \
+  && [ "$(find "$HOME_DIR/.claude/hooks" -maxdepth 1 -name '*.js' | wc -l | tr -d ' ')" = "11" ] \
+  && [ ! -f "$HOME_DIR/.claude/hooks/pre-compact.js" ]; then
+  pass "packaged install has 11 hooks and no pre-compact"
+else
+  fail_case "packaged hook set mismatch"
+fi
+
+if [ -f "$HOME_DIR/.claude/bin/report-payload.js" ] \
+  && [ -f "$HOME_DIR/.claude/bin/project-snapshot.js" ] \
+  && grep -q "report-payload.js" "$HOME_DIR/.claude/skills/qualia-report/SKILL.md"; then
+  pass "packaged install includes ERP report/snapshot helpers"
+else
+  fail_case "packaged install missing ERP report/snapshot helpers"
+fi
+
+PKG_VERSION=$("$NODE" -e "console.log(require(process.argv[1]).version)" "$TMP/package/package.json")
+CONFIG_VERSION=$("$NODE" -e "console.log(require(process.argv[1]).version)" "$HOME_DIR/.claude/.qualia-config.json" 2>/dev/null || echo "")
+if [ "$PKG_VERSION" = "$CONFIG_VERSION" ]; then
+  pass "installed config version matches package ($PKG_VERSION)"
+else
+  fail_case "installed config version mismatch" "package=$PKG_VERSION config=$CONFIG_VERSION"
+fi
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi
+
+exit 0

package/tests/published-install-smoke.test.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# published-install-smoke.test.sh — release-only smoke for the public npm path.
+# This intentionally is not part of npm test: it should fail until the current
+# package.json version has been published to the npm latest dist-tag.
+
+set -u
+
+PASS=0
+FAIL=0
+
+pass() {
+  echo "  ✓ $1"
+  PASS=$((PASS + 1))
+}
+
+fail_case() {
+  echo "  ✗ $1"
+  [ -n "${2:-}" ] && echo "    $2"
+  FAIL=$((FAIL + 1))
+}
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+NODE="${NODE:-node}"
+TMP="$(mktemp -d 2>/dev/null || mktemp -d -t qualia-published-install-smoke)"
+HOME_DIR="$TMP/home"
+CACHE_DIR="$TMP/npm-cache"
+LOGS_DIR="$TMP/npm-logs"
+USERCONFIG="$TMP/npmrc"
+mkdir -p "$HOME_DIR" "$CACHE_DIR" "$LOGS_DIR"
+: >"$USERCONFIG"
+REGISTRY_TIMEOUT_SECONDS="${REGISTRY_TIMEOUT_SECONDS:-45}"
+INSTALL_TIMEOUT_SECONDS="${INSTALL_TIMEOUT_SECONDS:-120}"
+
+cleanup() {
+  rm -rf "$TMP"
+}
+trap cleanup EXIT
+
+echo "published-install-smoke.test.sh — npm @latest Claude + Codex install"
+echo ""
+
+LOCAL_VERSION=$("$NODE" -e "console.log(require(process.argv[1]).version)" "$ROOT/package.json")
+timeout "$REGISTRY_TIMEOUT_SECONDS" env \
+  NPM_CONFIG_CACHE="$CACHE_DIR" \
+  NPM_CONFIG_LOGS_DIR="$LOGS_DIR" \
+  NPM_CONFIG_USERCONFIG="$USERCONFIG" \
+  npm view qualia-framework version >"$TMP/npm-view.out" 2>"$TMP/npm-view.err"
+VIEW_EXIT=$?
+LATEST_VERSION=$(tail -1 "$TMP/npm-view.out" 2>/dev/null | tr -d '[:space:]')
+
+if [ "$VIEW_EXIT" -eq 124 ]; then
+  fail_case "npm view timed out" "after=${REGISTRY_TIMEOUT_SECONDS}s"
+  echo ""
+  echo "Results: $PASS passed, $FAIL failed"
+  exit 1
+elif [ "$VIEW_EXIT" -ne 0 ]; then
+  fail_case "npm view failed" "exit=$VIEW_EXIT err=$(cat "$TMP/npm-view.err" 2>/dev/null)"
+  echo ""
+  echo "Results: $PASS passed, $FAIL failed"
+  exit 1
+fi
+
+if [ "$LATEST_VERSION" = "$LOCAL_VERSION" ]; then
+  pass "npm latest matches package.json ($LOCAL_VERSION)"
+else
+  fail_case "npm latest does not match package.json" "package.json=$LOCAL_VERSION npm_latest=${LATEST_VERSION:-unavailable} npm_err=$(cat "$TMP/npm-view.err" 2>/dev/null)"
+  echo ""
+  echo "Results: $PASS passed, $FAIL failed"
+  exit 1
+fi
+
+printf 'QS-FAWZI-01\n3\n' >"$TMP/install.input"
+timeout "$INSTALL_TIMEOUT_SECONDS" env \
+  HOME="$HOME_DIR" \
+  NPM_CONFIG_CACHE="$CACHE_DIR" \
+  NPM_CONFIG_LOGS_DIR="$LOGS_DIR" \
+  NPM_CONFIG_USERCONFIG="$USERCONFIG" \
+  npx --yes qualia-framework@latest install <"$TMP/install.input" >"$TMP/install.log" 2>&1
+EXIT=$?
+if [ "$EXIT" -eq 0 ]; then
+  pass "npx qualia-framework@latest install exits 0 for target=Both"
+elif [ "$EXIT" -eq 124 ]; then
+  fail_case "npx qualia-framework@latest install timed out" "after=${INSTALL_TIMEOUT_SECONDS}s log=$(tail -30 "$TMP/install.log" 2>/dev/null)"
+else
+  fail_case "npx qualia-framework@latest install failed" "exit=$EXIT log=$(tail -30 "$TMP/install.log" 2>/dev/null)"
+fi
+
+if [ -f "$HOME_DIR/.claude/CLAUDE.md" ] \
+  && grep -q "Role: OWNER" "$HOME_DIR/.claude/CLAUDE.md" \
+  && ! grep -q "{{ROLE}}" "$HOME_DIR/.claude/CLAUDE.md"; then
+  pass "public install writes Claude CLAUDE.md with OWNER role"
+else
+  fail_case "public install Claude CLAUDE.md role substitution failed"
+fi
+
+if [ -f "$HOME_DIR/.codex/AGENTS.md" ] \
+  && grep -q "Role: OWNER" "$HOME_DIR/.codex/AGENTS.md" \
+  && ! grep -q "{{ROLE}}" "$HOME_DIR/.codex/AGENTS.md"; then
+  pass "public install writes Codex AGENTS.md with OWNER role"
+else
+  fail_case "public install Codex AGENTS.md role substitution failed"
+fi
+
+if [ -d "$HOME_DIR/.claude/hooks" ] \
+  && [ "$(find "$HOME_DIR/.claude/hooks" -maxdepth 1 -name '*.js' | wc -l | tr -d ' ')" = "11" ] \
+  && [ ! -f "$HOME_DIR/.claude/hooks/pre-compact.js" ]; then
+  pass "public install has 11 hooks and no pre-compact"
+else
+  fail_case "public install hook set mismatch"
+fi
+
+CONFIG_VERSION=$("$NODE" -e "console.log(require(process.argv[1]).version)" "$HOME_DIR/.claude/.qualia-config.json" 2>/dev/null || echo "")
+if [ "$LOCAL_VERSION" = "$CONFIG_VERSION" ]; then
+  pass "public install config version matches package ($LOCAL_VERSION)"
+else
+  fail_case "public install config version mismatch" "package=$LOCAL_VERSION config=$CONFIG_VERSION"
+fi
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi
+
+exit 0

package/tests/refs.test.sh

@@ -21,6 +21,7 @@
 
 FRAMEWORK_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 SKILLS_DIR="$FRAMEWORK_ROOT/skills"
+NODE="${NODE:-node}"
 
 PASS=0
 FAIL=0
@@ -42,7 +43,7 @@ EXCLUDE_REGEX='/docs/reviews/|/docs/research/|/docs/playwright-loop-pilot-result
 # When a `/qualia-foo` ref appears AFTER one of these context tokens on the same line,
 # it's a migration-explainer ("Replaces /qualia-quick" / "deprecated in v5.7"), not
 # a live command reference. Treat it as exempt.
-MIGRATION_CONTEXT_REGEX='Replaces|Removed|removed in|consolidated|deprecated|renamed|former|previously|was the|now the|now\s+`?/qualia|absorbed|superseded|legacy|migrated|after\s+`?/qualia.*-(quick|task|prd|design|polish-loop)'
+MIGRATION_CONTEXT_REGEX='Replaces|Removed|removed in|consolidated|deprecated|renamed|former|previously|was the|now the|now\s+`?/qualia|absorbed|superseded|legacy|migrated|dead|after\s+`?/qualia.*-(quick|task|prd|design|polish-loop)'
 
 ACTIVE_DIRS=(
   "$FRAMEWORK_ROOT/rules"
@@ -130,6 +131,47 @@ for ref in $(printf '%s\n' "${!SEEN_REFS[@]}" | sort); do
   fail_case "$ref" "no skills/$name/SKILL.md — referenced by: $locations"
 done
 
+PACKAGE_VERSION="$("$NODE" -e 'console.log(require(process.argv[1]).version)' "$FRAMEWORK_ROOT/package.json" 2>/dev/null || echo "")"
+if [ -n "$PACKAGE_VERSION" ] && grep -q "# Qualia Framework v$PACKAGE_VERSION" "$FRAMEWORK_ROOT/README.md"; then
+  pass "README title matches package.json version ($PACKAGE_VERSION)"
+else
+  fail_case "README version drift" "README.md title must match package.json version $PACKAGE_VERSION"
+fi
+
+forbidden_surface_patterns=(
+  'ERP reads.*tracking\.json'
+  'tracking\.json.*ERP reads'
+  'reads it via git'
+  'reads it automatically'
+  'passive monitoring'
+  'Pre-compact.*Saves state'
+  'Stamps tracking\.json via a bot commit'
+  'Surface stays at 32 skills'
+  'Same 32 skills'
+  'orchestrator treats.*silent PASS'
+  'skip silently and note'
+  '"client_id": "acme"'
+  '"workspace_id": "qualia-solutions"'
+)
+
+for pattern in "${forbidden_surface_patterns[@]}"; do
+  hits=""
+  while IFS= read -r file; do
+    [ -z "$file" ] && continue
+    found=$(grep -nE "$pattern" "$file" 2>/dev/null || true)
+    if [ -n "$found" ]; then
+      rel="${file#$FRAMEWORK_ROOT/}"
+      hits="${hits}${hits:+; }${rel}: $(echo "$found" | head -1)"
+    fi
+  done <<<"$SCAN_FILES"
+
+  if [ -n "$hits" ]; then
+    fail_case "forbidden stale surface pattern: $pattern" "$hits"
+  else
+    pass "no stale surface pattern: $pattern"
+  fi
+done
+
 echo ""
 echo "Results: $PASS passed, $FAIL failed"
 

package/tests/run-all.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# tests/run-all.sh — fail-collect test orchestrator.
+# Runs every suite even if earlier ones fail, then reports which suites failed.
+# Exits non-zero if any suite failed.
+
+set -u
+
+DIR="$(cd "$(dirname "$0")" && pwd)"
+
+SUITES=(
+  "statusline"
+  "state"
+  "hooks"
+  "bin"
+  "lib"
+  "skills"
+  "refs"
+  "install-smoke"
+  "slop-detect"
+)
+
+FAILED=()
+
+for suite in "${SUITES[@]}"; do
+  file="$DIR/$suite.test.sh"
+  if [ ! -f "$file" ]; then
+    echo "MISSING: $file"
+    FAILED+=("$suite (missing file)")
+    continue
+  fi
+  if bash "$file"; then
+    :
+  else
+    FAILED+=("$suite")
+  fi
+done
+
+echo ""
+echo "===================================================="
+if [ ${#FAILED[@]} -eq 0 ]; then
+  echo "All ${#SUITES[@]} suites passed."
+  exit 0
+else
+  echo "${#FAILED[@]} of ${#SUITES[@]} suites FAILED:"
+  for s in "${FAILED[@]}"; do
+    echo "  - $s"
+  done
+  exit 1
+fi

package/tests/runner.js

@@ -147,6 +147,7 @@ describe("CLI", () => {
       assert.match(clean, /analytics/);
       assert.match(clean, /set-erp-key/);
       assert.match(clean, /erp-ping/);
+      assert.match(clean, /project-snapshot/);
       assert.match(clean, /doctor/);
       assert.match(clean, /flush/);
     } finally {
@@ -987,6 +988,9 @@ waves: 1
       // New v3.6 fields (default to empty / 0, but must be present)
       assert.ok("team_id" in t, "team_id missing");
       assert.ok("project_id" in t, "project_id missing");
+      assert.ok("erp_project_id" in t, "erp_project_id missing");
+      assert.ok("client_id" in t, "client_id missing");
+      assert.ok("workspace_id" in t, "workspace_id missing");
       assert.ok("git_remote" in t, "git_remote missing");
       assert.ok("session_started_at" in t, "session_started_at missing");
       assert.ok("last_pushed_at" in t, "last_pushed_at missing");
@@ -1507,25 +1511,18 @@ describe("Hooks", () => {
 
   // v3.4.2: behavioral test — the stamp must actually mutate tracking.json
   // AND create a real commit so the push includes it.
-  //
-  // v4.1.1 NOTE: skipped on Windows. The stamp-commit interacts with git's
-  // autocrlf in ways that are not fully reproducible without a live Windows
-  // box — pre-push.js now passes `-c core.autocrlf=false` on its own git
-  // commands (defensive), but the test's seed-commit path still hits an
-  // edge case on Windows that needs platform-specific investigation. This
-  // is tracked as a v4.1.2 follow-up; the Linux+macOS paths (which are the
-  // overwhelming majority of installs) are fully covered here.
-  it("pre-push.js mutates tracking.json AND commits the stamp", { skip: process.platform === "win32" ? "pre-existing autocrlf edge case — investigate in v4.1.2" : false }, () => {
+  // v6.2.0: pre-push.js no longer commits — it stamps tracking.json locally
+  // only. Test asserts the inverse of the pre-v6.2 behavior: file is mutated,
+  // HEAD is unchanged, file shows as modified in the working tree.
+  it("pre-push.js stamps tracking.json locally without creating a commit", () => {
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-push-real-"));
     try {
-      // Init a real git repo
       const gitOpts = { cwd: tmpDir, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] };
       spawnSync("git", ["init", "--initial-branch=main"], gitOpts);
       spawnSync("git", ["config", "user.email", "test@example.com"], gitOpts);
       spawnSync("git", ["config", "user.name", "Test"], gitOpts);
       spawnSync("git", ["config", "commit.gpgsign", "false"], gitOpts);
 
-      // Seed .planning/tracking.json + an initial commit
       fs.mkdirSync(path.join(tmpDir, ".planning"));
       const tFile = path.join(tmpDir, ".planning", "tracking.json");
       fs.writeFileSync(tFile, JSON.stringify({
@@ -1536,25 +1533,25 @@ describe("Hooks", () => {
 
       const headBefore = spawnSync("git", ["rev-parse", "HEAD"], gitOpts).stdout.trim();
 
-      // Run the hook
       const r = spawnSync(NODE, [path.join(HOOKS, "pre-push.js")], {
         encoding: "utf8", cwd: tmpDir, timeout: 10000, stdio: ["pipe", "pipe", "pipe"],
       });
       assert.equal(r.status, 0, `pre-push exited ${r.status}: ${r.stderr}`);
 
-      // tracking.json must have been mutated
+      // tracking.json must have been mutated on disk
       const t = JSON.parse(fs.readFileSync(tFile, "utf8"));
       assert.notEqual(t.last_commit, "OLD", "last_commit should have been updated");
       assert.notEqual(t.last_updated, "2020-01-01T00:00:00Z", "last_updated should have been updated");
       assert.match(t.last_updated, /^\d{4}-\d{2}-\d{2}T/);
+      assert.match(t.last_pushed_at, /^\d{4}-\d{2}-\d{2}T/, "last_pushed_at must be set");
 
-      // A NEW commit must exist (this is the smoking-gun fix from v3.4.2)
+      // HEAD must NOT advance — v6.2.0 contract: no bot commit
       const headAfter = spawnSync("git", ["rev-parse", "HEAD"], gitOpts).stdout.trim();
-      assert.notEqual(headAfter, headBefore, "pre-push must commit the stamp so it ships with the push");
+      assert.equal(headAfter, headBefore, "pre-push must NOT create a commit (v6.2.0)");
 
-      // The new commit must be authored by the bot, not the user
-      const author = spawnSync("git", ["log", "-1", "--format=%an <%ae>"], gitOpts).stdout.trim();
-      assert.match(author, /Qualia Framework/);
+      // The file should appear as modified-not-staged in the working tree
+      const status = spawnSync("git", ["status", "--porcelain", "--", ".planning/tracking.json"], gitOpts).stdout;
+      assert.match(status, /^ M /, "tracking.json should be unstaged modified");
     } finally {
       fs.rmSync(tmpDir, { recursive: true, force: true });
     }
@@ -1601,19 +1598,7 @@ describe("Hooks", () => {
     }
   });
 
-  // --- pre-compact.js ---
-
-  it("pre-compact.js exits 0 with no STATE.md", () => {
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-pc-"));
-    try {
-      const r = spawnSync(NODE, [path.join(HOOKS, "pre-compact.js")], {
-        encoding: "utf8", cwd: tmpDir, timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
-      });
-      assert.equal(r.status, 0);
-    } finally {
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-  });
+  // pre-compact.js removed in v6.2.0 — state.js journal provides crash safety.
 
   // --- auto-update.js ---
 
@@ -2593,12 +2578,13 @@ describe("install.js", () => {
     }
   });
 
-  it("9 hooks installed (block-env-edit removed in v3.2.0; git-guardrails + stop-session-log added in v4.2.0)", () => {
+  it("11 hooks installed (v6.2.0: pre-compact removed; v5.0: vercel-account-guard, env-empty-guard, supabase-destructive-guard added)", () => {
     const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-install-"));
     try {
       runInstall("QS-FAWZI-01", tmpHome);
       const hooks = fs.readdirSync(path.join(tmpHome, ".claude", "hooks")).filter(f => f.endsWith(".js"));
-      assert.equal(hooks.length, 9);
+      assert.equal(hooks.length, 11, `expected 11 hooks, got ${hooks.length}: ${hooks.join(", ")}`);
+      assert.ok(!hooks.includes("pre-compact.js"), "pre-compact.js must NOT be installed (removed in v6.2.0)");
     } finally {
       fs.rmSync(tmpHome, { recursive: true, force: true });
     }

package/tests/slop-detect.test.sh

@@ -86,11 +86,13 @@ export default function Page() {
   return <p>Welcome — to our amazing platform</p>;
 }
 EOF
-OUT=$($NODE "$SLOP_DETECT" "$TMP2/emdash.tsx" 2>&1 || true)
-if echo "$OUT" | grep -qiE "em.?dash|—"; then
+EXIT_CODE=0
+OUT=$($NODE "$SLOP_DETECT" "$TMP2/emdash.tsx" 2>&1) || EXIT_CODE=$?
+# Em-dash is HIGH (non-blocking) so exit MUST be 0; finding MUST be in output.
+if [ "$EXIT_CODE" = "0" ] && echo "$OUT" | grep -qiE "em.?dash|—"; then
   pass "reports em-dash finding (HIGH severity, non-blocking)"
 else
-  fail_case "em-dash detection" "no em-dash mention in output: $(echo "$OUT" | head -c 120)"
+  fail_case "em-dash detection" "exit=$EXIT_CODE, output: $(echo "$OUT" | head -c 120)"
 fi
 
 # ── Banned-font detection ─────────────────────────────────────────────
@@ -138,8 +140,12 @@ fi
 # ── --json flag produces JSON output ─────────────────────────────────
 TMP5=$(mktmp)
 cp "$TMP3/font.css" "$TMP5/font.css"
-JSON_OUT=$($NODE "$SLOP_DETECT" --json "$TMP5/font.css" 2>/dev/null || true)
-if echo "$JSON_OUT" | head -1 | grep -qE "^[\{\[]"; then
+# --json may exit 1 (banned font is CRITICAL); we only assert output shape.
+EXIT_CODE=0
+JSON_OUT=$($NODE "$SLOP_DETECT" --json "$TMP5/font.css" 2>/dev/null) || EXIT_CODE=$?
+if [ "$EXIT_CODE" != "0" ] && [ "$EXIT_CODE" != "1" ]; then
+  fail_case "--json output" "unexpected exit=$EXIT_CODE (only 0/1 acceptable for CRITICAL)"
+elif echo "$JSON_OUT" | head -1 | grep -qE "^[\{\[]"; then
   pass "--json flag produces JSON-shaped output"
 else
   fail_case "--json output" "first line is not JSON-shaped: '$(echo "$JSON_OUT" | head -c 80)'"

package/tests/state.test.sh

@@ -109,7 +109,10 @@ fi
 if grep -q '"project": "TestProject"' "$TMP/.planning/tracking.json" \
    && grep -q '"total_phases": 2' "$TMP/.planning/tracking.json" \
    && grep -q '"phase": 1' "$TMP/.planning/tracking.json" \
-   && grep -q '"status": "setup"' "$TMP/.planning/tracking.json"; then
+   && grep -q '"status": "setup"' "$TMP/.planning/tracking.json" \
+   && grep -q '"erp_project_id": ""' "$TMP/.planning/tracking.json" \
+   && grep -q '"client_id": ""' "$TMP/.planning/tracking.json" \
+   && grep -q '"workspace_id": ""' "$TMP/.planning/tracking.json"; then
   pass "cmdInit tracking.json has correct fields"
 else
   fail_case "cmdInit tracking.json fields"

package/hooks/pre-compact.js

@@ -1,125 +0,0 @@
-#!/usr/bin/env node
-// ~/.claude/hooks/pre-compact.js — commit STATE.md before context compaction.
-// PreCompact hook. Silent on failure — context compaction must never be blocked.
-// Cross-platform (Windows/macOS/Linux).
-//
-// BY DEFAULT this commit uses --no-verify + --no-gpg-sign. The auto-save is a
-// framework bot commit, and pre-commit hooks that run full test suites would
-// routinely fail (context compaction happens at any moment) and lose the
-// STATE.md snapshot. But compliance-sensitive projects can opt into strict
-// mode via ~/.claude/.qualia-config.json:
-//
-//   {
-//     "pre_compact": {
-//       "respect_user_hooks": true,
-//       "respect_gpg_signing": true
-//     }
-//   }
-//
-// When either is true, the corresponding --no-* flag is dropped.
-
-const fs = require("fs");
-const path = require("path");
-const os = require("os");
-const { spawnSync } = require("child_process");
-
-const _traceStart = Date.now();
-
-const STATE_FILE = path.join(".planning", "STATE.md");
-const TRACKING_FILE = path.join(".planning", "tracking.json");
-const PLANNING_FILES = [STATE_FILE, TRACKING_FILE];
-const CONFIG_FILE = path.join(os.homedir(), ".claude", ".qualia-config.json");
-
-function readCompactConfig() {
-  try {
-    const cfg = JSON.parse(fs.readFileSync(CONFIG_FILE, "utf8"));
-    return cfg.pre_compact || {};
-  } catch {
-    return {};
-  }
-}
-
-function git(args, opts = {}) {
-  return spawnSync("git", args, {
-    encoding: "utf8",
-    timeout: 3000,
-    shell: process.platform === "win32",
-    ...opts,
-  });
-}
-
-function planningHasPendingChanges() {
-  // v5.0: also stage tracking.json. The CLAUDE.md compaction contract says to
-  // preserve tracking.json across compactions, but pre-v5 only committed
-  // STATE.md — tracking.json mutations from state.js transitions were lost
-  // across compactions, leaving the ERP with stale milestone/phase/tasks data.
-  const diff = git(["diff", "--name-only", "--", ...PLANNING_FILES]);
-  const diffLines = (diff.stdout || "").split(/\r?\n/);
-  if (PLANNING_FILES.some((f) => diffLines.includes(f))) return true;
-
-  const untracked = git(["ls-files", "--others", "--exclude-standard", "--", ...PLANNING_FILES]);
-  const untrackedLines = (untracked.stdout || "").split(/\r?\n/);
-  return PLANNING_FILES.some((f) => untrackedLines.includes(f));
-}
-
-let _commitStatus = null;
-let _commitReason = "no-state-file";
-let _commitFlags = null;
-
-try {
-  if (fs.existsSync(STATE_FILE)) {
-    console.log("QUALIA: Saving state before compaction...");
-    _commitReason = "state-clean";
-    // Check if STATE.md or tracking.json has tracked or untracked changes.
-    if (planningHasPendingChanges()) {
-      // Stage both planning files. `git add` silently no-ops on files that don't exist
-      // or have no changes, so passing both is safe even when only one is dirty.
-      const addRes = git(["add", ...PLANNING_FILES]);
-      const cfg = readCompactConfig();
-      const commitArgs = ["commit"];
-      if (!cfg.respect_user_hooks) commitArgs.push("--no-verify");
-      if (!cfg.respect_gpg_signing) commitArgs.push("--no-gpg-sign");
-      commitArgs.push("--author=Qualia Framework <bot@qualia.solutions>");
-      commitArgs.push("-m", "state: pre-compaction save (STATE.md + tracking.json)");
-      _commitFlags = {
-        no_verify: !cfg.respect_user_hooks,
-        no_gpg_sign: !cfg.respect_gpg_signing,
-      };
-      const commitRes = spawnSync("git", commitArgs, {
-        timeout: 5000,
-        stdio: ["ignore", "ignore", "pipe"],
-        encoding: "utf8",
-        shell: process.platform === "win32",
-      });
-      _commitStatus = commitRes.status;
-      _commitReason = addRes.status === 0 && commitRes.status === 0
-        ? "committed"
-        : "commit-failed";
-    } else {
-      _commitReason = "state-clean";
-    }
-  }
-} catch {
-  // Silent — never block compaction
-  _commitReason = "exception";
-}
-
-function _trace(hookName, result, extra) {
-  try {
-    const os = require("os");
-    const traceDir = path.join(os.homedir(), ".claude", ".qualia-traces");
-    if (!fs.existsSync(traceDir)) fs.mkdirSync(traceDir, { recursive: true });
-    const entry = {
-      hook: hookName,
-      result,
-      timestamp: new Date().toISOString(),
-      duration_ms: Date.now() - _traceStart,
-      ...extra,
-    };
-    const file = path.join(traceDir, `${new Date().toISOString().split("T")[0]}.jsonl`);
-    fs.appendFileSync(file, JSON.stringify(entry) + "\n");
-  } catch {}
-}
-
-_trace("pre-compact", "allow", { commit_status: _commitStatus, commit_reason: _commitReason, commit_flags: _commitFlags });
-process.exit(0);