qualia-framework 6.9.2 → 6.22.0

package/tests/hooks.test.sh

@@ -96,29 +96,78 @@ TMP=$(setup_guard_repo main OWNER)
 assert_exit "OWNER on main → allowed" 0 $?
 rm -rf "$TMP"
 
-# EMPLOYEE on main → blocked (exit 2)
+# EMPLOYEE on main → ALLOWED + counted + notice (v6.10 policy: accountability, not block)
 TMP=$(setup_guard_repo main EMPLOYEE)
 OUT=$(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" 2>&1)
 RC=$?
-if [ "$RC" -eq 2 ] && echo "$OUT" | grep -q "BLOCKED" && echo "$OUT" | grep -q "main"; then
-  echo "  ✓ EMPLOYEE on main → blocked (BLOCKED in stdout)"
+if [ "$RC" -eq 0 ] \
+   && echo "$OUT" | grep -q "NOTICE" \
+   && grep -q "employee_main_push" "$TMP/.claude/.main-push-events.json" 2>/dev/null \
+   && grep -q '"total": 1' "$TMP/.claude/.main-push-events.json" 2>/dev/null; then
+  echo "  ✓ EMPLOYEE on main → allowed + recorded + notice"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ EMPLOYEE on main → allowed+recorded (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# EMPLOYEE repeated main push → per-employee count increments (framework counts)
+TMP=$(setup_guard_repo main EMPLOYEE)
+(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
+(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
+if grep -q '"total": 2' "$TMP/.claude/.main-push-events.json" 2>/dev/null; then
+  echo "  ✓ EMPLOYEE repeated main push → count increments to 2"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ EMPLOYEE repeated main push → count increments"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# EMPLOYEE refspec push to main from a feature branch → recorded
+TMP=$(setup_guard_repo feature/xyz EMPLOYEE)
+OUT=$(cd "$TMP/proj" && printf '%s' '{"tool_input":{"command":"git push origin feature/xyz:main"}}' | HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] && grep -q "employee_main_push" "$TMP/.claude/.main-push-events.json" 2>/dev/null; then
+  echo "  ✓ EMPLOYEE refspec push to :main → allowed + recorded"
   PASS=$((PASS + 1))
 else
-  echo "  ✗ EMPLOYEE on main → blocked (exit=$RC)"
+  echo "  ✗ EMPLOYEE refspec push to :main → recorded (exit=$RC)"
   FAIL=$((FAIL + 1))
 fi
 rm -rf "$TMP"
 
-# EMPLOYEE on master → blocked
+# EMPLOYEE on master → allowed + recorded
 TMP=$(setup_guard_repo master EMPLOYEE)
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "EMPLOYEE on master → blocked" 2 $?
+assert_exit "EMPLOYEE on master → allowed (recorded)" 0 $?
 rm -rf "$TMP"
 
-# EMPLOYEE on feature branch → allowed
+# EMPLOYEE on feature branch → allowed, NOT recorded
 TMP=$(setup_guard_repo feature/xyz EMPLOYEE)
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "EMPLOYEE on feature/xyz → allowed" 0 $?
+RC=$?
+if [ "$RC" -eq 0 ] && [ ! -f "$TMP/.claude/.main-push-events.json" ]; then
+  echo "  ✓ EMPLOYEE on feature/xyz → allowed, not recorded"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ EMPLOYEE on feature/xyz → allowed/not-recorded (exit=$RC)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# OWNER on main → allowed, NOT recorded (OWNER pushes are unremarkable)
+TMP=$(setup_guard_repo main OWNER)
+(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] && [ ! -f "$TMP/.claude/.main-push-events.json" ]; then
+  echo "  ✓ OWNER on main → allowed, not recorded"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ OWNER on main → allowed/not-recorded (exit=$RC)"
+  FAIL=$((FAIL + 1))
+fi
 rm -rf "$TMP"
 
 # OWNER on feature branch → allowed
@@ -127,31 +176,38 @@ TMP=$(setup_guard_repo feature/xyz OWNER)
 assert_exit "OWNER on feature/xyz → allowed" 0 $?
 rm -rf "$TMP"
 
-# Missing config → fails closed (block, exit 2)
+# Missing config → allowed (the hook never blocks now)
 TMP=$(mktemp -d)
 mkdir -p "$TMP/proj"
-(cd "$TMP/proj" && git init -q && git checkout -b feature/x -q 2>/dev/null)
+(cd "$TMP/proj" && git init -q && git checkout -b main -q 2>/dev/null)
 # NO .claude/.qualia-config.json
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "missing config → blocked (fails closed)" 2 $?
+assert_exit "missing config → allowed (never blocks)" 0 $?
 rm -rf "$TMP"
 
-# Malformed config JSON → fails closed
+# Malformed config JSON → allowed
 TMP=$(mktemp -d)
 mkdir -p "$TMP/proj" "$TMP/.claude"
-(cd "$TMP/proj" && git init -q && git checkout -b feature/x -q 2>/dev/null)
+(cd "$TMP/proj" && git init -q && git checkout -b main -q 2>/dev/null)
 echo 'not json{' > "$TMP/.claude/.qualia-config.json"
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "malformed config JSON → blocked" 2 $?
+assert_exit "malformed config JSON → allowed" 0 $?
 rm -rf "$TMP"
 
-# Empty role field → fails closed
+# Empty role field → allowed, not recorded (not a known EMPLOYEE)
 TMP=$(mktemp -d)
 mkdir -p "$TMP/proj" "$TMP/.claude"
-(cd "$TMP/proj" && git init -q && git checkout -b feature/x -q 2>/dev/null)
+(cd "$TMP/proj" && git init -q && git checkout -b main -q 2>/dev/null)
 echo '{"role":""}' > "$TMP/.claude/.qualia-config.json"
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "empty role field → blocked" 2 $?
+RC=$?
+if [ "$RC" -eq 0 ] && [ ! -f "$TMP/.claude/.main-push-events.json" ]; then
+  echo "  ✓ empty role → allowed, not recorded"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ empty role → allowed/not-recorded (exit=$RC)"
+  FAIL=$((FAIL + 1))
+fi
 rm -rf "$TMP"
 
 # --- fawzi-approval-guard.js ---
@@ -382,6 +438,72 @@ RC=$?
 assert_exit "regular page.tsx with service_role → blocked (exit 2)" 2 $RC
 rm -rf "$TMP"
 
+# --- pre-deploy-gate: anti-slop gate (slop-detect.mjs wired into ship) ---
+# Build a tmp QUALIA_HOME carrying bin/slop-detect.mjs so the gate can find it.
+SLOP_SRC="$(cd "$(dirname "$0")/../bin" && pwd)/slop-detect.mjs"
+
+# Purple-blue gradient (CRITICAL design tell) → blocked with anti-slop diagnostic
+TMP=$(mktemp -d)
+QH=$(mktemp -d)
+mkdir -p "$QH/bin" "$TMP/app"
+cp "$SLOP_SRC" "$QH/bin/slop-detect.mjs"
+echo 'export default function P(){return <div className="bg-gradient-to-r from-blue-500 to-purple-600">hi</div>;}' > "$TMP/app/page.tsx"
+OUT=$( (cd "$TMP" && QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/pre-deploy-gate.js") 2>&1 )
+RC=$?
+if [ "$RC" -eq 2 ] && echo "$OUT" | grep -qi "anti-slop"; then
+  echo "  ✓ purple-blue gradient → blocked by anti-slop gate (exit 2)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ purple-blue gradient → anti-slop block (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP" "$QH"
+
+# Clean frontend file → anti-slop passes → exit 0 with "Anti-slop" check shown
+TMP=$(mktemp -d)
+QH=$(mktemp -d)
+mkdir -p "$QH/bin" "$TMP/app"
+cp "$SLOP_SRC" "$QH/bin/slop-detect.mjs"
+echo 'export default function P(){return <div className="bg-stone-50 text-ink">hi</div>;}' > "$TMP/app/page.tsx"
+OUT=$( (cd "$TMP" && QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/pre-deploy-gate.js") 2>&1 )
+RC=$?
+if [ "$RC" -eq 0 ] && echo "$OUT" | grep -q "Anti-slop"; then
+  echo "  ✓ clean frontend → anti-slop passes (exit 0)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ clean frontend → anti-slop passes (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP" "$QH"
+
+# QUALIA_SKIP_SLOP=1 by non-OWNER → blocked (OWNER-only escape)
+TMP=$(mktemp -d)
+QH=$(mktemp -d)
+mkdir -p "$QH/bin" "$TMP/app"
+cp "$SLOP_SRC" "$QH/bin/slop-detect.mjs"
+echo '{"role":"EMPLOYEE"}' > "$QH/.qualia-config.json"
+echo 'export default function P(){return <div className="bg-gradient-to-r from-blue-500 to-purple-600">x</div>;}' > "$TMP/app/page.tsx"
+OUT=$( (cd "$TMP" && QUALIA_SKIP_SLOP=1 QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/pre-deploy-gate.js") 2>&1 )
+RC=$?
+if [ "$RC" -eq 2 ] && echo "$OUT" | grep -q "OWNER-only"; then
+  echo "  ✓ QUALIA_SKIP_SLOP by non-OWNER → blocked (OWNER-only)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ QUALIA_SKIP_SLOP non-OWNER block (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP" "$QH"
+
+# Scanner absent (older install) → gate skips silently → exit 0
+TMP=$(mktemp -d)
+QH=$(mktemp -d)
+mkdir -p "$TMP/app"
+echo 'export default function P(){return <div className="bg-gradient-to-r from-blue-500 to-purple-600">x</div>;}' > "$TMP/app/page.tsx"
+OUT=$( (cd "$TMP" && QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/pre-deploy-gate.js") 2>&1 )
+RC=$?
+assert_exit "anti-slop gate skips when scanner absent (exit 0)" 0 $RC
+rm -rf "$TMP" "$QH"
+
 # --- session-start.js — must exit 0 always ---
 echo ""
 echo "session-start:"
@@ -595,6 +717,85 @@ else
 fi
 rm -rf "$TMP"
 
+# --- task-write-guard.js (R1 — runtime plan-contract file-scope guard) ---
+echo ""
+echo "task-write-guard:"
+
+AS_BIN="$(cd "$(dirname "$0")/../bin" && pwd)/agent-status.js"
+
+# setup_twg_project → tmp dir with a phase-1 contract (T1 declares src/a.ts +
+# src/b.ts) and an active RUNNING status for T1. Prints the dir; caller rm -rf.
+setup_twg_project() {
+  local tmp
+  tmp=$(mktemp -d)
+  mkdir -p "$tmp/.planning"
+  cat > "$tmp/.planning/phase-1-contract.json" <<'EOF'
+{
+  "version": 1,
+  "phase": 1,
+  "tasks": [
+    { "id": "T1", "wave": 1, "files_modify": ["src/a.ts"], "files_create": ["src/b.ts"] }
+  ]
+}
+EOF
+  echo "$tmp"
+}
+twg() { echo "{\"tool_input\":{\"file_path\":\"$2\"}}" | (cd "$1" && $NODE "$HOOKS_DIR/task-write-guard.js" >/dev/null 2>&1); }
+
+# No active build → guard is a no-op even on an undeclared file
+TMP=$(setup_twg_project)
+twg "$TMP" "src/evil.ts"
+assert_exit "no active build → allowed (no-op)" 0 $?
+rm -rf "$TMP"
+
+# Active build (T1 RUNNING) + write to a DECLARED file → allowed
+TMP=$(setup_twg_project)
+$NODE "$AS_BIN" write T1 RUNNING --phase 1 --wave 1 --cwd "$TMP" >/dev/null 2>&1
+twg "$TMP" "src/a.ts"
+assert_exit "active build + declared file → allowed" 0 $?
+
+# Active build + write to an UNDECLARED file → blocked (exit 2)
+OUT=$(echo '{"tool_input":{"file_path":"src/evil.ts"}}' | (cd "$TMP" && $NODE "$HOOKS_DIR/task-write-guard.js" 2>&1))
+RC=$?
+if [ "$RC" -eq 2 ] && echo "$OUT" | grep -q "task-write-guard" && echo "$OUT" | grep -q "evil.ts"; then
+  echo "  ✓ active build + undeclared file → blocked with diagnostic"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ active build + undeclared file → blocked (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+
+# files_create entries count as declared
+twg "$TMP" "src/b.ts"
+assert_exit "active build + declared files_create → allowed" 0 $?
+
+# .planning/ and .agent-status/ paths are always writable during a build
+twg "$TMP" ".planning/phase-1-verification.md"
+assert_exit "active build + .planning path → allowed" 0 $?
+twg "$TMP" ".agent-status/T1.json"
+assert_exit "active build + .agent-status path → allowed" 0 $?
+
+# OWNER escape hatch overrides the block
+echo '{"tool_input":{"file_path":"src/evil.ts"}}' | (cd "$TMP" && QUALIA_ALLOW_OUTSIDE_CONTRACT=1 $NODE "$HOOKS_DIR/task-write-guard.js" >/dev/null 2>&1)
+assert_exit "QUALIA_ALLOW_OUTSIDE_CONTRACT=1 → allowed despite undeclared" 0 $?
+
+# Absolute path to an undeclared file still blocks
+echo "{\"tool_input\":{\"file_path\":\"$TMP/src/evil.ts\"}}" | (cd "$TMP" && $NODE "$HOOKS_DIR/task-write-guard.js" >/dev/null 2>&1)
+assert_exit "active build + absolute undeclared path → blocked" 2 $?
+
+# Once T1 flips to DONE (no RUNNING), the guard goes quiet again
+$NODE "$AS_BIN" write T1 DONE --commit abc --cwd "$TMP" >/dev/null 2>&1
+twg "$TMP" "src/evil.ts"
+assert_exit "build finished (no RUNNING) → allowed" 0 $?
+rm -rf "$TMP"
+
+# Active build but no contract present → fail open (allowed)
+TMP=$(mktemp -d)
+$NODE "$AS_BIN" write T1 RUNNING --phase 1 --cwd "$TMP" >/dev/null 2>&1
+twg "$TMP" "src/anything.ts"
+assert_exit "active build + no contract → allowed (fail open)" 0 $?
+rm -rf "$TMP"
+
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/install-smoke.test.sh

@@ -124,11 +124,12 @@ else
 fi
 
 if [ -d "$HOME_DIR/.claude/hooks" ] \
-  && [ "$(find "$HOME_DIR/.claude/hooks" -maxdepth 1 -name '*.js' | wc -l | tr -d ' ')" = "14" ] \
+  && [ "$(find "$HOME_DIR/.claude/hooks" -maxdepth 1 -name '*.js' | wc -l | tr -d ' ')" = "15" ] \
   && [ -f "$HOME_DIR/.claude/hooks/fawzi-approval-guard.js" ] \
   && [ -f "$HOME_DIR/.claude/hooks/pre-compact.js" ] \
-  && [ -f "$HOME_DIR/.claude/hooks/usage-capture.js" ]; then
-  pass "packaged install has 14 hooks including usage-capture (v6.9.1 telemetry)"
+  && [ -f "$HOME_DIR/.claude/hooks/usage-capture.js" ] \
+  && [ -f "$HOME_DIR/.claude/hooks/task-write-guard.js" ]; then
+  pass "packaged install has 15 hooks including task-write-guard (v6.13)"
 else
   fail_case "packaged hook set mismatch"
 fi

package/tests/instructions.test.sh

@@ -0,0 +1,109 @@
+#!/bin/bash
+# instructions.test.sh — single-source instruction compile (R4) + host adapter
+# contract (R5). Run: bash tests/instructions.test.sh
+
+PASS=0
+FAIL=0
+FRAMEWORK_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+NODE="${NODE:-node}"
+HA="$FRAMEWORK_DIR/bin/host-adapters.js"
+CI="$FRAMEWORK_DIR/bin/compile-instructions.js"
+
+assert_exit() {
+  local name="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then echo "  ✓ $name"; PASS=$((PASS+1));
+  else echo "  ✗ $name (expected exit $expected, got $actual)"; FAIL=$((FAIL+1)); fi
+}
+assert_eq() {
+  local name="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then echo "  ✓ $name"; PASS=$((PASS+1));
+  else echo "  ✗ $name (expected '$expected', got '$actual')"; FAIL=$((FAIL+1)); fi
+}
+assert_contains() {
+  local name="$1" hay="$2" needle="$3"
+  if echo "$hay" | grep -qF "$needle"; then echo "  ✓ $name"; PASS=$((PASS+1));
+  else echo "  ✗ $name (missing '$needle')"; FAIL=$((FAIL+1)); fi
+}
+refute_contains() {
+  local name="$1" hay="$2" needle="$3"
+  if echo "$hay" | grep -qF "$needle"; then echo "  ✗ $name (found '$needle')"; FAIL=$((FAIL+1));
+  else echo "  ✓ $name"; PASS=$((PASS+1)); fi
+}
+
+echo "instructions.test.sh — single-source compile (R4) + host contract (R5)"
+echo ""
+
+# syntax
+$NODE -c "$HA" 2>/dev/null && { echo "  ✓ host-adapters syntax valid"; PASS=$((PASS+1)); } || { echo "  ✗ host-adapters syntax"; FAIL=$((FAIL+1)); }
+$NODE -c "$CI" 2>/dev/null && { echo "  ✓ compile-instructions syntax valid"; PASS=$((PASS+1)); } || { echo "  ✗ compile-instructions syntax"; FAIL=$((FAIL+1)); }
+
+# --- R4: drift guard — committed files match the canonical ---
+$NODE "$CI" --check >/dev/null 2>&1
+assert_exit "compile-instructions --check passes (no drift)" 0 $?
+
+# A canonical edit not reflected in the artifacts is caught by --check.
+TMPCANON=$(mktemp)
+cp "$FRAMEWORK_DIR/templates/instructions.md" "$TMPCANON"
+printf '\nDRIFT-MARKER\n' >> "$FRAMEWORK_DIR/templates/instructions.md"
+$NODE "$CI" --check >/dev/null 2>&1
+RC=$?
+cp "$TMPCANON" "$FRAMEWORK_DIR/templates/instructions.md"   # restore immediately
+rm -f "$TMPCANON"
+assert_exit "drift guard fails (exit 1) when canonical edited but not recompiled" 1 $RC
+# confirm restore worked
+$NODE "$CI" --check >/dev/null 2>&1
+assert_exit "canonical restored, --check green again" 0 $?
+
+# --- R4: both artifacts share an identical body, differ only in footer ---
+CLAUDE_BODY=$(sed -n '/# Qualia Framework/,/state router tells you the next command/p' "$FRAMEWORK_DIR/CLAUDE.md")
+AGENTS_BODY=$(sed -n '/# Qualia Framework/,/state router tells you the next command/p' "$FRAMEWORK_DIR/AGENTS.md")
+if [ "$CLAUDE_BODY" = "$AGENTS_BODY" ]; then
+  echo "  ✓ CLAUDE.md and AGENTS.md bodies are identical (no drift)"; PASS=$((PASS+1));
+else
+  echo "  ✗ CLAUDE.md and AGENTS.md bodies diverge"; FAIL=$((FAIL+1));
+fi
+# host-specific footer survives
+assert_contains "CLAUDE.md keeps Claude footer" "$(cat "$FRAMEWORK_DIR/CLAUDE.md")" "this file stays under 25 lines"
+assert_contains "AGENTS.md keeps cross-vendor footer" "$(cat "$FRAMEWORK_DIR/AGENTS.md")" "cross-vendor compatibility"
+refute_contains "AGENTS.md does NOT carry the Claude-only footer" "$(cat "$FRAMEWORK_DIR/AGENTS.md")" "this file stays under 25 lines"
+# both carry the generated header + role placeholder for install to fill
+assert_contains "CLAUDE.md has generated header" "$(head -1 "$FRAMEWORK_DIR/CLAUDE.md")" "GENERATED from templates/instructions.md"
+assert_contains "AGENTS.md keeps {{ROLE}} for install" "$(cat "$FRAMEWORK_DIR/AGENTS.md")" "{{ROLE}}"
+
+# --- R5: adapter contract is the single source of per-host facts ---
+assert_eq "claude instructionFile" "CLAUDE.md" "$($NODE -e "console.log(require('$HA').adapter('claude').instructionFile)")"
+assert_eq "codex instructionFile" "AGENTS.md" "$($NODE -e "console.log(require('$HA').adapter('codex').instructionFile)")"
+assert_eq "claude configFile" "settings.json" "$($NODE -e "console.log(require('$HA').adapter('claude').configFile)")"
+assert_eq "codex configFile" "config.toml" "$($NODE -e "console.log(require('$HA').adapter('codex').configFile)")"
+assert_eq "codex agentExt" ".toml" "$($NODE -e "console.log(require('$HA').adapter('codex').agentExt)")"
+assert_eq "unknown host throws" "throws" "$($NODE -e "try{require('$HA').adapter('cursor');console.log('no')}catch(e){console.log('throws')}")"
+
+# --- R5: stripHostBlocks keeps only the matching host's block ---
+SRC='before
+<!--QUALIA-HOST claude-->
+CLAUDE_ONLY
+<!--/QUALIA-HOST-->
+<!--QUALIA-HOST codex-->
+CODEX_ONLY
+<!--/QUALIA-HOST-->
+after'
+CLAUDE_OUT=$($NODE -e "console.log(require('$HA').stripHostBlocks(process.argv[1],'claude'))" "$SRC")
+assert_contains "claude strip keeps CLAUDE_ONLY" "$CLAUDE_OUT" "CLAUDE_ONLY"
+refute_contains "claude strip drops CODEX_ONLY" "$CLAUDE_OUT" "CODEX_ONLY"
+CODEX_OUT=$($NODE -e "console.log(require('$HA').stripHostBlocks(process.argv[1],'codex'))" "$SRC")
+assert_contains "codex strip keeps CODEX_ONLY" "$CODEX_OUT" "CODEX_ONLY"
+refute_contains "codex strip drops CLAUDE_ONLY" "$CODEX_OUT" "CLAUDE_ONLY"
+
+# --- R5: compileInstructions applies naming but leaves tokens/role for install ---
+NAMED=$($NODE -e "console.log(require('$HA').compileInstructions('Use Claude Code now. Role: {{ROLE}} at \${QUALIA_BIN}','codex'))")
+assert_contains "codex compile swaps the product name" "$NAMED" "Use Codex now"
+assert_contains "codex compile leaves {{ROLE}} for install" "$NAMED" "{{ROLE}}"
+assert_contains "codex compile leaves \${QUALIA_BIN} token for install" "$NAMED" '${QUALIA_BIN}'
+
+# --- R5: renderText still resolves paths (regression) ---
+RENDERED=$($NODE -e "console.log(require('$HA').renderText('bin at \${QUALIA_BIN}','claude'))")
+assert_contains "renderText resolves QUALIA_BIN" "$RENDERED" "/.claude/bin"
+
+echo ""
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/last-report.test.sh

@@ -0,0 +1,156 @@
+#!/bin/bash
+# last-report.test.sh — bin/last-report.js (surface the latest session report)
+# Run: bash tests/last-report.test.sh
+
+PASS=0
+FAIL=0
+BIN_DIR="$(cd "$(dirname "$0")/../bin" && pwd)"
+NODE="${NODE:-node}"
+LR="$BIN_DIR/last-report.js"
+
+assert_exit() {
+  local name="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then echo "  ✓ $name"; PASS=$((PASS+1));
+  else echo "  ✗ $name (expected exit $expected, got $actual)"; FAIL=$((FAIL+1)); fi
+}
+assert_contains() {
+  local name="$1" hay="$2" needle="$3"
+  if echo "$hay" | grep -qF "$needle"; then echo "  ✓ $name"; PASS=$((PASS+1));
+  else echo "  ✗ $name (missing '$needle' in: $hay)"; FAIL=$((FAIL+1)); fi
+}
+assert_not_contains() {
+  local name="$1" hay="$2" needle="$3"
+  if echo "$hay" | grep -qF "$needle"; then echo "  ✗ $name (unexpected '$needle' in: $hay)"; FAIL=$((FAIL+1));
+  else echo "  ✓ $name"; PASS=$((PASS+1)); fi
+}
+
+# Write a well-formed report at $1/.planning/reports/report-$2.md with summary $3, next $4
+write_report() {
+  local root="$1" datepart="$2" summary="$3" next="$4" date="$5"
+  mkdir -p "$root/.planning/reports"
+  cat > "$root/.planning/reports/report-$datepart.md" <<EOF
+# Session Report — $date
+
+**Project:** demo
+**Employee:** T
+**Branch:** main
+**Date:** $date
+
+## What Was Done
+- $summary
+
+## Blockers
+None.
+
+## Next Steps
+1. $next
+
+## Commits (1)
+- abc123 seed
+EOF
+}
+
+echo "last-report.test.sh — bin/last-report.js"
+echo ""
+
+$NODE -c "$LR" 2>/dev/null && { echo "  ✓ syntax valid"; PASS=$((PASS+1)); } || { echo "  ✗ syntax invalid"; FAIL=$((FAIL+1)); }
+
+# --- no reports dir → exit 1, found:false ---
+TMP=$(mktemp -d)
+(cd "$TMP" && $NODE "$LR" >/dev/null 2>&1)
+assert_exit "no reports dir → exit 1" 1 $?
+OUT=$(cd "$TMP" && $NODE "$LR" --json 2>&1)
+assert_contains "json found:false when none" "$OUT" '"found": false'
+OUT=$(cd "$TMP" && $NODE "$LR" 2>&1)
+assert_contains "human: nothing to surface" "$OUT" "No session reports"
+rm -rf "$TMP"
+
+# --- single report → extracts date + summary + next, exit 0 ---
+TMP=$(mktemp -d)
+write_report "$TMP" "2026-05-28" "Built the login flow" "Wire the dashboard" "2026-05-28"
+(cd "$TMP" && $NODE "$LR" >/dev/null 2>&1)
+assert_exit "single report → exit 0" 0 $?
+OUT=$(cd "$TMP" && $NODE "$LR" 2>&1)
+assert_contains "human shows date" "$OUT" "2026-05-28"
+assert_contains "human shows summary" "$OUT" "Built the login flow"
+assert_contains "human shows next" "$OUT" "Wire the dashboard"
+assert_contains "human has 'Last session' prefix" "$OUT" "Last session"
+rm -rf "$TMP"
+
+# --- json shape ---
+TMP=$(mktemp -d)
+write_report "$TMP" "2026-05-28" "Built the login flow" "Wire the dashboard" "2026-05-28"
+OUT=$(cd "$TMP" && $NODE "$LR" --json 2>&1)
+assert_contains "json found:true" "$OUT" '"found": true'
+assert_contains "json file field" "$OUT" '"file": "report-2026-05-28.md"'
+assert_contains "json date field" "$OUT" '"date": "2026-05-28"'
+assert_contains "json summary field" "$OUT" '"summary": "Built the login flow"'
+assert_contains "json next field" "$OUT" '"next": "Wire the dashboard"'
+rm -rf "$TMP"
+
+# --- multiple reports → picks the newest BY DATE (not file order) ---
+TMP=$(mktemp -d)
+write_report "$TMP" "2026-05-28" "Older work" "Old next" "2026-05-28"
+write_report "$TMP" "2026-06-15" "Newest work" "New next" "2026-06-15"
+write_report "$TMP" "2026-06-01" "Middle work" "Mid next" "2026-06-01"
+OUT=$(cd "$TMP" && $NODE "$LR" --json 2>&1)
+assert_contains "picks newest date file" "$OUT" '"file": "report-2026-06-15.md"'
+assert_contains "picks newest summary" "$OUT" "Newest work"
+assert_not_contains "does not pick older summary" "$OUT" "Older work"
+rm -rf "$TMP"
+
+# --- dated suffix filenames (report-2026-06-20-session2.md) parse correctly ---
+TMP=$(mktemp -d)
+write_report "$TMP" "2026-06-10" "Earlier" "e" "2026-06-10"
+write_report "$TMP" "2026-06-20-session2" "Suffixed newest" "s" "2026-06-20"
+OUT=$(cd "$TMP" && $NODE "$LR" --json 2>&1)
+assert_contains "suffixed filename wins by date" "$OUT" "Suffixed newest"
+assert_contains "suffixed date extracted" "$OUT" '"date": "2026-06-20"'
+rm -rf "$TMP"
+
+# --- --now makes age_days deterministic ---
+TMP=$(mktemp -d)
+write_report "$TMP" "2026-06-01" "Work" "Next" "2026-06-01"
+OUT=$(cd "$TMP" && $NODE "$LR" --json --now 2026-06-11T00:00:00Z 2>&1)
+assert_contains "age_days deterministic (10)" "$OUT" '"age_days": 10'
+OUT=$(cd "$TMP" && $NODE "$LR" --now 2026-06-11T00:00:00Z 2>&1)
+assert_contains "human age uses --now" "$OUT" "10d ago"
+rm -rf "$TMP"
+
+# --- library: latestReport() returns structured object ---
+TMP=$(mktemp -d)
+write_report "$TMP" "2026-06-01" "Lib work" "Lib next" "2026-06-01"
+RES=$($NODE -e "console.log(require('$LR').latestReport('$TMP').summary)" 2>&1)
+assert_contains "latestReport() returns summary" "$RES" "Lib work"
+RES=$($NODE -e "console.log(require('$LR').latestReport('$TMP',{now:'2026-06-06T00:00:00Z'}).age_days)" 2>&1)
+assert_contains "latestReport() honors now opt (5)" "$RES" "5"
+rm -rf "$TMP"
+
+# --- malformed / empty report handled gracefully (no crash, still exit 0) ---
+TMP=$(mktemp -d)
+mkdir -p "$TMP/.planning/reports"
+: > "$TMP/.planning/reports/report-2026-06-02.md"   # completely empty
+(cd "$TMP" && $NODE "$LR" >/dev/null 2>&1)
+assert_exit "empty report → exit 0 (found by filename)" 0 $?
+OUT=$(cd "$TMP" && $NODE "$LR" --json 2>&1)
+assert_contains "empty report found:true" "$OUT" '"found": true'
+assert_contains "empty report date from filename" "$OUT" '"date": "2026-06-02"'
+rm -rf "$TMP"
+
+# --- malformed report (no headings, just prose) still yields a summary ---
+TMP=$(mktemp -d)
+mkdir -p "$TMP/.planning/reports"
+printf 'just some freeform notes about the day\n' > "$TMP/.planning/reports/report-2026-06-03.md"
+OUT=$(cd "$TMP" && $NODE "$LR" --json 2>&1)
+assert_contains "malformed report falls back to first line" "$OUT" "just some freeform notes"
+rm -rf "$TMP"
+
+# --- bad argument → exit 2 ---
+TMP=$(mktemp -d)
+(cd "$TMP" && $NODE "$LR" --bogus >/dev/null 2>&1)
+assert_exit "unknown flag → exit 2" 2 $?
+rm -rf "$TMP"
+
+echo ""
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/lib.test.sh

@@ -507,7 +507,7 @@ TMP=$(mktmp)
 mkdir -p "$TMP/home/.claude/bin" "$TMP/home/.claude/hooks" "$TMP/home/.claude/knowledge/daily-log" "$TMP/home/.claude/qualia-design" "$TMP/home/.claude/agents" "$TMP/home/.claude/qualia-templates" "$TMP/project"
 echo '{"installed_by":"Test","role":"OWNER","version":"6.3.0","erp":{"enabled":false}}' > "$TMP/home/.claude/.qualia-config.json"
 touch "$TMP/home/.claude/CLAUDE.md" "$TMP/home/.claude/settings.json"
-for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
+for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js agent-status.js analyze-gate.js verify-panel.js wave-plan.js eval-runner.js branch-hygiene.js last-report.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js project-sync.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
   touch "$TMP/home/.claude/bin/$f"
 done
 for h in session-start.js auto-update.js branch-guard.js pre-push.js pre-deploy-gate.js migration-guard.js git-guardrails.js stop-session-log.js fawzi-approval-guard.js vercel-account-guard.js env-empty-guard.js supabase-destructive-guard.js; do
@@ -622,7 +622,7 @@ TMP=$(mktmp)
 mkdir -p "$TMP/.claude/bin" "$TMP/.claude/hooks" "$TMP/.claude/knowledge/daily-log" "$TMP/.claude/qualia-design" "$TMP/.claude/agents" "$TMP/.claude/qualia-templates" "$TMP/project/.planning"
 echo '{"installed_by":"Test","role":"OWNER","erp":{"enabled":false}}' > "$TMP/.claude/.qualia-config.json"
 touch "$TMP/.claude/CLAUDE.md" "$TMP/.claude/settings.json"
-for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
+for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js agent-status.js analyze-gate.js verify-panel.js wave-plan.js eval-runner.js branch-hygiene.js last-report.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js project-sync.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
   touch "$TMP/.claude/bin/$f"
 done
 for h in session-start.js auto-update.js branch-guard.js pre-push.js pre-deploy-gate.js migration-guard.js git-guardrails.js stop-session-log.js fawzi-approval-guard.js vercel-account-guard.js env-empty-guard.js supabase-destructive-guard.js; do