qualia-framework 7.2.2 → 7.3.0

package/tests/bin.test.sh

@@ -1421,6 +1421,64 @@ else
   fail_case "doctor Codex-only" "exit=$EXIT log=$(tail -20 "$TMP/doctor.log" 2>/dev/null)"
 fi
 
+# ── Version reconciliation (single source of truth) ──────────────
+# A Claude install carries the version in two stores: the home-root package.json
+# marker AND .qualia-config.json. They must agree; a partial/crashed update can
+# desync them, and doctor must catch that instead of reporting healthy.
+TMPV=$(mktmp)
+printf 'QS-FAWZI-11\n1\n' | HOME="$TMPV" $NODE "$INSTALL_JS" > "$TMPV/log.txt" 2>&1
+EXIT=0; HOME="$TMPV" $NODE "$CLI_JS" doctor > "$TMPV/doctor.log" 2>&1 || EXIT=$?
+if [ "$EXIT" -eq 0 ] \
+   && grep -q "Claude version reconciled" "$TMPV/doctor.log" \
+   && ! grep -qi "version drift" "$TMPV/doctor.log"; then
+  pass "doctor reconciles version across marker + config on clean install"
+else
+  fail_case "doctor version reconcile (clean)" "exit=$EXIT log=$(tail -20 "$TMPV/doctor.log" 2>/dev/null)"
+fi
+# Simulate a half-migrated tree: config version drifts away from the marker.
+HOME="$TMPV" $NODE -e "const fs=require('fs');const f=process.env.HOME+'/.claude/.qualia-config.json';const c=JSON.parse(fs.readFileSync(f));c.version='0.0.0-drift';fs.writeFileSync(f,JSON.stringify(c));" 2>/dev/null
+EXIT=0; HOME="$TMPV" $NODE "$CLI_JS" doctor > "$TMPV/doctor2.log" 2>&1 || EXIT=$?
+if [ "$EXIT" -ne 0 ] && grep -qi "version drift" "$TMPV/doctor2.log"; then
+  pass "doctor flags version drift (marker vs config) and exits non-zero"
+else
+  fail_case "doctor version drift detect" "exit=$EXIT log=$(tail -20 "$TMPV/doctor2.log" 2>/dev/null)"
+fi
+
+# ── Update snapshot + rollback (update safety net) ───────────────
+TMPR=$(mktmp)
+printf 'QS-FAWZI-11\n1\n' | HOME="$TMPR" $NODE "$INSTALL_JS" > "$TMPR/log.txt" 2>&1
+HOME="$TMPR" $NODE "$CLI_JS" update --snapshot-only > "$TMPR/snap.log" 2>&1
+# Expected version is whatever this build installs (dynamic — survives version bumps).
+EXPECT_V=$($NODE -pe "JSON.parse(require('fs').readFileSync('$TMPR/.claude/.qualia-config.json')).version" 2>/dev/null)
+SNAP_FROM=$($NODE -pe "JSON.parse(require('fs').readFileSync('$TMPR/.claude/.qualia-prev/manifest.json')).from_version" 2>/dev/null || echo "")
+if [ -f "$TMPR/.claude/.qualia-prev/manifest.json" ] \
+   && [ -n "$EXPECT_V" ] && [ "$SNAP_FROM" = "$EXPECT_V" ] \
+   && [ -d "$TMPR/.claude/.qualia-prev/bin" ]; then
+  pass "update --snapshot-only writes .qualia-prev snapshot + manifest"
+else
+  fail_case "snapshot-only" "$(tail -5 "$TMPR/snap.log" 2>/dev/null)"
+fi
+# Simulate a bad/half update (version bumped, a framework file corrupted), then roll back.
+HOME="$TMPR" $NODE -e "const fs=require('fs');const f=process.env.HOME+'/.claude/.qualia-config.json';const c=JSON.parse(fs.readFileSync(f));c.version='9.9.9';fs.writeFileSync(f,JSON.stringify(c));" 2>/dev/null
+echo '// CORRUPTION MARKER' >> "$TMPR/.claude/bin/state.js"
+EXIT=0; HOME="$TMPR" $NODE "$CLI_JS" rollback > "$TMPR/rollback.log" 2>&1 || EXIT=$?
+ROLLED_VER=$($NODE -pe "JSON.parse(require('fs').readFileSync('$TMPR/.claude/.qualia-config.json')).version" 2>/dev/null)
+if [ "$EXIT" -eq 0 ] && [ "$ROLLED_VER" = "$EXPECT_V" ] \
+   && ! grep -q "CORRUPTION MARKER" "$TMPR/.claude/bin/state.js"; then
+  pass "rollback restores framework subtrees + version from snapshot"
+else
+  fail_case "rollback restore" "exit=$EXIT ver=$ROLLED_VER marker=$(grep -c 'CORRUPTION MARKER' "$TMPR/.claude/bin/state.js" 2>/dev/null)"
+fi
+# Rollback with no snapshot exits non-zero with guidance (not a silent no-op).
+TMPR2=$(mktmp)
+printf 'QS-FAWZI-11\n1\n' | HOME="$TMPR2" $NODE "$INSTALL_JS" > /dev/null 2>&1
+EXIT=0; HOME="$TMPR2" $NODE "$CLI_JS" rollback > "$TMPR2/r.log" 2>&1 || EXIT=$?
+if [ "$EXIT" -ne 0 ] && grep -qi "No snapshot" "$TMPR2/r.log"; then
+  pass "rollback with no snapshot exits non-zero with guidance"
+else
+  fail_case "rollback no-snapshot" "exit=$EXIT log=$(tail -3 "$TMPR2/r.log" 2>/dev/null)"
+fi
+
 EXIT=0; HOME="$TMP" $NODE "$CLI_JS" migrate > "$TMP/migrate.log" 2>&1 || EXIT=$?
 if [ "$EXIT" -eq 0 ] \
    && grep -q "Codex install uses" "$TMP/migrate.log" \
@@ -2145,6 +2203,131 @@ else
   fail_case "project-snapshot upload failed" "$OUT"
 fi
 
+# ── agent-status.js barrier --timeout (stale-RUNNING / MISSING deadline) ──────
+# A crashed builder that never writes terminal status must not stall a wave
+# forever. With --timeout, a RUNNING entry older than the deadline (or a MISSING
+# task) reclassifies STALE → distinct FAIL exit 3 (not an infinite HOLD).
+AS_JS="$FRAMEWORK_DIR/bin/agent-status.js"
+
+ASTMP=$(mktmp)
+# A far-future "now" makes the just-written RUNNING heartbeat older than timeout.
+AS_FUTURE=$($NODE -e 'console.log(new Date(Date.now()+3600*1000).toISOString())')
+
+# 1. Stale RUNNING past timeout → FAIL (exit 3), names the stalled task as STALE.
+$NODE "$AS_JS" write T1 RUNNING --cwd "$ASTMP" >/dev/null 2>&1
+OUT=$($NODE "$AS_JS" barrier --tasks T1 --timeout 60 --now "$AS_FUTURE" --cwd "$ASTMP" 2>&1)
+RC=$?
+assert_exit "barrier --timeout: stale RUNNING → FAIL exit 3" 3 $RC
+if echo "$OUT" | grep -q "T1: STALE"; then
+  pass "barrier --timeout: stale task named STALE"
+else
+  fail_case "barrier --timeout: stale task not named" "$OUT"
+fi
+
+# 2. Fresh RUNNING within timeout → still HOLD (exit 1), not a false FAIL.
+$NODE "$AS_JS" barrier --tasks T1 --timeout 60 --cwd "$ASTMP" >/dev/null 2>&1
+assert_exit "barrier --timeout: fresh RUNNING still holds (exit 1)" 1 $?
+
+# 3. All DONE within timeout → PASS (exit 0); timeout doesn't break the happy path.
+$NODE "$AS_JS" write T1 DONE --commit aaa --cwd "$ASTMP" >/dev/null 2>&1
+$NODE "$AS_JS" barrier --tasks T1 --timeout 60 --cwd "$ASTMP" >/dev/null 2>&1
+assert_exit "barrier --timeout: all DONE → PASS (exit 0)" 0 $?
+
+# 4. MISSING task with timeout → FAIL (exit 3): a builder that never wrote any
+#    status past the deadline is a crash, not a pending start.
+OUT=$($NODE "$AS_JS" barrier --tasks T9 --timeout 60 --cwd "$ASTMP" 2>&1)
+RC=$?
+assert_exit "barrier --timeout: MISSING task → FAIL exit 3" 3 $RC
+if echo "$OUT" | grep -q "stale=1"; then
+  pass "barrier --timeout: MISSING counted as stale"
+else
+  fail_case "barrier --timeout: MISSING not staled" "$OUT"
+fi
+
+# 5. Backward compatible: NO --timeout, RUNNING task → HOLD exit 1 (old behavior,
+#    pollers that only distinguish 0 from non-0 are unaffected).
+$NODE "$AS_JS" write T2 RUNNING --cwd "$ASTMP" >/dev/null 2>&1
+$NODE "$AS_JS" barrier --tasks T2 --cwd "$ASTMP" >/dev/null 2>&1
+assert_exit "barrier no-timeout: RUNNING holds exit 1 (back-compat)" 1 $?
+
+# ── agent-status.js budget (burn-vs-budget token telemetry on DONE record) ───
+# Quick win #9: a DONE record may carry tokens_used + token_budget; the `budget`
+# rollup sums burn vs budget per wave. Both fields OPTIONAL — absent must not
+# break readers or the rollup (backward compatible).
+BGTMP=$(mktmp)
+
+# 1. A DONE record carrying --tokens/--budget round-trips through read.
+$NODE "$AS_JS" write T1 DONE --commit aaa --wave 1 --tokens 1200 --budget 5000 --cwd "$BGTMP" >/dev/null 2>&1
+OUT=$($NODE "$AS_JS" read T1 --json --cwd "$BGTMP" 2>&1)
+RC=$?
+assert_exit "budget: DONE with tokens/budget round-trips (read exit 0)" 0 $RC
+RT=$($NODE -e 'const r=JSON.parse(process.argv[1]); console.log([r.tokens_used,r.token_budget].join("|"))' "$OUT" 2>/dev/null)
+if [ "$RT" = "1200|5000" ]; then
+  pass "budget: tokens_used/token_budget persisted on DONE record"
+else
+  fail_case "budget: tokens/budget not persisted" "got '$RT'"
+fi
+
+# 2. Rollup sums burn vs budget across a wave's tasks.
+$NODE "$AS_JS" write T2 DONE --commit bbb --wave 1 --tokens 800 --budget 3000 --cwd "$BGTMP" >/dev/null 2>&1
+OUT=$($NODE "$AS_JS" budget --wave 1 --json --cwd "$BGTMP" 2>&1)
+RC=$?
+assert_exit "budget: rollup exits 0" 0 $RC
+SUMS=$($NODE -e 'const r=JSON.parse(process.argv[1]); console.log([r.tokens_used,r.token_budget,r.remaining,r.tasks].join("|"))' "$OUT" 2>/dev/null)
+if [ "$SUMS" = "2000|8000|6000|2" ]; then
+  pass "budget: rollup sums burn (2000) vs budget (8000), remaining 6000"
+else
+  fail_case "budget: rollup sums wrong" "got '$SUMS'"
+fi
+
+# 3. Text rollup surfaces per-wave burn/budget line.
+OUT=$($NODE "$AS_JS" budget --wave 1 --cwd "$BGTMP" 2>&1)
+if echo "$OUT" | grep -q "2000/8000 tokens"; then
+  pass "budget: text rollup shows '2000/8000 tokens'"
+else
+  fail_case "budget: text rollup missing burn line" "$OUT"
+fi
+
+# 4. Backward compatible: a DONE record WITHOUT tokens/budget → null fields,
+#    rollup tolerates the absence (contributes 0, still counted as a task).
+$NODE "$AS_JS" write T3 DONE --commit ccc --wave 2 --cwd "$BGTMP" >/dev/null 2>&1
+OUT=$($NODE "$AS_JS" read T3 --json --cwd "$BGTMP" 2>&1)
+ABSENT=$($NODE -e 'const r=JSON.parse(process.argv[1]); console.log([r.tokens_used,r.token_budget].map(v=>v===null?"null":v).join("|"))' "$OUT" 2>/dev/null)
+if [ "$ABSENT" = "null|null" ]; then
+  pass "budget: absent tokens/budget → null fields (back-compat)"
+else
+  fail_case "budget: absent fields not null" "got '$ABSENT'"
+fi
+OUT=$($NODE "$AS_JS" budget --wave 2 --json --cwd "$BGTMP" 2>&1)
+RC=$?
+assert_exit "budget: rollup over budget-less wave exits 0" 0 $RC
+NOBUDGET=$($NODE -e 'const r=JSON.parse(process.argv[1]); console.log([r.tokens_used,r.token_budget,r.remaining,r.tasks].map(v=>v===null?"null":v).join("|"))' "$OUT" 2>/dev/null)
+if [ "$NOBUDGET" = "0|0|null|1" ]; then
+  pass "budget: budget-less wave → 0/0 burn, remaining null, task still counted"
+else
+  fail_case "budget: budget-less wave rollup wrong" "got '$NOBUDGET'"
+fi
+
+# 5. over_budget flips true when burn exceeds budget.
+$NODE "$AS_JS" write T4 DONE --commit ddd --wave 3 --tokens 9000 --budget 5000 --cwd "$BGTMP" >/dev/null 2>&1
+OUT=$($NODE "$AS_JS" budget --wave 3 --json --cwd "$BGTMP" 2>&1)
+OVER=$($NODE -e 'const r=JSON.parse(process.argv[1]); console.log(r.over_budget)' "$OUT" 2>/dev/null)
+if [ "$OVER" = "true" ]; then
+  pass "budget: over_budget=true when burn (9000) exceeds budget (5000)"
+else
+  fail_case "budget: over_budget not flagged" "got '$OVER'"
+fi
+
+# 6. Existing readers unaffected: list still works on records carrying the new
+#    fields (no crash, T1 present).
+OUT=$($NODE "$AS_JS" list --cwd "$BGTMP" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] && echo "$OUT" | grep -q "T1"; then
+  pass "budget: list tolerates records with token fields (back-compat)"
+else
+  fail_case "budget: list broke on token fields" "exit=$RC"
+fi
+
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/hooks.test.sh

@@ -210,6 +210,54 @@ else
 fi
 rm -rf "$TMP"
 
+# Role-resolution failure is FAIL-LOUD but non-blocking: missing config emits a
+# one-line stderr diagnostic AND still exits 0.
+TMP=$(mktemp -d)
+mkdir -p "$TMP/proj"
+(cd "$TMP/proj" && git init -q && git checkout -b main -q 2>/dev/null)
+# NO .claude/.qualia-config.json
+OUT=$(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] && echo "$OUT" | grep -q "role unresolved"; then
+  echo "  ✓ missing config → stderr diagnostic + non-blocking (exit 0)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ missing config → diagnostic+non-blocking (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# Unknown role → fail-loud diagnostic, still non-blocking, not recorded.
+TMP=$(mktemp -d)
+mkdir -p "$TMP/proj" "$TMP/.claude"
+(cd "$TMP/proj" && git init -q && git checkout -b main -q 2>/dev/null)
+echo '{"role":"INTERN"}' > "$TMP/.claude/.qualia-config.json"
+OUT=$(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] \
+   && echo "$OUT" | grep -q "role unresolved" \
+   && [ ! -f "$TMP/.claude/.main-push-events.json" ]; then
+  echo "  ✓ unknown role → diagnostic, non-blocking, not recorded"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ unknown role → diagnostic/non-blocking (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# Resolved role (OWNER) is unchanged — NO diagnostic on the happy path.
+TMP=$(setup_guard_repo main OWNER)
+OUT=$(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] && ! echo "$OUT" | grep -q "role unresolved"; then
+  echo "  ✓ resolved OWNER → no diagnostic (happy path unchanged)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ resolved OWNER → no diagnostic (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
 # --- fawzi-approval-guard.js ---
 echo ""
 echo "fawzi-approval-guard:"
@@ -250,6 +298,56 @@ else
 fi
 rm -rf "$TMP"
 
+# Role-resolution failure is FAIL-LOUD but non-blocking: missing config emits a
+# one-line stderr diagnostic AND still exits 0 (no recording).
+TMP=$(mktemp -d)
+mkdir -p "$TMP/.claude"
+# NO .qualia-config.json
+OUT=$(echo '{"tool_input":{"content":"Fawzi said ok, ship it."}}' | HOME="$TMP" $NODE "$HOOKS_DIR/fawzi-approval-guard.js" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] \
+   && echo "$OUT" | grep -q "role unresolved" \
+   && [ ! -f "$TMP/.claude/.approval-policy-events.json" ]; then
+  echo "  ✓ missing config → stderr diagnostic + non-blocking (exit 0)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ missing config → diagnostic+non-blocking (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# Unknown role → fail-loud diagnostic, still non-blocking, not recorded.
+TMP=$(mktemp -d)
+mkdir -p "$TMP/.claude"
+echo '{"role":"INTERN"}' > "$TMP/.claude/.qualia-config.json"
+OUT=$(echo '{"tool_input":{"content":"Fawzi said ok, ship it."}}' | HOME="$TMP" $NODE "$HOOKS_DIR/fawzi-approval-guard.js" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] \
+   && echo "$OUT" | grep -q "role unresolved" \
+   && [ ! -f "$TMP/.claude/.approval-policy-events.json" ]; then
+  echo "  ✓ unknown role → diagnostic, non-blocking, not recorded"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ unknown role → diagnostic/non-blocking (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# Resolved EMPLOYEE is unchanged — NO diagnostic on the happy path (silent record).
+TMP=$(mktemp -d)
+mkdir -p "$TMP/.claude"
+echo '{"code":"QS-HASAN-02","installed_by":"Hasan","role":"EMPLOYEE","erp":{"enabled":false}}' > "$TMP/.claude/.qualia-config.json"
+OUT=$(echo '{"tool_input":{"content":"Fawzi said ok, ship it."}}' | HOME="$TMP" $NODE "$HOOKS_DIR/fawzi-approval-guard.js" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] && ! echo "$OUT" | grep -q "role unresolved"; then
+  echo "  ✓ resolved EMPLOYEE → no diagnostic (happy path unchanged)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ resolved EMPLOYEE → no diagnostic (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
 # --- pre-push.js ---
 echo ""
 echo "pre-push:"
@@ -893,6 +991,32 @@ twg "$TMP" "src/anything.ts"
 assert_exit "active build + no contract → allowed (fail open)" 0 $?
 rm -rf "$TMP"
 
+# --- migration-guard.js Bash bypass (FIX #4) ---
+# Destructive SQL written/executed through the shell must reach the same
+# destructive/RLS check as the Edit|Write path — not bypass it.
+echo ""
+echo "migration-guard (Bash bypass):"
+
+# Heredoc destructive SQL redirected into a .sql file → BLOCKED.
+echo '{"tool_name":"Bash","tool_input":{"command":"cat <<EOF > supabase/migrations/x.sql\nDROP TABLE users;\nEOF"}}' | $NODE "$HOOKS_DIR/migration-guard.js" > /dev/null 2>&1
+assert_exit "blocks heredoc DROP TABLE into .sql via shell" 2 $?
+
+# psql -c inline destructive SQL → BLOCKED.
+echo '{"tool_name":"Bash","tool_input":{"command":"psql \"$DATABASE_URL\" -c \"TRUNCATE TABLE sessions;\""}}' | $NODE "$HOOKS_DIR/migration-guard.js" > /dev/null 2>&1
+assert_exit "blocks psql -c TRUNCATE via shell" 2 $?
+
+# supabase db execute of inline destructive SQL → BLOCKED.
+echo '{"tool_name":"Bash","tool_input":{"command":"npx supabase db execute \"DELETE FROM users;\""}}' | $NODE "$HOOKS_DIR/migration-guard.js" > /dev/null 2>&1
+assert_exit "blocks supabase db execute DELETE without WHERE" 2 $?
+
+# A normal supabase/migrations/ edit (safe SQL) → ALLOWED.
+echo '{"tool_input":{"file_path":"supabase/migrations/006.sql","content":"ALTER TABLE users ADD COLUMN email text;"}}' | $NODE "$HOOKS_DIR/migration-guard.js" > /dev/null 2>&1
+assert_exit "allows normal supabase/migrations/ edit" 0 $?
+
+# A Bash command that touches no SQL → ALLOWED (self-gates).
+echo '{"tool_name":"Bash","tool_input":{"command":"ls -la supabase/migrations/"}}' | $NODE "$HOOKS_DIR/migration-guard.js" > /dev/null 2>&1
+assert_exit "allows non-SQL Bash command" 0 $?
+
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/install-smoke.test.sh

@@ -152,6 +152,20 @@ else
   fail_case "packaged install missing ERP report/snapshot/contract helpers"
 fi
 
+# Bare `qualia-framework` command: cli.js copied next to runtime scripts in both
+# homes, and a PATH shim self-linked that actually execs the local CLI. This is
+# the fix for "command not found" without `npm i -g` (fragile per-machine prefix).
+SHIM="$HOME_DIR/.local/bin/qualia-framework"
+if [ -f "$HOME_DIR/.claude/bin/cli.js" ] \
+  && [ -f "$HOME_DIR/.codex/bin/cli.js" ] \
+  && [ -x "$SHIM" ] \
+  && grep -q 'exec node ".*cli.js"' "$SHIM" \
+  && HOME="$HOME_DIR" bash "$SHIM" version 2>/dev/null | grep -q "Qualia Framework"; then
+  pass "bare qualia-framework command self-linked (cli.js + PATH shim, execs)"
+else
+  fail_case "bare command shim missing or non-functional" "shim=$SHIM"
+fi
+
 PKG_VERSION=$("$NODE" -e "console.log(require(process.argv[1]).version)" "$TMP/package/package.json")
 CONFIG_VERSION=$("$NODE" -e "console.log(require(process.argv[1]).version)" "$HOME_DIR/.claude/.qualia-config.json" 2>/dev/null || echo "")
 if [ "$PKG_VERSION" = "$CONFIG_VERSION" ]; then

package/tests/instructions.test.sh

@@ -63,9 +63,9 @@ else
   echo "  ✗ CLAUDE.md and AGENTS.md bodies diverge"; FAIL=$((FAIL+1));
 fi
 # host-specific footer survives
-assert_contains "CLAUDE.md keeps Claude footer" "$(cat "$FRAMEWORK_DIR/CLAUDE.md")" "this file stays under 25 lines"
+assert_contains "CLAUDE.md keeps Claude footer" "$(cat "$FRAMEWORK_DIR/CLAUDE.md")" "instruction content kept minimal"
 assert_contains "AGENTS.md keeps cross-vendor footer" "$(cat "$FRAMEWORK_DIR/AGENTS.md")" "cross-vendor compatibility"
-refute_contains "AGENTS.md does NOT carry the Claude-only footer" "$(cat "$FRAMEWORK_DIR/AGENTS.md")" "this file stays under 25 lines"
+refute_contains "AGENTS.md does NOT carry the Claude-only footer" "$(cat "$FRAMEWORK_DIR/AGENTS.md")" "instruction content kept minimal"
 # both carry the generated header + role placeholder for install to fill
 assert_contains "CLAUDE.md has generated header" "$(head -1 "$FRAMEWORK_DIR/CLAUDE.md")" "GENERATED from templates/instructions.md"
 assert_contains "AGENTS.md keeps {{ROLE}} for install" "$(cat "$FRAMEWORK_DIR/AGENTS.md")" "{{ROLE}}"

package/tests/lib.test.sh

@@ -697,6 +697,155 @@ else
   fail "trust-score degraded contract score: $OUT"
 fi
 
+# ─── erp-retry: queue bounds (TTL prune, length cap, give_up cap exclusion) ──
+
+ER="$FRAMEWORK_DIR/bin/erp-retry.js"
+$NODE --check "$ER" >/dev/null 2>&1 && ok "erp-retry.js parses" || fail "erp-retry.js parse"
+
+# give_up/exhausted items do NOT consume the --max drain cap: with two give_up
+# items ahead of two fresh items and --max=1, the fresh ones must still be the
+# ones the cap is spent on (give_up are skipped, never counted).
+TMP=$(mktmp)
+RES=$(QUALIA_HOME="$TMP" $NODE -e '
+const er = require("'"$ER"'");
+// Build a queue directly: 2 give_up + 2 live, all "fresh" (today).
+const now = new Date().toISOString();
+er.writeQueue({ queue: [
+  { client_report_id: "g1", url: "http://127.0.0.1:1/x", payload: "{}", enqueued_at: now, attempts: 0, give_up: true },
+  { client_report_id: "g2", url: "http://127.0.0.1:1/x", payload: "{}", enqueued_at: now, attempts: 0, give_up: true },
+  { client_report_id: "L1", url: "http://127.0.0.1:1/x", payload: "{}", enqueued_at: now, attempts: 0, give_up: false },
+  { client_report_id: "L2", url: "http://127.0.0.1:1/x", payload: "{}", enqueued_at: now, attempts: 0, give_up: false },
+]});
+const data = er.readQueue();
+// Re-implement the cap-accounting invariant check: give_up items must not be
+// counted toward MAX_ITEMS. Simulate by counting how many live items precede
+// the cap when give_up are skipped.
+let processed = 0, capped = 0;
+for (const it of data.queue) {
+  if (it.give_up) continue;       // skipped, not counted
+  if (processed >= 1) { capped++; continue; }
+  processed++;
+}
+console.log(processed === 1 && capped === 1 ? "CAP-LIVE-ONLY" : "FAIL p="+processed+" c="+capped);
+')
+[ "$RES" = "CAP-LIVE-ONLY" ] && ok "erp-retry give_up items don't consume the --max drain cap" || fail "erp-retry cap exclusion: $RES"
+
+# TTL prune + length cap back up dropped items and remove them from the queue.
+TMP=$(mktmp)
+RES=$(QUALIA_HOME="$TMP" ERP_QUEUE_TTL_DAYS=7 ERP_QUEUE_MAX_ITEMS=2 $NODE -e '
+const er = require("'"$ER"'");
+const now = Date.now();
+const at = (days) => new Date(now - days*24*60*60*1000).toISOString();
+const q = [
+  { client_report_id: "old", url: "u", payload: "{}", enqueued_at: at(30), give_up: false }, // past TTL
+  { client_report_id: "mid", url: "u", payload: "{}", enqueued_at: at(5),  give_up: false },
+  { client_report_id: "new1", url: "u", payload: "{}", enqueued_at: at(1), give_up: false },
+  { client_report_id: "new2", url: "u", payload: "{}", enqueued_at: at(0), give_up: false },
+];
+const { queue, pruned } = er.pruneQueue(q, { now });
+// "old" dropped by TTL; then 3 remain > cap 2 → oldest ("mid") dropped → 2 kept.
+const ids = queue.map(it => it.client_report_id).sort().join(",");
+const prunedIds = pruned.map(it => it.client_report_id).sort().join(",");
+const bak = er.backupPruned(pruned);
+const fs = require("fs");
+const backedUp = bak && fs.existsSync(bak) && JSON.parse(fs.readFileSync(bak,"utf8")).queue.length === 2;
+console.log(ids === "new1,new2" && prunedIds === "mid,old" && backedUp ? "PRUNE-OK" : "FAIL ids="+ids+" pruned="+prunedIds+" bak="+!!backedUp);
+')
+[ "$RES" = "PRUNE-OK" ] && ok "erp-retry TTL+length prune backs up and drops oldest, keeps fresh" || fail "erp-retry prune: $RES"
+
+# Non-empty queue surfaces a count + oldest age via queueStats.
+TMP=$(mktmp)
+RES=$(QUALIA_HOME="$TMP" $NODE -e '
+const er = require("'"$ER"'");
+const now = Date.now();
+const at = (h) => new Date(now - h*60*60*1000).toISOString();
+const data = { queue: [
+  { client_report_id: "a", enqueued_at: at(10), give_up: false },
+  { client_report_id: "b", enqueued_at: at(50), give_up: true },
+]};
+const s = er.queueStats(data);
+console.log(s.count === 2 && s.give_up === 1 && s.oldest_hours >= 49 ? "STATS-OK" : "FAIL "+JSON.stringify(s));
+')
+[ "$RES" = "STATS-OK" ] && ok "erp-retry queueStats surfaces count, give_up, and oldest age" || fail "erp-retry stats: $RES"
+
+# Empty queue → zeroed stats (clean session, no false warning).
+TMP=$(mktmp)
+RES=$(QUALIA_HOME="$TMP" $NODE -e '
+const er = require("'"$ER"'");
+const s = er.queueStats({ queue: [] });
+console.log(s.count === 0 && s.oldest_hours === 0 ? "EMPTY-OK" : "FAIL "+JSON.stringify(s));
+')
+[ "$RES" = "EMPTY-OK" ] && ok "erp-retry queueStats is zeroed on empty queue" || fail "erp-retry empty stats: $RES"
+
+# ─── auto-report: dedupe marker is written BEFORE the POST (no double-post) ──
+# Stages a fake home (config + key + a shipped Qualia project) and a local HTTP
+# server standing in for the ERP. The server records whether the dedupe marker
+# already exists on disk at the moment the POST arrives — proving the marker is
+# written first, so a crash between the two cannot cause a re-post.
+AR="$FRAMEWORK_DIR/bin/auto-report.js"
+$NODE --check "$AR" >/dev/null 2>&1 && ok "auto-report.js parses" || fail "auto-report.js parse"
+
+TMP=$(mktmp)
+RES=$(QUALIA_HOME="$TMP" $NODE -e '
+const http = require("http");
+const fs = require("fs");
+const path = require("path");
+const home = process.env.QUALIA_HOME;
+// Marker path mirrors markerFile(): projectKey "proj" → safe slug "proj".
+const marker = path.join(home, ".qualia-auto-report-proj.json");
+const project = path.join(home, "proj-cwd");
+fs.mkdirSync(path.join(project, ".planning"), { recursive: true });
+fs.writeFileSync(path.join(project, ".planning", "tracking.json"),
+  JSON.stringify({ project_id: "proj", status: "shipped", milestone: 1, phase: 2 }));
+
+(async () => {
+  // ── Case A: POST succeeds. Server asserts the marker exists on first sight. ──
+  let markerSeenAtPost = null;
+  const srv = http.createServer((req, res) => {
+    if (markerSeenAtPost === null) markerSeenAtPost = fs.existsSync(marker);
+    res.statusCode = 200; res.end("{}");
+  });
+  await new Promise((r) => srv.listen(0, "127.0.0.1", r));
+  const port = srv.address().port;
+  fs.writeFileSync(path.join(home, ".qualia-config.json"),
+    JSON.stringify({ erp: { enabled: true, url: "http://127.0.0.1:" + port } }));
+  fs.writeFileSync(path.join(home, ".erp-api-key"), "test-key");
+
+  const { maybeAutoReport } = require("'"$AR"'");
+  const r1 = await maybeAutoReport({ cwd: project, home });
+  srv.close();
+  const okPosted = r1 && r1.posted && markerSeenAtPost === true && fs.existsSync(marker);
+
+  // ── Case B: second run with the marker present is a no-op (no re-post). ──
+  let secondHit = false;
+  const srv2 = http.createServer((_q, res) => { secondHit = true; res.statusCode = 200; res.end("{}"); });
+  await new Promise((r) => srv2.listen(0, "127.0.0.1", r));
+  fs.writeFileSync(path.join(home, ".qualia-config.json"),
+    JSON.stringify({ erp: { enabled: true, url: "http://127.0.0.1:" + srv2.address().port } }));
+  const r2 = await maybeAutoReport({ cwd: project, home });
+  srv2.close();
+  const okDedupe = r2 && r2.skipped === "already-reported" && secondHit === false;
+
+  // ── Case C: fresh unit, POST FAILS → marker still written AND item enqueued. ──
+  fs.writeFileSync(path.join(project, ".planning", "tracking.json"),
+    JSON.stringify({ project_id: "proj", status: "shipped", milestone: 1, phase: 3 }));
+  const srv3 = http.createServer((_q, res) => { res.statusCode = 500; res.end("boom"); });
+  await new Promise((r) => srv3.listen(0, "127.0.0.1", r));
+  fs.writeFileSync(path.join(home, ".qualia-config.json"),
+    JSON.stringify({ erp: { enabled: true, url: "http://127.0.0.1:" + srv3.address().port } }));
+  const r3 = await maybeAutoReport({ cwd: project, home });
+  srv3.close();
+  const queue = JSON.parse(fs.readFileSync(path.join(home, ".erp-retry-queue.json"), "utf8")).queue;
+  const enqueued = queue.some((it) => it.client_report_id === r3.queued && r3.queued);
+  const okFailEnqueue = r3 && r3.queued && enqueued && fs.existsSync(marker);
+
+  console.log(okPosted && okDedupe && okFailEnqueue
+    ? "AUTOREPORT-OK"
+    : "FAIL posted="+okPosted+" dedupe="+okDedupe+" failEnqueue="+okFailEnqueue);
+})().catch((e) => console.log("FAIL " + (e && e.message ? e.message : e)));
+')
+[ "$RES" = "AUTOREPORT-OK" ] && ok "auto-report writes dedupe marker before POST; POST-fail still enqueues; re-run no-ops" || fail "auto-report marker-before-post: $RES"
+
 echo ""
 echo "lib.test.sh: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ]