skalpel 4.0.41 → 4.0.43

package/mutation-check.mjs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+// mutation-check.mjs — mutation testing for the CRITICAL LOGIC: detectCompletionClaim (incl. the negation
+// guard), classifyOutcome, classifyConfirm, plus the false-accusation safeguards shipUrlPass (URL
+// reachability) and hasMutatingFlag (non-idempotent re-run guard). For each mutation we flip ONE key
+// predicate/branch in verify-shadow.mjs and re-run the pure-function suite (verify-core.test.mjs) against
+// the mutated copy. A mutation the suite still PASSES is a SURVIVOR (a test gap). Gate: survivors must be
+// 0. Run: `node mutation-check.mjs`.
+import { cpSync, mkdtempSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const TARGET = "verify-shadow.mjs";
+const SUITE = "verify-core.test.mjs";
+
+// Each mutation: a UNIQUE substring in verify-shadow.mjs and the flipped version. Every one MUST be caught
+// by at least one assertion in verify-core.test.mjs.
+const MUTATIONS = [
+  // ---- detectCompletionClaim (incl. the negation/hedge guard, Fix 2) ----
+  {
+    fn: "detectCompletionClaim",
+    find: 'if (!CLAIM_RE.test(s)) return { claim: false, text: "" };',
+    replace: 'if (CLAIM_RE.test(s)) return { claim: false, text: "" };',
+  },
+  {
+    fn: "detectCompletionClaim",
+    find: "if (!l || !CLAIM_RE.test(l)) continue;",
+    replace: "if (!l || CLAIM_RE.test(l)) continue;",
+  },
+  {
+    fn: "detectCompletionClaim",
+    find: "if (NEGATION_RE.test(l)) continue; // negated/hedged → not a completion claim",
+    replace: "if (!NEGATION_RE.test(l)) continue; // negated/hedged → not a completion claim",
+  },
+  {
+    fn: "detectCompletionClaim",
+    find: 'if (NEGATION_RE.test(s)) return { claim: false, text: "" };',
+    replace: 'if (!NEGATION_RE.test(s)) return { claim: false, text: "" };',
+  },
+  // ---- shipUrlPass (Fix 1: URL false-red safeguard) ----
+  {
+    fn: "shipUrlPass",
+    find: "if (urlResponded(ev1)) return true;",
+    replace: "if (urlResponded(ev1)) return false;",
+  },
+  {
+    fn: "shipUrlPass",
+    find: "  if (urlResponded(ev2)) return true;\n  return false;",
+    replace: "  if (urlResponded(ev2)) return true;\n  return true;",
+  },
+  // ---- hasMutatingFlag (Fix 3: non-idempotent re-run guard) ----
+  {
+    fn: "hasMutatingFlag",
+    find: "if (a.some((x) => MUTATING_FLAG.test(String(x)))) return true;",
+    replace: "if (a.some((x) => MUTATING_FLAG.test(String(x)))) return false;",
+  },
+  // ---- classifyOutcome ----
+  {
+    fn: "classifyOutcome",
+    find: 'if (!err) return "PASS";',
+    replace: 'if (err) return "PASS";',
+  },
+  {
+    fn: "classifyOutcome",
+    find: 'if (err.killed || err.signal === "SIGTERM") return "HARNESS_ERROR"; // hit the timeout',
+    replace: 'if (err.killed && err.signal === "SIGTERM") return "PASS"; // hit the timeout',
+  },
+  {
+    fn: "classifyOutcome",
+    find: 'if (exit === 127 || exit === 126) return "HARNESS_ERROR"; // command not found / not executable',
+    replace:
+      'if (exit === 127 && exit === 126) return "HARNESS_ERROR"; // command not found / not executable',
+  },
+  {
+    fn: "classifyOutcome",
+    find: 'return "GENUINE_FAIL"; // a real non-zero exit from the test/build/lint itself',
+    replace: 'return "HARNESS_ERROR"; // a real non-zero exit from the test/build/lint itself',
+  },
+  // ---- classifyConfirm (the flake-confirm state machine) ----
+  {
+    fn: "classifyConfirm",
+    find: 'const needsConfirm = firstOutcome === "GENUINE_FAIL";',
+    replace: 'const needsConfirm = firstOutcome !== "GENUINE_FAIL";',
+  },
+  {
+    fn: "classifyConfirm",
+    find: 'const confirmedFail = needsConfirm && confirmOutcome === "GENUINE_FAIL";',
+    replace: 'const confirmedFail = needsConfirm || confirmOutcome === "GENUINE_FAIL";',
+  },
+  {
+    fn: "classifyConfirm",
+    find: 'const confirmedFail = needsConfirm && confirmOutcome === "GENUINE_FAIL";',
+    replace: 'const confirmedFail = needsConfirm && confirmOutcome !== "GENUINE_FAIL";',
+  },
+  {
+    fn: "classifyConfirm",
+    find: "const unconfirmedFail = needsConfirm && !confirmedFail;",
+    replace: "const unconfirmedFail = needsConfirm && confirmedFail;",
+  },
+];
+
+const workRoot = mkdtempSync(join(tmpdir(), "skalpel-mutants-"));
+cpSync(HERE, join(workRoot, "src"), {
+  recursive: true,
+  filter: (s) => !s.includes("node_modules"),
+});
+const dir = join(workRoot, "src");
+const targetPath = join(dir, TARGET);
+const pristine = readFileSync(targetPath, "utf8");
+
+function runSuite() {
+  const r = spawnSync("node", ["--test", SUITE], { cwd: dir, encoding: "utf8" });
+  return r.status; // 0 = suite passed (mutant SURVIVED); non-zero = suite failed (mutant KILLED)
+}
+
+// Baseline: the pristine copy must pass, else the harness itself is broken.
+if (runSuite() !== 0) {
+  console.error(
+    "BASELINE FAIL: verify-core.test.mjs does not pass on the pristine copy — aborting.",
+  );
+  process.exit(2);
+}
+
+let survivors = 0;
+let missing = 0;
+const results = [];
+for (const m of MUTATIONS) {
+  const count = pristine.split(m.find).length - 1;
+  if (count !== 1) {
+    missing++;
+    results.push(`  ✗ MUTATION TARGET NOT UNIQUE (${count}×) [${m.fn}] ${m.find.slice(0, 50)}…`);
+    continue;
+  }
+  writeFileSync(targetPath, pristine.replace(m.find, m.replace));
+  const killed = runSuite() !== 0;
+  writeFileSync(targetPath, pristine); // restore
+  if (killed) {
+    results.push(`  ✓ killed   [${m.fn}] ${m.find.slice(0, 52)}…`);
+  } else {
+    survivors++;
+    results.push(`  ☠ SURVIVED [${m.fn}] ${m.find.slice(0, 52)}…`);
+  }
+}
+
+rmSync(workRoot, { recursive: true, force: true });
+console.log(results.join("\n"));
+console.log(
+  `\nmutants: ${MUTATIONS.length}   killed: ${MUTATIONS.length - survivors - missing}   survivors: ${survivors}   target-errors: ${missing}`,
+);
+if (survivors === 0 && missing === 0) {
+  console.log(
+    "MUTATION GATE: survivors = 0 on the critical + false-accusation-safeguard functions ✓",
+  );
+  process.exit(0);
+}
+process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.41",
+  "version": "4.0.43",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-hook.mjs

@@ -13,7 +13,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { identity } from "./auth.mjs";
 import { record } from "./metrics.mjs";
-import { recordInsight, cleanText, revealEnabled } from "./insights.mjs";
+import { recordInsight, cleanText, verifySpawnArmed } from "./insights.mjs";
 import { graphReadyNote, verifyCatchNote } from "./reveal.mjs";
 import { tailLines } from "./transcript.mjs";
 
@@ -510,13 +510,11 @@ async function main() {
   // recent test/build/typecheck/lint command and RE-RUNs it out-of-band to log the real PASS/FAIL the
   // agent can't forge. LOG ONLY — it writes nothing to this hook's stdout and never blocks the turn (the
   // re-run, up to 60s, lives in a separate unref'd process). Wrapped so it can never affect the injection.
-  // SKALPEL_VERIFY_REVEAL (the opt-in "aha catch" surface) ALSO arms the re-run — one flag turns on both
-  // the detection and its user-visible reveal. When BOTH are off (the default) this branch is skipped and
-  // the hook's stdout is byte-identical to before; the spawn is detached with stdio ignored regardless.
-  if (
-    (process.env.SKALPEL_VERIFY_SHADOW === "1" || revealEnabled(process.env)) &&
-    payload.transcript_path
-  ) {
+  // ARMING is resolved by the ONE shared resolver (verifySpawnArmed): the consented `verify:"on"` in
+  // client.json OR a dev env override (SKALPEL_VERIFY_SHADOW=1 / SKALPEL_VERIFY_REVEAL). When arming
+  // resolves OFF (the default for every existing install — env unset + config off/absent) this branch is
+  // skipped and the hook's stdout is byte-identical to before; the spawn is detached with stdio ignored.
+  if (verifySpawnArmed(process.env) && payload.transcript_path) {
     try {
       const { spawn } = await import("node:child_process");
       const { fileURLToPath } = await import("node:url");

package/skalpel-setup.mjs

@@ -22,6 +22,7 @@ import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { identity as authIdentity, cliAuthPath } from "./auth.mjs";
 import { isGenuineUserTurn } from "./session-turns.mjs";
+import { appendAdjudication, suppressProof, lastReveal, parseArmToken } from "./insights.mjs";
 
 // CLI (the `skalpel` bin): `skalpel setup [--api https://graph.skalpel.ai]
 // [--user <id>]`, plus `skalpel uninstall` and `skalpel login`. A bare invocation
@@ -65,6 +66,9 @@ const KNOWN_SUBS = new Set([
   "card",
   "ledger",
   "analytics",
+  "verify",
+  "yes",
+  "no",
   "__build",
   "__verify-report",
 ]);
@@ -83,6 +87,8 @@ usage:
   skalpel card [--last|--id <id>] [--md]        share one verified catch: the claim + its own failing proof
   skalpel ledger                                your running tally: N "done"s checked, M verified FALSE
   skalpel analytics                             interactive local analytics — caught lies, measured cost, steers, re-asks
+  skalpel verify on|off|status                  arm/disarm the live catch (re-runs your own proof on a "done" claim)
+  skalpel yes | skalpel no                      was the last catch right? (feeds precision; "no" stops that proof this session)
   skalpel uninstall [--purge]                   remove the hooks + local data from this machine
 
 options:
@@ -157,6 +163,84 @@ function fileCfg() {
 }
 const API = process.env.SKALPEL_API || apiFlag || fileCfg().api || DEFAULT_API;
 
+// writeVerifyConfig(state) — persist the CONSENTED arming for the live catch to ~/.skalpel/client.json.
+// state ∈ { "on", "off" }. On "on" we stamp verify_armed_at (a REAL timestamp) only if not already armed,
+// so re-confirming never resets the honest "armed N days" clock; on "off" we clear it. This is the ONLY
+// writer of the `verify` key; insights.mjs's resolver is the only reader — one key, no drift. Never throws.
+function writeVerifyConfig(state) {
+  const cfgDir = join(homedir(), ".skalpel");
+  const cfgPath = join(cfgDir, "client.json");
+  let cfg = {};
+  try {
+    cfg = JSON.parse(readFileSync(cfgPath, "utf8")) || {};
+  } catch {
+    /* fresh config */
+  }
+  const wasOn = parseArmToken(cfg.verify) === true;
+  cfg.verify = state === "on" ? "on" : "off";
+  if (state === "on") {
+    if (!wasOn || !cfg.verify_armed_at) cfg.verify_armed_at = new Date().toISOString();
+  } else {
+    delete cfg.verify_armed_at;
+  }
+  mkdirSync(cfgDir, { recursive: true });
+  writeFileSync(cfgPath, JSON.stringify(cfg, null, 2));
+}
+
+// promptVerifyConsent() — the ONE honest consent line at setup. The prompt DEFAULTS TO THE EXISTING
+// SETTING so a setup re-run never silently flips a deliberate choice: a user who ran `skalpel verify off`
+// and re-runs setup + Enter STAYS OFF; unset/on defaults to on (the activation intent). Non-interactive /
+// CI must NOT hang: no TTY → leave the config untouched and return. The copy is accurate, not hype: the
+// re-run is only the session's OWN already-executed command (reconstructed from its Bash tool calls) —
+// never a new class of side effect. Best-effort: never breaks setup.
+// resolveConsentChoice(current, answerRaw) → "on" | "off". The prompt DEFAULTS TO THE EXISTING SETTING so
+// an empty Enter never silently flips a deliberate choice: current "off" → stays off unless explicitly
+// re-enabled (y/yes/on); current "on"/unset → the activation default, on unless declined (n/no/off).
+export function resolveConsentChoice(current, answerRaw) {
+  const defaultOn = parseArmToken(current) !== false; // off → default off; on/unset → default on
+  const t = String(answerRaw || "")
+    .trim()
+    .toLowerCase();
+  if (defaultOn) return t === "n" || t === "no" || t === "off" ? "off" : "on";
+  return t === "y" || t === "yes" || t === "on" ? "on" : "off"; // stays off unless explicitly turned on
+}
+
+async function promptVerifyConsent() {
+  try {
+    const interactive = process.stdin.isTTY && process.stdout.isTTY && !process.env.CI;
+    if (!interactive || process.env.SKALPEL_DEMO || process.env.SKALPEL_SKIP_VERIFY_CONSENT === "1")
+      return; // CI / piped / demo → leave config untouched, never block
+    // Default the prompt to the EXISTING setting: off → Enter keeps off; on/unset → Enter accepts.
+    const current = fileCfg().verify; // "on" | "off" | undefined
+    const defaultOn = parseArmToken(current) !== false;
+    console.log(
+      `   ${B}The live catch${X}\n` +
+        `   ${D}When your agent says "done / tests pass", skalpel re-runs the SAME test/build command\n` +
+        `   it just ran, in the same directory, and shows you the real result. It only ever re-runs\n` +
+        `   your session's own command — never anything new.${X}`,
+    );
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const promptLine = defaultOn ? `[Enter = on · n = off]` : `[Enter = keep off · y = on]`;
+    const ans = await new Promise((res) =>
+      rl.question(`   ${B}${promptLine}${X} `, (a) => {
+        rl.close();
+        res(a);
+      }),
+    );
+    // Resolve against the existing setting so an empty Enter preserves the current choice.
+    const choice = resolveConsentChoice(current, ans);
+    const on = choice === "on";
+    writeVerifyConfig(choice);
+    console.log(
+      on
+        ? `   ${G}✓${X} ${D}Live catch on — it'll re-run your own proof and flag a false "done". ${X}skalpel verify off${D} anytime.${X}\n`
+        : `   ${D}Live catch off. Turn it on anytime with ${X}skalpel verify on${D}.${X}\n`,
+    );
+  } catch {
+    /* consent is best-effort — never break setup */
+  }
+}
+
 // who's signed in — the session saved by the login flow (~/.skalpel/auth.json). Its `uid` keys the
 // hosted graph; `access_token` authenticates the upload. SKALPEL_USER overrides for dev (no token).
 // Uses auth.mjs's REFRESH-CAPABLE identity() so a token that expired since login (Supabase tokens
@@ -933,6 +1017,66 @@ async function main() {
     spawnSync("node", [join(__dir, "verify-shadow.mjs"), "--xray"], { stdio: "inherit" });
     return;
   }
+  // `skalpel verify on|off|status` — the one-command reverse for the live catch. Local, no network, no
+  // sign-in. `on`/`off` persist the consented arming to client.json (the single writer); `status` (and a
+  // bare `skalpel verify`) render the arming + FIELD-PROOF (real fires, adjudicated precision, armed-days,
+  // auto-darken state) — all from real local rows.
+  if (sub === "verify") {
+    const action = (argv[1] || "status").toLowerCase();
+    if (action === "on" || action === "off") {
+      writeVerifyConfig(action);
+      if (action === "on") {
+        console.log(
+          `\n   ${G}✓${X} Live catch ${B}armed${X}. On a "done" claim, skalpel re-runs your session's own\n` +
+            `   test/build once (twice to confirm before any red) and shows the real result.\n` +
+            `   ${D}Reverse anytime: ${X}skalpel verify off${D}  ·  see the field proof: ${X}skalpel verify status\n`,
+        );
+      } else {
+        console.log(
+          `\n   ${G}✓${X} Live catch ${B}off${X}. ${D}Re-arm anytime: ${X}skalpel verify on\n`,
+        );
+      }
+    } else if (action === "status") {
+      spawnSync("node", [join(__dir, "verify-shadow.mjs"), "--status"], { stdio: "inherit" });
+    } else {
+      console.error(`skalpel verify: unknown action \`${argv[1]}\` (use: on | off | status)`);
+      process.exitCode = 2;
+    }
+    return;
+  }
+  // `skalpel yes` / `skalpel no` — ONE-KEY ADJUDICATION of the most-recent catch (the flight recorder).
+  // Local, no network, no sign-in. Appends one NDJSON row keyed to the reveal you just saw; a "no" also
+  // suppresses that exact proof for the rest of THAT session and counts against precision (feeding the
+  // auto-darken kill-switch). Fail-open: nothing to adjudicate → an honest note, never an error.
+  if (sub === "yes" || sub === "no") {
+    const r = lastReveal();
+    if (!r || !r.proof_command) {
+      console.log(
+        `\n   ${D}No recent skalpel catch to adjudicate — nothing has surfaced yet.${X}\n` +
+          `   ${D}When skalpel flags a false "done", it'll say: was this right? ${X}skalpel yes / skalpel no\n`,
+      );
+      return;
+    }
+    const proofShort = String(r.proof_command).slice(0, 60);
+    appendAdjudication({
+      verdict: sub, // "yes" | "no"
+      reveal_ts: r.ts || null,
+      session: r.session || null,
+      proof: r.proof_command,
+    });
+    if (sub === "no") {
+      suppressProof(r.session || null, r.proof_command);
+      console.log(
+        `\n   ${G}✓${X} Marked ${B}not a real catch${X}. ${D}skalpel won't re-accuse ${X}\`${proofShort}\`${D}\n` +
+          `   for the rest of this session, and it counts against precision.${X}\n`,
+      );
+    } else {
+      console.log(
+        `\n   ${G}✓${X} Marked ${B}a real catch${X}. ${D}Thanks — this counts toward precision.${X}\n`,
+      );
+    }
+    return;
+  }
   // Persist --api/--user to ~/.skalpel/client.json so the hooks can read them without shell-env
   // plumbing (env vars SKALPEL_API / SKALPEL_USER still win at hook runtime).
   if (apiFlag || userFlag) {
@@ -971,6 +1115,10 @@ async function main() {
       `   ${G}✓${X} Signed in as ${D}${id.name ? `${id.name} · ${id.email}` : id.email || id.uid}${X}\n`,
     );
 
+  // CONSENT for the live catch (default-accept). One honest line; persisted to client.json. Non-TTY/CI
+  // never blocks (stays default OFF). Reversible anytime with `skalpel verify off`.
+  await promptVerifyConsent();
+
   // 2) find the real coding sessions in the last 30 days (the client reads; the server builds)
   const s1 = spinner(`Looking through your last ${LOOKBACK_DAYS} days of Claude Code + Codex…`);
   await sleep(500);

package/skalpel-statusline.mjs

@@ -30,7 +30,7 @@ import { readFileSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { tailLines } from "./transcript.mjs";
-import { cleanText, REVEAL_PATH, VERDICT_PATH, revealEnabled } from "./insights.mjs";
+import { cleanText, REVEAL_PATH, VERDICT_PATH, revealEnabled, autoDarkened } from "./insights.mjs";
 
 const CYAN = "\x1b[36m";
 const GREEN = "\x1b[32m";
@@ -368,9 +368,23 @@ function main() {
   // SKALPEL_VERIFY_REVEAL — when off (the default) this branch never runs and the bar is byte-identical to
   // the always-on baseline below.
   if (revealEnabled(process.env)) {
+    // AUTO-DARKEN kill-switch: once adjudicated precision drops below 90% over >= 10 `skalpel yes|no`
+    // rows, the LIVE red reveal self-pauses and the bar points at the retro `skalpel catches`
+    // (transcript-grounded — it can't flake) until the user re-arms. autoDarkened() is DERIVED from the
+    // real adjudication rows on every render (never a stored flag), so writer + reader can't drift.
+    if (autoDarkened()) {
+      process.stdout.write(
+        `${BOLD}skalpel${RESET} · ${DIM}live catch paused (precision <90%) · run: skalpel catches${RESET}`,
+      );
+      return;
+    }
     const reveal = revealNote(payload.session_id);
     if (reveal) {
-      process.stdout.write(`${BOLD}${reveal}${RESET}`);
+      // The red carries its one-key adjudication pointer — the flight recorder that feeds precision +
+      // the auto-darken kill-switch. A `skalpel no` also suppresses this exact proof for the session.
+      process.stdout.write(
+        `${BOLD}${reveal}${RESET} ${DIM}· was this right? skalpel yes / skalpel no${RESET}`,
+      );
       return;
     }
     const verdict = verdictNote();

package/verify-core.test.mjs

@@ -0,0 +1,186 @@
+// verify-core.test.mjs — pure-function unit tests for the three CRITICAL-LOGIC functions the mutation
+// harness (mutation-check.mjs) targets: detectCompletionClaim, classifyOutcome, classifyConfirm. These
+// are pure (no fs / no network), so they need no HOME isolation. Every assertion here must be tight enough
+// that flipping a predicate/branch in the function under test makes at least one case fail (survivors = 0).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  detectCompletionClaim,
+  classifyOutcome,
+  classifyConfirm,
+  hasMutatingFlag,
+  urlResponded,
+  shipUrlPass,
+} from "./verify-shadow.mjs";
+
+test("detectCompletionClaim — fires on real completion claims", () => {
+  for (const s of [
+    "All tests pass now.",
+    "I've fixed the bug.",
+    "Done — build is green.",
+    "lgtm",
+    "everything should work now",
+    "ready to merge",
+  ]) {
+    assert.equal(detectCompletionClaim(s).claim, true, `should claim: ${s}`);
+  }
+});
+
+test("detectCompletionClaim — does NOT fire on non-claims", () => {
+  for (const s of [
+    "Let me run the tests and see.",
+    "This might be broken.",
+    "Can you check whether it works?",
+    "",
+    "   ",
+  ]) {
+    assert.equal(detectCompletionClaim(s).claim, false, `should NOT claim: ${s}`);
+  }
+});
+
+test("detectCompletionClaim — returns the specific claim line, bounded to 120 chars", () => {
+  const r = detectCompletionClaim("Here is a summary.\nAll tests pass.\nMore prose.");
+  assert.equal(r.claim, true);
+  assert.equal(r.text, "All tests pass.");
+  const long = "x ".repeat(200) + "all tests pass";
+  assert.ok(detectCompletionClaim(long).text.length <= 120);
+});
+
+test("classifyOutcome — no error is a PASS", () => {
+  assert.equal(classifyOutcome(null, ""), "PASS");
+  assert.equal(classifyOutcome(undefined, "anything"), "PASS");
+});
+
+test("classifyOutcome — a real non-zero exit is a GENUINE_FAIL", () => {
+  assert.equal(classifyOutcome({ code: 1 }, "2 failed, 3 passed"), "GENUINE_FAIL");
+  assert.equal(
+    classifyOutcome({ code: 2 }, "AssertionError: expected 1 to equal 2"),
+    "GENUINE_FAIL",
+  );
+});
+
+test("classifyOutcome — broken harness is NEVER a lie (HARNESS_ERROR)", () => {
+  assert.equal(classifyOutcome({ killed: true, signal: "SIGTERM" }, "..."), "HARNESS_ERROR"); // timeout
+  assert.equal(classifyOutcome({ code: "ENOENT" }, "..."), "HARNESS_ERROR"); // missing binary/cwd
+  assert.equal(classifyOutcome({ code: 127 }, "..."), "HARNESS_ERROR"); // command not found
+  assert.equal(classifyOutcome({ code: 126 }, "..."), "HARNESS_ERROR"); // not executable
+  assert.equal(classifyOutcome({ code: 1 }, 'npm error Missing script: "test"'), "HARNESS_ERROR");
+  assert.equal(classifyOutcome({ code: 1 }, "bash: pytest: command not found"), "HARNESS_ERROR");
+});
+
+test("classifyConfirm — 2/2 GENUINE_FAIL is the ONLY confirmed catch", () => {
+  const two = classifyConfirm("GENUINE_FAIL", "GENUINE_FAIL");
+  assert.deepEqual(two, { needsConfirm: true, confirmedFail: true, unconfirmedFail: false });
+});
+
+test("classifyConfirm — a single un-reproduced fail is UNCONFIRMED (never a red)", () => {
+  for (const second of ["PASS", "HARNESS_ERROR", "REFUSED", null, undefined]) {
+    const r = classifyConfirm("GENUINE_FAIL", second);
+    assert.equal(r.needsConfirm, true, `needsConfirm for second=${second}`);
+    assert.equal(r.confirmedFail, false, `NOT confirmed for second=${second}`);
+    assert.equal(r.unconfirmedFail, true, `unconfirmed for second=${second}`);
+  }
+});
+
+test("classifyConfirm — a non-fail first run needs no confirm and is never a catch", () => {
+  for (const first of ["PASS", "HARNESS_ERROR", "REFUSED"]) {
+    const r = classifyConfirm(first, "GENUINE_FAIL");
+    assert.deepEqual(
+      r,
+      { needsConfirm: false, confirmedFail: false, unconfirmedFail: false },
+      `first=${first}`,
+    );
+  }
+});
+
+// ---- Fix 2: negation / hedge guard — a negated claim is NOT a completion claim ----
+test("detectCompletionClaim — NEGATED / hedged lines are NOT completion claims (no self-contradicting red)", () => {
+  for (const s of [
+    "not done yet, still working on it",
+    "it isn't done",
+    "this isn't fixed",
+    "won't be fixed in this PR",
+    "not fixed yet",
+    "the tests are still failing",
+    "still broken, needs another pass",
+    "tests are still red",
+    "TODO: implement the parser",
+    "to-do: wire the handler",
+    "almost done",
+    "not quite passing yet",
+    "the build does not pass",
+  ]) {
+    assert.equal(detectCompletionClaim(s).claim, false, `should NOT claim (negated): ${s}`);
+  }
+});
+
+test("detectCompletionClaim — a genuine claim still fires even alongside a negated line", () => {
+  assert.equal(detectCompletionClaim("I've fixed the bug and it works now.").claim, true);
+  const r = detectCompletionClaim("The refactor is done.\nThe auth part is not done yet.");
+  assert.equal(r.claim, true);
+  assert.equal(r.text, "The refactor is done.", "picks the non-negated positive line");
+});
+
+// ---- Fix 3: mutating-flag guard — a proof that rewrites files is refused ----
+test("hasMutatingFlag — flags that REWRITE files are caught", () => {
+  for (const [cmd, args] of [
+    ["eslint", ["--fix"]],
+    ["eslint", ["src", "--fix"]],
+    ["ruff", ["check", "--fix"]],
+    ["ruff", ["format"]],
+    ["ruff", ["format", "app.py"]],
+    ["jest", ["-u"]],
+    ["jest", ["--updateSnapshot"]],
+    ["vitest", ["--update"]],
+    ["vitest", ["-u"]],
+    ["biome", ["check", "--write"]],
+    ["prettier", ["--write", "."]],
+  ]) {
+    assert.equal(hasMutatingFlag(cmd, args), true, `mutating: ${cmd} ${args.join(" ")}`);
+  }
+});
+
+test("hasMutatingFlag — pure verify runs (and pnpm -w) are NOT mutating", () => {
+  for (const [cmd, args] of [
+    ["eslint", ["."]],
+    ["ruff", ["check"]],
+    ["ruff", ["format", "--check"]],
+    ["ruff", ["format", "--diff"]],
+    ["jest", []],
+    ["vitest", ["run"]],
+    ["biome", ["check"]],
+    ["pnpm", ["-w", "test"]], // -w = workspace-root, NOT write
+    ["npm", ["test"]],
+  ]) {
+    assert.equal(hasMutatingFlag(cmd, args), false, `NOT mutating: ${cmd} ${args.join(" ")}`);
+  }
+});
+
+// ---- Fix 1: SHIP-STATUS URL reachability — any HTTP status = live (never a red) ----
+test("shipUrlPass — any HTTP status means REACHABLE/live → NO red", () => {
+  for (const code of [200, 301, 302, 401, 403, 404, 429, 500, 502, 503]) {
+    assert.equal(shipUrlPass(`http_code=${code}`, null), true, `HTTP ${code} → reachable (no red)`);
+  }
+});
+
+test("shipUrlPass — a red requires 2/2 NO-RESPONSE; a single transient blip does not", () => {
+  assert.equal(
+    shipUrlPass("curl error: timeout", "curl error: Could not resolve host"),
+    false,
+    "2/2 no-response → decisive unreachable (red)",
+  );
+  assert.equal(
+    shipUrlPass("curl error: timeout", "http_code=200"),
+    true,
+    "no-response then response → live (no red)",
+  );
+  assert.equal(shipUrlPass("no http code: 000", "no http code: 000"), false, "000 twice → red");
+});
+
+test("urlResponded — http_code=<n> means the server answered; curl errors do not", () => {
+  assert.equal(urlResponded("http_code=503"), true);
+  assert.equal(urlResponded("http_code=200"), true);
+  assert.equal(urlResponded("curl error: timeout"), false);
+  assert.equal(urlResponded("no http code: 000"), false);
+  assert.equal(urlResponded(""), false);
+});