specfuse-loop 0.3.14__tar.gz → 0.3.15__tar.gz

{specfuse_loop-0.3.14/specfuse_loop.egg-info → specfuse_loop-0.3.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfuse-loop
-Version: 0.3.14
+Version: 0.3.15
 Summary: Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology.
 Author: Specfuse contributors
 License: Apache-2.0

{specfuse_loop-0.3.14 → specfuse_loop-0.3.15}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "specfuse-loop"
-version = "0.3.14"
+version = "0.3.15"
 description = "Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology."
 readme = "README.md"
 requires-python = ">=3.10"

specfuse_loop-0.3.15/specfuse/loop/_filelock.py

@@ -0,0 +1,44 @@
+#
+# Copyright 2026 Specfuse contributors
+# Licensed under the Apache License, Version 2.0. See LICENSE.
+#
+"""Cross-platform advisory lock for the driver's single-instance working-tree lock.
+
+The kernel must auto-release the lock on process exit, including SIGKILL, with
+no cleanup step — this is why POSIX `fcntl.flock` and Windows `msvcrt.locking`
+are used here instead of any userspace primitive. Pidfiles are ruled out: the
+pid-holder can die without a chance to remove its file, leaving a stale lock
+that stalls or is silently skipped by the next launch.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+
+def acquire_tree_lock(specfuse_dir: Path):
+    """Open .specfuse/.loop.lock and acquire a non-blocking exclusive lock.
+
+    Returns the open file object; caller keeps it alive for the process
+    lifetime — the OS auto-releases on fd/handle close or process death
+    (SIGKILL included), so no stale-lock cleanup is ever needed.
+    Raises BlockingIOError if another process already holds the lock.
+    """
+    lock_path = specfuse_dir / ".loop.lock"
+    lock_path.parent.mkdir(parents=True, exist_ok=True)
+    fd = lock_path.open("w")
+    try:
+        if sys.platform == "win32":
+            import msvcrt
+            try:
+                msvcrt.locking(fd.fileno(), msvcrt.LK_NBLCK, 1)
+            except OSError as exc:
+                raise BlockingIOError from exc
+        else:
+            import fcntl
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+    except BlockingIOError:
+        fd.close()
+        raise
+    return fd

specfuse_loop-0.3.15/specfuse/loop/data/VERSION

@@ -0,0 +1 @@
+0.3.15

{specfuse_loop-0.3.14 → specfuse_loop-0.3.15}/specfuse/loop/data/docs/getting-started.md

@@ -31,6 +31,16 @@ python3 -m pip install specfuse
 > venv) — that's what puts `specfuse-loop` / `specfuse-lint` on PATH for the gate
 > commands to find.
 
+> **Windows: Git-Bash is required.** The driver runs natively on Windows (no WSL),
+> but it routes gate commands through **Git-Bash** so a target repo's
+> `verification.yml` (`&&`, `exit 1 || exit 0`, `bats`, globs) runs unchanged.
+> Install [Git for Windows](https://gitforwindows.org/) — it ships `bash.exe`, no
+> admin and no WSL feature needed — before running the loop. The driver prefers
+> the Git-for-Windows `bash.exe` over the `C:\Windows\System32\bash.exe` WSL
+> launcher; it also normalizes `python3` gate tokens to your Windows interpreter
+> and resolves the `claude` CLI via `PATHEXT`, so gate commands authored on
+> POSIX run as-is.
+
 Enable the skills plugin in Claude Code (one-time):
 
 ```

{specfuse_loop-0.3.14 → specfuse_loop-0.3.15}/specfuse/loop/loop.py

@@ -41,12 +41,12 @@ from __future__ import annotations
 
 import argparse
 import datetime as dt
-import fcntl
 import hashlib
 import json
 import logging
 import os
 import re
+import shutil
 import signal
 import subprocess
 import sys
@@ -54,6 +54,7 @@ import time
 from dataclasses import dataclass, field
 from pathlib import Path
 
+from . import _filelock
 from . import _miniyaml
 from . import scaffold as _scaffold
 from .gate_eval import evaluate_auto_close, AutoCloseDecision
@@ -62,7 +63,7 @@ SPECFUSE_DIR = Path(".specfuse")
 REPO_ROOT = SPECFUSE_DIR.parent
 FEATURES_DIR = SPECFUSE_DIR / "features"
 VERIFICATION_PATH = SPECFUSE_DIR / "verification.yml"
-DRIVER_VERSION = "0.3.14"
+DRIVER_VERSION = "0.3.15"
 # Oldest scaffold layout this driver can drive. init.sh stamps the scaffold's own
 # version into `.specfuse/VERSION`; check_scaffold_version() fails loud at startup if
 # the consumer's scaffold is older than this, pointing at `specfuse upgrade`. Bump
@@ -471,21 +472,26 @@ def build_event(event_type: str, correlation_id: str, payload: dict) -> dict:
 
 
 # Matches macOS ("/Users/" + "<name>/") and Linux ("/home/" + "<name>/") home
-# prefixes at runtime without containing a literal "/Users/" substring in
-# source, so this file's own staged diff never re-trips the structural leak-scan.
+# prefixes, plus the Windows shape ("C:" + "\Users\" + "<name>" + "\" or "/",
+# any drive letter, case-insensitive), at runtime without containing a literal
+# "/Users/" substring in source, so this file's own staged diff never re-trips
+# the structural leak-scan.
 _HOME_PATH_RE = re.compile(r"/(?:Users|home)/[^/\s]+/")
+_WIN_HOME_PATH_RE = re.compile(r"[A-Za-z]:\\Users\\[^\\/\s]+[\\/]", re.IGNORECASE)
 _HOME_PATH_PLACEHOLDER = "<redacted-home>/"
 
 
 def _redact_home_paths(value):
     """Recursively redact absolute home-directory prefixes from a JSON-ish value.
 
-    Walks dict/list/str/scalar and replaces every "/Users/" + "<name>/" or
-    "/home/" + "<name>/" match in string leaves with a stable placeholder.
-    Other text is preserved verbatim; idempotent (a second pass is a no-op).
+    Walks dict/list/str/scalar and replaces every "/Users/" + "<name>/",
+    "/home/" + "<name>/", or Windows "<drive>:\\Users\\" + "<name>" + "\\"/"/"
+    match in string leaves with a stable placeholder. Other text is preserved
+    verbatim; idempotent (a second pass is a no-op).
     """
     if isinstance(value, str):
-        return _HOME_PATH_RE.sub(_HOME_PATH_PLACEHOLDER, value)
+        value = _HOME_PATH_RE.sub(_HOME_PATH_PLACEHOLDER, value)
+        return _WIN_HOME_PATH_RE.sub(_HOME_PATH_PLACEHOLDER, value)
     if isinstance(value, dict):
         return {k: _redact_home_paths(v) for k, v in value.items()}
     if isinstance(value, list):
@@ -1098,7 +1104,9 @@ def prepare_feature(feat_fm: dict, feature_dir: "Path", feature_id: str) -> None
     git("add", "--", *add_paths)
     staged = git("status", "--porcelain", "--", *add_paths)
     if staged:
-        git("commit", "-m", f"chore: scaffold feature {feature_id}")
+        # --no-verify: driver-authored scaffold commit, same trust context as
+        # the WU squash (issue #156) — gated by `--all` + CI, not the pre-commit.
+        git("commit", "--no-verify", "-m", f"chore: scaffold feature {feature_id}")
         print(f"Prepared: committed feature folder on branch '{branch}'.")
     else:
         print(f"Prepare: feature folder already committed on branch '{branch}'.")
@@ -1205,22 +1213,14 @@ def ensure_feature_branch(feat_fm: dict, feature_dir: "Path | None" = None) -> N
 
 
 def acquire_tree_lock(specfuse_dir: Path):
-    """Open .specfuse/.loop.lock and acquire a non-blocking exclusive flock.
+    """Open .specfuse/.loop.lock and acquire a non-blocking exclusive lock.
 
-    Returns the open file object; caller keeps it alive for the process
-    lifetime — the kernel auto-releases on fd close or process exit (SIGKILL
-    included), so no stale-lock cleanup is ever needed.
+    Delegates to `_filelock`, which selects fcntl.flock (POSIX) or
+    msvcrt.locking (Windows) by sys.platform. See `_filelock` for why the
+    kernel-auto-release property this preserves rules out pidfiles.
     Raises BlockingIOError if another process already holds the lock.
     """
-    lock_path = specfuse_dir / ".loop.lock"
-    lock_path.parent.mkdir(parents=True, exist_ok=True)
-    fd = lock_path.open("w")
-    try:
-        fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
-    except BlockingIOError:
-        fd.close()
-        raise
-    return fd
+    return _filelock.acquire_tree_lock(specfuse_dir)
 
 
 def write_cost_to_wu(backend, wu: WorkUnit, cum_usage: dict) -> None:
@@ -1390,8 +1390,15 @@ def commit_bookkeeping(paths: list, message: str) -> str | None:
     git("add", "-f", *existing)
     if not git("status", "--porcelain"):
         return None  # all paths were already in their committed state
+    # --no-verify: internal driver commits belong to the `--all` scan trust
+    # context (denylist + gitleaks), NOT the human-oriented structural
+    # pre-commit hook (issue #156). The structural regexes are deliberately
+    # excluded from `--all` as too noisy for agent-authored / fixture-heavy
+    # content; running them on the driver's own commits produces false-positive
+    # blocks. `leak_scan.py --all` + the pre-push/PR surfaces remain the gates.
     res = subprocess.run(
-        ["git", "commit", "-m", message], capture_output=True, text=True,
+        ["git", "commit", "--no-verify", "-m", message],
+        capture_output=True, text=True,
     )
     if res.returncode != 0:
         raise BookkeepingCommitError(
@@ -1476,8 +1483,14 @@ def squash_commit(
         if not git("diff", "--cached", "--name-only"):
             return None
     msg = f"feat: {wu.title}\n\nFeature: {wu.wu_id}"
+    # --no-verify: see commit_bookkeeping — the driver's WU squashes are gated
+    # by `leak_scan.py --all` + CI, not the human-oriented structural pre-commit
+    # hook (issue #156). Without this, an agent-authored fixture token the
+    # structural scan flags (but `--all` allowlists) rejects the squash and the
+    # driver blocks `spinning_detected` after 3 retries.
     res = subprocess.run(
-        ["git", "commit", "-m", msg], capture_output=True, text=True,
+        ["git", "commit", "--no-verify", "-m", msg],
+        capture_output=True, text=True,
     )
     if res.returncode != 0:
         raise SquashCommitError(
@@ -1599,6 +1612,7 @@ def dispatch(wu: WorkUnit, failure_note: str | None,
                    + truncate_failure_note(failure_note))
     cmd = [p.replace("{model}", wu.model).replace("{effort}", wu.effort)
            for p in CLAUDE_CMD]
+    cmd = resolve_claude_cmd(cmd)
     if wu.unsandboxed:
         # Per-WU sandbox-escape. Audited via the unsandboxed_dispatch event
         # emitted in run()'s attempt loop; rationale lives in WU frontmatter.
@@ -1717,6 +1731,39 @@ def extract_smoke_imports(wu_body: str) -> list[str]:
     return out
 
 
+LEADING_PYTHON3_RE = re.compile(r'^(\s*)python3\b')
+
+
+def resolve_windows_interpreter() -> str:
+    """Return the interpreter token to substitute for a leading `python3`.
+
+    Windows Python ships `python` and the `py` launcher, never `python3`. A
+    bare `python` token is the safest form to hand to Git-Bash `bash -c` —
+    unlike a raw `sys.executable` path, it has no backslashes for MSYS to
+    mangle (cross-repo contract, see GATE-02-REVIEW.md). No real-Windows-runner
+    round-trip has verified this from the sandbox; T08 owns that proof.
+    """
+    return "python"
+
+
+def normalize_interpreter(command: str) -> str:
+    """Rewrite a leading `python3` token to the Windows interpreter, else no-op.
+
+    POSIX (`sys.platform != "win32"`): returns `command` unchanged — target
+    repos and the driver's own smoke imports already assume `python3` exists.
+    Windows: rewrites ONLY a `python3` token anchored at the start of the
+    command string (optionally after leading whitespace); a `python3`
+    appearing later, e.g. inside a quoted argument, is left untouched.
+    """
+    if sys.platform != "win32":
+        return command
+    match = LEADING_PYTHON3_RE.match(command)
+    if not match:
+        return command
+    interpreter = resolve_windows_interpreter()
+    return match.group(1) + interpreter + command[match.end():]
+
+
 def run_smoke_imports(commands: list[str], cwd: Path) -> tuple[bool, str]:
     """Run each smoke-import command in `cwd` in declared order.
 
@@ -1731,6 +1778,7 @@ def run_smoke_imports(commands: list[str], cwd: Path) -> tuple[bool, str]:
     active venv per `[loop-driver-operation]`).
     """
     for cmd in commands:
+        cmd = normalize_interpreter(cmd)
         proc = subprocess.run(  # nosec B602
             cmd, shell=True, capture_output=True, text=True, cwd=str(cwd),
         )
@@ -1827,6 +1875,65 @@ def load_verification() -> dict:
     return _miniyaml.parse(VERIFICATION_PATH.read_text()) or {}
 
 
+def resolve_claude_cmd(cmd: list[str]) -> list[str]:
+    """Resolve a bare `claude` argv[0] to its executable path on Windows.
+
+    `subprocess.run(..., shell=False)` calls `CreateProcess` on Windows, which
+    does not consult `PATHEXT` — a bare `"claude"` argv[0] will not resolve to
+    the `claude.cmd` shim the Windows install ships. `shutil.which` does honor
+    `PATHEXT`, so use it to find the real executable and substitute it as
+    argv[0]; the rest of `cmd` (flags, model/effort substitution) is untouched.
+    On POSIX, `shell=False` with a bare `claude` already resolves via PATH, so
+    `cmd` is returned unchanged.
+    """
+    if sys.platform != "win32":
+        return cmd
+    resolved = shutil.which(cmd[0])
+    if not resolved:
+        raise SystemExit(
+            f"claude not found on PATH — install Claude Code or add its "
+            f"install directory to PATH (resolve_claude_cmd: "
+            f"shutil.which('{cmd[0]}') returned None)."
+        )
+    return [resolved] + cmd[1:]
+
+
+def resolve_bash() -> str | None:
+    """Resolve a Git-for-Windows `bash.exe` for routing gate commands.
+
+    Prefers deriving it from `git --exec-path` (the git-core dir inside a
+    Git-for-Windows install; `bash.exe` lives at the install's `bin/bash.exe`,
+    i.e. two levels up from git-core then into `bin`) over a bare
+    `shutil.which("bash")`, which on a Windows host can resolve to
+    `C:\\Windows\\System32\\bash.exe` — the WSL launcher, which fails with no
+    distro installed. Returns None if no Git-Bash can be found.
+    """
+    try:
+        completed = subprocess.run(
+            ["git", "--exec-path"], capture_output=True, text=True, check=True,
+        )
+        exec_path = str(completed.stdout).strip()
+        if exec_path:
+            candidate = Path(exec_path).parent.parent / "bin" / "bash.exe"
+            if candidate.is_file():
+                return str(candidate)
+    except Exception:
+        pass
+
+    # Manual PATH scan rather than shutil.which(): shutil.which's win32 branch
+    # touches _winapi, which is unavailable when running under a mocked
+    # sys.platform on a non-Windows test host.
+    for dirname in os.environ.get("PATH", "").split(os.pathsep):
+        if not dirname:
+            continue
+        for name in ("bash.exe", "bash"):
+            candidate = Path(dirname) / name
+            if candidate.is_file() and "system32" not in str(candidate).lower():
+                return str(candidate)
+
+    return None
+
+
 def verify(wu: WorkUnit, feature_dir: Path,
            cfg: dict | None = None) -> tuple[bool, str]:
     """Driver runs the gates itself — the exit oracle. Agent self-report is advisory.
@@ -1873,6 +1980,7 @@ def verify(wu: WorkUnit, feature_dir: Path,
     results, ok_all = [], True
     for gate in gate_set:
         command = gate["command"].replace("{feature_dir}", str(feature_dir))
+        command = normalize_interpreter(command)
         # shell=True is intentional: gate commands are authored by the user in
         # verification.yml and routinely use shell features (pipes, &&, glob,
         # redirects — e.g. `dotnet build && dotnet test --no-build`). The input
@@ -1883,13 +1991,41 @@ def verify(wu: WorkUnit, feature_dir: Path,
         # output pipe so communicate() stalls past the timeout):
         #  1. stdin=DEVNULL — a gate that reads stdin (e.g. a test calling input())
         #     gets EOF immediately and fails fast instead of blocking forever.
-        #  2. start_new_session + killpg on timeout — the gate runs in its own
-        #     process group; on timeout the WHOLE group (shell + grandchildren) is
+        #  2. start_new_session + killpg (POSIX) / CREATE_NEW_PROCESS_GROUP +
+        #     taskkill (Windows) on timeout — the gate runs in its own process
+        #     group; on timeout the WHOLE group (shell + grandchildren) is
         #     killed, so the timer actually returns.
+        is_win32 = sys.platform == "win32"
+        spawn_kwargs = (
+            {"creationflags": getattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0x00000200)}
+            if is_win32
+            else {"start_new_session": True}
+        )
+        if is_win32:
+            # cmd.exe (the shell=True default on Windows) does not understand
+            # the POSIX shell syntax (&&, ||, globs, pipes) that real
+            # verification.yml gate commands routinely use. Route through
+            # Git-Bash instead so gate commands run unmodified across
+            # platforms.
+            bash = resolve_bash()
+            if not bash:
+                ok_all = False
+                results.append(
+                    f"### {gate['name']}: FAIL\n```\n$ {command}\n"
+                    f"No Git-Bash found — install Git for Windows "
+                    f"(https://git-scm.com/download/win) so gate commands can "
+                    f"run through bash.exe.\n```"
+                )
+                continue
+            popen_argv = [bash, "-c", command]
+            popen_kwargs = dict(shell=False)
+        else:
+            popen_argv = command
+            popen_kwargs = dict(shell=True)  # nosec B604
         proc = subprocess.Popen(  # nosec B602
-            command, shell=True, stdin=subprocess.DEVNULL,
+            popen_argv, stdin=subprocess.DEVNULL,
             stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
-            start_new_session=True,
+            **popen_kwargs, **spawn_kwargs,
         )
         try:
             out, _ = proc.communicate(timeout=GATE_TIMEOUT_SECONDS)
@@ -1904,10 +2040,16 @@ def verify(wu: WorkUnit, feature_dir: Path,
                     ok = False
                     tail = tail + [f"DEGRADED ORACLE: {degraded}"]
         except subprocess.TimeoutExpired:
-            try:
-                os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
-            except (ProcessLookupError, PermissionError):
-                proc.kill()
+            if is_win32:
+                subprocess.run(
+                    ["taskkill", "/T", "/F", "/PID", str(proc.pid)],
+                    capture_output=True,
+                )
+            else:
+                try:
+                    os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
+                except (ProcessLookupError, PermissionError):
+                    proc.kill()
             out, _ = proc.communicate()
             ok = False
             tail = (out or "").strip().splitlines()[-10:] + [
@@ -2400,7 +2542,17 @@ def write_stub_retrospective_terminal(
         f"- predicate_version: {decision.predicate_version}\n"
         f"- gate_total_cost: ${total_cost:.2f}\n"
         f"- gate_budget: {budget_str}\n"
-        f"- reasons: [] (auto=True)\n"
+        f"- reasons: [] (auto=True)\n\n"
+        # issue #157: terminal auto-close skips the close body AND has no
+        # downstream gate to catch the gap — the operator is the last line.
+        f"## What the loop did NOT verify (gate {gate_number})\n\n"
+        f"This terminal gate auto-closed on-plan; the full close ceremony did not\n"
+        f"run, so the per-criterion deferred-verification list was **not**\n"
+        f"enumerated, and there is no downstream gate to reconcile it. Before\n"
+        f"treating the feature as fully verified, the operator MUST confirm every\n"
+        f"acceptance criterion was actually verified in-loop (not only by artifact\n"
+        f"shape). Any AC deferred to a post-merge or real-system step must be\n"
+        f"recorded and completed now.\n"
     )
     if retro.exists():
         with retro.open("a") as fh:
@@ -2528,7 +2680,18 @@ def append_stub_retrospective_intermediate(
         f"- predicate_version: {decision.predicate_version}\n"
         f"- gate_total_cost: ${total_cost:.2f}\n"
         f"- gate_budget: {budget_str}\n"
-        f"- reasons: [] (auto=True)\n"
+        f"- reasons: [] (auto=True)\n\n"
+        # issue #157: the auto-close path skips the close-intermediate body, so
+        # the per-criterion deferred-verification list is never enumerated. Emit
+        # an explicit marker rather than silently omitting it — the predicate
+        # cannot reason over ACs, so it flags the gap for downstream reconciliation.
+        f"## What the loop did NOT verify (gate {gate_number})\n\n"
+        f"This gate auto-closed on-plan; the full close-intermediate ceremony did\n"
+        f"not run, so the per-criterion deferred-verification list was **not**\n"
+        f"enumerated. Any acceptance criterion whose verification is deferred\n"
+        f"(loop-sandbox limit, cross-repo coordination, real-system access) is\n"
+        f"unrecorded here. Gate {gate_number + 1}'s close MUST reconcile these\n"
+        f"before the feature's terminal verdict — auto-close cannot enumerate them.\n"
     )
     if retro.exists():
         with retro.open("a") as fh:
@@ -4342,7 +4505,21 @@ def auto_sync(
         _persist_scaffold_sync(installed)
 
 
+def _force_utf8_console() -> None:
+    """Force stdout/stderr to UTF-8 so the driver's non-ASCII console glyphs
+    (↳, ═, ⚠, — …) don't crash on Windows, whose default console codepage is
+    cp1252 (`UnicodeEncodeError: 'charmap' codec can't encode ...`). No-op on
+    POSIX, which is already UTF-8. `reconfigure` exists on the standard
+    text streams (Python ≥ 3.7); guard for the case where stdout has been
+    replaced by a stream that lacks it (e.g. a captured buffer in tests)."""
+    for stream in (sys.stdout, sys.stderr):
+        reconfigure = getattr(stream, "reconfigure", None)
+        if reconfigure is not None:
+            reconfigure(encoding="utf-8")
+
+
 def main() -> int:
+    _force_utf8_console()
     ap = argparse.ArgumentParser(description="Specfuse loop driver (single-repo).")
     ap.add_argument("--feature", help="Feature dir name under .specfuse/features/ "
                     "(optional if exactly one feature is active).")

{specfuse_loop-0.3.14 → specfuse_loop-0.3.15/specfuse_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: specfuse-loop
-Version: 0.3.14
+Version: 0.3.15
 Summary: Local-first executor for the Specfuse Plan + Work Unit gate-cycle methodology.
 Author: Specfuse contributors
 License: Apache-2.0

{specfuse_loop-0.3.14 → specfuse_loop-0.3.15}/specfuse_loop.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ NOTICE
 README.md
 pyproject.toml
 specfuse/loop/__init__.py
+specfuse/loop/_filelock.py
 specfuse/loop/_miniyaml.py
 specfuse/loop/adopt_feature.py
 specfuse/loop/gate_eval.py
@@ -44,15 +45,20 @@ specfuse_loop.egg-info/top_level.txt
 tests/test_adopt_feature.py
 tests/test_arm_gate_edits_uncommitted.py
 tests/test_attempt_outcome_emission.py
+tests/test_autoclose_deferral_visibility.py
 tests/test_autosync.py
 tests/test_autosync_consent.py
 tests/test_autosync_firstrun.py
 tests/test_autosync_plugin.py
 tests/test_backend.py
+tests/test_bash_routing.py
 tests/test_bookkeeping_commit_crash_run.py
 tests/test_bookkeeping_commit_hook_crash.py
+tests/test_bookkeeping_no_verify.py
+tests/test_claude_resolution.py
 tests/test_close_wu_self_reference.py
 tests/test_closing_deliverable_guard.py
+tests/test_console_encoding.py
 tests/test_cost_tracking.py
 tests/test_degraded_oracle.py
 tests/test_deliverable_presence_gate.py
@@ -65,6 +71,7 @@ tests/test_ensure_feature_branch.py
 tests/test_ensure_feature_branch_base.py
 tests/test_events_redaction.py
 tests/test_extra_gates.py
+tests/test_filelock_portable.py
 tests/test_force_full_close.py
 tests/test_gate_eval.py
 tests/test_gate_eval_calibration.py
@@ -76,6 +83,7 @@ tests/test_git_env_isolation.py
 tests/test_hashed_denylist.py
 tests/test_hashed_denylist_ci.py
 tests/test_init_integration.py
+tests/test_interpreter_normalization.py
 tests/test_leak_findings_redaction.py
 tests/test_leak_scan.py
 tests/test_leak_scan_content.py
@@ -116,6 +124,7 @@ tests/test_planned_cost_lint.py
 tests/test_prepare_feature.py
 tests/test_prepare_scaffold_sync.py
 tests/test_produces_field.py
+tests/test_redaction_windows_home.py
 tests/test_resolve_base.py
 tests/test_result_block.py
 tests/test_roadmap_add_skill.py
@@ -135,6 +144,7 @@ tests/test_squash_commit_hook_crash.py
 tests/test_template_closing_shapes.py
 tests/test_terminal_flip_ownership.py
 tests/test_terminal_flips.py
+tests/test_timeout_kill_portable.py
 tests/test_untracked_feature_folder.py
 tests/test_untracked_file_absorption.py
 tests/test_upgrade_integration.py
@@ -144,4 +154,5 @@ tests/test_verdict_coupling.py
 tests/test_verify_empty_gate_set.py
 tests/test_version_consistency.py
 tests/test_version_skew.py
+tests/test_windows_gate_exec.py
 tests/test_wu_execution_metadata.py

specfuse_loop-0.3.15/tests/test_autoclose_deferral_visibility.py

@@ -0,0 +1,67 @@
+# Copyright 2026 Specfuse contributors
+# Licensed under the Apache License, Version 2.0. See LICENSE.
+#
+# Issue #157: the auto-close path marks a close/close-intermediate WU done
+# without dispatching its body, so the mandatory "What the loop did NOT verify"
+# deferral list is never written. The auto-close stub writers must instead emit
+# an explicit deferral-visibility section so the gap is surfaced (direction 2),
+# not silently omitted — for BOTH the intermediate and terminal stubs.
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from tests._loop_loader import load_loop
+
+loop = load_loop()
+from specfuse.loop.gate_eval import AutoCloseDecision  # noqa: E402
+
+
+def _decision(gate: int) -> AutoCloseDecision:
+    return AutoCloseDecision(
+        auto=True,
+        reasons=[],
+        metrics={"gate_total_cost": 1.23, "gate_budget": 5.0},
+        gate_id=gate,
+        feature_id="FEAT-TEST-0001",
+        predicate_version="v1",
+    )
+
+
+class TestAutoCloseDeferralVisibility(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.fd = Path(self._tmp.name)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _retro(self) -> str:
+        return (self.fd / "RETROSPECTIVE.md").read_text()
+
+    def test_intermediate_stub_flags_deferred_verification_gap(self):
+        """The intermediate auto-close stub emits a 'What the loop did NOT
+        verify' section pointing reconciliation at the next gate's close."""
+        loop.append_stub_retrospective_intermediate(self.fd, 1, _decision(1))
+        retro = self._retro()
+        self.assertIn("## What the loop did NOT verify", retro)
+        self.assertIn("Gate 2's close", retro)  # next-gate reconciliation
+
+    def test_terminal_stub_flags_deferred_verification_gap(self):
+        """The terminal auto-close stub emits a 'What the loop did NOT verify'
+        section pointing reconciliation at the operator (no downstream gate)."""
+        loop.write_stub_retrospective_terminal(self.fd, 2, _decision(2))
+        retro = self._retro()
+        self.assertIn("## What the loop did NOT verify", retro)
+        self.assertIn("operator", retro.lower())
+
+    def test_intermediate_stub_still_records_cost_and_gate_heading(self):
+        """Existing stub content is preserved (cost, gate heading)."""
+        loop.append_stub_retrospective_intermediate(self.fd, 1, _decision(1))
+        retro = self._retro()
+        self.assertIn("## Gate 1 — auto-closed", retro)
+        self.assertIn("gate_total_cost: $1.23", retro)
+
+
+if __name__ == "__main__":
+    unittest.main()