From e352767981863ca8519a4ab3b053c0c2251dee17 Mon Sep 17 00:00:00 2001 From: Daniel Ochoa Date: Thu, 10 Sep 2026 11:26:33 -0500 Subject: [PATCH] Harden shared host decision tables - Add shared host reachability to the decision-table skill, edge-case expansion, artifact format, and review-prevention pass. - Require passive-entry, explicit-action, and non-primary entry-point coverage for shared wrappers, middleware, dispatchers, schedulers, root components, job runners, and callback registries. - Bump the code plugin to v1.14.11 and update changelog and README documentation. Testing: uv run --frozen --group dev pytest plugins/code/tools/python/test_decision_table_skill_contract.py; uv run --frozen --group dev pytest plugins/code/tools/python; uv run --frozen --group dev ruff check .; uv run --frozen --group dev pyright; git diff --check Risks: Low; guidance and contract-test change only. --- CHANGELOG.md | 5 ++ plugins/code/.claude-plugin/plugin.json | 2 +- plugins/code/README.md | 2 +- plugins/code/skills/decision-table/SKILL.md | 6 +- .../references/artifact-format.md | 3 + .../decision-table/references/edge-cases.md | 8 ++- .../references/review-prevention.md | 62 ++++++++++--------- .../test_decision_table_skill_contract.py | 14 +++++ 8 files changed, 66 insertions(+), 36 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ec24011e..c00f0ee2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ All notable changes to the claude-plugins project will be documented in this fil The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Entries are listed newest-first; each plugin section is treated as released when merged to `main`. +### code v1.14.11 + +#### Changed +- The `decision-table` skill now treats shared hosts as a first-class reachability case. Tables must inventory inherited entry-point classes, distinguish passive entry from explicit actions, and require non-primary entry-point coverage when a shared wrapper, middleware, dispatcher, scheduler, root component, callback registry, or other common container can trigger behavior outside its intended entry path. + ### code-review v3.7.1 #### Fixed diff --git a/plugins/code/.claude-plugin/plugin.json b/plugins/code/.claude-plugin/plugin.json index 75a12754..1e47cf73 100644 --- a/plugins/code/.claude-plugin/plugin.json +++ b/plugins/code/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "code", "description": "Code and planning framework plugin", - "version": "1.14.10", + "version": "1.14.11", "author": { "name": "ClosedLoop", "email": "support@closedloop.ai" diff --git a/plugins/code/README.md b/plugins/code/README.md index 4e368cf8..e4c5afad 100644 --- a/plugins/code/README.md +++ b/plugins/code/README.md @@ -308,7 +308,7 @@ Runs Codex to review a plan file and returns structured feedback with a verdict. ### `decision-table` -Generates a repo-local decision-table artifact that makes control-flow and stateful edge cases reviewable. Used when the user wants a code-grounded table for current behavior, wants to compare current behavior against a plan or work item, or needs a control-flow artifact for recovery, retry, finalization, validation, state-machine, or review-heavy edge cases. Writes one artifact per work item under `.closedloop-ai/decision-tables/` (`.md` for plan-scoped work, `.md` otherwise) using the format defined in `references/artifact-format.md`. Builds the `Current Code` table from code (not expectations), captures the target behavior in `Intended Change`, and freezes both once implementation begins; post-implementation drift is recorded in append-only `Verification Findings`, `Adversarial Review`, `Fixes Applied`, `Final Alignment Status`, and optional `Plan Clarifications` sections. Includes a behavioral edge-case expansion pass that explicitly models structured-result setup failures, library-managed lifecycle re-entry, published contract compatibility, CLI flag parsing, filesystem read/write safety, time-bound credentials/signatures, durable finalization and replay eligibility, diagnostic reason taxonomies, and side-effect boundaries for validation failures. The artifact also records `Evidence Artifacts` for high-yield coverage and non-applicability claims, distinguishing named fail-closed test coverage from source-backed `not applicable` evidence, and supports coordinator-run adversarial lanes with a sequential fallback for subagents that cannot delegate. +Generates a repo-local decision-table artifact that makes control-flow and stateful edge cases reviewable. Used when the user wants a code-grounded table for current behavior, wants to compare current behavior against a plan or work item, or needs a control-flow artifact for recovery, retry, finalization, validation, state-machine, or review-heavy edge cases. Writes one artifact per work item under `.closedloop-ai/decision-tables/` (`.md` for plan-scoped work, `.md` otherwise) using the format defined in `references/artifact-format.md`. Builds the `Current Code` table from code (not expectations), captures the target behavior in `Intended Change`, and freezes both once implementation begins; post-implementation drift is recorded in append-only `Verification Findings`, `Adversarial Review`, `Fixes Applied`, `Final Alignment Status`, and optional `Plan Clarifications` sections. Includes a behavioral edge-case expansion pass that explicitly models structured-result setup failures, shared host reachability, library-managed lifecycle re-entry, published contract compatibility, CLI flag parsing, filesystem read/write safety, time-bound credentials/signatures, durable finalization and replay eligibility, diagnostic reason taxonomies, and side-effect boundaries for validation failures. The artifact also records `Evidence Artifacts` for high-yield coverage and non-applicability claims, distinguishing named fail-closed test coverage from source-backed `not applicable` evidence, and supports coordinator-run adversarial lanes with a sequential fallback for subagents that cannot delegate. ### `design-inventory` diff --git a/plugins/code/skills/decision-table/SKILL.md b/plugins/code/skills/decision-table/SKILL.md index 6915879f..6bb239b3 100644 --- a/plugins/code/skills/decision-table/SKILL.md +++ b/plugins/code/skills/decision-table/SKILL.md @@ -27,9 +27,9 @@ Keep multiple behavior areas as sections inside the same artifact. Only split in 3. Read the plan first (if any) and extract only behaviorally relevant requirements. 4. Read repo-level guardrails as co-equal requirements: agent instruction files (`AGENTS.md`, `CLAUDE.md`), compatibility rules, contributor docs, API contracts. If the plan and guardrails conflict, record the tension in the artifact, add a `Plan Clarifications` note when appropriate, and surface the conflict to the user if it affects implementation or review. 5. Read the actual code paths. Build the table from code, not expectations. -6. For shared routes, handlers, helpers, contracts, or policy surfaces, build a call-site inventory before choosing axes. Search for literal route paths, exported helper names, feature flag keys, rollout keys, query parameters, cache key segments, environment variable names, storage keys, event names, command names, plugin or marketplace identifiers, header/reason/status strings, and shared types. For each caller, record what data it can supply, what response shapes/statuses it expects, peer version skew, and how missing/unknown fields degrade. Classify each literal by semantic purpose and source of truth; do not treat similar-looking strings as aliases unless a shared constant, documented contract, or existing compatibility path proves they are aliases. +6. For shared routes, handlers, helpers, contracts, hosts, or policy surfaces, build a call-site inventory before choosing axes. Search for literal route paths, exported helper names, feature flag keys, rollout keys, query parameters, cache key segments, environment variable names, storage keys, event names, command names, plugin or marketplace identifiers, header/reason/status strings, shared mounts or registrations, and shared types. For each caller, record what data it can supply, what response shapes/statuses it expects, peer version skew, and how missing/unknown fields degrade. For shared hosts, distinguish passive entry from explicit user or operator actions and include non-primary entry points that inherit the host, not only the entry point the feature is meant to guide. Classify each literal by semantic purpose and source of truth; do not treat similar-looking strings as aliases unless a shared constant, documented contract, or existing compatibility path proves they are aliases. 7. For dependencies, model success, null/absent, validation failure, and thrown/rejected branches whenever externally visible behavior depends on them. -8. Run the behavioral edge-case expansion pass. Apply every category in `references/edge-cases.md`. Each must be represented by rows or an explicit non-applicability note with source-backed evidence. When multiple evidence, authority, history, or fallback sources can coexist, add a bounded interaction pass: cover pairwise and high-risk intersections instead of an unbounded Cartesian product, including legacy/absent plus fresh valid, corrupt/undated plus fresh valid, irrelevant historical plus current authoritative, tied/conflicting current records, and source/state precedence. For distributed command, signing, key, capability, or cross-process state work, treat web app, backend, Electron, local store, OS notification, cache, and remote peer behavior as separate surfaces unless code proves they are the same surface. +8. Run the behavioral edge-case expansion pass. Apply every category in `references/edge-cases.md`. Each must be represented by rows or an explicit non-applicability note with source-backed evidence. When multiple evidence, authority, history, or fallback sources can coexist, add a bounded interaction pass: cover pairwise and high-risk intersections instead of an unbounded Cartesian product, including legacy/absent plus fresh valid, corrupt/undated plus fresh valid, irrelevant historical plus current authoritative, tied/conflicting current records, and source/state precedence. For distributed command, signing, key, capability, or cross-process state work, treat client app, server, desktop or native runtime, local store, notification layer, cache, and remote peer behavior as separate surfaces unless code proves they are the same surface. 9. Choose a small set of state axes that explain the branch behavior. Reuse the same axes within a behavior area across `Current Code` and `Intended Change`. 10. Write the artifact using `references/artifact-format.md`. 11. When a plan is in scope, include `Current Code`, `Intended Change`, `Delta Checklist`, and `Required Tests`. When no plan is in scope, omit `Intended Change` and focus on the current-state table plus gaps or suspicious branches. @@ -73,7 +73,7 @@ Do not mark `Final Alignment Status: Aligned` solely on the basis of unavailable - Prefer rows over prose. If a behavioral difference matters, capture it as a row. - Keep wording compact and behaviorally specific. Use clickable file links and plan IDs/URLs for non-obvious rows. -- Treat an entry path as actual caller plus capabilities, not just a route or module name. Include rows for callers that cannot supply newly required headers, proof material, payload fields, or response handling. +- Treat an entry path as actual caller plus capabilities, not just a route or module name. Include rows for callers that cannot supply newly required headers, proof material, payload fields, or response handling. For shared hosts, include passive entry on every inherited entry-point class plus explicit resume/start/dispatch actions. - Call out parity requirements between entry paths (live vs recovery, upload vs replay, retry vs terminal, middleware vs direct, internal vs external). When two entry paths must enforce the same policy, final verification should confirm a shared helper or focused parity tests unless duplication is intentionally documented. - When one behavior or policy has multiple executable twins (for example a pure helper, SQL predicate, route, worker, producer, or recovery path), use one shared scenario corpus to exercise every twin through its real production boundary and assert identical decisions. Source-string, AST-presence, and SQL-shape assertions are supplemental only and never prove behavioral parity. Treat a negative source-shape assertion that requires a predicate or policy term to be absent as suspicious: if it pins a missing predicate or permits divergence, record it as `Not aligned` until corrected. - For cross-surface state changes, include how each affected replica or process learns about the write, what durable source of truth resolves disagreement, and how missed events, offline peers, refreshes, reconnects, polling, heartbeats, and startup recovery converge. diff --git a/plugins/code/skills/decision-table/references/artifact-format.md b/plugins/code/skills/decision-table/references/artifact-format.md index d5cb25c7..9ccb6f50 100644 --- a/plugins/code/skills/decision-table/references/artifact-format.md +++ b/plugins/code/skills/decision-table/references/artifact-format.md @@ -42,6 +42,7 @@ Record evidence for high-yield coverage and non-applicability claims. Paste conc | filesystem/path write | symlink/clobber/bounds/canonicalization evidence and tests | ... | covered / not applicable / not aligned | | new trusted/persisted field | source, forgeability, validation/guard, legacy behavior, and mutation test | ... | covered / not applicable / not aligned | | replay/idempotency behavior | replay path test through production sequencing, not only helper state | ... | covered / not aligned | +| shared host reachability | entry-point inventory and passive-entry tests for inherited entry points, not only the primary entry point or explicit action | ... | covered / not aligned | | integration-boundary coverage claim | named test entering through CLI, route, package export, worker/job, replay, ingest, attribution, or public API | ... | covered / not aligned | ## Behavioral Edge-Case Expansion @@ -49,6 +50,7 @@ Record evidence for high-yield coverage and non-applicability claims. Paste conc Apply every category in [`edge-cases.md`](edge-cases.md). Each must be represented by rows or an explicit non-applicability note with source-backed evidence before marking `Final Alignment Status: Aligned`. The bullets below are placeholder shape — the canonical list is in `edge-cases.md`; do not skip categories that are absent from this template. - Structured-result setup failures: +- Shared host reachability: - External contract literal binding: - Library-managed lifecycle re-entry: - Cross-surface propagation and reconciliation: @@ -163,6 +165,7 @@ Guidelines: - Keep data visibility rows separate from side-effect rows such as notifications, dispatches, telemetry, cleanup, and deduplication. - For capability- or operation-gated behavior, include fresh cache, stale false negative, stale false positive, old peer, fallback, retry, and reconciliation rows. - For legacy persisted records missing new fields, include conservative defaults, evidence-backed promotion/backfill, downgrade behavior, and manual-record protection. +- For shared hosts, include every inherited entry-point class and distinguish passive entry from explicit actions, with non-primary entry-point coverage when the host can trigger behavior outside its intended entry path. - For distributed command/key/signing workflows, include register/create, approval/authorization, normal command, revoke/delete, offline/reconnect reconciliation, repeated action/idempotency, and stale UI/cache scenarios. - Every nontrivial row should include file or plan references. - Mark inferred target-state behavior explicitly when the plan implies it but does not say it directly. diff --git a/plugins/code/skills/decision-table/references/edge-cases.md b/plugins/code/skills/decision-table/references/edge-cases.md index 1bd41caf..2fcf3bca 100644 --- a/plugins/code/skills/decision-table/references/edge-cases.md +++ b/plugins/code/skills/decision-table/references/edge-cases.md @@ -18,6 +18,12 @@ Include rows for synchronous preparation failures before fetch/await/return: URL When a helper, service, adapter, route, command, job, or handler can be called by more than one path, include rows for the invariants it must enforce itself even when current callers validate first, especially before network I/O, persistence, credentials, filesystem mutation, or other durable side effects. Do not rely only on caller-side validation: either the boundary enforces its own invariants, or record why it is intentionally private/single-caller and how that is kept true. +## Shared host reachability + +When behavior is installed by a shared host above multiple entry points, include rows for every entry-point class that inherits the host, not only the feature's primary entry point. Hosts include shared wrappers, root components, providers, middleware, dispatchers, schedulers, route groups, job runners, callback registries, and other common containers. Distinguish passive entry such as navigation, refresh, replay, scheduled execution, callback delivery, or automatic retry from explicit start, resume, continue, dispatch, retry, or recovery actions. If product, plan, or guardrail text forbids an automatic takeover, replayed prompt, blocking gate, or side effect for already-satisfied users or records, include rows proving legacy and already-complete states stay non-blocked on at least one non-primary inherited entry point. + +**Tests:** require a positive control for the intended entry path, a passive-entry negative case on a non-primary inherited entry point, and a legacy or already-complete state case when persisted state, consent, setup, or policy records can be absent. + ## Executable policy twins and parity When the same behavior or policy is implemented by more than one executable path (for example a pure helper, SQL predicate, route, worker, producer, batch path, or recovery path), inventory every twin and identify its real production boundary. Build one shared scenario corpus and run every twin against it so the test proves identical decisions for identical inputs. @@ -90,7 +96,7 @@ Include rows for success, validation failure, dependency failure, cancellation/t When a write affects multiple processes, replicas, apps, windows, stores, or peers, include rows for how every affected surface learns about the write. Cover immediate push/control events, polling, heartbeat, reconnect, startup, manual refresh, missed event, offline recovery, and the durable source of truth that wins when surfaces disagree. -For distributed browser-command, key, authorization, or signing workflows, model the web app, backend, Electron process, local trusted-key store, OS notification layer, command dispatcher, and remote peer separately unless implementation proves two surfaces share the same state and lifecycle. +For distributed client-command, key, authorization, or signing workflows, model the client app, server, desktop or native process, local trusted-key store, notification layer, command dispatcher, and remote peer separately unless implementation proves two surfaces share the same state and lifecycle. **Tests:** require at least one immediate propagation assertion and one delayed or missed-event reconciliation assertion. The test must prove the affected consumer changed behavior, not only that the source write succeeded. diff --git a/plugins/code/skills/decision-table/references/review-prevention.md b/plugins/code/skills/decision-table/references/review-prevention.md index 6680c09d..68a6a959 100644 --- a/plugins/code/skills/decision-table/references/review-prevention.md +++ b/plugins/code/skills/decision-table/references/review-prevention.md @@ -14,36 +14,37 @@ Coverage and evidence disposition rule: any `covered` or `already covered` dispo 4. **Feature-flag, rollout, or permission path** that bypasses the intended gate or uses the wrong identity. 5. **Caller or version-skew path** that cannot supply a newly required field, header, proof, or response shape. 6. **Duplicated policy, helper, constant, or wire-contract logic** that should be shared or parity-tested. -7. **External contract literal collision** where a feature flag key, rollout name, query parameter, cache segment, header, event name, command name, storage key, plugin identifier, URL scheme, reason string, or status value is confused with a similarly named internal label or unrelated contract. -8. **Permissive test mock hides a wrong external key** because the mock returns enabled, valid, found, or accepted for any feature flag, header, query parameter, event, cache key, storage key, command name, or plugin identifier instead of failing closed unless the exact expected literal is used. -9. **Test that asserts only that something failed**, without proving the specific invariant, fallback, binding, or diagnostic reason from the table. -10. **Cleanup/finalizer state scoped too narrowly** for the cleanup mechanism that runs on error, cancellation, signal, trap, retry, process exit, disposal, or a language cleanup block. -11. **Durable output using raw input** after validation used an expanded, normalized, canonical, resolved, or otherwise transformed value. -12. **Validation checks a different representation** than the value later consumed by a decision, side effect, output, or boundary payload. -13. **State produced inside an isolated execution context** that is assumed to be available to a later phase without an explicit return, output, persistence, recomputation, or other propagation mechanism. -14. **Distinct modeled states with indistinguishable observable output** where the table or user-facing copy treats the states as meaningfully different, but the implemented status, message, action availability, styling, telemetry, or response signal is identical unless that parity is explicitly intentional. -15. **Replay or continuation path bypasses an initial-entry gate** such as a command guard, policy check, validation step, target resolver, or health check. -16. **Owner-scoped pending state leaks across surfaces** because loading, disabled, or label state reads a global pending/checking flag without matching the current owner, command, document, target, or attempt id. -17. **Sentinel value semantics collapse** where omitted, `undefined`, `null`, empty, and explicit values have different downstream meaning but are defaulted, coalesced, or serialized as the wrong shape. -18. **Adapter-variant error metadata mismatch** where code maps a dependency or database error by only one metadata shape even though the dependency may report an equivalent signal as a constraint name, field array, column array, structured object, missing metadata, or legacy/unknown value. -19. **Existing-data migration blocker** where a new unique constraint or stricter persisted invariant assumes all existing rows already satisfy the invariant instead of cleaning, backfilling, or explicitly preflighting violating rows before the constraint is created. -20. **Cleanup-induced adjacent constraint failure** where a migration repair satisfies the new invariant but leaves stale identity, reference, or preference state that makes the next normal application update fail on another constraint. -21. **Terminal local state not recoverable after external finalization failure** where a job, event, marker, status, or artifact is persisted locally but the external post, upload, acknowledgement, or finalization fails, and recovery cannot replay it because eligibility fields are missing or required credentials, tokens, signatures, secrets, locks, or marker data were deleted. -22. **Cross-surface write with no reconciliation path** where a web/backend/local write updates one surface but another process, replica, Electron runtime, cache, or peer only changes after manual refresh or never converges after missed events, offline time, reconnect, heartbeat, poll, or startup. -23. **Visible data mistaken for fired side effect** where a key, command, notification, badge, telemetry event, dispatch, cleanup, or prompt appears in a list/cache/view but the operational side effect never fires, repeats incorrectly, or lacks a dedupe rule. -24. **Stale cached capability false negative or false positive** where supported-operation or peer-capability cache causes a required safety action to be skipped, dispatches an unsupported command without fallback, or never reconciles after authoritative peer evidence changes. -25. **Legacy persisted record promoted or deleted without evidence** where missing provenance, source, trust, ownership, or capability fields default too optimistically, backfill without authoritative proof, downgrade unsafely, or treat manual/local records as managed remote records. -26. **Distributed lifecycle gap** where register/create, approval/authorization, normal command, revoke/delete, offline/reconnect reconciliation, repeated action/idempotency, or stale UI/cache behavior lacks its own row and required test. -27. **Derivation reads the incoming patch instead of merged state** where an upsert or partial update triggers a derived field, reducer, stamped value, or validation that consumes only the incoming patch rather than the post-merge result (existing state union patch), so a single-field or partial update that omits an identity or state field the derivation depends on produces a stale or wrong derived value. -28. **Gate-versus-filter predicate divergence** where the same eligibility, completion, or terminal predicate is enforced at one site (a gate) but re-derived independently at another (a list filter, a terminal or disposition check, a batch or unscoped routing path, or an early short-circuit), and the two derivations can disagree because they do not share a helper. -29. **Coverage claim without a fail-closed test** where a `covered` or `already covered` disposition cites no test, or cites only a happy-path assertion, instead of a named test that fails closed on the wrong-input or negative case (including security findings). -30. **Integration-boundary coverage backed only by helper tests** where a CLI, route handler, package export, worker/job, replay path, ingest pipeline, attribution pipeline, or public API is claimed covered by a pure helper test that never exercises production wiring through the real boundary. -31. **Non-applicability claim without source evidence** where a `not applicable` disposition says a surface has no consumers, no exported contract, no filesystem path, no legacy records, no compatibility path, or no untrusted input without grep output, export/package inventory, call-site inventory, schema/query inventory, or exact code references proving the claim. -32. **Singleton-only source coverage** where multiple evidence, authority, history, cache, or fallback sources can coexist but the table never exercises legacy/absent plus fresh valid, corrupt/undated plus fresh valid, irrelevant historical plus current authoritative, tied/conflicting current records, or source/state precedence. -33. **Executable-twin parity inferred from separate tests** where a helper, SQL predicate, route, worker, producer, batch path, or recovery path reimplements one policy but no shared scenario corpus exercises every twin through its real production boundary. -34. **Source-shape assertion pins missing policy** where a negative source-string, AST, or SQL-shape assertion requires a predicate, identity term, join, or branch to be absent and thereby preserves divergence instead of testing behavior. -35. **Required test not traceable to decision rows** where a test is listed without stable row IDs, or lacks the wrong-input or mixed-state negative case needed to distinguish the row's branch. -36. **Not-aligned status treated as success** where a caller proceeds to PR creation, merge, completion, or a success closeout despite unresolved `Final Alignment Status: Not aligned`. +7. **Shared host fires outside its intended entry path** where behavior installed by a shared wrapper, provider, middleware, dispatcher, scheduler, route group, root component, job runner, callback registry, or other common container is modeled only on the primary entry point or explicit action, while passive entry on inherited non-primary entry points can still trigger it. +8. **External contract literal collision** where a feature flag key, rollout name, query parameter, cache segment, header, event name, command name, storage key, plugin identifier, URL scheme, reason string, or status value is confused with a similarly named internal label or unrelated contract. +9. **Permissive test mock hides a wrong external key** because the mock returns enabled, valid, found, or accepted for any feature flag, header, query parameter, event, cache key, storage key, command name, or plugin identifier instead of failing closed unless the exact expected literal is used. +10. **Test that asserts only that something failed**, without proving the specific invariant, fallback, binding, or diagnostic reason from the table. +11. **Cleanup/finalizer state scoped too narrowly** for the cleanup mechanism that runs on error, cancellation, signal, trap, retry, process exit, disposal, or a language cleanup block. +12. **Durable output using raw input** after validation used an expanded, normalized, canonical, resolved, or otherwise transformed value. +13. **Validation checks a different representation** than the value later consumed by a decision, side effect, output, or boundary payload. +14. **State produced inside an isolated execution context** that is assumed to be available to a later phase without an explicit return, output, persistence, recomputation, or other propagation mechanism. +15. **Distinct modeled states with indistinguishable observable output** where the table or user-facing copy treats the states as meaningfully different, but the implemented status, message, action availability, styling, telemetry, or response signal is identical unless that parity is explicitly intentional. +16. **Replay or continuation path bypasses an initial-entry gate** such as a command guard, policy check, validation step, target resolver, or health check. +17. **Owner-scoped pending state leaks across surfaces** because loading, disabled, or label state reads a global pending/checking flag without matching the current owner, command, document, target, or attempt id. +18. **Sentinel value semantics collapse** where omitted, `undefined`, `null`, empty, and explicit values have different downstream meaning but are defaulted, coalesced, or serialized as the wrong shape. +19. **Adapter-variant error metadata mismatch** where code maps a dependency or database error by only one metadata shape even though the dependency may report an equivalent signal as a constraint name, field array, column array, structured object, missing metadata, or legacy/unknown value. +20. **Existing-data migration blocker** where a new unique constraint or stricter persisted invariant assumes all existing rows already satisfy the invariant instead of cleaning, backfilling, or explicitly preflighting violating rows before the constraint is created. +21. **Cleanup-induced adjacent constraint failure** where a migration repair satisfies the new invariant but leaves stale identity, reference, or preference state that makes the next normal application update fail on another constraint. +22. **Terminal local state not recoverable after external finalization failure** where a job, event, marker, status, or artifact is persisted locally but the external post, upload, acknowledgement, or finalization fails, and recovery cannot replay it because eligibility fields are missing or required credentials, tokens, signatures, secrets, locks, or marker data were deleted. +23. **Cross-surface write with no reconciliation path** where a client/server/local write updates one surface but another process, replica, desktop or native runtime, cache, or peer only changes after manual refresh or never converges after missed events, offline time, reconnect, heartbeat, poll, or startup. +24. **Visible data mistaken for fired side effect** where a key, command, notification, badge, telemetry event, dispatch, cleanup, or prompt appears in a list/cache/view but the operational side effect never fires, repeats incorrectly, or lacks a dedupe rule. +25. **Stale cached capability false negative or false positive** where supported-operation or peer-capability cache causes a required safety action to be skipped, dispatches an unsupported command without fallback, or never reconciles after authoritative peer evidence changes. +26. **Legacy persisted record promoted or deleted without evidence** where missing provenance, source, trust, ownership, or capability fields default too optimistically, backfill without authoritative proof, downgrade unsafely, or treat manual/local records as managed remote records. +27. **Distributed lifecycle gap** where register/create, approval/authorization, normal command, revoke/delete, offline/reconnect reconciliation, repeated action/idempotency, or stale UI/cache behavior lacks its own row and required test. +28. **Derivation reads the incoming patch instead of merged state** where an upsert or partial update triggers a derived field, reducer, stamped value, or validation that consumes only the incoming patch rather than the post-merge result (existing state union patch), so a single-field or partial update that omits an identity or state field the derivation depends on produces a stale or wrong derived value. +29. **Gate-versus-filter predicate divergence** where the same eligibility, completion, or terminal predicate is enforced at one site (a gate) but re-derived independently at another (a list filter, a terminal or disposition check, a batch or unscoped routing path, or an early short-circuit), and the two derivations can disagree because they do not share a helper. +30. **Coverage claim without a fail-closed test** where a `covered` or `already covered` disposition cites no test, or cites only a happy-path assertion, instead of a named test that fails closed on the wrong-input or negative case (including security findings). +31. **Integration-boundary coverage backed only by helper tests** where a CLI, route handler, package export, worker/job, replay path, ingest pipeline, attribution pipeline, or public API is claimed covered by a pure helper test that never exercises production wiring through the real boundary. +32. **Non-applicability claim without source evidence** where a `not applicable` disposition says a surface has no consumers, no exported contract, no filesystem path, no legacy records, no compatibility path, or no untrusted input without grep output, export/package inventory, call-site inventory, schema/query inventory, or exact code references proving the claim. +33. **Singleton-only source coverage** where multiple evidence, authority, history, cache, or fallback sources can coexist but the table never exercises legacy/absent plus fresh valid, corrupt/undated plus fresh valid, irrelevant historical plus current authoritative, tied/conflicting current records, or source/state precedence. +34. **Executable-twin parity inferred from separate tests** where a helper, SQL predicate, route, worker, producer, batch path, or recovery path reimplements one policy but no shared scenario corpus exercises every twin through its real production boundary. +35. **Source-shape assertion pins missing policy** where a negative source-string, AST, or SQL-shape assertion requires a predicate, identity term, join, or branch to be absent and thereby preserves divergence instead of testing behavior. +36. **Required test not traceable to decision rows** where a test is listed without stable row IDs, or lacks the wrong-input or mixed-state negative case needed to distinguish the row's branch. +37. **Not-aligned status treated as success** where a caller proceeds to PR creation, merge, completion, or a success closeout despite unresolved `Final Alignment Status: Not aligned`. ## Contract-Heavy Review Surface @@ -52,6 +53,7 @@ For contract-heavy work, also explicitly review: - new-shape and old/unknown-shape compatibility behavior when guardrails require version-skew safety - precedence between competing decision signals (status, structured fields, error codes, headers, metadata, exit state, persisted markers) - call-site inventory completeness for shared routes, helpers, contracts, and policy surfaces +- shared host reachability across inherited entry-point classes, including non-primary entry points and passive entry versus explicit actions - caller capability differences, especially callers that cannot supply newly required headers, proof material, fields, or response handling - dependency throw/reject branches on route/handler surfaces that promise exact status codes or error bodies - catch-all error handling that may map unrelated failures to a specific auth/verifier/validation/dependency diagnostic diff --git a/plugins/code/tools/python/test_decision_table_skill_contract.py b/plugins/code/tools/python/test_decision_table_skill_contract.py index f6635a1f..a9bd18a0 100644 --- a/plugins/code/tools/python/test_decision_table_skill_contract.py +++ b/plugins/code/tools/python/test_decision_table_skill_contract.py @@ -55,3 +55,17 @@ def test_required_tests_map_to_rows_and_negative_cases() -> None: assert "Row ID" in artifact_format assert "Decision Row IDs" in artifact_format assert "Wrong-Input / Mixed-State Negative Case" in artifact_format + + +def test_shared_hosts_require_passive_entry_point_coverage() -> None: + skill = read_skill_file("SKILL.md") + edge_cases = read_skill_file("references/edge-cases.md") + review_prevention = read_skill_file("references/review-prevention.md") + artifact_format = read_skill_file("references/artifact-format.md") + + for text in (skill, edge_cases, review_prevention, artifact_format): + normalized_text = text.lower() + assert "shared host" in normalized_text + assert "passive" in normalized_text + assert "explicit" in normalized_text + assert "non-primary" in normalized_text