SonarCloud quality gate: extract roadmap task parsing (S3776),
flatten the result printer (S4624), plain comparisons (S1940), and
shared stuck-test fixtures to drop duplication under the gate.
Merge-time fallout, one group: audit tests that pinned pre-remediation
behavior, flipped to the enforced/fixed behavior per area (precedents:
a50ced8, 1112441, S5 9289804). No product changes.
- scout-194 (core + opencode): #257 enforcement — NK advisory-skip
claims in record paths; (a) rewritten to refusal-then-skip; (b)/(c)
keep documenting the open validation hole; legacy cache reads take
state (#251).
- gates-seeded (opencode): #223.2 — provisioned run driven to BUILD by
test-only state surgery (visibility sealState pattern) so finding
shapes run.
- web-json-headers: #282 fixed by S5 — absence pins flipped to presence
(file pre-authorized the flip).
- control-matrix (core): #216 G1 — uniform text-layer deny; backstop
set removed. (opencode symlink test stays red here: btrfs has no
overlay mounts so the sandbox falls back and the write lands —
environmental, unchanged by this work; CI runners enforce EROFS.)
- domainpacks-packs: #252 — dead SECONDARY_MEDIA weights gone, assert
absence.
- queereye-audit193: #266 hasOwn refusals + #270.1 missing-probes report.
- lsp-audit197: #277.2 injector scoping — lsp:none stays silent.
- slash-commands: #274 — deep args reach the deep flow.
- stage-order: #223.2 — direct + tool refusal pins.
- fires-domainpacks: #252 scorer clamp — tiered peer fixtures clear
0.7 honestly ((1+1+0.3)/3).
- evidence-187: #251 — legacy-reader line dropped (refusal above).
- S8 strictness: the named areas are green; config-layers 17/17, no
darkharvest/hooks/lsp JSON or needle fixtures exist under those
names — nothing left to apply.
Full suite: 1892 pass / 1 fail (the btrfs symlink env test above);
docs:check 0, deps:check 0, per-package tsc 0, biome 0.
Refs #179, Refs #257, Refs #223, Refs #282, Refs #216, Refs #252, Refs #266, Refs #270, Refs #277, Refs #274, Refs #251, Refs #190, Refs #187, Refs #194
Add/add conflict with the remediation branch: the audit side pauses the
dashboard RPC at each headline state (#199.2, #248.2/.3/.5, es_status);
the remediation side proves additive registration, server-computed
footer content and a project-tree-clean setup (#276). Fully disjoint
suites: concatenated with merged imports, the remediation fixture in
its own describe block so no lets, hooks or helpers were renamed.
visibility.test.ts 15/15, biome clean.
Refs #199, Refs #248, Refs #276
Content conflict on the #269.2 default-run pin: the branch captures the
default result/ideas before the grill run and asserts byte-equality
after; main asserted the hardcoded b001/17 shortlist. The branch form
is strictly stronger (true before/after isolation, no shared-harness
assumption), so the resolution keeps it and drops main's version. The
nested-refusal test arrives via the main side without conflict.
brainstorm.test.ts 5/5, biome clean.
Refs #191, Refs #269
Content conflict in the shell-policy screen: the branch pins a direct
named `es research export` denial for every agent kind (#255) where
main has the single-build-agent line. The loop subsumes the line, so
the resolution keeps the loop and drops the line.
Refs #189
Add/add conflicts with the remediation branch on both files. Unions keep
every test from both suites: pr-guard keeps the remediation refusal-order
proofs plus the audit bare-remote no-ref-moved proof (audit duplicate
guard tests dropped as subsumed); release.test.ts keeps the remediation
fast bare-remote fixture plus the audit full RELEASE-run end-to-end (its
sync git shim renamed to gitSync beside core's async git).
pr-guard.test.ts 6/6, release.test.ts 5/5, biome clean.
Refs #202, Refs #238
Add/add conflict with the remediation branch: both sides created
packages/cli/test/mcp-identity.test.ts. Union keeps every test from
both suites except three: the two exact-duplicate list/stdio tests
(subsumed by stronger twins) and the audit side's "server ignores
legacy ES_AGENT" assertion, which pins pre-remediation behavior — the
remediation pin order (ES_MCP_AGENT, else ES_AGENT, else defaultAgent)
reads it, proven by the pin-order test kept above.
mcp-identity.test.ts 32/32, biome clean.
Refs #201, Refs #230, Refs #232
Follow-up to the negative-cache fix: caching positives is stale the
other way — a PATH shim's finally-restore leaves the cached hit behind
and the next gate run spawns a binary that is gone (CI: cli.test.ts
gates run failed with `Executable not found in $PATH: gitleaks`).
installed() is a live PATH probe now; a probe is microseconds and gate
runs call it a handful of times. The unit test pins both directions
(miss→shim→seen→removed→miss).
TDD: CI run 38105290150 is the red witness for the stale-positive
direction; gates-seeded.test.ts 13/13 green locally after.
Refs #185
John Smith