From 515712944ead469ce48a59c37f930000301ba24d Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:07:56 -0300
Subject: [PATCH 01/16] test: make Node and repo-root checks hold across patch
 bumps and worktrees

- stock-pi: assert the Node major meets SUPPORT_MATRIX.node.minimum instead
  of an exact patch version, so a 24.x patch bump no longer fails the suite.
- extension: drop assertCurrentNode (same exact-patch probe).
- doctor AR-14: repoRoot resolved one level above the checkout, so the nested
  `bun test` ran whatever tests lived in the parent directory (fails inside
  worktrees). Resolve from the test dir, assert the target suites exist, and
  drop handoff.test.ts/sdd.test.ts, which were deleted long ago.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/workit-core/doctor.test.ts  | 12 +++++-------
 test/workit-pi/extension.test.ts |  7 -------
 test/workit-pi/stock-pi.test.ts  |  5 +++--
 3 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/test/workit-core/doctor.test.ts b/test/workit-core/doctor.test.ts
index 05f5d811..db6c74d3 100644
--- a/test/workit-core/doctor.test.ts
+++ b/test/workit-core/doctor.test.ts
@@ -80,7 +80,7 @@ const runInstaller = (overrides: { env?: NodeJS.ProcessEnv; cwd?: string } = {})
     installer: true,
   });
 
-const repoRoot = path.resolve(path.dirname(import.meta.dir), "..", "..");
+const repoRoot = path.resolve(import.meta.dir, "..", "..");
 
 // Fix helpers mutate a file then restore the original content at teardown.
 const writeConfig = (p: string, content: string, mode?: number) => {
@@ -1733,12 +1733,10 @@ test("reports managed_content_conflict when managed bytes drift from cutover rec
 test(
   "AR-14: negative fixtures never leak raw git usage/fatal dumps into the suite output",
   () => {
-    const noisy = [
-      "test/workit-core/handoff.test.ts",
-      "test/workit-core/sdd.test.ts",
-      "test/workit-core/repo.test.ts",
-    ];
-    const r = spawnSync("bun", ["test", ...noisy], {
+    // Suites whose fixtures run git against missing revisions and non-repos.
+    const noisy = ["test/workit-core/repo.test.ts", "test/workit-core/typescript-parity.test.ts"];
+    for (const file of noisy) expect(existsSync(path.join(repoRoot, file)), file).toBe(true);
+    const r = spawnSync("bun", ["test", ...noisy.map((file) => `./${file}`)], {
       cwd: repoRoot,
       encoding: "utf8",
       timeout: 300_000,
diff --git a/test/workit-pi/extension.test.ts b/test/workit-pi/extension.test.ts
index 55c00fec..c8a45bae 100644
--- a/test/workit-pi/extension.test.ts
+++ b/test/workit-pi/extension.test.ts
@@ -9,7 +9,6 @@ import {
   OPERATION_SCHEMA_MAX_DEPTH,
   type OperationContext,
 } from "@/packages/workit-core/src/core";
-import { SUPPORT_MATRIX } from "@/packages/workit-core/src/core/support-matrix";
 import extension, { persistUncertainCancel } from "@/packages/workit-pi/extensions/workit";
 import { nativeWorkerForEvidence } from "@/packages/workit-pi/src/worker";
 import { piCapabilities } from "@/packages/workit-pi/src/context";
@@ -109,11 +108,6 @@ const decisionInput = (root: string) => {
 
 const nodeExecutable = "node";
 
-const assertCurrentNode = () => {
-  const result = spawnSync(nodeExecutable, ["--version"], { encoding: "utf8" });
-  if (result.status !== 0) throw new Error(result.stderr || result.stdout);
-  expect(result.stdout.trim()).toBe(`v${SUPPORT_MATRIX.node.current}`);
-};
 
 test("clean Pi package declares stock discovery and the eight families plus external action", async () => {
   const manifest = JSON.parse(
@@ -1022,7 +1016,6 @@ test("stock Pi discovers the package manifest through its local package manager"
   const home = path.join(stage, "home");
   mkdirSync(home);
   const env = { ...process.env, PI_CODING_AGENT_DIR: agentDir, HOME: home };
-  assertCurrentNode();
   const packed = spawnSync(
     "npm",
     ["pack", "--json", "--workspace", packageRoot, "--pack-destination", stage],
diff --git a/test/workit-pi/stock-pi.test.ts b/test/workit-pi/stock-pi.test.ts
index 4380e5e2..021f665a 100644
--- a/test/workit-pi/stock-pi.test.ts
+++ b/test/workit-pi/stock-pi.test.ts
@@ -9,10 +9,11 @@ import { taskStartRequest } from "@/test/workit-core/task-fixtures";
 
 const node = "node";
 
-test("stock Node runtime is the supported current line for Pi workers", () => {
+test("stock Node runtime meets the supported major line for Pi workers", () => {
   const result = spawnSync(node, ["--version"], { encoding: "utf8" });
   expect(result.status).toBe(0);
-  expect(result.stdout.trim()).toBe("v" + SUPPORT_MATRIX.node.current);
+  const major = Number(/^v(\d+)\./.exec(result.stdout.trim())?.[1]);
+  expect(major).toBeGreaterThanOrEqual(Number(SUPPORT_MATRIX.node.minimum));
 });
 
 test(

From 4f8f56bdf8416b66a29eb5dfa457f076d3f09623 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:08:01 -0300
Subject: [PATCH 02/16] test: delete the phase-9 traceability gate

phase-9-traceability.test.ts (485 lines) mapped POST-xx/AR-xx/CA-xx rows of
the archived reliability-overhaul plan to "file::exact test name" strings and
required the stale branch feature/workit-reliability-overhaul. It asserted
document cross-references, not product behavior: it failed on test renames
or plan edits and forced a head_ref checkout in CI. Every behavior it pointed
at keeps its own test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/artifacts/phase-9-traceability.test.ts | 485 --------------------
 1 file changed, 485 deletions(-)
 delete mode 100644 test/artifacts/phase-9-traceability.test.ts

diff --git a/test/artifacts/phase-9-traceability.test.ts b/test/artifacts/phase-9-traceability.test.ts
deleted file mode 100644
index 401f43c4..00000000
--- a/test/artifacts/phase-9-traceability.test.ts
+++ /dev/null
@@ -1,485 +0,0 @@
-import { expect, test } from "bun:test";
-import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import path from "node:path";
-import { REPO_ROOT } from "@/test/shared/helpers/packages";
-
-const escapeRegExp = (value: string): string => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-
-// Task 31 Phase 9 traceability gate (AR-15, CA-44, CA-45): every post-audit
-// finding (POST-01..15), every AR row (AR-01..15), and every Phase 9
-// acceptance criterion (CA-33..45) maps to an exact test file+case or an
-// exact command. A row is prose-only when its evidence target does not exist;
-// the gate fails naming those rows. Evidence for behavior proven by Tasks
-// 24-30 is referenced here, never re-implemented.
-
-const DECLARED_BRANCH = "feature/workit-reliability-overhaul";
-const PLAN = path.join(REPO_ROOT, "docs", "workit-reliability-overhaul", "plan.md");
-const SPEC = path.join(REPO_ROOT, "docs", "workit-reliability-overhaul", "spec.md");
-
-type Row = { row: string; requirement: string; evidence: string[] };
-
-// Evidence grammar: "test-file::exact test name" resolves against the named
-// test file; "command:bun run <script>" resolves against package.json
-// scripts; "command:git ..." and "command:workflow_*" resolve against the
-// plan's Step 6 / Step 5 text (executed by the coordinator, never in-test).
-const ROWS: Row[] = [
-  {
-    row: "POST-01",
-    requirement: "release can publish without built adapter dist/",
-    evidence: [
-      "test/artifacts/release-orchestration.test.ts::release job order is install → build → candidate gate → semantic-release → manifest sync (AR-01/CA-33/AR-15)",
-    ],
-  },
-  {
-    row: "POST-02",
-    requirement: "release rewrite/check order is after a possible publish",
-    evidence: [
-      "test/artifacts/release-orchestration.test.ts::rewrite runs before npm package verification and after version assignment (AR-02)",
-    ],
-  },
-  {
-    row: "POST-03",
-    requirement: "clean CLI install omits both adapter packages",
-    evidence: [
-      "test/workit-cli/packed-cli.test.ts::packed CLI setup flow configures OpenCode + Cursor and doctor verifies it",
-    ],
-  },
-  {
-    row: "POST-04",
-    requirement: "Workit package-prefix matching removes helper packages",
-    evidence: [
-      "test/artifacts/registration.test.ts::mergeOpenCodePlugins preserves prefix-shared helper packages (AR-04)",
-    ],
-  },
-  {
-    row: "POST-05",
-    requirement: "Cursor launcher workspace is ignored by defaulted tools",
-    evidence: [
-      "test/workit-cursor/mcp-process.test.ts::run-server <workspace> from an unrelated cwd defaults omitted roots to the launcher workspace",
-    ],
-  },
-  {
-    row: "POST-06",
-    requirement: "URL pathname builds and direct hook entry are not Windows-safe",
-    evidence: [
-      "test/workit-cursor/mcp-regressions.test.ts::build scripts derive their directory with fileURLToPath, not URL pathname",
-    ],
-  },
-  {
-    row: "POST-07",
-    requirement: "object-shaped config accepts scalar/array/null JSON",
-    evidence: [
-      "test/workit-core/config.test.ts::AR-07: non-object config.json shapes are malformed with exact paths, never defaults",
-    ],
-  },
-  {
-    row: "POST-08",
-    requirement: "embedded year-first dates derive Closes #2024",
-    evidence: [
-      "test/workit-core/pr-create.test.ts::AR-08: complete dates anywhere in a segment never close an issue",
-    ],
-  },
-  {
-    row: "POST-09",
-    requirement: "preview omits host writes performed during Apply",
-    evidence: [
-      "test/workit-cli/platform-install.test.ts::preview/apply parity: every Apply write was previewed, exactly (AR-09/CA-39)",
-    ],
-  },
-  {
-    row: "POST-10",
-    requirement: "custom credential paths are replaced by defaults",
-    evidence: [
-      "test/workit-cli/platform-install.test.ts::custom credential paths and canary bytes survive Apply (AR-10)",
-    ],
-  },
-  {
-    row: "POST-11",
-    requirement: "doctor downgrades required installer failures",
-    evidence: [
-      "test/workit-core/doctor.test.ts::installer fails when a selected-host asset is missing",
-    ],
-  },
-  {
-    row: "POST-12",
-    requirement: "native-choice evidence is model-forgeable",
-    evidence: [
-      "test/workit-opencode/task-tools.test.ts::stated design choices need no receipt and never authorize an action",
-    ],
-  },
-  {
-    row: "POST-13",
-    requirement: "delegated identity and direct edits bypass coordinator gates",
-    evidence: [
-      "test/workit-opencode/task-hooks.test.ts::known write surfaces pass through while unknown shell writes stay agent-guided",
-    ],
-  },
-  {
-    row: "POST-14",
-    requirement: "successful full checks emit unbounded negative Git diagnostics",
-    evidence: [
-      "test/workit-core/doctor.test.ts::AR-14: negative fixtures never leak raw git usage/fatal dumps into the suite output",
-    ],
-  },
-  {
-    row: "POST-15",
-    requirement: "feature history still carries the pre-squash recovery lineage",
-    evidence: ["command:git merge-base origin/main HEAD"],
-  },
-  {
-    row: "AR-01",
-    requirement:
-      "release workflow builds every artifact and runs the release-candidate gate before semantic-release",
-    evidence: [
-      "test/artifacts/release-orchestration.test.ts::release job order is install → build → candidate gate → semantic-release → manifest sync (AR-01/CA-33/AR-15)",
-    ],
-  },
-  {
-    row: "AR-02",
-    requirement:
-      "dependency rewriting before package verification and after version preparation; runnable build/verify:release-candidate scripts",
-    evidence: [
-      "test/artifacts/release-orchestration.test.ts::root scripts build the three adapters and run the pack-only gate (AR-02)",
-      "test/artifacts/release-orchestration.test.ts::rewrite runs before npm package verification and after version assignment (AR-02)",
-    ],
-  },
-  {
-    row: "AR-03",
-    requirement:
-      "clean CLI install includes both adapters through declared same-release dependencies; tests never manually install undeclared siblings",
-    evidence: [
-      "test/artifacts/release-candidate.test.ts::packed CLI manifest declares both adapters at the core release version",
-    ],
-  },
-  {
-    row: "AR-04",
-    requirement:
-      "registration matches exact identities and version suffixes only; prefix-shared helpers remain untouched",
-    evidence: [
-      "test/artifacts/registration.test.ts::isWorkitPlugin rejects prefix-shared @brainervirus names, still accepts exact names",
-    ],
-  },
-  {
-    row: "AR-05",
-    requirement:
-      "Cursor launcher workspace becomes the default root when workspace_root is omitted",
-    evidence: [
-      "test/workit-cursor/mcp-process.test.ts::WORKFLOW_WORKSPACE_ROOT env beats the process cwd for omitted tool roots",
-    ],
-  },
-  {
-    row: "AR-06",
-    requirement:
-      "builds decode import.meta.url with fileURLToPath; Cursor MCP/hook manifests invoke Node explicitly on Linux, macOS, and Windows",
-    evidence: [
-      "test/workit-cursor/mcp-regressions.test.ts::build scripts derive their directory with fileURLToPath, not URL pathname",
-    ],
-  },
-  {
-    row: "AR-07",
-    requirement:
-      "every config reader, setup preflight, and doctor classifies parseable scalar/array/null JSON as malformed",
-    evidence: [
-      "test/workit-core/config.test.ts::AR-07: non-object config.json shapes are malformed with exact paths, never defaults",
-    ],
-  },
-  {
-    row: "AR-08",
-    requirement:
-      "date-like sequences anywhere in a branch segment cannot derive issue closures; explicit issue branches remain supported",
-    evidence: [
-      "test/workit-core/pr-create.test.ts::AR-08: complete dates anywhere in a segment never close an issue",
-    ],
-  },
-  {
-    row: "AR-09",
-    requirement:
-      "setup preview lists every exact Apply mutation; Apply rejects any unreviewed mutation",
-    evidence: [
-      "test/workit-cli/platform-install.test.ts::preview/apply parity: every Apply write was previewed, exactly (AR-09/CA-39)",
-    ],
-  },
-  {
-    row: "AR-10",
-    requirement:
-      "existing custom tokenFile paths and bytes remain authoritative unless the preview shows and the user approves a replacement",
-    evidence: [
-      "test/workit-cli/platform-install.test.ts::custom credential paths and canary bytes survive Apply (AR-10)",
-    ],
-  },
-  {
-    row: "AR-11",
-    requirement:
-      "doctor never reports an incomplete selected host as healthy; required installer checks remain failures with nonzero status",
-    evidence: [
-      "test/workit-core/doctor.test.ts::installer fails when a selected-host asset is missing",
-    ],
-  },
-  {
-    row: "AR-12",
-    requirement:
-      "approval, menu, and delegated identity come from host observations, not caller-created evidence, role, or taskIdentity",
-    evidence: [
-      "test/workit-opencode/task-tools.test.ts::the decision tool consumes only the matching native question receipt",
-    ],
-  },
-  {
-    row: "AR-13",
-    requirement:
-      "OpenCode intercepts known file-write tools and denies coordinator shell mutation while subagent-driven mode is active",
-    evidence: [
-      "test/workit-opencode/task-hooks.test.ts::known write surfaces pass through while unknown shell writes stay agent-guided",
-    ],
-  },
-  {
-    row: "AR-14",
-    requirement:
-      "the full check captures expected negative-command stderr so successful verification is free of repeated Git usage/fatal dumps",
-    evidence: [
-      "test/workit-core/doctor.test.ts::AR-14: negative fixtures never leak raw git usage/fatal dumps into the suite output",
-    ],
-  },
-  {
-    row: "AR-15",
-    requirement:
-      "final branch merges current main so the PR merge-base no longer predates the recovery change; revalidated without force-push or publish",
-    evidence: [
-      "command:git merge-base origin/main HEAD",
-      "command:git merge --no-edit origin/main",
-    ],
-  },
-  {
-    row: "CA-33",
-    requirement:
-      "on a clean checkout with no generated dist/, the release job builds all adapters and completes verify:release-candidate before semantic-release",
-    evidence: [
-      "test/artifacts/release-orchestration.test.ts::a clean checkout tracks no generated adapter dist/ files (CA-33)",
-      "test/artifacts/release-orchestration.test.ts::release job order is install → build → candidate gate → semantic-release → manifest sync (AR-01/CA-33/AR-15)",
-    ],
-  },
-  {
-    row: "CA-34",
-    requirement:
-      "installing only the packed CLI and its declared dependency closure makes both adapter packages discoverable without manually copying sibling tarballs",
-    evidence: [
-      "test/workit-cli/packed-cli.test.ts::packed CLI setup flow configures OpenCode + Cursor and doctor verifies it",
-    ],
-  },
-  {
-    row: "CA-35",
-    requirement:
-      "unrelated package names that begin with a Workit package prefix survive registration merging unchanged",
-    evidence: [
-      "test/artifacts/registration.test.ts::mergeOpenCodePlugins preserves prefix-shared helper packages (AR-04)",
-    ],
-  },
-  {
-    row: "CA-36",
-    requirement:
-      "Cursor tools called without workspace_root use the launcher workspace; all build/hook entry paths pass Windows process tests",
-    evidence: [
-      "test/workit-cursor/mcp-process.test.ts::run-server <workspace> from an unrelated cwd defaults omitted roots to the launcher workspace",
-      "test/workit-cursor/mcp-regressions.test.ts::cursor MCP manifests stay package-relative (mcp.json and hooks-cursor.json)",
-    ],
-  },
-  {
-    row: "CA-37",
-    requirement:
-      "scalar, array, null, unreadable, and syntactically invalid configuration fixtures block readers, setup, and doctor with exact paths and nonzero status",
-    evidence: [
-      "test/workit-core/config.test.ts::AR-07: non-object config.json shapes are malformed with exact paths, never defaults",
-      "test/workit-cli/wizard-config.test.ts::AR-07: readSetupState classifies non-object shapes as malformed on every file",
-      "test/workit-core/doctor.test.ts::AR-07: doctor agrees with the readers on malformed shapes",
-    ],
-  },
-  {
-    row: "CA-38",
-    requirement:
-      "full date segments embedded after text cannot create issue clauses while explicit numeric issue branches retain documented behavior",
-    evidence: [
-      "test/workit-core/pr-create.test.ts::AR-08: complete dates anywhere in a segment never close an issue",
-      "test/workit-core/pr-create.test.ts::B2: day-first date segments never derive a numeric issue id",
-    ],
-  },
-  {
-    row: "CA-39",
-    requirement:
-      "preview and Apply mutation sets are identical, including host package copies and registration files, and custom credential paths/bytes survive rerun",
-    evidence: [
-      "test/workit-cli/platform-install.test.ts::preview/apply parity: every Apply write was previewed, exactly (AR-09/CA-39)",
-      "test/workit-cli/packed-cli.test.ts::packed CLI: custom credential paths and canary bytes survive preview/apply rerun (CA-39)",
-    ],
-  },
-  {
-    row: "CA-40",
-    requirement:
-      "installer doctor treats selected-host runtime, assets, launchers, registration, malformed config, and required utility defects as failures",
-    evidence: [
-      "test/workit-core/doctor.test.ts::installer fails when a selected-host asset is missing",
-      "test/workit-core/doctor.test.ts::installer fails when a selected-host launcher entry is missing",
-      "test/workit-core/doctor.test.ts::installer fails when the runtime is unavailable",
-    ],
-  },
-  {
-    row: "CA-41",
-    requirement:
-      "forged evidence, replayed receipts, mismatched sessions/labels, and caller-supplied delegated roles fail; a real host question plus child session succeeds",
-    evidence: [
-      "test/workit-opencode/task-tools.test.ts::native receipts reject unrelated questions and are consumed once per purpose",
-      "test/workit-opencode/task-hooks.test.ts::direct-child reviewer and implementer contexts are exact and lineage-bound",
-    ],
-  },
-  {
-    row: "CA-42",
-    requirement:
-      "Cursor flow results expose unauthenticated confirmation provenance and an accepted subagent-driven selection returns a raw coordinator lease",
-    evidence: [
-      "test/workit-cursor/task-mcp.test.ts::Cursor MCP refuses authority without a native caller identity",
-      "test/workit-cursor/task-mcp.test.ts::Cursor adapter has no legacy token or embedded schema surface",
-    ],
-  },
-  {
-    row: "CA-43",
-    requirement:
-      "a successful bun run check has zero test failures and no repeated raw Git usage/fatal dumps from expected negative fixtures",
-    evidence: [
-      "test/workit-core/doctor.test.ts::AR-14: negative fixtures never leak raw git usage/fatal dumps into the suite output",
-      "command:bun run check",
-    ],
-  },
-  {
-    row: "CA-44",
-    requirement:
-      "the Phase 9 release candidate passes clean dependency install, isolated runtime, Linux/macOS/Windows, doctor, traceability, and no-publication checks",
-    evidence: [
-      "command:bun run verify:release-candidate",
-      "test/artifacts/packed-runtime.test.ts::cli --help runs under node from the extracted package and exits 0",
-      "test/artifacts/manifests.test.ts::ci.yml pins the declared support matrix (Bun/Node/OpenCode, 3 OS, no Deno)",
-      "test/artifacts/reliability-report.test.ts::default report aggregates the deterministic candidate and an isolated doctor",
-      "test/workit-cli/packed-cli.test.ts::packed CLI setup flow configures OpenCode + Cursor and doctor verifies it",
-      "test/artifacts/release-candidate.test.ts::packing the candidate never invokes a publication command (RL-08/CA-30)",
-    ],
-  },
-  {
-    row: "CA-45",
-    requirement:
-      "before PR creation the feature branch has current main as its base, documents validate with all tasks numbered, and the PR diff excludes the recovery lineage",
-    evidence: ["command:git merge-base origin/main HEAD", "command:workflow_docs_validate"],
-  },
-];
-
-function resolveTest(target: string): string {
-  const sep = target.indexOf("::");
-  const rel = target.slice(0, sep);
-  const name = target.slice(sep + 2);
-  const file = path.join(REPO_ROOT, rel);
-  expect(existsSync(file), `${rel}: file missing`).toBe(true);
-  const src = readFileSync(file, "utf8");
-  // Accept any whitespace between `test(` and the quoted name — formatters
-  // may split long declarations across lines, and the options variant
-  // `test("name", fn, { timeout })` is used by slow spawn-based cases.
-  const testRe = new RegExp(`test\\(\\s*"${escapeRegExp(name)}"`);
-  expect(testRe.test(src), `${rel}::${name}: case missing`).toBe(true);
-  return `${rel}::${name}`;
-}
-
-function resolveCommand(cmd: string): string {
-  if (cmd.startsWith("bun run ")) {
-    const script = cmd.slice("bun run ".length).trim();
-    const scripts = JSON.parse(readFileSync(path.join(REPO_ROOT, "package.json"), "utf8"))
-      .scripts as Record<string, string>;
-    expect(typeof scripts[script], `package.json script ${script} missing`).toBe("string");
-    return `package.json::scripts.${script}`;
-  }
-  const plan = readFileSync(PLAN, "utf8");
-  expect(plan.includes(cmd), `plan.md does not document the command: ${cmd}`).toBe(true);
-  return `plan.md::${cmd}`;
-}
-
-test(
-  "every mapped row resolves to an existing test case or declared command",
-  () => {
-    for (const row of ROWS) {
-      for (const ev of row.evidence) {
-        const where = ev.startsWith("command:") ? resolveCommand(ev.slice(8)) : resolveTest(ev);
-        expect(where, `${row.row}: ${ev}`).toBeTruthy();
-      }
-    }
-  },
-  { timeout: 60_000 },
-);
-
-test(
-  "no row is prose-only: every POST/AR/CA row has at least one evidence target",
-  () => {
-    const unmapped = ROWS.filter((r) => r.evidence.length === 0).map((r) => r.row);
-    expect(unmapped).toEqual([]);
-  },
-  { timeout: 60_000 },
-);
-
-test(
-  "the mapping table is complete: the spec carries no POST/AR/CA row outside the table",
-  () => {
-    const spec = readFileSync(SPEC, "utf8");
-    const inSpec = {
-      post: [...spec.matchAll(/POST-\d\d/g)].map((m) => m[0]),
-      ar: [...spec.matchAll(/AR-\d\d/g)].map((m) => m[0]),
-      ca: [...spec.matchAll(/CA-(?:3[3-9]|4[0-5])/g)].map((m) => m[0]),
-    };
-    const inTable = {
-      post: ROWS.filter((r) => r.row.startsWith("POST-")).map((r) => r.row),
-      ar: ROWS.filter((r) => r.row.startsWith("AR-")).map((r) => r.row),
-      ca: ROWS.filter((r) => r.row.startsWith("CA-")).map((r) => r.row),
-    };
-    expect(new Set(inSpec.post)).toEqual(new Set(inTable.post));
-    expect(new Set(inSpec.ar)).toEqual(new Set(inTable.ar));
-    expect(new Set(inSpec.ca)).toEqual(new Set(inTable.ca));
-  },
-  { timeout: 60_000 },
-);
-
-test(
-  "the gate references the dependency-closure and release-ordering evidence instead of re-proving it",
-  () => {
-    const evidence = ROWS.flatMap((r) => r.evidence);
-    expect(
-      evidence.some((e) => e.startsWith("test/workit-cli/packed-cli.test.ts::")),
-      "packed CLI declared-closure proof (AR-03/CA-34) must be referenced, not re-implemented",
-    ).toBe(true);
-    expect(
-      evidence.some((e) => e.startsWith("test/artifacts/release-orchestration.test.ts::")),
-      "release-ordering proof (AR-01/AR-02/CA-33) must be exercised",
-    ).toBe(true);
-  },
-  { timeout: 60_000 },
-);
-
-test(
-  "the declared branch is active (AR-15/CA-45 pre-reconciliation state)",
-  () => {
-    const branch = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
-      cwd: REPO_ROOT,
-      encoding: "utf8",
-    });
-    expect(branch.status, branch.stderr ?? "").toBe(0);
-    const head = branch.stdout.trim();
-    if (head === DECLARED_BRANCH) return;
-    // CI checks out the PR merge commit (detached HEAD): the declared branch
-    // must exist and be an ancestor of the checked-out state. Post-merge the
-    // declared branch is gone — nothing left to assert.
-    const ref = spawnSync(
-      "git",
-      ["rev-parse", "--verify", `refs/remotes/origin/${DECLARED_BRANCH}`],
-      { cwd: REPO_ROOT, encoding: "utf8" },
-    );
-    if (ref.status !== 0) return;
-    const ancestor = spawnSync("git", ["merge-base", "--is-ancestor", ref.stdout.trim(), "HEAD"], {
-      cwd: REPO_ROOT,
-      encoding: "utf8",
-    });
-    expect(ancestor.status).toBe(0);
-  },
-  { timeout: 60_000 },
-);

From e6f0279d62753f6247c7d400538e407fd32179e8 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:09:12 -0300
Subject: [PATCH 03/16] test: drop packed-artifact assertions duplicated across
 three gate files

The phase-0, release-candidate, package-contents and packed-runtime gates
re-asserted the same facts about the same cached pack:
- phase-0 "final release candidate is byte-stable with the phase-0 pack":
  same check as release-candidate "a fresh repack yields byte-identical sha256".
- phase-0 "packed adapter core dependency equals the packed core version" and
  release-candidate "packed release metadata is synchronized": identical
  loops; folded into "packed internal dependencies rewrite to the same
  release version", which now also requires the core dependency to exist.
- phase-0 "expected entry files ship in each packed tarball": every entry is
  asserted by the per-tarball tests in package-contents.test.ts.
- package-contents "no packed package.json carries a workspace:, file: or
  git: protocol" and the protocol lines of release-candidate's
  self-contained test: subsumed by phase-0's CA-03 test, which also checks
  every range is a valid semver range.
- packed-runtime "the runtime gate exercises the same final candidate
  artifacts": tautology; both calls return the same cached array.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/artifacts/package-contents.test.ts  | 10 ---
 test/artifacts/packed-runtime.test.ts    | 15 -----
 test/artifacts/phase-0-candidate.test.ts | 83 ------------------------
 test/artifacts/release-candidate.test.ts | 22 ++-----
 test/workit-pi/extension.test.ts         |  1 -
 5 files changed, 4 insertions(+), 127 deletions(-)

diff --git a/test/artifacts/package-contents.test.ts b/test/artifacts/package-contents.test.ts
index 3f29330e..4600be11 100644
--- a/test/artifacts/package-contents.test.ts
+++ b/test/artifacts/package-contents.test.ts
@@ -181,16 +181,6 @@ test("core tarball keeps its source package layout without legacy vendor shell (
   expect(entries).not.toContain("scripts/verify-project.sh");
 });
 
-test("no packed package.json carries a workspace:, file: or git: protocol (CA-03)", () => {
-  const packs = packWorkspacePackages();
-  for (const pack of packs) {
-    const raw = readTarballFile(pack.tarball, "package.json");
-    expect(raw, pack.packageName).not.toContain("workspace:");
-    expect(raw, pack.packageName).not.toContain("file:");
-    expect(raw, pack.packageName).not.toContain("git:");
-  }
-});
-
 test("packed runtime JS imports no core source subpaths and no checkout paths", () => {
   const packs = packWorkspacePackages();
   const normalized = REPO_ROOT.split(path.sep).join("/");
diff --git a/test/artifacts/packed-runtime.test.ts b/test/artifacts/packed-runtime.test.ts
index e97d2f17..17f09dba 100644
--- a/test/artifacts/packed-runtime.test.ts
+++ b/test/artifacts/packed-runtime.test.ts
@@ -19,7 +19,6 @@ import {
   installPackedPackage,
   isolatedEnv,
   npmRegistryReachable,
-  packReleaseCandidate,
   packWorkspacePackages,
   tarballSpec,
   REPO_ROOT,
@@ -498,20 +497,6 @@ test(
   { timeout: 60_000 },
 );
 
-test(
-  "the runtime gate exercises the same final candidate artifacts (CA-30)",
-  () => {
-    // Both calls resolve to the same cached pack, so this asserts the gate uses
-    // the final candidate, not fresh-vs-cached bytes. Byte-stability across a
-    // forced repack is proven in release-candidate.test.ts ("a fresh repack
-    // yields byte-identical sha256") and phase-0-candidate.test.ts (D12).
-    const candidate = packReleaseCandidate();
-    const packs = packWorkspacePackages();
-    expect(candidate.map((p) => p.sha256)).toEqual(packs.map((p) => p.sha256));
-  },
-  { timeout: 60_000 },
-);
-
 test(
   "declared platform matrix is pinned across CI, engines, and lockfiles (PT-11/PT-12)",
   () => {
diff --git a/test/artifacts/phase-0-candidate.test.ts b/test/artifacts/phase-0-candidate.test.ts
index a322509d..98d67b2c 100644
--- a/test/artifacts/phase-0-candidate.test.ts
+++ b/test/artifacts/phase-0-candidate.test.ts
@@ -18,7 +18,6 @@ import {
   isolatedEnv,
   listTarball,
   npmRegistryReachable,
-  packReleaseCandidate,
   packWorkspacePackages,
   tarballSpec,
   readTarballFile,
@@ -52,9 +51,6 @@ if (!npmRegistryOk) {
 
 const tmp = (prefix: string) => mkdtempSync(path.join(os.tmpdir(), prefix));
 
-const hasEntry = (tarball: string, prefix: string) =>
-  listTarball(tarball).some((entry) => entry === prefix || entry.startsWith(prefix));
-
 test(
   "isolatedEnv strips script-specific path overrides that could re-point at the repo",
   () => {
@@ -100,36 +96,6 @@ test(
   { timeout: 60_000 },
 );
 
-test(
-  "the final release candidate is byte-stable with the phase-0 pack (CA-30)",
-  () => {
-    // Force a fresh pack against the earlier (cached) phase-0 pack: comparing two
-    // calls that both hit the module cache would be comparing an array with
-    // itself (D12). Order matters — packWorkspacePackages() must run first so the
-    // force actually repacks.
-    const packs = packWorkspacePackages();
-    const candidate = packReleaseCandidate({ force: true });
-    expect(candidate.map((p) => p.sha256)).toEqual(packs.map((p) => p.sha256));
-  },
-  { timeout: 60_000 },
-);
-
-test(
-  "packed adapter core dependency equals the packed core version (RR-01)",
-  () => {
-    const packs = packWorkspacePackages();
-    const coreVersion = JSON.parse(
-      readTarballFile(packs.find((p) => p.packageName === CORE)!.tarball, "package.json"),
-    ).version;
-    for (const name of [MCP, OPENCODE, CURSOR, CODEX, CLI]) {
-      const pack = packs.find((p) => p.packageName === name)!;
-      const pkg = JSON.parse(readTarballFile(pack.tarball, "package.json"));
-      expect(pkg.dependencies["@brainervirus/workit-core"], name).toBe(`^${coreVersion}`);
-    }
-  },
-  { timeout: 60_000 },
-);
-
 test(
   "packed tarballs carry no workspace: or local protocols, only valid ranges (CA-03)",
   () => {
@@ -150,55 +116,6 @@ test(
   { timeout: 60_000 },
 );
 
-test(
-  "expected entry files ship in each packed tarball",
-  () => {
-    const packs = packWorkspacePackages();
-    const byName = (name: string) => packs.find((p) => p.packageName === name)!;
-
-    const opencode = byName(OPENCODE).tarball;
-    expect(hasEntry(opencode, "dist/plugin.js")).toBe(true);
-    expect(hasEntry(opencode, "assets/skills/")).toBe(true);
-
-    const cursor = byName(CURSOR).tarball;
-    for (const f of [
-      "dist/mcp-server.js",
-      "dist/cursor-session-start.js",
-      "dist/workit-hook.js",
-      "mcp.json",
-      "assets/logo.svg",
-      ".cursor-plugin/plugin.json",
-      "hooks/hooks-cursor.json",
-    ]) {
-      expect(hasEntry(cursor, f), f).toBe(true);
-    }
-    expect(hasEntry(cursor, "mcp/run-server.sh")).toBe(false);
-    expect(hasEntry(cursor, "hooks/session-start")).toBe(false);
-    const cursorPkg = JSON.parse(readTarballFile(cursor, "package.json"));
-    expect(cursorPkg.bin["workit-cursor-mcp"]).toBe("./dist/mcp-server.js");
-    expect(cursorPkg.bin["workit-cursor-session-start"]).toBe("./dist/cursor-session-start.js");
-    expect(cursorPkg.bin["workit-cursor-hook"]).toBe("./dist/workit-hook.js");
-
-    const core = byName(CORE).tarball;
-    for (const f of [
-      "src/core.ts",
-      "scripts/rewrite-workspace-deps.ts",
-      "scripts/install-opencode-plugin.sh",
-      "scripts/sync-runtime.sh",
-      "templates/",
-      "skills/",
-    ]) {
-      expect(hasEntry(core, f), f).toBe(true);
-    }
-
-    const cli = byName(CLI).tarball;
-    expect(hasEntry(cli, "dist/index.js")).toBe(true);
-    const cliPkg = JSON.parse(readTarballFile(cli, "package.json"));
-    expect(cliPkg.bin.workit).toBe("./dist/index.js");
-  },
-  { timeout: 60_000 },
-);
-
 type McpClient = {
   child: ChildProcess;
   request: (method: string, params: unknown) => Promise<{ result?: unknown; error?: unknown }>;
diff --git a/test/artifacts/release-candidate.test.ts b/test/artifacts/release-candidate.test.ts
index 0288c883..3924d286 100644
--- a/test/artifacts/release-candidate.test.ts
+++ b/test/artifacts/release-candidate.test.ts
@@ -106,6 +106,7 @@ test("packed internal dependencies rewrite to the same release version", () => {
   ).version;
   for (const name of [MCP, OPENCODE, CURSOR, CODEX, CLI]) {
     const pkg = JSON.parse(readTarballFile(byName(packs, name).tarball, "package.json"));
+    expect(pkg.dependencies?.[CORE], `${name} → ${CORE}`).toBe(`^${coreVersion}`);
     for (const [dep, range] of Object.entries(pkg.dependencies ?? {})) {
       if (dep.startsWith("@brainervirus/")) {
         expect(range, `${name} → ${dep}`).toBe(`^${coreVersion}`);
@@ -173,19 +174,8 @@ test("packing the candidate never invokes a publication command (RL-08/CA-30)",
   }
 });
 
-test("packed release metadata is synchronized: adapter core dep equals core version", () => {
-  const packs = packReleaseCandidate();
-  const coreVersion = JSON.parse(
-    readTarballFile(byName(packs, CORE).tarball, "package.json"),
-  ).version;
-  for (const name of [MCP, OPENCODE, CURSOR, CODEX, CLI]) {
-    const pkg = JSON.parse(readTarballFile(byName(packs, name).tarball, "package.json"));
-    expect(pkg.dependencies["@brainervirus/workit-core"], name).toBe(`^${coreVersion}`);
-  }
-});
-
-// AR-03: the packed CLI manifest declares BOTH adapters at the same release
-// version, so a manifest-driven install carries the full setup closure.
+// The packed CLI manifest declares BOTH adapters at the same release version,
+// so a manifest-driven install carries the full setup closure.
 test("packed CLI manifest declares both adapters at the core release version", () => {
   const packs = packReleaseCandidate();
   const coreVersion = JSON.parse(
@@ -197,16 +187,12 @@ test("packed CLI manifest declares both adapters at the core release version", (
   expect(JSON.stringify(cli.dependencies)).not.toContain("workspace:");
 });
 
-test("candidate entries are self-contained: no dist .ts, workspace:, or checkout paths", () => {
+test("candidate entries are self-contained: no dist .ts or checkout paths", () => {
   const normalizedRoot = REPO_ROOT.split(path.sep).join("/");
   for (const pack of packReleaseCandidate()) {
     const files = listTarball(pack.tarball);
     const distTs = files.filter((f) => f.startsWith("dist/") && f.endsWith(".ts"));
     expect(distTs, pack.packageName).toEqual([]);
-    const raw = readTarballFile(pack.tarball, "package.json");
-    expect(raw, pack.packageName).not.toContain("workspace:");
-    expect(raw, pack.packageName).not.toContain("file:");
-    expect(raw, pack.packageName).not.toContain("git:");
     expect(files.join("\n"), pack.packageName).not.toContain(normalizedRoot);
   }
 });
diff --git a/test/workit-pi/extension.test.ts b/test/workit-pi/extension.test.ts
index c8a45bae..b2e6c724 100644
--- a/test/workit-pi/extension.test.ts
+++ b/test/workit-pi/extension.test.ts
@@ -108,7 +108,6 @@ const decisionInput = (root: string) => {
 
 const nodeExecutable = "node";
 
-
 test("clean Pi package declares stock discovery and the eight families plus external action", async () => {
   const manifest = JSON.parse(
     readFileSync(path.join(import.meta.dir, "../../packages/workit-pi/package.json"), "utf8"),

From ceb63ccfa84d6a3ceae08f5574156159fdc93f96 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:12:20 -0300
Subject: [PATCH 04/16] test: check generated copies against git trees and
 derive skill lists from the manifest

Byte-copy tests:
- methods "host skill copies stay byte-identical to every canonical core
  skill" and package-contents "tracked CLI template mirrors stay
  byte-identical" compared working-tree files that `bun run build`
  regenerates, so after the CI build step they passed by construction.
  Replaced by generated-copies.test.ts, which compares committed git trees
  (HEAD:packages/workit-core/skills vs each host copy, core templates vs the
  CLI mirror). A canonical edit committed without regenerated copies fails.

Fourteen-skill list (restated in 9 places):
- methods "method manifest lists exactly fourteen core skills" now checks
  the manifest against the canonical skill directories, without a literal.
- Pi extension "Pi package ships the fourteen canonical method skills"
  deleted: the committed-tree check plus the manifest check cover it.
- package-contents opencode tarball skill list deleted: identical to
  opencode-skill-contract "opencode packed tarball ships exactly the
  canonical method skills".
- `expect(WORKIT).toHaveLength(14)` pins in opencode-skill-contract and
  cursor-install-invariants deleted (restated the constant).
- Codex plugin, OpenCode plugin, opencode-v2 shell/matrix, manifests,
  packed-runtime and stock Pi now derive expected skill and wk- alias sets
  from WORKIT_METHOD_SKILLS / WORKIT_SKILL_ALIASES; stock Pi checks the
  discovered skill names, not only their count.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../cursor-install-invariants.test.ts         |  1 -
 test/artifacts/manifests.test.ts              | 22 +++-------
 .../artifacts/opencode-skill-contract.test.ts |  1 -
 test/artifacts/package-contents.test.ts       | 41 +------------------
 test/artifacts/packed-runtime.test.ts         |  8 +++-
 test/opencode-v2/matrix.test.ts               | 40 +++---------------
 test/opencode-v2/shell.test.ts                | 30 +++++---------
 test/workit-codex/plugin.test.ts              | 22 +++-------
 test/workit-core/generated-copies.test.ts     | 39 ++++++++++++++++++
 test/workit-core/methods.test.ts              | 36 ++--------------
 test/workit-opencode/plugin.test.ts           | 38 +++--------------
 test/workit-pi/extension.test.ts              | 23 +----------
 test/workit-pi/stock-pi.test.ts               | 30 +++++---------
 13 files changed, 95 insertions(+), 236 deletions(-)
 create mode 100644 test/workit-core/generated-copies.test.ts

diff --git a/test/artifacts/cursor-install-invariants.test.ts b/test/artifacts/cursor-install-invariants.test.ts
index 4844bb2e..71fa3f23 100644
--- a/test/artifacts/cursor-install-invariants.test.ts
+++ b/test/artifacts/cursor-install-invariants.test.ts
@@ -68,7 +68,6 @@ const byName = (packs: ReturnType<typeof packWorkspacePackages>, name: string) =
 test(
   "Cursor build, package, and packed CLI doctor enforce exact canonical method skills and Workit identity",
   () => {
-    expect(WORKIT).toHaveLength(14);
     const fixture = mkdtempSync(path.join(os.tmpdir(), "wk-cursor-invariants-"));
     try {
       const missingWorkitRepo = copyBuildFixture(path.join(fixture, "missing-workit"));
diff --git a/test/artifacts/manifests.test.ts b/test/artifacts/manifests.test.ts
index 5f8a3f7c..3bb12bd3 100644
--- a/test/artifacts/manifests.test.ts
+++ b/test/artifacts/manifests.test.ts
@@ -2,7 +2,10 @@ import { expect, test } from "bun:test";
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
-import { WORKIT_METHOD_SKILLS } from "@/packages/workit-core/src/core/skill-manifests";
+import {
+  WORKIT_METHOD_SKILLS,
+  WORKIT_SKILL_ALIASES,
+} from "@/packages/workit-core/src/core/skill-manifests";
 import { SUPPORT_MATRIX } from "@/packages/workit-core/src/core/support-matrix";
 import {
   listTarball,
@@ -248,22 +251,7 @@ test(
     for (const skill of WORKIT_METHOD_SKILLS) {
       expect(entries, `skills/${skill}/SKILL.md`).toContain(`skills/${skill}/SKILL.md`);
     }
-    for (const alias of [
-      "wk-babysit",
-      "wk-blast-radius",
-      "wk-challenge",
-      "wk-debug",
-      "wk-deslop",
-      "wk-diagram",
-      "wk-green-run",
-      "wk-handoff",
-      "wk-implement",
-      "wk-mockup",
-      "wk-plan",
-      "wk-review",
-      "wk-steer",
-      "wk-tdd",
-    ]) {
+    for (const alias of Object.keys(WORKIT_SKILL_ALIASES)) {
       expect(entries, `commands/${alias}.md`).toContain(`commands/${alias}.md`);
     }
     expect(
diff --git a/test/artifacts/opencode-skill-contract.test.ts b/test/artifacts/opencode-skill-contract.test.ts
index cf86e191..1b999612 100644
--- a/test/artifacts/opencode-skill-contract.test.ts
+++ b/test/artifacts/opencode-skill-contract.test.ts
@@ -20,7 +20,6 @@ const tarballSkillNames = (tarball: string, prefix: string): string[] =>
     .sort();
 
 test("opencode packed tarball ships exactly the canonical method skills", () => {
-  expect(WORKIT).toHaveLength(14);
   const tarball = byName(packWorkspacePackages(), OPENCODE).tarball;
   expect(tarballSkillNames(tarball, "assets/skills/")).toEqual(WORKIT);
   expect(tarballSkillNames(tarball, "assets/vendor/superpowers/skills/")).toEqual([]);
diff --git a/test/artifacts/package-contents.test.ts b/test/artifacts/package-contents.test.ts
index 4600be11..46416805 100644
--- a/test/artifacts/package-contents.test.ts
+++ b/test/artifacts/package-contents.test.ts
@@ -1,14 +1,6 @@
 import { expect, test } from "bun:test";
 import { spawnSync } from "node:child_process";
-import {
-  cpSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  symlinkSync,
-} from "node:fs";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import {
@@ -72,28 +64,12 @@ test("runtime TS allowlist permits vendor examples and exactly the root loader s
   }
 });
 
-test("opencode tarball ships one bundled dist entry plus fourteen method skills (RR-02/PT-06/PT-07)", () => {
+test("opencode tarball ships one bundled dist entry and no commands, templates or vendor trees", () => {
   const packs = packWorkspacePackages();
   const tarball = byName(packs, OPENCODE).tarball;
   const entries = listTarball(tarball);
 
   expect(entries).toContain("dist/plugin.js");
-  expect(entries.filter((e) => e.startsWith("assets/skills/") && e.endsWith("/SKILL.md"))).toEqual([
-    "assets/skills/workit-babysit/SKILL.md",
-    "assets/skills/workit-behavioral-tdd/SKILL.md",
-    "assets/skills/workit-blast-radius/SKILL.md",
-    "assets/skills/workit-challenge/SKILL.md",
-    "assets/skills/workit-debug/SKILL.md",
-    "assets/skills/workit-deslop/SKILL.md",
-    "assets/skills/workit-diagram/SKILL.md",
-    "assets/skills/workit-green-run/SKILL.md",
-    "assets/skills/workit-handoff/SKILL.md",
-    "assets/skills/workit-implement/SKILL.md",
-    "assets/skills/workit-mockup/SKILL.md",
-    "assets/skills/workit-plan/SKILL.md",
-    "assets/skills/workit-review/SKILL.md",
-    "assets/skills/workit-steer/SKILL.md",
-  ]);
   expect(entries.some((e) => e.startsWith("assets/commands/"))).toBe(false);
   expect(entries.some((e) => e.startsWith("assets/templates/"))).toBe(false);
   expect(entries.some((e) => e.startsWith("assets/vendor/"))).toBe(false);
@@ -393,16 +369,3 @@ test("adapter tarballs ship no legacy vendor trees", () => {
     ).toBe(false);
   }
 });
-
-test("tracked CLI template mirrors stay byte-identical to the core templates", () => {
-  // The CLI package tracks copies of the execution templates (shipped to
-  // projects by hygiene scaffolding); a fix in one copy must land in both.
-  for (const name of ["execution-contract.md", "plan-template.md"]) {
-    const core = readFileSync(path.join(REPO_ROOT, "packages/workit-core/templates", name), "utf8");
-    const mirror = readFileSync(
-      path.join(REPO_ROOT, "packages/workit-cli/assets/templates", name),
-      "utf8",
-    );
-    expect(mirror, name).toBe(core);
-  }
-});
diff --git a/test/artifacts/packed-runtime.test.ts b/test/artifacts/packed-runtime.test.ts
index 17f09dba..81989bbe 100644
--- a/test/artifacts/packed-runtime.test.ts
+++ b/test/artifacts/packed-runtime.test.ts
@@ -23,6 +23,10 @@ import {
   tarballSpec,
   REPO_ROOT,
 } from "@/test/shared/helpers/packages";
+import {
+  WORKIT_METHOD_SKILLS,
+  WORKIT_SKILL_ALIASES,
+} from "@/packages/workit-core/src/core/skill-manifests";
 
 // Task 7 packed-runtime gate: from EXTRACTED tarballs with repository node_modules
 // unavailable, the packaged adapters load/boot under plain Node without Bun or a
@@ -207,8 +211,8 @@ test(
       };
       const cleanup = await mod.default.setup(fake as never);
       if (typeof cleanup === "function") cleanup();
-      expect(skills).toHaveLength(14);
-      expect(commands).toHaveLength(14);
+      expect(skills).toHaveLength(WORKIT_METHOD_SKILLS.length);
+      expect(commands).toHaveLength(Object.keys(WORKIT_SKILL_ALIASES).length);
       for (const skill of skills) {
         expect(existsSync(skill.path), skill.id).toBe(true);
         expect(realpathSync(skill.path).startsWith(realpathSync(skillsPath)), skill.id).toBe(true);
diff --git a/test/opencode-v2/matrix.test.ts b/test/opencode-v2/matrix.test.ts
index 377af427..381bcaad 100644
--- a/test/opencode-v2/matrix.test.ts
+++ b/test/opencode-v2/matrix.test.ts
@@ -25,6 +25,10 @@ import {
   ensureImages,
   type Harness,
 } from "./harness";
+import {
+  WORKIT_METHOD_SKILLS,
+  WORKIT_SKILL_ALIASES,
+} from "@/packages/workit-core/src/core/skill-manifests";
 
 const ENABLED = process.env.WORKIT_V2_HARNESS === "1";
 const OPENCODE = "@brainervirus/workit-opencode";
@@ -285,41 +289,9 @@ test("V2 native lane loads the packed plugin, registers skills, and executes a f
   const plugins = dataOf(await lane.harness.op("v2.plugin.list"));
   expect(plugins.map((entry) => entry.id)).toContain("workit");
   const skills = dataOf(await lane.harness.op("v2.skill.list")).map((entry) => entry.id);
-  for (const id of [
-    "workit-challenge",
-    "workit-behavioral-tdd",
-    "workit-review",
-    "workit-plan",
-    "workit-implement",
-    "workit-debug",
-    "workit-handoff",
-    "workit-babysit",
-    "workit-blast-radius",
-    "workit-deslop",
-    "workit-diagram",
-    "workit-mockup",
-    "workit-green-run",
-    "workit-steer",
-  ])
-    expect(skills, id).toContain(id);
+  for (const id of WORKIT_METHOD_SKILLS) expect(skills, id).toContain(id);
   const commands = dataOf(await lane.harness.op("v2.command.list")).map((entry) => entry.name);
-  for (const alias of [
-    "wk-challenge",
-    "wk-babysit",
-    "wk-implement",
-    "wk-plan",
-    "wk-debug",
-    "wk-review",
-    "wk-handoff",
-    "wk-tdd",
-    "wk-blast-radius",
-    "wk-deslop",
-    "wk-diagram",
-    "wk-mockup",
-    "wk-green-run",
-    "wk-steer",
-  ])
-    expect(commands, alias).toContain(alias);
+  for (const alias of Object.keys(WORKIT_SKILL_ALIASES)) expect(commands, alias).toContain(alias);
 
   const messages = await runWorkitTool(lane.harness);
   const call = toolCall(messages, "workit_task");
diff --git a/test/opencode-v2/shell.test.ts b/test/opencode-v2/shell.test.ts
index 5c1a0ac4..cc6320f8 100644
--- a/test/opencode-v2/shell.test.ts
+++ b/test/opencode-v2/shell.test.ts
@@ -7,6 +7,10 @@ import { TaskStore, WorkitCore } from "@/packages/workit-core/src/core";
 import definition from "@/packages/workit-opencode/src/v2/plugin";
 import { normalizeQuestionAnswers } from "@/packages/workit-opencode/src/v2/receipts";
 import { taskStartRequest } from "../workit-core/task-fixtures";
+import {
+  WORKIT_METHOD_SKILLS,
+  WORKIT_SKILL_ALIASES,
+} from "@/packages/workit-core/src/core/skill-manifests";
 
 /** The exact 10 registered Workit tool names in registration order. */
 const TOOL_NAMES = [
@@ -315,11 +319,10 @@ test("setup registers the subagent lifecycle hooks and an abortable event stream
   }
 });
 
-test("setup registers 14 method skills with packaged content and paths", async () => {
+test("setup registers every method skill with packaged content and paths", async () => {
   const root = repository();
   try {
     const { skills } = await harness(root);
-    expect(skills).toHaveLength(14);
     for (const skill of skills) {
       expect(skill.content.length, skill.id).toBeGreaterThan(100);
       expect(skill.description?.length, skill.id).toBeGreaterThan(0);
@@ -327,32 +330,19 @@ test("setup registers 14 method skills with packaged content and paths", async (
       expect(skill.path.endsWith(path.join(skill.id, "SKILL.md")), String(skill.id)).toBe(true);
       expect(skill.content.startsWith("---"), String(skill.id)).toBe(false);
     }
-    expect(skills.map((skill) => skill.id).sort()).toEqual([
-      "workit-babysit",
-      "workit-behavioral-tdd",
-      "workit-blast-radius",
-      "workit-challenge",
-      "workit-debug",
-      "workit-deslop",
-      "workit-diagram",
-      "workit-green-run",
-      "workit-handoff",
-      "workit-implement",
-      "workit-mockup",
-      "workit-plan",
-      "workit-review",
-      "workit-steer",
-    ]);
+    expect(skills.map((skill) => skill.id).sort()).toEqual([...WORKIT_METHOD_SKILLS].sort());
   } finally {
     rmSync(root, { recursive: true, force: true });
   }
 });
 
-test("setup registers 14 collision-safe wk commands that forward prompts", async () => {
+test("setup registers one collision-safe wk command per alias that forwards prompts", async () => {
   const root = repository();
   try {
     const { commands, prompts } = await harness(root);
-    expect(commands).toHaveLength(14);
+    expect(commands.map((command) => command.name).sort()).toEqual(
+      Object.keys(WORKIT_SKILL_ALIASES).sort(),
+    );
     const names = commands.map((command) => command.name);
     expect(names).toContain("wk-tdd");
     expect(names).toContain("wk-babysit");
diff --git a/test/workit-codex/plugin.test.ts b/test/workit-codex/plugin.test.ts
index 7e975b8a..fe7500d1 100644
--- a/test/workit-codex/plugin.test.ts
+++ b/test/workit-codex/plugin.test.ts
@@ -3,10 +3,11 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
 import { OPERATION_FAMILIES } from "@/packages/workit-core/src/core";
 import { codexCapabilities, detectCodexSurface } from "@/packages/workit-codex/hooks/workit-hook";
+import { WORKIT_METHOD_SKILLS } from "@/packages/workit-core/src/core/skill-manifests";
 
 const packageRoot = path.resolve(import.meta.dir, "../../packages/workit-codex");
 
-test("Codex plugin ships current manifest layout and fourteen synchronized skills", () => {
+test("Codex plugin ships the current manifest layout and the canonical method skills", () => {
   const manifest = JSON.parse(
     readFileSync(path.join(packageRoot, ".codex-plugin/plugin.json"), "utf8"),
   );
@@ -18,22 +19,9 @@ test("Codex plugin ships current manifest layout and fourteen synchronized skill
   // hooks.json bundle, so the manifest must not advertise a Hooks capability.
   expect(manifest.interface.capabilities).toEqual(["MCP", "Task continuity"]);
   expect(manifest.mcpServers).toBe("./.mcp.json");
-  expect(readdirSync(path.join(packageRoot, "skills")).sort()).toEqual([
-    "workit-babysit",
-    "workit-behavioral-tdd",
-    "workit-blast-radius",
-    "workit-challenge",
-    "workit-debug",
-    "workit-deslop",
-    "workit-diagram",
-    "workit-green-run",
-    "workit-handoff",
-    "workit-implement",
-    "workit-mockup",
-    "workit-plan",
-    "workit-review",
-    "workit-steer",
-  ]);
+  expect(readdirSync(path.join(packageRoot, "skills")).sort()).toEqual(
+    [...WORKIT_METHOD_SKILLS].sort(),
+  );
   expect(existsSync(path.join(packageRoot, "hooks/hooks.json"))).toBe(true);
   expect(existsSync(path.join(packageRoot, ".mcp.json"))).toBe(true);
   const hooks = JSON.parse(readFileSync(path.join(packageRoot, "hooks/hooks.json"), "utf8"));
diff --git a/test/workit-core/generated-copies.test.ts b/test/workit-core/generated-copies.test.ts
new file mode 100644
index 00000000..9e404af9
--- /dev/null
+++ b/test/workit-core/generated-copies.test.ts
@@ -0,0 +1,39 @@
+import { expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+
+// Host packages commit copies of canonical sources so git-based installs
+// (Cursor marketplace, Codex plugin) work without a build. `bun run build`
+// regenerates these copies in place, so comparing working-tree files after a
+// build would pass by construction. Instead compare the committed git trees:
+// a canonical edit committed without its regenerated copies fails here.
+const repoRoot = path.resolve(import.meta.dir, "../..");
+
+const GENERATED_COPIES: Record<string, string[]> = {
+  "packages/workit-core/skills": [
+    "packages/workit-opencode/assets/skills",
+    "packages/workit-cursor/skills",
+    "packages/workit-codex/skills",
+    "packages/workit-pi/skills",
+  ],
+  "packages/workit-core/templates": ["packages/workit-cli/assets/templates"],
+};
+
+const committedTree = (relative: string): string => {
+  const result = spawnSync("git", ["rev-parse", `HEAD:${relative}`], {
+    cwd: repoRoot,
+    encoding: "utf8",
+  });
+  if (result.status !== 0) throw new Error(`git rev-parse HEAD:${relative}: ${result.stderr}`);
+  return result.stdout.trim();
+};
+
+test("committed host copies match the canonical source they are built from", () => {
+  for (const [canonical, copies] of Object.entries(GENERATED_COPIES)) {
+    const expected = committedTree(canonical);
+    for (const copy of copies)
+      expect(committedTree(copy), `${copy} differs from ${canonical}; run bun run build`).toBe(
+        expected,
+      );
+  }
+});
diff --git a/test/workit-core/methods.test.ts b/test/workit-core/methods.test.ts
index b225b01f..3e334e0a 100644
--- a/test/workit-core/methods.test.ts
+++ b/test/workit-core/methods.test.ts
@@ -308,36 +308,8 @@ test("debug and behavioral-tdd do not wait for pre-assess policy selection", ()
   }
 });
 
-test("host skill copies stay byte-identical to every canonical core skill", () => {
-  for (const name of WORKIT_METHOD_SKILLS) {
-    const canonical = skillText(name);
-    for (const host of ["opencode/assets/skills", "cursor/skills", "codex/skills", "pi/skills"]) {
-      const relative = `packages/workit-${host}/${name}/SKILL.md`;
-      expect(readFileSync(path.join(import.meta.dir, "../..", relative), "utf8"), relative).toBe(
-        canonical,
-      );
-    }
-  }
-});
-
-test("method manifest lists exactly fourteen core skills", () => {
-  expect(WORKIT_METHOD_SKILLS).toEqual([
-    "workit-challenge",
-    "workit-behavioral-tdd",
-    "workit-review",
-    "workit-plan",
-    "workit-implement",
-    "workit-debug",
-    "workit-handoff",
-    "workit-babysit",
-    "workit-blast-radius",
-    "workit-deslop",
-    "workit-diagram",
-    "workit-mockup",
-    "workit-green-run",
-    "workit-steer",
-  ]);
-  expect(skillManifestNames("packages/workit-core/skills")).toEqual([
-    ...[...WORKIT_METHOD_SKILLS].sort(),
-  ]);
+test("method manifest matches the canonical skill directories", () => {
+  expect(
+    skillManifestNames(path.join(import.meta.dir, "../../packages/workit-core/skills")),
+  ).toEqual([...WORKIT_METHOD_SKILLS].sort());
 });
diff --git a/test/workit-opencode/plugin.test.ts b/test/workit-opencode/plugin.test.ts
index 4a841bdf..9187dcc2 100644
--- a/test/workit-opencode/plugin.test.ts
+++ b/test/workit-opencode/plugin.test.ts
@@ -2,6 +2,10 @@ import { expect, test } from "bun:test";
 import { readdirSync } from "node:fs";
 import path from "node:path";
 import { server as plugin } from "@/packages/workit-opencode/src/index";
+import {
+  WORKIT_METHOD_SKILLS,
+  WORKIT_SKILL_ALIASES,
+} from "@/packages/workit-core/src/core/skill-manifests";
 
 const packageSkills = path.resolve(import.meta.dir, "../../packages/workit-opencode/assets/skills");
 const families = [
@@ -40,38 +44,8 @@ test("config registers only the policy-selected method skills", async () => {
   const config: Record<string, any> = {};
   await hooks.config?.(config);
   expect(config.skills.paths).toEqual([packageSkills]);
-  expect(readdirSync(packageSkills).sort()).toEqual([
-    "workit-babysit",
-    "workit-behavioral-tdd",
-    "workit-blast-radius",
-    "workit-challenge",
-    "workit-debug",
-    "workit-deslop",
-    "workit-diagram",
-    "workit-green-run",
-    "workit-handoff",
-    "workit-implement",
-    "workit-mockup",
-    "workit-plan",
-    "workit-review",
-    "workit-steer",
-  ]);
-  expect(Object.keys(config.command).sort()).toEqual([
-    "wk-babysit",
-    "wk-blast-radius",
-    "wk-challenge",
-    "wk-debug",
-    "wk-deslop",
-    "wk-diagram",
-    "wk-green-run",
-    "wk-handoff",
-    "wk-implement",
-    "wk-mockup",
-    "wk-plan",
-    "wk-review",
-    "wk-steer",
-    "wk-tdd",
-  ]);
+  expect(readdirSync(packageSkills).sort()).toEqual([...WORKIT_METHOD_SKILLS].sort());
+  expect(Object.keys(config.command).sort()).toEqual(Object.keys(WORKIT_SKILL_ALIASES).sort());
   expect(config.command["wk-challenge"].description).toContain("workit-challenge");
   expect(config.command["wk-challenge"].template).toContain("$ARGUMENTS");
 });
diff --git a/test/workit-pi/extension.test.ts b/test/workit-pi/extension.test.ts
index b2e6c724..eeb5932c 100644
--- a/test/workit-pi/extension.test.ts
+++ b/test/workit-pi/extension.test.ts
@@ -1,5 +1,5 @@
 import { expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { spawn, spawnSync } from "node:child_process";
 import path from "node:path";
 import { tmpdir } from "node:os";
@@ -156,27 +156,6 @@ test("clean Pi package declares stock discovery and the eight families plus exte
   expect(pi.commands.map((command) => command.name)).toContain("workit-worker");
 });
 
-test("Pi package ships the fourteen canonical method skills", () => {
-  expect(readdirSync(path.join(import.meta.dir, "../../packages/workit-pi/skills")).sort()).toEqual(
-    [
-      "workit-babysit",
-      "workit-behavioral-tdd",
-      "workit-blast-radius",
-      "workit-challenge",
-      "workit-debug",
-      "workit-deslop",
-      "workit-diagram",
-      "workit-green-run",
-      "workit-handoff",
-      "workit-implement",
-      "workit-mockup",
-      "workit-plan",
-      "workit-review",
-      "workit-steer",
-    ],
-  );
-});
-
 test("Pi registers wk- slash aliases that expand the bundled skill commands", async () => {
   const pi = makePi();
   await extension(pi as any);
diff --git a/test/workit-pi/stock-pi.test.ts b/test/workit-pi/stock-pi.test.ts
index 021f665a..b4fe9af6 100644
--- a/test/workit-pi/stock-pi.test.ts
+++ b/test/workit-pi/stock-pi.test.ts
@@ -6,6 +6,10 @@ import path from "node:path";
 import { SUPPORT_MATRIX } from "@/packages/workit-core/src/core/support-matrix";
 import { TaskStore, WorkitCore, type OperationContext } from "@/packages/workit-core/src/core";
 import { taskStartRequest } from "@/test/workit-core/task-fixtures";
+import {
+  WORKIT_METHOD_SKILLS,
+  WORKIT_SKILL_ALIASES,
+} from "@/packages/workit-core/src/core/skill-manifests";
 
 const node = "node";
 
@@ -103,26 +107,14 @@ test(
         (message) => message.type === "response" && message.command === "get_commands",
       ) as { data: { commands: Array<{ name: string; source: string }> } };
       const commands = response.data.commands;
-      expect(commands.filter((command) => command.name.startsWith("skill:workit-"))).toHaveLength(
-        14,
-      );
+      expect(
+        commands
+          .filter((command) => command.name.startsWith("skill:workit-"))
+          .map((command) => command.name.slice("skill:".length))
+          .sort(),
+      ).toEqual([...WORKIT_METHOD_SKILLS].sort());
       expect(commands.map((command) => command.name)).toEqual(
-        expect.arrayContaining([
-          "wk-challenge",
-          "wk-babysit",
-          "wk-implement",
-          "wk-plan",
-          "wk-debug",
-          "wk-review",
-          "wk-handoff",
-          "wk-tdd",
-          "wk-blast-radius",
-          "wk-deslop",
-          "wk-diagram",
-          "wk-mockup",
-          "wk-green-run",
-          "wk-steer",
-        ]),
+        expect.arrayContaining(Object.keys(WORKIT_SKILL_ALIASES)),
       );
       expect(
         commands.some(

From b5d4347ff776f6c5185fea182d7bd30c7c4078ea Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:13:03 -0300
Subject: [PATCH 05/16] test: assert bootstrap and skill contract keywords
 instead of whole sentences

methods.test.ts asserted ~35 literal sentences of the bootstrap and SKILL.md
prose, so any rewording failed the suite without a behavior change. Kept
only the keywords agents depend on:
- bootstrap: native allow/ask/deny stays authoritative, never evade a
  denial, no task.start/policy.assess preamble, TDD/review left to policy,
  routed skill names, and every operation family name.
- steer stays lifecycle-free, babysit does not authorize merge, challenge
  never fabricates a native permission.
- all method skills: the four negative preamble/policy-gating patterns are
  now checked across every skill (previously two of them for two skills).
Deleted "planning keeps documentation proportional..." (pure prose of
workit-plan/workit-implement, no contract keyword) and the sentence-level
assertions of the steer/babysit/challenge tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/workit-core/methods.test.ts | 96 +++++++-------------------------
 1 file changed, 21 insertions(+), 75 deletions(-)

diff --git a/test/workit-core/methods.test.ts b/test/workit-core/methods.test.ts
index 3e334e0a..99a804fb 100644
--- a/test/workit-core/methods.test.ts
+++ b/test/workit-core/methods.test.ts
@@ -169,45 +169,34 @@ test("selection has stable registry order and no duplicate methods", () => {
   expect(new Set(selected.map((method) => method.id)).size).toBe(selected.length);
 });
 
-test("bootstrap preserves host authority and keeps Workit coordination optional", () => {
+// Bootstrap and skill text is agent-facing prose: assert only the contract
+// keywords an agent relies on, not whole sentences.
+test("bootstrap defers to native host authority and mandates no Workit preamble", () => {
   const bootstrap = invariantBootstrap();
-  expect(bootstrap.toLowerCase()).toContain("authority");
-  expect(bootstrap.toLowerCase()).toContain("state");
-  expect(bootstrap.toLowerCase()).toContain("operation");
-  expect(bootstrap).toContain("Native host allow/ask/deny");
-  expect(bootstrap).toContain("zero Workit task, assessment, or writer calls");
-  expect(bootstrap).toContain("prefer native host Git/shell");
-  expect(bootstrap).toContain("Never switch execution paths to evade a denial");
-  expect(bootstrap).toContain("A local-commit endpoint does not imply");
-  expect(bootstrap.toLowerCase()).toContain("not automatic");
-  expect(bootstrap).toContain("branch/commit/push");
-  expect(bootstrap).toContain("reconcile every requested item");
-  expect(bootstrap).toContain("a local commit alone is not evidence");
-  expect(bootstrap).not.toContain("run task.start then policy.assess");
+  expect(bootstrap).toMatch(/allow\/ask\/deny/);
+  expect(bootstrap).toMatch(/evade a denial/);
+  expect(bootstrap).not.toContain("task.start then policy.assess");
+  // Policy selects TDD and review; the bootstrap must not hard-wire them.
   expect(bootstrap).not.toContain("workit-behavioral-tdd");
   expect(bootstrap).not.toContain("workit-review");
-  expect(bootstrap).toContain(
-    "Load workit-plan when dependencies or handoff need durable next actions",
-  );
 });
 
 test("bootstrap routes moment-based skill loads by name", () => {
   const bootstrap = invariantBootstrap();
-  expect(bootstrap).toContain("Skill routing");
-  expect(bootstrap).toContain("workit-steer");
-  expect(bootstrap).toContain("workit-deslop");
-  expect(bootstrap).toContain("workit-green-run");
-  expect(bootstrap).toContain("workit-blast-radius");
-  expect(bootstrap).toContain("workit-challenge");
+  for (const skill of [
+    "workit-steer",
+    "workit-deslop",
+    "workit-green-run",
+    "workit-blast-radius",
+    "workit-challenge",
+    "workit-plan",
+  ])
+    expect(bootstrap).toContain(skill);
   expect(bootstrap).not.toContain("## Method");
 });
 
-test("bootstrap records only work that benefits from continuity or coordination", () => {
+test("bootstrap names every shared operation family", () => {
   const bootstrap = invariantBootstrap();
-  expect(bootstrap).toContain("handoff, dependent steps, concurrent actors");
-  expect(bootstrap).toContain("A solo edit does not need writer acquisition");
-  expect(bootstrap).toContain("Answer a quick question without pausing/resuming task state");
-  expect(bootstrap).toContain("not a permission system or a mandatory workflow");
   for (const operation of [
     "task",
     "policy",
@@ -221,48 +210,12 @@ test("bootstrap records only work that benefits from continuity or coordination"
     expect(bootstrap).toContain(operation);
 });
 
-test("steer stays lifecycle-free and babysit preserves explicit merge evidence", () => {
+test("steer, babysit and challenge keep lifecycle and merge authority outside the skill", () => {
   const steer = skillText("workit-steer");
-  expect(steer).toContain("Answer a quick question");
-  expect(steer).toContain("do not silently resume an old objective");
-  expect(steer).toContain("checkout, branch, requested");
-  expect(steer).toContain("Keep explicitly held items parked");
-  expect(steer).toContain("A conversational");
   expect(steer).not.toContain("task.start");
   expect(steer).not.toContain("policy.assess");
-  const babysit = skillText("workit-babysit");
-  expect(babysit).toContain("PR creation does not start babysitting");
-  expect(babysit).toContain("Stop at PR-ready");
-  expect(babysit).toContain("does not authorize merge");
-  expect(babysit).not.toContain("drive + merge");
-  expect(babysit).toContain("squash merge");
-  expect(babysit).toContain("re-record");
-  expect(babysit).toContain("route Workit did not enforce");
-});
-
-test("challenge presents evidence-led options without a receipt or debate ritual", () => {
-  const skill = skillText("workit-challenge");
-  expect(skill).toContain("two or three genuinely different");
-  expect(skill).toContain("small round");
-  expect(skill).toContain("never fabricate a native permission");
-  expect(skill).toContain("Brainstorming alone does not require a spec");
-  expect(skill).not.toContain("receipt-shaped question");
-  expect(skill).not.toContain("three rounds");
-});
-
-test("planning keeps documentation proportional and continues through the authorized endpoint", () => {
-  const plan = skillText("workit-plan");
-  expect(plan).toContain("A small fix needs no document");
-  expect(plan).toContain(
-    "Create a spec when a durable behavior contract or interface is requested",
-  );
-  expect(plan).toContain("proceed through the agreed endpoint");
-  expect(plan).toContain("Do not ask for a separate plan approval");
-  const implement = skillText("workit-implement");
-  expect(implement).toContain("checks appropriate to the requested");
-  expect(implement).toContain("competing plausible targets");
-  expect(implement).toContain("reconcile every named deliverable");
-  expect(implement).toContain("observe the destination remote");
+  expect(skillText("workit-babysit")).toMatch(/does not authorize merge/);
+  expect(skillText("workit-challenge")).toMatch(/never fabricate a native permission/);
 });
 
 test("compact task context carries selected methods and refreshes with policy", () => {
@@ -291,18 +244,11 @@ test("compact task context carries selected methods and refreshes with policy",
   ]);
 });
 
-test("method skills do not impose a universal task-start or assessment preamble", () => {
+test("method skills impose no task-start preamble and do not wait for policy selection", () => {
   for (const name of WORKIT_METHOD_SKILLS) {
     const skill = skillText(name);
     expect(skill, name).not.toContain("Before method work");
     expect(skill, name).not.toContain("If there is no active or paused task");
-  }
-  expect(skillText("workit-plan")).toContain("never a prerequisite for implementation");
-});
-
-test("debug and behavioral-tdd do not wait for pre-assess policy selection", () => {
-  for (const name of ["workit-debug", "workit-behavioral-tdd"] as const) {
-    const skill = skillText(name);
     expect(skill, name).not.toMatch(/only when policy selects/i);
     expect(skill, name).not.toMatch(/when the `[^`]+` rule is selected/i);
   }

From 3e2c58391fef802c49989846c159793c8113e1c5 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:13:27 -0300
Subject: [PATCH 06/16] test: rename typescript-parity to repo-context and drop
 its source-grep check

typescript-parity.test.ts described its cases as parity with shell scripts
that no longer exist, but every case exercises the TS context generators
against a real fixture repo, so the behavior coverage stays. Renamed to
repo-context.test.ts and named the cases after the behavior they check.
Deleted "PATH scanning uses path.delimiter (Windows-safe) not a literal
colon": it grepped pr-create.ts for the text `split(path.delimiter)`;
the missing-CLI guard in workspaces-scripts.test.ts runs whichOnPath over
a path.delimiter-joined PATH, which is the behavioral check.
doctor AR-14 now targets the renamed file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/workit-core/doctor.test.ts               |  2 +-
 ...pt-parity.test.ts => repo-context.test.ts} | 67 +++++++------------
 2 files changed, 25 insertions(+), 44 deletions(-)
 rename test/workit-core/{typescript-parity.test.ts => repo-context.test.ts} (88%)

diff --git a/test/workit-core/doctor.test.ts b/test/workit-core/doctor.test.ts
index db6c74d3..e7e7cabe 100644
--- a/test/workit-core/doctor.test.ts
+++ b/test/workit-core/doctor.test.ts
@@ -1734,7 +1734,7 @@ test(
   "AR-14: negative fixtures never leak raw git usage/fatal dumps into the suite output",
   () => {
     // Suites whose fixtures run git against missing revisions and non-repos.
-    const noisy = ["test/workit-core/repo.test.ts", "test/workit-core/typescript-parity.test.ts"];
+    const noisy = ["test/workit-core/repo.test.ts", "test/workit-core/repo-context.test.ts"];
     for (const file of noisy) expect(existsSync(path.join(repoRoot, file)), file).toBe(true);
     const r = spawnSync("bun", ["test", ...noisy.map((file) => `./${file}`)], {
       cwd: repoRoot,
diff --git a/test/workit-core/typescript-parity.test.ts b/test/workit-core/repo-context.test.ts
similarity index 88%
rename from test/workit-core/typescript-parity.test.ts
rename to test/workit-core/repo-context.test.ts
index e9c5b9bc..08b289cf 100644
--- a/test/workit-core/typescript-parity.test.ts
+++ b/test/workit-core/repo-context.test.ts
@@ -18,7 +18,7 @@ import {
 import { gitContext } from "@/packages/workit-core/src/core/git";
 import { youTrackApi } from "@/packages/workit-core/src/core/youtrack";
 
-/** Split context stdout on `## Section` headers (the shell print_section shape). */
+/** Split context stdout on `## Section` headers. */
 const parseSections = (stdout: string): Record<string, string> => {
   const sections: Record<string, string> = {};
   for (const part of stdout.split(/\n## /).slice(1)) {
@@ -36,10 +36,8 @@ const parseKeyValueLines = (text: string, keys: string[]): Record<string, string
   return out;
 };
 
-// Parity between the TS runtime ports and the maintained shell behavior they
-// replaced. Fixtures below were captured from the real scripts before the shell
-// port: the context generators must reproduce the same parsed sections and
-// error text.
+// Behavior of the repository context generators (PR, changelog, docs refresh,
+// release notes) and git context against a real fixture repository.
 
 function buildFixtureRepo(): { repo: string; mergeBase: string } {
   const repo = mkdtempSync(path.join(os.tmpdir(), "wf-parity-repo-"));
@@ -146,7 +144,7 @@ test(
 );
 
 test(
-  "branch classification and current branch match the shell predicates",
+  "branch classification and current branch",
   () => {
     const { repo } = buildFixtureRepo();
     try {
@@ -169,7 +167,7 @@ test(
 );
 
 test.skipIf(process.platform === "win32")(
-  "resolvePrBranchContext yields the branch-exclusive range the shell produced",
+  "resolvePrBranchContext yields the branch-exclusive range against the configured target",
   () => {
     const { repo, mergeBase } = buildFixtureRepo();
     try {
@@ -188,7 +186,7 @@ test.skipIf(process.platform === "win32")(
 );
 
 test.skipIf(process.platform === "win32")(
-  "pr-ready-context sections match the shell output (auto branch-exclusive range)",
+  "pr-ready-context reports repository, commits, files, template and VCS sections (auto branch-exclusive range)",
   () => {
     const { repo } = buildFixtureRepo();
     try {
@@ -221,7 +219,7 @@ test.skipIf(process.platform === "win32")(
       expect(sections.Summary ?? "").toContain("- fix");
       expect(sections["VCS Config"] ?? "").toContain("workspace: work");
       expect(sections["VCS Config"] ?? "").toContain("provider: gitlab");
-      // B4: concise shell shape — workspace:/provider: only, no raw summary JSON.
+      // Concise shape: workspace:/provider: only, no raw summary JSON.
       expect(sections["VCS Config"] ?? "").not.toContain('"defaultTargetBranch"');
       expect(sections["Merged PR Style"] ?? "").toContain("no origin remote");
     } finally {
@@ -254,23 +252,20 @@ test.skipIf(process.platform === "win32")(
   { timeout: 60_000 },
 );
 
-test.skipIf(process.platform === "win32")(
-  "pr-ready-context errors on protected branches with the shell message",
-  () => {
-    const { repo } = buildFixtureRepo();
-    try {
-      spawnSync("git", ["checkout", "-q", "main"], { cwd: repo });
-      const result = withGitLabConfig(() => prReadyContext(repo));
-      expect(result.exitCode).toBe(1);
-      expect(result.stderr).toContain("cannot build PR context on protected branch main");
-    } finally {
-      rmSync(repo, { recursive: true, force: true });
-    }
-  },
-);
+test.skipIf(process.platform === "win32")("pr-ready-context refuses protected branches", () => {
+  const { repo } = buildFixtureRepo();
+  try {
+    spawnSync("git", ["checkout", "-q", "main"], { cwd: repo });
+    const result = withGitLabConfig(() => prReadyContext(repo));
+    expect(result.exitCode).toBe(1);
+    expect(result.stderr).toContain("cannot build PR context on protected branch main");
+  } finally {
+    rmSync(repo, { recursive: true, force: true });
+  }
+});
 
 test(
-  "changelog-context sections match the shell output",
+  "changelog-context reports branch range, rules, existing changelog and changes",
   () => {
     const { repo } = buildFixtureRepo();
     try {
@@ -282,7 +277,7 @@ test(
       expect(repoSection.range).toBe("main...HEAD");
       expect(sections["Keep a Changelog Rules"] ?? "").toContain("Use an [Unreleased] section.");
       // parseSections splits on "## ", so the excerpt ends at the changelog's own
-      // "## [Unreleased]" heading — identical to how the shell output was parsed.
+      // "## [Unreleased]" heading.
       expect(sections["Existing CHANGELOG.md"] ?? "").toBe("# Changelog");
       expect(sections.Commits ?? "").toContain("feature change");
       expect(sections["Changed Files"] ?? "").toBe("feature.txt");
@@ -294,7 +289,7 @@ test(
 );
 
 test(
-  "docs-refresh-context sections match the shell output",
+  "docs-refresh-context reports changed files, doc files and previews",
   () => {
     const { repo } = buildFixtureRepo();
     try {
@@ -317,7 +312,7 @@ test(
 );
 
 test(
-  "release-notes-context requires a range and reproduces the shell sections",
+  "release-notes-context requires a range and reports commits and release files",
   () => {
     const { repo } = buildFixtureRepo();
     try {
@@ -340,7 +335,7 @@ test(
   { timeout: 60_000 },
 );
 
-test("git context exposes the same branch and status fields the shell produced", () => {
+test("git context exposes branch, untracked files and workspace root", () => {
   const { repo } = buildFixtureRepo();
   try {
     writeFileSync(path.join(repo, "untracked.txt"), "keep\n");
@@ -368,20 +363,6 @@ test(
   { timeout: 60_000 },
 );
 
-test(
-  "PATH scanning uses path.delimiter (Windows-safe) not a literal colon",
-  () => {
-    const prCreateSource = readFileSync(
-      path.resolve(import.meta.dir, "..", "..", "packages", "workit-core", "src/core/pr-create.ts"),
-      "utf8",
-    );
-    expect(prCreateSource).toContain("split(path.delimiter)");
-    // Functional delimiter coverage lives in workspaces-scripts.test.ts: the
-    // missing-CLI guard runs whichOnPath over a path.delimiter-joined PATH.
-  },
-  { timeout: 60_000 },
-);
-
 test(
   "YouTrack API uses fetch (not the curl binary) and never leaks the token",
   async () => {
@@ -405,7 +386,7 @@ test(
     process.env.WORKFLOW_YOUTRACK_CONFIG = configPath;
     try {
       const result = await youTrackApi(["post-comment", "NSR-40", "Revisado"], "1");
-      expect(seenAuth).toBe("Bearer secret-token"); // header carried, exactly like curl -H
+      expect(seenAuth).toBe("Bearer secret-token");
       expect("error" in result).toBe(true);
       expect(JSON.stringify(result)).not.toContain("secret-token");
       expect(JSON.stringify(result)).not.toContain("Authorization");

From 43a1be1a1aff37d01d5a8d95d949067565adb0c0 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:13:45 -0300
Subject: [PATCH 07/16] test: fold per-host route-denial scope tests into the
 core parity table

workit-opencode/route-denial-scope.test.ts and workit-pi/route-denial-scope
.test.ts ran the same five commands, with and without a live task, against
the same adapter functions that core/route-denial-parity.test.ts already
drives for OpenCode, Pi and Codex. The parity table now also asserts what
only the per-host files checked: the denial carries the protected_ref
reason (OpenCode error, Pi block reason with block: true), plus the
`git checkout -b feature/raw` and `git status --short` rows. The Pi
extension's own tool_call tests stay as the thin adapter-wiring check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/workit-core/route-denial-parity.test.ts  |  31 ++++--
 .../route-denial-scope.test.ts                | 101 ------------------
 test/workit-pi/route-denial-scope.test.ts     |  95 ----------------
 3 files changed, 22 insertions(+), 205 deletions(-)
 delete mode 100644 test/workit-opencode/route-denial-scope.test.ts
 delete mode 100644 test/workit-pi/route-denial-scope.test.ts

diff --git a/test/workit-core/route-denial-parity.test.ts b/test/workit-core/route-denial-parity.test.ts
index b4480f7d..5b2aca66 100644
--- a/test/workit-core/route-denial-parity.test.ts
+++ b/test/workit-core/route-denial-parity.test.ts
@@ -54,7 +54,8 @@ const startTask = (root: string, host: OperationContext["caller"]["host"]) => {
   if (!started.ok) throw new Error(started.error);
 };
 
-const opencodeDenies = async (root: string, command: string): Promise<boolean> => {
+// Each adapter returns its denial reason, or null when the command passes.
+const opencodeDenial = async (root: string, command: string): Promise<string | null> => {
   const hooks = await plugin({
     directory: root,
     worktree: root,
@@ -65,17 +66,21 @@ const opencodeDenies = async (root: string, command: string): Promise<boolean> =
       { tool: "bash", sessionID: "lead", callID: command } as never,
       { args: { command } } as never,
     );
-    return false;
-  } catch {
-    return true;
+    return null;
+  } catch (error) {
+    return String(error);
   }
 };
 
-const piDenies = (root: string, command: string): boolean =>
-  enforceNativeWriter(
+const piDenial = (root: string, command: string): string | null => {
+  const result = enforceNativeWriter(
     { toolName: "bash", input: { command } } as never,
     { cwd: root, isProjectTrusted: () => true } as never,
-  ) !== undefined;
+  ) as { block?: boolean; reason?: string } | undefined;
+  if (result === undefined) return null;
+  expect(result.block).toBe(true);
+  return String(result.reason);
+};
 
 const codexResult = (root: string, command: string) => {
   const result = handleCodexHook({
@@ -106,12 +111,20 @@ test("all adapters enforce only recognized noncompliant branch targets", async (
       for (const [command, denied] of [
         ["git checkout -b main", true],
         ["git switch -c feature/raw", false],
+        ["git checkout -b feature/raw", false],
+        ["git status --short", false],
         ["gh pr create --fill", false],
         ["git worktree add ../other", false],
         ['git checkout -b "main"', false],
       ] as const) {
-        expect(await opencodeDenies(root, command), `opencode ${command}`).toBe(denied);
-        expect(piDenies(root, command), `pi ${command}`).toBe(denied);
+        const opencode = await opencodeDenial(root, command);
+        const pi = piDenial(root, command);
+        expect(opencode !== null, `opencode ${command}`).toBe(denied);
+        expect(pi !== null, `pi ${command}`).toBe(denied);
+        if (denied) {
+          expect(opencode, `opencode ${command}`).toContain("protected_ref");
+          expect(pi, `pi ${command}`).toContain("protected_ref");
+        }
         expect(codexDenies(root, command), `codex ${command}`).toBe(denied);
       }
       expect(codexResult(root, "git status --short")).toEqual({ hookEventName: "PreToolUse" });
diff --git a/test/workit-opencode/route-denial-scope.test.ts b/test/workit-opencode/route-denial-scope.test.ts
deleted file mode 100644
index c43e887e..00000000
--- a/test/workit-opencode/route-denial-scope.test.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-import { afterAll, beforeAll, expect, test } from "bun:test";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { TaskStore, WorkitCore } from "@/packages/workit-core/src/core";
-import { scope, taskStartRequest } from "@/test/workit-core/task-fixtures";
-import { server as plugin } from "@/packages/workit-opencode/src/index";
-
-const previousEnv = {
-  config: process.env.WORKFLOW_TOOLKIT_CONFIG,
-  configDir: process.env.WORKFLOW_TOOLKIT_CONFIG_DIR,
-  profile: process.env.WORKFLOW_PROFILE,
-  workspace: process.env.WORKFLOW_WORKSPACE_NAME,
-};
-let configDir: string;
-beforeAll(() => {
-  configDir = mkdtempSync(join(tmpdir(), "workit-opencode-route-config-"));
-  delete process.env.WORKFLOW_TOOLKIT_CONFIG;
-  process.env.WORKFLOW_TOOLKIT_CONFIG_DIR = configDir;
-  delete process.env.WORKFLOW_PROFILE;
-  delete process.env.WORKFLOW_WORKSPACE_NAME;
-  writeFileSync(
-    join(configDir, "config.json"),
-    JSON.stringify({
-      branchPolicy: { preset: "custom", allowed: ["feature/*"], protected: ["main"] },
-    }),
-  );
-});
-afterAll(() => {
-  if (previousEnv.config === undefined) delete process.env.WORKFLOW_TOOLKIT_CONFIG;
-  else process.env.WORKFLOW_TOOLKIT_CONFIG = previousEnv.config;
-  if (previousEnv.configDir === undefined) delete process.env.WORKFLOW_TOOLKIT_CONFIG_DIR;
-  else process.env.WORKFLOW_TOOLKIT_CONFIG_DIR = previousEnv.configDir;
-  if (previousEnv.profile === undefined) delete process.env.WORKFLOW_PROFILE;
-  else process.env.WORKFLOW_PROFILE = previousEnv.profile;
-  if (previousEnv.workspace === undefined) delete process.env.WORKFLOW_WORKSPACE_NAME;
-  else process.env.WORKFLOW_WORKSPACE_NAME = previousEnv.workspace;
-  rmSync(configDir, { recursive: true, force: true });
-});
-
-const startTask = (root: string) => {
-  const store = new TaskStore(root);
-  const core = new WorkitCore(store, {
-    root,
-    caller: { host: "opencode", actor: "lead" },
-    capabilities: [],
-    constraints: [],
-    now: () => "2026-01-01T00:00:00Z",
-  });
-  const started = core.task(
-    taskStartRequest({
-      intent: { objective: "test task", scope: scope({ paths: ["."] }), authorityRefs: [] },
-    }),
-  );
-  if (!started.ok) throw new Error(started.error);
-};
-
-const bash = (
-  hooks: { "tool.execute.before"?: (input: never, output: never) => unknown },
-  command: string,
-) =>
-  hooks["tool.execute.before"]?.(
-    { tool: "bash", sessionID: "lead", callID: command } as never,
-    { args: { command } } as never,
-  );
-
-test("OpenCode blocks only noncompliant literal branch targets inside live work", async () => {
-  const root = mkdtempSync(join(tmpdir(), "workit-opencode-route-scope-"));
-  try {
-    startTask(root);
-    const hooks = await plugin({
-      directory: root,
-      worktree: root,
-      serverUrl: new URL("http://localhost"),
-    } as never);
-    await expect(bash(hooks, "git checkout -b main")).rejects.toThrow("protected_ref");
-    await expect(bash(hooks, "git checkout -b feature/raw")).resolves.toBeUndefined();
-    await expect(bash(hooks, "gh pr create --fill")).resolves.toBeUndefined();
-    await expect(bash(hooks, "git worktree add ../other")).resolves.toBeUndefined();
-    await expect(bash(hooks, "git status --short")).resolves.toBeUndefined();
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("OpenCode branch policy does not depend on task state", async () => {
-  const root = mkdtempSync(join(tmpdir(), "workit-opencode-route-scope-"));
-  try {
-    const hooks = await plugin({
-      directory: root,
-      worktree: root,
-      serverUrl: new URL("http://localhost"),
-    } as never);
-    await expect(bash(hooks, "git checkout -b main")).rejects.toThrow("protected_ref");
-    await expect(bash(hooks, "git checkout -b feature/raw")).resolves.toBeUndefined();
-    await expect(bash(hooks, "gh pr create --fill")).resolves.toBeUndefined();
-    await expect(bash(hooks, "git worktree add ../other")).resolves.toBeUndefined();
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
diff --git a/test/workit-pi/route-denial-scope.test.ts b/test/workit-pi/route-denial-scope.test.ts
deleted file mode 100644
index 59d33e88..00000000
--- a/test/workit-pi/route-denial-scope.test.ts
+++ /dev/null
@@ -1,95 +0,0 @@
-import { afterAll, beforeAll, expect, test } from "bun:test";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { TaskStore, WorkitCore, type OperationContext } from "@/packages/workit-core/src/core";
-import { taskStartRequest } from "@/test/workit-core/task-fixtures";
-import { enforceNativeWriter } from "@/packages/workit-pi/src/tools";
-
-const previousEnv = {
-  config: process.env.WORKFLOW_TOOLKIT_CONFIG,
-  configDir: process.env.WORKFLOW_TOOLKIT_CONFIG_DIR,
-  profile: process.env.WORKFLOW_PROFILE,
-  workspace: process.env.WORKFLOW_WORKSPACE_NAME,
-};
-let configDir: string;
-beforeAll(() => {
-  configDir = mkdtempSync(join(tmpdir(), "workit-pi-route-config-"));
-  delete process.env.WORKFLOW_TOOLKIT_CONFIG;
-  process.env.WORKFLOW_TOOLKIT_CONFIG_DIR = configDir;
-  delete process.env.WORKFLOW_PROFILE;
-  delete process.env.WORKFLOW_WORKSPACE_NAME;
-  writeFileSync(
-    join(configDir, "config.json"),
-    JSON.stringify({
-      branchPolicy: { preset: "custom", allowed: ["feature/*"], protected: ["main"] },
-    }),
-  );
-});
-afterAll(() => {
-  if (previousEnv.config === undefined) delete process.env.WORKFLOW_TOOLKIT_CONFIG;
-  else process.env.WORKFLOW_TOOLKIT_CONFIG = previousEnv.config;
-  if (previousEnv.configDir === undefined) delete process.env.WORKFLOW_TOOLKIT_CONFIG_DIR;
-  else process.env.WORKFLOW_TOOLKIT_CONFIG_DIR = previousEnv.configDir;
-  if (previousEnv.profile === undefined) delete process.env.WORKFLOW_PROFILE;
-  else process.env.WORKFLOW_PROFILE = previousEnv.profile;
-  if (previousEnv.workspace === undefined) delete process.env.WORKFLOW_WORKSPACE_NAME;
-  else process.env.WORKFLOW_WORKSPACE_NAME = previousEnv.workspace;
-  rmSync(configDir, { recursive: true, force: true });
-});
-
-const startTask = (root: string) => {
-  const store = new TaskStore(root);
-  const context: OperationContext = {
-    root,
-    caller: { host: "pi", actor: "pi-session" },
-    callerAttested: true,
-    capabilities: [],
-    constraints: [],
-    now: "2026-01-01T00:00:00Z",
-  };
-  const started = new WorkitCore(store, context).task(taskStartRequest());
-  if (!started.ok) throw new Error(started.error);
-};
-
-const ctx = (root: string) =>
-  ({
-    cwd: root,
-    hasUI: false,
-    mode: "json",
-    isProjectTrusted: () => true,
-    sessionManager: { getSessionId: () => "pi-session" },
-    ui: { confirm: async () => true },
-  }) as never;
-
-const bash = (command: string) => ({ toolName: "bash", input: { command } }) as never;
-
-test("Pi blocks only noncompliant literal branch targets inside live work", () => {
-  const root = mkdtempSync(join(tmpdir(), "workit-pi-route-scope-"));
-  try {
-    startTask(root);
-    const branch = enforceNativeWriter(bash("git checkout -b main"), ctx(root));
-    expect(branch).toMatchObject({ block: true });
-    expect(String((branch as { reason?: string })?.reason)).toContain("protected_ref");
-    expect(enforceNativeWriter(bash("git checkout -b feature/raw"), ctx(root))).toBeUndefined();
-    expect(enforceNativeWriter(bash("gh pr create --fill"), ctx(root))).toBeUndefined();
-    expect(enforceNativeWriter(bash("git worktree add ../other"), ctx(root))).toBeUndefined();
-    expect(enforceNativeWriter(bash("git status --short"), ctx(root))).toBeUndefined();
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("Pi branch policy does not depend on task state", () => {
-  const root = mkdtempSync(join(tmpdir(), "workit-pi-route-scope-"));
-  try {
-    expect(enforceNativeWriter(bash("git checkout -b main"), ctx(root))).toMatchObject({
-      block: true,
-    });
-    expect(enforceNativeWriter(bash("git checkout -b feature/raw"), ctx(root))).toBeUndefined();
-    expect(enforceNativeWriter(bash("gh pr create --fill"), ctx(root))).toBeUndefined();
-    expect(enforceNativeWriter(bash("git worktree add ../other"), ctx(root))).toBeUndefined();
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});

From 6342f97f3e7c55800dd1972444d93af7c1422261 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:14:58 -0300
Subject: [PATCH 08/16] test: build packed Codex and Pi artifacts from source
 instead of local dist

The packed Codex launcher tests and the stock Pi tests ran `npm pack` on
packages/workit-{codex,pi}, which ships whatever dist/ is on disk: they
failed on a fresh checkout and silently tested stale code after a source
edit. They now take their tarball from packWorkspacePackages(), which
builds every adapter into a sandbox from current source (cached per run,
the same artifact the release gates check), so they need no prior
`bun run build`.

- The two packed Codex launcher tests move from desktop.test.ts to
  packed-launcher.test.ts (packaging tier); desktop.test.ts keeps its
  source-level unit tests.
- "npm installs the packed package without workspace protocol
  dependencies" moves from extension.test.ts to stock-pi.test.ts and now
  installs the release-shaped tarball (workspace deps rewritten).
- Deleted extension "stock Pi discovers the package manifest through its
  local package manager": same pack/install/get_commands flow as stock-pi
  "stock Pi discovers the packed Workit extension and skills", which
  asserts a superset (worker command, settings, reconcile prompt).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/workit-codex/desktop.test.ts         | 134 +-----------------
 test/workit-codex/packed-launcher.test.ts | 144 +++++++++++++++++++
 test/workit-pi/extension.test.ts          | 161 +---------------------
 test/workit-pi/stock-pi.test.ts           |  91 ++++++------
 4 files changed, 197 insertions(+), 333 deletions(-)
 create mode 100644 test/workit-codex/packed-launcher.test.ts

diff --git a/test/workit-codex/desktop.test.ts b/test/workit-codex/desktop.test.ts
index 76bf3ff5..204d36c7 100644
--- a/test/workit-codex/desktop.test.ts
+++ b/test/workit-codex/desktop.test.ts
@@ -1,6 +1,5 @@
 import { expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { spawn, spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import {
@@ -12,9 +11,6 @@ import { handleCodexHook } from "@/packages/workit-codex/hooks/workit-hook";
 import { TaskStore, WorkitCore, type OperationContext } from "@/packages/workit-core/src/core";
 import { taskStartRequest } from "@/test/workit-core/task-fixtures";
 
-const packageRoot = path.resolve(import.meta.dir, "../../packages/workit-codex");
-const repoRoot = path.resolve(import.meta.dir, "../..");
-
 const initializedRoot = () => {
   const root = mkdtempSync(path.join(tmpdir(), "workit-codex-packed-"));
   const store = new TaskStore(root);
@@ -129,131 +125,3 @@ test("Codex MCP provider keeps caller identity empty on both surfaces", async ()
     resolveCodexWorkspaceRoot(pluginRoot, { WORKFLOW_WORKSPACE_ROOT: mismatchedRoot }),
   ).toBeNull();
 });
-
-const packCodex = () => {
-  const packRoot = mkdtempSync(path.join(tmpdir(), "workit-codex-package-"));
-  const packed = spawnSync(
-    "npm",
-    ["pack", "--json", "--workspace", packageRoot, "--pack-destination", packRoot],
-    { cwd: repoRoot, encoding: "utf8" },
-  );
-  if (packed.status !== 0) throw new Error(packed.stderr || packed.stdout);
-  const filename = (JSON.parse(packed.stdout) as Array<{ filename: string }>)[0]?.filename;
-  if (!filename) throw new Error(`npm pack returned no filename: ${packed.stdout}`);
-  const extractRoot = path.join(packRoot, "extract");
-  mkdirSync(extractRoot);
-  const extracted = spawnSync("tar", ["-xzf", path.join(packRoot, filename), "-C", extractRoot], {
-    cwd: repoRoot,
-    encoding: "utf8",
-  });
-  if (extracted.status !== 0) throw new Error(extracted.stderr || extracted.stdout);
-  return {
-    root: path.join(extractRoot, "package"),
-    cleanup: () => rmSync(packRoot, { recursive: true, force: true }),
-  };
-};
-
-const startPackedMcp = (workspaceRoot: string) => {
-  const packed = packCodex();
-  const config = JSON.parse(readFileSync(path.join(packed.root, ".mcp.json"), "utf8"));
-  const server = config.mcpServers.workit;
-  if (server.command !== "node") throw new Error(`unexpected MCP command: ${server.command}`);
-  const child = spawn(server.command, server.args, {
-    cwd: path.resolve(packed.root, server.cwd),
-    env: {
-      ...process.env,
-      WORKFLOW_WORKSPACE_ROOT: workspaceRoot,
-      CODEX_INTERNAL_ORIGINATOR_OVERRIDE: "",
-      CODEX_ELECTRON_RESOURCES_PATH: "",
-    },
-    stdio: ["pipe", "pipe", "pipe"],
-  });
-  let stdout = "";
-  let stderr = "";
-  const responses: Record<number, any> = {};
-  child.stdout.setEncoding("utf8");
-  child.stderr.setEncoding("utf8");
-  child.stdout.on("data", (chunk) => {
-    stdout += chunk;
-    for (;;) {
-      const end = stdout.indexOf("\n");
-      if (end < 0) break;
-      const line = stdout.slice(0, end).trim();
-      stdout = stdout.slice(end + 1);
-      if (!line) continue;
-      const message = JSON.parse(line);
-      if (typeof message.id === "number") responses[message.id] = message;
-    }
-  });
-  child.stderr.on("data", (chunk) => (stderr += chunk));
-  const request = (id: number, method: string, params: unknown) =>
-    new Promise<void>((resolve, reject) => {
-      const timer = setTimeout(
-        () => reject(new Error(`timeout ${method}; stderr=${stderr}`)),
-        15_000,
-      );
-      const check = () => {
-        if (responses[id]) {
-          clearTimeout(timer);
-          resolve();
-        } else setTimeout(check, 10);
-      };
-      child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
-      check();
-    });
-  return { child, packed, responses, request, getStderr: () => stderr };
-};
-
-test("packed Codex launcher uses the shipped node command and lists read-only families once", async () => {
-  const launcher = startPackedMcp(initializedRoot());
-  try {
-    await launcher.request(1, "initialize", {
-      protocolVersion: "2024-11-05",
-      capabilities: {},
-      clientInfo: { name: "codex-packed-test", version: "1.0.0" },
-    });
-    launcher.child.stdin.write('{"jsonrpc":"2.0","method":"notifications/initialized"}\n');
-    await launcher.request(2, "tools/list", {});
-    expect(launcher.responses[1].result.serverInfo.name).toBe("workit");
-    expect(launcher.responses[2].result.tools.map((tool: { name: string }) => tool.name)).toEqual([
-      "workit_task",
-      "workit_policy",
-      "workit_state",
-    ]);
-    expect(Object.keys(launcher.responses)).toEqual(["1", "2"]);
-    expect(launcher.getStderr()).toBe("");
-  } finally {
-    launcher.child.kill();
-    launcher.packed.cleanup();
-  }
-}, 30_000);
-
-test("packed Codex launcher lists empty on fresh checkouts without leaking paths", async () => {
-  const freshRoot = mkdtempSync(path.join(tmpdir(), "workit-codex-fresh-"));
-  const launcher = startPackedMcp(freshRoot);
-  try {
-    await launcher.request(1, "initialize", {
-      protocolVersion: "2024-11-05",
-      capabilities: {},
-      clientInfo: { name: "codex-packed-unavailable-test", version: "1.0.0" },
-    });
-    launcher.child.stdin.write('{"jsonrpc":"2.0","method":"notifications/initialized"}\n');
-    await launcher.request(2, "tools/call", {
-      name: "workit_task",
-      arguments: { schemaVersion: 1, action: "list" },
-    });
-    expect(launcher.responses[2].result.structuredContent).toEqual({
-      ok: true,
-      schemaVersion: 1,
-      revision: null,
-      workspaceRevision: null,
-      data: [],
-    });
-    expect(JSON.stringify(launcher.responses[2])).not.toContain(freshRoot);
-    expect(launcher.getStderr()).not.toContain(freshRoot);
-  } finally {
-    launcher.child.kill();
-    launcher.packed.cleanup();
-    rmSync(freshRoot, { recursive: true, force: true });
-  }
-});
diff --git a/test/workit-codex/packed-launcher.test.ts b/test/workit-codex/packed-launcher.test.ts
new file mode 100644
index 00000000..f31651aa
--- /dev/null
+++ b/test/workit-codex/packed-launcher.test.ts
@@ -0,0 +1,144 @@
+import { expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { TaskStore, WorkitCore, type OperationContext } from "@/packages/workit-core/src/core";
+import { taskStartRequest } from "@/test/workit-core/task-fixtures";
+import { extractTarball, packWorkspacePackages } from "@/test/shared/helpers/packages";
+
+// Packaging tier: starts the MCP launcher shipped in the packed Codex tarball.
+const CODEX = "@brainervirus/workit-codex";
+
+const initializedRoot = () => {
+  const root = mkdtempSync(path.join(tmpdir(), "workit-codex-packed-"));
+  const store = new TaskStore(root);
+  const context: OperationContext = {
+    root,
+    caller: { host: "codex_cli", actor: "launcher-test" },
+    callerAttested: false,
+    capabilities: [],
+    constraints: [],
+    now: "2026-01-01T00:00:00Z",
+  };
+  const started = new WorkitCore(store, context).task(taskStartRequest());
+  if (!started.ok) throw new Error(started.error);
+  return root;
+};
+
+// Packs from a fresh sandbox build of the current source (shared, cached
+// helper), so the launcher under test never comes from a stale local dist/.
+const packCodex = () => {
+  const pack = packWorkspacePackages().find((entry) => entry.packageName === CODEX);
+  if (!pack) throw new Error(`${CODEX} missing from the workspace pack`);
+  const extracted = extractTarball(pack.tarball);
+  return {
+    root: extracted.packageDir,
+    cleanup: () => rmSync(extracted.root, { recursive: true, force: true }),
+  };
+};
+
+const startPackedMcp = (workspaceRoot: string) => {
+  const packed = packCodex();
+  const config = JSON.parse(readFileSync(path.join(packed.root, ".mcp.json"), "utf8"));
+  const server = config.mcpServers.workit;
+  if (server.command !== "node") throw new Error(`unexpected MCP command: ${server.command}`);
+  const child = spawn(server.command, server.args, {
+    cwd: path.resolve(packed.root, server.cwd),
+    env: {
+      ...process.env,
+      WORKFLOW_WORKSPACE_ROOT: workspaceRoot,
+      CODEX_INTERNAL_ORIGINATOR_OVERRIDE: "",
+      CODEX_ELECTRON_RESOURCES_PATH: "",
+    },
+    stdio: ["pipe", "pipe", "pipe"],
+  });
+  let stdout = "";
+  let stderr = "";
+  const responses: Record<number, any> = {};
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk;
+    for (;;) {
+      const end = stdout.indexOf("\n");
+      if (end < 0) break;
+      const line = stdout.slice(0, end).trim();
+      stdout = stdout.slice(end + 1);
+      if (!line) continue;
+      const message = JSON.parse(line);
+      if (typeof message.id === "number") responses[message.id] = message;
+    }
+  });
+  child.stderr.on("data", (chunk) => (stderr += chunk));
+  const request = (id: number, method: string, params: unknown) =>
+    new Promise<void>((resolve, reject) => {
+      const timer = setTimeout(
+        () => reject(new Error(`timeout ${method}; stderr=${stderr}`)),
+        15_000,
+      );
+      const check = () => {
+        if (responses[id]) {
+          clearTimeout(timer);
+          resolve();
+        } else setTimeout(check, 10);
+      };
+      child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
+      check();
+    });
+  return { child, packed, responses, request, getStderr: () => stderr };
+};
+
+test("packed Codex launcher uses the shipped node command and lists read-only families once", async () => {
+  const launcher = startPackedMcp(initializedRoot());
+  try {
+    await launcher.request(1, "initialize", {
+      protocolVersion: "2024-11-05",
+      capabilities: {},
+      clientInfo: { name: "codex-packed-test", version: "1.0.0" },
+    });
+    launcher.child.stdin.write('{"jsonrpc":"2.0","method":"notifications/initialized"}\n');
+    await launcher.request(2, "tools/list", {});
+    expect(launcher.responses[1].result.serverInfo.name).toBe("workit");
+    expect(launcher.responses[2].result.tools.map((tool: { name: string }) => tool.name)).toEqual([
+      "workit_task",
+      "workit_policy",
+      "workit_state",
+    ]);
+    expect(Object.keys(launcher.responses)).toEqual(["1", "2"]);
+    expect(launcher.getStderr()).toBe("");
+  } finally {
+    launcher.child.kill();
+    launcher.packed.cleanup();
+  }
+}, 30_000);
+
+test("packed Codex launcher lists empty on fresh checkouts without leaking paths", async () => {
+  const freshRoot = mkdtempSync(path.join(tmpdir(), "workit-codex-fresh-"));
+  const launcher = startPackedMcp(freshRoot);
+  try {
+    await launcher.request(1, "initialize", {
+      protocolVersion: "2024-11-05",
+      capabilities: {},
+      clientInfo: { name: "codex-packed-unavailable-test", version: "1.0.0" },
+    });
+    launcher.child.stdin.write('{"jsonrpc":"2.0","method":"notifications/initialized"}\n');
+    await launcher.request(2, "tools/call", {
+      name: "workit_task",
+      arguments: { schemaVersion: 1, action: "list" },
+    });
+    expect(launcher.responses[2].result.structuredContent).toEqual({
+      ok: true,
+      schemaVersion: 1,
+      revision: null,
+      workspaceRevision: null,
+      data: [],
+    });
+    expect(JSON.stringify(launcher.responses[2])).not.toContain(freshRoot);
+    expect(launcher.getStderr()).not.toContain(freshRoot);
+  } finally {
+    launcher.child.kill();
+    launcher.packed.cleanup();
+    rmSync(freshRoot, { recursive: true, force: true });
+  }
+});
diff --git a/test/workit-pi/extension.test.ts b/test/workit-pi/extension.test.ts
index eeb5932c..87c1e8b9 100644
--- a/test/workit-pi/extension.test.ts
+++ b/test/workit-pi/extension.test.ts
@@ -1,6 +1,6 @@
 import { expect, test } from "bun:test";
 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { spawn, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { tmpdir } from "node:os";
 import {
@@ -106,8 +106,6 @@ const decisionInput = (root: string) => {
   };
 };
 
-const nodeExecutable = "node";
-
 test("clean Pi package declares stock discovery and the eight families plus external action", async () => {
   const manifest = JSON.parse(
     readFileSync(path.join(import.meta.dir, "../../packages/workit-pi/package.json"), "utf8"),
@@ -936,163 +934,6 @@ test("Pi allows recognized raw branch and PR creation outside live work", async
   }
 });
 
-test("npm installs the packed package without workspace protocol dependencies", async () => {
-  const repoRoot = path.resolve(import.meta.dir, "../..");
-  const packageRoot = path.join(repoRoot, "packages/workit-pi");
-  const stage = mkdtempSync(path.join(tmpdir(), "workit-pi-install-"));
-  const packed = spawnSync(
-    "npm",
-    ["pack", "--json", "--workspace", packageRoot, "--pack-destination", stage],
-    { cwd: repoRoot, encoding: "utf8" },
-  );
-  if (packed.status !== 0) throw new Error(packed.stderr || packed.stdout);
-  const filename = (JSON.parse(packed.stdout) as Array<{ filename: string }>)[0].filename;
-  const consumer = path.join(stage, "consumer");
-  mkdirSync(consumer);
-  const installed = spawnSync(
-    "npm",
-    [
-      "install",
-      "--prefix",
-      consumer,
-      "--legacy-peer-deps",
-      "--ignore-scripts",
-      "--no-audit",
-      "--no-fund",
-      path.join(stage, filename),
-    ],
-    { cwd: repoRoot, encoding: "utf8" },
-  );
-  try {
-    expect(installed.status, installed.stderr || installed.stdout).toBe(0);
-    expect(
-      readFileSync(
-        path.join(consumer, "node_modules/@brainervirus/workit-pi/package.json"),
-        "utf8",
-      ),
-    ).toContain('"name": "@brainervirus/workit-pi"');
-  } finally {
-    rmSync(stage, { recursive: true, force: true });
-  }
-});
-
-test("stock Pi discovers the package manifest through its local package manager", async () => {
-  const repoRoot = path.resolve(import.meta.dir, "../..");
-  const packageRoot = path.join(repoRoot, "packages/workit-pi");
-  const stage = mkdtempSync(path.join(tmpdir(), "workit-pi-discovery-"));
-  const isolated = path.join(stage, "project");
-  const agentDir = path.join(stage, "agent");
-  mkdirSync(isolated);
-  mkdirSync(agentDir);
-  const piBin = path.join(
-    repoRoot,
-    "node_modules/@earendil-works/pi-coding-agent/dist/bundle/cli.js",
-  );
-  // Hermetic HOME: stock Pi auto-discovers user-level agent skills
-  // (~/.agents/skills), so ambient user skills would pollute the exact
-  // command count. The fake home keeps discovery limited to the package.
-  const home = path.join(stage, "home");
-  mkdirSync(home);
-  const env = { ...process.env, PI_CODING_AGENT_DIR: agentDir, HOME: home };
-  const packed = spawnSync(
-    "npm",
-    ["pack", "--json", "--workspace", packageRoot, "--pack-destination", stage],
-    { cwd: repoRoot, encoding: "utf8" },
-  );
-  if (packed.status !== 0) throw new Error(packed.stderr || packed.stdout);
-  const filename = (JSON.parse(packed.stdout) as Array<{ filename: string }>)[0].filename;
-  const extracted = path.join(stage, "extract");
-  mkdirSync(extracted);
-  const unpacked = spawnSync("tar", ["-xzf", path.join(stage, filename), "-C", extracted], {
-    cwd: repoRoot,
-    encoding: "utf8",
-  });
-  if (unpacked.status !== 0) throw new Error(unpacked.stderr || unpacked.stdout);
-  const installed = spawnSync(
-    nodeExecutable,
-    [piBin, "install", path.join(extracted, "package"), "-l", "--approve"],
-    {
-      cwd: isolated,
-      env,
-      encoding: "utf8",
-    },
-  );
-  if (installed.status !== 0) throw new Error(installed.stderr || installed.stdout);
-  const child = spawn(
-    nodeExecutable,
-    [piBin, "--mode", "rpc", "--no-session", "--approve", "--offline", "--no-context-files"],
-    {
-      cwd: isolated,
-      env,
-      stdio: ["pipe", "pipe", "pipe"],
-    },
-  );
-  let stdout = "";
-  let stderr = "";
-  const responses = new Map<string, any>();
-  child.stdout.setEncoding("utf8");
-  child.stderr.setEncoding("utf8");
-  child.stdout.on("data", (chunk) => {
-    stdout += chunk;
-    for (;;) {
-      const end = stdout.indexOf("\n");
-      if (end < 0) break;
-      const line = stdout.slice(0, end).trim();
-      stdout = stdout.slice(end + 1);
-      if (!line) continue;
-      const message = JSON.parse(line);
-      if (message.type === "response" && typeof message.command === "string")
-        responses.set(message.command, message);
-    }
-  });
-  child.stderr.on("data", (chunk) => (stderr += chunk));
-  try {
-    child.stdin.write('{"id":"commands","type":"get_commands"}\n');
-    await new Promise<void>((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error(`Pi discovery timeout: ${stderr}`)), 10000);
-      const poll = () => {
-        if (responses.has("get_commands")) {
-          clearTimeout(timer);
-          resolve();
-        } else setTimeout(poll, 10);
-      };
-      poll();
-    });
-    expect(
-      (responses.get("get_commands").data.commands as Array<{ name: string }>)
-        .filter((command) => command.name.startsWith("skill:workit-"))
-        .map((command) => command.name)
-        .sort(),
-    ).toHaveLength(14);
-    expect(
-      (responses.get("get_commands").data.commands as Array<{ name: string }>).map(
-        (command) => command.name,
-      ),
-    ).toEqual(
-      expect.arrayContaining([
-        "wk-challenge",
-        "wk-babysit",
-        "wk-implement",
-        "wk-plan",
-        "wk-debug",
-        "wk-review",
-        "wk-handoff",
-        "wk-tdd",
-        "wk-blast-radius",
-        "wk-deslop",
-        "wk-diagram",
-        "wk-mockup",
-        "wk-green-run",
-        "wk-steer",
-      ]),
-    );
-    expect(stderr).toBe("");
-  } finally {
-    child.kill();
-    rmSync(stage, { recursive: true, force: true });
-  }
-});
-
 test("reconcile without a live handle fails recovery_required instead of pretending", async () => {
   const root = mkdtempSync(path.join(tmpdir(), "workit-pi-reconcile-"));
   const pi = makePi();
diff --git a/test/workit-pi/stock-pi.test.ts b/test/workit-pi/stock-pi.test.ts
index b4fe9af6..eff36393 100644
--- a/test/workit-pi/stock-pi.test.ts
+++ b/test/workit-pi/stock-pi.test.ts
@@ -6,6 +6,7 @@ import path from "node:path";
 import { SUPPORT_MATRIX } from "@/packages/workit-core/src/core/support-matrix";
 import { TaskStore, WorkitCore, type OperationContext } from "@/packages/workit-core/src/core";
 import { taskStartRequest } from "@/test/workit-core/task-fixtures";
+import { packWorkspacePackages } from "@/test/shared/helpers/packages";
 import {
   WORKIT_METHOD_SKILLS,
   WORKIT_SKILL_ALIASES,
@@ -13,6 +14,21 @@ import {
 
 const node = "node";
 
+const PI = "@brainervirus/workit-pi";
+
+// Unpacks the Pi tarball from a fresh sandbox build of the current source
+// (shared, cached helper) into <stage>/extract/package, so stock Pi never
+// installs a stale local dist/.
+const extractPackedPi = (stage: string): string => {
+  const pack = packWorkspacePackages().find((entry) => entry.packageName === PI);
+  if (!pack) throw new Error(`${PI} missing from the workspace pack`);
+  const extracted = path.join(stage, "extract");
+  mkdirSync(extracted);
+  const unpacked = spawnSync("tar", ["-xzf", pack.tarball, "-C", extracted], { encoding: "utf8" });
+  if (unpacked.status !== 0) throw new Error(unpacked.stderr || unpacked.stdout);
+  return extracted;
+};
+
 test("stock Node runtime meets the supported major line for Pi workers", () => {
   const result = spawnSync(node, ["--version"], { encoding: "utf8" });
   expect(result.status).toBe(0);
@@ -38,26 +54,7 @@ test(
     const home = path.join(stage, "home");
     mkdirSync(home);
     const env = { ...process.env, PI_CODING_AGENT_DIR: agentDir, HOME: home };
-    const packed = spawnSync(
-      "npm",
-      [
-        "pack",
-        "--json",
-        "--workspace",
-        path.join(repoRoot, "packages/workit-pi"),
-        "--pack-destination",
-        stage,
-      ],
-      { cwd: repoRoot, encoding: "utf8" },
-    );
-    if (packed.status !== 0) throw new Error(packed.stderr || packed.stdout);
-    const filename = (JSON.parse(packed.stdout) as Array<{ filename: string }>)[0].filename;
-    const extracted = path.join(stage, "extract");
-    mkdirSync(extracted);
-    const unpacked = spawnSync("tar", ["-xzf", path.join(stage, filename), "-C", extracted], {
-      encoding: "utf8",
-    });
-    if (unpacked.status !== 0) throw new Error(unpacked.stderr || unpacked.stdout);
+    const extracted = extractPackedPi(stage);
     const installed = spawnSync(
       node,
       [piBin, "install", path.join(extracted, "package"), "-l", "--approve"],
@@ -154,26 +151,7 @@ test(
       repoRoot,
       "node_modules/@earendil-works/pi-coding-agent/dist/bundle/cli.js",
     );
-    const packed = spawnSync(
-      "npm",
-      [
-        "pack",
-        "--json",
-        "--workspace",
-        path.join(repoRoot, "packages/workit-pi"),
-        "--pack-destination",
-        stage,
-      ],
-      { cwd: repoRoot, encoding: "utf8" },
-    );
-    if (packed.status !== 0) throw new Error(packed.stderr || packed.stdout);
-    const filename = (JSON.parse(packed.stdout) as Array<{ filename: string }>)[0].filename;
-    const extracted = path.join(stage, "extract");
-    mkdirSync(extracted);
-    const unpacked = spawnSync("tar", ["-xzf", path.join(stage, filename), "-C", extracted], {
-      encoding: "utf8",
-    });
-    if (unpacked.status !== 0) throw new Error(unpacked.stderr || unpacked.stdout);
+    const extracted = extractPackedPi(stage);
 
     const fakeProvider = path.join(stage, "offline-provider.mjs");
     const piAi = path.join(repoRoot, "node_modules/@earendil-works/pi-ai/dist/index.js");
@@ -348,3 +326,36 @@ export default (pi) => pi.registerProvider("workit-test", {
   },
   { timeout: 30_000 },
 );
+
+test("npm installs the packed package without workspace protocol dependencies", () => {
+  const stage = mkdtempSync(path.join(tmpdir(), "workit-pi-install-"));
+  try {
+    const pack = packWorkspacePackages().find((entry) => entry.packageName === PI);
+    if (!pack) throw new Error(`${PI} missing from the workspace pack`);
+    const consumer = path.join(stage, "consumer");
+    mkdirSync(consumer);
+    const installed = spawnSync(
+      "npm",
+      [
+        "install",
+        "--prefix",
+        consumer,
+        "--legacy-peer-deps",
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        pack.tarball,
+      ],
+      { cwd: stage, encoding: "utf8" },
+    );
+    expect(installed.status, installed.stderr || installed.stdout).toBe(0);
+    expect(
+      readFileSync(
+        path.join(consumer, "node_modules/@brainervirus/workit-pi/package.json"),
+        "utf8",
+      ),
+    ).toContain('"name": "@brainervirus/workit-pi"');
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+});

From 16a17a013a35b194698c62caeb50a73939c94581 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:26:33 -0300
Subject: [PATCH 09/16] chore(test): split test and test:packaging tiers and
 guard the Node version

- `bun run test` runs the domain/unit tier; `bun run test:packaging` runs
  the suites that pack tarballs, run npm/Pi installs, drive doctor against
  installed artifacts, or need docker. The packaging list lives once in
  scripts/test.ts (the unit tier ignores the same patterns); plain
  `bun test` still runs everything.
- scripts/test.ts drops node_modules/.bin from PATH before spawning
  `bun test`: `bun run` prepends it, which exposed the repo's own npm
  dependency to host-install code and failed two packed-CLI tests (and
  slowed an opencode-v2 shell test into a timeout) only under `bun run`.
- test/shared/node-guard.ts, preloaded from bunfig.toml, stops any
  `bun test` run with one message when the PATH node is older than
  SUPPORT_MATRIX.node.minimum, instead of ~30 confusing doctor/setup
  failures.
- `check` runs both tiers through the scripts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 bunfig.toml               |  4 ++++
 package.json              |  5 +++--
 scripts/test.ts           | 45 +++++++++++++++++++++++++++++++++++++++
 test/shared/node-guard.ts | 18 ++++++++++++++++
 4 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 scripts/test.ts
 create mode 100644 test/shared/node-guard.ts

diff --git a/bunfig.toml b/bunfig.toml
index 6d046a0a..4cf63387 100644
--- a/bunfig.toml
+++ b/bunfig.toml
@@ -5,3 +5,7 @@ linker = "hoisted"
 # fires when a pin is deliberately moved to a fresh release. Machine-global
 # `min-release-age` in ~/.npmrc still guards every other project.
 minimumReleaseAge = 0
+
+[test]
+# Fail fast with one clear message when the PATH node is older than Node 24.
+preload = ["./test/shared/node-guard.ts"]
diff --git a/package.json b/package.json
index e7868c2e..73c01944 100644
--- a/package.json
+++ b/package.json
@@ -38,9 +38,10 @@
     "knip": "knip --no-progress --no-config-hints && knip --no-progress --production --files && bun scripts/check-reachability.ts",
     "format": "oxfmt packages/workit-core/src packages/workit-mcp/src packages/workit-opencode/src packages/workit-cli/src packages/workit-cursor/mcp/run-server.ts packages/workit-codex/hooks packages/workit-codex/scripts packages/workit-pi/src packages/workit-pi/extensions test '!test/fixtures/cursor-schemas/**' package.json packages/*/package.json tsconfig.json",
     "format:check": "oxfmt --check packages/workit-core/src packages/workit-mcp/src packages/workit-opencode/src packages/workit-cli/src packages/workit-cursor/mcp/run-server.ts packages/workit-codex/hooks packages/workit-codex/scripts packages/workit-pi/src packages/workit-pi/extensions test '!test/fixtures/cursor-schemas/**' package.json packages/*/package.json tsconfig.json",
-    "test": "bun test",
+    "test": "bun scripts/test.ts unit",
+    "test:packaging": "bun scripts/test.ts packaging",
     "typecheck": "tsc --noEmit",
-    "check": "bun run build && bun run lint && bun run format:check && bun test && tsc --noEmit"
+    "check": "bun run build && bun run lint && bun run format:check && bun run test && bun run test:packaging && tsc --noEmit"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.85.1",
diff --git a/scripts/test.ts b/scripts/test.ts
new file mode 100644
index 00000000..f5696594
--- /dev/null
+++ b/scripts/test.ts
@@ -0,0 +1,45 @@
+#!/usr/bin/env bun
+// Test tiers. `bun run test` runs the fast domain/unit tier; `bun run
+// test:packaging` runs the suites that pack tarballs, run npm/Pi installs,
+// drive doctor against installed artifacts, or need docker. Packaging suites
+// build what they pack (packWorkspacePackages builds every adapter into a
+// sandbox), so neither tier needs `bun run build` first. Plain `bun test`
+// still runs everything. Extra arguments pass through to `bun test`.
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+
+const PACKAGING = [
+  "test/artifacts/**",
+  "test/opencode-v2/contract.test.ts",
+  "test/opencode-v2/lifecycle.test.ts",
+  "test/opencode-v2/matrix.test.ts",
+  "test/workit-cli/doctor.test.ts",
+  "test/workit-cli/packed-cli.test.ts",
+  "test/workit-cli/platform-install.test.ts",
+  "test/workit-codex/packed-launcher.test.ts",
+  "test/workit-core/doctor.test.ts",
+  "test/workit-core/install-scripts.test.ts",
+  "test/workit-pi/stock-pi.test.ts",
+];
+
+const [tier, ...rest] = process.argv.slice(2);
+if (tier !== "unit" && tier !== "packaging") {
+  console.error("usage: bun scripts/test.ts <unit|packaging> [bun test args]");
+  process.exit(2);
+}
+const selection =
+  tier === "packaging"
+    ? PACKAGING.map((pattern) => `./${pattern.replace(/\/\*\*$/, "")}`)
+    : PACKAGING.map((pattern) => `--path-ignore-patterns=${pattern}`);
+// `bun run` prepends node_modules/.bin to PATH, which exposes the repo's own
+// npm dependency as `npm` to host-install code under test. Give the suite the
+// same PATH a direct `bun test` sees.
+const PATH = (process.env.PATH ?? "")
+  .split(path.delimiter)
+  .filter((dir) => !/[\\/]node_modules[\\/]\.bin[\\/]?$/.test(dir))
+  .join(path.delimiter);
+const run = spawnSync("bun", ["test", ...selection, ...rest], {
+  stdio: "inherit",
+  env: { ...process.env, PATH },
+});
+process.exit(run.status ?? 1);
diff --git a/test/shared/node-guard.ts b/test/shared/node-guard.ts
new file mode 100644
index 00000000..0444a07a
--- /dev/null
+++ b/test/shared/node-guard.ts
@@ -0,0 +1,18 @@
+// bun test preload (bunfig.toml): the suite spawns the real `node` on PATH for
+// packed adapters, doctor and installers, and those fail in confusing ways on
+// an older runtime. Stop before any test runs with one clear message instead.
+// (Bun reports its own process.versions.node, so ask the PATH binary.)
+import { spawnSync } from "node:child_process";
+import { SUPPORT_MATRIX } from "@/packages/workit-core/src/core/support-matrix";
+
+const required = Number(SUPPORT_MATRIX.node.minimum);
+const probe = spawnSync("node", ["--version"], { encoding: "utf8" });
+const found = probe.status === 0 ? probe.stdout.trim() : null;
+const major = Number(/^v(\d+)\./.exec(found ?? "")?.[1] ?? 0);
+if (major < required) {
+  console.error(
+    `workit tests need Node ${required}+ on PATH (found ${found ?? "no node"}); ` +
+      `switch first, e.g. \`fnm use ${SUPPORT_MATRIX.node.current}\`.`,
+  );
+  process.exit(1);
+}

From 5f97fd2a86114893e4d533e2c08bf2654fc2fe44 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:27:04 -0300
Subject: [PATCH 10/16] chore(test): run every test directory in CI and drop
 the phase-9 checkout ref

- New `remaining` job runs test/workit-codex, test/workit-mcp,
  test/opencode-v2 and test/acceptance (~120 tests), which no job ran.
  They need no prior build (packed suites build their own artifacts).
- The artifacts job no longer checks out `ref: head_ref`; only the deleted
  phase-9 traceability test needed it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4207e7d4..4c8c1521 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -180,6 +180,29 @@ jobs:
       - name: Typecheck (whole repo)
         run: bun run typecheck
 
+  remaining:
+    # Test directories without a package job above, so no suite escapes CI.
+    name: check (codex, mcp, opencode-v2, acceptance)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.NODE_CURRENT }}
+
+      - name: Install deps
+        run: bun install --frozen-lockfile
+
+      - name: Test codex, mcp, opencode-v2, acceptance
+        run: bun test test/workit-codex test/workit-mcp test/opencode-v2 test/acceptance
+
   shared:
     # test/shared/helpers has no standalone tests (helpers are exercised via the
     # importing packages' jobs); the job guards that the helpers still compile.
@@ -216,12 +239,8 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
         node: [24.20.0]
     steps:
-      # The phase-9 traceability gate asserts the DECLARED branch is active;
-      # the default PR checkout is detached at the merge commit, so check out
-      # the head ref (fallback: the default ref, e.g. main pushes).
       - uses: actions/checkout@v7
         with:
-          ref: ${{ github.head_ref }}
           fetch-depth: 0
 
       - uses: oven-sh/setup-bun@v2

From e3a7b8e971005262d2086c73b41abd153599e6fc Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 15:34:03 -0300
Subject: [PATCH 11/16] test: build the Cursor dist that the dev-checkout
 install test needs

cursor-install-mcp.test.ts installs packages/workit-cursor from the dev
checkout and its doctor step requires dist/mcp-server.js. It only passed
when `bun run build` or another suite (install-scripts) had built that dist
earlier in the same run. It now runs the Cursor build script (~0.1 s) in
beforeAll and sits in the packaging tier with the other install flows.
project-config pins the new `check` script string.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/test.ts                             |  1 +
 test/workit-core/cursor-install-mcp.test.ts | 16 +++++++++++++++-
 test/workit-core/project-config.test.ts     |  2 +-
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/scripts/test.ts b/scripts/test.ts
index f5696594..893166c7 100644
--- a/scripts/test.ts
+++ b/scripts/test.ts
@@ -17,6 +17,7 @@ const PACKAGING = [
   "test/workit-cli/packed-cli.test.ts",
   "test/workit-cli/platform-install.test.ts",
   "test/workit-codex/packed-launcher.test.ts",
+  "test/workit-core/cursor-install-mcp.test.ts",
   "test/workit-core/doctor.test.ts",
   "test/workit-core/install-scripts.test.ts",
   "test/workit-pi/stock-pi.test.ts",
diff --git a/test/workit-core/cursor-install-mcp.test.ts b/test/workit-core/cursor-install-mcp.test.ts
index 0e6f3282..c8d1feef 100644
--- a/test/workit-core/cursor-install-mcp.test.ts
+++ b/test/workit-core/cursor-install-mcp.test.ts
@@ -1,4 +1,5 @@
-import { expect, test } from "bun:test";
+import { beforeAll, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
 import { mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -18,6 +19,19 @@ import { isolatedEnv } from "@/test/shared/helpers/packages";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
 
+// The dev-checkout install copies packages/workit-cursor, and its doctor step
+// requires the built dist entries. Build them from current source first (the
+// same step `bun run build` runs for Cursor) instead of depending on a prior
+// build or on another suite having built them.
+beforeAll(() => {
+  const build = spawnSync(
+    process.execPath,
+    [path.join(repoRoot, "packages/workit-cursor/scripts/build.ts")],
+    { encoding: "utf8" },
+  );
+  if (build.status !== 0) throw new Error(`cursor build failed: ${build.stderr}`);
+});
+
 const tempDir = (prefix: string) => mkdtempSync(path.join(os.tmpdir(), prefix));
 const clean = (dir: string) => rmSync(dir, { recursive: true, force: true });
 
diff --git a/test/workit-core/project-config.test.ts b/test/workit-core/project-config.test.ts
index 9bec483b..5ea86d2a 100644
--- a/test/workit-core/project-config.test.ts
+++ b/test/workit-core/project-config.test.ts
@@ -12,7 +12,7 @@ test("root package exposes pinned Oxc lint and format checks", () => {
   expect(pkg.scripts.format).toStartWith("oxfmt ");
   expect(pkg.scripts["format:check"]).toStartWith("oxfmt --check ");
   expect(pkg.scripts.check).toBe(
-    "bun run build && bun run lint && bun run format:check && bun test && tsc --noEmit",
+    "bun run build && bun run lint && bun run format:check && bun run test && bun run test:packaging && tsc --noEmit",
   );
 });
 

From 03311697098fb9777f567deb69c6ff882a40ce32 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 16:02:01 -0300
Subject: [PATCH 12/16] fix(core): resolve npm-cli.js through a symlinked npm
 before layout guesses

findNpmCli only tried install layouts relative to the `npm` it found on
PATH, so a package-bin symlink (node_modules/.bin/npm -> ../npm/bin/
npm-cli.js), which `bun run` puts first on PATH, failed Cursor setup with
"npm CLI could not be resolved". It now realpaths `npm` first and accepts
the target when it is npm-cli.js; the layout candidates remain the
fallback. Covered by a host-install test with a symlinked .bin/npm (fails
without the fix).

scripts/test.ts no longer strips node_modules/.bin from PATH; that
workaround only hid this bug.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/workit-core/src/core/host-install.ts | 18 ++++++++++-
 scripts/test.ts                               | 13 +-------
 test/workit-core/host-install.test.ts         | 30 ++++++++++++++++++-
 3 files changed, 47 insertions(+), 14 deletions(-)

diff --git a/packages/workit-core/src/core/host-install.ts b/packages/workit-core/src/core/host-install.ts
index 57945b4b..42c911b5 100644
--- a/packages/workit-core/src/core/host-install.ts
+++ b/packages/workit-core/src/core/host-install.ts
@@ -1,5 +1,13 @@
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  statSync,
+} from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -448,6 +456,14 @@ export function runHostCommand(
 }
 
 const findNpmCli = (npm: string): string | null => {
+  // `npm` is usually a symlink to npm-cli.js (Node's bin/npm, a package's
+  // node_modules/.bin/npm); resolve it before guessing install layouts.
+  try {
+    const resolved = realpathSync(npm);
+    if (path.basename(resolved) === "npm-cli.js") return resolved;
+  } catch {
+    // Fall through to the layout candidates.
+  }
   const dir = path.dirname(npm);
   const candidates = [
     path.join(dir, "node_modules", "npm", "bin", "npm-cli.js"),
diff --git a/scripts/test.ts b/scripts/test.ts
index 893166c7..f8475dbe 100644
--- a/scripts/test.ts
+++ b/scripts/test.ts
@@ -6,7 +6,6 @@
 // sandbox), so neither tier needs `bun run build` first. Plain `bun test`
 // still runs everything. Extra arguments pass through to `bun test`.
 import { spawnSync } from "node:child_process";
-import path from "node:path";
 
 const PACKAGING = [
   "test/artifacts/**",
@@ -32,15 +31,5 @@ const selection =
   tier === "packaging"
     ? PACKAGING.map((pattern) => `./${pattern.replace(/\/\*\*$/, "")}`)
     : PACKAGING.map((pattern) => `--path-ignore-patterns=${pattern}`);
-// `bun run` prepends node_modules/.bin to PATH, which exposes the repo's own
-// npm dependency as `npm` to host-install code under test. Give the suite the
-// same PATH a direct `bun test` sees.
-const PATH = (process.env.PATH ?? "")
-  .split(path.delimiter)
-  .filter((dir) => !/[\\/]node_modules[\\/]\.bin[\\/]?$/.test(dir))
-  .join(path.delimiter);
-const run = spawnSync("bun", ["test", ...selection, ...rest], {
-  stdio: "inherit",
-  env: { ...process.env, PATH },
-});
+const run = spawnSync("bun", ["test", ...selection, ...rest], { stdio: "inherit" });
 process.exit(run.status ?? 1);
diff --git a/test/workit-core/host-install.test.ts b/test/workit-core/host-install.test.ts
index 04816287..2d4c48bd 100644
--- a/test/workit-core/host-install.test.ts
+++ b/test/workit-core/host-install.test.ts
@@ -1,5 +1,5 @@
 import { expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import {
@@ -183,3 +183,31 @@ test("native command context routes HOME and host data directories into the inje
     rmSync(home, { recursive: true, force: true });
   }
 });
+
+// Symlinks need privileges on Windows; the layout is the POSIX package-bin one.
+test.skipIf(process.platform === "win32")(
+  "Cursor setup resolves npm-cli.js through a node_modules/.bin/npm symlink",
+  () => {
+    const home = temp("workit-cursor-npm-home-");
+    const project = temp("workit-cursor-npm-project-");
+    try {
+      const nodeBin = path.join(project, "bin");
+      executable(path.join(nodeBin, "node"));
+      const npmCli = path.join(project, "node_modules", "npm", "bin", "npm-cli.js");
+      executable(npmCli);
+      const dotBin = path.join(project, "node_modules", ".bin");
+      mkdirSync(dotBin, { recursive: true });
+      symlinkSync("../npm/bin/npm-cli.js", path.join(dotBin, "npm"));
+      const commands = planHostInstall("cursor", {
+        home,
+        cwd: home,
+        env: { HOME: home, PATH: [dotBin, nodeBin].join(path.delimiter) },
+      });
+      const install = commands.find((command) => command.args.includes("install"));
+      expect(install?.args[0]).toBe(realpathSync(npmCli));
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+      rmSync(project, { recursive: true, force: true });
+    }
+  },
+);

From b3cbad39b551d2b364d81b3a614d1825f7254693 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 16:02:40 -0300
Subject: [PATCH 13/16] test: pin one phrase per agent-critical delivery rule
 and the skill count

Review mutation-tested the keyword trim: inverting any of ten rules left
the suite green. methods.test.ts now pins one meaning-bearing phrase per
rule (whitespace-flexible, wording-exact): bootstrap prefers native host
Git, a local-commit endpoint does not imply PR readiness, reconcile every
requested item, a local commit alone is not push evidence; babysit is not
started by PR creation and stops at PR-ready; steer does not silently
resume; plan asks for no separate approval; implement reconciles every
named deliverable; behavioral-tdd leaves GREEN without RED unsatisfied.
Each inversion was applied and fails the test.

The manifest test also pins WORKIT_METHOD_SKILLS to 14, so dropping a skill
from both the manifest and its directory fails; skill-set changes update it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/workit-core/methods.test.ts | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/test/workit-core/methods.test.ts b/test/workit-core/methods.test.ts
index 99a804fb..c60d1d65 100644
--- a/test/workit-core/methods.test.ts
+++ b/test/workit-core/methods.test.ts
@@ -244,6 +244,32 @@ test("compact task context carries selected methods and refreshes with policy",
   ]);
 });
 
+// One meaning-bearing phrase per agent-critical rule. Whitespace is flexible
+// (the prose wraps), the words are not: inverting a rule fails here.
+const phrase = (text: string) => new RegExp(text.trim().split(/\s+/).join("\\s+"));
+
+test("agent-critical delivery rules stay stated", () => {
+  const bootstrap = invariantBootstrap();
+  const rules: Array<[string, string, string]> = [
+    ["bootstrap", bootstrap, "prefer native host Git/shell"],
+    ["bootstrap", bootstrap, "A local-commit endpoint does not imply PR readiness"],
+    ["bootstrap", bootstrap, "reconcile every requested item"],
+    ["bootstrap", bootstrap, "a local commit alone is not evidence of a requested remote push"],
+    ["workit-babysit", skillText("workit-babysit"), "PR creation does not start babysitting"],
+    ["workit-babysit", skillText("workit-babysit"), "Stop at PR-ready"],
+    ["workit-steer", skillText("workit-steer"), "do not silently resume an old objective"],
+    ["workit-plan", skillText("workit-plan"), "Do not ask for a separate plan approval"],
+    ["workit-implement", skillText("workit-implement"), "reconcile every named deliverable"],
+    [
+      "workit-behavioral-tdd",
+      skillText("workit-behavioral-tdd"),
+      "GREEN but no preceding RED evidence stays unsatisfied",
+    ],
+  ];
+  for (const [source, text, rule] of rules)
+    expect(text, `${source}: ${rule}`).toMatch(phrase(rule));
+});
+
 test("method skills impose no task-start preamble and do not wait for policy selection", () => {
   for (const name of WORKIT_METHOD_SKILLS) {
     const skill = skillText(name);
@@ -255,6 +281,9 @@ test("method skills impose no task-start preamble and do not wait for policy sel
 });
 
 test("method manifest matches the canonical skill directories", () => {
+  // Pinned on purpose: a skill-set change (adding or dropping a skill from
+  // both the manifest and the directory) must update this count.
+  expect(WORKIT_METHOD_SKILLS).toHaveLength(14);
   expect(
     skillManifestNames(path.join(import.meta.dir, "../../packages/workit-core/skills")),
   ).toEqual([...WORKIT_METHOD_SKILLS].sort());

From 4d5152856c72d723b81eeebf5e65066312a9dd8c Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 16:03:02 -0300
Subject: [PATCH 14/16] test: build the Cursor package for the dev-install test
 in a sandbox

cursor-install-mcp.test.ts now copies packages/workit-cursor into a temp
"checkout", builds it there with the Cursor build script's target
argument, and installs from that sandbox, so it no longer writes dist/ into
the working checkout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/workit-core/cursor-install-mcp.test.ts | 22 ++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/test/workit-core/cursor-install-mcp.test.ts b/test/workit-core/cursor-install-mcp.test.ts
index c8d1feef..5783cbdc 100644
--- a/test/workit-core/cursor-install-mcp.test.ts
+++ b/test/workit-core/cursor-install-mcp.test.ts
@@ -1,6 +1,6 @@
-import { beforeAll, expect, test } from "bun:test";
+import { afterAll, beforeAll, expect, test } from "bun:test";
 import { spawnSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { cpSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -20,17 +20,25 @@ import { isolatedEnv } from "@/test/shared/helpers/packages";
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
 
 // The dev-checkout install copies packages/workit-cursor, and its doctor step
-// requires the built dist entries. Build them from current source first (the
-// same step `bun run build` runs for Cursor) instead of depending on a prior
-// build or on another suite having built them.
+// requires the built dist entries. Stage a sandbox "checkout" holding a copy of
+// the Cursor package and build it there from current source, so the test
+// neither depends on a prior `bun run build` nor writes into this checkout.
+let devCheckout: string;
 beforeAll(() => {
+  devCheckout = mkdtempSync(path.join(os.tmpdir(), "wk-cursor-dev-"));
+  const pkg = path.join(devCheckout, "packages", "workit-cursor");
+  cpSync(path.join(repoRoot, "packages", "workit-cursor"), pkg, {
+    recursive: true,
+    filter: (src) => !/[\\/](?:dist|node_modules)$/.test(src),
+  });
   const build = spawnSync(
     process.execPath,
-    [path.join(repoRoot, "packages/workit-cursor/scripts/build.ts")],
+    [path.join(repoRoot, "packages/workit-cursor/scripts/build.ts"), pkg],
     { encoding: "utf8" },
   );
   if (build.status !== 0) throw new Error(`cursor build failed: ${build.stderr}`);
 });
+afterAll(() => rmSync(devCheckout, { recursive: true, force: true }));
 
 const tempDir = (prefix: string) => mkdtempSync(path.join(os.tmpdir(), prefix));
 const clean = (dir: string) => rmSync(dir, { recursive: true, force: true });
@@ -56,7 +64,7 @@ const apply = (dir: string, home: string): SetupResult =>
   applySetupPreview(buildSetupPreview(values(), { dir, cwd: dir, env: {}, home }), {
     home,
     configDir: dir,
-    dev: repoRoot,
+    dev: devCheckout,
     cwd: dir,
     env: envFor(home, dir),
   });

From ab5d158b0817d4a512a0f3c59cc388534ea4c424 Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 16:03:02 -0300
Subject: [PATCH 15/16] chore(test): delete the stale windows-inner-suite-probe
 workflow

It ran test/workit-core/handoff.test.ts and sdd.test.ts, which no longer
exist, so a dispatch would fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../workflows/windows-inner-suite-probe.yml   | 25 -------------------
 1 file changed, 25 deletions(-)
 delete mode 100644 .github/workflows/windows-inner-suite-probe.yml

diff --git a/.github/workflows/windows-inner-suite-probe.yml b/.github/workflows/windows-inner-suite-probe.yml
deleted file mode 100644
index fe3b8592..00000000
--- a/.github/workflows/windows-inner-suite-probe.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: Windows inner-suite probe
-
-# AR-14 diagnostic (dispatch-only): reproduces the exact inner `bun test` run
-# the AR-14 negative-fixture test performs (handoff + sdd + repo suites) on
-# windows-latest, with FULL output so the real failing test name is visible —
-# the AR-14 assertion truncates stderr to 2000 chars and hides it.
-
-on:
-  workflow_dispatch:
-
-jobs:
-  probe:
-    runs-on: windows-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.4.1"
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Run the AR-14 inner suites with full output
-        run: bun test test/workit-core/handoff.test.ts test/workit-core/sdd.test.ts test/workit-core/repo.test.ts

From bdd28f1e1c7fa1f7d6419ca62c8a9aa81ead7eaa Mon Sep 17 00:00:00 2001
From: Cristhofer Pincetti <github.annotate387@passmail.net>
Date: Sat, 3 Oct 2026 16:25:12 -0300
Subject: [PATCH 16/16] test: pin behavioral-tdd RED-first order and escape
 phrase regex input

- Adds "Write one vertical RED slice that fails" for workit-behavioral-tdd:
  the existing pin only covered the close gate, so rewriting step 3 to
  implement first stayed green. That inversion now fails the test.
- phrase() escapes regex metacharacters in each word, so a pinned phrase
  matches literally ("a.b" no longer matches "axb").

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/workit-core/methods.test.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/test/workit-core/methods.test.ts b/test/workit-core/methods.test.ts
index c60d1d65..a5796e15 100644
--- a/test/workit-core/methods.test.ts
+++ b/test/workit-core/methods.test.ts
@@ -246,7 +246,9 @@ test("compact task context carries selected methods and refreshes with policy",
 
 // One meaning-bearing phrase per agent-critical rule. Whitespace is flexible
 // (the prose wraps), the words are not: inverting a rule fails here.
-const phrase = (text: string) => new RegExp(text.trim().split(/\s+/).join("\\s+"));
+const escapeRegExp = (text: string) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const phrase = (text: string) =>
+  new RegExp(text.trim().split(/\s+/).map(escapeRegExp).join("\\s+"));
 
 test("agent-critical delivery rules stay stated", () => {
   const bootstrap = invariantBootstrap();
@@ -260,6 +262,11 @@ test("agent-critical delivery rules stay stated", () => {
     ["workit-steer", skillText("workit-steer"), "do not silently resume an old objective"],
     ["workit-plan", skillText("workit-plan"), "Do not ask for a separate plan approval"],
     ["workit-implement", skillText("workit-implement"), "reconcile every named deliverable"],
+    [
+      "workit-behavioral-tdd",
+      skillText("workit-behavioral-tdd"),
+      "Write one vertical RED slice that fails",
+    ],
     [
       "workit-behavioral-tdd",
       skillText("workit-behavioral-tdd"),