* feat(#3464): widen no-source-grep to detect regex.exec() on tracked text
Adds an execCall kind alongside the existing regexTest detection --
regex.exec(tracked) was invisible to the rule while regex.test(tracked)
was already caught, despite both reading a source-derived string through
a regex. Measured: 4 previously-invisible sites across 2 files.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* test(#3464): migrate 4 sites newly flagged by the exec() widening
docs-hooks-table-parity.test.cjs's three regex-extraction loops are
site-scoped marked (source-text-is-the-product) -- the dynamic
preToolEvent/postToolEvent dialect branching they mirror is explicitly
documented as not statically parseable, so a literal-pattern mirror is
the practical minimum-cost check.
no-bare-gsd-tools-command-position.test.cjs's readRouterVerbs() now
requires HOST_COMMAND_ROUTERS directly instead of regex-walking
gsd-tools.cjs's source text -- the same accessor three other suites
already use.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix(#3464): pay down 6 grandfathered uncited allow-test-rule markers
Two were genuinely load-bearing (suppressing a real detected violation)
and just needed a citation added -- phase6-capstone-conformance.test.cjs,
runtime-name-policy.test.cjs, both now (#3464).
Four were dead-weight file-header markers suppressing nothing -- each
file's real effective sites are covered by separate, already-cited
markers elsewhere in the same file. Deleted outright rather than cited,
per Phase 1's own precedent (remove non-load-bearing markers instead of
grandfathering them forever) -- codex-config.test.cjs (two copies),
gsd-check-update-worker-platform-gate.test.cjs, orphaned-hooks.test.cjs,
settings-jsonc.test.cjs.
allowlist.json: 134 -> 128 entries.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* chore(#3464): re-baseline effective-exemption ceiling to 84
The exec() widening's 3 newly-marked sites are now suppressed and
counted; ceiling rises 81 -> 84, the exact measured high-water mark.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix(#3464): correct citation and restore a wrongly-deleted marker
Two review corrections, both found by the orthogonal review pass:
- docs-hooks-table-parity.test.cjs's 3 new exec() markers cited #3464
(mechanically "the phase that widened the rule") when the file's own
established, correct reference is #3839 (the issue this whole test
exists to enforce, already cited in its file header) -- fixed to match.
- gsd-check-update-worker-platform-gate.test.cjs's deleted file-header
marker was NOT dead weight: its codeOnly() helper wraps readFileSync
and is called inline as an assert argument, a genuine source-grep
pattern on real .cjs/.js source that the rule cannot currently see
(helper-function indirection is a distinct blind spot from anything
Phase 7/8 measured) -- CONTRIBUTING.md is explicit that "unverified"
is not the same as "vestigial." Restored, site-scoped this time
(directly above codeOnly(), not as an inert file-header comment) and
cited (#3103, the issue the file's own docstring already references).
codex-config.test.cjs's two deletions and orphaned-hooks.test.cjs's /
settings-jsonc.test.cjs's deletions were independently re-verified and
stand: their flagged lines read generated .toml/.json OUTPUT, not
source, or have no residual pattern at all.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: sim <sim@local>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* test(#3839): docs hook tables must match surface registrations (failing first)
* docs(#3839): hook tables say PreToolUse for validate-commit, SessionStart for session-state
gsd-validate-commit.sh is registered PreToolUse (src/runtime-hooks-surface.cts;
its exit-2 block IS the contract — a post-tool hook cannot prevent a commit)
and gsd-session-state.sh is registered SessionStart (session orientation, not
post-tool tracking). Both rows said PostToolUse in ARCHITECTURE.md and the
three INVENTORY locales; the issue asked for a neighbouring-row scan, which
is how the session-state row was found. All other rows in the four tables
verify against the surface.
* fix(#3839): review fold-ins — 10 more wrong rows in ko-KR/pt-BR/zh-CN, parser authority + drift pins
Adversarial review found the same two wrong rows shipped in five more
files the issue's table missed (ko-KR ARCHITECTURE+INVENTORY, pt-BR
ARCHITECTURE+INVENTORY, zh-CN ARCHITECTURE) — all fixed; DOC_TABLES now
covers all ten shipped tables. The parity parser unioned only the Kimi
mirror list, silently exempting agent-isolation-guard (registered via
the dynamic preToolEvent push): probes are now parsed too, with bare
hook names resolved against hooks/ ground truth and dynamic event
variables resolved to their canonical (non-Gemini) events; an exact-set
pin replaces the loose size guard. allow-test-rule marker carries the
issue ref; unverified-ceiling 280→281 (audited: the new marker is
legitimate — the suite reads product docs whose text is the contract).
* fix(#3839): register the hook-table parity suite in the docs-guard lane
The new suite reads ten docs/ paths, so lint-docs-guard-registration
requires it in the docs-guard registry — the first GREEN bench run
caught the omission (the RED run's docs-guard failures were the same
signal, previously misread as marker fallout).
* chore(#3839): changeset fragment (pr number backfilled after PR creation)
* chore(#3839): backfill changeset PR number (4041)
---------
Co-authored-by: sim <sim@local>
