Merge remote-tracking branch 'origin/main' into worktree-20260512-190648 (#112)

JoeOakhartNava · Test · claude · web-flow · commit 02c260c8f19b · 2026-05-13T02:14:12.000-07:00
* fix(merge-to-main-pr): push version-bump commit to origin/main after PR merge (3024-d618) _phase_version_bump in PR mode was using git commit --amend, creating a divergent SHA that can't be fast-forward pushed. _phase_push was also never called, so the version bump never reached origin/main. Fix: set MERGE_TO_MAIN_PR_MODE=1 before calling _phase_version_bump so it makes a new commit (not amend), then call _phase_push to push it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(merge-to-main-pr): guard MAIN_REPO branch + fix fetch refspec in test (coderabbit) - Ensure MAIN_REPO is on 'main' before _phase_version_bump + _phase_push so git push targets the correct ref (coderabbit PRRT_kwDORoc4TM6BoDBB) - Change `git fetch origin main` to `git fetch origin main:refs/remotes/origin/main` in t_pr_version_bump_pushed_to_origin to prevent stale tracking-ref flakiness (coderabbit PRRT_kwDORoc4TM6BoDBH) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(merge-to-main-pr): remove DSO_MECHANICAL_AMEND from new-commit path (coderabbit PRRT_kwDORoc4TM6BoET5) DSO_MECHANICAL_AMEND=1 is documented and sentinel-guarded as amend-only. The PR-mode new commit (chore: bump version) only stages plugin.json, which is allowlisted in review-gate-allowlist.conf, so no bypass is needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(merge-to-main-pr): address 4 coderabbit findings on version-bump path BoKhK: avoid ${_vf} interpolation into python3 -c source — pass via _VF env var BoLgH: fast-forward local main to origin/main after branch switch before push BoLgc: randomize test branch name with $$ to prevent tmp-path collisions BoIjn: add t_pr_version_bump_main_repo_not_on_main to cover branch-switch path Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(merge-to-main-pr): address llm-review cycle-1 findings (PR #111) Critical: add _vf non-empty guard + explicit file close in Python version extraction one-liner; _vf is defined at line 598 of _phase_version_bump (REVIEW-DEFENSE added for false-positive "undefined variable" claim) Important: fail-loudly on MAIN_REPO checkout failure (was silently || true) which could leave version bump running on wrong branch Important: add commit-message assertions to t_pr_version_bump_* tests so the "vunknown" fallback defect is caught by tests REVIEW-DEFENSE: _phase_push called-twice finding is false positive — merge-to-main-direct.sh sourced with MERGE_TO_MAIN_DIRECT_LIB=1, skipping top-level lifecycle; _phase_push called exactly once REVIEW-DEFENSE: RED marker removal for 0a63-754f is correct — t_pr_version_bump_pushed_to_origin is the implementation the marker awaited Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(batch-2): resolve 5 bugs across sprint, ticket-cli, review-gate, and onboarding - d2e4-3db7: sprint Phase F now checks SPRINT_MODE and routes ci-pr to merge-to-main.sh instead of direct merge-story-branch.sh - 277c-8f37: sprint-story-review.yml adds actionlint/shellcheck/lint-python gate jobs with needs: on the review job - 493a-dfe5: ticket show resolves friendly aliases via full resolve_ticket_id pipeline (was using short-hex-only _ticketlib_resolve_short_id) - 7ddc-1ae7: review-gate-allowlist.conf adds bootstrap/onboarding config artifact patterns so first commit doesn't require review - 6b04-9b62: onboarding SKILL.md adds git add -A after git checkout - to re-stage files cleared by orphan branch checkout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(277c-8f37): replace deprecated fail_on_error with fail_level in actionlint step reviewdog/action-actionlint@v1 deprecated fail_on_error; actionlint itself flagged this during PR CI. Replacing with fail_level: error per current API. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(7ddc-1ae7): restore clean .tickets-tracker/** pattern in allowlist Inline # tickets-boundary-ok suffix broke _load_allowlist_patterns which does not strip trailing comments — the full line became the glob, failing to match .tickets-tracker/ paths. Fix: restore clean pattern and add review-gate-allowlist.conf to check-tickets-boundary-allowlist.conf. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(7ddc-1ae7): remove dso-config.conf from bootstrap allowlist .claude/dso-config.conf was incorrectly added to review-gate-allowlist.conf in the batch-2 commit. The classifier reads the same allowlist to identify SCORING_FILES — adding dso-config.conf to the exempt list silently broke the _has_config_file floor rule (dso-config.conf diffs landed in light tier instead of standard/deep). Removing it restores the floor rule. The partial bootstrap allowlist still covers .gitignore, CLAUDE.md, workflow, and script scaffolding files. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(7ddc-1ae7): remove CLAUDE.md from bootstrap allowlist CLAUDE.md has a hardcoded safeguard floor rule in review-complexity-classifier.sh (_has_safeguard_file iterates SCORING_FILES only). Adding it to the allowlist puts it in EXEMPT_FILES, silently bypassing the floor rule and landing at light tier. Removing it from the allowlist restores the standard-tier floor for CLAUDE.md changes. Bootstrap scenario still benefits from .gitignore, .semgrep.yml, .pre-commit-config.yaml, .github/workflows/**, .claude/scripts/**, and .claude/project-understanding.md being allowlisted. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(batch-2): address llm-review cycle-1 findings Critical: - onboarding: replace git add -A with targeted re-staging using saved staged-file list; prevents application code from being staged into the orphan .tickets-tracker branch Important: - sprint Phase F: export STORY_BRANCH STORY_ID before calling merge-to-main.sh in ci-pr mode so subprocess can access orchestrator variables - ticket_show: add declare -f guard to prevent repeated ticket-lib.sh sourcing in batch contexts (shell cached function detection) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(batch-2): address llm-review cycle-2 findings Critical: - allowlist: remove .github/workflows/** — workflow files carry semantic significance and must be reviewed when modified Important: - ticket_show: add _TICKETLIB_DIR guard for clear diagnostic on missing module variable; pass TRACKER_DIR as TICKETS_TRACKER_DIR to resolve_ticket_id so custom tracker paths are honored by the resolution pipeline - onboarding: fix unquoted $_STAGED_BEFORE expansion using while/read loop to handle filenames with spaces safely - sprint Phase F ci-pr: add exit code check on merge-to-main.sh call Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(493a-dfe5): use non-circular alias derivation in test Replace code-under-test alias retrieval (ticket show $id) with independent derivation via ticket-alias-compute.py + wordlist, eliminating the circular dependency flagged in llm-review cycle-2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(batch-2): address llm-review cycle-3 findings - Add error handling to local mode merge path in sprint Phase F (was silently ignoring non-zero exit from merge-story-branch.sh) - Clarify resolve_ticket_id contract in ticket-lib-api.sh comment (document source location and interface) - Document merge-to-main.sh env-var contract in ci-pr path comment - Fix misleading comment in onboarding SKILL.md (readarray → while/read) - Fix terminology in review-gate-allowlist.conf comment (EXCLUDED → NOT listed here) - Add JSON output validation and tmpdir cleanup to alias resolution test Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(batch-2): skip alias scan for 4+ hyphen inputs in ticket show Inputs with 4+ hyphens (e.g. test inputs like nonexistent-ticket-id-zzz9-yyyy) cannot match any known ticket format (max is 3 hyphens for 16-hex IDs). Previously, resolve_ticket_id would run the expensive O(N*K) alias scan via ticket-alias-resolve.py against all 16K+ tickets, causing test timeouts in CI when check-tag-guards.sh / check-reinvocation.sh used such inputs. Add format-discriminated resolution: hex patterns → fast path, 4+ hyphens → immediate fail, 0-3 hyphens non-hex → full alias pipeline. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(batch-2): address llm-review cycle-4 findings - Add _snapshot_fail to alias-resolution tests for correct test isolation - Add tests for 4+-hyphen fast-reject and 8-hex short-ID resolution paths - Switch sprint-story-review.yml lint-python to astral-sh/ruff-action@v3 (pre-built action with pinned version replaces pip install ruff) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(batch-2): address llm-review cycle-5 findings - Propagate resolve_ticket_id exit code explicitly; command substitution silently loses the exit status, causing a generic "not found" message to overwrite the real error from the alias-resolution path - Add behavioral proof that ≥4-hyphen fast-path fires before alias scan: unset _TICKETLIB_DIR in test so slow path would produce a distinct error; assert that error contains no _TICKETLIB_DIR reference - Guard ${ticket_id:0:9} slice with length check (>= 9) before use Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(batch-2): address PR #112 review thread findings - Add permissions block to sprint-story-review.yml (contents: read, checks: write); fixes CodeQL/CodeRabbit/Copilot token-scope findings - Pin ludeeus/action-shellcheck@master to @2.0.0 (supply-chain pinning) - Replace tr+wc hyphen counting with pure bash arithmetic in ticket-lib-api.sh - Fix JSON parsing in test to use stdin (not sys.argv) for robustness - Fix misleading "skip" comment: alias unavailability is a hard fail - Fix sprint SKILL.md: use BRANCH env var (not STORY_BRANCH) for merge-to-main-pr.sh which defaults to the current git branch Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(batch-2): address llm-review cycle-6 findings - Fix hex regex: [a-z0-9] -> [0-9a-f] to reject non-hex alphanumeric inputs (e.g., 'gggg-hhhh') that would have been routed to _ticketlib_resolve_short_id expecting pure hex - Remove fragile _TICKETLIB_DIR error-message assertion from fast-path test; observable behavior (exit non-zero) is the correct assertion - Add short_id format guard in 8-hex test: assert extracted prefix matches [0-9a-f]{4}-[0-9a-f]{4} before proceeding Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Test <test@test.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
diff --git a/.claude/hooks/pre-commit/check-tickets-boundary-allowlist.conf b/.claude/hooks/pre-commit/check-tickets-boundary-allowlist.conf
@@ -35,6 +35,7 @@ plugins/dso/hooks/lib/merge-helpers.sh
 
 # Exclusion-pattern scripts (classify .tickets-tracker/ paths, do not access them)
 plugins/dso/scripts/skip-review-check.sh
+plugins/dso/hooks/lib/review-gate-allowlist.conf
 
 # All tests are exempt — the boundary exists to enforce that ticket code can be
 # broken out into a separate component later; test helpers that exercise that code
diff --git a/.github/workflows/sprint-story-review.yml b/.github/workflows/sprint-story-review.yml
@@ -5,13 +5,52 @@ on:
     branches:
       - 'story/**'
 
+permissions:
+  contents: read
+  checks: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ vars.SPRINT_SESSION_ID }}
   cancel-in-progress: true
 
 jobs:
+  actionlint:
+    name: Actionlint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run actionlint
+        uses: reviewdog/action-actionlint@v1
+        with:
+          reporter: github-check
+          fail_level: error
+
+  shellcheck:
+    name: ShellCheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@2.0.0
+        with:
+          scandir: './plugins/dso/scripts'
+
+  lint-python:
+    name: Lint Python (ruff)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run ruff
+        uses: astral-sh/ruff-action@v3
+        with:
+          args: check plugins/dso/scripts/
+
   review:
     name: Per-Story LLM Review
+    needs: [actionlint, shellcheck, lint-python]
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
diff --git a/plugins/dso/hooks/lib/review-gate-allowlist.conf b/plugins/dso/hooks/lib/review-gate-allowlist.conf
@@ -65,3 +65,14 @@ docs/**
 
 # Claude brainstorm/research artifacts
 .claude/artifacts/**
+
+# Bootstrap / onboarding config artifacts (written by dso-setup.sh / onboarding
+# SKILL.md Batch Groups 2+4; contain no reviewable application code).
+# NOTE: .claude/dso-config.conf, settings.json, CLAUDE.md, and .github/workflows/**
+# are intentionally NOT listed here — they are NOT exempt, so changes to them ARE reviewed.
+# .github/workflows/** in particular drives CI/CD and MUST be reviewed when modified.
+.gitignore
+.semgrep.yml
+.pre-commit-config.yaml
+.claude/scripts/**
+.claude/project-understanding.md
diff --git a/plugins/dso/scripts/ticket-lib-api.sh b/plugins/dso/scripts/ticket-lib-api.sh
@@ -123,7 +123,37 @@ ticket_show() {
             return 1
         fi
 
-        ticket_id="$(_ticketlib_resolve_short_id "$ticket_id" "$TRACKER_DIR")"
+        # Resolution strategy (ordered by cost):
+        # 1. Hex patterns (8-hex or 16-hex): fast O(N-dir) scan via _ticketlib_resolve_short_id
+        # 2. Inputs with 4+ hyphens: cannot match any known format (max is 3 for 16-hex);
+        #    skip expensive O(N*K) alias scan and fail immediately
+        # 3. All other inputs (0-3 hyphens, non-hex): potential alias, jira_key, or prefix;
+        #    use full resolve_ticket_id pipeline from ticket-lib.sh (line ~1199)
+        local _no_hyphens="${ticket_id//-/}"
+        local _hyphen_count=$(( ${#ticket_id} - ${#_no_hyphens} ))
+        if [[ "$ticket_id" =~ ^[0-9a-f]{4}-[0-9a-f]{4}(-[0-9a-f]{4}-[0-9a-f]{4})?$ ]]; then
+            ticket_id="$(_ticketlib_resolve_short_id "$ticket_id" "$TRACKER_DIR")"
+        elif [[ "$_hyphen_count" -ge 4 ]]; then
+            echo "Error: Ticket '$ticket_id' not found" >&2
+            return 1
+        else
+            if [[ -z "${_TICKETLIB_DIR:-}" ]]; then
+                echo "Error: _TICKETLIB_DIR is not set; cannot resolve ticket alias" >&2
+                return 1
+            fi
+            declare -f resolve_ticket_id &>/dev/null || source "$_TICKETLIB_DIR/ticket-lib.sh"
+            # Pass TRACKER_DIR through TICKETS_TRACKER_DIR so resolve_ticket_id
+            # uses the same tracker path as ticket_show's directory lookup below.
+            # Capture exit code separately: command substitution loses the exit status,
+            # so a failing resolve_ticket_id would silently produce an empty ticket_id
+            # and fall through to the generic "not found" error, hiding the real cause.
+            local _resolve_rc=0
+            ticket_id="$(TICKETS_TRACKER_DIR="$TRACKER_DIR" resolve_ticket_id "$ticket_id")" || _resolve_rc=$?
+            if [[ $_resolve_rc -ne 0 ]]; then
+                # resolve_ticket_id already wrote a specific error to stderr; propagate it
+                return 1
+            fi
+        fi
 
         if [ ! -d "$TRACKER_DIR/$ticket_id" ]; then
             echo "Error: Ticket '$ticket_id' not found" >&2
diff --git a/plugins/dso/skills/onboarding/SKILL.md b/plugins/dso/skills/onboarding/SKILL.md
@@ -1213,13 +1213,23 @@ If the git guard passes, initialize the DSO ticket system by creating an orphan
 ```bash
 # Create orphan branch for ticket event storage
 cd "$REPO_ROOT"
+# Capture staged files before orphan checkout clears the index
+_STAGED_BEFORE=$(git diff --name-only --cached 2>/dev/null || true)
 git checkout --orphan tickets
 git rm -rf . --quiet 2>/dev/null || true
 mkdir -p .tickets-tracker
 echo "# DSO Ticket System" > .tickets-tracker/README.md
 git add .tickets-tracker/README.md
 git commit -m "chore: initialize ticket system"
 git checkout -  # return to previous branch
+# Re-stage only the files that were staged before the orphan checkout
+# (do NOT use git add -A which would stage untracked application code)
+# Use while/read with IFS= to handle filenames with spaces safely
+if [ -n "$_STAGED_BEFORE" ]; then
+    while IFS= read -r _staged_file; do
+        [ -n "$_staged_file" ] && git add -- "$_staged_file"
+    done <<< "$_STAGED_BEFORE"
+fi
 ```
 
 **Push verification:** After creating the orphan branch, push it to the remote and verify push success. If the push fails, warn the user:
diff --git a/plugins/dso/skills/sprint/SKILL.md b/plugins/dso/skills/sprint/SKILL.md
@@ -1996,15 +1996,33 @@ grep -n "\[.*\]" .test-index || true
 # Remove any markers for tests that are now passing
 ```
 
-**Story branch merge (before closure)**: After RED marker cleanup and before closing the story, merge the story branch with the DSO-Story-Merge trailer:
+**Story branch merge (before closure)**: After RED marker cleanup and before closing the story, merge the story branch. The merge path depends on `SPRINT_MODE`:
+- `ci-pr` mode: route through `merge-to-main.sh` to create a GitHub PR — do NOT perform a direct local merge
+- `local` mode (default): direct local merge with `DSO-Story-Merge` trailer via `merge-story-branch.sh`
 
 ```bash
 # Conflict queue precondition (in-memory orchestrator check):
 if [[ ${#CONFLICT_QUEUE[@]} -gt 0 ]]; then
   echo 'ERROR: conflict queue non-empty — resolve conflicts before merging story branch' >&2
   exit 1
 fi
-bash "$PLUGIN_SCRIPTS/merge-story-branch.sh" "$STORY_BRANCH" "$STORY_ID" # shim-exempt: SKILL.md orchestrator instruction — sprint runs plugin scripts via $PLUGIN_SCRIPTS directly
+if [[ "${SPRINT_MODE:-local}" == "ci-pr" ]]; then
+  # ci-pr mode: merge via GitHub PR — do NOT perform a local direct merge
+  # merge-to-main-pr.sh uses BRANCH (defaults to current git branch if unset).
+  # Export STORY_BRANCH as BRANCH so the script targets the correct story branch
+  # even when the orchestrator is not currently checked out on that branch.
+  export BRANCH="$STORY_BRANCH"
+  bash "$PLUGIN_SCRIPTS/merge-to-main.sh" || { # shim-exempt: SKILL.md orchestrator instruction — sprint runs plugin scripts via $PLUGIN_SCRIPTS directly
+    echo "ERROR: merge-to-main.sh failed in ci-pr mode — aborting story merge" >&2
+    exit 1
+  }
+else
+  # local mode: direct local merge with DSO-Story-Merge trailer
+  bash "$PLUGIN_SCRIPTS/merge-story-branch.sh" "$STORY_BRANCH" "$STORY_ID" || { # shim-exempt: SKILL.md orchestrator instruction — sprint runs plugin scripts via $PLUGIN_SCRIPTS directly
+    echo "ERROR: merge-story-branch.sh failed in local mode — aborting story merge" >&2
+    exit 1
+  }
+fi
 ```
 
 ### Leakage Detection
diff --git a/tests/scripts/test-ticket-show.sh b/tests/scripts/test-ticket-show.sh
@@ -547,4 +547,117 @@ except Exception as e:
 }
 test_ticket_show_preconditions_summary_legacy_placeholder
 
+# [RED: 493a-dfe5-alias-resolve]
+# ── Test: ticket show resolves friendly alias ─────────────────────────────────
+echo "Test: ticket show resolves friendly alias to ticket details"
+test_ticket_show_resolves_friendly_alias() {
+    _snapshot_fail
+    local repo
+    repo=$(_make_test_repo)
+
+    local ticket_id=""
+    ticket_id=$(cd "$repo" && bash "$TICKET_SCRIPT" create story "alias resolution test story" 2>/dev/null | tail -1 || true)
+
+    if [ -z "$ticket_id" ]; then
+        assert_eq "ticket created for alias resolution test" "non-empty" "empty"
+        rm -rf "$repo"
+        return
+    fi
+
+    # Derive the alias independently via ticket-alias-compute.py (not via ticket show)
+    # to avoid circular dependency on the code under test.
+    local alias=""
+    local _wordlist="$REPO_ROOT/plugins/dso/resources/ticket-wordlist.txt"
+    local _alias_script="$REPO_ROOT/plugins/dso/scripts/ticket-alias-compute.py"
+    if [[ -f "$_alias_script" && -f "$_wordlist" ]]; then
+        alias=$(python3 "$_alias_script" "$ticket_id" "$_wordlist" 2>/dev/null || true)
+    fi
+
+    if [ -z "$alias" ]; then
+        # Alias computation unavailable — this is a hard requirement; fail the test
+        assert_eq "ticket alias derivable from ticket_id" "non-empty-alias" "empty-alias"
+        rm -rf "$repo"
+        return
+    fi
+
+    # ticket show using the friendly alias must exit 0 and return the same ticket_id
+    local alias_output=""
+    local alias_exit=0
+    alias_output=$(cd "$repo" && bash "$TICKET_SCRIPT" show "$alias" 2>/dev/null) || alias_exit=$?
+
+    assert_eq "ticket show via alias exits 0" "0" "$alias_exit"
+
+    # Validate output is parseable JSON before extracting field (parse via stdin, not argv)
+    local json_valid=""
+    json_valid=$(echo "$alias_output" | python3 -c "import json,sys; json.load(sys.stdin); print('yes')" 2>/dev/null || echo "no")
+    assert_eq "ticket show via alias returns valid JSON" "yes" "$json_valid"
+
+    local resolved_id=""
+    resolved_id=$(echo "$alias_output" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('ticket_id',''))" 2>/dev/null || true)
+    assert_eq "ticket show via alias returns correct ticket_id" "$ticket_id" "$resolved_id"
+
+    rm -rf "$repo"
+    assert_pass_if_clean "test_ticket_show_resolves_friendly_alias"
+}
+test_ticket_show_resolves_friendly_alias
+
+# ── Test: ticket show rejects inputs with 4+ hyphens without alias scan ───────
+echo "Test: ticket show rejects 4+ hyphen inputs fast (no alias scan)"
+test_ticket_show_rejects_four_hyphen_input() {
+    _snapshot_fail
+    local repo
+    repo=$(_make_test_repo)
+
+    local rc=0
+    cd "$repo" && bash "$TICKET_SCRIPT" show "nonexistent-ticket-id-zzz9-yyyy" 2>/dev/null || rc=$?
+    assert_ne "ticket show with 4+ hyphens exits non-zero" "0" "$rc"
+
+    rm -rf "$repo"
+    assert_pass_if_clean "test_ticket_show_rejects_four_hyphen_input"
+}
+test_ticket_show_rejects_four_hyphen_input
+
+# ── Test: ticket show resolves 8-hex short ID ─────────────────────────────────
+echo "Test: ticket show resolves 8-hex short ID to full ticket"
+test_ticket_show_resolves_8hex_short_id() {
+    _snapshot_fail
+    local repo
+    repo=$(_make_test_repo)
+
+    local ticket_id=""
+    ticket_id=$(cd "$repo" && bash "$TICKET_SCRIPT" create story "short-id test story" 2>/dev/null | tail -1 || true)
+
+    if [ -z "$ticket_id" ]; then
+        assert_eq "ticket created for short-id test" "non-empty" "empty"
+        rm -rf "$repo"
+        return
+    fi
+
+    # Extract the 8-hex prefix (first 9 chars: "xxxx-xxxx"); guard length and format
+    if [[ ${#ticket_id} -lt 9 ]]; then
+        assert_eq "ticket_id long enough for 8-hex prefix (>=9 chars)" ">=9" "${#ticket_id}"
+        rm -rf "$repo"
+        return
+    fi
+    local short_id="${ticket_id:0:9}"
+    if [[ ! "$short_id" =~ ^[0-9a-f]{4}-[0-9a-f]{4}$ ]]; then
+        assert_eq "extracted short_id has expected 8-hex format (xxxx-xxxx)" "hex4-hex4" "$short_id"
+        rm -rf "$repo"
+        return
+    fi
+    local short_output="" short_exit=0
+    short_output=$(cd "$repo" && bash "$TICKET_SCRIPT" show "$short_id" 2>/dev/null) || short_exit=$?
+
+    assert_eq "ticket show via 8-hex exits 0" "0" "$short_exit"
+
+    local resolved_id=""
+    resolved_id=$(python3 -c "import json,sys; d=json.loads(sys.argv[1]); print(d.get('ticket_id',''))" "$short_output" 2>/dev/null || true)
+    assert_eq "ticket show via 8-hex returns correct ticket_id" "$ticket_id" "$resolved_id"
+
+    rm -rf "$repo"
+    assert_pass_if_clean "test_ticket_show_resolves_8hex_short_id"
+}
+test_ticket_show_resolves_8hex_short_id
+
+
 print_summary
