feat(w21-24kl): batch 20 — RED ticket gate tests + allowlist fix + CI fixes

Add RED tests for pre-commit-ticket-gate.sh (dso-qki2): 10 test functions
covering ticket ID validation, allowlist skip, merge exemption, and
graceful degradation.

Fix critical allowlist bug: restore .tickets/** pattern alongside the v3
worktree pattern — .tickets/ is tracked on main while the v3 worktree is
on an orphan branch whose files never appear in git diff on main.

Fix CI: portable xargs replacement in cutover migration test, update
validate-work readonly enforcement test for ticket CLI migration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JoeOakhartNava

.test-index

@@ -102,3 +102,4 @@ plugins/dso/skills/validate-work/SKILL.md:plugins/dso/tests/test-sprint-skill-st
 plugins/dso/skills/validate-work/prompts/ci-status.md:tests/hooks/test-ci-status-no-jq.sh,tests/scripts/test-ci-status-auth-ratelimit.sh,tests/scripts/test-ci-status-timeout.sh,tests/scripts/test-ci-status.sh
 plugins/dso/skills/verification-before-completion/SKILL.md:plugins/dso/tests/test-sprint-skill-step10-no-merge-to-main.sh,tests/plugin/test-audit-skill-resolution.sh,tests/hooks/test-fix-bug-skill.sh,tests/hooks/test-generate-claude-md-skill.sh,tests/hooks/test-init-skill.sh,tests/scripts/test-qualify-skill-refs.sh,tests/scripts/test-skill-path-refs.sh,tests/scripts/test-check-skill-refs.sh,tests/skills/test_end_skill_final_verification_step.py,tests/skills/test_implementation_plan_skill_tdd_enforcement.py,tests/skills/test-quick-ref-skill.sh,tests/skills/test_project_setup_skill_conditional_prompts.py,tests/skills/test_fix_bug_skill.py,tests/skills/test_end_skill_summary_displays_stored_learnings.py,tests/skills/test_end_skill_learnings_step_before_commit.py,tests/skills/test-design-skills-cross-stack.sh,tests/skills/test_end_skill_dirty_worktree_resolution.py,tests/skills/test_fix_bug_skill_escalated_section.py,tests/skills/test_end_skill_bug_tickets_before_commit.py
 plugins/dso/scripts/cutover-tickets-migration.sh: tests/scripts/test-cutover-tickets-migration.sh [test_cutover_rollback_committed_uses_revert]
+plugins/dso/hooks/pre-commit-ticket-gate.sh: tests/hooks/test-pre-commit-ticket-gate.sh [test_blocks_missing_ticket_id]

.tickets/.index.json

@@ -700,6 +700,13 @@
     "title": "Fix: project-detect.sh short-circuit python3 subprocess when entries is empty",
     "type": "bug"
   },
+  "dso-qxsw": {
+    "deps": [],
+    "priority": 1,
+    "status": "open",
+    "title": "Fix remaining CI failures from v3 path migration",
+    "type": "bug"
+  },
   "dso-r97p": {
     "deps": [],
     "priority": 2,

.tickets/.sync-state.json

@@ -449,8 +449,8 @@
     "last_synced": "2026-03-19T18:38:35Z",
     "local_hash": "14c516947a151a3db8bdec4010e2fd6e"
   },
-  "last_pull_timestamp": "2026-03-23T20:17:37Z",
-  "last_sync_commit": "d71e356f714a70cdc98c0624fac743dd3073793e",
+  "last_pull_timestamp": "2026-03-23T20:55:35Z",
+  "last_sync_commit": "0ae161d9e098387e6596147a999ae6bcf2d32f9d",
   "w21-5cqr": {
     "jira_hash": "bce29d76f01c58613ee99cb1dd03920d",
     "jira_key": "DIG-61",

.tickets/dso-qki2.md

@@ -1,6 +1,6 @@
 ---
 id: dso-qki2
-status: open
+status: in_progress
 deps: []
 links: []
 created: 2026-03-23T20:26:38Z
@@ -53,3 +53,38 @@ Env var injection for tests:
 **2026-03-23T20:29:04Z**
 
 Gap Analysis AC Amendment: Ensure the test script is runnable (bash-executable). Add to acceptance criteria: 'Test file runs without bash syntax errors: Verify: bash -n $(git rev-parse --show-toplevel)/tests/hooks/test-pre-commit-ticket-gate.sh'
+
+## ACCEPTANCE CRITERIA
+
+- [ ] tests/hooks/test-pre-commit-ticket-gate.sh exists and is executable
+  Verify: test -x tests/hooks/test-pre-commit-ticket-gate.sh
+- [ ] Test file contains at least 8 test functions
+  Verify: grep -c "^test_" tests/hooks/test-pre-commit-ticket-gate.sh | awk "{exit (\$1 < 8)}"
+- [ ] .test-index entry added with RED marker
+  Verify: grep -q "test-pre-commit-ticket-gate" .test-index
+- [ ] All tests fail RED (hook does not exist yet)
+  Verify: bash tests/hooks/test-pre-commit-ticket-gate.sh 2>&1 | grep -qi fail
+
+**2026-03-23T20:35:56Z**
+
+CHECKPOINT 1/6: Task context loaded ✓
+
+**2026-03-23T20:36:00Z**
+
+CHECKPOINT 2/6: Code patterns understood ✓
+
+**2026-03-23T20:37:21Z**
+
+CHECKPOINT 3/6: Tests written ✓
+
+**2026-03-23T20:37:25Z**
+
+CHECKPOINT 4/6: Implementation complete ✓
+
+**2026-03-23T20:47:54Z**
+
+CHECKPOINT 5/6: Validation passed ✓ — syntax OK; 10/10 tests fail RED (hook not yet implemented); .test-index entry added with RED marker [test_blocks_missing_ticket_id]
+
+**2026-03-23T20:48:07Z**
+
+CHECKPOINT 6/6: Done ✓ — all 6 ACs verified: file exists, executable, 20 test_ functions (>=8 required), .test-index entry present, 10/10 tests fail RED, no bash syntax errors

.tickets/dso-qxsw.md

@@ -0,0 +1,39 @@
+---
+id: dso-qxsw
+status: open
+deps: []
+links: []
+created: 2026-03-23T20:35:48Z
+type: bug
+priority: 1
+assignee: Joe Oakhart
+---
+# Fix remaining CI failures from v3 path migration
+
+
+## Notes
+
+<!-- note-id: qb96bnr0 -->
+<!-- timestamp: 2026-03-23T21:01:48Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+Investigation complete. Root causes identified and fixed:
+
+1. test_phase_migrate_preserves_notes_with_timestamps (BLOCKING in CI batch 18):
+   - Root cause: xargs -S 65536 is macOS-specific, fails on Linux/CI
+   - Fix: replaced with portable while-read loop in test-cutover-tickets-migration.sh
+
+2. test_*_names_tk_close_or_tk_status_as_prohibited (BLOCKING in CI batch 18):
+   - Root cause: test checked for old 'tk close|tk status' commands after v3 migration renamed them to 'ticket transition|ticket create'
+   - Fix: updated test-validate-work-readonly-enforcement.sh to check for new v3 command names
+
+3. test_cutover_rollback_committed_uses_revert + test_cutover_exits_with_error (non-blocking):
+   - These are RED marker tests in .test-index, expected to fail
+   - Also improved _rollback_phase implementation to handle empty revert ranges
+
+4. Previously-failing tests from earlier batches (skip-review, doc-migration, impl-plan-contracts, merge-squash-rebase, behavioral-equivalence, review-gate, compute-diff-hash):
+   - All pass on current HEAD (fixed by batches 16-18)
+
+ShellCheck: no violations on modified files.
+Local test results: Script Tests 2679 PASSED / 2 FAILED (both RED markers)

plugins/dso/hooks/compute-diff-hash.sh

@@ -4,7 +4,7 @@
 # Includes changes in the git index (staged) and modifications to tracked files.
 # Excludes untracked files — new files must be staged before review (per COMMIT-WORKFLOW.md).
 # This prevents temp test fixtures from causing hash mismatches between review and pre-commit.
-# Excludes .tickets-tracker/ files from hash — ticket metadata changes must not invalidate code reviews.
+# Excludes .tickets/ and .tickets-tracker/ files from hash — ticket metadata changes must not invalidate code reviews.
 #
 # Usage:
 #   HASH=$(.claude/hooks/compute-diff-hash.sh)
@@ -111,6 +111,7 @@ fi
 # Fallback defaults when allowlist or helpers are unavailable
 _FALLBACK_PATHSPECS=(
     ':!.checkpoint-needs-review'
+    ':!.tickets/**'
     ':!.tickets-tracker/**'
     ':!.sync-state.json'
     ':!*.png' ':!*.jpg' ':!*.jpeg' ':!*.gif' ':!*.svg' ':!*.ico' ':!*.webp'

plugins/dso/hooks/lib/review-gate-allowlist.conf

@@ -10,7 +10,10 @@
 # dynamically at load time by the consumer scripts. They are NOT
 # listed here because they vary per project.
 
-# Ticket metadata
+# Ticket metadata — both paths needed:
+#   .tickets/** = old flat-file tickets tracked on main (until w21-gy45 cleanup)
+#   .tickets-tracker/** = v3 event-sourced worktree (orphan branch, currently no-op on main)
+.tickets/**
 .tickets-tracker/**
 
 # Sync metadata

plugins/dso/scripts/cutover-tickets-migration.sh

@@ -908,33 +908,45 @@ _rollback_phase() {
     local commit_before="$3"
     local log_file="$4"
 
-    # Determine rollback strategy: dirty working tree → checkout, clean → revert
+    # Determine rollback strategy:
+    #   - Commits were made since run start (HEAD moved)  → git revert
+    #   - Working-tree dirty (staged/unstaged changes)    → git checkout HEAD -- .
+    #   - No changes at all                               → no-op
+    local current_head
+    current_head=$(git -C "$_REPO_ROOT" rev-parse HEAD 2>/dev/null || echo "unknown")
+
     local rollback_strategy
-    if git -C "$_REPO_ROOT" diff --quiet HEAD 2>/dev/null; then
+    if [[ "$commit_before" != "unknown" && "$current_head" != "$commit_before" ]]; then
         rollback_strategy="revert"
-    else
+    elif ! git -C "$_REPO_ROOT" diff --quiet HEAD 2>/dev/null; then
         rollback_strategy="checkout"
+    else
+        rollback_strategy="noop"
     fi
 
     echo "Rollback: phase '${phase}' failed (exit ${phase_rc}); strategy=${rollback_strategy}" >&2
     printf '[%s] Rollback: phase "%s" failed (exit %s); strategy=%s\n' \
         "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$phase" "$phase_rc" "$rollback_strategy" >> "$log_file"
 
     local rollback_exit=0
-    if [[ "$rollback_strategy" == "checkout" ]]; then
-        git -C "$_REPO_ROOT" checkout HEAD -- . 2>&1 || rollback_exit=$?
-    else
-        # revert: undo all commits made during this phase by reverting from
-        # commit_before up to HEAD, so multi-commit phases are fully unwound.
+    if [[ "$rollback_strategy" == "revert" ]]; then
+        # revert: undo all commits made during this run by reverting from
+        # commit_before up to HEAD, so multi-phase commits are fully unwound.
         git -C "$_REPO_ROOT" revert --no-edit "${commit_before}..HEAD" 2>&1 || rollback_exit=$?
+    elif [[ "$rollback_strategy" == "checkout" ]]; then
+        git -C "$_REPO_ROOT" checkout HEAD -- . 2>&1 || rollback_exit=$?
     fi
 
     # Remove the state file so a subsequent re-run starts fresh
     rm -f "$CUTOVER_STATE_FILE"
 
-    # Remove any untracked files/dirs created during the run (log dir, temp
-    # files, etc.) so the working tree is left fully clean.
-    git -C "$_REPO_ROOT" clean -fd 2>&1 || true
+    # Remove any untracked files/dirs created during the run, preserving the
+    # log directory so the error message path remains valid after rollback.
+    local _clean_excludes=()
+    if [[ -n "${CUTOVER_LOG_DIR:-}" ]]; then
+        _clean_excludes+=("-e" "$CUTOVER_LOG_DIR")
+    fi
+    git -C "$_REPO_ROOT" clean -fd "${_clean_excludes[@]}" 2>&1 || true
 
     if [[ "$rollback_exit" -eq 0 ]]; then
         echo "Rollback complete." >&2
@@ -969,6 +981,8 @@ if [[ "$_RESUME" == "true" ]]; then
     fi
 fi
 
+_run_commit_before=$(git -C "$_REPO_ROOT" rev-parse HEAD 2>/dev/null || echo "unknown")
+
 for _phase in "${PHASES[@]}"; do
     # Resume: skip phases already recorded in the state file
     if [[ "$_RESUME" == "true" ]] && _phase_is_completed "$_phase"; then
@@ -979,12 +993,9 @@ for _phase in "${PHASES[@]}"; do
     if [[ "$_DRY_RUN" == "true" ]]; then
         "_run_phase_dry" "$_phase" || { _rc=$?; echo "[DRY RUN] ERROR: phase ${_phase} failed (exit ${_rc}) — see ${_LOG_FILE}" >&2; exit "$_rc"; }
     else
-        _phase_commit_before=$(git -C "$_REPO_ROOT" rev-parse HEAD 2>/dev/null || echo "unknown")
         "_phase_${_phase}" || {
             _rc=$?
-            _rollback_phase "$_phase" "$_rc" "$_phase_commit_before" "$_LOG_FILE"
-            echo "ERROR: phase ${_phase} failed (exit ${_rc}) — see ${_LOG_FILE}" >&2
-            exit "$_rc"
+            _rollback_phase "$_phase" "$_rc" "$_run_commit_before" "$_LOG_FILE"
         }
         _state_append_phase "$_phase"
     fi

plugins/dso/scripts/skip-review-check.sh

@@ -51,6 +51,7 @@ if [[ -f "$_ALLOWLIST_FILE" ]]; then
 else
     # Graceful degradation: fall back to hardcoded patterns when allowlist is missing
     _ALLOWLIST_PATTERNS=(
+        ".tickets/*"
         ".tickets-tracker/*"
         ".sync-state.json"
         ".checkpoint-needs-review"