fix(dso-6x8o): change stale test-gate-status guard from reject to clear-and-rerun (merge worktree-20260321-170257)

JoeOakhartNava · JoeOakhartNava · commit 7f161c307ed7 · 2026-03-21T18:49:07.000-07:00
diff --git a/.tickets/.index.json b/.tickets/.index.json
@@ -714,7 +714,7 @@
   "w20-4idh": {
     "deps": [],
     "priority": 1,
-    "status": "open",
+    "status": "closed",
     "title": "test-batched.sh state file not isolated by repo/worktree \u2014 causes cross-session interference",
     "type": "bug"
   },
@@ -805,7 +805,7 @@
   "w21-3w8y": {
     "deps": [],
     "priority": 1,
-    "status": "open",
+    "status": "closed",
     "title": "Preplanning adds epic's own children as deps, making the epic self-blocked",
     "type": "bug"
   },
diff --git a/.tickets/dso-2dxt.md b/.tickets/dso-2dxt.md
@@ -1,12 +1,13 @@
 ---
 id: dso-2dxt
-status: open
+status: in_progress
 deps: []
 links: []
 created: 2026-03-21T20:32:23Z
 type: task
 priority: 2
 assignee: Joe Oakhart
+parent: w22-ns6l
 ---
 # bug LINK/UNLINK same-second timestamp ordering causes unlink to be ignored
 
@@ -19,3 +20,7 @@ assignee: Joe Oakhart
 <!-- sync: unsynced -->
 
 Discovered in test-ticket-dependency-e2e.sh (dso-ofdp). When ticket-graph.py writes a LINK event and ticket-link.sh writes an UNLINK event in the same Unix second (int(time.time())), the filename sort order is {timestamp}-{uuid}-LINK.json vs {timestamp}-{uuid}-UNLINK.json. Since UUIDs are random, the UNLINK can sort before the LINK alphabetically, causing the event replay in _is_duplicate_link and _find_direct_blockers to treat the link as still active. Fix: use millisecond timestamps or add a tie-breaker suffix to guarantee UNLINK always sorts after LINK in the same second.
+
+**2026-03-22T00:35:13Z**
+
+Classification: behavioral, Score: 2 (BASIC). Root cause: event filename sort key used only the full basename, so when LINK and UNLINK events share the same Unix-second timestamp but have different random UUID segments, alphabetical UUID sort could place UNLINK before LINK. Fix: changed sort key to (timestamp_only, event_type_order, full_name) in both _is_duplicate_link and _get_link_info — ensures LINK always replays before UNLINK at same second. Added Test 9 to test-ticket-link.sh to reproduce the bug deterministically using crafted filenames with controlled UUID ordering.
diff --git a/.tickets/dso-6x8o.md b/.tickets/dso-6x8o.md
@@ -1,6 +1,6 @@
 ---
 id: dso-6x8o
-status: open
+status: closed
 deps: []
 links: []
 created: 2026-03-22T00:00:28Z
diff --git a/.tickets/dso-gg0v.md b/.tickets/dso-gg0v.md
@@ -0,0 +1,30 @@
+---
+id: dso-gg0v
+status: open
+deps: []
+links: []
+created: 2026-03-22T00:33:09Z
+type: bug
+priority: 2
+assignee: Joe Oakhart
+tags: [agent-compliance, debug-everything]
+---
+# debug-everything validation prompts use soft "Do NOT fix" language instead of hard-stop READ-ONLY ENFORCEMENT
+
+## Bug
+
+The following debug-everything validation sub-agent prompts use soft "Do NOT fix" imperative language instead of the hard-stop READ-ONLY ENFORCEMENT section pattern fixed in w20-w7pm:
+
+- plugins/dso/skills/debug-everything/prompts/full-validation.md
+- plugins/dso/skills/debug-everything/prompts/post-batch-validation.md
+- plugins/dso/skills/debug-everything/prompts/tier-transition-validation.md
+- plugins/dso/skills/debug-everything/prompts/critic-review.md
+- plugins/dso/skills/debug-everything/prompts/diagnostic-and-cluster.md
+
+## Expected Behavior
+
+Each validation/diagnostic prompt should have a dedicated ## READ-ONLY ENFORCEMENT section that explicitly names the Edit tool, Write tool, and file-modifying Bash commands as PROHIBITED — matching the pattern implemented in w20-w7pm for validate-work prompts.
+
+## Discovered by
+
+Bug w20-w7pm anti-pattern search (CLAUDE.md rule 9).
diff --git a/.tickets/w20-4idh.md b/.tickets/w20-4idh.md
@@ -1,6 +1,6 @@
 ---
 id: w20-4idh
-status: open
+status: closed
 deps: []
 links: []
 created: 2026-03-21T16:04:19Z
@@ -33,3 +33,12 @@ Search for similar patterns of non-isolated /tmp file usage across the codebase.
 - tests/scripts/test-batched-state-integrity.sh (update tests)
 - Potentially other scripts found during audit
 
+
+## Notes
+
+<!-- note-id: u0s49rck -->
+<!-- timestamp: 2026-03-22T01:04:02Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+CLOSE REASON: Fixed: derive default state file path using SHA256 hash of git root (12 hex chars) — df51136. 49/49 tests passing.
diff --git a/.tickets/w21-3w8y.md b/.tickets/w21-3w8y.md
@@ -1,6 +1,6 @@
 ---
 id: w21-3w8y
-status: open
+status: closed
 deps: []
 links: []
 created: 2026-03-20T18:57:23Z
@@ -35,3 +35,12 @@ Children are added to `deps`, causing the epic to self-block. `sprint-list-epics
 
 - `plugins/dso/skills/preplanning/` — likely where `tk dep` is called to wire children as blockers
 - `plugins/dso/scripts/sprint-list-epics.sh` — could also filter out self-child deps when computing blocked status
+
+## Notes
+
+<!-- note-id: s4dz9l0o -->
+<!-- timestamp: 2026-03-22T01:05:02Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+CLOSE REASON: Fixed: sprint-list-epics.sh now filters child deps from blocked computation via external_deps; tk index stores parent field in _tk_build_full_index and _update_ticket_index; preplanning/SKILL.md guardrail added against tk dep epic-id story-id. Committed in df51136.
diff --git a/plugins/dso/hooks/record-test-status.sh b/plugins/dso/hooks/record-test-status.sh
@@ -204,6 +204,22 @@ fi
 # alter the untracked file list and produce a different hash.
 DIFF_HASH=$("$HOOK_DIR/compute-diff-hash.sh")
 
+# --- Guard: clear stale status when code changed since last recorded test run ---
+# If an existing 'passed' status was recorded for a DIFFERENT hash, clear it so
+# the test loop below re-runs tests against the current code (dso-6x8o).
+_EXISTING_STATUS_FILE="$ARTIFACTS_DIR/test-gate-status"
+if [[ -f "$_EXISTING_STATUS_FILE" ]]; then
+    _EXISTING_STATUS=$(head -1 "$_EXISTING_STATUS_FILE" 2>/dev/null || echo "")
+    _EXISTING_HASH=$(grep '^diff_hash=' "$_EXISTING_STATUS_FILE" 2>/dev/null | head -1 | cut -d= -f2 || echo "")
+    if [[ "$_EXISTING_STATUS" == "passed" ]] && [[ -n "$_EXISTING_HASH" ]] && [[ "$_EXISTING_HASH" != "$DIFF_HASH" ]]; then
+        echo "WARNING: stale test-gate-status cleared — re-running tests for current hash." >&2
+        echo "  Previously passed hash: ${_EXISTING_HASH:0:12}..." >&2
+        echo "  Current diff hash:      ${DIFF_HASH:0:12}..." >&2
+        rm -f "$_EXISTING_STATUS_FILE"
+    fi
+fi
+
+
 # --- Run associated tests ---
 STATUS="passed"
 HAD_TIMEOUT=false
diff --git a/plugins/dso/scripts/sprint-list-epics.sh b/plugins/dso/scripts/sprint-list-epics.sh
@@ -107,11 +107,15 @@ for fname in files:
             title = line[2:].strip()
             break
 
+    parent = get_field('parent')
+
     entry = {'title': title, 'status': status, 'type': type_}
     if priority is not None:
         entry['priority'] = priority
     if deps:
         entry['deps'] = deps
+    if parent:
+        entry['parent'] = parent
     idx[ticket_id] = entry
 
 # Write atomically
@@ -215,8 +219,9 @@ try:
 except Exception:
     child_counts = {}
 
-# Build lookup for dep status resolution
+# Build lookup for dep status and parent resolution
 dep_status = {tid: entry.get('status', 'open') for tid, entry in index.items()}
+dep_parent = {tid: entry.get('parent', '') for tid, entry in index.items()}
 
 in_progress = []
 open_unblocked = []
@@ -230,8 +235,11 @@ for tid, entry in index.items():
         continue
 
     deps = entry.get('deps', [])
-    # An epic is blocked if it has at least one dep whose status is not 'closed'
-    is_blocked = any(dep_status.get(dep, 'open') != 'closed' for dep in deps)
+    # An epic is blocked only by external deps — exclude deps that are its own children.
+    # Preplanning may mistakenly add child story IDs to the epic's deps field (bug w21-3w8y).
+    # Children are identified by having parent == this epic's ID.
+    external_deps = [dep for dep in deps if dep_parent.get(dep, '') != tid]
+    is_blocked = any(dep_status.get(dep, 'open') != 'closed' for dep in external_deps)
 
     priority = entry.get('priority', 4)
     if priority is None:
diff --git a/plugins/dso/scripts/test-batched.sh b/plugins/dso/scripts/test-batched.sh
@@ -121,9 +121,27 @@ trap '_signal_handler URG'  SIGURG
 
 # ── Constants ─────────────────────────────────────────────────────────────────
 DEFAULT_TIMEOUT=50
-DEFAULT_STATE_FILE="${TEST_BATCHED_STATE_FILE:-/tmp/test-batched-state.json}"
 DEFAULT_STATE_TTL=14400  # 4 hours in seconds
 
+# Derive a repo/worktree-isolated default state file path.
+# Uses a hash of the git root directory so each repo and worktree gets its own
+# state file, preventing cross-session interference on the same machine.
+# Falls back to /tmp/test-batched-state.json when git is unavailable.
+_derive_default_state_file() {
+    local git_root
+    git_root=$(git rev-parse --show-toplevel 2>/dev/null) || { echo "/tmp/test-batched-state.json"; return; }
+    local hash
+    hash=$(echo -n "$git_root" | sha256sum 2>/dev/null | awk '{print $1}' || \
+           echo -n "$git_root" | python3 -c "import sys,hashlib; print(hashlib.sha256(sys.stdin.buffer.read()).hexdigest())" 2>/dev/null)
+    if [ -n "$hash" ]; then
+        echo "/tmp/test-batched-state-${hash:0:12}.json"
+    else
+        echo "/tmp/test-batched-state.json"
+    fi
+}
+
+DEFAULT_STATE_FILE="${TEST_BATCHED_STATE_FILE:-$(_derive_default_state_file)}"
+
 # ── Argument parsing ──────────────────────────────────────────────────────────
 TIMEOUT=$DEFAULT_TIMEOUT
 STATE_FILE="$DEFAULT_STATE_FILE"
diff --git a/plugins/dso/scripts/ticket-link.sh b/plugins/dso/scripts/ticket-link.sh
@@ -85,7 +85,13 @@ for f in sorted(p.glob('*-UNLINK.json')):
     all_events.append(('UNLINK', f))
 
 # Re-sort by filename (basename) so LINK and UNLINK interleave in timestamp order.
-all_events.sort(key=lambda x: x[1].name)
+# Sort key: (timestamp, event_type_order, full_name)
+# - timestamp (first filename segment) preserves chronological order
+# - event_type_order (LINK=0, UNLINK=1) guarantees LINK processes before UNLINK
+#   when two events share the same second-level timestamp (different random UUIDs)
+# - full name as final tiebreaker for stable ordering within same type+timestamp
+_event_order = {'LINK': 0, 'UNLINK': 1}
+all_events.sort(key=lambda x: (x[1].name.split('-')[0], _event_order.get(x[0], 99), x[1].name))
 
 # Replay events to build net-active link set: maps uuid -> (target_id, relation)
 active_links: dict[str, tuple[str, str]] = {}
@@ -207,7 +213,13 @@ for f in sorted(p.glob('*-UNLINK.json')):
     all_events.append(('UNLINK', f))
 
 # Re-sort by filename (basename) so LINK and UNLINK interleave in timestamp order.
-all_events.sort(key=lambda x: x[1].name)
+# Sort key: (timestamp, event_type_order, full_name)
+# - timestamp (first filename segment) preserves chronological order
+# - event_type_order (LINK=0, UNLINK=1) guarantees LINK processes before UNLINK
+#   when two events share the same second-level timestamp (different random UUIDs)
+# - full name as final tiebreaker for stable ordering within same type+timestamp
+_event_order = {'LINK': 0, 'UNLINK': 1}
+all_events.sort(key=lambda x: (x[1].name.split('-')[0], _event_order.get(x[0], 99), x[1].name))
 
 # Replay events to build net-active link set: maps uuid -> (target_id, relation)
 active_links: dict[str, tuple[str, str]] = {}
diff --git a/plugins/dso/scripts/tk b/plugins/dso/scripts/tk
@@ -313,13 +313,19 @@ except Exception:
     else:
         inner = raw_deps.strip().lstrip('[').rstrip(']')
         deps = [s.strip().strip('\"').strip(chr(39)) for s in inner.split(',') if s.strip()]
-idx[os.environ['TICKET_ID']] = {
+tid = os.environ['TICKET_ID']
+# Preserve existing parent field if present (parent is not passed as an argument)
+existing_parent = idx.get(tid, {}).get('parent', '')
+entry = {
     'title':    os.environ['TICKET_TITLE'],
     'status':   os.environ['TICKET_STATUS'],
     'type':     os.environ['TICKET_TYPE'],
     'priority': priority,
     'deps':     deps,
 }
+if existing_parent:
+    entry['parent'] = existing_parent
+idx[tid] = entry
 print(json.dumps(idx, indent=2, sort_keys=True))
 " > "$tmp_file" 2>/dev/null && mv "$tmp_file" "$index_file" || true
 }
@@ -399,7 +405,12 @@ for fname in files:
             title = line[2:].strip()
             break
 
-    idx[ticket_id] = {'title': title, 'status': status, 'type': type_, 'priority': priority, 'deps': deps}
+    parent = get_field('parent')
+
+    entry = {'title': title, 'status': status, 'type': type_, 'priority': priority, 'deps': deps}
+    if parent:
+        entry['parent'] = parent
+    idx[ticket_id] = entry
 
 print(json.dumps(idx))
 " 2>/dev/null || echo "{}"
diff --git a/plugins/dso/skills/preplanning/SKILL.md b/plugins/dso/skills/preplanning/SKILL.md
@@ -718,6 +718,15 @@ up to date and report completion.
 
 ## Guardrails
 
+### Epic Deps Must Not Contain Children (Critical)
+
+**Never run `tk dep <epic-id> <story-id>`** — this adds the story as a dependency of the epic, causing the epic to self-block in `sprint-list-epics.sh` (bug w21-3w8y).
+
+- `tk dep <story-id> <blocking-story-id>` — correct: story depends on another story
+- `tk dep <epic-id> <child-story-id>` — **WRONG**: child added as epic blocker
+
+Epic children are linked via `--parent=<epic-id>` at creation time. That parent field is how the epic knows what work to do. Adding a child as a dep means the epic will show as BLOCKED until the child is closed — which is backwards. Only add external dependencies (tickets from other epics/projects) to an epic's deps.
+
 ### No "How"
 Focus on requirements, constraints, and outcomes. Avoid dictating specific implementation code or library choices unless mandated by the Architecture Board.
 
diff --git a/tests/hooks/test-record-test-status.sh b/tests/hooks/test-record-test-status.sh
@@ -867,6 +867,103 @@ fi
 rm -rf "$TEST_REPO_IDX4" "$ARTIFACTS_IDX4"
 trap - EXIT
 
+# ============================================================
+# test_restamping_with_changed_hash_rejected
+# When record-test-status.sh is called a second time after
+# code changes (hash A → hash B), it should NOT silently
+# re-stamp hash B as 'passed' based on a test run that
+# validated hash-A code. The script must detect the stale
+# status (existing 'passed' for a different hash) and fail
+# with an error directing the caller to re-run tests.
+#
+# Reproduction (dso-6x8o):
+#   1. Stage files, run record-test-status.sh (records hash A)
+#   2. Edit a staged file (hash changes to B)
+#   3. Stage the edit, run record-test-status.sh again
+#   Expected: error / non-zero exit — stale status detected
+#   Actual:   exits 0 and writes hash B as 'passed' silently
+# ============================================================
+echo ""
+echo "=== test_restamping_with_changed_hash_rejected ==="
+
+TEST_REPO_RESTAMP=$(create_test_repo)
+ARTIFACTS_RESTAMP=$(mktemp -d "${TMPDIR:-/tmp}/test-rts-artifacts-XXXXXX")
+trap 'rm -rf "$TEST_REPO_RESTAMP" "$ARTIFACTS_RESTAMP"' EXIT
+
+# Create a source file and its associated test
+mkdir -p "$TEST_REPO_RESTAMP/src" "$TEST_REPO_RESTAMP/tests"
+cat > "$TEST_REPO_RESTAMP/src/restamp.py" << 'PYEOF2'
+def restamp():
+    return "v1"
+PYEOF2
+cat > "$TEST_REPO_RESTAMP/tests/test_restamp.py" << 'PYEOF2'
+def test_restamp():
+    assert True
+PYEOF2
+git -C "$TEST_REPO_RESTAMP" add -A
+git -C "$TEST_REPO_RESTAMP" commit -m "add restamp" --quiet 2>/dev/null
+
+# Step 1: Modify source, stage it, run record-test-status.sh (records hash A)
+echo "# change v1" >> "$TEST_REPO_RESTAMP/src/restamp.py"
+git -C "$TEST_REPO_RESTAMP" add -A
+
+MOCK_PASS_RESTAMP=$(mktemp "${TMPDIR:-/tmp}/mock-pass-restamp-XXXXXX")
+chmod +x "$MOCK_PASS_RESTAMP"
+cat > "$MOCK_PASS_RESTAMP" << 'MOCKEOF'
+#!/usr/bin/env bash
+echo "PASSED (mock)"
+exit 0
+MOCKEOF
+
+EXIT_CODE_FIRST=$(
+    cd "$TEST_REPO_RESTAMP"
+    WORKFLOW_PLUGIN_ARTIFACTS_DIR="$ARTIFACTS_RESTAMP" \
+    CLAUDE_PLUGIN_ROOT="$DSO_PLUGIN_DIR" \
+    RECORD_TEST_STATUS_RUNNER="$MOCK_PASS_RESTAMP" \
+    run_hook_exit
+)
+
+assert_eq "test_restamping_with_changed_hash_rejected: first invocation exits 0" "0" "$EXIT_CODE_FIRST"
+
+STATUS_FILE_RESTAMP="$ARTIFACTS_RESTAMP/test-gate-status"
+if [[ ! -f "$STATUS_FILE_RESTAMP" ]]; then
+    echo "SKIP: test_restamping_with_changed_hash_rejected: no status file after first run (test infra issue)" >&2
+else
+    HASH_A=$(grep '^diff_hash=' "$STATUS_FILE_RESTAMP" | head -1 | cut -d= -f2)
+
+    # Step 2: Make a new code change and stage it (hash changes to B)
+    echo "# change v2 - post-review fix" >> "$TEST_REPO_RESTAMP/src/restamp.py"
+    git -C "$TEST_REPO_RESTAMP" add -A
+
+    # Verify hash actually changed
+    HASH_B=$(cd "$TEST_REPO_RESTAMP" && bash "$COMPUTE_HASH_SCRIPT" 2>/dev/null)
+
+    if [[ "$HASH_A" == "$HASH_B" ]]; then
+        echo "SKIP: test_restamping_with_changed_hash_rejected: hashes did not change (test setup issue)" >&2
+    else
+        # Step 3: Call record-test-status.sh again -- it should clear the stale
+        # status and re-run tests, recording hash B as passed.
+        EXIT_CODE_SECOND=$(
+            cd "$TEST_REPO_RESTAMP"
+            WORKFLOW_PLUGIN_ARTIFACTS_DIR="$ARTIFACTS_RESTAMP" \
+            CLAUDE_PLUGIN_ROOT="$DSO_PLUGIN_DIR" \
+            RECORD_TEST_STATUS_RUNNER="$MOCK_PASS_RESTAMP" \
+            run_hook_exit
+        )
+
+        # EXPECTED: exit 0 (stale status cleared, tests re-run and passed)
+        assert_eq "test_restamping_with_changed_hash_rejected: second call re-runs tests and exits 0" "0" "$EXIT_CODE_SECOND"
+
+        # Status file should now have hash B (tests re-ran against new code)
+        RECORDED_HASH_AFTER=$(grep '^diff_hash=' "$STATUS_FILE_RESTAMP" | head -1 | cut -d= -f2)
+        assert_eq "test_restamping_with_changed_hash_rejected: status file updated to hash B after re-test" "$HASH_B" "$RECORDED_HASH_AFTER"
+    fi
+fi
+
+rm -f "$MOCK_PASS_RESTAMP"
+rm -rf "$TEST_REPO_RESTAMP" "$ARTIFACTS_RESTAMP"
+trap - EXIT
+
 # Clean up mock runners if created
 if (( ! _PYTEST_AVAILABLE )); then
     rm -f "$_MOCK_PASS_RUNNER" "$_MOCK_FAIL_RUNNER" 2>/dev/null || true
diff --git a/tests/scripts/test-sprint-list-epics.sh b/tests/scripts/test-sprint-list-epics.sh
diff --git a/tests/scripts/test-test-batched.sh b/tests/scripts/test-test-batched.sh
diff --git a/tests/scripts/test-ticket-link.sh b/tests/scripts/test-ticket-link.sh
