chore: auto-commit ticket changes before merge (merge worktree-20260320-130729)

Author: JoeOakhartNava

.tickets/.index.json

@@ -59,6 +59,13 @@
     "title": "Recurring tool error: command_exit_nonzero (56 occurrences)",
     "type": "bug"
   },
+  "dso-2e99": {
+    "deps": [],
+    "priority": 2,
+    "status": "closed",
+    "title": "fix: ci-status.sh crashes with CFG_PYTHON_VENV unbound variable when config-paths.sh is absent",
+    "type": "bug"
+  },
   "dso-2xqd": {
     "deps": [],
     "priority": 2,
@@ -334,7 +341,7 @@
   "dso-lli8": {
     "deps": [],
     "priority": 2,
-    "status": "open",
+    "status": "closed",
     "title": "Bug: tk sync windowed pull uses UTC but Jira reads JQL datetimes as user-local timezone",
     "type": "bug"
   },
@@ -369,7 +376,7 @@
   "dso-or3g": {
     "deps": [],
     "priority": 2,
-    "status": "open",
+    "status": "closed",
     "title": "Bug: collect-discoveries.sh crashes with get_artifacts_dir not found when CLAUDE_PLUGIN_ROOT is wrong",
     "type": "bug"
   },
@@ -407,7 +414,7 @@
   "dso-qlgq": {
     "deps": [],
     "priority": 2,
-    "status": "open",
+    "status": "closed",
     "title": "validate-phase.sh runs tests directly without test-batched.sh \u2014 same timeout anti-pattern as w21-ae0s",
     "type": "bug"
   },
@@ -1022,7 +1029,7 @@
   "w21-ouns": {
     "deps": [],
     "priority": 2,
-    "status": "open",
+    "status": "closed",
     "title": "fix: test-isolation rule no-script-dir-write misses variable aliases like FIXTURES_DIR derived from SCRIPT_DIR",
     "type": "bug"
   },

.tickets/.sync-state.json

@@ -449,8 +449,8 @@
     "last_synced": "2026-03-19T18:38:35Z",
     "local_hash": "14c516947a151a3db8bdec4010e2fd6e"
   },
-  "last_pull_timestamp": "2026-03-21T00:46:12Z",
-  "last_sync_commit": "14ba17eafcaaf4b0a87c49dbbafad037f24be5fe",
+  "last_pull_timestamp": "2026-03-21T01:19:00Z",
+  "last_sync_commit": "0f08614b43de2ae17e7a1338dcfb3232ea9cec86",
   "w21-5cqr": {
     "jira_hash": "bce29d76f01c58613ee99cb1dd03920d",
     "jira_key": "DIG-61",

.tickets/dso-2e99.md

@@ -1,6 +1,6 @@
 ---
 id: dso-2e99
-status: open
+status: closed
 deps: []
 links: []
 created: 2026-03-21T00:31:14Z
@@ -19,3 +19,17 @@ assignee: Joe Oakhart
 <!-- sync: unsynced -->
 
 Same anti-pattern as dso-tqvy (fixed in worktree-sync-from-main.sh). ci-status.sh line 212 uses $CFG_PYTHON_VENV inside ${repo_root:+$repo_root/$CFG_PYTHON_VENV} inside _find_python_with_yaml(). If config-paths.sh is not found (e.g., CLAUDE_PLUGIN_ROOT without hooks/lib/config-paths.sh), the variable is unbound. When repo_root is non-empty, the ${repo_root:+...} expansion evaluates the inner $CFG_PYTHON_VENV, triggering 'unbound variable' crash. Fix: use ${CFG_PYTHON_VENV:-app/.venv/bin/python3} at line 212.
+
+<!-- note-id: lah9wfxd -->
+<!-- timestamp: 2026-03-21T01:05:14Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+Fixed at plugins/dso/scripts/ci-status.sh line 212: changed `${repo_root:+$repo_root/$CFG_PYTHON_VENV}` to `${repo_root:+$repo_root/${CFG_PYTHON_VENV:-app/.venv/bin/python3}}`. RED confirmed: bash -u crash reproduced before fix. GREEN confirmed: function returns python3 without error after fix. All 8 existing ci-status tests pass.
+
+<!-- note-id: 87jmeqai -->
+<!-- timestamp: 2026-03-21T01:36:45Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+CLOSE REASON: Fixed: CFG_PYTHON_VENV default in ci-status.sh (commit 0f08614)

.tickets/dso-lli8.md

@@ -1,6 +1,6 @@
 ---
 id: dso-lli8
-status: open
+status: closed
 deps: []
 links: []
 created: 2026-03-19T18:19:56Z
@@ -21,3 +21,19 @@ Fix: convert UTC timestamp to local timezone before formatting for JQL in the Py
 one-liner at plugins/dso/scripts/tk lines 4252-4283.
 
 Workaround: tk sync --full bypasses the windowed pull.
+
+## Notes
+
+<!-- note-id: f6i9h8lv -->
+<!-- timestamp: 2026-03-21T01:05:05Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+Classification: behavioral, Score: 2 (BASIC). Root cause confirmed: line 4353 in plugins/dso/scripts/tk — datetime.fromisoformat() parses UTC timestamp but strftime('%Y-%m-%d %H:%M') strips timezone and emits a naive string. Jira interprets it as user-local time, causing the window to be off by the TZ offset. Fix: convert UTC timestamp to local time (astimezone()) before formatting.
+
+<!-- note-id: diufvexm -->
+<!-- timestamp: 2026-03-21T01:36:46Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+CLOSE REASON: Fixed: tk sync .astimezone() for Jira JQL (commit 0f08614)

.tickets/dso-or3g.md

@@ -1,6 +1,6 @@
 ---
 id: dso-or3g
-status: open
+status: closed
 deps: []
 links: []
 created: 2026-03-20T23:49:34Z
@@ -10,3 +10,12 @@ assignee: Joe Oakhart
 ---
 # Bug: collect-discoveries.sh crashes with get_artifacts_dir not found when CLAUDE_PLUGIN_ROOT is wrong
 
+
+## Notes
+
+<!-- note-id: gi8nzfol -->
+<!-- timestamp: 2026-03-21T01:36:45Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+CLOSE REASON: Fixed: plugin.json sentinel in collect-discoveries.sh (commit 0f08614)

.tickets/dso-qlgq.md

@@ -1,6 +1,6 @@
 ---
 id: dso-qlgq
-status: open
+status: closed
 deps: []
 links: []
 created: 2026-03-20T22:51:51Z
@@ -22,3 +22,26 @@ Integrate test-batched.sh into validate-phase.sh for the test step, similar to h
 ## Related
 Discovered while fixing w21-ae0s (validate.sh timeout anti-pattern).
 
+
+## Notes
+
+<!-- note-id: 4uqdd7fy -->
+<!-- timestamp: 2026-03-21T01:05:06Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+Classification: behavioral, Score: 2 (BASIC). Root cause: phase_auto_fix, phase_post_batch, and phase_tier_transition all run CMD_TEST_UNIT via raw eval, bypassing test-batched.sh. Fix: extract a run_test_batched() helper in validate-phase.sh that mirrors validate.sh's run_test_check() pattern — calls test-batched.sh when available, falls back to direct eval. Use VALIDATE_TEST_STATE_FILE / VALIDATE_TEST_BATCHED_SCRIPT env vars for overridability in tests.
+
+<!-- note-id: puampc20 -->
+<!-- timestamp: 2026-03-21T01:15:52Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+CLOSE REASON: Fixed: validate-phase.sh now uses test-batched.sh via run_test_batched() helper in all three phase functions (phase_auto_fix, phase_post_batch, phase_tier_transition); falls back to direct eval when script is absent; PENDING exit code (2) propagated on NEXT: output. Tests: 21/21 pass. Committed in 0f08614.
+
+<!-- note-id: 67yv85d6 -->
+<!-- timestamp: 2026-03-21T01:36:45Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+CLOSE REASON: Fixed: validate-phase.sh test-batched integration (commit 0f08614)

.tickets/w21-ouns.md

@@ -1,6 +1,6 @@
 ---
 id: w21-ouns
-status: open
+status: closed
 deps: []
 links: []
 created: 2026-03-19T18:11:59Z
@@ -17,3 +17,10 @@ parent: dso-9xnr
 **2026-03-19T18:12:11Z**
 
 The no-script-dir-write isolation rule only checks for literal $SCRIPT_DIR/ in write commands. It misses indirect writes through derived variables like FIXTURES_DIR="$SCRIPT_DIR/fixtures/...". Also, $REPO_ROOT writes are explicitly excluded ('too many legitimate reads') but test-record-review-crossval.sh writes sentinel files to REPO_ROOT. Two fixes needed: (1) trace variable assignments that derive from SCRIPT_DIR and flag writes through those aliases, (2) consider a narrower REPO_ROOT write rule that catches touch/mkdir/redirect to REPO_ROOT but not reads.
+
+<!-- note-id: uo4wsqnz -->
+<!-- timestamp: 2026-03-21T01:36:46Z -->
+<!-- origin: agent -->
+<!-- sync: unsynced -->
+
+CLOSE REASON: Fixed: isolation rule alias detection + tests (commit c25c396)

plugins/dso/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dso",
-  "version": "0.12.3",
+  "version": "0.12.7",
   "description": "Workflow infrastructure plugin for Claude Code projects",
   "commands": "./commands/",
   "skills": "./skills/",

plugins/dso/scripts/ci-status.sh

@@ -209,7 +209,7 @@ _find_python_with_yaml() {
     local candidate
     for candidate in \
         "${CLAUDE_PLUGIN_PYTHON:-}" \
-        "${repo_root:+$repo_root/$CFG_PYTHON_VENV}" \
+        "${repo_root:+$repo_root/${CFG_PYTHON_VENV:-app/.venv/bin/python3}}" \
         "${repo_root:+$repo_root/.venv/bin/python3}" \
         "python3"; do
         [[ -z "$candidate" ]] && continue

plugins/dso/scripts/collect-discoveries.sh

@@ -38,8 +38,14 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(git rev-parse --show-toplevel)"
 
 # Source deps.sh for get_artifacts_dir
+# Defensive plugin-root resolution: CLAUDE_PLUGIN_ROOT may point to the main repo
+# root instead of the plugin subdirectory (e.g., plugins/dso) when called from a
+# host project via the dso shim. Validate using plugin.json (always present in the
+# plugin dir) and fall back to $SCRIPT_DIR/.. (the plugin dir relative to this script).
 # shellcheck source=hooks/lib/deps.sh
-source "${CLAUDE_PLUGIN_ROOT:-$SCRIPT_DIR/..}/hooks/lib/deps.sh"
+_PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-$SCRIPT_DIR/..}"
+[[ ! -f "${_PLUGIN_ROOT}/plugin.json" ]] && _PLUGIN_ROOT="$SCRIPT_DIR/.."
+source "${_PLUGIN_ROOT}/hooks/lib/deps.sh"
 
 # Resolve discoveries directory
 DISCOVERIES_DIR="${AGENT_DISCOVERIES_DIR:-$(get_artifacts_dir)/agent-discoveries}"