feat: use word boundary matching for negated assertions

Negated assertions (e.g. "Not FAIL") now use \b word boundary regex
instead of substring matching. This prevents false positives where
"0 failed" would incorrectly trigger "Not FAIL". Positive assertions
remain substring-based. Also add dev-skillshare Makefile target and
narrow .gitignore docs/ exclusion.

Author: runkids

.gitignore

@@ -20,4 +20,4 @@ coverage.out
 .claude
 .feature-radar
 .mdproof/
-docs/
+docs/superpowers/

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help build run test test-unit test-docker lint fmt fmt-check check devc devc-up devc-down devc-restart devc-reset devc-status install clean
+.PHONY: help build run test test-unit test-docker lint fmt fmt-check check devc devc-up devc-down devc-restart devc-reset devc-status install dev-skillshare clean
 
 help:
 	@echo "Common tasks:"
@@ -17,6 +17,7 @@ help:
 	@echo "  make devc-reset     # full reset (remove volumes)"
 	@echo "  make devc-status    # show devcontainer status"
 	@echo "  make clean          # remove build artifacts"
+	@echo "  make dev-skillshare # cross-compile Linux binary to ../skillshare/bin/"
 
 build:
 	mkdir -p bin && go build -o bin/mdproof ./cmd/mdproof
@@ -66,5 +67,10 @@ devc-status:
 install:
 	go install ./cmd/mdproof
 
+dev-skillshare:
+	@mkdir -p ../skillshare/bin
+	GOOS=linux GOARCH=$$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/') CGO_ENABLED=0 go build -o ../skillshare/bin/mdproof ./cmd/mdproof
+	@echo "Installed Linux binary → ../skillshare/bin/mdproof"
+
 clean:
 	rm -rf bin coverage.out

internal/assertion/assertion.go

@@ -84,6 +84,8 @@ func dispatchAssertion(pat, combined, combinedLower, stdout string, exitCode int
 }
 
 // checkSubstring performs case-insensitive substring matching with negation.
+// Negated assertions use word boundary matching (\b) to avoid false positives
+// (e.g. "Not FAIL" should not trigger on "0 failed").
 func checkSubstring(pat, combinedLower string) core.AssertionResult {
 	r := core.AssertionResult{Pattern: pat, Type: core.AssertSubstring}
 
@@ -97,21 +99,32 @@ func checkSubstring(pat, combinedLower string) core.AssertionResult {
 	}
 
 	needle := strings.ToLower(inner)
-	found := strings.Contains(combinedLower, needle)
 	if r.Negated {
+		// Use word boundary matching for negated assertions.
+		found := negatedContains(combinedLower, needle)
 		r.Matched = !found
 		if !r.Matched {
-			// Show the line that triggered the match to help debug false positives.
 			r.Detail = fmt.Sprintf("negated pattern %q was found in: %s",
 				inner, findMatchLine(combinedLower, needle))
 		}
 	} else {
-		r.Matched = found
+		r.Matched = strings.Contains(combinedLower, needle)
 	}
 
 	return r
 }
 
+// negatedContains checks if inner appears as a whole word (word boundary match)
+// in text, case-insensitively. Falls back to substring if regex compilation fails.
+func negatedContains(text, inner string) bool {
+	pattern := `(?i)\b` + regexp.QuoteMeta(inner) + `\b`
+	re, err := regexp.Compile(pattern)
+	if err != nil {
+		return strings.Contains(strings.ToLower(text), strings.ToLower(inner))
+	}
+	return re.MatchString(text)
+}
+
 // findMatchLine returns the trimmed line containing the first occurrence of needle.
 func findMatchLine(text, needle string) string {
 	idx := strings.Index(text, needle)

internal/assertion/assertion_test.go

@@ -37,15 +37,30 @@ func TestMatchAssertions_NegatedFails(t *testing.T) {
 	}
 }
 
-func TestMatchAssertions_NegatedFails_FalsePositive(t *testing.T) {
-	// "Not FAIL" should trigger on "0 failed" (substring match).
-	// The Detail should help users see WHY it triggered.
+func TestMatchAssertions_NegatedWordBoundary(t *testing.T) {
+	// "Not FAIL" should NOT trigger on "0 failed" — word boundary prevents it.
 	results := MatchAssertions("Uninstall complete: 2 removed, 0 failed (0.0s)", []string{"Not FAIL"})
+	if !results[0].Matched {
+		t.Fatal("Not FAIL should pass because 'failed' is not the word 'FAIL'")
+	}
+}
+
+func TestMatchAssertions_NegatedWordBoundary_StillCatches(t *testing.T) {
+	// "Not FAIL" SHOULD trigger on "FAIL: something" — exact word match.
+	results := MatchAssertions("FAIL: config has skills", []string{"Not FAIL"})
 	if results[0].Matched {
-		t.Fatal("Not FAIL should fail because 'failed' contains 'fail'")
+		t.Fatal("Not FAIL should fail because 'FAIL' appears as a word")
 	}
-	if !strings.Contains(results[0].Detail, "0 failed") {
-		t.Fatalf("detail should show the triggering line, got: %s", results[0].Detail)
+	if results[0].Detail == "" {
+		t.Fatal("should include detail on failure")
+	}
+}
+
+func TestMatchAssertions_NegatedWordBoundary_Standalone(t *testing.T) {
+	// "Not FAIL" triggers on standalone "FAIL" at end of line.
+	results := MatchAssertions("test result: FAIL", []string{"Not FAIL"})
+	if results[0].Matched {
+		t.Fatal("Not FAIL should fail on standalone FAIL")
 	}
 }