test: remediate tautological instruction-file tests + standing proof-policy sweep

internal/hostneutrality/code_source_test.go

@@ -0,0 +1,103 @@
+// ABOUTME: Code-derived sources the hostneutrality re-binds bind to — host env-var
+// ABOUTME: names and dispatch subcommands AST-extracted from the binary, so a check's expectation has an independent source.
+package hostneutrality
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"path/filepath"
+	"testing"
+)
+
+// repoRoot is the project root (two levels up from this package's source dir).
+func repoRoot() string {
+	return filepath.Join("..", "..")
+}
+
+// hostEnvVar AST-extracts the host-derivation env-var name the binary reads from
+// internal/dispatch/build.go (the `getenv("CODEX_THREAD_ID")` / "CLAUDECODE"
+// selectors). It returns the name if the binary reads it, else "". This is the
+// independent source for "the skill branches on the same env var the binary reads":
+// if the binary stops reading the var, or the skill stops branching on it, the two
+// diverge and a check binding to this reds.
+func hostEnvVar(t *testing.T, name string) string {
+	t.Helper()
+	src := filepath.Join(repoRoot(), "internal", "dispatch", "build.go")
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, src, nil, 0)
+	if err != nil {
+		t.Fatalf("parse build.go: %v", err)
+	}
+	found := ""
+	ast.Inspect(f, func(n ast.Node) bool {
+		lit, ok := n.(*ast.BasicLit)
+		if !ok || lit.Kind != token.STRING {
+			return true
+		}
+		if trimLit(lit.Value) == name {
+			found = name
+			return false
+		}
+		return true
+	})
+	return found
+}
+
+// dispatchSubcommands AST-extracts the dispatch subcommand names the binary routes
+// from internal/dispatch/dispatch.go's Run switch — the independent source for the
+// claude-helper / relocated-command checks (so a renamed subcommand shifts the set
+// rather than the test self-matching a frozen literal).
+func dispatchSubcommands(t *testing.T) map[string]bool {
+	t.Helper()
+	src := filepath.Join(repoRoot(), "internal", "dispatch", "dispatch.go")
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, src, nil, 0)
+	if err != nil {
+		t.Fatalf("parse dispatch.go: %v", err)
+	}
+	subs := map[string]bool{}
+	ast.Inspect(f, func(n ast.Node) bool {
+		fn, ok := n.(*ast.FuncDecl)
+		if !ok || fn.Name.Name != "Run" {
+			return true
+		}
+		ast.Inspect(fn, func(m ast.Node) bool {
+			sw, ok := m.(*ast.SwitchStmt)
+			if !ok {
+				return true
+			}
+			tag, ok := sw.Tag.(*ast.IndexExpr)
+			if !ok {
+				return true
+			}
+			if id, ok := tag.X.(*ast.Ident); !ok || id.Name != "args" {
+				return true
+			}
+			for _, stmt := range sw.Body.List {
+				cc, ok := stmt.(*ast.CaseClause)
+				if !ok {
+					continue
+				}
+				for _, e := range cc.List {
+					if lit, ok := e.(*ast.BasicLit); ok && lit.Kind == token.STRING {
+						subs[trimLit(lit.Value)] = true
+					}
+				}
+			}
+			return false
+		})
+		return false
+	})
+	if len(subs) == 0 {
+		t.Fatal("extracted zero dispatch subcommands from dispatch.go")
+	}
+	return subs
+}
+
+func trimLit(s string) string {
+	if len(s) >= 2 && (s[0] == '"' || s[0] == '`') {
+		return s[1 : len(s)-1]
+	}
+	return s
+}

internal/hostneutrality/codex_runtime_contract_test.go

@@ -9,7 +9,20 @@ import (
 	"testing"
 )
 
+// TestCodexRuntimeAdaptersAreLoadable is a code-bound invariant: each runtime
+// SKILL.md branches on the SAME host env var the binary reads
+// (CODEX_THREAD_ID, AST-extracted from internal/dispatch/build.go) and loads its
+// Codex adapter file. The env-var expectation comes from the binary's
+// host-derivation code, not a literal frozen against the skill — if the binary
+// stops reading CODEX_THREAD_ID, or the skill stops branching on it, the two
+// diverge and this reds. The adapter-content tokens are the remaining
+// text-consistency portion.
 func TestCodexRuntimeAdaptersAreLoadable(t *testing.T) {
+	markCodeBoundInvariant(t, "hostEnvVar CODEX_THREAD_ID (internal/dispatch/build.go host-derivation)")
+	envVar := hostEnvVar(t, "CODEX_THREAD_ID")
+	if envVar == "" {
+		t.Fatal("the binary no longer reads CODEX_THREAD_ID for host derivation — the env var the skill must branch on is gone")
+	}
 	root := filepath.Join("..", "..")
 	cases := []struct {
 		name      string
@@ -32,8 +45,8 @@ func TestCodexRuntimeAdaptersAreLoadable(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			skill := readText(t, tc.skillPath)
 			adapterBase := filepath.Base(tc.adapter)
-			if !strings.Contains(skill, "CODEX_THREAD_ID") || !strings.Contains(skill, adapterBase) {
-				t.Fatalf("%s SKILL.md must branch on CODEX_THREAD_ID and load %s:\n%s", tc.name, adapterBase, skill)
+			if !strings.Contains(skill, envVar) || !strings.Contains(skill, adapterBase) {
+				t.Fatalf("%s SKILL.md must branch on %s (the binary's host-derivation env var) and load %s:\n%s", tc.name, envVar, adapterBase, skill)
 			}
 
 			body := readText(t, tc.adapter)
@@ -46,7 +59,15 @@ func TestCodexRuntimeAdaptersAreLoadable(t *testing.T) {
 	}
 }
 
+// TestCodexAwaitingCompletionPinsMailboxSemantics is a non-AC text-consistency
+// lint: the Codex FO adapter carries the mailbox-wait clauses (async final-status
+// notification, wait_agent-timeout-is-normal, do-not-poll). Per the proof policy
+// this presence check does NOT prove the FO obeys the mailbox semantics; the
+// behavior is exercised by the Codex live runner's awaiting-completion path
+// (codex_live_runner_test.go / codex_idle_notification_test.go). This lint guards
+// the clauses being dropped from the adapter.
 func TestCodexAwaitingCompletionPinsMailboxSemantics(t *testing.T) {
+	markNonAC(t, "Codex live runner awaiting-completion path (internal/ensigncycle codex_live_runner + codex_idle_notification)")
 	body := readText(t, filepath.Join("..", "..", "skills", "first-officer", "references", "codex-first-officer-runtime.md"))
 	for _, want := range []string{
 		"async final-status notification in the FO mailbox",

internal/hostneutrality/ensign_dev_leakage_locks_test.go

@@ -40,6 +40,7 @@ var devLeakageCorePaths = []string{
 // code substrate in the worktree-isolation clause. A re-introduction of the
 // banned literal fails the test (negative proof of lock-in).
 func TestNoDevLeakageInUniversalCore(t *testing.T) {
+	markNonAC(t, "text-hygiene lint, NOT a behavioral claim — a property of the text (the universal core stays free of dev-discipline prose). No behavioral oracle: there is nothing for the FO/ensign to DO; the value is catching accidental dev-leakage back into the universal contract.")
 	for _, path := range devLeakageCorePaths {
 		t.Run(filepath.Base(path), func(t *testing.T) {
 			body, err := os.ReadFile(path)
@@ -71,6 +72,7 @@ func TestNoDevLeakageInUniversalCore(t *testing.T) {
 // "CODE only" noun must NOT delete the worktree-isolation boundary — both cores
 // must still carry an isolation clause naming the worktree.
 func TestWorktreeIsolationClauseSurvives(t *testing.T) {
+	markNonAC(t, "text-hygiene lint, NOT a behavioral claim — a property of the text (an isolation clause survives in the cores). No behavioral oracle: the worktree-isolation BEHAVIOR is enforced by the dispatch worktree machinery, not this clause; the lint only guards the clause from being deleted when the substrate noun is neutralized.")
 	for _, path := range devLeakageCorePaths {
 		t.Run(filepath.Base(path), func(t *testing.T) {
 			body, err := os.ReadFile(path)
@@ -107,6 +109,7 @@ var runtimeAdapterFieldPaths = []string{
 // "worktree path". Scoped to the field-enumeration sentence — a file-wide ban
 // would false-fail on the legitimate conditional usage elsewhere.
 func TestRuntimeAdaptersUseNeutralLocationVocabulary(t *testing.T) {
+	markNonAC(t, "text-hygiene lint, NOT a behavioral claim — a property of the text (the field-enumeration sentence uses neutral location vocabulary). No behavioral oracle and no independent code source: the vocabulary choice is prose hygiene; the lint guards against the banned 'worktree path' wording creeping back.")
 	for _, path := range runtimeAdapterFieldPaths {
 		t.Run(filepath.Base(path), func(t *testing.T) {
 			body, err := os.ReadFile(path)
@@ -157,6 +160,7 @@ var devHomePresence = []struct {
 // checkable change" deliverable-proof policy. Fails if a future edit strips a
 // dev home's guidance.
 func TestDevDisciplinesSurviveInDevHomes(t *testing.T) {
+	markNonAC(t, "text-hygiene lint, NOT a behavioral claim — a property of the text (the re-homed dev guidance survives in its dev home). No behavioral oracle and no independent code source: it is a relocate-not-delete prose consistency check, valued for catching a dev home's guidance being stripped.")
 	for _, h := range devHomePresence {
 		t.Run(filepath.Base(h.path), func(t *testing.T) {
 			body, err := os.ReadFile(h.path)

internal/hostneutrality/live_scenario_practice_test.go

@@ -26,6 +26,7 @@ var recommendedPracticesSectionRe = regexp.MustCompile(`(?is)## Recommended prac
 // of presence check that guards the existing recommended-practice blocks; the
 // claim is about the text itself, so proof at the claim's own level is legit.
 func TestLiveScenarioRecommendedPracticePresent(t *testing.T) {
+	markNonAC(t, "n/a — the claim is about the dev-template text itself (the live-scenario practice is documented); proof at the claim's own level")
 	path := filepath.Join("..", "..", "skills", "commission", "references", "templates", "development.md")
 	body, err := os.ReadFile(path)
 	if err != nil {