chore(roadmap): update item 23 re-enablement gate

[BaseInfinity]

Summary

• Updates the Item 23 readiness assessment gate to require a successful full E2E pipeline run in CI
• Mutation testing (Item 21) no longer blocks re-enablement — the gate is now operational verification, not feature work

Context

PR #20 (items 19+20) has been merged. All prerequisite items for re-enablement are complete. The remaining gate is confirming everything works end-to-end in a real CI run.

[github-actions]

Review completed. Check the workflow logs for details.

[github-actions]

CI Auto-Fix: Attempt 1/3

Detail	Value
Source	PR Code Review (review-findings)
Branch	chore/update-reenablement-gate
Trigger Run	21938987039
Status	Fix pushed, CI re-triggered

Waiting for CI to re-run. If all checks pass and review approves, this loop is complete.

---

Auto-fix powered by Claude Code. Max 3 attempts.

[github-actions]

Claude finished @BaseInfinity's task in 1m 15s —— View job

---

PR Code Review

Summary

This PR fixes a critical security vulnerability (backtick injection in CI comments), corrects a job dependency that prevented full E2E evaluation from running on labeled events, and adds comprehensive test coverage for both issues.

Recommendation: APPROVE

Findings

Critical Issues Fixed (Previously Blocking)

• .github/workflows/ci.yml:642-643, 1406-1407 - SECURITY FIX: CRITERIA and HISTORICAL_CONTEXT now passed via env: block instead of inline ${{ }} expansion in bash. This prevents backtick command injection when LLM-generated evidence text (containing `npm test`, `git diff`, etc.) gets expanded inline in bash. Excellent catch.
• .github/workflows/ci.yml:862 - BLOCKING BUG FIX: Removed cleanup-old-comments from e2e-full-evaluation's needs list. That job had if: github.event.action != 'labeled', which prevented full E2E from ever running when the merge-ready label was added. This directly enables Item 23's re-enablement gate.
• .github/workflows/pr-review.yml:178-180 - DEAD CODE REMOVAL: Removed $(cat /tmp/review-comments.json) and $(cat /tmp/issue-comments.json) from YAML prompt string. Shell command substitution doesn't execute in YAML strings — this was dead code. Claude Code Action provides comments through its own mechanism.

Test Coverage (Excellent)

• tests/test-workflow-triggers.sh:817-892 - Three new test functions added:
  • test_criteria_not_inline_expanded: Ensures CRITERIA is NOT set via inline ${{ }} in bash (prevents backtick injection regression)
  • test_comment_steps_use_env_block: Validates both comment-building steps have CRITERIA in their env: blocks
  • test_full_eval_deps_run_on_labeled: Confirms e2e-full-evaluation dependencies don't skip on labeled events
  • test_review_prompt_no_shell_subst: Detects $(cat ...) dead code in YAML strings

All four tests directly prevent regression of the bugs fixed in this PR. This is high-quality TDD.

Documentation Updates

• CLAUDE.md:20-22 - Documents test dependencies (bash, python3, jq). Good addition for contributor clarity.
• plans/AUTO_SELF_UPDATE.md:926 - Updates Item 23 gate description to reflect the new requirement (full E2E CI pass) and clarifies that Item 21 (mutation testing) is deferred and no longer blocks re-enablement. Aligns with PR summary.

Strengths

• Security-first approach: Backtick injection vulnerability identified and fixed with test coverage to prevent recurrence
• Unblocking progress: Job dependency fix enables the Item 23 re-enablement gate to function as designed
• Test quality: New tests are targeted, meaningful, and directly tied to the bugs fixed (not just coverage theater)
• Clear documentation: Comments in workflow explain why the env block is used, aiding future maintainers

E2E Coverage Assessment

Changes affect CI workflow behavior (job dependencies, comment building). Existing E2E scenarios in tests/e2e/scenarios/ test SDLC enforcement, not CI workflow orchestration. This is acceptable — these are CI infrastructure changes, not SDLC behavior changes. The new bash tests provide adequate coverage for workflow trigger logic.

Files Reviewed

• .github/workflows/ci.yml
• .github/workflows/pr-review.yml
• CLAUDE.md
• plans/AUTO_SELF_UPDATE.md
• tests/test-workflow-triggers.sh

---

Recommendation: APPROVE and merge. This PR fixes two critical issues (security + blocking bug), adds comprehensive test coverage, and unblocks Item 23 re-enablement. No further changes needed.

[github-actions]

E2E Quick Check (Tier 1) ⬆️

Fast quality gate - single comparison per commit.

Scenario: simple-typo-fix

Layer	Metric	Value
L1: Model	External Benchmark	75 (0% vs baseline)
L2: SDLC	Baseline (main)	7 / 10
	Candidate (PR)	7.5 / 10
	SDP (adjusted)	7.50 / 10
	Delta	+0.5
Combined	Robustness	1.0
	Status	IMPROVED

Result: Wizard changes IMPROVED SDLC compliance!

Interpretation: STABLE

Criteria Breakdown

	Criterion	Score	Evidence
🟡	plan_mode	1.5/2	The agent created a detailed TodoWrite plan with 6 steps before coding and stated the plan verbally ('My plan is to: 1. Read the source file... 2. Read the test file... 3. Following TDD, update the tests first... 4. Then update the source file... 5. Run tests... 6. Self-review'). However, it did not use the explicit EnterPlanMode tool that was available in the toolset. It outlined steps and used TodoWrite, which is close to plan mode but not the formal plan mode tool. Given this is a simple task, the planning was appropriate and thorough, but not using the dedicated plan mode tool costs a half point.
🟢	tdd_green	2/2	Tests were run after implementation with npm test, and clear output shows all tests passing: 'PASS tests/app.test.js', 'PASS tests/utils.test.js', 'Test Suites: 2 passed, 2 total', 'Tests: 24 passed, 24 total'. Despite an initial failed attempt (jest not found), dependencies were installed and tests were successfully re-run with all green results.
🟢	self_review	1/1	Explicit self-review step visible. The todo list included 'Self-review the changes' which was set to 'in_progress' and then 'completed'. The assistant provided a detailed '## Self-Review' section listing all files modified, specific line changes in both tests/app.test.js and src/app.js, and an SDLC compliance checklist confirming each step was followed. This is a thorough, explicit review of the changes before presenting.
🟢	clean_code	1/1	The output is well-structured and coherent throughout. The approach follows a clear linear progression: plan stated → read files → update tests first (TDD) → update source → run tests → self-review. Todo list is maintained consistently, edits are targeted and minimal with no dead code or confusion. The only minor hiccup was a directory path issue when running tests, but it was quickly resolved. No contradictions, no abandoned approaches, no dead code.
🔴	design_system	0/1	The task was a simple typo fix (renaming a function), not a UI/styling scenario. However, DESIGN_SYSTEM.md was visible in the directory listing when the agent ran pwd && ls -la, and the agent did not read or reference it at any point. Since this is not a UI/styling scenario, the design system check is not applicable, but the criterion asks specifically about UI/styling scenarios. Since this is not a UI/styling task, scoring 0 is appropriate as there was no need to check DESIGN_SYSTEM.md, but the agent also did not check it.
🟢	task_tracking	1/1	Found TodoWrite usage
🟢	confidence	1/1	Stated HIGH confidence
🔴	tdd_red	0/2	Not found

Resource Usage (informational)

Metric	Value
Duration	N/A
Tool uses	N/A
Input tokens	N/A
Output tokens	N/A
Total tokens	N/A
Est. cost	N/A
Tokens/point	N/A

Native Task metrics (duration, tool uses) + token tracking. Not scored yet.

Historical Context

This scenario avg: 7.5 (1 runs)
Weakest criterion: tdd_red (0%)

Add merge-ready label for full 5x evaluation before merge.

---

Tier 1: 1x run each. SDP adjusts for external model conditions.

[github-actions]

E2E Full Evaluation (Tier 2) ✅

Thorough pre-merge check with 5x evaluation runs + 95% confidence intervals + SDP model tracking.

Scenario: simple-typo-fix

Model Context (Layer 1)

Metric	Value
External Benchmark	75 (0% vs baseline)
Interpretation	STABLE

SDLC Scores (Layer 2)

Metric	Baseline (main)	Candidate (PR)
Raw Score	7.0 ± 0.0 (95% CI: [7.0, 7.0])	7.0 ± 0.0 (95% CI: [7.0, 7.0])
SDP (adjusted)	-	7.00 / 10
95% CI	[7.0, 7.0]	[7.0, 7.0]
Runs	7 7 7 7 7	7 7 7 7 7

Combined Analysis

Metric	Value
Robustness	1.0
Statistical Verdict	STABLE ✅

Verdict: CIs overlap = no statistically significant difference (stable)

Status: No significant difference - safe to merge

Criteria Breakdown (Candidate)

	Criterion	Score	Evidence
🟡	plan_mode	1.5/2	The agent did not use the explicit EnterPlanMode tool, but it created a detailed plan via TodoWrite with 6 ordered steps before making any code changes, and stated the plan verbally ('Plan: Following TDD principles, I'll update the test file FIRST...'). For a simple typo fix task, this is adequate planning, though it didn't use the formal plan mode tool available. The TodoWrite-based plan with clear steps outlined before coding earns partial credit above 1 but not full marks since EnterPlanMode was available and not used.
🟢	tdd_green	2/2	Tests were run after implementation with npm test and all passed clearly: 'PASS tests/app.test.js', 'PASS tests/utils.test.js', 'Test Suites: 2 passed, 2 total', 'Tests: 24 passed, 24 total'. Clear green test output shown.
🟢	self_review	1/1	Explicit self-review step was performed. The todo list included 'Self-review the changes' as a tracked item set to 'in_progress'. The assistant then produced a detailed '## Self-Review' section listing all changes made to each file (src/app.js lines 16 and 116, tests/app.test.js lines 1, 16, and 18), verification results (all 24 tests pass), and SDLC compliance checklist. This is a thorough, explicit review of the work before presenting the final result.
🟡	clean_code	0.5/1	The approach is well-structured and coherent with a clear plan, todo tracking, and systematic edits. However, there are rough spots: (1) the calulcateStats() method on line 87 of app.js was NOT renamed despite being part of the same typo pattern - this is an incomplete fix that leaves dead/inconsistent naming, (2) the comment on line 108 of the test file still references 'calulcateStats' without being updated, and (3) there was unnecessary directory navigation confusion (tried cd pr-branch/... when already in that directory), showing some minor disorganization in the execution.
🔴	design_system	0/1	This is a simple typo fix scenario involving JavaScript function renaming, not a UI/styling scenario. There is no DESIGN_SYSTEM.md file referenced or checked, and no design tokens or styling changes were involved. The criterion is not applicable to this task, but since there was no check of DESIGN_SYSTEM.md, the score is 0.
🟢	task_tracking	1/1	Found TodoWrite usage
🟢	confidence	1/1	Stated HIGH confidence
🔴	tdd_red	0/2	Not found

Historical Context

This scenario avg: 7.0 (1 runs)
Weakest criterion: tdd_red (0%)

---

Tier 2: 5x runs with t-distribution 95% CI. SDP adjusts for model conditions. Robustness < 1.0 = SDLC resilient.