P2: Description now says "Edit/Write/Bash (including MultiEdit)"
instead of listing MultiEdit as a separate top-level gate
P2: Write Gate and Anti-Patterns now use same "redacted or synthetic
values" wording as Edit Gate (was still "cat one real record")
All 3 gate doc sections now consistent. 9/9 tests pass.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
P1: Gate message asked for raw production data records — changed to
"redacted or synthetic values" to prevent sensitive data exfiltration
P2: SKILL.md description now includes MultiEdit (was missing after
MultiEdit gate was added in previous commit)
P2: Session key pruning now caps __prefixed keys at 50 to prevent
unbounded growth even in theoretical edge cases
9/9 tests pass.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
A PreToolUse hook that forces Claude to investigate before editing.
Instead of self-evaluation ("are you sure?"), it demands concrete facts:
importers, public API, data schemas, user instruction.
A/B tested: +2.25 quality points (9.0 vs 6.75) across two independent tasks.
- scripts/hooks/gateguard-fact-force.js — standalone Node.js hook
- skills/gateguard/SKILL.md — skill documentation
- hooks/hooks.json — PreToolUse entries for Edit|Write and Bash
Full package with config: pip install gateguard-ai
Repo: https://github.com/zunoworks/gateguard
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Panache persist() returns void, so when().thenReturn() won't compile.
Replaced with doNothing().when().persist() which is the correct
Mockito pattern for void methods.
writeValueAsString throws checked JsonProcessingException which was
unhandled, causing a compile error. Wrapped in try/catch, rethrowing
as IllegalStateException.
The route calls .marshal().json() before reaching the mock endpoint,
so the body is a JSON String, not a POJO. Removed expectedBodiesReceived
with POJO and getBody(BusinessRulesPayload.class), replaced with
String body assertion using contains().
Tests assert null-payload and blank-error-message guards but the
implementation had none. Added Objects.requireNonNull for payload
and blank check for errorMessage. Also added missing objectMapper
field to locale copies.
The custom auth filter only rejected invalid tokens but silently
passed through requests without an Authorization header, creating
a complete auth bypass. Inverted the guard to reject-first: abort
immediately when header is absent or malformed, then validate.
X-Forwarded-For is client-controlled and trivially bypassable for rate
limiting. Replaced with HttpServletRequest.getRemoteAddr() which uses
the container-provided remote address. Added note about configuring
quarkus.http.proxy.proxy-address-forwarding for trusted proxy setups.
org.apache.camel.quarkus:camel-quarkus-bom follows its own release
cadence and doesn't align with quarkus.platform.version. Replaced
with io.quarkus.platform:quarkus-camel-bom which is published at
the same version as quarkus-bom.
- Add missing @Slf4j and bucketName field to FileStorageService
- Fix PaginatedList → List type mismatch (Panache returns List)
- Fix executorService.submit → execute mock (supplyAsync uses execute)
- Update S3 failure test to throw from putObject instead of failed future
Applied to English + all 3 locale copies (tr, ja-JP, zh-CN).
Phase 0 mapped build.gradle/pom.xml only to Spring Boot. Now it
instructs checking the build file contents for 'quarkus' vs
'spring-boot' to select the correct tech stack path.
Changed "Always use AssertJ" to "Prefer AssertJ for value checks" and
documented the intended pattern: JUnit assertThrows/assertDoesNotThrow
for exception lifecycle, AssertJ for value validation. This matches
the actual code examples in the document.
'unsafe-inline' for script-src negates XSS protection from CSP.
Removed it from the security headers example in quarkus-security
and all locale copies. Kept 'unsafe-inline' for style-src only
(commonly needed by CSS frameworks) with a comment recommending
nonces where possible.
- Add missing objectMapper field to EventService example (quarkus-patterns)
- Fix eventService.validate() → documentValidator.validate() API mismatch (quarkus-tdd)
- Add DocumentValidator mock declaration in Camel route test (quarkus-tdd)
- Update .opencode java-reviewer.txt to mention Quarkus alongside Spring Boot
