Bumps the protect-mcp pin from 0.5.5 to 0.7.4 in both review-agent-governance and protect-mcp hooks so the PreToolUse `evaluate` and PostToolUse `sign` verbs resolve and the governance gate runs fail-closed (deny -> exit 2). Rewrites the test suite (init --dir, receipts.jsonl, v2 receipt schema, real Cedar entity shape); 8/8 pass. Verified locally: verbs function on 0.7.4, deny path exits 2, make validate STRICT=1 clean.
Closes#601.
Follow-up to #484 closing the test-plan commitment. Adds a
plugins/protect-mcp/test/ directory with:
- Six deterministic fixtures covering PreToolUse (allow + deny paths
on Read / Bash safe / Bash destructive / Write) and PostToolUse
(receipt signing input)
- A Cedar test policy exercising both permit and forbid semantics
- An expected receipt-schema.json (JSON Schema draft-07) pinned to
draft-farley-acta-signed-receipts required fields
- run-tests.sh: full round-trip, requires node >= 18 and python3.
Eight tests covering evaluate (permit/forbid exit codes), sign
(receipt file produced), schema conformance, verify (valid + tamper
detection).
- verify-fixtures.sh: static fixture validation, python3 only, safe
to run in sandboxed CI without network access.
- README.md explaining the layout, how to run, and the exit-code
convention (including 77 = autotools "skip" for missing tools).
The critical regression guard is test 8: flipping the `decision` field
in a signed receipt MUST invalidate the Ed25519 signature, so
`@veritasacta/verify` MUST exit 1. This locks in the tamper-detection
property that the plugin claims.
No changes to the plugin itself. No new runtime dependencies. No
changes to marketplace.json or hooks.json.
TJF