fix(engine): the affirmative TAGS-SIGNED was suppressed by its own exemption OK

Gated on `findings.length === 0`, so a TAG-SIGNED-PREPOLICY OK silenced it —
and every repo in the org has pre-policy tags, which made the affirmative
verdict near-unreachable in practice.

Caught by dogfooding v0.11.0: this repo signed the first tag the check ever
judged, and the gate did not say so. Status was green either way, which is
exactly why it was worth fixing — a reader could not tell "signed its new tag"
from "has cut no tag since the policy". Two different facts wearing one
silence, which is the defect this engine already refuses to ship one check
over, where an exemption nobody can see reads like a check that stopped
running.

Keys the affirmative on the JUDGED findings only. Measured after: 18 repos
emit both codes, 3 NONE, still 0 ERROR / 0 WARN. 243 tests, from 241.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XsPsVsvhrSaejK3cLPmnN2

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-standard",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Per-repo gate for the open/ presentation standard: README first screen, install block, files required by the repo's class, and dead repo references.",
   "author": {
     "name": "Kjell Tore Guttormsen"

CHANGELOG.md

@@ -6,6 +6,26 @@ versioning is [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.11.1] — 2026-08-13
+
+### Fixed
+
+- **`TAGS-SIGNED`, the affirmative verdict, was near-unreachable.** It was gated
+  on `findings.length === 0`, so the presence of a `TAG-SIGNED-PREPOLICY` `OK`
+  suppressed it — and every repo in the org has pre-policy tags. Caught by
+  dogfooding the v0.11.0 release: this repo signed the first tag the check ever
+  judged, and the gate did not say so.
+
+  The status was green either way, which is what made it worth fixing rather
+  than shrugging at: a reader could not tell *this repo signed its new tag* from
+  *this repo has cut no tag since the policy*. Two different facts wearing one
+  silence — the same defect as an exemption nobody can see, which this engine
+  already refuses to ship one check over. The gate now keys the affirmative on
+  the JUDGED findings only, and the two cases carry different sentences.
+
+  Measured after: 18 repos emit both `TAGS-SIGNED` and `TAG-SIGNED-PREPOLICY`,
+  3 `TAG-SIGNED-NONE`, still 0 ERROR and 0 WARN. 243 tests, from 241.
+
 ## [0.11.0] — 2026-08-13
 
 ### Added

CLAUDE.md

@@ -344,7 +344,7 @@ would recreate, in data, exactly the drift this plugin exists to remove.
 ## Commands
 
 ```bash
-npm test                                                  # 241 tests
+npm test                                                  # 243 tests
 node scripts/repo-standard-check.mjs --dir "$PWD"         # gate one repo
 node scripts/repo-standard-check.mjs --offline            # no network call
 node scripts/repo-standard-check.mjs --json               # machine output

README.md

@@ -10,7 +10,7 @@ checks that surface in one repository and reports what it finds.
 
 *AI-generated: all code produced by Claude Code through dialog-driven development.*
 
-![Version](https://img.shields.io/badge/version-0.11.0-blue)
+![Version](https://img.shields.io/badge/version-0.11.1-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
 ![Skills](https://img.shields.io/badge/skills-1-orange)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-standard",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "private": true,
   "type": "module",
   "engines": {

scripts/repo-standard-check.mjs

@@ -839,11 +839,16 @@ export function checkTagSigned({ tagObjects }, register) {
     });
   }
 
-  if (findings.length === 0 && inScope.length > 0) {
-    findings.push({ level: 'OK', code: 'TAGS-SIGNED', msg: `all ${inScope.length} tag(s) cut under the policy (from ${from}) are signed` });
-  }
-  if (findings.length === 0) {
-    findings.push({ level: 'OK', code: 'TAGS-SIGNED', msg: `no tag has been cut since the signing policy took effect (${from}) — nothing to judge yet` });
+  // The affirmative verdict is gated on the JUDGED findings only, never on
+  // `findings.length`. Gating on the whole list suppressed it the moment a
+  // pre-policy OK was present — which is every repo in the org, so this OK was
+  // near-unreachable in practice, and a reader could not tell "signed its new
+  // tag" from "has cut no tag since the policy". Two different facts, both green.
+  const judged = findings.some((f) => f.level === 'ERROR' || f.level === 'WARN');
+  if (!judged) {
+    findings.push(inScope.length > 0
+      ? { level: 'OK', code: 'TAGS-SIGNED', msg: `all ${inScope.length} tag(s) cut under the policy (from ${from}) are signed` }
+      : { level: 'OK', code: 'TAGS-SIGNED', msg: `no tag has been cut since the signing policy took effect (${from}) — nothing to judge yet` });
   }
   return findings;
 }

scripts/repo-standard-check.test.mjs

@@ -1004,6 +1004,35 @@ test('tags predating the policy are never judged — and say so as an OK, not si
   assert.match(ok.msg, /2026-08-13/);
 });
 
+// Caught by dogfooding the v0.11.0 release: the affirmative verdict was
+// suppressed whenever ANY pre-policy tag existed — which is every repo in the
+// org, so `TAGS-SIGNED` would have been near-unreachable in practice. The
+// reader could then not tell "this repo signed its new tag" from "this repo has
+// cut no tag since the policy". Both are OK-status, and they are not the same
+// fact. The exemption OK must not silence the judged one.
+test('the affirmative OK survives alongside the pre-policy OK — they are two different facts', () => {
+  const f = checkTagSigned({ tagObjects: [
+    { name: 'v0.9.0', annotated: true, signed: false, date: '2026-08-09' },
+    { name: 'v1.0.0', annotated: true, signed: true, date: '2026-08-14' },
+  ] }, SIGN_REG);
+  assert.equal(f.some((x) => x.level === 'ERROR' || x.level === 'WARN'), false);
+  assert.equal(f.some((x) => x.code === 'TAG-SIGNED-PREPOLICY'), true);
+  const ok = f.find((x) => x.code === 'TAGS-SIGNED');
+  assert.equal(ok.level, 'OK');
+  assert.match(ok.msg, /\b1 tag/);
+});
+
+// The other half of the same distinction: nothing cut since the policy is a
+// DIFFERENT sentence from "what was cut is signed", and it must not borrow the
+// affirmative one's wording.
+test('a repo with only pre-policy tags says nothing has been cut yet, not that anything passed', () => {
+  const f = checkTagSigned({ tagObjects: [
+    { name: 'v0.9.0', annotated: true, signed: false, date: '2026-08-09' },
+  ] }, SIGN_REG);
+  const ok = f.find((x) => x.code === 'TAGS-SIGNED');
+  assert.match(ok.msg, /no tag has been cut/);
+});
+
 test('a tag cut exactly ON the policy date is in scope — the policy starts that day', () => {
   const f = checkTagSigned({ tagObjects: [
     { name: 'v1.0.0', annotated: true, signed: false, date: '2026-08-13' },