From 9ba73f207d371d33d255e4f7171fc413c77d74d5 Mon Sep 17 00:00:00 2001
From: araharah-executor <executor@araharah.local>
Date: Thu, 22 Oct 2026 08:28:30 +0800
Subject: [PATCH] test(01-04): add failing inline-style-attribute audit test
 (RED)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- T8: style="color: #00ff00" on an implementation page currently passes
  silently — an evasion path around the <style>-block scan (Rule 2 hole
  in the D-13 evidence: the gallery itself will use style attributes)
---
 theme/scripts/audit.test.mjs | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/theme/scripts/audit.test.mjs b/theme/scripts/audit.test.mjs
index 4092435..23e840d 100644
--- a/theme/scripts/audit.test.mjs
+++ b/theme/scripts/audit.test.mjs
@@ -24,6 +24,9 @@
  *       implementation pages are audited (compiled
  *       mockup vocabulary is reference material per D-06,
  *       never worn by implementation markup)
+ *   T8  inline style="…" attributes on implementation
+ *       pages are audited too (no evasion path around
+ *       the <style>-block scan)                       → flagged (exit 1)
  */
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -59,6 +62,7 @@ const badRadiusTokens = join(FIX, 'tokens-bad-radius.css');
 const compLayerCss = join(FIX, 'components-layer.css');
 const usedCss = join(FIX, 'used-utilities.css');
 const usedPage = join(FIX, 'used-page.html');
+const styleAttrPage = join(FIX, 'style-attr-page.html');
 
 /* T1 — token values only: var() refs, verbatim token hex,
  * token-hue+alpha 8-digit form, zero radius, sanctioned font
@@ -135,6 +139,15 @@ writeFileSync(usedPage, `<!DOCTYPE html>
 </body></html>
 `);
 
+/* T8 — inline style attributes: token-var reference passes,
+ * off-token literal gets flagged. */
+writeFileSync(styleAttrPage, `<!DOCTYPE html>
+<html><body>
+  <p style="background: var(--color-signal-orange)">token reference</p>
+  <p style="color: #00ff00">off-token literal</p>
+</body></html>
+`);
+
 /* ————— tests ————— */
 
 // T1 — clean stylesheet exits 0
@@ -202,6 +215,17 @@ writeFileSync(usedPage, `<!DOCTYPE html>
     `out=${r.out.slice(0, 300)}`);
 }
 
+// T8 — inline style attributes are audited (no evasion path)
+{
+  const r = runAudit(['--pages', styleAttrPage]);
+  check('T8 off-token style attribute → exit 1', r.status === 1,
+    `status=${r.status} error=${r.error} out=${r.out.slice(0, 300)}`);
+  check('T8 style-attr violation listed with file:line',
+    /style-attr-page\.html:\d+:.*#00ff00/.test(r.out), `out=${r.out.slice(0, 300)}`);
+  check('T8 token-var style attribute passes', !r.out.includes('var(--color-signal-orange)'),
+    `out=${r.out.slice(0, 300)}`);
+}
+
 /* ————— report ————— */
 console.log(`audit.test: ${passes.length} passed, ${failures.length} failed`);
 passes.forEach((p) => console.log(`  PASS ${p}`));