@mmerterden/multi-agent-pipeline 11.2.0 → 11.3.0

package/pipeline/commands/multi-agent/refactor.md

@@ -1,188 +0,0 @@
----
-description: "Analyse the project, score it, draft an improvement plan, take approval, develop, then ask whether to sync."
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep, Agent, AskUserQuestion, WebFetch
----
-
-# Multi-Agent Refactor
-
-**One command. Analyse → Score → Plan → Approval → Develop → Sync.**
-
-Deep-analyses the current project, scores it across 10 categories, drafts every improvement, asks the user for approval, applies them, and asks about sync at the end.
-
-**Input**: $ARGUMENTS (optional  -  area to focus on: "security", "performance", "tests", etc.)
-
-## Flow
-
-```
-Step 0: RESEARCH   Search GitHub + Reddit for competing projects, gather good ideas
-Step 1: SCAN       Walk the project structure (files, LOC, dependencies, CI, tests)
-Step 2: ANALYZE    Deep analysis across 10 categories
-Step 3: SCORE      Each category /10, overall /100
-Step 4: PLAN       List every improvement + competitor idea in priority order
-Step 5: ASK        "Start the work?"  -  wait for user approval
-Step 6: IMPLEMENT  Apply approved improvements one by one (lint, test, commit)
-Step 7: VERIFY     Confirm every test + lint passes
-Step 8: ASK SYNC   "Run multi-agent-sync?"  -  wait for user approval
-```
-
-## Step 0: RESEARCH  -  competitor analysis
-
-Before starting work, scan for similar projects:
-
-1. **GitHub Search**: `multi-agent pipeline AI development` + `Claude Code pipeline` + `AI coding agent`
-   - find repos with stars:>10
-   - read their READMEs
-   - extract their distinct features
-2. **Reddit Search**: multi-agent discussions in `r/ClaudeAI`, `r/ChatGPT`, `r/LocalLLaMA`
-3. **For each competitor, record**:
-   - distinct features we DO NOT have
-   - ideas worth adopting
-   - things they do better than us
-   - things we do better than them
-4. **Add to the plan**: roll the high-impact + low-effort ideas into the PLAN step (P1 priority)
-
-Output format:
-```
-| Source | Idea | Effort | Impact | In plan? |
-|--------|-------|--------|------|--------------|
-| ralph-loop | Symlink distribution | Low | High | Yes |
-| atelier | Persistent Brain | High | Very High | No (roadmap) |
-```
-
-## Step 1: SCAN
-
-```
-- file count, LOC (cloc or wc -l)
-- package.json / Package.swift / build.gradle analizi
-- dependency count (runtime vs dev)
-- Is there a CI/CD pipeline? (.github/workflows/, fastlane/, Makefile)
-- Is there test infrastructure? How many tests? Coverage?
-- Is linter/formatter config in place?
-- Do README, LICENSE, SECURITY.md, CHANGELOG.md exist?
-- Git state: branch count, last commit date, tags
-```
-
-## Step 2: ANALYZE  -  10 categories
-
-| # | Category | What to check |
-|---|----------|-------------------|
-| 1 | **Architecture** | Layer separation, modularity, SOLID, dependency direction |
-| 2 | **Code Quality** | Naming, magic numbers, dead code, complexity, DRY |
-| 3 | **Security** | Hardcoded secrets, input validation, Keychain, ATS, ATT |
-| 4 | **Tests** | Coverage, test pyramid, edge cases, mock/stub quality |
-| 5 | **CI/CD** | Build matrix, lint job, release automation, artifact caching |
-| 6 | **Docs** | README quality, JSDoc / Swift docs, API docs, CHANGELOG |
-| 7 | **Performance** | Bundle size, lazy loading, memory leaks, unnecessary re-renders |
-| 8 | **Accessibility** | a11y labels, tap targets, VoiceOver, Dynamic Type |
-| 9 | **Dependency Management** | Outdated deps, vulnerability scan, lockfile, version pinning |
-| 10 | **DevEx** | Onboarding time, script ergonomics, error messages, debug tooling |
-
-## Step 3: SCORE
-
-Her kategori 10 uzerinden puanlanir. Output format:
-
-```
-+---------------------+-------+
-| Category            | Score |
-+---------------------+-------+
-| Architecture        | 9/10  |
-| Code Quality        | 8/10  |
-| Security            | 9/10  |
-| Tests               | 7/10  |
-| CI/CD               | 8/10  |
-| Docs                | 7/10  |
-| Performance         | 9/10  |
-| Accessibility       | 6/10  |
-| Dependency Mgmt     | 8/10  |
-| DevEx               | 9/10  |
-+---------------------+-------+
-| TOTAL               | 80/100|
-+---------------------+-------+
-```
-
-## Step 4: PLAN
-
-List every improvement found:
-
-```
-| # | Priority | Category | Improvement | Impact |
-|---|---------|----------|-------------|------|
-| 1 | P0 | Security | Remove hardcoded API key | Critical |
-| 2 | P0 | Tests | Missing edge-case tests | High |
-| 3 | P1 | CI/CD | Add Node matrix | Medium |
-| 4 | P1 | Docs | Functions missing JSDoc | Medium |
-| 5 | P2 | DevEx | npm script naming | Low |
-```
-
-Priority levels:
-- **P0**: bugs, security holes, broken functionality  -  MUST fix
-- **P1**: clear quality improvement  -  should be done
-- **P2**: nice-to-have  -  if time allows
-
-## Step 5: ASK  -  user approval
-
-After showing the plan, ask:
-
-> "Found X improvements (P0: N, P1: M, P2: K). Should I start the work?"
-
-Options:
-- "Yes, do all"
-- "Only P0"
-- "P0 + P1 only"
-- (the user may pick specific items)
-
-**NEVER start the work without approval.**
-
-## Step 6: IMPLEMENT
-
-Apply the approved improvements one by one:
-
-1. For each improvement:
-   - apply the change
-   - run the relevant tests
-   - on success, move to the next
-   - On failure, roll back and notify the user
-2. After all changes are done:
-   - run the full lint + test suite
-   - on success, commit
-
-Commit format: `refactor(scope): {short description}`
-
-## Step 7: VERIFY
-
-```bash
-# Lint
-npm run lint 2>/dev/null || swift build 2>/dev/null
-
-# Test
-npm test 2>/dev/null || swift test 2>/dev/null || xcodebuild test 2>/dev/null
-
-# Result
-echo "Lint: PASS/FAIL"
-echo "Test: PASS/FAIL (X/Y passed)"
-```
-
-## Step 8: ASK SYNC
-
-After every improvement is applied, ask:
-
-> "Work is complete. Should I run multi-agent-sync?"
-
-Options:
-- "Yes" → run the `/sync` command (full ecosystem sync)
-- "No" → emit a report and stop
-- "Commit + push only" → push the current repo without sync
-
-## Focus filter
-
-If $ARGUMENTS is set, focus on that category only:
-
-| Input | Focus |
-|-------|------|
-| `security` | Security analysis only |
-| `tests` | Test coverage and quality only |
-| `performance` | Performance optimisation only |
-| `docs` | Docs only |
-| `ci` | CI/CD pipeline only |
-| `deps` | Dependency updates only |
-| (empty) | All 10 categories (default) |

package/pipeline/commands/multi-agent/refs/component-dispatch.md

@@ -1,92 +0,0 @@
-# Component Dispatch (Phase 3 short-circuit)
-
-> **TLDR**  -  When `taskType === "component"` (Figma URL in task description or instruction-driven figma workflow), multi-agent Phase 3 **does not run the TDD loop**. It delegates the entire phase to the `figma-to-component` skill and relays its subphases 3.0 - 3.8 via the existing phase-tracker contract. Implementation lives in the skill; multi-agent's job is classification, dispatch, and state report.
-
-This doc is referenced from `refs/phases/phase-3-dev.md`. Keeping it separate lets `phase-3-dev.md` remain tight (it's already the largest phase doc) and gives the orchestrator-report contract a stable URL for both Claude-side and Copilot-side implementations.
-
-## Entry conditions
-
-Phase 3 checks, in order:
-
-1. `agent-state.json` has `taskType: "component"` (set by Phase 0 Step 7).
-2. `agent-state.json` has a non-null `figmaUrl`.
-
-Either missing → log the anomaly to `agent-log.md` ("component dispatch expected but state incomplete"), fall through to the standard TDD path. Never silently skip the Figma work.
-
-## Orchestrator resolution
-
-```
-project.platform  → orchestrator skill
-────────────────────────────────────────────────────────────────
-ios               → pipeline/skills/figma-ios/figma-to-component/
-android           → pipeline/skills/figma-android/figma-to-component/
-web, multi-*      → HALT with clear error (no web target)
-```
-
-If the chosen skill directory is missing, **halt with a user-visible error**. Do not silently fall back to TDD  -  a component task ran through the bugfix path would produce wrong artefacts and waste review cycles.
-
-## Dispatch call
-
-Emit `→ dispatching figma-to-component <componentName>` via the progress contract, then launch a single agent invocation on the orchestrator skill with:
-
-- `figmaUrl`  -  primary positional argument
-- `agentState`  -  the path to `agent-state.json` so the orchestrator enriches `state.phases["3"].subphases[]`
-- `progressVerbosity`  -  forced to `verbose` when multi-agent runs in `mode: "autopilot"`; otherwise inherits `prefs.global.settings.progressVerbosity`
-- `mode`  -  `"dev"` for `--dev` runs; `"full"` otherwise
-
-## Subphase contract
-
-The orchestrator writes each of its 8 subphases to `state.phases["3"].subphases[]` as it completes, with the shape:
-
-```json
-{
-  "id": "3.4a",
-  "name": "4A-Configuration",
-  "status": "done",
-  "startedAt": "2026-04-16T18:12:02Z",
-  "endedAt":   "2026-04-16T18:13:47Z",
-  "buildStatus": "green",
-  "testStatus": "green"
-}
-```
-
-Multi-agent's `phase-tracker` reads this array without any component-specific code  -  the tracker UI renders one row per subphase under the Phase 3 row. No new phase-tracker field is required.
-
-## Multi-repo report
-
-When multi-repo mode is active (`state.projects.length > 1`), the orchestrator reads `state.projects[]` and runs subphases against the correct per-repo worktree:
-
-- Tokens, accessibility metadata, testing identifiers, localisation keys → `repos.common`
-- View / Configuration / Modifiers / Preview → `repos.components`
-- Wiki markdown → `repos.wiki` (if `wiki.mode === submodule` or `separate-repo`) or `repos.components/.wiki/components/` (if `wiki.mode === in-repo`)
-
-Multi-agent does **not** split the component task into per-repo Phase 3 runs  -  the orchestrator is aware of the repo graph and sequences writes correctly (e.g. token writes to `common` precede component reads in `components`).
-
-## Failure + resume
-
-On orchestrator failure (subphase hits a build/test error that can't auto-fix, or hits retry cap):
-
-1. The orchestrator persists `{subphase, error, buildLog, testLog}` to `state.phases["3"].errors[]`.
-2. Multi-agent increments `state.phases["3"].retryCount`.
-3. Retry re-enters the orchestrator with `phase-<N>` as the argument (the failed subphase), so the skill resumes instead of restarting.
-4. Hard kill at `retryCount === 3` → surface the errors to the user, halt Phase 3. Do not loop indefinitely.
-
-## `--dev` mode behaviour
-
-When multi-agent is invoked with `--dev` (fast path: Init → Dev → Commit → Report), the orchestrator receives `mode: "dev"` and is allowed to elide:
-
-- Subphase 5C (unit tests)  -  structural + snapshot are still required
-- Subphase 7 (wiki)  -  can be deferred; Phase 7 in multi-agent will ask the user whether to run it post-commit
-
-Phase 4 reviewer-skipping is **not** Phase 3's concern  -  Phase 4 decides based on `mode: "dev"` itself.
-
-## Cross-CLI parity
-
-Both Claude Code and Copilot CLI implementations MUST:
-
-- Use the same orchestrator resolution table (ios / android / halt).
-- Emit byte-identical progress lines (`→ dispatching figma-to-component <name>`).
-- Write the same `state.phases["3"].subphases[]` schema.
-- Treat `--dev` the same way (elide 5C + 7 by default, no reviewer skip).
-
-`smoke-cross-cli-behavior.sh` asserts this contract.

package/pipeline/scripts/smoke-existing-discovery-gate.sh

@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-#
-# smoke-existing-discovery-gate.sh
-#
-# Asserts the figma-to-component orchestrator has the Phase 1.5 existing-
-# component discovery gate wired in:
-#   - phase-1.5-existing-discovery.md exists with the canonical anchors
-#   - phase-2-orchestrator ENTRY GATE consults discovery.status
-#   - phase-6-code-connect ENTRY GATE skips publish when already mapped
-#
-# This is Defect 10 from the GH1241 stability plan (docs/STABILITY-FIX-PLAN.md).
-
-set -euo pipefail
-
-SELF_DIR=$(cd "$(dirname "$0")" && pwd)
-PIPELINE_ROOT=$(cd "$SELF_DIR/.." && pwd)
-
-cd "$PIPELINE_ROOT"
-
-FAIL=0
-
-GATE_DOC="skills/figma-ios/figma-to-component/phases/phase-1.5-existing-discovery.md"
-PHASE2="skills/figma-ios/figma-to-component/phases/phase-2-orchestrator.md"
-PHASE6="skills/figma-ios/figma-to-component/phases/phase-6-code-connect.md"
-
-# 1. Phase 1.5 doc exists.
-if [ ! -f "$GATE_DOC" ]; then
-  echo "FAIL [smoke-existing-discovery-gate]: $GATE_DOC missing"
-  exit 1
-fi
-
-# 2. Phase 1.5 contains the four canonical statuses.
-declare -a REQUIRED_STATUSES=(
-  "GREENFIELD_OK"
-  "ALREADY_MAPPED"
-  "EXISTING_SOURCE_NO_CC"
-  "GAP_ANALYSIS"
-)
-for st in "${REQUIRED_STATUSES[@]}"; do
-  if ! grep -qF "$st" "$GATE_DOC"; then
-    echo "FAIL [smoke-existing-discovery-gate]: $GATE_DOC must define status $st"
-    FAIL=$((FAIL + 1))
-  fi
-done
-
-# 3. Phase 1.5 writes to agent-state.discovery.{status,sourcePath,gaps}.
-if ! grep -qE 'discovery.*status|"discovery"' "$GATE_DOC"; then
-  echo "FAIL [smoke-existing-discovery-gate]: $GATE_DOC must write to agent-state.discovery"
-  FAIL=$((FAIL + 1))
-fi
-
-# 4. Phase 2 ENTRY GATE consults discovery.status.
-if ! grep -qE "discovery\.status|agent-state\.discovery" "$PHASE2"; then
-  echo "FAIL [smoke-existing-discovery-gate]: $PHASE2 ENTRY GATE must consult discovery.status"
-  FAIL=$((FAIL + 1))
-fi
-
-# 5. Phase 6 ENTRY GATE skips when ALREADY_MAPPED or .figma.swift exists.
-if ! grep -qE "ALREADY_MAPPED|already published|GAP_ANALYSIS" "$PHASE6"; then
-  echo "FAIL [smoke-existing-discovery-gate]: $PHASE6 ENTRY GATE must skip when ALREADY_MAPPED / GAP_ANALYSIS"
-  FAIL=$((FAIL + 1))
-fi
-
-if [ "$FAIL" -gt 0 ]; then
-  echo ""
-  echo "smoke-existing-discovery-gate: $FAIL violation(s)."
-  echo "Defect 10 contract  -  see docs/STABILITY-FIX-PLAN.md."
-  exit 1
-fi
-
-echo "smoke-existing-discovery-gate: ok"

package/pipeline/scripts/smoke-figma-android-parity.sh

@@ -1,148 +0,0 @@
-#!/usr/bin/env bash
-# smoke-figma-android-parity.sh  -  WS-7 contract.
-#
-# Verifies the Android platform skill tree under pipeline/skills/figma-android/
-# mirrors the iOS peer for every platform-specific skill required by the
-# figma-to-component orchestrator. Also checks Android-specific details
-# (Kotlin file names, Compose tooling, Paparazzi/Roborazzi references).
-
-set -euo pipefail
-
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-IOS_DIR="$ROOT/pipeline/skills/figma-ios"
-ANDROID_DIR="$ROOT/pipeline/skills/figma-android"
-
-PASS=0
-FAIL=0
-pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
-
-[ -d "$IOS_DIR" ] || { echo "error: iOS tree missing at $IOS_DIR" >&2; exit 1; }
-[ -d "$ANDROID_DIR" ] || { echo "error: Android tree missing at $ANDROID_DIR" >&2; exit 1; }
-
-# Platform-specific skills that MUST exist on both sides.
-REQUIRED=(
-  figma-to-component
-  figma-component-implement
-  figma-component-test
-  figma-component-code-connect
-  figma-component-wiki
-)
-
-echo "→ 1. Android tree has required platform-specific skills"
-for skill in "${REQUIRED[@]}"; do
-  if [ -d "$ANDROID_DIR/$skill" ] && [ -f "$ANDROID_DIR/$skill/SKILL.md" ]; then
-    pass "$skill present"
-  else
-    fail "$skill missing"
-  fi
-done
-
-echo ""
-echo "→ 2. iOS tree has the same required skills (parity source)"
-for skill in "${REQUIRED[@]}"; do
-  if [ -d "$IOS_DIR/$skill" ] && [ -f "$IOS_DIR/$skill/SKILL.md" ]; then
-    pass "iOS $skill present"
-  else
-    fail "iOS $skill missing (parity source broken)"
-  fi
-done
-
-echo ""
-echo "→ 3. Every Android SKILL.md has frontmatter with platform: android"
-for skill in "${REQUIRED[@]}"; do
-  f="$ANDROID_DIR/$skill/SKILL.md"
-  [ -f "$f" ] || continue
-  if ! head -n 1 "$f" | grep -Fxq -- "---"; then
-    fail "$skill/SKILL.md missing frontmatter"
-    continue
-  fi
-  if awk '/^---$/{c++; next} c==1' "$f" | grep -Fq "platform: android"; then
-    pass "$skill stamped platform: android"
-  else
-    fail "$skill/SKILL.md missing platform: android stamp"
-  fi
-done
-
-echo ""
-echo "→ 4. Every Android SKILL.md stamped status: wip-v5 + sourced-from"
-for skill in "${REQUIRED[@]}"; do
-  f="$ANDROID_DIR/$skill/SKILL.md"
-  [ -f "$f" ] || continue
-  grep -q "^status: wip-v5" "$f" && pass "$skill status: wip-v5" || fail "$skill missing status stamp"
-  grep -q "^sourced-from: " "$f" && pass "$skill has sourced-from" || fail "$skill missing sourced-from"
-done
-
-echo ""
-echo "→ 5. Android implement skill targets Compose + Kotlin"
-IMPL="$ANDROID_DIR/figma-component-implement/SKILL.md"
-if [ -f "$IMPL" ]; then
-  if grep -Fq "@Composable" "$IMPL" && grep -Fq "Configuration.kt" "$IMPL" && grep -Fq "@Immutable" "$IMPL"; then
-    pass "implement references @Composable + Configuration.kt + @Immutable"
-  else
-    fail "implement missing Compose/Kotlin markers"
-  fi
-fi
-
-echo ""
-echo "→ 6. Android test skill targets Compose Testing + Paparazzi"
-TEST="$ANDROID_DIR/figma-component-test/SKILL.md"
-if [ -f "$TEST" ]; then
-  if grep -Fq "createComposeRule" "$TEST" && grep -Fq "Paparazzi" "$TEST"; then
-    pass "test references createComposeRule + Paparazzi"
-  else
-    fail "test missing Compose Testing / Paparazzi markers"
-  fi
-fi
-
-echo ""
-echo "→ 7. Android orchestrator routes Android-specific build (gradleModule)"
-ORCH="$ANDROID_DIR/figma-to-component/SKILL.md"
-if [ -f "$ORCH" ]; then
-  if grep -Fq "gradleModule" "$ORCH" && grep -Fq "./gradlew" "$ORCH"; then
-    pass "orchestrator references gradleModule + gradlew"
-  else
-    fail "orchestrator missing gradleModule / gradlew references"
-  fi
-fi
-
-echo ""
-echo "→ 8. figma-project-config schema declares Android build fields"
-SCHEMA="$ROOT/pipeline/schemas/figma-project-config.schema.json"
-if jq -e '.properties.build.properties.gradleModule' "$SCHEMA" >/dev/null 2>&1 \
- && jq -e '.properties.build.properties.variant' "$SCHEMA" >/dev/null 2>&1; then
-  pass "schema has build.gradleModule + build.variant"
-else
-  fail "schema missing Android build fields"
-fi
-
-echo ""
-echo "→ 9. Platform enum covers Android"
-if jq -e '.properties.project.properties.platform.enum | index("android")' "$SCHEMA" >/dev/null 2>&1; then
-  pass "project.platform enum includes android"
-else
-  fail "project.platform enum missing android"
-fi
-
-echo ""
-echo "→ 10. README.md present explaining the Android tree"
-README="$ANDROID_DIR/README.md"
-if [ -f "$README" ] && grep -Fq "Android Platform Skills" "$README"; then
-  pass "README.md present and descriptive"
-else
-  fail "README.md missing or not descriptive"
-fi
-
-echo ""
-echo "→ 11. component-dispatch.md ref acknowledges Android routing"
-DISPATCH="$ROOT/pipeline/commands/multi-agent/refs/component-dispatch.md"
-if grep -Fq "android" "$DISPATCH" && grep -Fq "figma-android" "$DISPATCH"; then
-  pass "component-dispatch.md routes iOS/Android"
-else
-  fail "component-dispatch.md missing Android routing"
-fi
-
-echo ""
-echo "══ figma-android-parity smoke: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-figma-credential-store.sh

@@ -1,105 +0,0 @@
-#!/usr/bin/env bash
-# smoke-figma-credential-store.sh  -  drift gate for figma skill Keychain access.
-#
-# In v8.3.x the figma skill family was migrated off raw `security` calls and
-# routed through the cross-platform credential helper:
-#   ~/.claude/lib/credential-store.sh  (Claude Code installs)
-#   ~/.copilot/lib/credential-store.sh (Copilot CLI installs)
-# Each bash block uses a `CRED_STORE` resolver that picks whichever helper is
-# present so the same source ships to both CLIs.
-#
-# This smoke locks the migration in place. It re-fails the build if anyone
-# reverts a figma skill back to a direct `security find-generic-password` /
-# `add-generic-password` / `delete-generic-password` call against one of OUR
-# managed token names.
-#
-# Two intentional exceptions:
-#   - Subprocess calls that read the `Claude Code-credentials` keychain entry
-#     (Claude Code's own OAuth-token store, not ours).
-#   - Pedagogical references inside CHANGELOG / MIGRATION docs.
-#
-# Exit 0 = no drift, 1 = at least one figma file regressed.
-
-set -uo pipefail
-
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-
-pass=0
-fail=0
-failures=()
-record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
-record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
-
-printf '→ smoke-figma-credential-store: figma skills route Keychain via the helper, not raw `security`\n'
-
-# 1. The 8 figma surfaces that were migrated must keep using "$CRED_STORE" or
-#    `~/.claude/lib/credential-store.sh` / `~/.copilot/lib/credential-store.sh`.
-MIGRATED_FILES=(
-  "pipeline/skills/figma-common/figma-issue/SKILL.md"
-  "pipeline/skills/figma-common/figma-component-confluence-sync/SKILL.md"
-  "pipeline/skills/figma-common/figma-setup/SKILL.md"
-  "pipeline/skills/figma-common/figma-validate/SKILL.md"
-  "pipeline/skills/figma-ios/figma-to-component/phases/phase-6-code-connect.md"
-  "pipeline/skills/figma-ios/figma-to-component/reference/code-connect.md"
-  "pipeline/skills/figma-ios/figma-to-component/reference/rest-api-script.md"
-  "pipeline/skills/figma-ios/figma-to-component/reference/tools.md"
-  "pipeline/skills/figma-ios/figma-to-component/scripts/phase1-gather.py"
-)
-
-for rel in "${MIGRATED_FILES[@]}"; do
-  abs="$ROOT/$rel"
-  base="$(basename "$rel")"
-  if [ ! -f "$abs" ]; then
-    record_fail "$base missing  -  figma skill set drifted out of inventory"
-    continue
-  fi
-
-  # Each of these must reference the helper at least once (resolver, get/set/delete call,
-  # or python subprocess wrapper). If the helper reference is gone, the file regressed.
-  if grep -qE 'credential-store\.sh|CRED_STORE|keychain\.py' "$abs"; then
-    record_pass "$base references the credential helper"
-  else
-    record_fail "$base lost its credential-store.sh reference"
-  fi
-
-  # Now look for raw `security {find,add,delete}-generic-password` calls
-  # against OUR managed tokens. Anything matching one of these service names
-  # is a regression. (Claude Code's own `Claude Code-credentials` entry is
-  # NOT in this list  -  the figma-setup wizard is allowed to read it.)
-  managed_tokens='FIGMA_ACCESS_TOKEN|FIGMA_MCP_TOKEN|FIGMA_API_USER|JIRA_TOKEN|CONFLUENCE_TOKEN'
-  bad=$(grep -nE "security (find|add|delete)-generic-password.*-s [\"']?($managed_tokens)[\"']?" "$abs" 2>/dev/null || true)
-  if [ -z "$bad" ]; then
-    record_pass "$base contains no raw security calls against managed tokens"
-  else
-    record_fail "$base regressed to raw security on a managed token:
-$bad"
-  fi
-done
-
-# 2. The cross-CLI contract doc must point callers at credential-store.sh as
-#    the canonical path. If it ever flips back to raw `security` in the
-#    "canonical" column the principle is broken.
-CONTRACT="$ROOT/pipeline/commands/multi-agent/refs/cross-cli-contract.md"
-if [ -f "$CONTRACT" ] && grep -qE 'canonical path is .*credential-store\.sh' "$CONTRACT"; then
-  record_pass "cross-cli-contract.md declares credential-store.sh as canonical"
-else
-  record_fail "cross-cli-contract.md no longer declares credential-store.sh as canonical"
-fi
-
-# 3. The Copilot install template allowlist must list the helper, not just raw `security`.
-TEMPLATE="$ROOT/install/templates/copilot-instructions.md"
-if [ -f "$TEMPLATE" ] && grep -q 'credential-store\.sh' "$TEMPLATE"; then
-  record_pass "install template allowlist references credential-store.sh"
-else
-  record_fail "install template allowlist no longer references credential-store.sh"
-fi
-
-# Summary
-total=$((pass + fail))
-printf '\n→ smoke-figma-credential-store: %d/%d passed\n' "$pass" "$total"
-if [ "$fail" -ne 0 ]; then
-  printf '\nFailures:\n'
-  for f in "${failures[@]}"; do printf '  - %s\n' "$f"; done
-  exit 1
-fi
-exit 0