@mmerterden/multi-agent-pipeline 12.5.0 → 12.7.0

package/pipeline/scripts/smoke-no-mcp-in-dev-phases.sh

@@ -7,20 +7,30 @@
 # Phase 1; any entry in state.telemetry.mcpCalls[] with phase >= 2 is a
 # violation.
 #
-# Inputs
-#   --state-file <path>   Optional override (default: ~/.claude/state/run/latest.json)
+# Two modes.
 #
-# Outcomes
-#   - State file missing      -> WARN, exit 0 (no run to check)
+# CHECK MODE (--state-file <path>): audit that one state file.
 #   - telemetry.mcpCalls field absent -> PASS, exit 0 (older run, no telemetry)
 #   - All entries phase < 2   -> PASS, exit 0
 #   - One or more violations  -> FAIL summary on stdout, exit 1
+#   - Missing / corrupt file  -> exit 2
+#
+# SELF-TEST MODE (no arguments): drive check mode over fixtures that cover
+# every verdict, then audit the live state file if one happens to exist.
+#
+# Why: with no --state-file this script used to print "no run to check" and
+# exit 0. On a clean clone, on CI, and on any machine that had not just
+# finished a pipeline run - which is nearly always - the gate for Locked
+# decision 30 therefore asserted nothing while reporting success. A gate whose
+# green tick means "I had nothing to look at" is indistinguishable from one
+# that passed, and this suite had three of those.
 #
 # stdout: human-readable summary only. stderr: empty in normal operation.
 
 set -euo pipefail
 
 STATE_FILE="${HOME}/.claude/state/run/latest.json"
+STATE_FILE_EXPLICIT=0
 
 while [ "$#" -gt 0 ]; do
   case "$1" in
@@ -31,16 +41,19 @@ while [ "$#" -gt 0 ]; do
         exit 2
       fi
       STATE_FILE="$1"
+      STATE_FILE_EXPLICIT=1
       shift
       ;;
     --state-file=*)
       STATE_FILE="${1#--state-file=}"
+      STATE_FILE_EXPLICIT=1
       shift
       ;;
     -h|--help)
       echo "Usage: $0 [--state-file <path>]"
       echo ""
-      echo "Default state file: ~/.claude/state/run/latest.json"
+      echo "No arguments: run the fixture self-test suite."
+      echo "Default state file when checking live: ~/.claude/state/run/latest.json"
       exit 0
       ;;
     *)
@@ -55,9 +68,75 @@ if ! command -v jq >/dev/null 2>&1; then
   exit 2
 fi
 
+# ── self-test mode ─────────────────────────────────────────────────────────
+if [ "$STATE_FILE_EXPLICIT" -eq 0 ]; then
+  SELF="$0"
+  TMP=$(mktemp -d)
+  trap 'rm -rf "$TMP"' EXIT
+  PASS=0
+  FAIL=0
+
+  expect() {
+    local name="$1" want="$2" file="$3"
+    local got=0
+    bash "$SELF" --state-file "$file" >/dev/null 2>&1 || got=$?
+    if [ "$got" -eq "$want" ]; then
+      PASS=$((PASS + 1)); echo "  ✓ $name (exit $got)"
+    else
+      FAIL=$((FAIL + 1)); echo "  ✗ $name (exit $got, expected $want)"
+    fi
+  }
+
+  echo "→ Locked decision 30 gate, fixture self-test"
+
+  printf '%s' '{"telemetry":{"mcpCalls":[{"tool":"mcp__figma__get_design_context","phase":1}]}}' \
+    > "$TMP/phase1-only.json"
+  expect "MCP call in Phase 1 passes" 0 "$TMP/phase1-only.json"
+
+  printf '%s' '{"telemetry":{"mcpCalls":[{"tool":"mcp__figma__get_design_context","phase":3}]}}' \
+    > "$TMP/phase3.json"
+  expect "MCP call in Phase 3 is a violation" 1 "$TMP/phase3.json"
+
+  printf '%s' '{"telemetry":{"mcpCalls":[{"tool":"a","phase":1},{"tool":"b","phase":2}]}}' \
+    > "$TMP/mixed.json"
+  expect "one violation among clean entries still fails" 1 "$TMP/mixed.json"
+
+  printf '%s' '{"telemetry":{"mcpCalls":[]}}' > "$TMP/empty.json"
+  expect "empty call list passes" 0 "$TMP/empty.json"
+
+  printf '%s' '{"telemetry":{}}' > "$TMP/no-field.json"
+  expect "absent telemetry.mcpCalls passes (older state format)" 0 "$TMP/no-field.json"
+
+  printf '%s' '{"telemetry":{"mcpCalls":[{"tool":"a"}]}}' > "$TMP/no-phase.json"
+  expect "entry with no phase defaults to Phase 0 and passes" 0 "$TMP/no-phase.json"
+
+  printf '%s' 'not json at all' > "$TMP/corrupt.json"
+  expect "corrupt state is an error, never a silent pass" 2 "$TMP/corrupt.json"
+
+  expect "missing state file is an error in check mode" 2 "$TMP/does-not-exist.json"
+
+  # The live run, when there is one. Absence is not a failure here - the
+  # fixtures above already proved the gate works.
+  if [ -f "$STATE_FILE" ]; then
+    echo "→ live state file"
+    if bash "$SELF" --state-file "$STATE_FILE"; then
+      PASS=$((PASS + 1)); echo "  ✓ live run clean"
+    else
+      FAIL=$((FAIL + 1)); echo "  ✗ live run has violations"
+    fi
+  else
+    echo "→ live state file: none at $STATE_FILE (fixtures already exercised every path)"
+  fi
+
+  echo ""
+  echo "══ smoke-no-mcp-in-dev-phases: $PASS passed, $FAIL failed ══"
+  [ "$FAIL" -gt 0 ] && exit 1 || exit 0
+fi
+
+# ── check mode ─────────────────────────────────────────────────────────────
 if [ ! -f "$STATE_FILE" ]; then
-  echo "WARN: state file not found at $STATE_FILE - no run to check"
-  exit 0
+  echo "FAIL: state file not found at $STATE_FILE"
+  exit 2
 fi
 
 # Validate JSON parse first; corrupt state cannot be silently passed.

package/pipeline/scripts/smoke-own-punctuation.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+#
+# smoke-own-punctuation.sh  -  the punctuation rule applies to this repo's own
+# shipped files, not only to the documents it generates.
+#
+# validate-analysis-doc.mjs has enforced the locked policy (no em-dash, en-dash,
+# ellipsis or section sign) on generated analysis documents for a long time,
+# and smoke-generate-issue.sh / smoke-review-readiness.sh enforce it on issue
+# and review payloads. Nothing applied it to the pipeline's own tree, so 77
+# shipped files carried 719 em-dashes, 10 en-dashes and 24 ellipses while the
+# rule was described as enforced.
+#
+# ALLOWED holds the files that carry these characters as data rather than
+# prose: the detector's own table and the grep patterns that look for them.
+# Stripping those would disable the very checks this rule depends on. Every
+# entry needs a reason, and the list is expected to stay this short.
+#
+# Exit codes: 0=clean, 1=violations
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+# file path -> why the characters are legitimately present
+ALLOWED_PATHS="
+pipeline/scripts/validate-analysis-doc.mjs|the detector's own table of banned characters
+pipeline/scripts/smoke-generate-issue.sh|greps for the banned characters
+pipeline/scripts/smoke-review-readiness.sh|greps for the banned characters
+pipeline/scripts/smoke-md2confluence.sh|dirty-input fixture plus the forbidden list
+pipeline/scripts/smoke-own-punctuation.sh|this file names the characters it bans
+pipeline/lib/md2confluence-v3.py|the converter's codepoint-to-ASCII mapping table
+"
+
+# The same characters written as escapes. prefs.schema.json carried 50 of them
+# in its descriptions and was invisible to a search for the literal character,
+# so the first version of this gate passed it. A rule that only sees one
+# encoding of what it bans is not enforcing the rule.
+ESCAPED='\\u2014|\\u2013|\\u2026|\\u00a7'
+
+is_allowed() {
+  printf '%s\n' "$ALLOWED_PATHS" | grep -q "^$1|"
+}
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
+
+echo "→ 1. no em-dash, en-dash, ellipsis or section sign in shipped files"
+
+# CHANGELOG history is left as written; rewriting released notes to satisfy a
+# later style rule would falsify the record.
+VIOLATIONS=""
+while IFS= read -r f; do
+  case "$f" in CHANGELOG*.md) continue ;; esac
+  is_allowed "$f" && continue
+  VIOLATIONS="${VIOLATIONS}${f}\n"
+done < <(git grep -lI -e $'—' -e $'–' -e $'…' -e $'§' -- . 2>/dev/null || true)
+
+if [ -z "$VIOLATIONS" ]; then
+  pass "no banned punctuation outside the allowlist"
+else
+  COUNT=$(printf '%b' "$VIOLATIONS" | grep -c . || true)
+  fail "$COUNT file(s) carry banned punctuation"
+  printf '%b' "$VIOLATIONS" | sed 's/^/    /'
+  echo "    fix: plain ASCII - or : or parentheses; 'section 4' rather than the sign"
+fi
+
+echo "→ 2. same characters written as unicode escapes"
+ESC_VIOLATIONS=""
+while IFS= read -r f; do
+  case "$f" in CHANGELOG*.md) continue ;; esac
+  is_allowed "$f" && continue
+  ESC_VIOLATIONS="${ESC_VIOLATIONS}${f}\n"
+done < <(git grep -lI -E "$ESCAPED" -- . 2>/dev/null || true)
+
+if [ -z "$ESC_VIOLATIONS" ]; then
+  pass "no escaped forms outside the allowlist"
+else
+  COUNT=$(printf '%b' "$ESC_VIOLATIONS" | grep -c . || true)
+  fail "$COUNT file(s) carry the banned characters as unicode escapes"
+  printf '%b' "$ESC_VIOLATIONS" | sed 's/^/    /'
+fi
+
+echo "→ 3. every allowlist entry still exists and still needs the exemption"
+while IFS='|' read -r path reason; do
+  [ -z "$path" ] && continue
+  if [ ! -f "$path" ]; then
+    fail "allowlisted path no longer exists: $path"
+  elif ! grep -qI -e $'—' -e $'–' -e $'…' -e $'§' "$path" 2>/dev/null \
+    && ! grep -qIE "$ESCAPED" "$path" 2>/dev/null; then
+    # Either encoding justifies the entry: md2confluence-v3.py holds them as
+    # escapes, the detector table holds them literally.
+    fail "$path is allowlisted ($reason) but is now clean - drop it from the list"
+  else
+    pass "allowlist justified: ${path##*/} ($reason)"
+  fi
+done < <(printf '%s\n' "$ALLOWED_PATHS" | grep '|')
+
+echo ""
+echo "══ smoke-own-punctuation: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -gt 0 ] && exit 1 || exit 0

package/pipeline/scripts/smoke-per-repo-memory.sh

@@ -35,7 +35,7 @@ repo="$sandbox/repo"
 mkdir -p "$repo"
 
 # --- 1: pref off → silent exit 0 ---
-printf '{"global":{"perRepoMemory":false}}' > "$HOME/.claude/preferences.json"
+printf '{"global":{"perRepoMemory":false}}' > "$HOME/.claude/multi-agent-preferences.json"
 out=$(bash "$LOAD" "$repo" 2>&1 || true)
 if [ -z "$out" ]; then
   record_pass "load exits silent when pref off"
@@ -44,7 +44,7 @@ else
 fi
 
 # --- 2: pref on + no memory → silent exit 0 ---
-printf '{"global":{"perRepoMemory":true}}' > "$HOME/.claude/preferences.json"
+printf '{"global":{"perRepoMemory":true}}' > "$HOME/.claude/multi-agent-preferences.json"
 out=$(bash "$LOAD" "$repo" 2>&1 || true)
 if [ -z "$out" ]; then
   record_pass "load exits silent when pref on but no memory present"

package/pipeline/scripts/smoke-review-readiness.sh

@@ -21,6 +21,7 @@ SK_J="$ROOT/pipeline/skills/shared/core/multi-agent-review-jira/SKILL.md"
 SK_I="$ROOT/pipeline/skills/shared/core/multi-agent-review-issue/SKILL.md"
 DISPATCHER="$ROOT/pipeline/commands/multi-agent/SKILL.md"
 CONTRACT="$ROOT/pipeline/multi-agent-refs/cross-cli-contract.md"
+CMD_COUNT=$(find "$ROOT/pipeline/commands/multi-agent" -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')
 HELP="$ROOT/pipeline/commands/multi-agent/help/SKILL.md"
 
 PASS=0; FAIL=0
@@ -61,12 +62,12 @@ grep -Fqi "confirm" "$REF" && pass "ref has confirm-before-post gate" || fail "r
 grep -Fqi "rubric" "$REF" && pass "ref has readiness rubric" || fail "ref missing rubric"
 
 echo ""
-echo "→ 5. registration + count (38)"
+echo "→ 5. registration + count (derived)"
 grep -Fq '| `review-jira ' "$DISPATCHER" && pass "dispatcher desc: review-jira" || fail "dispatcher desc missing review-jira"
 grep -Fq '| `review-issue ' "$DISPATCHER" && pass "dispatcher desc: review-issue" || fail "dispatcher desc missing review-issue"
 grep -Fq "review-jira/SKILL.md" "$DISPATCHER" && pass "dispatcher routing: review-jira" || fail "dispatcher routing missing review-jira"
 grep -Fq "review-issue/SKILL.md" "$DISPATCHER" && pass "dispatcher routing: review-issue" || fail "dispatcher routing missing review-issue"
-grep -Fq "## 1. Command Inventory (41 commands)" "$CONTRACT" && pass "contract count = 41" || fail "contract count wrong"
+grep -Fq "## 1. Command Inventory ($CMD_COUNT commands)" "$CONTRACT" && pass "contract count = $CMD_COUNT (derived)" || fail "contract count wrong"
 grep -Eq '(^|[ ,])review-jira([ ,]|$)' "$CONTRACT" && pass "contract inventory has review-jira" || fail "contract missing review-jira"
 grep -Eq '(^|[ ,])review-issue([ ,]|$)' "$CONTRACT" && pass "contract inventory has review-issue" || fail "contract missing review-issue"
 grep -Fq "multi-agent:review-jira" "$HELP" && pass "help lists review-jira" || fail "help missing review-jira"

package/pipeline/scripts/smoke-schema-validation.sh

@@ -87,17 +87,31 @@ done
 
 # ──────────────────────────────────────────────────────────────────────────
 echo ""
-echo "→ 4. prefs.schema.json  -  keychainMapping has 12 services"
+echo "→ 4. prefs.schema.json  -  keychainMapping covers every resolved service"
+# A floor, not a pin: new credentials get added over time, and pinning the count
+# made every addition a false failure. What matters is that the keys shipped
+# flows resolve are all declared.
 KM_COUNT=$(node -e "
   const s = JSON.parse(require('fs').readFileSync('$PREFS_SCHEMA', 'utf8'));
   const km = s.properties.global.properties.keychainMapping.properties;
   console.log(Object.keys(km).length);
 " 2>/dev/null)
-EXPECTED_SERVICES=13  # 12 + legacy "bitbucket" alias
-if [ "$KM_COUNT" = "$EXPECTED_SERVICES" ] || [ "$KM_COUNT" = "12" ]; then
-  pass "keychainMapping has $KM_COUNT services (≥12 expected)"
+if [ "${KM_COUNT:-0}" -ge 12 ] 2>/dev/null; then
+  pass "keychainMapping declares $KM_COUNT services (≥12 expected)"
 else
-  fail "keychainMapping has $KM_COUNT services, expected ≥12"
+  fail "keychainMapping declares ${KM_COUNT:-0} services, expected ≥12"
+fi
+
+MISSING_KEYS=$(node -e "
+  const s = JSON.parse(require('fs').readFileSync('$PREFS_SCHEMA', 'utf8'));
+  const km = Object.keys(s.properties.global.properties.keychainMapping.properties);
+  const required = ['jira','bitbucket_token','bitbucket_user','github','confluence','figma','figma_pat','figma_mcp','firebase','npm'];
+  console.log(required.filter((k) => !km.includes(k)).join(','));
+" 2>/dev/null)
+if [ -z "$MISSING_KEYS" ]; then
+  pass "every credential the pipeline resolves is declared"
+else
+  fail "keychainMapping missing declared-and-used key(s): $MISSING_KEYS"
 fi
 
 # ──────────────────────────────────────────────────────────────────────────

package/pipeline/scripts/smoke-shadow-git.sh

@@ -59,7 +59,9 @@ fi
 
 # 4-9. Lifecycle on a temp project
 TMP=$(mktemp -d)
-cd "$TMP"
+# A failed cd here would run the relative `rm -rf DerivedData` below in the
+# caller's directory instead of the sandbox.
+cd "$TMP" || { record_fail "cannot cd into sandbox $TMP"; exit 1; }
 git init --quiet
 echo "node_modules/" > .gitignore
 echo "hello" > a.txt
@@ -178,7 +180,7 @@ else
   record_fail "~/.claude/state is GONE after unsafe prune attempts"
 fi
 
-cd - >/dev/null
+cd - >/dev/null || true
 rm -rf "$TMP"
 
 # 10-12. Prefs schema

package/pipeline/scripts/smoke-workflow-audit.sh

@@ -4,20 +4,38 @@
 # `.github/workflows/` with the two dedicated external linters:
 #
 #   - zizmor      GitHub Actions security auditor (template injection,
-#                 credential persistence, unpinned actions, ...). Runs in
-#                 offline mode so the smoke never touches the network.
+#                 credential persistence, cache poisoning, unpinned actions,
+#                 excessive permissions, ...). Runs offline, no network.
 #   - actionlint  workflow correctness linter (expression syntax, matrix
 #                 typos, shellcheck of run: blocks, ...).
 #
-# Both tools are optional: each is skipped with a SKIP line when its binary
-# is not on PATH (billing-friendly CI runners install neither; run locally
-# via `brew install zizmor actionlint` for full coverage). Structural
-# baseline checks that need no external binary live in
-# smoke-ci-workflows.sh - this smoke is the deeper, tool-backed layer.
-#
 # Any finding from either tool fails the smoke.
 #
-# Exit codes: 0=pass or all tools skipped, 1=findings, 2=workflows missing
+# WHY THIS IS STRICT BY DEFAULT
+#
+# Until now a missing binary produced a SKIP and the smoke exited 0, so it
+# reported "0 passed, 0 failed, 2 skipped" on the dev machine AND on the CI
+# runner - neither had the tools. ci-lite.yml justified not installing them by
+# saying to run the smoke locally "where the tools exist", but they did not
+# exist there either. The audit had therefore never run anywhere, while
+# appearing as a green step. When it was finally run it found nine real issues,
+# one of them high severity (a dependency cache restored into the job that
+# signs and publishes the release tarball).
+#
+# So the failure mode is inverted: absent tooling is a failure, and skipping is
+# something you opt into deliberately and locally.
+#
+#   brew install zizmor actionlint            # macOS
+#   pipx install zizmor && go install github.com/rhysd/actionlint/cmd/actionlint@latest
+#
+# WORKFLOW_AUDIT_ALLOW_MISSING=1 downgrades a missing binary back to a SKIP for
+# a local run. It is ignored when CI is set: CI installs both, pinned, and a
+# runner that cannot must fail loudly rather than pass quietly.
+#
+# Structural baseline checks that need no external binary live in
+# smoke-ci-workflows.sh - this smoke is the deeper, tool-backed layer.
+#
+# Exit codes: 0=pass, 1=findings or missing tooling, 2=workflows missing
 
 set -uo pipefail
 
@@ -26,6 +44,10 @@ WF_DIR="$REPO_ROOT/.github/workflows"
 
 [ -d "$WF_DIR" ] || { echo "FAIL: .github/workflows/ missing"; exit 2; }
 
+# In CI the escape hatch does not apply, whatever the environment says.
+ALLOW_MISSING="${WORKFLOW_AUDIT_ALLOW_MISSING:-0}"
+[ -n "${CI:-}" ] && ALLOW_MISSING=0
+
 PASS=0
 FAIL=0
 SKIPPED=0
@@ -33,6 +55,16 @@ pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
 fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
 skip() { SKIPPED=$((SKIPPED + 1)); echo "  ↷ SKIP: $1"; }
 
+# A tool that is not installed is a failure unless a local run opted out.
+missing_tool() {
+  local tool="$1" install="$2"
+  if [ "$ALLOW_MISSING" = "1" ]; then
+    skip "$tool not on PATH, WORKFLOW_AUDIT_ALLOW_MISSING=1 ($install)"
+  else
+    fail "$tool not on PATH - the audit cannot run ($install)"
+  fi
+}
+
 # ──────────────────────────────────────────────────────────────────────────
 echo "→ 1. zizmor (security audit, offline)"
 if command -v zizmor >/dev/null 2>&1; then
@@ -48,7 +80,7 @@ if command -v zizmor >/dev/null 2>&1; then
     echo "$OUT" | sed 's/^/    /'
   fi
 else
-  skip "zizmor not on PATH (brew install zizmor)"
+  missing_tool zizmor "brew install zizmor"
 fi
 
 # ──────────────────────────────────────────────────────────────────────────
@@ -61,7 +93,7 @@ if command -v actionlint >/dev/null 2>&1; then
     echo "$OUT" | sed 's/^/    /'
   fi
 else
-  skip "actionlint not on PATH (brew install actionlint)"
+  missing_tool actionlint "brew install actionlint"
 fi
 
 echo ""

package/pipeline/scripts/smoke-write-state.sh

@@ -93,21 +93,65 @@ else
 fi
 
 # 10. Concurrent writers don't corrupt state
+#
+# Was 5 writers, which lost an update roughly one run in five on a loaded
+# machine and never on an idle one, so it read as a flaky test rather than the
+# data-loss bug it was. 20 writers puts enough writers in the acquire window to
+# make a regression show up on an idle machine too.
 STATE2="$TMPDIR/concurrent.json"
+WRITERS=20
 echo '{"counter":0}' | node "$WRITER" "$STATE2"
-for i in 1 2 3 4 5; do
+for i in $(seq 1 "$WRITERS"); do
   echo "{\"w$i\":$i}" | node "$WRITER" "$STATE2" &
 done
 wait
-# All 5 keys should be present (deep merge)
 MISSING=0
-for i in 1 2 3 4 5; do
+for i in $(seq 1 "$WRITERS"); do
   grep -q "\"w$i\": $i" "$STATE2" || MISSING=$((MISSING+1))
 done
 if [ "$MISSING" -eq 0 ]; then
-  pass "5 concurrent writers all persisted"
+  pass "$WRITERS concurrent writers all persisted"
 else
-  fail "$MISSING concurrent writes lost"
+  fail "$MISSING of $WRITERS concurrent writes lost"
+fi
+
+# 11. A lock with no readable PID must not be treated as stale
+#
+# This is the exact shape of the bug above. The lock used to be created empty
+# and filled on the next line, so a writer that arrived in between read an
+# unparseable PID, called the lock stale, and deleted it while its owner was
+# still working. Both then wrote and one update vanished.
+#
+# An empty lock now has to block until the staleness window elapses, so a
+# writer given a 1s acquire budget must give up with exit 2 rather than help
+# itself to the lock.
+STATE3="$TMPDIR/emptylock.json"
+echo '{"seed":1}' | node "$WRITER" "$STATE3"
+: > "$STATE3.lock"
+LOCK_RC=0
+echo '{"stolen":true}' | WRITE_STATE_LOCK_TIMEOUT_MS=1000 WRITE_STATE_LOCK_STALE_MS=30000 \
+  node "$WRITER" "$STATE3" >/dev/null 2>&1 || LOCK_RC=$?
+if [ "$LOCK_RC" -eq 2 ] && ! grep -q '"stolen"' "$STATE3"; then
+  pass "empty lock is not stolen (exit 2, state untouched)"
+else
+  fail "empty lock was treated as stale (exit $LOCK_RC) - the live-lock race is back"
+fi
+rm -f "$STATE3.lock"
+
+# 12. A lock older than the staleness window is still reclaimed
+#
+# The counterpart to 11: refusing to reclaim an unreadable PID must not mean a
+# genuinely abandoned lock blocks forever.
+STATE4="$TMPDIR/stalelock.json"
+echo '{"seed":1}' | node "$WRITER" "$STATE4"
+: > "$STATE4.lock"
+STALE_RC=0
+echo '{"recovered":true}' | WRITE_STATE_LOCK_TIMEOUT_MS=3000 WRITE_STATE_LOCK_STALE_MS=1 \
+  node "$WRITER" "$STATE4" >/dev/null 2>&1 || STALE_RC=$?
+if [ "$STALE_RC" -eq 0 ] && grep -q '"recovered"' "$STATE4"; then
+  pass "abandoned lock past the staleness window is reclaimed"
+else
+  fail "stale lock not reclaimed (exit $STALE_RC) - writers would wedge"
 fi
 
 echo ""

package/pipeline/scripts/test-gap-rules/android.json

@@ -5,20 +5,20 @@
   "sourceExtensions": [".kt", ".java"],
   "testPathSuffixes": ["Test.kt", "Tests.kt", "Test.java"],
   "testPathContains": ["/src/test/", "/src/androidTest/", "/test/", "/tests/"],
-  "excludePathGlobs": [
-    "build/", ".gradle/", "generated/",
-    "**/BuildConfig.java", "**/R.java"
-  ],
+  "excludePathGlobs": ["build/", ".gradle/", "generated/", "**/BuildConfig.java", "**/R.java"],
   "publicApiPatterns": [
-    {"id": "open_class", "regex": "\\bopen\\s+class\\s+([A-Z][A-Za-z0-9_]*)"},
-    {"id": "open_fun",   "regex": "\\bopen\\s+fun\\s+([a-z_][A-Za-z0-9_]*)"},
-    {"id": "public_fun", "regex": "^\\s*(?:public\\s+)?fun\\s+([a-z_][A-Za-z0-9_]*)"},
-    {"id": "public_class", "regex": "^\\s*(?:public\\s+)?class\\s+([A-Z][A-Za-z0-9_]*)"},
-    {"id": "jvmstatic",  "regex": "@JvmStatic\\b"},
-    {"id": "interface",  "regex": "^\\s*(?:public\\s+)?interface\\s+([A-Z][A-Za-z0-9_]*)"}
+    { "id": "open_class", "regex": "\\bopen\\s+class\\s+([A-Z][A-Za-z0-9_]*)" },
+    { "id": "open_fun", "regex": "\\bopen\\s+fun\\s+([a-z_][A-Za-z0-9_]*)" },
+    { "id": "public_fun", "regex": "^\\s*(?:public\\s+)?fun\\s+([a-z_][A-Za-z0-9_]*)" },
+    { "id": "public_class", "regex": "^\\s*(?:public\\s+)?class\\s+([A-Z][A-Za-z0-9_]*)" },
+    { "id": "jvmstatic", "regex": "@JvmStatic\\b" },
+    { "id": "interface", "regex": "^\\s*(?:public\\s+)?interface\\s+([A-Z][A-Za-z0-9_]*)" }
   ],
   "composablePatterns": [
-    {"id": "composable_fun", "regex": "@Composable\\s+(?:public\\s+|internal\\s+)?fun\\s+([A-Z][A-Za-z0-9_]*)"}
+    {
+      "id": "composable_fun",
+      "regex": "@Composable\\s+(?:public\\s+|internal\\s+)?fun\\s+([A-Z][A-Za-z0-9_]*)"
+    }
   ],
   "expectedTestKindsForComposable": ["compose-ui-test"],
   "hint": "Cover @Composable functions with createComposeRule() + onNodeWithText/Tag/ContentDescription assertions; ViewModels with runTest + Turbine."

package/pipeline/scripts/test-gap-rules/ios.json

@@ -6,22 +6,27 @@
   "testPathSuffixes": ["Tests.swift", "Test.swift"],
   "testPathContains": ["/Tests/", "/UnitTests/", "/SnapshotTests/"],
   "excludePathGlobs": [
-    "Pods/", "Carthage/", ".build/", "DerivedData/",
-    "Generated/", "Sourcery/", "_Generated.swift",
+    "Pods/",
+    "Carthage/",
+    ".build/",
+    "DerivedData/",
+    "Generated/",
+    "Sourcery/",
+    "_Generated.swift",
     "Tests/Fixtures/"
   ],
   "publicApiPatterns": [
-    {"id": "public_func",   "regex": "\\bpublic\\s+func\\s+([A-Za-z_][A-Za-z0-9_]*)"},
-    {"id": "public_class",  "regex": "\\bpublic\\s+(?:final\\s+)?class\\s+([A-Z][A-Za-z0-9_]*)"},
-    {"id": "public_struct", "regex": "\\bpublic\\s+struct\\s+([A-Z][A-Za-z0-9_]*)"},
-    {"id": "public_enum",   "regex": "\\bpublic\\s+enum\\s+([A-Z][A-Za-z0-9_]*)"},
-    {"id": "public_proto",  "regex": "\\bpublic\\s+protocol\\s+([A-Z][A-Za-z0-9_]*)"},
-    {"id": "public_init",   "regex": "\\bpublic\\s+init\\b"},
-    {"id": "objc_export",   "regex": "@objc(?:Members)?\\s+(?:public\\s+)?(?:func|class|var)"}
+    { "id": "public_func", "regex": "\\bpublic\\s+func\\s+([A-Za-z_][A-Za-z0-9_]*)" },
+    { "id": "public_class", "regex": "\\bpublic\\s+(?:final\\s+)?class\\s+([A-Z][A-Za-z0-9_]*)" },
+    { "id": "public_struct", "regex": "\\bpublic\\s+struct\\s+([A-Z][A-Za-z0-9_]*)" },
+    { "id": "public_enum", "regex": "\\bpublic\\s+enum\\s+([A-Z][A-Za-z0-9_]*)" },
+    { "id": "public_proto", "regex": "\\bpublic\\s+protocol\\s+([A-Z][A-Za-z0-9_]*)" },
+    { "id": "public_init", "regex": "\\bpublic\\s+init\\b" },
+    { "id": "objc_export", "regex": "@objc(?:Members)?\\s+(?:public\\s+)?(?:func|class|var)" }
   ],
   "swiftUiViewPatterns": [
-    {"id": "view_struct",     "regex": "struct\\s+([A-Z][A-Za-z0-9_]*)\\s*:\\s*View\\b"},
-    {"id": "config_struct",   "regex": "struct\\s+([A-Z][A-Za-z0-9_]*Configuration)\\b"}
+    { "id": "view_struct", "regex": "struct\\s+([A-Z][A-Za-z0-9_]*)\\s*:\\s*View\\b" },
+    { "id": "config_struct", "regex": "struct\\s+([A-Z][A-Za-z0-9_]*Configuration)\\b" }
   ],
   "expectedTestKindsForView": ["snapshot", "viewinspector", "unit"],
   "snapshotPathHints": ["SnapshotTests", "__Snapshots__"],

package/pipeline/scripts/test-gap-rules/node.json

@@ -3,15 +3,27 @@
   "stack": "node",
   "description": "Node.js / TypeScript test gap rules. Sources in *.ts/*.tsx/*.js/*.mjs; tests in *.test.* / *.spec.* / __tests__/.",
   "sourceExtensions": [".ts", ".tsx", ".js", ".mjs", ".cjs"],
-  "testPathSuffixes": [".test.ts", ".test.tsx", ".test.js", ".test.mjs", ".spec.ts", ".spec.tsx", ".spec.js", ".spec.mjs"],
-  "testPathContains": ["/__tests__/", "/test/", "/tests/"],
-  "excludePathGlobs": [
-    "node_modules/", "dist/", "build/", ".next/", "coverage/",
-    "*.d.ts"
+  "testPathSuffixes": [
+    ".test.ts",
+    ".test.tsx",
+    ".test.js",
+    ".test.mjs",
+    ".spec.ts",
+    ".spec.tsx",
+    ".spec.js",
+    ".spec.mjs"
   ],
+  "testPathContains": ["/__tests__/", "/test/", "/tests/"],
+  "excludePathGlobs": ["node_modules/", "dist/", "build/", ".next/", "coverage/", "*.d.ts"],
   "publicApiPatterns": [
-    {"id": "named_export",   "regex": "^export\\s+(?:async\\s+)?(?:function|class|const|let|interface|type|enum)\\s+([A-Za-z_$][A-Za-z0-9_$]*)"},
-    {"id": "default_export", "regex": "^export\\s+default\\s+(?:async\\s+)?(?:function|class)\\s+([A-Za-z_$][A-Za-z0-9_$]*)"}
+    {
+      "id": "named_export",
+      "regex": "^export\\s+(?:async\\s+)?(?:function|class|const|let|interface|type|enum)\\s+([A-Za-z_$][A-Za-z0-9_$]*)"
+    },
+    {
+      "id": "default_export",
+      "regex": "^export\\s+default\\s+(?:async\\s+)?(?:function|class)\\s+([A-Za-z_$][A-Za-z0-9_$]*)"
+    }
   ],
   "hint": "Cover named exports with vitest/jest test('<name>', ...). React components: React Testing Library (render + screen + userEvent)."
 }

package/pipeline/scripts/test-gap-rules/python.json

@@ -7,13 +7,19 @@
   "testPathPrefixes": ["test_"],
   "testPathContains": ["/tests/", "/test/"],
   "excludePathGlobs": [
-    "__pycache__/", ".venv/", "venv/", ".tox/", "build/", "dist/", "*.egg-info/",
+    "__pycache__/",
+    ".venv/",
+    "venv/",
+    ".tox/",
+    "build/",
+    "dist/",
+    "*.egg-info/",
     "**/migrations/**"
   ],
   "publicApiPatterns": [
-    {"id": "top_def",   "regex": "^def\\s+([a-z_][a-z0-9_]*)"},
-    {"id": "top_class", "regex": "^class\\s+([A-Z][A-Za-z0-9_]*)"},
-    {"id": "async_def", "regex": "^async\\s+def\\s+([a-z_][a-z0-9_]*)"}
+    { "id": "top_def", "regex": "^def\\s+([a-z_][a-z0-9_]*)" },
+    { "id": "top_class", "regex": "^class\\s+([A-Z][A-Za-z0-9_]*)" },
+    { "id": "async_def", "regex": "^async\\s+def\\s+([a-z_][a-z0-9_]*)" }
   ],
   "hint": "Cover with pytest test_<symbol> style. Async with pytest-asyncio. Avoid name collision with private helpers (prefix _)."
 }