@mmerterden/multi-agent-pipeline 12.6.0 → 12.8.0

package/pipeline/scripts/smoke-plugin-validate.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-#
-# smoke-plugin-validate.sh  -  run `claude plugin validate --strict` against
-# every plugin / marketplace surface committed to this repo.
-#
-# Discovery: any directory containing `.claude-plugin/plugin.json` or
-# `.claude-plugin/marketplace.json` (node_modules excluded). The `claude`
-# CLI validates the containing directory; --strict promotes warnings
-# (unrecognized fields, missing metadata) to failures so CI catches drift
-# the runtime would silently tolerate.
-#
-# Skip semantics (exit 0 with a SKIP line):
-#   - `claude` binary not on PATH (optional tooling; billing-friendly CI
-#     runners don't install it)
-#   - no validatable surface in the repo (the marketplace plugins live in
-#     the separate multi-agent-plugins repo; this repo may carry none)
-#
-# Exit codes: 0=pass or skip, 1=validation failure
-
-set -uo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-
-if ! command -v claude >/dev/null 2>&1; then
-  echo "SKIP smoke-plugin-validate: claude binary not on PATH"
-  exit 0
-fi
-
-# Each hit is a manifest; the validatable surface is its .claude-plugin parent's parent.
-MANIFESTS=$(find "$REPO_ROOT" \
-  -path "$REPO_ROOT/node_modules" -prune -o \
-  -path "$REPO_ROOT/coverage" -prune -o \
-  -type f -path '*/.claude-plugin/*' \( -name plugin.json -o -name marketplace.json \) -print \
-  2>/dev/null | sort)
-
-if [ -z "$MANIFESTS" ]; then
-  echo "SKIP smoke-plugin-validate: no .claude-plugin plugin/marketplace manifest in this repo"
-  exit 0
-fi
-
-PASS=0
-FAIL=0
-pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
-
-# Validate each surface directory once, even if it carries both manifests.
-SURFACES=$(echo "$MANIFESTS" | sed 's|/\.claude-plugin/[^/]*$||' | sort -u)
-
-for surface in $SURFACES; do
-  rel="${surface#"$REPO_ROOT"/}"
-  [ "$surface" = "$REPO_ROOT" ] && rel="."
-  echo ""
-  echo "→ claude plugin validate --strict $rel"
-  if OUT=$(claude plugin validate --strict "$surface" 2>&1); then
-    pass "$rel validates clean (strict)"
-  else
-    fail "$rel failed strict validation"
-    echo "$OUT" | sed 's/^/    /'
-  fi
-done
-
-echo ""
-echo "══ smoke-plugin-validate: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -gt 0 ] && exit 1 || exit 0

package/pipeline/scripts/smoke-pr-review-actions.sh

@@ -1,152 +0,0 @@
-#!/usr/bin/env bash
-#
-# smoke-pr-review-actions.sh
-#
-# Asserts the review-actions contract is wired correctly: the new channel
-# doc, the orchestrator, the decision rule, both languages, the github +
-# bitbucket-server provider switch, and the absence of the legacy monolith
-# comment artifacts.
-#
-# This is a lint, not a behavioural test. Behavioural drift is caught at
-# runtime by the chat summary + the actual PR state on the provider.
-
-set -euo pipefail
-
-SELF_DIR=$(cd "$(dirname "$0")" && pwd)
-PIPELINE_ROOT=$(cd "$SELF_DIR/.." && pwd)
-
-cd "$PIPELINE_ROOT"
-
-FAIL=0
-
-CHANNEL="multi-agent-refs/channels/pr-review-actions.md"
-REVIEW="commands/multi-agent/review/SKILL.md"
-POSTER="lib/post-pr-review.sh"
-
-# 1. New canonical template + new poster exist.
-if [ ! -f "$CHANNEL" ]; then
-  echo "FAIL [smoke-pr-review-actions]: $CHANNEL missing"
-  exit 1
-fi
-if [ ! -x "$POSTER" ]; then
-  echo "FAIL [smoke-pr-review-actions]: $POSTER missing or not executable"
-  FAIL=$((FAIL + 1))
-fi
-
-# 2. Legacy monolith artifacts must not exist or be referenced.
-LEGACY_TEMPLATE="multi-agent-refs/channels/pr-review-comment.md"
-LEGACY_RENDERER="lib/render-pr-review-body.sh"
-if [ -e "$LEGACY_TEMPLATE" ]; then
-  echo "FAIL [smoke-pr-review-actions]: $LEGACY_TEMPLATE must not exist (monolith comment template forbidden)"
-  FAIL=$((FAIL + 1))
-fi
-if [ -e "$LEGACY_RENDERER" ]; then
-  echo "FAIL [smoke-pr-review-actions]: $LEGACY_RENDERER must not exist (monolith comment renderer forbidden)"
-  FAIL=$((FAIL + 1))
-fi
-# Reference scan  -  no spec files should still WIRE the legacy artifacts.
-# Match only call-site patterns (bash <path>, --body-file <path>), NOT prose
-# references. Migration notes like "render-pr-review-body.sh is GONE" are
-# allowed; an actual `bash render-pr-review-body.sh` call is not.
-LEAK=$(grep -rEl '(bash|sh|source) [^ ]*render-pr-review-body\.sh|--body-file [^ ]*pr-review-comment\.md' \
-     commands/ lib/ scripts/ 2>/dev/null \
-   | grep -v "$(basename "$0")" \
-   | grep -v "CHANGELOG\." \
-   | head -1 || true)
-if [ -n "$LEAK" ]; then
-  echo "FAIL [smoke-pr-review-actions]: stale call-site to legacy artifact in: $LEAK"
-  FAIL=$((FAIL + 1))
-fi
-
-# 3. Decision rule is documented verbatim in the channel doc.
-declare -a DECISION_ANCHORS=(
-  "0 accepted blocking AND 0 accepted important"
-  "≥1 accepted blocking OR ≥1 accepted important"
-  "Suggestions never block"
-  "APPROVE"
-  "NEEDS_WORK"
-)
-for a in "${DECISION_ANCHORS[@]}"; do
-  if ! grep -qF "$a" "$CHANNEL" "$REVIEW"; then
-    echo "FAIL [smoke-pr-review-actions]: decision rule anchor missing across $CHANNEL + $REVIEW: $a"
-    FAIL=$((FAIL + 1))
-  fi
-done
-
-# 4. Both languages render  -  the template documents tr + en shapes.
-if ! grep -qE 'outputLanguage *= *"tr"|Turkish \(outputLanguage' "$CHANNEL"; then
-  echo "FAIL [smoke-pr-review-actions]: $CHANNEL must document the tr inline-comment shape"
-  FAIL=$((FAIL + 1))
-fi
-if ! grep -qE 'outputLanguage *= *"en"|English \(outputLanguage' "$CHANNEL"; then
-  echo "FAIL [smoke-pr-review-actions]: $CHANNEL must document the en inline-comment shape"
-  FAIL=$((FAIL + 1))
-fi
-
-# 5. Provider switch covers github + bitbucket-server explicitly.
-declare -a PROVIDER_HINTS=(
-  "github"
-  "bitbucket-server"
-)
-for p in "${PROVIDER_HINTS[@]}"; do
-  if ! grep -qF "$p" "$REVIEW" "$CHANNEL" "$POSTER"; then
-    echo "FAIL [smoke-pr-review-actions]: provider '$p' missing across review.md + channel + poster"
-    FAIL=$((FAIL + 1))
-  fi
-done
-
-# 6. review.md wires post-pr-review.sh and references the new channel doc.
-if ! grep -qF "post-pr-review.sh" "$REVIEW"; then
-  echo "FAIL [smoke-pr-review-actions]: $REVIEW must wire post-pr-review.sh"
-  FAIL=$((FAIL + 1))
-fi
-if ! grep -qF "refs/channels/pr-review-actions.md" "$REVIEW"; then
-  echo "FAIL [smoke-pr-review-actions]: $REVIEW must reference refs/channels/pr-review-actions.md"
-  FAIL=$((FAIL + 1))
-fi
-
-# 7. post-pr-review.sh enforces the decision rule and the language axis.
-if ! grep -qF "outputLanguage" "$POSTER"; then
-  echo "FAIL [smoke-pr-review-actions]: $POSTER must read prefs.global.outputLanguage"
-  FAIL=$((FAIL + 1))
-fi
-if ! grep -qE 'DECISION=approve|DECISION=needs_work' "$POSTER"; then
-  echo "FAIL [smoke-pr-review-actions]: $POSTER must compute DECISION=approve|needs_work"
-  FAIL=$((FAIL + 1))
-fi
-if ! grep -qE '"status":"APPROVED"' "$POSTER"; then
-  echo "FAIL [smoke-pr-review-actions]: $POSTER must include the Bitbucket APPROVED participant payload"
-  FAIL=$((FAIL + 1))
-fi
-if ! grep -qE '"status":"NEEDS_WORK"' "$POSTER"; then
-  echo "FAIL [smoke-pr-review-actions]: $POSTER must include the Bitbucket NEEDS_WORK participant payload"
-  FAIL=$((FAIL + 1))
-fi
-
-# 8. No suggestion severity ever posts inline (hard prohibition in template).
-if ! grep -qE 'No suggestion-severity inline comments|Suggestions are chat-only|never get inline comments by default' "$CHANNEL"; then
-  echo "FAIL [smoke-pr-review-actions]: $CHANNEL must declare suggestions are chat-only (never inline)"
-  FAIL=$((FAIL + 1))
-fi
-if grep -qE 'severity.*suggestion.*inline' "$POSTER"; then
-  echo "FAIL [smoke-pr-review-actions]: $POSTER must NOT post suggestion-severity findings inline"
-  FAIL=$((FAIL + 1))
-fi
-
-# 9. Bitbucket URL parser is wired into review.md Step 1.
-if ! grep -qE 'bitbucket\.\*/projects/\*/repos/\*/pull-requests/\*' "$REVIEW"; then
-  echo "FAIL [smoke-pr-review-actions]: $REVIEW must parse bitbucket.* PR URLs in Step 1"
-  FAIL=$((FAIL + 1))
-fi
-if ! grep -qF "bbProjectKey" "$REVIEW"; then
-  echo "FAIL [smoke-pr-review-actions]: $REVIEW must persist bbProjectKey in agent-state.review.input"
-  FAIL=$((FAIL + 1))
-fi
-
-if [ "$FAIL" -gt 0 ]; then
-  echo ""
-  echo "smoke-pr-review-actions: $FAIL violation(s)."
-  exit 1
-fi
-
-echo "smoke-pr-review-actions: ok"

package/pipeline/scripts/smoke-pre-commit.sh

@@ -1,170 +0,0 @@
-#!/usr/bin/env bash
-# smoke-pre-commit.sh  -  verify pre-commit-check.sh catches all secret patterns.
-# Uses a real temp git repo to test the actual hook behavior end-to-end.
-# No mocks, no test-only flags  -  tests exactly what runs in production.
-
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-HOOK="$SCRIPT_DIR/pre-commit-check.sh"
-
-if [ ! -f "$HOOK" ]; then
-  echo "FAIL: pre-commit-check.sh not found at $HOOK" >&2
-  exit 1
-fi
-
-PASS=0
-FAIL=0
-
-pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
-
-TMPDIR=$(mktemp -d) || { echo "FAIL: mktemp" >&2; exit 1; }
-trap 'rm -rf "$TMPDIR"' EXIT
-
-# Bootstrap a real git repo with an initial commit
-git -C "$TMPDIR" init -q
-git -C "$TMPDIR" config user.email "test@test.com"
-git -C "$TMPDIR" config user.name "Test"
-echo "init" > "$TMPDIR/init.txt"
-git -C "$TMPDIR" add init.txt
-git -C "$TMPDIR" commit -q -m "init"
-
-# Stage a file with content and run the hook inside the temp repo
-stage_and_check() {
-  local filename="$1" content="$2"
-  echo "$content" > "$TMPDIR/$filename"
-  git -C "$TMPDIR" add "$filename"
-}
-
-reset_stage() {
-  git -C "$TMPDIR" reset -q HEAD -- . 2>/dev/null
-  git -C "$TMPDIR" checkout -q -- . 2>/dev/null
-  rm -f "$TMPDIR"/test-* "$TMPDIR"/.env* 2>/dev/null
-}
-
-run_hook() {
-  (cd "$TMPDIR" && bash "$HOOK") >/dev/null 2>&1
-  return $?
-}
-
-check_detects() {
-  local desc="$1" filename="$2" content="$3"
-  reset_stage
-  stage_and_check "$filename" "$content"
-  if run_hook; then
-    fail "$desc (hook passed, expected block)"
-  else
-    pass "$desc"
-  fi
-}
-
-check_passes() {
-  local desc="$1" filename="$2" content="$3"
-  reset_stage
-  stage_and_check "$filename" "$content"
-  if run_hook; then
-    pass "$desc"
-  else
-    fail "$desc (hook blocked, expected pass)"
-  fi
-}
-
-echo "→ 1. Secret pattern detection"
-
-check_detects "API key (api_key=long_string)" \
-  "test-file.swift" \
-  'let api_key = "ghp_aBcDeFgHiJkLmNoPqRsT1234567890"'
-
-check_detects "AWS access key (AKIA prefix)" \
-  "test-file.py" \
-  'aws_key = "AKIAIOSFODNN7EXAMPLE"'
-
-check_detects "RSA private key header" \
-  "test-file.pem" \
-  '-----BEGIN RSA PRIVATE KEY-----'
-
-check_detects "Generic private key header" \
-  "test-file.key" \
-  '-----BEGIN PRIVATE KEY-----'
-
-check_detects "EC private key header" \
-  "test-file.key" \
-  '-----BEGIN EC PRIVATE KEY-----'
-
-check_detects "GCP service account JSON" \
-  "test-file.json" \
-  '{"type": "service_account", "project_id": "my-project"}'
-
-check_detects "GitHub PAT (ghp_ 36 chars)" \
-  "test-file.txt" \
-  'token: ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789'
-
-check_detects "Slack token (xoxb-)" \
-  "test-file.txt" \
-  'slack = "xoxb-123456789012-abcdefghijklmnop"'
-
-check_detects "Google API key (AIza)" \
-  "test-file.txt" \
-  'gmaps = "AIzaSyA1234567890abcdefghijklmnopqrstuv"'
-
-check_detects "JWT three-segment token" \
-  "test-file.txt" \
-  'auth = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N"'
-
-check_detects "High-entropy custom secret (no known prefix)" \
-  "test-file.txt" \
-  'session = "Zx9Kq2Lm7Pw4Nv8Rt3Yb6Hc1Df5Gj0Sa2Wd7Qe4Uo9Ik"'
-
-check_detects "Secret in a filename WITH SPACES (no false-negative)" \
-  "test secret file.txt" \
-  'token: ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789'
-
-echo ""
-echo "→ 2. File-name based detection"
-
-check_detects ".env file blocked by name" \
-  ".env" \
-  "DATABASE_URL=postgres://localhost/db"
-
-check_detects ".env.local blocked by name" \
-  ".env.local" \
-  "SECRET=foo"
-
-check_detects "Credentials JSON blocked by name" \
-  "credentials.json" \
-  '{"user": "admin"}'
-
-echo ""
-echo "→ 3. Clean files pass"
-
-check_passes "Normal Swift code" \
-  "test-file.swift" \
-  'import Foundation
-let greeting = "Hello, World!"
-func add(_ a: Int, _ b: Int) -> Int { a + b }'
-
-check_passes "Empty file" \
-  "test-file.txt" \
-  ""
-
-check_passes "Git SHA / hex hash is not flagged as high-entropy" \
-  "test-file.txt" \
-  'commit a1b2c3d4e5f6789012345678901234567890abcd resolved'
-
-check_passes "Lockfile integrity hash is exempt" \
-  "test-yarn.lock" \
-  'resolved "https://r.npm/x" integrity sha512-Zx9Kq2Lm7Pw4Nv8Rt3Yb6Hc1Df5Gj0Sa2Wd7Qe4Uo9IkLp=='
-
-echo ""
-echo "→ 4. No staged files = clean exit"
-reset_stage
-if run_hook; then
-  pass "No staged files exits 0"
-else
-  fail "No staged files exits 0"
-fi
-
-echo ""
-echo "══ pre-commit smoke: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-pref-migration.sh

@@ -1,226 +0,0 @@
-#!/usr/bin/env bash
-# smoke-pref-migration.sh  -  exercises migrate-prefs.mjs against representative
-# v2.0.0 and pre-2.0.0 fixtures, asserts the output is v2.1.0-shaped.
-#
-# Fixtures are synthesized inline (no external files) to keep the test self-contained.
-# Run after any change to migrate-prefs.mjs or prefs.schema.json.
-
-set -uo pipefail
-
-HERE="$(cd "$(dirname "$0")" && pwd)"
-MIGRATE="$HERE/migrate-prefs.mjs"
-TMP="$(mktemp -d -t ma-smoke-migration-XXXX)"
-trap 'rm -rf "$TMP"' EXIT
-
-PASS=0
-FAIL=0
-pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
-
-if [ ! -f "$MIGRATE" ]; then
-  fail "migrate-prefs.mjs not found at $MIGRATE"
-  echo "══ pref-migration smoke: aborted ══"
-  exit 2
-fi
-
-# Helper: write fixture to $TMP/<name>.json, run migration, read back
-run_fixture() {
-  local name="$1"
-  local content="$2"
-  local file="$TMP/$name.json"
-  printf '%s' "$content" > "$file"
-  node "$MIGRATE" --file "$file" >/dev/null 2>&1
-  cat "$file"
-}
-
-assert_json_has() {
-  local name="$1"
-  local json="$2"
-  local path="$3"  # e.g. .schemaVersion or .global.identities
-  local expected="$4"
-  local actual
-  actual=$(echo "$json" | node -e "
-    const j = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-    const p = '$path'.split('.').filter(Boolean);
-    let v = j; for (const k of p) v = v?.[k];
-    if (Array.isArray(v)) console.log('array:' + v.length);
-    else if (typeof v === 'object' && v !== null) console.log('object:' + Object.keys(v).length);
-    else console.log(String(v));
-  " 2>/dev/null)
-  if [ "$actual" = "$expected" ]; then
-    pass "$name: $path == $expected"
-  else
-    fail "$name: $path expected '$expected', got '$actual'"
-  fi
-}
-
-# ──────────────────────────────────────────────────────────────────────────
-echo "→ Fixture 1: v2.0.0 with gitIdentities (legacy)"
-F1=$(run_fixture "f1-v2.0.0-legacy" '{
-  "schemaVersion": "2.0.0",
-  "global": {
-    "gitIdentities": [{"name": "Test User", "email": "test@example.com"}],
-    "keychainMapping": {"jira": "user_Jira_Access_Token"}
-  },
-  "projects": {}
-}')
-assert_json_has "f1" "$F1" ".schemaVersion" "2.4.0"
-assert_json_has "f1" "$F1" ".global.identities" "array:1"
-assert_json_has "f1" "$F1" ".global.gitIdentities" "undefined"
-assert_json_has "f1" "$F1" ".global.settings" "object:8"
-assert_json_has "f1" "$F1" ".global.keychainMapping" "object:10"
-assert_json_has "f1" "$F1" ".global.platformIdentityRouting" "object:0"
-assert_json_has "f1" "$F1" ".global.recentGroups" "array:0"
-assert_json_has "f1" "$F1" ".global.recentAccounts" "array:0"
-assert_json_has "f1" "$F1" ".global.accounts" "array:0"
-assert_json_has "f1" "$F1" ".global.routines" "array:0"
-
-echo ""
-echo "→ Fixture 2: no schemaVersion (pre-2.0.0 fossil)"
-F2=$(run_fixture "f2-no-version" '{
-  "global": {"gitIdentities": []},
-  "projects": {}
-}')
-assert_json_has "f2" "$F2" ".schemaVersion" "2.4.0"
-assert_json_has "f2" "$F2" ".global.identities" "array:0"
-
-echo ""
-echo "→ Fixture 3: v2.4.0 already (no-op)"
-F3_FILE="$TMP/f3-v2.4.0.json"
-cat > "$F3_FILE" <<'EOF'
-{
-  "schemaVersion": "2.4.0",
-  "global": {
-    "identities": [],
-    "keychainMapping": {
-      "jira": null, "bitbucket_token": null, "bitbucket_user": null,
-      "github": null, "confluence": null, "figma": null,
-      "figma_mcp": null, "fortify": null,
-      "firebase": null, "jenkins": null
-    },
-    "platformIdentityRouting": {},
-    "recentProjects": [],
-    "recentBranches": {},
-    "recentGroups": [],
-    "serviceStatus": {},
-    "settings": {
-      "branchTtlDays": 15, "pushRetryMax": 5, "buildRetryMax": 3,
-      "serviceStatusCacheSeconds": 300, "repoScanDays": 90,
-      "identityRoutingEnabled": false, "multiRepoEnabled": false,
-      "pushMustSucceed": true
-    },
-    "triageCrossCheck": {
-      "enabled": false, "samplePct": 10, "model": "sonnet", "blockOnDisagreement": false
-    },
-    "promptLanguage": "en",
-    "reportChannels": {"pr": true, "jira": true, "confluence": false, "wiki": false},
-    "reportContent": {"normalAnalysis": true, "technicalAnalysis": false, "testScenarios": true, "autoDiff": false, "manualNote": false},
-    "wikiScope": ["main", "ios", "screenshots", "index"],
-    "autopilotReportTimeoutSeconds": 1800,
-    "recentAccounts": [],
-    "accounts": [],
-    "routines": []
-  },
-  "projects": {}
-}
-EOF
-# Hash before
-BEFORE=$(shasum -a 256 "$F3_FILE" | awk '{print $1}')
-node "$MIGRATE" --file "$F3_FILE" >/dev/null 2>&1
-AFTER=$(shasum -a 256 "$F3_FILE" | awk '{print $1}')
-if [ "$BEFORE" = "$AFTER" ]; then
-  pass "f3: idempotent (v2.3.0 unchanged by re-run)"
-else
-  fail "f3: v2.3.0 file mutated by re-run (hash changed)"
-fi
-
-echo ""
-echo "→ Fixture 4: obsolete fields pruned"
-F4=$(run_fixture "f4-obsolete" '{
-  "global": {
-    "defaultPriority": "Medium",
-    "defaultIssueType": "Story",
-    "gitIdentities": []
-  },
-  "projects": {}
-}')
-assert_json_has "f4" "$F4" ".global.defaultPriority" "undefined"
-assert_json_has "f4" "$F4" ".global.defaultIssueType" "undefined"
-
-echo ""
-echo "→ Fixture 5: keychainMapping values preserved"
-F5=$(run_fixture "f5-km-preserve" '{
-  "global": {
-    "gitIdentities": [],
-    "keychainMapping": {
-      "jira": "user_Jira_Access_Token",
-      "github": "user_Github_Access_Token"
-    }
-  },
-  "projects": {}
-}')
-# Parse and inspect specific keychain values
-JIRA_VAL=$(echo "$F5" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.keychainMapping.jira)")
-if [ "$JIRA_VAL" = "user_Jira_Access_Token" ]; then
-  pass "f5: existing keychainMapping.jira value preserved"
-else
-  fail "f5: keychainMapping.jira lost or changed: got '$JIRA_VAL'"
-fi
-
-echo ""
-echo "→ Fixture 6: v2.1.0 firebase_sa + firebase_project → firebase (consolidation)"
-F6=$(run_fixture "f6-firebase-consolidate" '{
-  "schemaVersion": "2.1.0",
-  "global": {
-    "identities": [{
-      "name": "corporate",
-      "email": "x@y.com",
-      "servicePatMap": {
-        "firebase_sa": "user_Firebase_Access_Json",
-        "firebase_project": "user_Firebase_Project_Id"
-      }
-    }],
-    "keychainMapping": {
-      "jira": null, "bitbucket_token": null, "bitbucket_user": null,
-      "github": null, "confluence": null, "figma_pat": "user_Figma_Access_Token",
-      "figma_user": "user_figma_email", "figma_mcp": null, "fortify": null,
-      "firebase_sa": "user_Firebase_Access_Json",
-      "firebase_project": "user_Firebase_Project_Id",
-      "jenkins": null
-    },
-    "platformIdentityRouting": {},
-    "recentProjects": [], "recentBranches": {}, "recentGroups": [],
-    "serviceStatus": {},
-    "settings": {
-      "branchTtlDays": 15, "pushRetryMax": 5, "buildRetryMax": 3,
-      "serviceStatusCacheSeconds": 300, "repoScanDays": 90,
-      "identityRoutingEnabled": false, "multiRepoEnabled": false,
-      "pushMustSucceed": true
-    }
-  },
-  "projects": {}
-}')
-# keychainMapping.firebase_sa must be gone, firebase_project must be gone, firebase must carry the old firebase_sa value
-FB_SA=$(echo "$F6" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.keychainMapping.firebase_sa === undefined ? 'absent' : 'present')")
-FB_PROJ=$(echo "$F6" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.keychainMapping.firebase_project === undefined ? 'absent' : 'present')")
-FB=$(echo "$F6" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.keychainMapping.firebase)")
-SPM_SA=$(echo "$F6" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.identities[0].servicePatMap.firebase_sa === undefined ? 'absent' : 'present')")
-SPM_PROJ=$(echo "$F6" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.identities[0].servicePatMap.firebase_project === undefined ? 'absent' : 'present')")
-SPM_FB=$(echo "$F6" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.identities[0].servicePatMap.firebase)")
-[ "$FB_SA" = "absent" ] && pass "f6: keychainMapping.firebase_sa removed" || fail "f6: keychainMapping.firebase_sa still present"
-[ "$FB_PROJ" = "absent" ] && pass "f6: keychainMapping.firebase_project removed" || fail "f6: keychainMapping.firebase_project still present"
-[ "$FB" = "user_Firebase_Access_Json" ] && pass "f6: keychainMapping.firebase carries old firebase_sa value" || fail "f6: keychainMapping.firebase wrong value: '$FB'"
-[ "$SPM_SA" = "absent" ] && pass "f6: servicePatMap.firebase_sa removed" || fail "f6: servicePatMap.firebase_sa still present"
-[ "$SPM_PROJ" = "absent" ] && pass "f6: servicePatMap.firebase_project removed" || fail "f6: servicePatMap.firebase_project still present"
-[ "$SPM_FB" = "user_Firebase_Access_Json" ] && pass "f6: servicePatMap.firebase carries old value" || fail "f6: servicePatMap.firebase wrong value: '$SPM_FB'"
-# figma consolidation: figma_pat → figma, figma_user removed
-FIG_PAT=$(echo "$F6" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.keychainMapping.figma_pat === undefined ? 'absent' : 'present')")
-FIG_USER=$(echo "$F6" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.keychainMapping.figma_user === undefined ? 'absent' : 'present')")
-FIG=$(echo "$F6" | node -e "const j=JSON.parse(require('fs').readFileSync(0,'utf8')); console.log(j.global.keychainMapping.figma)")
-[ "$FIG_PAT" = "absent" ] && pass "f6: keychainMapping.figma_pat removed" || fail "f6: keychainMapping.figma_pat still present"
-[ "$FIG_USER" = "absent" ] && pass "f6: keychainMapping.figma_user removed" || fail "f6: keychainMapping.figma_user still present"
-[ "$FIG" = "user_Figma_Access_Token" ] && pass "f6: keychainMapping.figma carries old figma_pat value" || fail "f6: keychainMapping.figma wrong value: '$FIG'"
-
-echo ""
-echo "══ pref-migration smoke: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -eq 0 ]