@mmerterden/multi-agent-pipeline 12.7.0 → 12.8.0

package/pipeline/scripts/smoke-bitbucket-contract.sh

@@ -1,255 +0,0 @@
-#!/usr/bin/env bash
-# smoke-bitbucket-contract.sh  -  offline contract test for repo-cache.sh
-# Bitbucket Server backend.
-#
-# Replaces curl with a stub that serves a fixture JSON, then verifies the
-# python parser shape-converts the BB Server `/rest/api/1.0/projects/.../repos`
-# response into the canonical {fullName, name, owner, cloneUrl, provider}
-# schema that the picker consumes.
-#
-# Why offline: live Bitbucket Server REST requires a corporate host + project
-# key + valid token. Without those, contract drift would only surface in
-# production. This smoke pins the request URL, the response parsing, and the
-# auth header construction so changes that break either fail in CI.
-
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-LIB_DIR="$REPO_ROOT/pipeline/lib"
-
-PASS=0; FAIL=0
-ok()   { echo "  ✓ $1"; PASS=$((PASS+1)); }
-fail() { echo "  ✗ $1" >&2; FAIL=$((FAIL+1)); }
-
-REPO_CACHE="$LIB_DIR/repo-cache.sh"
-[ -x "$REPO_CACHE" ] || { fail "repo-cache.sh missing/not executable"; exit 1; }
-
-# --- Stub setup -------------------------------------------------------------
-TMP=$(mktemp -d)
-trap 'rm -rf "$TMP"' EXIT
-
-# Fixture: minimal but realistic BB Server response shape (as documented at
-# https://docs.atlassian.com/bitbucket-server/rest/7.21.0/bitbucket-rest.html)
-cat > "$TMP/fixture.json" <<'EOF'
-{
-  "size": 2,
-  "limit": 200,
-  "isLastPage": true,
-  "values": [
-    {
-      "slug": "my-ios-app",
-      "name": "my-ios-app",
-      "project": {"key": "MOBILE", "name": "Mobile Team"},
-      "description": "iOS application",
-      "links": {
-        "clone": [
-          {"href": "https://bitbucket.example.com/scm/mobile/my-ios-app.git", "name": "http"},
-          {"href": "ssh://git@bitbucket.example.com/mobile/my-ios-app.git", "name": "ssh"}
-        ]
-      }
-    },
-    {
-      "slug": "common-ui-kit",
-      "name": "common-ui-kit",
-      "project": {"key": "MOBILE", "name": "Mobile Team"},
-      "description": "Shared UI components",
-      "links": {
-        "clone": [
-          {"href": "https://bitbucket.example.com/scm/mobile/common-ui-kit.git", "name": "http"},
-          {"href": "ssh://git@bitbucket.example.com/mobile/common-ui-kit.git", "name": "ssh"}
-        ]
-      }
-    }
-  ]
-}
-EOF
-
-# Stub curl that captures invocation and returns the fixture. PATH-shadows the
-# real curl for this smoke only. Auth travels via `-K <config-file>` (so the
-# token never hits argv); the stub dumps the config file so the smoke can
-# assert its contents.
-cat > "$TMP/curl" <<EOF
-#!/usr/bin/env bash
-# Capture every invocation so we can assert the URL + auth config shape.
-echo "INVOCATION:" "\$@" >> "$TMP/curl-calls.log"
-prev=""
-for arg in "\$@"; do
-  if [ "\$prev" = "-K" ]; then
-    echo "AUTH-CONFIG: \$(cat "\$arg" 2>/dev/null)" >> "$TMP/curl-calls.log"
-  fi
-  prev="\$arg"
-done
-# Echo the fixture body (BB Server response) to stdout  -  same as real curl -sf.
-cat "$TMP/fixture.json"
-exit 0
-EOF
-chmod +x "$TMP/curl"
-
-# Stub `security` so credential-store.sh `get` returns deterministic test values.
-# We do this rather than touching the real Keychain.
-cat > "$TMP/security" <<EOF
-#!/usr/bin/env bash
-# Mimic the relevant security subcommands used by credential-store.sh.
-case "\$1" in
-  find-generic-password)
-    # macOS path. Args: -s NAME -w
-    while [ \$# -gt 0 ]; do
-      case "\$1" in
-        -s) shift; SVC="\$1" ;;
-      esac
-      shift || break
-    done
-    case "\$SVC" in
-      mock_BB_Token) echo "test-bb-token" ;;
-      mock_BB_User)  echo "test-bb-user" ;;
-      *) exit 44 ;;
-    esac
-    ;;
-  dump-keychain) ;; # noop for list
-esac
-EOF
-chmod +x "$TMP/security"
-
-# Stub `secret-tool` for the same purpose on Linux - credential-store.sh
-# routes get() through libsecret there, so the macOS `security` stub alone
-# leaves BB_TOKEN empty and every downstream assertion blank.
-cat > "$TMP/secret-tool" <<EOF
-#!/usr/bin/env bash
-# Mimic: secret-tool lookup service <key>
-if [ "\$1" = "lookup" ]; then
-  case "\$3" in
-    mock_BB_Token) echo "test-bb-token" ;;
-    mock_BB_User)  echo "test-bb-user" ;;
-    *) exit 1 ;;
-  esac
-fi
-EOF
-chmod +x "$TMP/secret-tool"
-
-# Override repo-cache TTL and stub PATH so curl + security come from $TMP.
-export PATH="$TMP:$PATH"
-export REPO_CACHE_TTL=0   # skip cache, force fetch
-export BB_TOKEN_KEY="mock_BB_Token"
-export BB_USER_KEY="mock_BB_User"
-export BB_HOST="bitbucket.example.com"
-
-# Run with a sandboxed cache dir so we don't pollute the real one
-export HOME="$TMP/fakehome"
-mkdir -p "$HOME/.claude/cache/repos" "$HOME/.claude/lib"
-ln -sf "$LIB_DIR/credential-store.sh" "$HOME/.claude/lib/credential-store.sh"
-
-# --- Run the call -----------------------------------------------------------
-echo "→ 1. repo-cache.sh bitbucket MOBILE  -  invoke + parse"
-out=$("$REPO_CACHE" bitbucket MOBILE --refresh 2>&1)
-if [ $? -eq 0 ]; then
-  ok "exit 0 with valid fixture"
-else
-  fail "exit non-zero on valid fixture: $out"
-fi
-
-# --- Assert: curl called with correct URL + auth ----------------------------
-echo "→ 2. curl invocation captured the right URL"
-if grep -q "https://bitbucket.example.com/rest/api/1.0/projects/MOBILE/repos" "$TMP/curl-calls.log"; then
-  ok "URL matches BB Server REST contract (/rest/api/1.0/projects/{key}/repos)"
-else
-  fail "URL wrong; captured: $(cat "$TMP/curl-calls.log")"
-fi
-
-if grep -q "limit=200" "$TMP/curl-calls.log"; then
-  ok "page limit=200 (the BB Server max)"
-else
-  fail "limit param missing"
-fi
-
-if grep -q 'AUTH-CONFIG: user = "test-bb-user:test-bb-token"' "$TMP/curl-calls.log"; then
-  ok "Basic auth uses {user}:{token} via curl -K config (not argv)"
-else
-  fail "auth config wrong; captured: $(grep 'AUTH-CONFIG' "$TMP/curl-calls.log" || echo none)"
-fi
-
-# The raw token must never appear on curl argv (visible to ps).
-if grep "^INVOCATION:" "$TMP/curl-calls.log" | grep -q "test-bb-token"; then
-  fail "token leaked onto curl argv"
-else
-  ok "token absent from curl argv"
-fi
-
-# --- Assert: shape conversion produced canonical schema ---------------------
-echo "→ 3. parser converts BB shape → canonical schema"
-canonical=$(printf '%s' "$out" | python3 -c '
-import json, sys
-data = json.load(sys.stdin)
-required = {"fullName","name","owner","description","isFork","updatedAt","cloneUrl","provider"}
-for r in data:
-    miss = required - set(r.keys())
-    if miss:
-        sys.stderr.write("MISS:" + str(sorted(miss)) + "\n")
-        sys.exit(1)
-    if r["provider"] != "bitbucket":
-        sys.stderr.write("BAD_PROVIDER:" + r["provider"] + "\n")
-        sys.exit(1)
-print(json.dumps(data))
-')
-if [ -n "$canonical" ]; then
-  ok "every output entry has the canonical fields + provider=bitbucket"
-else
-  fail "shape conversion failed"
-fi
-
-count=$(printf '%s' "$canonical" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)))')
-if [ "$count" = "2" ]; then
-  ok "all values[] entries surfaced (count matches fixture)"
-else
-  fail "count $count != 2"
-fi
-
-# Specific field plumbing
-first_full=$(printf '%s' "$canonical" | python3 -c 'import json,sys; print(json.load(sys.stdin)[0]["fullName"])')
-if [ "$first_full" = "MOBILE/my-ios-app" ]; then
-  ok "fullName format: <projectKey>/<slug>"
-else
-  fail "fullName wrong: $first_full"
-fi
-
-first_clone=$(printf '%s' "$canonical" | python3 -c 'import json,sys; print(json.load(sys.stdin)[0]["cloneUrl"])')
-if printf '%s' "$first_clone" | grep -q "^ssh://"; then
-  ok "cloneUrl prefers ssh link when both available"
-else
-  fail "cloneUrl should prefer ssh, got: $first_clone"
-fi
-
-# --- Assert: empty values[] handled cleanly ---------------------------------
-echo "→ 4. empty BB project (no repos) returns empty array"
-cat > "$TMP/fixture.json" <<'EOF'
-{"size": 0, "limit": 200, "isLastPage": true, "values": []}
-EOF
-out=$("$REPO_CACHE" bitbucket EMPTY --refresh 2>&1)
-parsed=$(printf '%s' "$out" | python3 -c 'import json,sys; print(len(json.load(sys.stdin)))' 2>/dev/null || echo "ERR")
-if [ "$parsed" = "0" ]; then
-  ok "empty project → []"
-else
-  fail "empty project parse failed (got: $parsed)"
-fi
-
-# --- Assert: missing token exits with diagnostic ----------------------------
-echo "→ 5. missing BB token → exit 3 with hint"
-unset BB_TOKEN_KEY
-err=$("$REPO_CACHE" bitbucket MOBILE --refresh 2>&1 >/dev/null) || true
-# repo-cache.sh fails with `BB_TOKEN_KEY required` from `: "${BB_TOKEN_KEY:?...}"`
-if printf '%s' "$err" | grep -q "BB_TOKEN_KEY"; then
-  ok "missing BB_TOKEN_KEY produces a diagnostic"
-else
-  fail "no diagnostic on missing token (got: $err)"
-fi
-
-# --- Summary ----------------------------------------------------------------
-echo ""
-TOTAL=$((PASS+FAIL))
-if [ $FAIL -eq 0 ]; then
-  echo "══ bitbucket-contract smoke: $PASS passed, 0 failed ══"
-  exit 0
-else
-  echo "══ bitbucket-contract smoke: $PASS passed, $FAIL failed (of $TOTAL) ══" >&2
-  exit 1
-fi

package/pipeline/scripts/smoke-changelog-version.sh

@@ -1,47 +0,0 @@
-#!/usr/bin/env bash
-# smoke-changelog-version.sh - fail when CHANGELOG.md and package.json drift.
-#
-# Gates (release.yml relies on both holding):
-#   1. The newest "## [X.Y.Z] - YYYY-MM-DD" entry in CHANGELOG.md matches
-#      package.json "version".
-#   2. The entry's date is ISO formatted.
-#   3. CHANGELOG-archive.md is NOT listed in package.json files[] (repo-only).
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-PASS=0
-FAIL=0
-
-record_pass() { PASS=$((PASS + 1)); printf '  PASS %s\n' "$1"; }
-record_fail() { FAIL=$((FAIL + 1)); printf '  FAIL %s\n' "$1"; }
-
-printf 'smoke-changelog-version: CHANGELOG.md <-> package.json drift gate\n'
-
-PKG_VERSION=$(jq -r .version "$ROOT/package.json")
-TOP_ENTRY=$(grep -m1 -E '^## \[[0-9]+\.[0-9]+\.[0-9]+\]' "$ROOT/CHANGELOG.md" || true)
-
-if [ -z "$TOP_ENTRY" ]; then
-  record_fail "CHANGELOG.md has no '## [X.Y.Z] - YYYY-MM-DD' entry"
-else
-  record_pass "CHANGELOG.md has a parseable top entry"
-  TOP_VERSION=$(printf '%s' "$TOP_ENTRY" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-  if [ "$TOP_VERSION" = "$PKG_VERSION" ]; then
-    record_pass "top entry $TOP_VERSION matches package.json $PKG_VERSION"
-  else
-    record_fail "top entry $TOP_VERSION != package.json $PKG_VERSION"
-  fi
-  if printf '%s' "$TOP_ENTRY" | grep -qE '[0-9]{4}-[0-9]{2}-[0-9]{2}'; then
-    record_pass "top entry date is ISO formatted"
-  else
-    record_fail "top entry date is not ISO formatted: $TOP_ENTRY"
-  fi
-fi
-
-if jq -e '.files | index("CHANGELOG-archive.md")' "$ROOT/package.json" >/dev/null 2>&1; then
-  record_fail "CHANGELOG-archive.md must stay repo-only (remove from files[])"
-else
-  record_pass "CHANGELOG-archive.md not shipped in npm tarball"
-fi
-
-printf 'smoke-changelog-version: %d passed, %d failed\n' "$PASS" "$FAIL"
-[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-channels-approval-gate.sh

@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-# smoke-channels-approval-gate.sh  -  contract for the channels Step 6 body preview + approval gate.
-#
-# Verifies:
-#   1. channels.md has the Step 6 gate section with the four decision options.
-#   2. The two (and only two) bypass cases are documented: autopilot + --dry-run.
-#   3. Step 7 dispatch is gated on the Step 6 approval.
-#   4. Byte-identical post rule + re-approval-on-regeneration rule present.
-#   5. Phase 7 Step 1.5 (GitHub issue comment) references the same gate.
-#   6. Required rules include the approval-before-post bullet.
-
-set -euo pipefail
-
-HERE="$(cd "$(dirname "$0")" && pwd)"
-ROOT="$(cd "$HERE/../.." && pwd)"
-CHANNELS="$ROOT/pipeline/commands/multi-agent/channels/SKILL.md"
-PHASE7="$ROOT/pipeline/multi-agent-refs/phases/phase-7-report.md"
-
-PASS=0
-FAIL=0
-pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
-
-for f in "$CHANNELS" "$PHASE7"; do
-  [ -f "$f" ] || { echo "error: missing $f" >&2; exit 1; }
-done
-
-echo "→ 1. Step 6 gate section + decision options"
-grep -Fq "Step 6  -  Body preview + approval gate" "$CHANNELS" && pass "gate section present" || fail "gate section missing"
-for opt in "Approve & post" "Edit" "Skip channels" "Cancel"; do
-  grep -Fq "$opt" "$CHANNELS" && pass "option: $opt" || fail "option missing: $opt"
-done
-
-echo ""
-echo "→ 2. bypass cases are exactly autopilot + --dry-run"
-grep -Fq "Skipped in exactly two cases" "$CHANNELS" && pass "two-case rule stated" || fail "two-case rule missing"
-grep -Fq "MULTI_AGENT_AUTOPILOT=1" "$CHANNELS" && pass "autopilot bypass documented" || fail "autopilot bypass missing"
-grep -Eq 'dry-run.*(redundant|without posting)' "$CHANNELS" && pass "dry-run bypass documented" || fail "dry-run bypass missing"
-
-echo ""
-echo "→ 3. dispatch gated on approval"
-grep -Fq "NEVER starts before the Step 6 gate resolves" "$CHANNELS" && pass "Step 6 gated" || fail "Step 6 gate wiring missing"
-
-echo ""
-echo "→ 4. byte-identical + re-approval rules"
-grep -Fq "byte-identical to the approved preview" "$CHANNELS" && pass "byte-identical rule" || fail "byte-identical rule missing"
-grep -Fq "invalidates the approval" "$CHANNELS" && pass "re-approval on regeneration" || fail "re-approval rule missing"
-
-echo ""
-echo "→ 5. Phase 7 issue-comment path uses the same gate"
-grep -Fq "same preview + approval gate as channels Step 6" "$PHASE7" && pass "Phase 7 Step 1.5 gated" || fail "Phase 7 Step 1.5 gate reference missing"
-grep -Fq "Autopilot posts directly" "$PHASE7" && pass "Phase 7 autopilot bypass" || fail "Phase 7 autopilot bypass missing"
-
-echo ""
-echo "→ 6. required-rules bullet"
-grep -Fq "**Approval before post**" "$CHANNELS" && pass "required-rules bullet present" || fail "required-rules bullet missing"
-
-echo ""
-echo "══ channels-approval-gate smoke: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-channels-flow.sh

@@ -1,130 +0,0 @@
-#!/usr/bin/env bash
-# smoke-channels-flow.sh  -  asserts the v5.7+ /multi-agent:channels contract:
-#   1. channels.md exists (Claude) + multi-agent-channels SKILL.md exists (Copilot)
-#   2. enrich.md is GONE (Claude) + multi-agent-enrich skill is GONE (Copilot)
-#   3. channels.md declares the 4 channels (pr, jira, confluence, wiki)
-#   4. channels.md declares the 4 content sources (normalAnalysis, testScenarios, auto-diff, manual-note)
-#   5. Reviewer-preserving Bitbucket PUT payload is present (title+description+reviewers+fromRef+toRef+version)
-#   6. 30-min timeout contract referenced in channels.md + phase-7-report.md + modes.md
-#   7. Phase 7 autopilot always-pause rule documented in modes.md
-#   8. Phase 7 report delegates to channels (does NOT inline Jira/Confluence/Wiki logic)
-#   9. schema has reportChannels, reportContent, autopilotReportTimeoutSeconds, wikiScope
-#  10. legacy jiraCommentDefault/confluenceDefault/wikiDefault REMOVED from schema
-#  11. migrate-prefs.mjs has migrateReportChannels() sub-migration
-#  12. preferences-template.json uses new fields (not legacy)
-#
-# Fails loudly on any violation. Intended to run as part of the full smoke suite.
-
-set -uo pipefail
-
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-CLAUDE_CMD="$ROOT/pipeline/commands/multi-agent/channels/SKILL.md"
-COPILOT_SKILL="$ROOT/pipeline/skills/shared/core/multi-agent-channels/SKILL.md"
-ENRICH_CMD="$ROOT/pipeline/commands/multi-agent/enrich/SKILL.md"
-ENRICH_SKILL_DIR="$ROOT/pipeline/skills/shared/core/multi-agent-enrich"
-PHASE7="$ROOT/pipeline/multi-agent-refs/phases/phase-7-report.md"
-MODES="$ROOT/pipeline/multi-agent-refs/phases/modes.md"
-WIKI_CAPTURE="$ROOT/pipeline/multi-agent-refs/wiki-capture.md"
-SCHEMA="$ROOT/pipeline/schemas/prefs.schema.json"
-MIGRATE="$ROOT/pipeline/scripts/migrate-prefs.mjs"
-TEMPLATE="$ROOT/pipeline/preferences-template.json"
-
-PASS=0
-FAIL=0
-pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
-
-check() {
-  local label="$1" cmd="$2"
-  if eval "$cmd" > /dev/null 2>&1; then pass "$label"; else fail "$label"; fi
-}
-
-echo "→ 1. channels command exists (both CLIs)"
-check "Claude channels.md present"              "[ -f '$CLAUDE_CMD' ]"
-check "Copilot multi-agent-channels SKILL.md"   "[ -f '$COPILOT_SKILL' ]"
-
-echo ""
-echo "→ 2. enrich command + skill REMOVED"
-check "Claude enrich.md absent"                 "[ ! -f '$ENRICH_CMD' ]"
-check "Copilot multi-agent-enrich dir absent"   "[ ! -d '$ENRICH_SKILL_DIR' ]"
-
-echo ""
-echo "→ 3. channels.md declares 4 kanals"
-check "mentions PR description"                 "grep -Fq 'PR description' '$CLAUDE_CMD'"
-check "mentions Jira comment"                   "grep -Fq 'Jira comment'   '$CLAUDE_CMD'"
-check "mentions Confluence page"                "grep -Fq 'Confluence'     '$CLAUDE_CMD'"
-check "mentions Wiki (component-only)"          "grep -Fq 'Wiki'           '$CLAUDE_CMD'"
-
-echo ""
-echo "→ 4. channels.md declares 5 content sources (v5.7.3+ adds teknik analiz)"
-check "Normal analiz content option"            "grep -Fq 'Normal analiz'    '$CLAUDE_CMD'"
-check "Teknik analiz content option"            "grep -Fq 'Teknik analiz'    '$CLAUDE_CMD'"
-check "Test senaryoları content option"         "grep -Fq 'Test senaryoları' '$CLAUDE_CMD'"
-check "Auto-diff content option"                "grep -Fq 'Auto-diff'        '$CLAUDE_CMD'"
-check "Manuel not content option"               "grep -Fq 'Manuel not'       '$CLAUDE_CMD'"
-
-echo ""
-echo "→ 5. Reviewer-preserving Bitbucket PUT payload"
-check "mentions reviewers field mandatory"      "grep -Fq 'reviewers' '$CLAUDE_CMD'"
-check "mentions fromRef field mandatory"        "grep -Fq 'fromRef'   '$CLAUDE_CMD'"
-check "mentions toRef field mandatory"          "grep -Fq 'toRef'     '$CLAUDE_CMD'"
-check "mentions version field mandatory"        "grep -Fq 'version'   '$CLAUDE_CMD'"
-check "jq --rawfile pattern (real newlines)"    "grep -Eq 'jq --rawfile|jq -n' '$CLAUDE_CMD'"
-
-echo ""
-echo "→ 6. 30-min timeout contract"
-check "channels.md mentions 30-min timeout"     "grep -Eq '30.min|30-min|30 min' '$CLAUDE_CMD'"
-check "phase-7-report.md mentions timeout"      "grep -Eq '30.min|30-min|30 min|channelsTimeout' '$PHASE7'"
-check "modes.md mentions timeout"               "grep -Eq '30.min|30-min|30 min|timeout' '$MODES'"
-
-echo ""
-echo "→ 7. Phase 7 autopilot always-pause rule"
-check "modes.md: Phase 7 autopilot exception"   "grep -Fq 'Phase 7 autopilot exception' '$MODES'"
-check "modes.md: STILL PAUSES"                  "grep -Fq 'STILL PAUSES' '$MODES'"
-check "phase-7-report.md: always pauses"        "grep -Eq 'ALWAYS pauses|always pauses' '$PHASE7'"
-
-echo ""
-echo "→ 8. Phase 7 delegates to channels (no inline adapters)"
-check "phase-7-report.md invokes channels"      "grep -Eq 'multi-agent:channels|multi-agent-channels' '$PHASE7'"
-check "phase-7-report.md has state bundle"      "grep -Fq 'state bundle' '$PHASE7'"
-# Old inline per-channel sub-step list (Jira-Comment/Wiki+Figma/Confluence) should be gone
-if grep -Fq 'Jira-Comment' "$PHASE7" && grep -Fq 'Wiki+Figma' "$PHASE7" && grep -Fq 'Confluence' "$PHASE7"; then
-  # All three together = old 5-sub-step inline layout
-  fail "phase-7-report.md still has old inline 5-sub-step layout (Jira-Comment/Wiki+Figma/Confluence all three)"
-else
-  pass "phase-7-report.md no longer inlines old 5-sub-step layout"
-fi
-
-echo ""
-echo "→ 9. schema has new v5.7+ fields"
-check "schema has reportChannels"               "grep -Fq 'reportChannels'              '$SCHEMA'"
-check "schema has reportContent"                "grep -Fq 'reportContent'               '$SCHEMA'"
-check "schema has autopilotReportTimeoutSeconds" "grep -Fq 'autopilotReportTimeoutSeconds' '$SCHEMA'"
-check "schema has wikiScope"                    "grep -Fq 'wikiScope'                    '$SCHEMA'"
-
-echo ""
-echo "→ 10. schema PURGED of legacy fields"
-check "schema has NO jiraCommentDefault property"    "! grep -Eq '\"jiraCommentDefault\"\\s*:' '$SCHEMA'"
-check "schema has NO confluenceDefault property"     "! grep -Eq '\"confluenceDefault\"\\s*:' '$SCHEMA'"
-check "schema has NO wikiDefault property"           "! grep -Eq '\"wikiDefault\"\\s*:' '$SCHEMA'"
-
-echo ""
-echo "→ 11. migrate-prefs.mjs handles v5.7 migration"
-check "migrate-prefs has migrateReportChannels()" "grep -Fq 'migrateReportChannels' '$MIGRATE'"
-check "migrate-prefs prunes jiraCommentDefault"   "grep -Fq 'jiraCommentDefault'     '$MIGRATE'"
-check "migrate-prefs prunes confluenceDefault"    "grep -Fq 'confluenceDefault'      '$MIGRATE'"
-check "migrate-prefs prunes wikiDefault"          "grep -Fq 'wikiDefault'            '$MIGRATE'"
-
-echo ""
-echo "→ 12. template uses new fields (not legacy)"
-check "template has reportChannels"             "grep -Fq 'reportChannels'  '$TEMPLATE'"
-check "template has reportContent"              "grep -Fq 'reportContent'   '$TEMPLATE'"
-check "template has wikiScope"                  "grep -Fq 'wikiScope'       '$TEMPLATE'"
-check "template NO jiraCommentDefault"          "! grep -Eq '\"jiraCommentDefault\"\\s*:' '$TEMPLATE'"
-check "template NO confluenceDefault"           "! grep -Eq '\"confluenceDefault\"\\s*:' '$TEMPLATE'"
-check "template NO wikiDefault"                 "! grep -Eq '\"wikiDefault\"\\s*:' '$TEMPLATE'"
-
-echo ""
-echo "══ channels-flow smoke: $PASS passed, $FAIL failed ══"
-if [ "$FAIL" -gt 0 ]; then exit 1; fi
-exit 0

package/pipeline/scripts/smoke-ci-workflows.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-#
-# smoke-ci-workflows.sh  -  structural validator for `.github/workflows/*.yml`.
-#
-# We don't have `act` (or PyYAML) as a hard dependency, and we don't run
-# workflows on GitHub during this smoke (billing-friendly stance). This
-# smoke catches the obvious classes of breakage:
-#
-#   - Missing `on:` block / no triggers
-#   - Missing `jobs:` block
-#   - At least one `steps:` block per job
-#   - workflow_dispatch trigger present (project policy: every workflow
-#     must be runnable on demand while billing is paused)
-#   - Each `uses:` references a pinned major version (no @main / @master)
-#   - No `--token=` argv pattern in shell steps (Vercel leak shape)
-#
-# The full job semantics (Docker image resolution, secret resolution,
-# matrix expansion) are NOT checked  -  install `act` and run
-# `act -W .github/workflows/<file> --list` for that.
-#
-# Exit codes: 0=pass, 1=structural break
-
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-WF_DIR="$REPO_ROOT/.github/workflows"
-
-[ -d "$WF_DIR" ] || { echo "FAIL: .github/workflows/ missing"; exit 2; }
-
-PASS=0
-FAIL=0
-pass() { echo "  ✓ $*"; PASS=$((PASS + 1)); }
-fail() { echo "  ✗ $*"; FAIL=$((FAIL + 1)); }
-
-WORKFLOWS=$(find "$WF_DIR" -maxdepth 1 -type f \( -name "*.yml" -o -name "*.yaml" \) | sort)
-[ -n "$WORKFLOWS" ] || { echo "FAIL: no workflows in $WF_DIR"; exit 1; }
-
-for wf in $WORKFLOWS; do
-  name=$(basename "$wf")
-  echo ""
-  echo "→ $name"
-
-  if grep -Eq '^on:' "$wf"; then
-    pass "$name has on: trigger block"
-  else
-    fail "$name missing 'on:' block"
-  fi
-
-  if grep -Eq '^jobs:' "$wf"; then
-    pass "$name declares jobs:"
-  else
-    fail "$name missing 'jobs:' block"
-  fi
-
-  if grep -Eq '^[[:space:]]+steps:' "$wf"; then
-    pass "$name has at least one steps: block"
-  else
-    fail "$name has no steps: block"
-  fi
-
-  if grep -q 'workflow_dispatch' "$wf"; then
-    pass "$name supports workflow_dispatch (manual run)"
-  else
-    fail "$name missing workflow_dispatch  -  won't be runnable while billing is paused"
-  fi
-
-  # Pin check: `uses: foo/bar@vN` good; `uses: foo/bar@main` bad
-  if grep -E '^[[:space:]]+- uses: [^@]+@(main|master)[^[:alnum:]]?' "$wf" >/dev/null 2>&1; then
-    fail "$name has uses: pinned to a moving branch (main/master)  -  pin to a version"
-  else
-    pass "$name uses: lines are not pinned to main/master"
-  fi
-
-  # Vercel leak shape: `--token=` or `--token ` in a `run:` block
-  if grep -E "vercel.*--token[ =]" "$wf" >/dev/null 2>&1; then
-    fail "$name contains 'vercel --token=...'  -  must use VERCEL_TOKEN env + wrapper instead"
-  else
-    pass "$name does not pass --token= to vercel"
-  fi
-done
-
-echo ""
-echo "→ workflow inventory"
-echo "$WORKFLOWS" | sed 's|.*/|  - |'
-
-echo ""
-echo "══ smoke-ci-workflows: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -gt 0 ] && exit 1 || exit 0