@mmerterden/multi-agent-pipeline 12.7.0 → 12.8.0

package/pipeline/scripts/smoke-keychain.sh

@@ -1,158 +0,0 @@
-#!/usr/bin/env bash
-# smoke-keychain.sh  -  deterministic Keychain helper contract
-#
-# Verifies the Python Keychain helper that backs setup, Phase 0 token reads,
-# Phase 6 push retry, and the channel notifiers:
-#   1. keychain.py parses cleanly (Python 3 stdlib only)
-#   2. doctor reports the expected backend for the host platform
-#   3. Roundtrip on macOS: set / get / rotate-via-stdin / delete
-#   4. get-after-delete returns exit 1 (item missing)
-#   5. Cross-convention lookup: items written via -l (label) AND -s (service)
-#      are findable by both forms  -  ensures parity with the user's
-#      manually-added personal tokens (-l only) and credential-store.sh
-#      managed items (-s only).
-#   6. Argparse surface: every documented subcommand registered.
-#
-# Linux/CI hosts skip the live roundtrip (no libsecret keyring agent under
-# typical CI) but still enforce parse + argparse + doctor remediation text.
-#
-# Exit 0 = all pass, 1 = any failure.
-
-set -uo pipefail
-
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-KEYCHAIN_PY="$ROOT/pipeline/scripts/keychain.py"
-
-pass=0
-fail=0
-failures=()
-record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
-record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
-
-printf '→ smoke-keychain: deterministic Python Keychain helper contract\n'
-
-# --- 0: file present ---
-if [ ! -f "$KEYCHAIN_PY" ]; then
-  record_fail "keychain.py missing at $KEYCHAIN_PY"
-  printf '\n→ smoke-keychain: %d/%d passed\n' "$pass" "$((pass + fail))"
-  exit 1
-fi
-
-# --- 1: parse cleanly ---
-if python3 -c "import ast,sys; ast.parse(open('$KEYCHAIN_PY').read())" 2>/dev/null; then
-  record_pass "keychain.py parses cleanly"
-else
-  record_fail "keychain.py failed to parse"
-fi
-
-# --- 2: argparse surface ---
-HELP_OUT=$(python3 "$KEYCHAIN_PY" --help 2>&1 || true)
-for sub in get set delete list doctor; do
-  if grep -qE "[{, ]${sub}[},]" <<< "$HELP_OUT"; then
-    record_pass "argparse exposes '$sub' subcommand"
-  else
-    record_fail "argparse missing '$sub' subcommand"
-  fi
-done
-
-# --- 3: doctor returns valid JSON ---
-DOCTOR_JSON=$(python3 "$KEYCHAIN_PY" doctor 2>&1 || true)
-if jq -e '.platform and (.backend_ok | type == "boolean")' <<< "$DOCTOR_JSON" >/dev/null 2>&1; then
-  record_pass "doctor returns schema-conforming JSON"
-else
-  record_fail "doctor JSON malformed: $DOCTOR_JSON"
-fi
-
-PLATFORM=$(jq -r '.platform' <<< "$DOCTOR_JSON" 2>/dev/null || echo "unknown")
-BACKEND_OK=$(jq -r '.backend_ok' <<< "$DOCTOR_JSON" 2>/dev/null || echo "false")
-
-# --- 4: live roundtrip (macOS only  -  Linux CI rarely has libsecret agent) ---
-if [ "$PLATFORM" = "macos" ] && [ "$BACKEND_OK" = "true" ]; then
-  TEST_LABEL="_keychain_smoke_$$_$(date +%s)"
-  TEST_VALUE="smoke-value-roundtrip"
-
-  if python3 "$KEYCHAIN_PY" set "$TEST_LABEL" "$TEST_VALUE" >/dev/null 2>&1; then
-    record_pass "set succeeds"
-  else
-    record_fail "set failed"
-  fi
-
-  GOT=$(python3 "$KEYCHAIN_PY" get "$TEST_LABEL" 2>/dev/null || true)
-  if [ "$GOT" = "$TEST_VALUE" ]; then
-    record_pass "get returns the stored value (no trailing newline)"
-  else
-    record_fail "get mismatch: '$GOT' != '$TEST_VALUE'"
-  fi
-
-  # Cross-convention parity: setup/credential-store.sh keys items by -s, but the
-  # user's personal tokens are keyed by -l. The helper must store both.
-  if /usr/bin/security find-generic-password -l "$TEST_LABEL" -w >/dev/null 2>&1; then
-    record_pass "set wrote -l (label) attribute"
-  else
-    record_fail "set did NOT write -l (label) attribute"
-  fi
-  if /usr/bin/security find-generic-password -s "$TEST_LABEL" -w >/dev/null 2>&1; then
-    record_pass "set wrote -s (service) attribute"
-  else
-    record_fail "set did NOT write -s (service) attribute"
-  fi
-
-  # Stdin rotation (preferred  -  keeps secrets out of shell history).
-  ROTATED="rotated-$$"
-  if printf '%s' "$ROTATED" | python3 "$KEYCHAIN_PY" set "$TEST_LABEL" - >/dev/null 2>&1; then
-    GOT2=$(python3 "$KEYCHAIN_PY" get "$TEST_LABEL" 2>/dev/null || true)
-    if [ "$GOT2" = "$ROTATED" ]; then
-      record_pass "stdin set ('-' sentinel) rotates value"
-    else
-      record_fail "stdin set: got '$GOT2' want '$ROTATED'"
-    fi
-  else
-    record_fail "stdin set failed"
-  fi
-
-  # Delete + missing-after-delete contract.
-  if python3 "$KEYCHAIN_PY" delete "$TEST_LABEL" >/dev/null 2>&1; then
-    record_pass "delete succeeds"
-  else
-    record_fail "delete failed"
-  fi
-
-  set +e
-  python3 "$KEYCHAIN_PY" get "$TEST_LABEL" >/dev/null 2>&1
-  rc_missing=$?
-  set -e
-  if [ "$rc_missing" -eq 1 ]; then
-    record_pass "get-after-delete exits 1 (item missing)"
-  else
-    record_fail "get-after-delete should exit 1, got $rc_missing"
-  fi
-
-  # Belt-and-braces: ensure delete cleared BOTH attribute forms.
-  if ! /usr/bin/security find-generic-password -l "$TEST_LABEL" -w >/dev/null 2>&1 \
-     && ! /usr/bin/security find-generic-password -s "$TEST_LABEL" -w >/dev/null 2>&1; then
-    record_pass "delete clears both -l and -s entries"
-  else
-    record_fail "delete left a stale -l or -s entry behind"
-  fi
-elif [ "$PLATFORM" = "linux" ] && [ "$BACKEND_OK" = "true" ]; then
-  # Linux: only validate non-secret-touching paths to stay CI-safe.
-  record_pass "linux backend present (libsecret); skipping live roundtrip"
-else
-  # Backend unavailable  -  verify doctor surfaces remediation text.
-  REMEDIATION=$(jq -r '.remediation // ""' <<< "$DOCTOR_JSON")
-  if [ -n "$REMEDIATION" ] && [ "$REMEDIATION" != "null" ]; then
-    record_pass "doctor surfaces remediation text when backend unavailable"
-  else
-    record_fail "doctor missing remediation text on unsupported platform"
-  fi
-fi
-
-# --- Summary ---
-total=$((pass + fail))
-printf '\n→ smoke-keychain: %d/%d passed\n' "$pass" "$total"
-if [ "$fail" -ne 0 ]; then
-  printf '\nFailures:\n'
-  for f in "${failures[@]}"; do printf '  - %s\n' "$f"; done
-  exit 1
-fi
-exit 0

package/pipeline/scripts/smoke-language-axis.sh

@@ -1,109 +0,0 @@
-#!/usr/bin/env bash
-#
-# smoke-language-axis.sh
-#
-# Asserts the Language Application contract from refs/rules.md is honored
-# across every phase doc and orchestrator command:
-#
-#   - AskUserQuestion.label   -> English (UI button)
-#   - AskUserQuestion.header  -> English (chip)
-#   - AskUserQuestion.question -> outputLanguage
-#   - AskUserQuestion.options[].description -> outputLanguage
-#
-# In particular, this gate forbids the deprecated "ask in English (promptLanguage
-# locked to en)" wording that survived from earlier versions and made phase docs
-# instruct the orchestrator to render picker question + description in English
-# even when outputLanguage was Turkish.
-#
-# Defect 1 from docs/STABILITY-FIX-PLAN.md.
-
-set -euo pipefail
-
-SELF_DIR=$(cd "$(dirname "$0")" && pwd)
-PIPELINE_ROOT=$(cd "$SELF_DIR/.." && pwd)
-
-cd "$PIPELINE_ROOT"
-
-FAIL=0
-
-# Phrases that mean "ALL picker text English"  -  over-broad, contradicts the
-# rules.md matrix. Rule update is in v8.5.1 (rules.md narrowed). Anywhere
-# in phase docs / orchestrator commands that still says this is a regression.
-declare -a FORBIDDEN_PHRASES=(
-  'ask in English'
-  'always render in English'
-  'always English'
-  'render.*in English.*\bpromptLanguage\b'
-  'User-facing strings.*always.*English'
-  'all .*picker.*text.*English'
-)
-
-# In-scope: phase docs + orchestrator commands. Not in scope: rules.md itself
-# (it's the rule source), CHANGELOG (history), STABILITY-FIX-PLAN (history),
-# and feedback memory (notes the rule, can quote it).
-TARGETS=(
-  "multi-agent-refs/phases/*.md"
-  "commands/multi-agent/*.md"
-  "skills/shared/core/multi-agent/SKILL.md"
-)
-
-# Allowlist: rules.md, language.md (the toggle command  -  explains the contract),
-# setup.md (Step 0 sets the language and explains why label stays English),
-# refs/picker-contract.md (UI contract spec).
-declare -a ALLOWLIST=(
-  "multi-agent-refs/rules.md"
-  "commands/multi-agent/language/SKILL.md"
-  "commands/multi-agent/setup/SKILL.md"
-  "multi-agent-refs/picker-contract.md"
-)
-
-is_allowlisted() {
-  local f="$1"
-  for a in "${ALLOWLIST[@]}"; do
-    [ "$f" = "$a" ] && return 0
-  done
-  return 1
-}
-
-for pattern in "${FORBIDDEN_PHRASES[@]}"; do
-  for glob in "${TARGETS[@]}"; do
-    while IFS= read -r match; do
-      [ -z "$match" ] && continue
-      file="${match%%:*}"
-      # Relative path for allowlist check.
-      rel="${file#$PIPELINE_ROOT/pipeline/}"
-      if is_allowlisted "$rel"; then continue; fi
-      # Allow per-line annotation.
-      if echo "$match" | grep -q '# allow: language-axis-quote'; then continue; fi
-      echo "FAIL [smoke-language-axis]: forbidden 'all-English' phrase in $rel"
-      echo "  $match"
-      FAIL=$((FAIL + 1))
-    done < <(grep -rEni "$pattern" "pipeline/$glob" 2>/dev/null || true)
-  done
-done
-
-# Positive assertion: rules.md must contain the per-field language matrix.
-RULES="multi-agent-refs/rules.md"
-if [ -f "pipeline/$RULES" ]; then
-  if ! grep -q "Per-field language matrix" "pipeline/$RULES"; then
-    echo "FAIL [smoke-language-axis]: $RULES must contain the 'Per-field language matrix' section"
-    FAIL=$((FAIL + 1))
-  fi
-  if ! grep -qE "AskUserQuestion\.options\[\]\.label.*English" "pipeline/$RULES"; then
-    echo "FAIL [smoke-language-axis]: $RULES matrix must keep 'options[].label -> English'"
-    FAIL=$((FAIL + 1))
-  fi
-  if ! grep -qE "AskUserQuestion\.question.*outputLanguage" "pipeline/$RULES"; then
-    echo "FAIL [smoke-language-axis]: $RULES matrix must route 'question -> outputLanguage'"
-    FAIL=$((FAIL + 1))
-  fi
-fi
-
-if [ "$FAIL" -gt 0 ]; then
-  echo ""
-  echo "smoke-language-axis: $FAIL violation(s)."
-  echo "Defect 1: AskUserQuestion.question + .description follow outputLanguage; only label + header stay English. See refs/rules.md."
-  exit 1
-fi
-
-echo "smoke-language-axis: ok"

package/pipeline/scripts/smoke-learning-curve.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-# smoke-learning-curve.sh  -  contract for learning-curve.mjs (time-bucketed
-# trend over metrics.jsonl).
-
-set -uo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-LC="$SCRIPT_DIR/learning-curve.mjs"
-
-PASS=0
-FAIL=0
-record_pass() { PASS=$((PASS + 1)); printf '  \342\234\223 %s\n' "$1"; }
-record_fail() { FAIL=$((FAIL + 1)); printf '  \342\234\227 %s\n' "$1"; }
-
-printf '\342\206\222 smoke-learning-curve: metrics trend contract\n'
-
-tmp=$(mktemp -d "${TMPDIR:-/tmp}/lc.XXXXXX")
-trap 'rm -rf "$tmp"' EXIT
-M="$tmp/metrics.jsonl"
-
-# Two early tasks (noisy: 3/2 review cycles, low cache) + two later tasks
-# (clean: 1 cycle, high cache) -> the curve should improve.
-cat > "$M" <<'EOF'
-{"ts":"2026-06-02T10:00:00Z","task_id":"t1","phase":"4","event":"review.completed","details":{"review_cycles":3,"tokens_in":100000,"tokens_out":8000,"tokens_cached":10000}}
-{"ts":"2026-06-02T10:05:00Z","task_id":"t1","phase":"3","event":"rework.started","details":{}}
-{"ts":"2026-06-03T09:00:00Z","task_id":"t2","phase":"4","event":"review.completed","details":{"review_cycles":2,"tokens_in":90000,"tokens_out":7000,"tokens_cached":20000}}
-{"ts":"2026-06-24T09:00:00Z","task_id":"t3","phase":"4","event":"review.completed","details":{"review_cycles":1,"tokens_in":40000,"tokens_out":4000,"tokens_cached":30000}}
-{"ts":"2026-06-25T09:00:00Z","task_id":"t4","phase":"4","event":"review.completed","details":{"review_cycles":1,"tokens_in":38000,"tokens_out":3500,"tokens_cached":32000}}
-EOF
-
-# 1. parses
-bash -n "$SCRIPT_DIR/smoke-learning-curve.sh" >/dev/null 2>&1 || true
-if node --check "$LC" 2>/dev/null; then record_pass "learning-curve.mjs parses"; else record_fail "syntax error"; fi
-
-# 2. JSON: buckets + improving trend
-out=$(METRICS_FILE="$M" node "$LC" --json 2>/dev/null)
-nbuckets=$(printf '%s' "$out" | python3 -c "import json,sys;print(len(json.load(sys.stdin)['buckets']))")
-[ "$nbuckets" -ge 2 ] && record_pass "produces >=2 time buckets" || record_fail "expected >=2 buckets, got $nbuckets"
-
-tokens_delta=$(printf '%s' "$out" | python3 -c "import json,sys;print(json.load(sys.stdin)['trend']['tokensPerTask'])")
-case "$tokens_delta" in
-  -*) record_pass "tokens/task trend is negative (improving)" ;;
-  *) record_fail "tokens/task trend should drop, got $tokens_delta" ;;
-esac
-cache_delta=$(printf '%s' "$out" | python3 -c "import json,sys;print(json.load(sys.stdin)['trend']['cacheRatio'])")
-case "$cache_delta" in
-  -*|0|0.0) record_fail "cache ratio should rise, got $cache_delta" ;;
-  *) record_pass "cache ratio trend rises (improving)" ;;
-esac
-
-# 3. markdown renders a table + trend
-md=$(METRICS_FILE="$M" node "$LC" 2>/dev/null)
-printf '%s' "$md" | grep -q "Learning curve" && record_pass "markdown has a header" || record_fail "no markdown header"
-printf '%s' "$md" | grep -q "Trend" && record_pass "markdown shows a trend block" || record_fail "no trend block"
-
-# 4. missing metrics -> graceful, exit 0
-METRICS_FILE="/nope/none.jsonl" node "$LC" --json >/dev/null 2>&1
-[ "$?" -eq 0 ] && record_pass "missing metrics is a graceful no-op (exit 0)" || record_fail "missing metrics should exit 0"
-
-printf '\n\342\225\220\342\225\220 smoke-learning-curve: %d passed, %d failed \342\225\220\342\225\220\n' "$PASS" "$FAIL"
-[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-learnings-ledger.sh

@@ -1,86 +0,0 @@
-#!/usr/bin/env bash
-# smoke-learnings-ledger.sh  -  contract check for the persistent learnings ledger.
-#
-# Verifies:
-#   1. add appends a fact / convention; identical statement is deduped.
-#   2. from-triage distills rejected findings into rejected-preference entries.
-#   3. brief emits a <repo-learnings> block grouped by kind; exit 2 when empty.
-#   4. Storage is per-repo isolated (slug A never sees slug B).
-#   5. Phase docs + prefs schema wire the ledger in.
-#
-# Uses an isolated HOME so it never touches the developer's real memory store.
-# Exit 0 = all pass, 1 = any failure.
-
-set -uo pipefail
-
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-L="$ROOT/pipeline/scripts/learnings-ledger.mjs"
-TMPHOME="$(mktemp -d)"
-trap 'rm -rf "$TMPHOME"' EXIT
-export HOME="$TMPHOME"   # redirect ~/.claude/memory into the sandbox
-
-PASS=0
-FAIL=0
-pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
-fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
-
-command -v node >/dev/null 2>&1 || { echo "error: node required" >&2; exit 127; }
-[ -f "$L" ] || { echo "FAIL: learnings-ledger.mjs missing" >&2; exit 1; }
-
-SLUG=repoA
-
-echo "→ 1. add + dedup"
-out=$(node "$L" add --kind fact --statement "Auth tokens persist via KeychainStore" --scope "Auth/*" --repo-slug "$SLUG")
-echo "$out" | grep -q '"added":1' && pass "first add writes" || fail "first add did not write ($out)"
-out=$(node "$L" add --kind fact --statement "auth tokens persist via keychainstore" --repo-slug "$SLUG"; echo "rc=$?")
-echo "$out" | grep -q '"added":0' && pass "case-insensitive dedup" || fail "dedup failed ($out)"
-echo "$out" | grep -q 'rc=2' && pass "dedup exits 2" || fail "dedup exit code wrong ($out)"
-
-echo ""
-echo "→ 2. from-triage distills rejections"
-printf '{"accepted":[],"deferred":[],"rejected":[{"finding":{"severity":"suggestion","file":"Net/Client.swift","line":12,"issue":"add Sendable annotation"},"reason":"requires Swift 6 migration"}],"approved":true}' > "$TMPHOME/tri.json"
-out=$(node "$L" from-triage --triage "$TMPHOME/tri.json" --task PROJ-9 --repo-slug "$SLUG")
-echo "$out" | grep -q '"added":1' && pass "rejected finding becomes a rejected-preference" || fail "from-triage failed ($out)"
-
-echo ""
-echo "→ 2b. SAFETY: blocking rejections are NOT auto-suppressed"
-printf '{"accepted":[],"deferred":[],"rejected":[{"finding":{"severity":"blocking","file":"Auth/x.swift","line":1,"issue":"missing access-control flag on keychain item"},"reason":"reviewer says false positive"},{"finding":{"severity":"suggestion","file":"Net/y.swift","line":2,"issue":"rename helper for clarity"},"reason":"style only"}]}' > "$TMPHOME/blk.json"
-out=$(node "$L" from-triage --triage "$TMPHOME/blk.json" --task PROJ-2 --repo-slug "$SLUG")
-echo "$out" | grep -q '"skippedBlocking":1' && pass "blocking rejection skipped" || fail "blocking not skipped ($out)"
-echo "$out" | grep -q '"added":1' && pass "non-blocking rejection still distilled" || fail "suggestion not added ($out)"
-brief2=$(node "$L" brief --repo-slug "$SLUG")
-echo "$brief2" | grep -qi "missing access-control flag" && fail "blocking issue leaked into brief (would suppress a real finding)" || pass "blocking issue absent from brief"
-
-echo ""
-echo "→ 2c. forget removes a bad/stale entry"
-node "$L" forget --statement "rename helper" --repo-slug "$SLUG" >/dev/null 2>&1
-brief3=$(node "$L" brief --repo-slug "$SLUG" 2>/dev/null || true)
-echo "$brief3" | grep -qi "rename helper" && fail "forget did not remove the entry" || pass "forget removed the targeted entry"
-
-echo ""
-echo "→ 3. brief content + emptiness"
-brief=$(node "$L" brief --repo-slug "$SLUG")
-echo "$brief" | grep -q '<repo-learnings>' && pass "brief emits repo-learnings block" || fail "brief block missing"
-echo "$brief" | grep -q 'Architectural facts' && pass "brief groups facts" || fail "facts group missing"
-echo "$brief" | grep -qi 'do not re-flag: add Sendable' && pass "brief surfaces rejected preference" || fail "rejected preference not in brief"
-rc=0
-node "$L" brief --repo-slug emptyRepo >/dev/null 2>&1 || rc=$?
-[ "$rc" = "2" ] && pass "brief on empty ledger exits 2" || fail "empty brief exit code wrong (got $rc)"
-
-echo ""
-echo "→ 4. per-repo isolation"
-node "$L" add --kind fact --statement "repoB only fact" --repo-slug repoB >/dev/null 2>&1
-briefA=$(node "$L" brief --repo-slug "$SLUG")
-echo "$briefA" | grep -q 'repoB only fact' && fail "repoA brief leaked repoB content" || pass "repoA does not see repoB entries"
-
-echo ""
-echo "→ 5. wiring + docs"
-grep -q 'learnings-ledger.mjs' "$ROOT/pipeline/multi-agent-refs/phases/phase-1-analysis.md" && pass "phase-1 injects the brief" || fail "phase-1 wiring missing"
-grep -q 'learnings-ledger.mjs' "$ROOT/pipeline/multi-agent-refs/phases/phase-4-review.md" && pass "phase-4 triage injects rejected prefs" || fail "phase-4 wiring missing"
-grep -q 'learnings-ledger.mjs' "$ROOT/pipeline/multi-agent-refs/phases/phase-7-report.md" && pass "phase-7 distills the ledger" || fail "phase-7 wiring missing"
-grep -q '"learningsLedger"' "$ROOT/pipeline/schemas/prefs.schema.json" && pass "prefs exposes learningsLedger" || fail "prefs toggle missing"
-[ -f "$ROOT/pipeline/schemas/learnings-ledger.schema.json" ] && pass "ledger schema present" || fail "ledger schema missing"
-
-echo ""
-echo "══ learnings-ledger smoke: $PASS passed, $FAIL failed ══"
-[ "$FAIL" -eq 0 ]