@mmerterden/multi-agent-pipeline 12.7.0 → 12.9.0

package/pipeline/scripts/agent-guard.py

@@ -25,7 +25,50 @@ ATTRIBUTION = re.compile(
     r"|claude code <",
     re.IGNORECASE,
 )
-FORCE = re.compile(r"(^|\s)(--force(\b|$)|--force-with-lease|-\S*f\S*)(\s|$)")
+# Force flags, and ONLY force flags.
+#
+# The previous pattern ended in `-\S*f\S*`, which matches any flag containing an
+# `f` anywhere - so it fired on `--ff-only`, `--follow-tags`, and `--file=...`.
+# Two real false positives followed:
+#
+#   git pull --ff-only && git push origin main   -> BLOCKED
+#   git push --follow-tags origin main           -> BLOCKED
+#
+# Neither rewrites history. `--follow-tags` is the normal way to push a release
+# tag with its commit, so the guard blocked a routine release step. Being
+# fail-closed is right for a data-loss guard, but only against the thing it
+# guards; blocking safe commands trains people to work around the hook, which
+# costs more safety than it buys.
+#
+# The short-flag arm is now `-[A-Za-z]*f[A-Za-z]*`: a SINGLE dash followed only by
+# letters, so it still catches `-f`, `-fq`, `-qf`, and never a `--long-flag`
+# (whose second character is `-`, not a letter).
+FORCE = re.compile(
+    r"(^|\s)("
+    r"--force(-with-lease|-if-includes)?(=\S+)?"  # --force, --force-with-lease[=ref], --force-if-includes
+    r"|-[A-Za-z]*f[A-Za-z]*"  # -f and short clusters containing f
+    r")(\s|$)"
+)
+
+
+# Shell separators that end one command and start the next. Used to attribute a
+# flag to the command it actually belongs to.
+SEPARATORS = re.compile(r"&&|\|\||;|\||\n")
+
+
+def push_segments(cmd: str) -> list:
+    """The sub-commands that invoke `git push`.
+
+    A flag must be attributed to its own command. Scanning the whole string made
+    `git commit -f ... && git push origin main` read as a force-push, because the
+    `-f` belonged to the commit. Splitting on shell separators first keeps each
+    command's flags with that command.
+
+    Deliberately coarse: a separator inside a quoted string splits too, which can
+    only ever produce MORE segments to inspect, never fewer - the safe direction
+    for a guard.
+    """
+    return [seg for seg in SEPARATORS.split(cmd) if re.search(r"git\s+push", seg.lower())]
 
 
 def decide(cmd: str) -> str:
@@ -35,8 +78,19 @@ def decide(cmd: str) -> str:
     if re.search(r"git\s+commit", low) and ATTRIBUTION.search(cmd):
         return "BLOCK_ATTRIB"
 
-    # Rule 2: force-push to a protected branch.
-    if re.search(r"git\s+push", low) and FORCE.search(cmd):
+    # Rule 2: force-push to a protected branch. Evaluate each push segment on its
+    # own so a neighbouring command's flags cannot implicate it.
+    for segment in push_segments(cmd):
+        verdict = _decide_push(segment)
+        if verdict != "OK":
+            return verdict
+
+    return "OK"
+
+
+def _decide_push(cmd: str) -> str:
+    """Verdict for a single `git push ...` command."""
+    if FORCE.search(cmd):
         try:
             toks = shlex.split(cmd)
         except Exception:

package/pipeline/scripts/audit-log.sh

@@ -80,3 +80,28 @@ LINE="{\"ts\":\"${TS}\",\"event\":\"$(json_escape "$EVENT")\",\"service\":\"$(js
 LINE="${LINE}}"
 
 echo "$LINE" >> "$AUDIT_FILE" 2>/dev/null || true
+
+# Opportunistic rotation. audit-log-rotate.sh documents a launchd/cron install,
+# but nothing ever told a user to set that up, so an unrotated trail would grow
+# without bound now that credential-store.sh writes an event on every PAT lookup.
+# Self-triggering removes the operator step: check a cheap size threshold and hand
+# off to the real rotator, which is atomic against concurrent appenders (it moves
+# the live inode first). Silent and non-blocking - telemetry never fails a run.
+ROTATE_AT_BYTES="${AUDIT_ROTATE_AT_BYTES:-1048576}"
+_audit_size() {
+  case "$(uname -s)" in
+    Darwin|*BSD*) stat -f %z "$1" 2>/dev/null || echo 0 ;;
+    *)            stat -c %s "$1" 2>/dev/null || echo 0 ;;
+  esac
+}
+if [ "${AUDIT_SELF_ROTATE:-1}" = "1" ] && [ -f "$AUDIT_FILE" ]; then
+  SIZE="$(_audit_size "$AUDIT_FILE")"
+  if [ "${SIZE:-0}" -ge "$ROTATE_AT_BYTES" ]; then
+    ROTATOR="$(dirname "${BASH_SOURCE[0]:-$0}")/audit-log-rotate.sh"
+    # The rotator derives AUDIT_FILE from AUDIT_DIR, so pass the DIRECTORY.
+    # Handing it AUDIT_FILE would leave it rotating the default path while a
+    # caller-overridden trail kept growing.
+    [ -f "$ROTATOR" ] &&
+      AUDIT_DIR="$(dirname "$AUDIT_FILE")" bash "$ROTATOR" >/dev/null 2>&1 || true
+  fi
+fi

package/pipeline/scripts/smoke-cross-cli-behavior.sh

@@ -190,22 +190,36 @@ fi
 # (the orchestrator dispatches per the doc), so lock the CONTRACT here against
 # drift across the phase doc, the schema, and the consensus block.
 echo "→ reviewer-count contract (Claude=2, Copilot=3)"
-REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-P4="$REPO_ROOT/pipeline/multi-agent-refs/phases/phase-4-review.md"
-REVSCHEMA="$REPO_ROOT/pipeline/schemas/reviewer-output.schema.json"
-TRSCHEMA="$REPO_ROOT/pipeline/schemas/triage-output.schema.json"
-if grep -qiE "Claude Code (dispatches|=|:) ?2|2-model" "$P4" && grep -qiE "Copilot CLI (dispatches|=|:) ?3|3-model" "$P4"; then
+# `/multi-agent:update` runs this smoke on the user's machine, where the tree is
+# ~/.claude/{schemas,multi-agent-refs} and NOT <root>/pipeline/*. Resolving the
+# root by hand here reported three phantom failures in an install, which reads as
+# a broken installation. _smoke-root.sh handles both layouts.
+# shellcheck source=pipeline/scripts/_smoke-root.sh
+. "$(dirname "${BASH_SOURCE[0]}")/_smoke-root.sh"
+P4="${MA_REFS:+$MA_REFS/phases/phase-4-review.md}"
+REVSCHEMA="${MA_SCHEMAS:+$MA_SCHEMAS/reviewer-output.schema.json}"
+TRSCHEMA="${MA_SCHEMAS:+$MA_SCHEMAS/triage-output.schema.json}"
+
+if [ -z "$P4" ] || [ ! -f "$P4" ]; then
+  echo "  ↷ SKIP: phase-4-review.md not present in this $MA_LAYOUT layout"
+elif grep -qiE "Claude Code (dispatches|=|:) ?2|2-model" "$P4" && grep -qiE "Copilot CLI (dispatches|=|:) ?3|3-model" "$P4"; then
   pass "phase-4-review declares Claude=2 / Copilot=3 reviewers"
 else
   fail "phase-4-review does not declare the CLI-aware reviewer count"
 fi
-if grep -qi "Copilot CLI" "$REVSCHEMA" && grep -qi "Claude" "$REVSCHEMA"; then
+
+if [ -z "$REVSCHEMA" ] || [ ! -f "$REVSCHEMA" ]; then
+  echo "  ↷ SKIP: reviewer-output.schema.json not present in this $MA_LAYOUT layout"
+elif grep -qi "Copilot CLI" "$REVSCHEMA" && grep -qi "Claude" "$REVSCHEMA"; then
   pass "reviewer-output schema notes the CLI-aware reviewer set"
 else
   fail "reviewer-output schema missing the CLI-aware note"
 fi
+
 # consensus.reviewerCount must accommodate both 2 and 3 (min 1, no max < 3)
-if grep -q '"reviewerCount"' "$TRSCHEMA" && grep -qi "Claude Code = 2, Copilot CLI = 3" "$TRSCHEMA"; then
+if [ -z "$TRSCHEMA" ] || [ ! -f "$TRSCHEMA" ]; then
+  echo "  ↷ SKIP: triage-output.schema.json not present in this $MA_LAYOUT layout"
+elif grep -q '"reviewerCount"' "$TRSCHEMA" && grep -qi "Claude Code = 2, Copilot CLI = 3" "$TRSCHEMA"; then
   pass "triage consensus.reviewerCount documents 2 (Claude) and 3 (Copilot)"
 else
   fail "triage consensus.reviewerCount does not document the 2/3 split"

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/expected/phase-1-analysis.json

@@ -1,25 +0,0 @@
-{
-  "stack": {
-    "primary": "ios",
-    "language": "Swift 6",
-    "framework": "SwiftUI"
-  },
-  "touchedAreas": [
-    {
-      "path": "Sources/Auth/LoginView.swift",
-      "why": "Hardcoded Color.white yerine DesignSystem.Color.Primary.onBackground kullanacak"
-    },
-    {
-      "path": "Sources/Auth/LoginViewTests.swift",
-      "why": "Dark mode snapshot + ViewInspector contrast assertion eklenecek"
-    }
-  ],
-  "risks": [
-    {
-      "risk": "LoginView başka ekran tarafından preview alanı olarak kullanılıyor olabilir  -  token değişimi preview snapshot'larını kırabilir",
-      "severity": "low",
-      "mitigation": "Preview varyantlarını snapshot'lar ile koruyarak incremental değiştir"
-    }
-  ],
-  "summary": "LoginView'de primary button rengi hardcoded Color.white. Token sistemi ile değiştirilip light+dark mode için ayrık snapshot testleri eklenecek. Değişim iki dosya ile sınırlı, regresyon riski düşük."
-}

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/expected/phase-2-plan.json

@@ -1,30 +0,0 @@
-{
-  "approach": "TDD-first. Önce dark-mode contrast için snapshot + ViewInspector testi yazılır (RED), sonra LoginView'de hardcoded renk token çağrısıyla değiştirilir (GREEN). Refactor: aynı dosyada ikinci hardcoded renk varsa tek geçişte temizlenir.",
-  "tasks": [
-    {
-      "id": "T1",
-      "title": "Add failing dark mode snapshot + contrast ViewInspector test",
-      "type": "test",
-      "files": ["Sources/Auth/LoginViewTests.swift"],
-      "dependsOn": [],
-      "acceptanceCriteria": [
-        "Snapshot test for dark mode renders primary button",
-        "ViewInspector asserts foreground color != Color.white when env.colorScheme == .dark"
-      ]
-    },
-    {
-      "id": "T2",
-      "title": "Replace hardcoded Color.white with DesignSystem token",
-      "type": "code",
-      "files": ["Sources/Auth/LoginView.swift"],
-      "dependsOn": ["T1"],
-      "acceptanceCriteria": [
-        "No Color(red:..., green:..., blue:...) or Color.white remains in LoginView",
-        "Primary button uses DesignSystem.Color.Primary.onBackground",
-        "All snapshot + inspector tests pass"
-      ]
-    }
-  ],
-  "approved": true,
-  "userFeedback": null
-}

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/expected/phase-4-review.json

@@ -1,20 +0,0 @@
-[
-  {
-    "reviewer": "opus",
-    "findings": [
-      {
-        "severity": "blocking",
-        "file": "Sources/Auth/LoginView.swift",
-        "line": 42,
-        "issue": "Hardcoded .font(.system(size: 14)) kaldı  -  aynı fix sırasında typography token'ına da bağlanmalı",
-        "fix": "Replace with .typographyStyle(.body1)  -  same pattern as the color token migration"
-      }
-    ],
-    "approved": false
-  },
-  {
-    "reviewer": "sonnet",
-    "findings": [],
-    "approved": true
-  }
-]

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/expected/phase-4-triage.json

@@ -1,15 +0,0 @@
-{
-  "accepted": [
-    {
-      "severity": "blocking",
-      "file": "Sources/Auth/LoginView.swift",
-      "line": 42,
-      "issue": "Hardcoded .font(.system(size: 14)) kaldı  -  aynı fix sırasında typography token'ına da bağlanmalı",
-      "fix": "Replace with .typographyStyle(.body1)  -  same pattern as the color token migration",
-      "reviewer": "opus"
-    }
-  ],
-  "deferred": [],
-  "rejected": [],
-  "approved": false
-}

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/metadata.json

@@ -1,14 +0,0 @@
-{
-  "focus": "SwiftUI bugfix path  -  verifies that Phase 4 picks up an in-scope but adjacent blocker (token drift) even when the primary issue is resolved.",
-  "exercises": [
-    "Phase 1 stack detection (iOS / Swift 6 / SwiftUI)",
-    "Phase 2 TDD ordering (test before code)",
-    "Phase 4 Reviewer-1 catches adjacent token drift; Reviewer-2 approves base fix",
-    "Triage keeps the blocker accepted, no deferrals, not approved"
-  ],
-  "regressionsCaught": [
-    "If stack detection drops SwiftUI from the framework field, this fixture fails the analysis schema check",
-    "If planning schema drops the 'dependsOn' field, T2 loses its order guarantee",
-    "If Phase 4 no longer tolerates Reviewer-1 blocker + Reviewer-2 approval (approved divergence), triage fixture fails"
-  ]
-}

package/pipeline/eval/golden-tasks/01-ios-bugfix-darkmode/task.json

@@ -1,12 +0,0 @@
-{
-  "title": "LoginView dark mode contrast fix",
-  "description": "Dark mode'da primary button text'i zemin rengiyle düşük kontrast veriyor. Tokens switch'i çalışmıyor çünkü LoginView hardcoded Color.white kullanıyor. Design tokens'a geri bağla.",
-  "inputType": "free-text",
-  "expectedStack": "ios",
-  "expectedLanguage": "Swift",
-  "expectedFramework": "SwiftUI",
-  "expectedBlockers": 1,
-  "expectedDeferrals": 0,
-  "baseBranch": "develop",
-  "taskBranch": "bugfix/loginview-dark-mode-contrast"
-}

package/pipeline/eval/golden-tasks/02-android-feature-compose/expected/phase-1-analysis.json

@@ -1,29 +0,0 @@
-{
-  "stack": {
-    "primary": "android",
-    "language": "Kotlin 2.1",
-    "framework": "Jetpack Compose"
-  },
-  "touchedAreas": [
-    {
-      "path": "feature/orders/src/main/java/com/example/orders/OrdersScreen.kt",
-      "why": "PullToRefreshBox UI eklenecek, ViewModel.refresh() tetiklenecek"
-    },
-    {
-      "path": "feature/orders/src/main/java/com/example/orders/OrdersViewModel.kt",
-      "why": "isRefreshing state flow eklenecek  -  PullToRefreshBox'ın state binding'i için"
-    },
-    {
-      "path": "feature/orders/src/test/java/com/example/orders/OrdersScreenTest.kt",
-      "why": "Pull-to-refresh compose testi eklenecek"
-    }
-  ],
-  "risks": [
-    {
-      "risk": "Material3 PullToRefreshBox henüz beta API  -  1.3.x'de signature değişti",
-      "severity": "medium",
-      "mitigation": "Existing libs.versions.toml'de material3 sürümünü teyit et, gerekirse bump et"
-    }
-  ],
-  "summary": "OrdersScreen Compose ekranına Material3 pull-to-refresh eklenir. ViewModel'de zaten refresh() var; UI binding + isRefreshing state + Compose testi yeterli. Material3 API surface'i beta olduğu için version check gerekir, risk orta."
-}

package/pipeline/eval/golden-tasks/02-android-feature-compose/expected/phase-2-plan.json

@@ -1,43 +0,0 @@
-{
-  "approach": "ViewModel state genişletilir (isRefreshing StateFlow), UI PullToRefreshBox'a bağlanır, Compose test yazılır. TDD: önce Compose testi refresh davranışını doğrulamalı (RED), sonra ViewModel + UI bağlanır.",
-  "tasks": [
-    {
-      "id": "T1",
-      "title": "Add failing Compose test for pull-to-refresh trigger",
-      "type": "test",
-      "files": ["feature/orders/src/test/java/com/example/orders/OrdersScreenTest.kt"],
-      "dependsOn": [],
-      "acceptanceCriteria": [
-        "Test performTouchInput { swipeDown() } on OrdersScreen",
-        "Asserts ViewModel.refresh() is called",
-        "Test initially fails because PullToRefreshBox is not wired"
-      ]
-    },
-    {
-      "id": "T2",
-      "title": "Add isRefreshing StateFlow to OrdersViewModel",
-      "type": "code",
-      "files": ["feature/orders/src/main/java/com/example/orders/OrdersViewModel.kt"],
-      "dependsOn": ["T1"],
-      "acceptanceCriteria": [
-        "isRefreshing: StateFlow<Boolean> exposed",
-        "refresh() sets isRefreshing = true, then false on completion"
-      ]
-    },
-    {
-      "id": "T3",
-      "title": "Wire PullToRefreshBox in OrdersScreen",
-      "type": "code",
-      "files": ["feature/orders/src/main/java/com/example/orders/OrdersScreen.kt"],
-      "dependsOn": ["T2"],
-      "acceptanceCriteria": [
-        "PullToRefreshBox wraps the list",
-        "isRefreshing bound from ViewModel state",
-        "onRefresh calls viewModel::refresh",
-        "Compose test from T1 passes"
-      ]
-    }
-  ],
-  "approved": true,
-  "userFeedback": null
-}

package/pipeline/eval/golden-tasks/02-android-feature-compose/expected/phase-4-review.json

@@ -1,35 +0,0 @@
-[
-  {
-    "reviewer": "opus",
-    "findings": [
-      {
-        "severity": "blocking",
-        "file": "feature/orders/src/main/java/com/example/orders/OrdersViewModel.kt",
-        "line": 28,
-        "issue": "refresh() içinde isRefreshing = false finally bloğunda değil  -  exception fırlatıldığında spinner sonsuza dek takılır",
-        "fix": "Wrap the body in try/finally and set _isRefreshing.value = false in finally"
-      },
-      {
-        "severity": "important",
-        "file": "feature/orders/src/main/java/com/example/orders/OrdersScreen.kt",
-        "line": 0,
-        "issue": "Yeni modifier chain lazılarla LazyColumn semantics test matcher'larını kırabilir  -  Compose stability endişesi var",
-        "fix": "Measure recomposition count with Compose Compiler Reports before merging"
-      }
-    ],
-    "approved": false
-  },
-  {
-    "reviewer": "sonnet",
-    "findings": [
-      {
-        "severity": "important",
-        "file": "feature/orders/src/main/java/com/example/orders/OrdersScreen.kt",
-        "line": 54,
-        "issue": "PullToRefreshState hoisted yerine composable içinde tutuluyor  -  configuration change'de state kaybı",
-        "fix": "Use rememberSaveable or hoist the state up to ViewModel"
-      }
-    ],
-    "approved": false
-  }
-]

package/pipeline/eval/golden-tasks/02-android-feature-compose/expected/phase-4-triage.json

@@ -1,35 +0,0 @@
-{
-  "accepted": [
-    {
-      "severity": "blocking",
-      "file": "feature/orders/src/main/java/com/example/orders/OrdersViewModel.kt",
-      "line": 28,
-      "issue": "refresh() içinde isRefreshing = false finally bloğunda değil  -  exception fırlatıldığında spinner sonsuza dek takılır",
-      "fix": "Wrap the body in try/finally and set _isRefreshing.value = false in finally",
-      "reviewer": "opus"
-    },
-    {
-      "severity": "important",
-      "file": "feature/orders/src/main/java/com/example/orders/OrdersScreen.kt",
-      "line": 54,
-      "issue": "PullToRefreshState hoisted yerine composable içinde tutuluyor  -  configuration change'de state kaybı",
-      "fix": "Use rememberSaveable or hoist the state up to ViewModel",
-      "reviewer": "sonnet"
-    }
-  ],
-  "deferred": [
-    {
-      "finding": {
-        "severity": "important",
-        "file": "feature/orders/src/main/java/com/example/orders/OrdersScreen.kt",
-        "line": 0,
-        "issue": "Yeni modifier chain lazılarla LazyColumn semantics test matcher'larını kırabilir  -  Compose stability endişesi var",
-        "fix": "Measure recomposition count with Compose Compiler Reports before merging",
-        "reviewer": "opus"
-      },
-      "reason": "Out of scope for this task  -  recomposition audit is a performance sweep, not a correctness gate for adding pull-to-refresh"
-    }
-  ],
-  "rejected": [],
-  "approved": false
-}

package/pipeline/eval/golden-tasks/02-android-feature-compose/metadata.json

@@ -1,14 +0,0 @@
-{
-  "focus": "Android/Compose feature path with mixed-verdict triage  -  one finding deferred out-of-scope, two accepted (one blocker + one important cross-reviewer match).",
-  "exercises": [
-    "Phase 1 stack detection (android / Kotlin 2.1 / Jetpack Compose)",
-    "Phase 2 3-task decomposition with clear dependency chain (T1 test → T2 VM → T3 UI)",
-    "Phase 4 Reviewer-1 + Reviewer-2 surface overlapping concerns at different lines",
-    "Triage deferred bucket works (important but out-of-scope finding parked, not actioned)"
-  ],
-  "regressionsCaught": [
-    "If triage schema removes the 'deferred' bucket, this fixture fails",
-    "If reviewer enum drops a required reviewer, accepted[] loses its reviewer attribution and schema fails",
-    "If planning schema drops 'dependsOn', T1→T2→T3 ordering becomes unverifiable"
-  ]
-}

package/pipeline/eval/golden-tasks/02-android-feature-compose/task.json

@@ -1,12 +0,0 @@
-{
-  "title": "Add pull-to-refresh on OrdersScreen",
-  "description": "Compose OrdersScreen'de swipe-to-refresh yok. Material3 PullToRefreshBox eklenmeli, ViewModel refresh() zaten var  -  UI tarafı bağlanmadı.",
-  "inputType": "free-text",
-  "expectedStack": "android",
-  "expectedLanguage": "Kotlin",
-  "expectedFramework": "Jetpack Compose",
-  "expectedBlockers": 1,
-  "expectedDeferrals": 1,
-  "baseBranch": "develop",
-  "taskBranch": "feature/orders-pull-to-refresh"
-}

package/pipeline/eval/golden-tasks/03-backend-python-ratelimit/expected/phase-1-analysis.json

@@ -1,29 +0,0 @@
-{
-  "stack": {
-    "primary": "backend",
-    "language": "Python 3.13",
-    "framework": "FastAPI"
-  },
-  "touchedAreas": [
-    {
-      "path": "app/middleware/rate_limit.py",
-      "why": "New sliding-window per-IP limiter implemented as ASGI middleware"
-    },
-    {
-      "path": "app/api/auth.py",
-      "why": "Login router registers the limiter and returns 429 + Retry-After on breach"
-    },
-    {
-      "path": "tests/test_rate_limit.py",
-      "why": "Covers allowed-under-limit, blocked-over-limit, and window reset"
-    }
-  ],
-  "risks": [
-    {
-      "risk": "An in-memory counter does not share state across Gunicorn/Uvicorn workers, so the limit is per-process not per-cluster",
-      "severity": "medium",
-      "mitigation": "Document the single-process assumption now; back it with Redis when the service scales horizontally"
-    }
-  ],
-  "summary": "Brute-force on POST /auth/login is unthrottled. Add a sliding-window per-IP limiter as middleware, wire it into the auth router, and return 429 with Retry-After. Scope is three files; the main caveat is multi-worker state sharing, deferred to a Redis-backed follow-up."
-}

package/pipeline/eval/golden-tasks/03-backend-python-ratelimit/expected/phase-2-plan.json

@@ -1,42 +0,0 @@
-{
-  "approach": "TDD-first. Write a failing test that fires N+1 requests from one IP and asserts the last one returns 429 with Retry-After (RED). Implement the sliding-window limiter middleware (GREEN). Wire it into the auth router and assert allowed traffic still passes (refactor + integration).",
-  "tasks": [
-    {
-      "id": "T1",
-      "title": "Add failing rate-limit tests (under limit, over limit, window reset)",
-      "type": "test",
-      "files": ["tests/test_rate_limit.py"],
-      "dependsOn": [],
-      "acceptanceCriteria": [
-        "N requests under the limit all return 200",
-        "The N+1th request within the window returns 429 with a Retry-After header",
-        "After the window elapses, requests are allowed again"
-      ]
-    },
-    {
-      "id": "T2",
-      "title": "Implement sliding-window per-IP limiter middleware",
-      "type": "code",
-      "files": ["app/middleware/rate_limit.py"],
-      "dependsOn": ["T1"],
-      "acceptanceCriteria": [
-        "Tracks request timestamps per client IP in a sliding window",
-        "Emits 429 with Retry-After once the threshold is exceeded",
-        "Window bookkeeping is safe under concurrent requests"
-      ]
-    },
-    {
-      "id": "T3",
-      "title": "Register the limiter on the auth login route",
-      "type": "code",
-      "files": ["app/api/auth.py"],
-      "dependsOn": ["T2"],
-      "acceptanceCriteria": [
-        "POST /auth/login passes through the limiter",
-        "Normal login traffic under the limit is unaffected"
-      ]
-    }
-  ],
-  "approved": true,
-  "userFeedback": null
-}

package/pipeline/eval/golden-tasks/03-backend-python-ratelimit/expected/phase-4-review.json

@@ -1,20 +0,0 @@
-[
-  {
-    "reviewer": "opus",
-    "findings": [
-      {
-        "severity": "blocking",
-        "file": "app/middleware/rate_limit.py",
-        "line": 38,
-        "issue": "The per-IP window dict is read-modified-written without a lock; under concurrent requests two coroutines can both pass the check and under-count, letting bursts through",
-        "fix": "Guard the read-modify-write with an asyncio.Lock keyed per IP, or use an atomic counter structure"
-      }
-    ],
-    "approved": false
-  },
-  {
-    "reviewer": "sonnet",
-    "findings": [],
-    "approved": true
-  }
-]

package/pipeline/eval/golden-tasks/03-backend-python-ratelimit/expected/phase-4-triage.json

@@ -1,15 +0,0 @@
-{
-  "accepted": [
-    {
-      "severity": "blocking",
-      "file": "app/middleware/rate_limit.py",
-      "line": 38,
-      "issue": "The per-IP window dict is read-modified-written without a lock; under concurrent requests two coroutines can both pass the check and under-count, letting bursts through",
-      "fix": "Guard the read-modify-write with an asyncio.Lock keyed per IP, or use an atomic counter structure",
-      "reviewer": "opus"
-    }
-  ],
-  "deferred": [],
-  "rejected": [],
-  "approved": false
-}

package/pipeline/eval/golden-tasks/03-backend-python-ratelimit/metadata.json

@@ -1,14 +0,0 @@
-{
-  "focus": "Backend (Python/FastAPI) feature path  -  verifies stack detection on a non-mobile repo and that Phase 4 catches a concurrency blocker (unsynchronized shared counter) in newly added middleware.",
-  "exercises": [
-    "Phase 1 stack detection (backend / Python / FastAPI)",
-    "Phase 2 TDD ordering (failing rate-limit test before middleware code)",
-    "Phase 4 Reviewer-1 (opus) catches a race condition on the shared window counter; Reviewer-2 (sonnet) approves the wiring",
-    "Triage keeps the concurrency blocker accepted, no deferrals, not approved"
-  ],
-  "regressionsCaught": [
-    "If stack detection misroutes a FastAPI repo to 'frontend' or 'unknown', the stack-match check fails",
-    "If planning emits files outside Phase 1 touchedAreas, the subset check fails",
-    "If triage stops requiring a reviewer attribution on accepted findings, this fixture fails validate-triage"
-  ]
-}

package/pipeline/eval/golden-tasks/03-backend-python-ratelimit/task.json

@@ -1,12 +0,0 @@
-{
-  "title": "Add per-IP rate limiting to the auth login endpoint",
-  "description": "Brute-force attempts on POST /auth/login are unthrottled. Add per-IP rate limiting (sliding window) as FastAPI middleware and wire it into the auth router. Return 429 with Retry-After when the limit is exceeded.",
-  "inputType": "free-text",
-  "expectedStack": "backend",
-  "expectedLanguage": "Python",
-  "expectedFramework": "FastAPI",
-  "expectedBlockers": 1,
-  "expectedDeferrals": 0,
-  "baseBranch": "main",
-  "taskBranch": "feature/auth-rate-limit"
-}

package/pipeline/eval/golden-tasks/04-frontend-next-hydration/expected/phase-1-analysis.json

@@ -1,29 +0,0 @@
-{
-  "stack": {
-    "primary": "frontend",
-    "language": "TypeScript 5",
-    "framework": "Next.js"
-  },
-  "touchedAreas": [
-    {
-      "path": "components/CartBadge.tsx",
-      "why": "Reads localStorage during render, diverging from the server-rendered 0"
-    },
-    {
-      "path": "hooks/useCart.ts",
-      "why": "Exposes the count; needs an SSR-safe initial value with hydration on mount"
-    },
-    {
-      "path": "components/CartBadge.test.tsx",
-      "why": "Adds a render test asserting no hydration warning and the count appears after mount"
-    }
-  ],
-  "risks": [
-    {
-      "risk": "Other components may also read the same localStorage key during render and reintroduce the mismatch elsewhere",
-      "severity": "low",
-      "mitigation": "Centralize the SSR-safe read in useCart so callers share one hydration-safe source"
-    }
-  ],
-  "summary": "The cart badge reads localStorage during render while the server renders 0, triggering a hydration mismatch and a count flash. Move the read behind an SSR-safe initial value that hydrates on mount, centralized in useCart. Three files; low regression risk if the read stays centralized."
-}