@mmerterden/multi-agent-pipeline 14.1.1 → 14.2.2

package/pipeline/commands/multi-agent/testflight-validation/SKILL.md

@@ -1,219 +1,46 @@
 ---
-description: "Pre-submission validation for a TestFlight / App Store build (iOS, local-only). Three gates: static archive audit, Apple's own `altool --validate-app`, and a Review-Guidelines check. ITMS codes are mapped to the rule each implies. Validates only, never uploads. Use when a build is about to go to TestFlight, or a submission was rejected and you need why."
-description-tr: "TestFlight / App Store yüklemesi öncesi doğrulama (iOS, yalnızca lokal). Repo + branch seç, sonra ya build'i sen ver ya da koşu archive alsın; üç kapıyı geç: statik 18-kurallı archive denetimi, Apple'ın kendi `altool --validate-app`'i, ve App Store Review Guidelines'a karşı guideline incelemesi. Her kapı için ayrı verdict, ITMS kodları ilgili kurala eşlenmiş. Sadece doğrular  -  asla yüklemez."
+description: "iOS-pinned alias of store-ready: same three gates on an iOS build, one implementation. Validates a TestFlight / App Store package, never uploads. Use when an iOS build is about to go to TestFlight, or a submission was rejected and you need why."
+description-tr: "store-ready komutunun iOS'a sabitlenmiş alias'ı: iOS build'inde aynı üç kapı, tek implementasyon. TestFlight / App Store paketini doğrular, asla yüklemez."
 argument-hint: "[repo]  -  empty = pick from prefs; repo name or path; --ipa=<path>; --archive=<path>; --resume"
 allowed-tools: Agent, Bash, Read, Write, Edit, Glob, Grep, TaskCreate, TaskUpdate, AskUserQuestion, Skill, mcp__dev-toolkit__ios_app_store_audit, mcp__dev-toolkit__ios_export_ipa, mcp__dev-toolkit__ios_testflight_validate, mcp__dev-toolkit__ios_xcodebuild, mcp__dev-toolkit__ios_xcresult
 ---
 
-# /multi-agent:testflight-validation  -  pre-submission validation
+# /multi-agent:testflight-validation  -  iOS alias for store-ready
 
-Catch, before you upload, what App Store Connect would send back after you do.
+This command is an alias. The implementation it used to carry was merged into
+`/multi-agent:store-ready`, which runs the same three gates on iOS and adds the
+Android side, so there is one flow to maintain instead of two that had already
+started to drift.
 
-**Local-only.** No commits, no push, no PR, no channels. The worktree exists only
-to archive without touching your working tree.
+The name is kept because it is the one people reach for when the target is
+TestFlight, and removing a command is a breaking change to the slash-command
+surface.
 
-**It never uploads.** Only `--validate-app` is ever invoked, never `--upload-app`.
-A validation run must not be able to ship a build by accident.
+## Dispatcher
 
-## Why three gates and not one
-
-Each gate sees something the others structurally cannot. Reporting one of them as
-"the check" is how a build passes locally and gets rejected anyway.
-
-| Gate | What runs | Needs | Sees | Blind to |
-|---|---|---|---|---|
-| **1. Static** | `ios_app_store_audit` (18 rules, real ITMS codes) | an `.xcarchive` | privacy manifest, required-reason API, Info.plist, code signing, entitlements, embedded SDK, IPv6, debug-tool leak, binary size | anything that depends on the App Store Connect account |
-| **2. Authoritative** | `ios_testflight_validate` → `altool --validate-app` | an `.ipa` + credentials | unregistered bundle ID, profile that does not match the app record, **a version+build pair already used**, entitlements not provisioned for the App ID | the Review Guidelines  -  Apple's validator does not read them |
-| **3. Guideline** | `app-store-review` skill + repo evidence | repo checkout | ATT flow, privacy policy, account deletion, IAP rules, purpose-string wording, permission justification | anything not visible in source |
-
-Gate 2 is the only one that asks Apple, and Gate 3 is the only one that covers the
-rejections a human reviewer writes. Most "we passed validation and still got
-rejected" cases are Gate 3 findings.
-
-## Step 0  -  parse input
-
-| Input | Meaning |
-|---|---|
-| (empty) | ask which repo (Step 1) |
-| `my-ios-app` or a path | that repo |
-| `--ipa=<path>` | Mode B with an `.ipa`; Gate 1 cannot run (see Step 3) |
-| `--archive=<path>` | Mode B with an `.xcarchive`; all three gates run |
-| `--resume` | continue the last run from its state file |
-
-State lives at `$HOME/.claude/logs/multi-agent/<task_id>/agent-state.json` with
-`taskId = TFV-<repo>-<yyyymmddHHMM>`. Register phases with the tracker
-(`$HOME/.claude/multi-agent-refs/tracker-contract.md`) so `:resume` and `:status`
-work like any other run.
-
-## Step 1  -  pickers (native, always)
-
-Use `AskUserQuestion` for every step  -  never a numbered text menu. Questions and
-descriptions render in `prefs.global.outputLanguage`; `label` and `header` stay
-English, per `$HOME/.claude/multi-agent-refs/picker-contract.md`. Print the
-`Step <i>/<n>: <what this decides>` breadcrumb for each.
-
-1. **Repo**  -  from `prefs.projects` where the stack is iOS. A single match
-   auto-resolves (say so in the breadcrumb, do not silently skip the step).
-2. **Branch**  -  the branch to validate. Resolution order:
-   - `git fetch --prune` first, capturing **stderr**. **If the fetch fails, do not
-     silently fall back to a cached ref**, and **classify before naming a cause**  -
-     the same rule as the `/multi-agent:dev` remote gate:
-
-     | stderr contains | Cause | Remedy |
-     |---|---|---|
-     | `could not read Password`, `Authentication failed`, `403` | credential | store the PAT in the credential helper or switch the remote to SSH. **A VPN cannot fix this**, and the base ref being stale is unrelated to what broke  -  do not offer the cached-ref fallback. |
-     | `Could not resolve host`, `Operation timed out`, `Connection refused` | network | retry / continue on the cached ref with an explicit warning / switch remote / abort, per `$HOME/.claude/multi-agent-refs/rules.md` |
-     | `Repository not found`, `404` | wrong remote | show `git remote -v` and ask |
-
-     Always print the observed stderr line next to the classification. Asserting
-     `unreachable (VPN/DNS)` for a missing-credential error that returns in under a
-     second sends the user to fix something that was never broken.
-   - Offer the current branch, the default branch, and any `release/*` /
-     `tkdevelop/*` heads.
-3. **Mode**  -  how the build is obtained:
-   - `Supply a build` (Mode B, default)  -  fastest, no signing needed in-run.
-   - `Archive from this branch` (Mode A)  -  needs a distribution certificate and
-     profile in the keychain, and takes as long as a release archive.
-
-## Step 2  -  pre-flight, before anything expensive
-
-Report every line; a missing prerequisite is a halt, not a warning.
-
-```bash
-xcrun --find altool >/dev/null 2>&1 || echo "MISSING: altool (install Xcode)"
-xcodebuild -version | head -1
-```
-
-Then resolve credentials, and **state which tier is active in the report**:
-
-| Tier | Source | Effect |
-|---|---|---|
-| 1 | ASC API key  -  key id + issuer id from the keychain via `prefs.global.keychainMapping`, `.p8` at `~/.appstoreconnect/private_keys/AuthKey_<keyId>.p8` | Gate 2 runs |
-| 2 | Apple ID + app-specific password, referenced as a keychain item | Gate 2 runs |
-| 3 | neither | **Gate 2 reports `SKIPPED`, and the run says so in the verdict line** |
-
-Credentials come from `/multi-agent:setup`; never prompt for a secret value in
-chat. If nothing is configured, tell the user which of the two tiers they can set
-up and that tier 2 needs no elevated App Store Connect role.
-
-Multi-provider accounts need `--provider-public-id`. When it is not in prefs, run
-`ios_testflight_validate({list_providers: true})` once and ask which provider.
-
-## Step 3  -  obtain the build
-
-### Mode B  -  a build you supply
-
-- `.xcarchive` → Gate 1 runs on it. To reach Gate 2 the archive must be exported,
-  so run `ios_export_ipa` (see Mode A step 3 for the signing inputs).
-- `.ipa` only → **Gate 1 is reported `SKIPPED (needs .xcarchive)`.** The static
-  audit reads archive structure that an `.ipa` does not carry. Do not present a
-  two-gate run as a full pass; say which gate did not run and why, and offer to
-  re-run with the archive.
-
-### Mode A  -  archive from the branch
-
-1. Worktree at `{projectRoot}/{worktreeBasePath}/{taskId}` on the chosen branch.
-   **Never under `$HOME`**, never a direct checkout of the main working tree.
-2. Resolve the scheme and workspace/project from prefs; ask if ambiguous.
-3. Archive:
-   `ios_xcodebuild({workspace|project, scheme, action: "archive", configuration: "Release", destination: "generic/platform=iOS"})`
-   Note the destination: the simulator default would produce an archive that
-   cannot be exported for distribution.
-4. Export:
-   `ios_export_ipa({archive_path, output_dir, method: "app-store-connect", team_id, provisioning_profiles?, signing_style?})`
-   Leave `allow_provisioning_updates` off unless the user asks: it lets xcodebuild
-   create or modify profiles in the developer account, which a validation run has
-   no business doing.
-5. A failed export halts with the parsed errors. The usual causes are a missing
-   distribution certificate, a profile that does not match the bundle ID, or
-   `signing_style: "manual"` with no `provisioning_profiles` map.
-
-## Step 4  -  Gate 1, static audit
-
-`ios_app_store_audit({archive_path, rules: "all"})`.
-
-`error` findings are blocking; `warning` is advisory. Group the output by severity
-and keep each finding's ITMS code  -  Gate 2 may return the same code, and seeing
-it in both places tells the user it is real rather than a heuristic.
-
-## Step 5  -  Gate 2, Apple's own validation
-
-`ios_testflight_validate({ipa_path, platform: "ios", <credential args>})`.
-
-Render the verdict exactly as returned:
-
-- `PASS`  -  Apple accepted the binary for delivery.
-- `FAIL`  -  list each issue with its ITMS code, the mapped guideline, and the hint.
-- `SKIPPED`  -  print the reason. **Never render this as a pass.** The verdict line
-  for the whole run must read `2 of 3 gates cleared, 1 skipped`, not `passed`.
-
-Gate 2 is the only gate that catches a build number already used  -  the most
-common wasted upload  -  so when it fails on that, say so plainly and name the next
-free build number.
-
-## Step 6  -  Gate 3, guideline review
-
-Load the `app-store-review` skill and review the repo against it. This is the gate
-that catches what a human reviewer rejects, so it reads source, not the binary:
-
-| Area | Evidence to gather |
-|---|---|
-| Purpose strings | every `NS*UsageDescription` in Info.plist  -  present, specific, user-facing, and matching what the code actually does with the data |
-| Privacy manifest | `PrivacyInfo.xcprivacy` exists, declares required-reason APIs, and matches the SDKs actually linked |
-| Tracking | if any tracking API or SDK is present, an ATT prompt exists and runs before collection |
-| Account deletion | if the app creates accounts, an in-app deletion path exists (guideline 5.1.1(v)) |
-| Privacy policy | reachable in-app and in the metadata |
-| IAP | anything unlocking features goes through StoreKit, with no external purchase path |
-| Sign in with Apple | present when a third-party social login is offered |
-
-For each: `pass` / `fail` / `not-applicable` with the evidence path that justifies
-it. `not-applicable` needs a reason  -  an unexamined area is not a pass.
-
-## Step 7  -  report
-
-Write to `~/TestFlightChecks/<repo>-<branch>-<timestamp>/report.md` and print a
-summary. Structure:
+Read this file and apply its instructions:
 
 ```
-Verdict: <N> of 3 gates cleared[, <M> skipped]
-Build:   <ipa or archive path>  ·  <bundle id> <version> (<build>)
-Auth:    tier <1|2|none>  ·  <method>
-
-Gate 1  static audit        PASS | FAIL (<n> blocking, <n> advisory) | SKIPPED (<reason>)
-Gate 2  Apple validation    PASS | FAIL (<n> issues) | SKIPPED (<reason>)
-Gate 3  guideline review    PASS | FAIL (<n> findings) | <n> not-applicable
-
-Blocking  -  fix before uploading
-  [ITMS-90683] Info.plist: NSCameraUsageDescription missing
-      guideline 5.1.1 Data Collection and Storage
-      <hint>
-      <file:line>
-
-Advisory
-  ...
-
-Not run
-  Gate 1: needs an .xcarchive; only an .ipa was supplied
+$HOME/.claude/commands/multi-agent/store-ready/SKILL.md
 ```
 
-Rules for the report:
+Run it with **platform pinned to `ios`** and skip its platform-detection step. Pass
+`$ARGUMENTS` through verbatim: `--ipa=`, `--archive=`, a repo name or path, and
+`--resume` all mean exactly what they mean there.
 
-- A skipped gate is never folded into the pass count. The verdict line states the
-  skip.
-- Every blocking finding carries a file path or an ITMS code. A finding the user
-  cannot act on is noise.
-- No AI or assistant attribution anywhere, per
-  `$HOME/.claude/rules/git-conventions.md`.
-- Real newlines, no HTML entities, per
-  `$HOME/.claude/multi-agent-refs/rules.md "External System Outputs"`.
+`--aab=` / `--apk=` are Android inputs and are not valid here. If one is supplied,
+do not silently switch platform  -  say the Android inputs belong to
+`/multi-agent:store-ready`, and stop.
 
-## Step 8  -  offer the next action, do not take it
+## What you get
 
-Print, and stop:
+Unchanged from before the merge, on the iOS path:
 
-- the exact `xcrun altool --upload-app` command for when the gates are clear, so
-  uploading stays an explicit human act
-- `/multi-agent:testflight-validation --resume` to re-run after fixes
-- `/multi-agent:fix-bug` when Gate 3 produced code-level findings
+| Gate | What runs | Needs |
+|---|---|---|
+| **1. Static** | `ios_app_store_audit` (18 rules, real ITMS codes) | an `.xcarchive` |
+| **2. Authoritative** | `ios_testflight_validate` → `altool --validate-app` | an `.ipa` + credentials |
+| **3. Policy** | `app-store-review` skill vs repo source | repo checkout |
 
-Never upload, never bump the build number, never commit.
+A skipped gate is never folded into the pass count, and the run never uploads. The
+report lands in `~/StoreChecks/ios-<repo>-<branch>-<timestamp>/report.md`.

package/pipeline/commands/multi-agent/update/SKILL.md

@@ -101,7 +101,7 @@ Update the pipeline in one command. Existing preferences are preserved; only ski
 ```
 Current: v3.6.0
   -> git pull origin main
-  -> node install.js --all (44 commands, 50 scripts, 291 skills)
+  -> node install.js --all (49 commands, 50 scripts, 202 skills)
   -> migrate-prefs.mjs (0 changes  -  already v2.1.0)
 
 ✓ Updated: v3.6.0 → v3.7.0

package/pipeline/commands/sim-test.md

@@ -35,12 +35,36 @@ For Android: use `mcp__dev-toolkit__android_*` tools
 /multi-agent test "accessibility"      -> accessibility audit (visual + MCP audit tool)
 /multi-agent test "dynamic type"       -> large text test
 /multi-agent test "screenshot tr"      -> locale screenshots
-/multi-agent test "store-ready"        -> full audit: visual + accessibility + archive/APK compliance
-/multi-agent test "biometric"          -> Face ID / Touch ID flow test
-/multi-agent test "performance"        -> launch time + scroll performance
+/multi-agent test "store-ready"        -> hands off to /multi-agent:store-ready (package validation)
 /sim-test                              -> standalone (same thing)
 ```
 
+Not offered, deliberately  -  `"biometric"` and `"performance"` were listed here with
+no implementation section, so reaching one fell through to the general sweep and got
+reported as the scenario asked for. Neither can be implemented symmetrically today:
+biometric has an iOS tool (`ios_biometric`) and no Android counterpart, and launch
+timing has `android_launch_time` and no iOS counterpart. Platform is auto-detected,
+so either one would work on one platform and silently do nothing on the other. They
+come back when the missing side exists, not before  -  do not re-add the rows to make
+the list look complete.
+
+Four scenarios also have a fixed-scenario command that pins the tag, so it does not
+have to be typed or quoted. They arrive here with the scenario already resolved  -
+treat them as identical to the quoted form:
+
+```
+/multi-agent:test-dark-mode            -> scenario "dark mode"
+/multi-agent:test-accessibility        -> scenario "accessibility"
+/multi-agent:test-dynamic-type         -> scenario "dynamic type"
+/multi-agent:test-screenshots [locale] -> scenario "screenshot <locale>", locale defaults to tr
+```
+
+`store-ready` is not one of them, and does not belong to this file at all: it
+validates a built package on either platform and lives at
+`/multi-agent:store-ready`. The `"store-ready"` tag is kept as a hand-off so an
+existing invocation still lands somewhere correct. `/multi-agent:testflight-validation`
+is the iOS-pinned alias of that same command.
+
 ## Flow
 
 ### Step 1  -  Device & App Discovery
@@ -121,43 +145,28 @@ Call: ios_set_locale(language: "<lang>", bundle_id: "...")
 
 **"store-ready":**
 
-Runs visual + accessibility pass AND dispatches the platform-matching compliance skill so the build is pre-validated against Apple / Google store requirements before submission.
+Not implemented here. `store-ready` validates a built **package**, which is a
+different job from driving a running app, and it is owned by one command on both
+platforms:
 
 ```
-Platform detection:
-  cwd contains .xcodeproj OR Package.swift             -> iOS
-  cwd contains build.gradle OR build.gradle.kts        -> Android
-  Otherwise                                            -> error: "store-ready needs an iOS or Android project"
-
-Step A  -  run the standard visual + accessibility sweep (light + dark + large text).
-
-Step B  -  dispatch compliance skill:
-  iOS:
-    Load $HOME/.claude/skills/apple-archive-compliance/SKILL.md
-    Prereq: @mmerterden/dev-toolkit-mcp ≥ v2.9.0 (provides ios_app_store_audit MCP tool)
-             -  installable via npm; standalone ArchiveGuard binary deprecated in v8.4.0
-    Artifact: pick newest .xcarchive under ~/Library/Developer/Xcode/Archives/**
-              OR accept explicit path argument after "store-ready"
-    Invoke:   mcp__dev-toolkit__ios_app_store_audit({ archive_path: <path>, rules: "all" })
-              OR (Node fallback): node -e "import('@mmerterden/dev-toolkit-mcp/tools/ios-app-store-audit/index.js').then(m => m.runAudit({ archivePath: '<path>', rules: 'all' }).then(r => console.log(JSON.stringify(r))))"
-              Humanize via --lang en (promptLanguage is locked to "en"; pass --lang=tr explicitly to opt into Turkish)
-  Android:
-    Load $HOME/.claude/skills/google-play-compliance/SKILL.md
-    Prereq: bundletool, aapt2, apksigner in PATH (Android SDK build-tools)
-    Artifact: newest .aab under **/build/outputs/bundle/**/*.aab
-              OR explicit path argument
-    Invoke:   bundletool validate + dump manifest, aapt2 dump badging,
-              apksigner verify, ABI/native scan
-  Merge findings with UI-hunter findings -> single report, severity-grouped.
-
-Step C  -  humanize via `--lang en` by default (promptLanguage is locked to "en"; pass --lang=tr explicitly to opt into Turkish), group by severity
-  (error = blocker, warning = risk, info = hygiene), link each finding to the
-  Apple ITMS / Play policy reference supplied by the skill catalog.
-
-Step D  -  offer `/multi-agent:channels` follow-up so findings can land in
-  Jira / Confluence / Wiki / PR body via the normal Phase 7 machinery.
+$HOME/.claude/commands/multi-agent/store-ready/SKILL.md
 ```
 
+Read that file and follow it. Pass through any artifact path given after
+`store-ready` as its `--archive=` / `--ipa=` / `--aab=` / `--apk=` input.
+
+Its Step A is the visual + accessibility sweep in this file  -  it calls back here
+for the running-app half, then runs three gates per platform that nothing in this
+file can do: the static package audit, the store's own validator, and a policy
+review against repo source. It merges both halves into one severity-grouped report
+and offers the `/multi-agent:channels` follow-up.
+
+The archive-compliance audit used to be duplicated here, invoking
+`ios_app_store_audit` with exactly the arguments the store-ready command's Gate 1
+uses. Two copies of one call is how the iOS path grew a second door with no Gate 2,
+no Gate 3 and no Android parity, so the copy is gone rather than kept in sync.
+
 **No argument (full test):**
 
 - Run light mode -> all screens

package/pipeline/lib/extract-conventions.sh

@@ -140,9 +140,31 @@ run_find() {
   if [ "${#roots[@]}" -eq 0 ]; then
     return 0
   fi
+  # No explicit -print anywhere in this expression means find falls back to
+  # its own implicit print on the WHOLE expression - which fires for every
+  # true branch of the -prune OR-chain too, including the pruned directories
+  # themselves (their contents are still correctly skipped; the dir path
+  # itself was not). An explicit -print, implicit-AND'd onto the caller's own
+  # criteria as the OR-chain's last branch, only fires on that branch.
   find "${roots[@]}" \
     "${SKIP_PRUNE_ARGS[@]}" \
-    "$@" 2>/dev/null || true
+    "$@" -print 2>/dev/null || true
+}
+
+# Count how many of the newline-separated paths in $1 contain a line matching
+# grep pattern $2. `xargs grep -l` here used to word-split on whitespace by
+# default, so any path with a space in it was silently mis-scanned as several
+# nonexistent partial paths (a false-negative on real matches, not an error -
+# stderr was already redirected to /dev/null). Reading line-by-line handles
+# that correctly since each line is one whole path regardless of embedded
+# spaces.
+count_grep_hits() {
+  local list="$1" pattern="$2" n=0 f
+  while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    grep -lq "$pattern" "$f" 2>/dev/null && n=$((n + 1))
+  done <<< "$list"
+  printf '%s' "$n"
 }
 
 # ---- confidence classifier ----------------------------------------------------
@@ -849,8 +871,15 @@ bucket_localization_key() {
   case "$PLATFORM" in
     ios)
       local strings_files xcstrings_files
-      strings_files=$(find "$REPO_PATH" -name 'Localizable.strings' "${SKIP_PRUNE_ARGS[@]}" -o -name 'Localizable.strings' -type f -print 2>/dev/null | head -5 || true)
-      xcstrings_files=$(find "$REPO_PATH" -name 'Localizable.xcstrings' -type f 2>/dev/null | head -3 || true)
+      # An earlier version ANDed -name onto the FRONT of the prune chain
+      # (`-name X SKIP_PRUNE_ARGS...`), which requires every -prune branch to
+      # ALSO be named "Localizable.strings" - a directory prune can never
+      # satisfy that, so no prune ever fired and the search walked into
+      # Pods/.build/node_modules looking for vendored copies. Prunes must
+      # stay their own independent OR-chain, ahead of (not ANDed with) the
+      # real search criteria. The xcstrings search had no prune chain at all.
+      strings_files=$(find "$REPO_PATH" "${SKIP_PRUNE_ARGS[@]}" -name 'Localizable.strings' -type f -print 2>/dev/null | head -5 || true)
+      xcstrings_files=$(find "$REPO_PATH" "${SKIP_PRUNE_ARGS[@]}" -name 'Localizable.xcstrings' -type f -print 2>/dev/null | head -3 || true)
       if [ -n "$strings_files" ]; then
         keys=$(printf '%s\n' "$strings_files" | while IFS= read -r f; do
           [ -n "$f" ] && grep -hEo '^"[^"]+"' "$f" 2>/dev/null | tr -d '"'
@@ -918,9 +947,9 @@ bucket_di_registration() {
       fi
       files=$(run_find -type f -name '*.swift' 2>/dev/null || true)
       if [ -n "$files" ]; then
-        resolver_count=$(printf '%s\n' "$files" | xargs grep -l 'Resolver.register' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-        factory_count=$(printf '%s\n' "$files" | xargs grep -l '@Injected\|Container.shared' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-        swinject_count=$(printf '%s\n' "$files" | xargs grep -l 'Swinject\|Container()' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+        resolver_count=$(count_grep_hits "$files" 'Resolver.register')
+        factory_count=$(count_grep_hits "$files" '@Injected\|Container.shared')
+        swinject_count=$(count_grep_hits "$files" 'Swinject\|Container()')
       fi
       manual_count=${manual_count:-0}; resolver_count=${resolver_count:-0}; factory_count=${factory_count:-0}; swinject_count=${swinject_count:-0}
 
@@ -941,9 +970,9 @@ bucket_di_registration() {
       files=$(run_find -type f -name '*.kt' 2>/dev/null || true)
       if [ -z "$files" ]; then empty_bucket; return; fi
       local hilt_count koin_count dagger_count
-      hilt_count=$(printf '%s\n' "$files" | xargs grep -l '@Module\|@InstallIn\|@HiltViewModel' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      koin_count=$(printf '%s\n' "$files" | xargs grep -l 'koinViewModel\|module {' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      dagger_count=$(printf '%s\n' "$files" | xargs grep -l '@Component\|@Subcomponent' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+      hilt_count=$(count_grep_hits "$files" '@Module\|@InstallIn\|@HiltViewModel')
+      koin_count=$(count_grep_hits "$files" 'koinViewModel\|module {')
+      dagger_count=$(count_grep_hits "$files" '@Component\|@Subcomponent')
       hilt_count=${hilt_count:-0}; koin_count=${koin_count:-0}; dagger_count=${dagger_count:-0}
       if [ "$hilt_count" -ge "$koin_count" ] && [ "$hilt_count" -ge "$dagger_count" ] && [ "$hilt_count" -gt 0 ]; then
         emit_bucket "Hilt" "@Module @InstallIn(SingletonComponent::class)" "$(confidence_for "$hilt_count")" "[]" '["Koin","Dagger"]'
@@ -959,9 +988,9 @@ bucket_di_registration() {
       files=$(run_find -type f -name '*.py' 2>/dev/null || true)
       if [ -z "$files" ]; then empty_bucket; return; fi
       local depends_count dishka_count di_count
-      depends_count=$(printf '%s\n' "$files" | xargs grep -l 'Depends(' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      dishka_count=$(printf '%s\n' "$files" | xargs grep -l 'dishka' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      di_count=$(printf '%s\n' "$files" | xargs grep -l 'dependency_injector' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+      depends_count=$(count_grep_hits "$files" 'Depends(')
+      dishka_count=$(count_grep_hits "$files" 'dishka')
+      di_count=$(count_grep_hits "$files" 'dependency_injector')
       depends_count=${depends_count:-0}; dishka_count=${dishka_count:-0}; di_count=${di_count:-0}
       if [ "$depends_count" -ge "$dishka_count" ] && [ "$depends_count" -ge "$di_count" ] && [ "$depends_count" -gt 0 ]; then
         emit_bucket "FastAPI Depends" "def handler(svc: FooService = Depends(get_service))" "$(confidence_for "$depends_count")" "[]" '["dishka","dependency_injector"]'
@@ -977,9 +1006,9 @@ bucket_di_registration() {
       files=$(run_find -type f \( -name '*.tsx' -o -name '*.ts' \) 2>/dev/null || true)
       if [ -z "$files" ]; then empty_bucket; return; fi
       local context_count zustand_count hook_count
-      context_count=$(printf '%s\n' "$files" | xargs grep -l 'createContext\|\.Provider' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      zustand_count=$(printf '%s\n' "$files" | xargs grep -l "from 'zustand'\|from \"zustand\"" 2>/dev/null | wc -l | tr -d ' ' || echo 0)
-      hook_count=$(printf '%s\n' "$files" | xargs grep -l 'export function use[A-Z]' 2>/dev/null | wc -l | tr -d ' ' || echo 0)
+      context_count=$(count_grep_hits "$files" 'createContext\|\.Provider')
+      zustand_count=$(count_grep_hits "$files" "from 'zustand'\\|from \"zustand\"")
+      hook_count=$(count_grep_hits "$files" 'export function use[A-Z]')
       context_count=${context_count:-0}; zustand_count=${zustand_count:-0}; hook_count=${hook_count:-0}
       if [ "$context_count" -ge "$zustand_count" ] && [ "$context_count" -ge "$hook_count" ] && [ "$context_count" -gt 0 ]; then
         emit_bucket "React Context Provider" "const FooContext = createContext<Foo>(...)" "$(confidence_for "$context_count")" "[]" '["zustand","custom-hook-factory"]'

package/pipeline/lib/fetch-figma-annotations.sh

@@ -124,10 +124,17 @@ trap 'rm -rf "$TMPDIR_A"' EXIT INT TERM
 # curl one /nodes batch (token via -K config so it never lands in argv).
 curl_nodes() {
   local out="$1" ids="$2" code
+  # curl already writes "000" via -w on a total connection failure (and
+  # still exits non-zero for it, which the inner `|| echo "000"` used to
+  # catch too - so `code` became the literal string "000000", never
+  # matching a plain "000" comparison anywhere downstream). `|| true` keeps
+  # a failing curl from tripping any caller's `set -e` without re-printing
+  # into $code; `:-000` only fills in when curl fails before -w ever runs.
   code=$(curl -sS -o "$out" -w '%{http_code}' \
             --max-time "$HTTP_TIMEOUT" --connect-timeout 5 \
             -K <(printf 'header = "X-Figma-Token: %s"\n' "$FIGMA_TOKEN") \
-            "$FIGMA_API/files/$FILE_KEY/nodes?ids=$ids" || echo "000")
+            "$FIGMA_API/files/$FILE_KEY/nodes?ids=$ids") || true
+  code="${code:-000}"
   printf '%s' "$code"
 }
 

package/pipeline/lib/fetch-fortify.sh

@@ -202,18 +202,33 @@ fortify_get() {
   return 1
 }
 
-VERSION_JSON=$(fortify_get "projectVersions/$VERSION_ID" || true)
-case "$VERSION_JSON" in
-  HTTP_AUTH_FAILED|*HTTP_4*)
-    echo "ERR: Fortify auth failed (Bearer + FortifyToken both rejected)" >&2
-    exit 3 ;;
-esac
+# Check fortify_get's actual exit status, not a string pattern over its
+# output - the old `case ... HTTP_AUTH_FAILED|*HTTP_4*)` only recognized
+# auth failures and 4xx. A dropped connection, timeout, or 5xx made
+# fortify_get return "...\nHTTP_000"/"...\nHTTP_5xx", which matched neither
+# arm, so the case fell through, VERSION_JSON stayed unparseable garbage,
+# and the Python block below silently treated that as "0 issues found" -
+# the security gate passing precisely when it couldn't check anything.
+if ! VERSION_JSON=$(fortify_get "projectVersions/$VERSION_ID"); then
+  echo "ERR: Fortify fetch failed for projectVersions/$VERSION_ID: ${VERSION_JSON:-no response}" >&2
+  exit 3
+fi
 
 ISSUES_JSON=""
 if [ -n "$ISSUE_ID" ]; then
-  ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?q=issueInstanceId:\"$ISSUE_ID\"&limit=20" || true)
+  if ! ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?q=issueInstanceId:\"$ISSUE_ID\"&limit=20"); then
+    echo "ERR: Fortify issues fetch failed for issue $ISSUE_ID: ${ISSUES_JSON:-no response}" >&2
+    exit 3
+  fi
 else
-  ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?limit=200&filter=ANALYSIS%3D%3DNotAnIssue,ANALYSIS%3D%3DFalsePositive&filterset=Critical%2CHigh" || true)
+  # filter=ANALYSIS!=NotAnIssue,ANALYSIS!=FalsePositive (%21%3D is `!=`) is
+  # meant to EXCLUDE suppressed findings. It was encoded as %3D%3D (`==`),
+  # which instead selected only suppressed findings - the opposite of the
+  # gate's intent whenever SSC honors the filter.
+  if ! ISSUES_JSON=$(fortify_get "projectVersions/$VERSION_ID/issues?limit=200&filter=ANALYSIS%21%3DNotAnIssue,ANALYSIS%21%3DFalsePositive&filterset=Critical%2CHigh"); then
+    echo "ERR: Fortify issues fetch failed for version $VERSION_ID: ${ISSUES_JSON:-no response}" >&2
+    exit 3
+  fi
 fi
 
 # Issue details are fetched per-issue lazily  -  only for the first 10 to keep

package/pipeline/lib/figma-screenshot.sh

@@ -180,10 +180,20 @@ curl_figma() {
   for attempt in 1 2 3; do
     # Token header goes through a curl config via process substitution so it
     # never appears in argv (argv is visible to ps).
+    # curl already writes "000" via -w on a total connection failure (and
+    # still exits non-zero for it, which the inner `|| echo "000"` used to
+    # catch too - so `code` became the literal string "000000", matching
+    # neither the `000)` retry branch below nor handle_http_code's "000)
+    # network timeout" case, just the generic catch-all). `|| true` on its
+    # own line keeps `set -e` from aborting on curl's exit status without
+    # re-printing anything into $code; the `:-000` fallback only fires for
+    # the rarer case where curl fails before -w ever runs and $code is
+    # genuinely empty.
     code=$(curl -sS -o "$out" -w '%{http_code}' \
               --max-time "$HTTP_TIMEOUT" --connect-timeout 5 \
               -K <(printf 'header = "X-Figma-Token: %s"\n' "$FIGMA_TOKEN") \
-              "$url" || echo "000")
+              "$url") || true
+    code="${code:-000}"
     case "$code" in
       2*) printf '%s' "$code"; return 0 ;;
       401|403) printf '%s' "$code"; return 0 ;;