@mmerterden/multi-agent-pipeline 16.31.0 → 16.31.1

package/CHANGELOG.md

@@ -14,6 +14,16 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ---
 
+## [16.31.1] - 2026-09-13
+
+### Fixed
+
+- **A literal keychain item name shipped in `refs/rules.md` for two months.** The Vercel section's example read `credential-store.sh get <maintainer's own item>`, which both named whose machine the file came from and taught the wrong mechanism: `keychainMapping` exists precisely so shipped files name the LOGICAL key and the mapping resolves the per-machine item. The example is now the one-line wrapper call, which resolves the token itself. `sync/SKILL.md`'s publish-candidate table and `keychain.py`'s comment carried the same shape and are genericized.
+
+- **`smoke-personal-data.sh` had no pattern for that shape**, which is why it survived every scan. Added, case-sensitively: the owner segment must start lowercase, which is exactly what separates a resolved item name from the `${USER}_...` and `{USER}_...` template spellings the convention calls for - under the main list's `-i` that distinction disappears and the templates match too. It found three live instances on its first run.
+
+- `account-resolver.sh`'s prefix example and `smoke-pref-migration.sh`'s fixtures now use placeholder spellings rather than ones that read like a real account.
+
 ## [16.31.0] - 2026-09-13
 
 A pipeline that leaves worktrees, artefacts and exclude lines behind is not generic tooling, it is a guest that rearranges the furniture. This release makes a run leave the repo exactly as it found it, and fixes two credentials-and-integrity gaps found while proving it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "16.31.0",
+  "version": "16.31.1",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/sync/SKILL.md

@@ -384,8 +384,8 @@ Measured on this machine, which is why the order is what it is:
 | Candidate | login | scopes |
 |---|---|---|
 | `keychainMapping.github` | corporate EMU account | cannot publish to a personal scope under any grant |
-| `mmerterden_Github_Auth_Token` | personal | `admin:public_key, gist, read:org, repo`  -  no `write:packages` |
-| `gh auth token -u mmerterden` | personal | `gist, read:org, repo, workflow, write:packages` ✓ |
+| the personal PAT in the store | personal | `admin:public_key, gist, read:org, repo`  -  no `write:packages` |
+| `gh auth token -u {owner}` | personal | `gist, read:org, repo, workflow, write:packages` ✓ |
 
 **Two 403s mean two different things, and neither says "wrong token" plainly:**
 

package/pipeline/lib/account-resolver.sh

@@ -8,7 +8,7 @@
 # that precedes the provider segment. Examples:
 #   ${USER}_Github_Access_Token        -> prefix=${USER}
 #   ${USER}_Tktech_Github_Access_Token -> prefix=${USER}_Tktech
-#   personal_Github_Auth_Token        -> prefix=personal
+#   {prefix}_Github_Auth_Token         -> prefix={prefix}
 #
 # Usage:
 #   ./account-resolver.sh             # JSON array

package/pipeline/multi-agent-refs/rules.md

@@ -161,11 +161,10 @@ This is the single source of truth. When a contributor or model is unsure where
 Provider tools that print failed argv on retry leak credentials into the conversation transcript. Every Vercel call from the pipeline (Phase 6 deploy hooks, Phase 7 site updates, manual `vercel deploy` shells) MUST go through the wrapper:
 
 ```bash
-# CORRECT  -  token via env var, output redacted automatically. Token resolution
-# goes through the cross-platform credential helper so the same snippet works
-# on macOS / Linux / Windows installs:
-VERCEL_TOKEN="$(~/.claude/lib/credential-store.sh get mmerterden_Vercel_Access_Token)" \
-  bash $HOME/.claude/lib/vercel-deploy.sh deploy --prod
+# CORRECT  -  the wrapper resolves the token itself, via the logical key `vercel`
+# that keychainMapping maps to this machine's item. Never name the item here.
+# An explicit VERCEL_TOKEN in the environment still wins.
+bash $HOME/.claude/lib/vercel-deploy.sh deploy --prod
 
 # Health check before deploy:
 bash $HOME/.claude/lib/vercel-deploy.sh doctor

package/pipeline/scripts/keychain.py

@@ -189,7 +189,7 @@ def _macos_find(args: list[str]) -> Optional[str]:
 
 def get(label: str, account: Optional[str] = None) -> Optional[str]:
     """Lookup by label first, then by service name. Two coexisting conventions:
-    - User's manually-added tokens (e.g. mmerterden_Vercel_Access_Token) use -l (label).
+    - User's manually-added tokens (e.g. ${USER}_Vercel_Access_Token) use -l (label).
     - credential-store.sh-managed items use -s (service).
     The helper finds either."""
     pf = _ensure_backend()