@mmerterden/multi-agent-pipeline 20.4.0 → 20.6.0

package/pipeline/lib/normalize-text.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * normalize-text.mjs  -  fold look-alike text to the form a guard matches on.
+ *
+ * NFKC, then the invisible characters in confusables.json removed and its
+ * look-alike letters and punctuation mapped to ASCII. A guard matches on the
+ * raw text and on this folded copy, so a trailer or a token written with a
+ * zero-width space or a Cyrillic letter is still recognised. The folded copy is
+ * only ever matched against; nothing written or shown uses it.
+ *
+ * As a CLI it reads stdin and writes the folded text to stdout.
+ *
+ * @module pipeline/lib/normalize-text
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { invokedDirectly } from "./invoked-directly.mjs";
+
+const TABLE = JSON.parse(readFileSync(join(import.meta.dirname, "confusables.json"), "utf8"));
+const STRIP = new Set(TABLE.strip);
+const MAP = new Map(Object.entries(TABLE.map));
+
+/** @param {string} text */
+export function normalizeForMatch(text) {
+  if (typeof text !== "string" || !text) return text;
+  let out = "";
+  for (const ch of text.normalize("NFKC")) {
+    if (STRIP.has(ch)) continue;
+    out += MAP.get(ch) ?? ch;
+  }
+  return out;
+}
+
+/** The text with its invisible characters removed and nothing else changed. */
+export function stripInvisible(text) {
+  if (typeof text !== "string" || !text) return text;
+  let out = "";
+  for (const ch of text) if (!STRIP.has(ch)) out += ch;
+  return out;
+}
+
+if (invokedDirectly(import.meta.url)) {
+  let input = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (d) => (input += d));
+  process.stdin.on("end", () => process.stdout.write(normalizeForMatch(input)));
+}

package/pipeline/lib/outbound-gate.mjs

@@ -49,6 +49,7 @@
 
 import { readFileSync } from "node:fs";
 import { invokedDirectly } from "./invoked-directly.mjs";
+import { normalizeForMatch } from "./normalize-text.mjs";
 
 /**
  * Each rule is a SHAPE, not a dictionary. A list of known token prefixes goes
@@ -155,11 +156,19 @@ export function scan(text) {
   const findings = [];
   const lines = String(text).split("\n");
   for (let i = 0; i < lines.length; i++) {
+    // A credential written with an invisible character or a look-alike letter
+    // still matches: the certain rules also run on the folded line.
+    const folded = normalizeForMatch(lines[i]);
     for (const rule of RULES) {
       // `lastIndex` survives between calls on a /g regex and would make every
       // second line skip its start. Reset per line.
       rule.re.lastIndex = 0;
-      if (rule.re.test(lines[i])) {
+      let hit = rule.re.test(lines[i]);
+      if (!hit && rule.certain && folded !== lines[i]) {
+        rule.re.lastIndex = 0;
+        hit = rule.re.test(folded);
+      }
+      if (hit) {
         findings.push({ rule: rule.name, certain: rule.certain, line: i + 1 });
       }
     }

package/pipeline/lib/redact.mjs

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+/**
+ * redact.mjs  -  replace every credential in a text with a visible marker.
+ *
+ * Uses the certain rules of outbound-gate.mjs, so the log writers, the commit
+ * hook and the outbound gate recognise one provider set. A match becomes
+ * `[redacted:<rule>]`; the text around it is kept, because a log line is read
+ * to debug a failure and the message is what makes it useful.
+ *
+ * As a CLI it reads stdin and writes the redacted text to stdout. It never
+ * fails its caller: on an internal error it writes the input unchanged.
+ *
+ * @module pipeline/lib/redact
+ */
+
+import { RULES } from "./outbound-gate.mjs";
+import { invokedDirectly } from "./invoked-directly.mjs";
+import { stripInvisible } from "./normalize-text.mjs";
+
+const CERTAIN = RULES.filter((r) => r.certain);
+
+/** @param {string} text */
+export function redact(text) {
+  if (typeof text !== "string" || !text) return text;
+  // Invisible characters are removed first: they change nothing a reader sees,
+  // and a token split by one would otherwise slip past every rule.
+  let out = stripInvisible(text);
+  for (const rule of CERTAIN) {
+    const re = new RegExp(
+      rule.re.source,
+      rule.re.flags.includes("g") ? rule.re.flags : `${rule.re.flags}g`,
+    );
+    out = out.replace(re, () =>
+      rule.name === "url-with-credentials" ? `[redacted:${rule.name}]@` : `[redacted:${rule.name}]`,
+    );
+  }
+  return out;
+}
+
+if (invokedDirectly(import.meta.url)) {
+  let input = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (d) => (input += d));
+  process.stdin.on("end", () => {
+    let out;
+    try {
+      out = redact(input);
+    } catch {
+      out = input;
+    }
+    process.stdout.write(out);
+  });
+}

package/pipeline/lib/vercel-deploy.sh

@@ -2,11 +2,9 @@
 #
 # vercel-deploy.sh  -  safe wrapper around `vercel` CLI.
 #
-# Why this exists (v8.0.0): on 2026-04-27 a `vercel deploy --token=...`
-# invocation failed during the v7.9.1 release flow. The CLI's error retry
-# hint printed the failed argv verbatim, including `--token=vcp_...`. That
-# leaked the deploy token into the conversation transcript and forced a
-# token rotation. See `feedback_vercel_cli_token_leak.md`.
+# Why this exists: when a `vercel` call fails, the CLI's retry hint prints the
+# failed argv verbatim. A token passed as `--token=vcp_...` therefore reaches the
+# terminal, any log, and the conversation transcript, and has to be rotated.
 #
 # This wrapper guarantees three properties for every Vercel call:
 #   1. Tokens are passed via VERCEL_TOKEN env var, NEVER via --token=... argv.
@@ -186,8 +184,8 @@ cmd_deploy() {
   done
 
   # Run the CLI with token via env. Pipe stdout AND stderr through the redact
-  # filter so even if the CLI dumps argv on failure (it does  -  that was the
-  # original v7.9.1 leak), tokens never reach the user's screen or transcript.
+  # filter so even if the CLI dumps argv on failure (its retry hint does),
+  # tokens never reach the user's screen or transcript.
   set +e
   ( cd "$cwd" && VERCEL_TOKEN="$VERCEL_TOKEN" vercel "${cmd_args[@]}" 2>&1 ) \
     | redact_filter

package/pipeline/multi-agent-refs/features/unattended-security.md

@@ -589,6 +589,11 @@ hashes `~/.claude/{scripts,lib}`, the settings files, the profile and
 `~/Library/LaunchAgents` before and after publish verification (`hostFingerprint`
 in `autopilot-publish.mjs`) and refuses to push if any changed.
 
+It also refuses to launch (`blocked-version-floor`) while the installed version
+is below the published `required` floor (`require-supported-version.sh` exits
+3): the child's Phase 0 would halt on the same check, and the update it needs is
+refused unattended. Like every `blocked-*` outcome it is not an attempt.
+
 The profile's `env` reaches the session and the commands it runs. The Claude
 Code docs pass environment to a stdio MCP server through the server entry, so
 pin the two toolkit variables there as well: `claude mcp add --env

package/pipeline/schemas/autopilot-config.schema.json

@@ -50,6 +50,11 @@
             "default": "agent-queue",
             "description": "Only issues carrying this label are picked up. `gh issue list --label` does the filtering server-side."
           },
+          "githubAssignee": {
+            "type": "string",
+            "default": "@me",
+            "description": "Only issues assigned to this login are picked up (`gh issue list --assignee`), matching the Jira search's assignee = currentUser(). An issue form can apply the queue label for anyone who opens an issue, and an unattended run acts on the issue's text. \"*\" picks up every labelled issue."
+          },
           "jiraJql": {
             "type": "string",
             "description": "Full JQL, so an instance that cannot use labels is a config change rather than a redesign. The label form is sugar for: assignee = currentUser() AND labels = \"<label>\" AND resolution = EMPTY AND status not in (Done, Closed, Cancelled) ORDER BY priority DESC, created ASC. Jira labels are a single global namespace anyone can write to, so on a shared instance prefer a qualified name, and note that the Labels field must be on the edit screen for the issue types in play. An issue that more than one repo's search returns is queued once, for the first repo in config order, so repos sharing a Jira instance should each carry a jiraJql that matches only their own issues."

package/pipeline/scripts/_autopilot-outcomes.mjs

@@ -41,6 +41,7 @@ export const OUTCOME = Object.freeze({
   BLOCKED_NO_PATH: "blocked-no-path",
   BLOCKED_GUARD_MISSING: "blocked-guard-missing",
   BLOCKED_SANDBOX_UNAVAILABLE: "blocked-sandbox-unavailable",
+  BLOCKED_VERSION_FLOOR: "blocked-version-floor",
 });
 
 /**
@@ -107,6 +108,7 @@ export const BLOCKED = new Set([
   OUTCOME.BLOCKED_NO_PATH,
   OUTCOME.BLOCKED_GUARD_MISSING,
   OUTCOME.BLOCKED_SANDBOX_UNAVAILABLE,
+  OUTCOME.BLOCKED_VERSION_FLOOR,
 ]);
 
 /** Prefix families. `stopped-<status>` is a run that ended mid-way. */

package/pipeline/scripts/agent-guard.py

@@ -20,6 +20,7 @@ import re
 import shlex
 import signal
 import sys
+import unicodedata
 
 # An internal deadline well under the hook timeout: if the guard cannot decide
 # in this long, it prints the blocking verdict when unattended (fail-closed) and
@@ -48,6 +49,34 @@ ATTRIBUTION = re.compile(
     r"|claude code <",
     re.IGNORECASE,
 )
+
+
+def _load_confusables():
+    here = os.path.dirname(os.path.abspath(__file__))
+    try:
+        with open(os.path.join(here, "..", "lib", "confusables.json"), encoding="utf-8") as fh:
+            table = json.load(fh)
+        return set(table.get("strip", [])), dict(table.get("map", {}))
+    except (OSError, ValueError):
+        return set(), {}
+
+
+_STRIP, _MAP = _load_confusables()
+
+
+def normalize_for_match(text: str) -> str:
+    """NFKC, invisible characters removed, look-alike letters mapped to ASCII.
+
+    The same fold lib/normalize-text.mjs applies, from the same table. Rules
+    that match text content run on the raw command and on this copy, so a
+    trailer written with a zero-width space or a Cyrillic letter still matches.
+    Without the table only NFKC applies.
+    """
+    return "".join(
+        _MAP.get(ch, ch) for ch in unicodedata.normalize("NFKC", text) if ch not in _STRIP
+    )
+
+
 # Force flags, and ONLY force flags.
 #
 # The previous pattern ended in `-\S*f\S*`, which matches any flag containing an
@@ -228,7 +257,7 @@ def decide(cmd: str, depth: int = 0) -> str:
     commits = re.search(r"git\s+commit", low) or any(
         git_subcommand(toks) == "commit" for _, toks in segs
     )
-    if commits and ATTRIBUTION.search(cmd):
+    if commits and (ATTRIBUTION.search(cmd) or ATTRIBUTION.search(normalize_for_match(cmd))):
         return "BLOCK_ATTRIB"
 
     # Rule 2: force-push to a protected branch. Evaluate each push segment on its

package/pipeline/scripts/audit-log-rotate.sh

@@ -89,6 +89,9 @@ if [ -s "$AUDIT_FILE" ]; then
   # of the content it archived. gzip -f removes the plain file on success, so
   # only touch whichever of the two actually exists.
   [ -f "$ROTATED.gz" ] && touch "$ROTATED.gz"
+  # An archive holds the same events as the live file, so it gets the same mode.
+  [ -f "$ROTATED.gz" ] && chmod 600 "$ROTATED.gz" 2>/dev/null
+  [ -f "$ROTATED" ] && chmod 600 "$ROTATED" 2>/dev/null
   [ -f "$ROTATED" ] && touch "$ROTATED"
 fi
 

package/pipeline/scripts/audit-log.sh

@@ -39,9 +39,10 @@ esac
 AUDIT_FILE="${AUDIT_FILE:-${LOGS_ROOT:-$HOME/.claude/logs/multi-agent}/audit.jsonl}"
 mkdir -p "$(dirname "$AUDIT_FILE")" 2>/dev/null || exit 0
 
-# Escape a string for embedding inside a JSON double-quoted value.
+# Escape a string for embedding inside a JSON double-quoted value. Newlines,
+# carriage returns and tabs are escaped too: a raw one splits the JSONL line.
 json_escape() {
-  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
+  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g; s/\r/\\r/g' | awk 'NR > 1 { printf "\\n" } { printf "%s", $0 }'
 }
 
 # SHA-256 hash the repo URL (never log plaintext per section18.2.2)
@@ -85,6 +86,13 @@ LINE="{\"ts\":\"${TS}\",\"event\":\"$(json_escape "$EVENT")\",\"service\":\"$(js
 [ -n "$EXTRAS" ] && LINE="${LINE},${EXTRAS}"
 LINE="${LINE}}"
 
+# Caller-supplied values can carry a credential copied out of an error.
+# redact.mjs replaces it with a marker; without node the line is written as is.
+REDACT="$(dirname "${BASH_SOURCE[0]:-$0}")/../lib/redact.mjs"
+[ -f "$REDACT" ] && LINE=$(printf '%s' "$LINE" | node "$REDACT" 2>/dev/null || printf '%s' "$LINE")
+
+[ -f "$AUDIT_FILE" ] || (umask 077 && : > "$AUDIT_FILE") 2>/dev/null || true
+chmod 600 "$AUDIT_FILE" 2>/dev/null || true
 echo "$LINE" >> "$AUDIT_FILE" 2>/dev/null || true
 
 # Opportunistic rotation. audit-log-rotate.sh documents a launchd/cron install,

package/pipeline/scripts/autopilot-intake.mjs

@@ -245,22 +245,24 @@ function sh(cmd, args, opts = {}) {
   }
 }
 
-function fetchGitHub(repo) {
+/**
+ * The `gh issue list` arguments for one repo. Only issues assigned to the
+ * operator are listed by default, as the Jira search does with
+ * `assignee = currentUser()`: an issue form can apply the queue label for
+ * anyone who opens an issue, and an unattended run acts on the issue's text.
+ * `githubAssignee: "*"` lists every labelled issue.
+ */
+export function githubListArgs(repo) {
   const label = repo.githubLabel || "agent-queue";
-  const out = sh("gh", [
-    "issue",
-    "list",
-    "--repo",
-    repo.nameWithOwner,
-    "--label",
-    label,
-    "--state",
-    "open",
-    "--json",
-    "number,title,labels,url,createdAt",
-    "--limit",
-    "100",
-  ]);
+  const assignee = repo.githubAssignee || "@me";
+  const args = ["issue", "list", "--repo", repo.nameWithOwner, "--label", label];
+  if (assignee !== "*") args.push("--assignee", assignee);
+  args.push("--state", "open", "--json", "number,title,labels,url,createdAt", "--limit", "100");
+  return args;
+}
+
+function fetchGitHub(repo) {
+  const out = sh("gh", githubListArgs(repo));
   let rows;
   try {
     rows = JSON.parse(out || "[]");

package/pipeline/scripts/autopilot-publish.mjs

@@ -112,7 +112,7 @@ import { OUTCOME } from "./_autopilot-outcomes.mjs";
 import { commandFor, getAdapter, loadAdapters, resolveStack } from "./_stack-adapter.mjs";
 import { checkCommit, park, updateState } from "./gate-ledger.mjs";
 import { LOCKFILES } from "./package-manager.mjs";
-import { PROTECTED_BRANCHES, validatePrRequest } from "./pr-request.mjs";
+import { PROTECTED_BRANCHES, hasAutoClose, validatePrRequest } from "./pr-request.mjs";
 import { summarize } from "./test-summary.mjs";
 
 const HERE = import.meta.dirname;
@@ -576,6 +576,20 @@ function checkRemoteBranch(stage, url, branch, headSha, prior) {
 }
 
 /** Gate ledger: the commit hook's requirement, re-checked for every commit in the range. */
+// A closing keyword in a commit message closes the issue when the PR merges,
+// whatever the PR text says, and issues are closed by people, not by a run.
+function checkCommitMessages(stage, commits) {
+  for (const sha of commits) {
+    const message = stage.out(["log", "-1", "--format=%B", sha]) || "";
+    if (hasAutoClose(message)) {
+      throw new Refusal(
+        "auto-close",
+        `commit ${sha.slice(0, 12)} carries an auto-close keyword; use Ref: #N`,
+      );
+    }
+  }
+}
+
 function checkLedger(state, commits, wt, env) {
   for (const c of commits) {
     const parent = gitOut(wt, ["rev-parse", "--verify", `${c}^1`], env);
@@ -1319,6 +1333,7 @@ export async function publish({ sessionId, statePath, item, config, env = proces
     const mergeBase = stage.out(["merge-base", baseSha, headSha]);
     if (!mergeBase) throw new Refusal("branch", `${req.branch} shares no history with ${req.base}`);
 
+    checkCommitMessages(stage, commits);
     checkLedger(state, commits, wt, localEnv);
     checkTestLog(state, wt, statePath);
     checkSecrets(wt, `${mergeBase}..${headSha}`, env);

package/pipeline/scripts/autopilot-runner.mjs

@@ -2086,6 +2086,26 @@ async function main() {
     return 0;
   }
 
+  // ---- 3d. VERSION --------------------------------------------------------
+  // Phase 0 of the child halts below the published floor, and the update it
+  // would need is refused unattended. Checked here so a floor costs no session.
+  const floorGate = join(SCRIPTS, "require-supported-version.sh");
+  if (existsSync(floorGate)) {
+    const floor = spawnSync("bash", [floorGate], { encoding: "utf-8", timeout: 30_000 });
+    if (floor.status === 3) {
+      const [, local, , required] = (floor.stdout || "").trim().split("|");
+      const reason = `installed v${local || "?"} is below the required v${required || "?"}; run the update`;
+      log(`not launching: ${reason}`);
+      if (!DRY) {
+        record({ source: next.source, id: next.id, outcome: OUTCOME.BLOCKED_VERSION_FLOOR });
+        writeState("queue.json", { ...queue, blockedReason: reason });
+        refreshStatus();
+      }
+      tick({ action: "version-floor" });
+      return 0;
+    }
+  }
+
   // ---- 4. TAKE -----------------------------------------------------------
   const sessionId = randomUUID();
   const taskId = `ap-${Date.now()}`;

package/pipeline/scripts/log-metric.sh

@@ -81,6 +81,11 @@ PHASE_SCHEMA="$(node -e 'const c=require("'"$(cd "$(dirname "$0")" && pwd)"'/../
 TS="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
 LINE="{\"ts\":\"${TS}\",\"task_id\":\"${TASK_ID}\",\"phase\":\"${PHASE}\",\"event\":\"${EVENT}\",\"details\":${DETAILS},\"phaseSchema\":${PHASE_SCHEMA}}"
 
+# Caller-supplied values can carry a credential copied out of an error.
+# redact.mjs replaces it with a marker; without node the line is written as is.
+REDACT="$(cd "$(dirname "$0")" && pwd)/../lib/redact.mjs"
+[ -f "$REDACT" ] && LINE=$(printf '%s' "$LINE" | node "$REDACT" 2>/dev/null || printf '%s' "$LINE")
+
 # Atomic append (one line, well under PIPE_BUF).
 echo "$LINE" >> "$METRICS_FILE" 2>/dev/null || {
   echo "warn: log-metric: cannot write to $METRICS_FILE  -  telemetry skipped" >&2

package/pipeline/scripts/pr-request.mjs

@@ -46,7 +46,14 @@ export const FIELDS = ["branch", "base", "title", "body", "draft", "repo"];
 export const PROTECTED_BRANCHES = ["main", "master", "develop"];
 const REF = /^[A-Za-z0-9._/-]+$/;
 const REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
-const AUTO_CLOSE = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?\s+(?:[\w.-]+\/[\w.-]+)?#\d+/i;
+// GitHub closes an issue from `#N`, `owner/repo#N` and the issue's full URL.
+const AUTO_CLOSE =
+  /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?\s+(?:(?:[\w.-]+\/[\w.-]+)?#\d+|https?:\/\/[^\s/]+\/[\w.-]+\/[\w.-]+\/issues\/\d+)/i;
+
+/** True when the text would close an issue once the PR or commit merges. */
+export function hasAutoClose(text) {
+  return typeof text === "string" && AUTO_CLOSE.test(text);
+}
 
 /**
  * The request object `write` produces. draft is always true.
@@ -92,8 +99,7 @@ export function validatePrRequest(req) {
   if (typeof req.branch === "string" && req.branch === req.base)
     errors.push("branch and base are the same");
   for (const k of ["title", "body"]) {
-    if (typeof req[k] === "string" && AUTO_CLOSE.test(req[k]))
-      errors.push(`${k} carries an auto-close keyword; use Ref: #N`);
+    if (hasAutoClose(req[k])) errors.push(`${k} carries an auto-close keyword; use Ref: #N`);
   }
   const secrets = [];
   for (const k of ["title", "body"]) {

package/pipeline/scripts/pre-commit-check.sh

@@ -174,6 +174,19 @@ scan_file() {
 
   [ -z "$content" ] && return 0
 
+  # A token written with an invisible character or a look-alike letter: scan a
+  # folded copy too. Only non-ASCII content pays for the node call.
+  if printf '%s' "$content" | LC_ALL=C grep -q '[^ -~[:space:]]' 2>/dev/null \
+     && command -v node >/dev/null 2>&1 \
+     && [ -f "$PRE_COMMIT_DIR/../lib/normalize-text.mjs" ]; then
+    local folded
+    folded=$(printf '%s' "$content" | node "$PRE_COMMIT_DIR/../lib/normalize-text.mjs" 2>/dev/null) || folded=""
+    if [ -n "$folded" ] && [ "$folded" != "$content" ]; then
+      content="$content
+$folded"
+    fi
+  fi
+
   # API keys / tokens (key = "long_string" pattern)
   if echo "$content" | grep -qiE '(api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token|secret[_-]?key)\s*[:=]\s*["'"'"'][A-Za-z0-9+/=_-]{20,}'; then
     echo "BLOCKED: Possible API key/token in $file" >&2
@@ -261,28 +274,58 @@ scan_file() {
   # repo-root-relative, so the full path can be anchored.
   if ! echo "$file" | grep -qiE '(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|Podfile\.lock|Cartfile\.resolved|Package\.resolved|\.lock$|\.map$|__snapshots__|\.snap$|\.min\.(js|css)$)' \
      && ! echo "$file" | grep -qE '^pipeline/scripts/smoke-pre-commit\.sh$'; then
-    candidates=$(echo "$content" | grep -oE '[A-Za-z0-9+/=_-]{40,}' || true)
+    # Staged and working-tree content arrives as diff lines, so the leading "+"
+    # is stripped first: it is in the candidate class and would otherwise glue
+    # onto a token that starts at column 0 and defeat every shape check below.
+    candidates=$(echo "$content" | sed 's/^+//' | grep -oE '[A-Za-z0-9+/=_-]{40,}' || true)
     if [ -n "$candidates" ]; then
       entropy_hit=$(printf '%s\n' "$candidates" | awk '
+        # Word-shaped identifier: letters and _ or - only, split into segments at
+        # separators and case boundaries (UIApplication -> UI, Application), where
+        # the segments read like words: average length 4+, none longer than 24,
+        # and at least 70 percent carrying a vowel. Random letters-only tokens
+        # flip case every one or two characters, so their segments average about
+        # two characters with few vowels; a long lowercase run is one oversized
+        # segment. Neither shape passes.
+        function wordlike(t,    n, i, c, p, nx, seg, nseg, total, maxlen, voweled, split_here) {
+          if (t !~ /^[A-Za-z_-]+$/) return 0;
+          n = length(t); seg = ""; nseg = 0; total = 0; maxlen = 0; voweled = 0;
+          for (i = 1; i <= n + 1; i++) {
+            c = (i <= n) ? substr(t, i, 1) : "_";
+            split_here = 0;
+            if (c == "_" || c == "-") split_here = 1;
+            else if (seg != "" && c ~ /[A-Z]/) {
+              p = substr(seg, length(seg), 1);
+              nx = (i < n) ? substr(t, i + 1, 1) : "";
+              if (p ~ /[a-z]/ || (nx ~ /[a-z]/ && length(seg) > 1)) split_here = 1;
+            }
+            if (split_here && seg != "") {
+              nseg++; total += length(seg);
+              if (length(seg) > maxlen) maxlen = length(seg);
+              if (tolower(seg) ~ /[aeiouy]/) voweled++;
+              seg = "";
+            }
+            if (c != "_" && c != "-") seg = seg c;
+          }
+          if (nseg == 0) return 0;
+          return (total / nseg >= 4 && maxlen <= 24 && voweled * 10 >= nseg * 7);
+        }
         {
           s=$0;
           # Scoring the joined string measures the variety of a whole SENTENCE
           # rather than of any token in it, so an ordinary doc path like
-          # "claude/commands/multi-agent/review-jira/SKILL" scores 4.35 and was
-          # blocked as a possible credential. 47 of the 400 committed markdown
-          # files in this repo carried such a path, so each was un-editable  -  and
-          # the gate only fired once such a file was staged, which is why it
-          # stayed invisible.
+          # "claude/commands/multi-agent/review-jira/SKILL" scores 4.35 and would
+          # be blocked as a possible credential, making every doc that cites
+          # such a path un-editable.
           #
-          # The reduction is applied ONLY to path-shaped candidates. An earlier
-          # version of this fix scored the longest slash-free segment for every
-          # candidate containing a slash, which structurally exempted any secret
-          # with a slash in it: the canonical 40-char AWS documentation-example
-          # secret access key (two slashes, full-match H=4.663, blocked before)
-          # reduced to an 18-char segment and sailed through, and roughly half
-          # of `openssl rand -base64 32` outputs contain a "/". It is not
-          # reproduced here on purpose  -  this gate flags credential-shaped
-          # strings in comments too, and it is right to.
+          # The reduction is applied ONLY to path-shaped candidates. Scoring the
+          # longest slash-free segment for every candidate containing a slash
+          # would structurally exempt any secret with a slash in it: the
+          # canonical 40-char AWS documentation-example secret access key (two
+          # slashes, full-match H=4.663) reduces to an 18-char segment, and
+          # roughly half of `openssl rand -base64 32` outputs contain a "/". The
+          # key is not reproduced here on purpose  -  this gate flags
+          # credential-shaped strings in comments too, and it is right to.
           # No other check here catches that key: the key-name regex above does
           # not match "secret_access_key", and the AKIA pattern only covers the
           # key ID, not the secret.
@@ -299,7 +342,7 @@ scan_file() {
           if (s ~ /^[0-9]+$/) next;        # pure digits
           if (s ~ /^[0-9a-f]+$/) next;     # lowercase hex (git sha / md5 / sha-*)
           if (s ~ /^[0-9A-F]+$/) next;     # uppercase hex
-          if (s ~ /^([A-Z][a-z]+)+[A-Z]*$/) next;  # CamelCase words only (label key / type name), never a credential
+          if (wordlike(s)) next;           # identifier made of words (plist key / type name), never a credential
           delete freq;
           for (i = 1; i <= n; i++) { c = substr(s, i, 1); freq[c]++ }
           H = 0;

package/pipeline/scripts/pre-push-check.sh

@@ -21,9 +21,9 @@
 #
 # Two modes, because a gate that runs INSIDE the push is a gate that breaks
 # pushes. Git opens the connection to the remote before this hook fires, so a
-# six-minute run idles that connection until the server drops it: the first two
-# attempts to push the v15.12.0 rename died on a broken pipe with every gate
-# green. The work has to happen outside the network window.
+# six-minute run idles that connection until the server drops it, and the push
+# dies on a broken pipe with every gate green. The work has to happen outside
+# the network window.
 #
 #   pre-push-check.sh --run    run every gate and stamp the tree as green
 #   pre-push-check.sh          verify the stamp only; refuse the push if absent

package/pipeline/scripts/run-ui-tests.sh

@@ -277,11 +277,11 @@ EOF
   fi
 }
 
-# Web had no arm here at all until v17.1.0, which meant a repo with a full
-# Playwright suite reported "no UI test target" and every downstream consumer
-# believed it: the evidence probe closed tier 1, the PR body said UI tests were
-# not run, and the reason it gave was true of the runner rather than of the repo.
-# That is the failure mode this file exists to avoid, and it was shipped for web.
+# Without a web arm, a repo with a full Playwright suite reports "no UI test
+# target" and every downstream consumer believes it: the evidence probe closes
+# tier 1, the PR body says UI tests were not run, and the reason it gives is
+# true of the runner rather than of the repo. That is the failure mode this file
+# exists to avoid.
 web_spec_files() {
   find "$REPO" \
     -name ".*" -type d -prune -o \