@mmerterden/multi-agent-pipeline 20.5.0 → 20.6.0

package/CHANGELOG.md

@@ -16,6 +16,24 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [20.6.0] - 2026-09-26
+
+### Added
+
+- `pipeline/lib/normalize-text.mjs` and `pipeline/lib/confusables.json`: NFKC, invisible characters removed and look-alike letters and dashes mapped to ASCII. `agent-guard.py` reads the same table.
+- `eval-guard-robustness.mjs` (in `npm test`): each attribution trailer and every provider in `secret-patterns.json` is passed through disguises (zero-width space, word joiner, Cyrillic letter, non-breaking hyphen) and must still be blocked by `agent-guard`, the outbound gate, the commit hook and the redactor; ordinary Turkish text, emoji and Unicode in code must still pass.
+- `check-rewrite-overlap.mjs` (maintainer tool, not shipped): the share of a rewritten file's 6-word sequences that also appear in its source, with a `--max` threshold.
+
+### Changed
+
+- The npm `license` field is `MIT AND LicenseRef-PolyForm-Perimeter-1.0.0`, and `LICENSE` names the skills that stay under PolyForm Perimeter 1.0.0 (listed in `NOTICE-swift-ios-skills.md`). Nothing was removed; the label now matches what the package carries.
+
+### Fixed
+
+- `agent-guard` blocked an attribution trailer only when it was written in plain ASCII; one written with a zero-width space, a Cyrillic letter, a non-breaking hyphen or a fullwidth colon passed. The rule now also matches the folded text.
+- The outbound gate, `redact.mjs` and `pre-commit-check.sh` recognise a credential that carries an invisible character. `smoke-secret-parity.sh` runs every provider with a zero-width space through both surfaces.
+- The pre-commit high-entropy scan no longer blocks long identifiers made of words, such as the Info.plist keys `UIApplicationSceneManifest_Generation` and `UISupportedInterfaceOrientations` behind the `INFOPLIST_KEY_` build-setting prefix. A letters-only token passes only when its CamelCase, `_` and `-` segments read like words; random mixed-case tokens are still blocked, including letters-only ones that the previous CamelCase exemption let through. The leading `+` of a staged diff line is stripped before candidates are extracted, so a token at column 0 is judged by its own shape.
+
 ## [20.5.0] - 2026-09-25
 
 ### Added

package/LICENSE

@@ -19,3 +19,13 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+---
+
+Third-party content under another license
+
+The skills listed in pipeline/skills/shared/external/NOTICE-swift-ios-skills.md
+are derived from dpearson2699/swift-ios-skills and remain under the PolyForm
+Perimeter License 1.0.0 (https://polyformproject.org/licenses/perimeter/1.0.0),
+not the MIT License above. That license's Required Notice is carried in the
+NOTICE file. Other vendored skills keep the licenses their NOTICE files name.

package/docs/facts.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Generated by pipeline/scripts/gen-facts.mjs. Do not hand-edit: the site reads this, and a number edited here instead of at its source is the drift this file removes.",
-  "generatedAt": "2026-09-25",
-  "version": "20.5.0",
+  "generatedAt": "2026-09-26",
+  "version": "20.6.0",
   "phaseSchema": 2,
   "phases": [
     {
@@ -40,13 +40,14 @@
   "skillCountAll": 218,
   "agentCount": 10,
   "hosts": ["Claude Code", "Codex CLI", "Copilot CLI"],
-  "toolCount": 118,
+  "toolCount": 124,
   "toolCategories": {
     "ios": 40,
     "android": 31,
     "web": 18,
     "code": 8,
     "design": 7,
+    "voice": 6,
     "pass": 4,
     "context": 3,
     "agent": 2,
@@ -55,5 +56,5 @@
     "media": 1
   },
   "pluginSkillCount": 245,
-  "toolkitVersion": "3.15.0"
+  "toolkitVersion": "3.16.0"
 }

package/install/_dev-only-files.mjs

@@ -66,6 +66,7 @@ const DEV_ONLY_TOOLING = Object.freeze([
   "lint-personas.mjs", // imports install/_codex-agents.mjs, which never ships to scripts/
   "lint-mcp-refs.mjs",
   "check-md-links.mjs",
+  "check-rewrite-overlap.mjs", // compares a rewrite against a source only a maintainer has
   "gen-ref-toc.mjs", // regenerates the repo's own reference tree; an install has no pipeline/
   "validate-schemas.mjs", // validates the repo's own schema files, needs ajv
   "sync-parity-check.sh",

package/manifest.json

@@ -1,13 +1,13 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "20.5.0",
-  "commit": "2779213750032f49aefb95d894ef3df49e29e325",
-  "generatedAt": "2026-09-25T17:15:16.484Z",
+  "version": "20.6.0",
+  "commit": "3fc39a82ab127eef5b3e5004ebc279232a2d020c",
+  "generatedAt": "2026-09-26T14:39:59.575Z",
   "algorithm": "sha256",
-  "fileCount": 1218,
+  "fileCount": 1220,
   "files": {
-    "CHANGELOG.md": "40dbfcb1d32886e1930ea869d1ce2a50c24bde5388085e9689e6e1c34c910a95",
-    "LICENSE": "8d8c51aaf1e1538b180c69965fa038db71be86798cc3e26a143bebfefe16a43e",
+    "CHANGELOG.md": "67d8197e2f23337512cca774519c4f111868adbf736f284c2919a49ae684b6c5",
+    "LICENSE": "ab7264a940291b3fd39e40133c06772351490f5e33c88e20fd5d8333227abfa0",
     "README.md": "0613eebb0b38062bd94c44043595d1950b5c9b470874dd8e402c052fd20960cf",
     "README.tr.md": "0c6b5e6943d6c3d3bf3a7ed99c705fb9a78d15d7722e6252f58404d3f6d3524d",
     "SECURITY.md": "0eb89553ddcfc56bfe9712315b55a6630ee2f579631aaeccd6ad24f8ac769a0b",
@@ -33,7 +33,7 @@
     "docs/best-practices.md": "f8b75b0d38b5896a6a852bb30a1edddeb24dab8b5b7b1d9313290e1241c72024",
     "docs/ecosystem.md": "e6c00f30e95b5e178f77bdfbefd686c8a4164f39c03865a89ab23465d1a37acf",
     "docs/engineering.md": "550528cd47c7d2c921729c68d0782a00ac8e77a4bdfec479f6749f9c3235d188",
-    "docs/facts.json": "2ed95fd7398d21ff4d92fce2e0f6442db876bd68c96002d964491a98902282e2",
+    "docs/facts.json": "34a26f599d40a37e2bdd7f35b208ddb211c444b854e942adb88132c96f8ecba6",
     "docs/features.md": "6c9f0efb00c683e6f611c440c87847b187f8b0eee59e9e812f3a241695bc2ae1",
     "docs/performance.md": "bbf2f3922c25dcba0c1a9e69ef420e3871a729af5b35009a49b48a5d3c5cd151",
     "docs/recovery-guide.md": "59a8f1b66b34cb9ff5507b3d54dac3b9915e184aa044d9c758d18cac818d510e",
@@ -44,7 +44,7 @@
     "install/_codex-instructions.mjs": "add75ffc0e8d8db0e3bf275b46017a897a4cadb83dc66c7d3affd73bcead20f8",
     "install/_common.mjs": "8e7dac0c08e0712b3fec5ce6b8db08ccfb4bd3e36d98d22d9e1df8dcd5371250",
     "install/_copilot-instructions.mjs": "73e4b82b2af0f3e1669f772fa0788dac6b540c131e56d5fe38dcf29be85cc019",
-    "install/_dev-only-files.mjs": "8f8327a19fd03f8aaf7c5f739391ea4c97d47a59bb936e9b8cb485a3e59dbfe6",
+    "install/_dev-only-files.mjs": "51285901f3b650ff22a76f8c05b23c69b9ceb6fe3da3333cece9e0caf65065a4",
     "install/_managed-block.mjs": "7328728a7c82744b66218034389fc295d1384311daa5415408afa94be14303d3",
     "install/_mcp-register.mjs": "56a785984afbba54aedc3677652ca4ee990d98d45b6599a3937cb656cad53b46",
     "install/_platform-filter.mjs": "1c66acc79da0da0c1aa5a57050989e84198c3153e6437ee03f1d3bacbb12ff2c",
@@ -61,7 +61,7 @@
     "install/templates/multi-agent-autopilot-awake.plist.template": "ddd25c76c56fcbb38a89de8e35637372d70ace993d6bc487a88ca9cfb702fe1f",
     "install/templates/multi-agent-autopilot.plist.template": "122c8a61cd927edd99375d6e3da40f1d42bcceed5b6641785c8b28bb930bc77e",
     "install/unattended-profile-legacy.json": "f52e86b998956f09ad306b1735a6c10b58580d7082d8a55665a4c6bb15c3aa1f",
-    "package.json": "e8b5ebb47535e622d1e13c31676a183dca1af3af7b089ba3a0e8a90101429e23",
+    "package.json": "ad296bb61988074861178c88e988bfef7332fd592e7f6c88d51b25c81a51ae3d",
     "pipeline/agents/android-architect.md": "11fb74543cb0ebcf9525ca6654fe95d53da7229e0bf4a1149b31fd9005abc453",
     "pipeline/agents/backend-architect.md": "b02a606c301e4714131aed70ae6d16eeb77fbc819a001e2752cff2488d4246de",
     "pipeline/agents/bulk-reader.md": "6597052cd7d205bac2b1c7633f5232fe1a40730664a913b8eb77efd5a786dc25",
@@ -167,6 +167,7 @@
     "pipeline/lib/autopilot-state.sh": "e97d4cb4fce18be8be3485702be0e6d0948209a14f9725cbc83c2721d293432a",
     "pipeline/lib/channels-multi-repo.sh": "aef26f888bddbaf7fb0e2e86143d612da776b4a4282bcee8144a090a9050b989",
     "pipeline/lib/classify-intent.sh": "dab0896bc9707a10ac046d0b31d25a48c363cdde76cb1d720bf847deefc0364c",
+    "pipeline/lib/confusables.json": "2638872fc47c7a8c087902938d67a88440e855e66ede487ac1c057ff85f1571f",
     "pipeline/lib/context-link-extractor.sh": "84a154dcabf57136be17199b21d02120d70cc0ca34e8f48fe24bdda74eddda1d",
     "pipeline/lib/count-lib.sh": "7bafe152b0ffb9ca6fb9296b7ecaaef33deb9410286b3579fefbb37796044f79",
     "pipeline/lib/credential-inventory.sh": "adff81b265a9cf4f8c9135011686c12963cf5eeeafcb266be54456c803ffde38",
@@ -192,13 +193,14 @@
     "pipeline/lib/model-dispatch.sh": "7edd5c92d41ee3bf74972e0827ccbb671853d5410e7fb0af0b7cb020f95e05c5",
     "pipeline/lib/model-rung.sh": "2a5e04af3c6829d4c72e5f518e668a9cc2feffe6f2abb90a68c485f52e81959a",
     "pipeline/lib/multi-repo-pipeline.sh": "5cca6bcc4fb857448ddadb31add343952be89423a328267e56496c7b7cdc7710",
-    "pipeline/lib/outbound-gate.mjs": "9cedbb9ce3e99af6bc4a7d3625a4a2ee4ce841c41425b130de58a52dc82c6cfb",
+    "pipeline/lib/normalize-text.mjs": "db5f3b6618c679762227083299ec7f7bef8f1bb6b9179f19449b5ff904812c45",
+    "pipeline/lib/outbound-gate.mjs": "4e89bf43554af4c727ef110505658159c7a7a3c53d8a4007f0e2e65dab87896f",
     "pipeline/lib/parse-complaints.sh": "d787ce870f141cf7f881da80fab4320814044554065e82e94632f061675b4d12",
     "pipeline/lib/phase-schema.mjs": "8fc0c909f129341295cd8ef2ea9e93cecd0ac493c3a8d83e25879f7ff522f1ab",
     "pipeline/lib/plan-todos.sh": "4992bed180774a27f84892add8b09e0f7b53e9b8fefb75f60325a04d1af18c56",
     "pipeline/lib/post-pr-review.sh": "c7a8f8c648ac7aebf904e70ae482c026de5b3cc897b376cd8aa52356fda8b805",
     "pipeline/lib/pr-request-location.mjs": "622ca4705ec8ee00e0a4609657d8ee684fcdc077f3099ab312cf41b5b0c41efd",
-    "pipeline/lib/redact.mjs": "63dd8a1d5a7f0d6e2dca764b186212e393e59f480c5f0985afe4685c2361f9fc",
+    "pipeline/lib/redact.mjs": "9abe7d74a1fa5d9d1ca9742652b485626e0ae86b62a7229c9ac478813b854bcf",
     "pipeline/lib/regular-file.mjs": "084dd2c98a664a1e4a937757cc5e5e5d7e162b6aa422f8c7cfdb27f7834c6cbc",
     "pipeline/lib/repo-cache.sh": "82bbdd3d61746042ad5341554a1077098d4b56f15caf6c5cc092377a273c8f45",
     "pipeline/lib/repo-hygiene.sh": "67f4227d2bc84198d51205f1f16d055e76a07fe11a4e5c2b8103559c44cefa04",
@@ -217,7 +219,7 @@
     "pipeline/lib/usage-endpoint.mjs": "9aed3a854e729f82563ca7614c9ab8dbb5af3b42fa0f7c10204b0094627b9906",
     "pipeline/lib/user-facing.mjs": "08d8a1f4f12e36de88673d24167e244862f56671586a5ce26e73f52821996eed",
     "pipeline/lib/user-facing.sh": "969038aa575a7075cbc8c2857b3e6bddfa5c8ea8a15811ad65c6660735539b76",
-    "pipeline/lib/vercel-deploy.sh": "7890a86f050611e7743e101303f1263527713019824a15aa4dddc09940bb0a65",
+    "pipeline/lib/vercel-deploy.sh": "50d3d8a0b2c60daf90365396f37337d89a60230a94e7bd4c89b19acf1849de99",
     "pipeline/multi-agent-refs/_account-picker.md": "42715ba746e1fc681a57436d72fc643e3f16de023f0409fee8782b013f7a144a",
     "pipeline/multi-agent-refs/_dev-context.md": "4d0905cc537c7f8526d3c92cf09bb44d2ab50680470ee0baa2dd5c3b1d0565d5",
     "pipeline/multi-agent-refs/_input-parser.md": "4cf222b1c4a405bd71521f5290f45408cc8a47913a0a39166c68210104e90cc5",
@@ -427,7 +429,7 @@
     "pipeline/scripts/_smoke-root.sh": "dad129959a4e37a0cd0f4f6c04f6d66c5a43752b2bf33989db9c002eb106b832",
     "pipeline/scripts/_stack-adapter.mjs": "a754c042d237cd03abf11c6909099a7a3ea798cdd13d49b03787797fd3496cd7",
     "pipeline/scripts/_stack-routing.mjs": "d64421b48eb42efffeae01f1d64ec56182269285de62e80434f3b8b05610e2ab",
-    "pipeline/scripts/agent-guard.py": "a9856912d62d5769d3cd7fcb070007569398a085412cc7b26385caed66471fca",
+    "pipeline/scripts/agent-guard.py": "764e7ce3dd448b37cf7b69b03def5d173ab8dedadd2b2dca098e20ca15fd8604",
     "pipeline/scripts/agent-guard.sh": "5b57cea687754533c673b66a9dd2281ca06d12ef86bdc0d03fa285fc9e7debf8",
     "pipeline/scripts/aggregate-metrics.mjs": "c324e349993fb154a885263cf6665af0ff656e9c987b455a263dad8b96cca667",
     "pipeline/scripts/analysis-story-tree.mjs": "8fd371d3e552a3f60533f18c7699074ae6089016c6663512410c4fa02494548f",
@@ -526,8 +528,8 @@
     "pipeline/scripts/plan-critique-gate.mjs": "b139394e5f16d11e4997d0bb0b08529f439dbd7fad39781ef4c2475247d8fa97",
     "pipeline/scripts/plugin-refresh.sh": "687a33199ad963616ab537e32210ec8c967e76ecc42f494ee8a1dc9fe947fc30",
     "pipeline/scripts/pr-request.mjs": "e6f4ded2366c6599bb345b3011ecc771e13b8a1561afa4c9a50bca4edff17456",
-    "pipeline/scripts/pre-commit-check.sh": "81937ed7c0974fdfe440e19ce31405a38bbdf2b45a9bf226f490268fcf915942",
-    "pipeline/scripts/pre-push-check.sh": "ff98e73d02aa75cfa9411c29c838241e8529e832e1421ca9c25c39aa07bcd968",
+    "pipeline/scripts/pre-commit-check.sh": "a4a091abff1f3a5695227bfca63cd257b09e859f8bd10bfba5700e0c9334e6ea",
+    "pipeline/scripts/pre-push-check.sh": "e449aff7f0336d7d624eff4c6221f56d8621ba9d010669601755e57fd4ee02c7",
     "pipeline/scripts/probe-evidence-capability.sh": "ac74252eed6b773fdbc7ec475a63606925f1ba7b5e7c6f911329f46fd920eae7",
     "pipeline/scripts/prune-logs.sh": "c5587b33104c7253e07be8cce8249b50014c52dfdf232de637811ffdd88e95e4",
     "pipeline/scripts/purge.sh": "95c60b272ae47209893dba9b17528538592bb5636da47940a02734cd9b4f0ce5",
@@ -545,7 +547,7 @@
     "pipeline/scripts/routine-registry.mjs": "eaffbb840cd0ac977d46659cb3bf5c6cbd21a969ee50491cdb4295d10d9d636b",
     "pipeline/scripts/run-aggregator.mjs": "e58ecdf900aa30ea1625939d72e6d4e26d13ae4e6bb2ee1fd68d99718def27c8",
     "pipeline/scripts/run-metrics.mjs": "6db53f3814a992c1f23beae7a54c84310be5af8e84dbff5a6768a91169152f02",
-    "pipeline/scripts/run-ui-tests.sh": "5f1cb05ab0b387f9b89d8f34a0f60182906f0ca27cca4d41926b7217eee86bc5",
+    "pipeline/scripts/run-ui-tests.sh": "11331115a4c3fb436f8f35894b7f12a1be317c7cfcd7b7512aeb42b6a9aa21e3",
     "pipeline/scripts/runs-index.mjs": "7937dd3d6f3c5b7800d853ff06289fd5551413dda4f46b0f3db81483b7280e66",
     "pipeline/scripts/scaffold-gate.mjs": "e2935957771f1d332b9968a819de49676152c51991e89f4a9cab7467b6d18701",
     "pipeline/scripts/scan-agent-config.sh": "41dbd995de799f599dc365ea8cfe55542c48c7387c4f94a596a1e6feec278168",
@@ -592,12 +594,12 @@
     "pipeline/scripts/verify-citations.mjs": "ed1c3d7d0dbebbc64a26524f0f321d3a0ec1318cbb60dd4517d6b3db77e7fd74",
     "pipeline/scripts/verify-skills.sh": "871fcdfe5567232cd49a4cce4401911a06c8df6ab712d0597e17ce1bf0f63d80",
     "pipeline/scripts/verify.mjs": "fdc9843dc33b37d08d132617f158b8fe10cc4ab3be5bf31714bf2453ac0f714f",
-    "pipeline/scripts/website-deploy-commit.sh": "523482438b265ca1f1883ec5fb450e803566a1239eaccdc423e12c5426140a84",
+    "pipeline/scripts/website-deploy-commit.sh": "73cae49db83cf98eeeb08eb8852a13912bd5f05855319b184e348b9ca4dff44f",
     "pipeline/scripts/worktree-finalize.sh": "ca2bb363bec738cfce57ce5f46962d69664810003cc56dde0a82ab9133dbf557",
     "pipeline/scripts/worktree-prepare.sh": "9391c828375b127f77c86e3c830dbbaf355a61464c6437319969f2f1eecc72b1",
     "pipeline/scripts/worktrees.mjs": "90dfd09b70fffe9b56c331a4ae2692cc248f4898f4ee6aee4239ef0b20888a90",
     "pipeline/scripts/write-state.mjs": "e1198bf970eace07d3eff22b394808a526e473df65d3d58aa2d5a12cfdac8b49",
-    "pipeline/skills/.skill-manifest.json": "04ce3e26081d98d092e0795f82aace9f6717bcff749a60b9573833343e8608be",
+    "pipeline/skills/.skill-manifest.json": "94bbe3de5468d7277f6268a570c82af7d8295166e2d9c27676839646c4faff77",
     "pipeline/skills/.skills-index.json": "042b1090f3e2ca310c6ce70d1bb304e8c7f96bd73133e504b95d83801608e470",
     "pipeline/skills/shared/README.md": "98196ea7c9d84637e8917ca4053c34b45de46586f71fb0c0034dce0808af857d",
     "pipeline/skills/shared/core/apple-archive-compliance/SKILL.md": "7239fef717ea45b79276bfcc2c3903acd57950b6e00dd6a2a66399c4b09cbd51",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "20.5.0",
+  "version": "20.6.0",
   "description": "6-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",
@@ -20,7 +20,7 @@
   },
   "scripts": {
     "start": "node index.js",
-    "test": "npm run format:check && npm run lint && node --test test/*.test.mjs && node pipeline/scripts/run-smokes.mjs && node pipeline/scripts/lint-skills.mjs && node pipeline/scripts/lint-personas.mjs && node pipeline/scripts/lint-mcp-refs.mjs && node pipeline/scripts/eval-triage.mjs && node pipeline/scripts/eval-golden-tasks.mjs && node pipeline/scripts/eval-intent.mjs && node pipeline/scripts/eval-recall.mjs && node pipeline/scripts/validate-schemas.mjs && node pipeline/scripts/validate-prefs.mjs && node pipeline/scripts/scorecard.mjs",
+    "test": "npm run format:check && npm run lint && node --test test/*.test.mjs && node pipeline/scripts/run-smokes.mjs && node pipeline/scripts/lint-skills.mjs && node pipeline/scripts/lint-personas.mjs && node pipeline/scripts/lint-mcp-refs.mjs && node pipeline/scripts/eval-triage.mjs && node pipeline/scripts/eval-golden-tasks.mjs && node pipeline/scripts/eval-intent.mjs && node pipeline/scripts/eval-recall.mjs && node pipeline/scripts/eval-guard-robustness.mjs && node pipeline/scripts/validate-schemas.mjs && node pipeline/scripts/validate-prefs.mjs && node pipeline/scripts/scorecard.mjs",
     "test:unit": "node --test test/*.test.mjs",
     "test:smoke": "node pipeline/scripts/run-smokes.mjs",
     "lint:skills": "node pipeline/scripts/lint-skills.mjs",
@@ -55,7 +55,7 @@
     "codex-cli"
   ],
   "author": "Mert Erden",
-  "license": "MIT",
+  "license": "MIT AND LicenseRef-PolyForm-Perimeter-1.0.0",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public"
@@ -93,6 +93,7 @@
     "!pipeline/scripts/smoke-*.sh",
     "!pipeline/scripts/run-smokes.mjs",
     "!pipeline/scripts/eval-*.mjs",
+    "!pipeline/scripts/check-rewrite-overlap.mjs",
     "!pipeline/scripts/scorecard.mjs",
     "!pipeline/scripts/lint-skills.mjs",
     "!pipeline/scripts/lint-personas.mjs",

package/pipeline/lib/confusables.json

@@ -0,0 +1,100 @@
+{
+  "_readme": "Characters a guard folds before matching, applied after NFKC. `strip` lists invisible characters that are removed. `map` sends a character that renders like an ASCII one to that ASCII character: the dash family, and the Cyrillic and Greek letters whose glyphs match Latin ones. Chosen from the Unicode confusables data for the letters and punctuation the guard rules use. Read by lib/normalize-text.mjs and scripts/agent-guard.py.",
+  "strip": [
+    "\u00ad",
+    "\u034f",
+    "\u061c",
+    "\u115f",
+    "\u1160",
+    "\u17b4",
+    "\u17b5",
+    "\u180e",
+    "\u200b",
+    "\u200c",
+    "\u200d",
+    "\u200e",
+    "\u200f",
+    "\u202a",
+    "\u202b",
+    "\u202c",
+    "\u202d",
+    "\u202e",
+    "\u2060",
+    "\u2061",
+    "\u2062",
+    "\u2063",
+    "\u2064",
+    "\u2066",
+    "\u2067",
+    "\u2068",
+    "\u2069",
+    "\u3164",
+    "\ufeff",
+    "\uffa0"
+  ],
+  "map": {
+    "\u2010": "-",
+    "\u2011": "-",
+    "\u2012": "-",
+    "\u2013": "-",
+    "\u2014": "-",
+    "\u2015": "-",
+    "\u2043": "-",
+    "\u2212": "-",
+    "\ufe58": "-",
+    "\ufe63": "-",
+    "\u02d0": ":",
+    "\u0589": ":",
+    "\u05c3": ":",
+    "\u2236": ":",
+    "\ua789": ":",
+    "\u0410": "A",
+    "\u0412": "B",
+    "\u0421": "C",
+    "\u0415": "E",
+    "\u041d": "H",
+    "\u0406": "I",
+    "\u0408": "J",
+    "\u041a": "K",
+    "\u041c": "M",
+    "\u041e": "O",
+    "\u0420": "P",
+    "\u0405": "S",
+    "\u0422": "T",
+    "\u0425": "X",
+    "\u0423": "Y",
+    "\u0430": "a",
+    "\u0441": "c",
+    "\u0435": "e",
+    "\u0456": "i",
+    "\u0458": "j",
+    "\u043e": "o",
+    "\u0440": "p",
+    "\u0455": "s",
+    "\u0445": "x",
+    "\u0443": "y",
+    "\u04bb": "h",
+    "\u0501": "d",
+    "\u051b": "q",
+    "\u051d": "w",
+    "\u0391": "A",
+    "\u0392": "B",
+    "\u0395": "E",
+    "\u0396": "Z",
+    "\u0397": "H",
+    "\u0399": "I",
+    "\u039a": "K",
+    "\u039c": "M",
+    "\u039d": "N",
+    "\u039f": "O",
+    "\u03a1": "P",
+    "\u03a4": "T",
+    "\u03a5": "Y",
+    "\u03a7": "X",
+    "\u03bf": "o",
+    "\u03b1": "a",
+    "\u03bd": "v",
+    "\u03c1": "p",
+    "\u0131": "i"
+  }
+}

package/pipeline/lib/normalize-text.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * normalize-text.mjs  -  fold look-alike text to the form a guard matches on.
+ *
+ * NFKC, then the invisible characters in confusables.json removed and its
+ * look-alike letters and punctuation mapped to ASCII. A guard matches on the
+ * raw text and on this folded copy, so a trailer or a token written with a
+ * zero-width space or a Cyrillic letter is still recognised. The folded copy is
+ * only ever matched against; nothing written or shown uses it.
+ *
+ * As a CLI it reads stdin and writes the folded text to stdout.
+ *
+ * @module pipeline/lib/normalize-text
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { invokedDirectly } from "./invoked-directly.mjs";
+
+const TABLE = JSON.parse(readFileSync(join(import.meta.dirname, "confusables.json"), "utf8"));
+const STRIP = new Set(TABLE.strip);
+const MAP = new Map(Object.entries(TABLE.map));
+
+/** @param {string} text */
+export function normalizeForMatch(text) {
+  if (typeof text !== "string" || !text) return text;
+  let out = "";
+  for (const ch of text.normalize("NFKC")) {
+    if (STRIP.has(ch)) continue;
+    out += MAP.get(ch) ?? ch;
+  }
+  return out;
+}
+
+/** The text with its invisible characters removed and nothing else changed. */
+export function stripInvisible(text) {
+  if (typeof text !== "string" || !text) return text;
+  let out = "";
+  for (const ch of text) if (!STRIP.has(ch)) out += ch;
+  return out;
+}
+
+if (invokedDirectly(import.meta.url)) {
+  let input = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (d) => (input += d));
+  process.stdin.on("end", () => process.stdout.write(normalizeForMatch(input)));
+}

package/pipeline/lib/outbound-gate.mjs

@@ -49,6 +49,7 @@
 
 import { readFileSync } from "node:fs";
 import { invokedDirectly } from "./invoked-directly.mjs";
+import { normalizeForMatch } from "./normalize-text.mjs";
 
 /**
  * Each rule is a SHAPE, not a dictionary. A list of known token prefixes goes
@@ -155,11 +156,19 @@ export function scan(text) {
   const findings = [];
   const lines = String(text).split("\n");
   for (let i = 0; i < lines.length; i++) {
+    // A credential written with an invisible character or a look-alike letter
+    // still matches: the certain rules also run on the folded line.
+    const folded = normalizeForMatch(lines[i]);
     for (const rule of RULES) {
       // `lastIndex` survives between calls on a /g regex and would make every
       // second line skip its start. Reset per line.
       rule.re.lastIndex = 0;
-      if (rule.re.test(lines[i])) {
+      let hit = rule.re.test(lines[i]);
+      if (!hit && rule.certain && folded !== lines[i]) {
+        rule.re.lastIndex = 0;
+        hit = rule.re.test(folded);
+      }
+      if (hit) {
         findings.push({ rule: rule.name, certain: rule.certain, line: i + 1 });
       }
     }

package/pipeline/lib/redact.mjs

@@ -15,13 +15,16 @@
 
 import { RULES } from "./outbound-gate.mjs";
 import { invokedDirectly } from "./invoked-directly.mjs";
+import { stripInvisible } from "./normalize-text.mjs";
 
 const CERTAIN = RULES.filter((r) => r.certain);
 
 /** @param {string} text */
 export function redact(text) {
   if (typeof text !== "string" || !text) return text;
-  let out = text;
+  // Invisible characters are removed first: they change nothing a reader sees,
+  // and a token split by one would otherwise slip past every rule.
+  let out = stripInvisible(text);
   for (const rule of CERTAIN) {
     const re = new RegExp(
       rule.re.source,

package/pipeline/lib/vercel-deploy.sh

@@ -2,11 +2,9 @@
 #
 # vercel-deploy.sh  -  safe wrapper around `vercel` CLI.
 #
-# Why this exists (v8.0.0): on 2026-04-27 a `vercel deploy --token=...`
-# invocation failed during the v7.9.1 release flow. The CLI's error retry
-# hint printed the failed argv verbatim, including `--token=vcp_...`. That
-# leaked the deploy token into the conversation transcript and forced a
-# token rotation. See `feedback_vercel_cli_token_leak.md`.
+# Why this exists: when a `vercel` call fails, the CLI's retry hint prints the
+# failed argv verbatim. A token passed as `--token=vcp_...` therefore reaches the
+# terminal, any log, and the conversation transcript, and has to be rotated.
 #
 # This wrapper guarantees three properties for every Vercel call:
 #   1. Tokens are passed via VERCEL_TOKEN env var, NEVER via --token=... argv.
@@ -186,8 +184,8 @@ cmd_deploy() {
   done
 
   # Run the CLI with token via env. Pipe stdout AND stderr through the redact
-  # filter so even if the CLI dumps argv on failure (it does  -  that was the
-  # original v7.9.1 leak), tokens never reach the user's screen or transcript.
+  # filter so even if the CLI dumps argv on failure (its retry hint does),
+  # tokens never reach the user's screen or transcript.
   set +e
   ( cd "$cwd" && VERCEL_TOKEN="$VERCEL_TOKEN" vercel "${cmd_args[@]}" 2>&1 ) \
     | redact_filter

package/pipeline/scripts/agent-guard.py

@@ -20,6 +20,7 @@ import re
 import shlex
 import signal
 import sys
+import unicodedata
 
 # An internal deadline well under the hook timeout: if the guard cannot decide
 # in this long, it prints the blocking verdict when unattended (fail-closed) and
@@ -48,6 +49,34 @@ ATTRIBUTION = re.compile(
     r"|claude code <",
     re.IGNORECASE,
 )
+
+
+def _load_confusables():
+    here = os.path.dirname(os.path.abspath(__file__))
+    try:
+        with open(os.path.join(here, "..", "lib", "confusables.json"), encoding="utf-8") as fh:
+            table = json.load(fh)
+        return set(table.get("strip", [])), dict(table.get("map", {}))
+    except (OSError, ValueError):
+        return set(), {}
+
+
+_STRIP, _MAP = _load_confusables()
+
+
+def normalize_for_match(text: str) -> str:
+    """NFKC, invisible characters removed, look-alike letters mapped to ASCII.
+
+    The same fold lib/normalize-text.mjs applies, from the same table. Rules
+    that match text content run on the raw command and on this copy, so a
+    trailer written with a zero-width space or a Cyrillic letter still matches.
+    Without the table only NFKC applies.
+    """
+    return "".join(
+        _MAP.get(ch, ch) for ch in unicodedata.normalize("NFKC", text) if ch not in _STRIP
+    )
+
+
 # Force flags, and ONLY force flags.
 #
 # The previous pattern ended in `-\S*f\S*`, which matches any flag containing an
@@ -228,7 +257,7 @@ def decide(cmd: str, depth: int = 0) -> str:
     commits = re.search(r"git\s+commit", low) or any(
         git_subcommand(toks) == "commit" for _, toks in segs
     )
-    if commits and ATTRIBUTION.search(cmd):
+    if commits and (ATTRIBUTION.search(cmd) or ATTRIBUTION.search(normalize_for_match(cmd))):
         return "BLOCK_ATTRIB"
 
     # Rule 2: force-push to a protected branch. Evaluate each push segment on its

package/pipeline/scripts/pre-commit-check.sh

@@ -174,6 +174,19 @@ scan_file() {
 
   [ -z "$content" ] && return 0
 
+  # A token written with an invisible character or a look-alike letter: scan a
+  # folded copy too. Only non-ASCII content pays for the node call.
+  if printf '%s' "$content" | LC_ALL=C grep -q '[^ -~[:space:]]' 2>/dev/null \
+     && command -v node >/dev/null 2>&1 \
+     && [ -f "$PRE_COMMIT_DIR/../lib/normalize-text.mjs" ]; then
+    local folded
+    folded=$(printf '%s' "$content" | node "$PRE_COMMIT_DIR/../lib/normalize-text.mjs" 2>/dev/null) || folded=""
+    if [ -n "$folded" ] && [ "$folded" != "$content" ]; then
+      content="$content
+$folded"
+    fi
+  fi
+
   # API keys / tokens (key = "long_string" pattern)
   if echo "$content" | grep -qiE '(api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token|secret[_-]?key)\s*[:=]\s*["'"'"'][A-Za-z0-9+/=_-]{20,}'; then
     echo "BLOCKED: Possible API key/token in $file" >&2
@@ -261,28 +274,58 @@ scan_file() {
   # repo-root-relative, so the full path can be anchored.
   if ! echo "$file" | grep -qiE '(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|Podfile\.lock|Cartfile\.resolved|Package\.resolved|\.lock$|\.map$|__snapshots__|\.snap$|\.min\.(js|css)$)' \
      && ! echo "$file" | grep -qE '^pipeline/scripts/smoke-pre-commit\.sh$'; then
-    candidates=$(echo "$content" | grep -oE '[A-Za-z0-9+/=_-]{40,}' || true)
+    # Staged and working-tree content arrives as diff lines, so the leading "+"
+    # is stripped first: it is in the candidate class and would otherwise glue
+    # onto a token that starts at column 0 and defeat every shape check below.
+    candidates=$(echo "$content" | sed 's/^+//' | grep -oE '[A-Za-z0-9+/=_-]{40,}' || true)
     if [ -n "$candidates" ]; then
       entropy_hit=$(printf '%s\n' "$candidates" | awk '
+        # Word-shaped identifier: letters and _ or - only, split into segments at
+        # separators and case boundaries (UIApplication -> UI, Application), where
+        # the segments read like words: average length 4+, none longer than 24,
+        # and at least 70 percent carrying a vowel. Random letters-only tokens
+        # flip case every one or two characters, so their segments average about
+        # two characters with few vowels; a long lowercase run is one oversized
+        # segment. Neither shape passes.
+        function wordlike(t,    n, i, c, p, nx, seg, nseg, total, maxlen, voweled, split_here) {
+          if (t !~ /^[A-Za-z_-]+$/) return 0;
+          n = length(t); seg = ""; nseg = 0; total = 0; maxlen = 0; voweled = 0;
+          for (i = 1; i <= n + 1; i++) {
+            c = (i <= n) ? substr(t, i, 1) : "_";
+            split_here = 0;
+            if (c == "_" || c == "-") split_here = 1;
+            else if (seg != "" && c ~ /[A-Z]/) {
+              p = substr(seg, length(seg), 1);
+              nx = (i < n) ? substr(t, i + 1, 1) : "";
+              if (p ~ /[a-z]/ || (nx ~ /[a-z]/ && length(seg) > 1)) split_here = 1;
+            }
+            if (split_here && seg != "") {
+              nseg++; total += length(seg);
+              if (length(seg) > maxlen) maxlen = length(seg);
+              if (tolower(seg) ~ /[aeiouy]/) voweled++;
+              seg = "";
+            }
+            if (c != "_" && c != "-") seg = seg c;
+          }
+          if (nseg == 0) return 0;
+          return (total / nseg >= 4 && maxlen <= 24 && voweled * 10 >= nseg * 7);
+        }
         {
           s=$0;
           # Scoring the joined string measures the variety of a whole SENTENCE
           # rather than of any token in it, so an ordinary doc path like
-          # "claude/commands/multi-agent/review-jira/SKILL" scores 4.35 and was
-          # blocked as a possible credential. 47 of the 400 committed markdown
-          # files in this repo carried such a path, so each was un-editable  -  and
-          # the gate only fired once such a file was staged, which is why it
-          # stayed invisible.
+          # "claude/commands/multi-agent/review-jira/SKILL" scores 4.35 and would
+          # be blocked as a possible credential, making every doc that cites
+          # such a path un-editable.
           #
-          # The reduction is applied ONLY to path-shaped candidates. An earlier
-          # version of this fix scored the longest slash-free segment for every
-          # candidate containing a slash, which structurally exempted any secret
-          # with a slash in it: the canonical 40-char AWS documentation-example
-          # secret access key (two slashes, full-match H=4.663, blocked before)
-          # reduced to an 18-char segment and sailed through, and roughly half
-          # of `openssl rand -base64 32` outputs contain a "/". It is not
-          # reproduced here on purpose  -  this gate flags credential-shaped
-          # strings in comments too, and it is right to.
+          # The reduction is applied ONLY to path-shaped candidates. Scoring the
+          # longest slash-free segment for every candidate containing a slash
+          # would structurally exempt any secret with a slash in it: the
+          # canonical 40-char AWS documentation-example secret access key (two
+          # slashes, full-match H=4.663) reduces to an 18-char segment, and
+          # roughly half of `openssl rand -base64 32` outputs contain a "/". The
+          # key is not reproduced here on purpose  -  this gate flags
+          # credential-shaped strings in comments too, and it is right to.
           # No other check here catches that key: the key-name regex above does
           # not match "secret_access_key", and the AKIA pattern only covers the
           # key ID, not the secret.
@@ -299,7 +342,7 @@ scan_file() {
           if (s ~ /^[0-9]+$/) next;        # pure digits
           if (s ~ /^[0-9a-f]+$/) next;     # lowercase hex (git sha / md5 / sha-*)
           if (s ~ /^[0-9A-F]+$/) next;     # uppercase hex
-          if (s ~ /^([A-Z][a-z]+)+[A-Z]*$/) next;  # CamelCase words only (label key / type name), never a credential
+          if (wordlike(s)) next;           # identifier made of words (plist key / type name), never a credential
           delete freq;
           for (i = 1; i <= n; i++) { c = substr(s, i, 1); freq[c]++ }
           H = 0;

package/pipeline/scripts/pre-push-check.sh

@@ -21,9 +21,9 @@
 #
 # Two modes, because a gate that runs INSIDE the push is a gate that breaks
 # pushes. Git opens the connection to the remote before this hook fires, so a
-# six-minute run idles that connection until the server drops it: the first two
-# attempts to push the v15.12.0 rename died on a broken pipe with every gate
-# green. The work has to happen outside the network window.
+# six-minute run idles that connection until the server drops it, and the push
+# dies on a broken pipe with every gate green. The work has to happen outside
+# the network window.
 #
 #   pre-push-check.sh --run    run every gate and stamp the tree as green
 #   pre-push-check.sh          verify the stamp only; refuse the push if absent

package/pipeline/scripts/run-ui-tests.sh

@@ -277,11 +277,11 @@ EOF
   fi
 }
 
-# Web had no arm here at all until v17.1.0, which meant a repo with a full
-# Playwright suite reported "no UI test target" and every downstream consumer
-# believed it: the evidence probe closed tier 1, the PR body said UI tests were
-# not run, and the reason it gave was true of the runner rather than of the repo.
-# That is the failure mode this file exists to avoid, and it was shipped for web.
+# Without a web arm, a repo with a full Playwright suite reports "no UI test
+# target" and every downstream consumer believes it: the evidence probe closes
+# tier 1, the PR body says UI tests were not run, and the reason it gives is
+# true of the runner rather than of the repo. That is the failure mode this file
+# exists to avoid.
 web_spec_files() {
   find "$REPO" \
     -name ".*" -type d -prune -o \

package/pipeline/scripts/website-deploy-commit.sh

@@ -7,8 +7,9 @@
 # refuses to build a commit whose author is not a contributor on the project. The
 # push still succeeds, the deployment is created and sits at UNKNOWN with a 0ms
 # build (API `readyState: BLOCKED`), and the live site keeps serving the previous
-# version. v16.4.0 and v16.5.0 were both pushed that way and neither was built,
-# while the sync reported the website as synced both times.
+# version. A successful push is therefore not evidence of a deploy, so the script
+# pins the author before committing and reads the deployment state back after
+# pushing instead of reporting the website as synced on the push alone.
 #
 # Usage:
 #   website-deploy-commit.sh <identity-name> <identity-email> <version> [repo-dir]

package/pipeline/skills/.skill-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-09-25T16:25:54Z",
+  "generatedAt": "2026-09-26T13:39:28Z",
   "skillCount": 218,
   "entries": [
     {