@mmerterden/multi-agent-pipeline 20.9.0 → 20.11.0

package/pipeline/multi-agent-refs/features/repo-profile.md

@@ -19,7 +19,7 @@ Every role is `{ value, source, evidence, confidence }`. `source` is `derived`,
 | `commit.format` | last 200 non-merge, non-bot subjects: ticket `prefix` / `suffix` / `none` by majority, its style (`[KEY-123]`, `KEY-123:`), whether a conventional scope is required. A trailing `(#123)` is the host's PR number and is ignored |
 | `repo.workBranch`, `repo.defaultBranch` | `pull_request: branches:` targets in workflows, else `push: branches:` targets, else the most active of the usual integration branches, remote or local; `origin/HEAD` |
 | `build`, `test`, `lint` | CI `run:` steps, exact flags kept, continuations joined; `high` when a pull request triggers the step or it appears twice; `-testPlan` values and `*.xctestplan` files; `package.json` scripts as a low-confidence fallback |
-| `accessors.*`, `di.*` | top-level types a generated localization / testing-id / token tree declares, ranked by `<Root>.<Seg>.<Seg>` usage outside it; the registrar suffix is the compound most files of the commonest `Registrar` / `Configurator` / `Assembly` / `Container` / `Module` family end in, read from the file names; its common method; the inject attribute. `--conventions <file>` or `--with-conventions <platform>` folds in `extract-conventions.sh` buckets |
+| `accessors.*`, `di.*` | top-level types a generated localization / testing-id / token tree declares, ranked by `<Root>.<Seg>.<Seg>` usage outside it; the registrar suffix is the compound most files of the commonest `Registrar` / `Configurator` / `Assembly` / `Container` / `Module` family end in, read from the file names; its commonest registration method (`registerMethod`) and, apart from it, its commonest `validate*` / `verify*` / `check*` method (`validateMethod`); the inject attribute (`@Inject`, `@Injected`, `@Dependency` and similar keyed wrappers). `--conventions <file>` or `--with-conventions <platform>` folds in `extract-conventions.sh` buckets |
 | `module`, `mock` | repeated module manifests as a glob; a module validator script or step; mock framework imports or a fixture tree; a `Custom*` tree beside a generated one. `mock.system` and `di.injectAttribute` count only files of the repo's dominant language and carry `file:line` evidence; otherwise they are `null` |
 | `hooks[]` | `.githooks/`, `scripts/git-hooks/`, `.husky/`, pre-commit and lefthook configs; side effects `amends-commit`, `stages-files`, `writes-files`, `network`; the script that sets `core.hooksPath` |
 | `requiredChecks[]`, `docs.authoritative[]`, `inRepoSkills[]` | workflow jobs with a `required` comment (always low); the documents `claude-md-links.mjs` admits from the repo's `CLAUDE.md` files (same bounds, evidence is the CLAUDE.md that points at it); `.claude/skills/*/SKILL.md` with `trigger: explicit` when `disable-model-invocation: true` |

package/pipeline/multi-agent-refs/keychain.md

@@ -163,6 +163,8 @@ The shell driver auto-delegates to `~/.claude/scripts/keychain.py` for determini
 | `vercel`           | Vercel deploys     | `${USER}_Vercel_Access_Token`      | Access Token | Vercel -> Account Settings -> Tokens. Read by `vercel-deploy.sh`; never passed on argv |
 | `appstore_connect_key_id` | App Store Connect | `${USER}_AppStoreConnect_Key_Id` | Identifier, not a secret | App Store Connect -> Users and Access -> Integrations -> App Store Connect API |
 | `appstore_connect_issuer_id` | App Store Connect | `${USER}_AppStoreConnect_Issuer_Id` | Identifier, not a secret | Same page as the key id; one issuer id per team |
+| `appstore_connect_private_key` | App Store Connect | `${USER}_AppStoreConnect_Private_Key` | Full PEM text of `AuthKey_<keyId>.p8` | Same page as the key id; downloadable once. Stored from the file via stdin (`set appstore_connect_private_key - < AuthKey_<keyId>.p8`), probed first with `probe-store-key.mjs --asc` |
+| `google_play` | Google Play | `${USER}_GooglePlay_Access_Json` | Service-account JSON, as issued | Play Console -> Setup -> API access; invite the account with app permissions and enable the Google Play Android Developer API and the Google Play Developer Reporting API. Probed first with `probe-store-key.mjs --play` |
 | `appstore_connect_apple_id` | App Store Connect | `${USER}_AppStoreConnect_Apple_Id` | Email address | The Apple ID itself; no generation step |
 | `appstore_connect_password_item` | App Store Connect | `${USER}_AppStoreConnect_Password_Item` | Keychain ITEM NAME, not a password | `xcrun altool --store-password-in-keychain-item`; map only the item NAME |
 |  -                   | Git Identity       | Stored in preferences JSON         | Not Keychain | Written to preferences by setup Step 4 |

package/pipeline/multi-agent-refs/outside-the-pipeline.md

@@ -104,6 +104,7 @@ another stack's toolkit in its place.
 | `design_*` (`design_visual_compare`, `design_ui_geometry`, `design_report`, ...) | a built screen has to be compared against its design |
 | `ios_app_store_audit` | a package is heading for review |
 | `ios_testflight_validate` | validating a build before upload |
+| `store_*` (`store_status`, `store_asc_*`, `store_play_*`, `store_search` / `store_call`) | a question about App Store Connect or Google Play data: builds and build numbers, reviews, subscriptions, tracks, vitals. Keys come from the Keychain via the store reference file `/multi-agent:setup` writes; `store_status` says which store resolves. Writes return a preview until `confirm: true` and are refused unattended |
 
 Registered at user scope by the installer, and preserved by uninstall - the tools are
 useful with no pipeline at all. If it is not registered the tools simply are not

package/pipeline/multi-agent-refs/setup/app-store-connect.md

@@ -1,5 +1,12 @@
 # App Store Connect Onboarding (setup Step 3b)
 
+<!-- toc -->
+- [API key](#api-key)
+- [Apple ID + app-specific password](#apple-id-app-specific-password)
+- [Multi-provider accounts](#multi-provider-accounts)
+- [Verify + expiry](#verify-expiry)
+<!-- /toc -->
+
 Loaded on demand by `/multi-agent:setup` Step 3b (iOS only, optional). The SKILL.md carries the step intro; this file is the full flow.
 
 Runs inside Step 3 alongside the other missing credentials, not as a late add-on:
@@ -7,24 +14,25 @@ a user who already has an App Store Connect credential in their keychain gets it
 mapped by Step 1 discovery like any other token, and only the genuinely missing
 pieces reach this flow.
 
-Three of the four entries do not go through the normal Token Save Flow, because
-what they hold is not a pasteable secret:
+None of the five entries goes through the clipboard Token Save Flow: four hold
+something that is not a pasteable secret, and the one secret arrives as a file.
 
 | Entry | Holds | Flow |
 |---|---|---|
 | `appstore_connect_key_id` | an identifier | plain value, not a secret; still mapped so it is read through the mapping layer |
 | `appstore_connect_issuer_id` | an identifier | same |
-| `appstore_connect_apple_id` | an email address | same |
+| `appstore_connect_private_key` | the full PEM text of `AuthKey_<keyId>.p8` | probed from the file, then stored from the file through stdin; never pasted, never on argv |
+| `appstore_connect_apple_id` | an email address | plain value, not a secret |
 | `appstore_connect_password_item` | a keychain ITEM NAME | the password lives in Apple's own keychain item, referenced as `-p @keychain:<item>` and never read by the pipeline |
 
-All four entries are **iOS-only and optional**: skip them all and the pipeline
+All five entries are **iOS-only and optional**: skip them all and the pipeline
 still works, it just reports Gate 2 of `/multi-agent:store-ready` as `SKIPPED`,
 never as a pass.
 
 The tiers mirror the Figma 3-tier shape: Tier 1 = API key (`appstore_connect_key_id`
-+ `appstore_connect_issuer_id`), Tier 2 = Apple ID + app-specific password
-(`appstore_connect_apple_id` + `appstore_connect_password_item`), Tier 3 = nothing
-configured.
++ `appstore_connect_issuer_id` + `appstore_connect_private_key`), Tier 2 = Apple ID
++ app-specific password (`appstore_connect_apple_id` + `appstore_connect_password_item`),
+Tier 3 = nothing configured.
 
 Ask which tier to configure (picker): **API key** / **Apple ID + app-specific
 password** / **Skip**. Lead with the second when the user says they cannot create
@@ -32,16 +40,89 @@ an API key: creating one needs an Admin or App Manager role in App Store Connect
 while an app-specific password is generated by the account holder at
 `appleid.apple.com` with no team permission at all.
 
-**API key.** The private key is a FILE and is never copied into the credential
-store. It must sit in a directory `altool` already searches:
+## API key
 
-```bash
-ls ~/.appstoreconnect/private_keys/AuthKey_*.p8 2>/dev/null \
-  || echo "MISSING: put AuthKey_<keyId>.p8 in ~/.appstoreconnect/private_keys/"
-```
+Every part of the key lives in the Keychain, the `.p8` included. The toolkit's
+`store_asc_*` tools and `ios_testflight_validate` read all three items through the
+store reference file (`~/.config/multi-agent-toolkit/store.json`). Called with
+neither `api_key_id` nor `apple_id`, `ios_testflight_validate` uses that same key
+and hands `altool` a private temporary copy that exists only for the length of the
+call, so no copy under `~/.appstoreconnect/private_keys/` is needed.
+
+Map before storing. The three entries in `prefs.global.keychainMapping`
+(`appstore_connect_key_id`, `appstore_connect_issuer_id`,
+`appstore_connect_private_key`) point at their standard names from
+`refs/keychain.md`, or keep an existing mapping when re-onboarding, as Token Save
+Flow Step D does for any key. `set` resolves a logical key through the mapping,
+so every write below goes through the logical key and lands in the item the
+mapping names; an unmapped key would be stored under the bare logical name.
+
+1. **Key id and issuer id.** App Store Connect -> Users and Access -> Integrations
+   -> App Store Connect API. Both are identifiers; store them as plain values:
+
+   ```bash
+   ~/.claude/lib/credential-store.sh set appstore_connect_key_id "<key id>"
+   ~/.claude/lib/credential-store.sh set appstore_connect_issuer_id "<issuer id>"
+   ```
+
+2. **Locate the `.p8`.** Ask for the path to `AuthKey_<keyId>.p8` as a path, never
+   its contents. Apple lets the file be downloaded once, so it is usually in
+   `~/Downloads` or `~/.appstoreconnect/private_keys/`:
+
+   ```bash
+   ls ~/Downloads/AuthKey_*.p8 ~/.appstoreconnect/private_keys/AuthKey_*.p8 2>/dev/null
+   ```
+
+3. **Validate before saving.** A key that is saved first and tried later fails at
+   the first store call, long after setup. Probe it against the file:
+
+   ```bash
+   node "$HOME/.claude/scripts/probe-store-key.mjs" --asc \
+     --key-id "<key id>" --issuer-id "<issuer id>" --p8 "<path to AuthKey_<keyId>.p8>"
+   ```
+
+   It signs a 10-minute ES256 token, reads `GET /v1/apps?limit=1` and prints one
+   line, `{ok, store, status, hint}`, with no key material in it. Exit 0 = accepted.
+   On exit 1 show the `hint` and stop this tier: `401` means the key id or issuer
+   id does not belong to this `.p8`, the key was revoked, or the clock is off;
+   `403` means the key's role cannot read apps. Exit 2 is a usage problem (wrong
+   path, not a private key). Nothing is saved on a failed probe.
+
+4. **Store the key from the file.** A file does not go through the clipboard;
+   stdin keeps it off argv and out of shell history:
 
-**Apple ID + app-specific password.** Use Apple's own keychain helper. The secret
-never enters chat and never becomes a shell argument, per the Token Save Flow rule:
+   ```bash
+   ~/.claude/lib/credential-store.sh set appstore_connect_private_key - < "<path to AuthKey_<keyId>.p8>"
+   ```
+
+5. **Write the store reference file.**
+
+   ```bash
+   node "$HOME/.claude/scripts/write-store-config.mjs"
+   ```
+
+   It names the three Keychain items in `~/.config/multi-agent-toolkit/store.json`
+   (0600, directory 0700), after checking each item exists without reading it.
+   `store_status` in the toolkit then reports App Store Connect as configured from
+   the Keychain.
+
+6. **Offer to delete the `.p8` from disk** (picker, default keep). The key is in
+   the Keychain now, and a plain file in `~/Downloads` is the copy most likely to
+   leak. Apple does not let it be downloaded again, so the user decides:
+
+   - `question` / `description` in `outputLanguage`, for example "The key is now in
+     the Keychain. Delete the .p8 file from disk?"
+   - `header`: `P8 file`
+   - options: `{label: "Keep file", description: "<outputLanguage: leave the file where it is>"}`
+     (first, default) / `{label: "Delete file", description: "<outputLanguage: remove it; the Keychain copy is the only one left>"}`
+
+   On **Delete file**, `rm "<path>"` that one file and nothing else. On **Keep
+   file**, say where it is.
+
+## Apple ID + app-specific password
+
+Use Apple's own keychain helper. The secret never enters chat and never becomes a
+shell argument, per the Token Save Flow rule:
 
 ```bash
 # the user exports AC_PASSWORD_ONCE in their own shell, for this one command
@@ -51,15 +132,20 @@ xcrun altool --store-password-in-keychain-item "<item-name>" \
 
 Then map only `<item-name>` as `appstore_connect_password_item`.
 
-**Multi-provider accounts.** A corporate Apple ID often belongs to several
+## Multi-provider accounts
+
+A corporate Apple ID often belongs to several
 providers, and `altool` fails opaquely without one. Resolve it once with
 `ios_testflight_validate({list_providers: true, <credentials just configured>})`
 and store the answer under
 `prefs.projects[<key>].appStoreConnect.providerPublicId`  -  per-project, since a
 user can ship for more than one team.
 
-**Verify + expiry.** Re-run the `list_providers` probe and report the resolved
-tier. A credential that resolves but is rejected (401/403) follows the
-Expired-token decision in `refs/keychain.md` Rule 1  -  Regenerate / Use a
-different token / Skip and continue  -  never a silent drop.
+## Verify + expiry
 
+For the API key, `store_status({probe: true})` makes one read-only call and says
+whether it worked; for either tier, re-run the `list_providers` probe and report
+the resolved tier. A credential that resolves but is rejected (401/403) follows the
+Expired-token decision in `refs/keychain.md` Rule 1  -  Regenerate / Use a
+different token / Skip and continue  -  never a silent drop. Regenerating the API
+key repeats steps 2 to 5 with the new file.

package/pipeline/multi-agent-refs/setup/google-play.md

@@ -0,0 +1,70 @@
+# Google Play Onboarding (setup Step 3d)
+
+Loaded on demand by `/multi-agent:setup` Step 3d (Android only, optional). The SKILL.md carries the step intro; this file is the full flow.
+
+Runs inside Step 3, only when the target repo is Android, the same way Step 3b
+runs only for iOS. One entry, `google_play`: a Google Cloud service-account JSON,
+stored exactly as Google issued it. The toolkit's `store_play_*` tools
+authenticate with it through the store reference file, and it is what lets
+`/multi-agent:store-ready` hand Android Gate 2 to Google instead of reporting it
+`SKIPPED`.
+
+## Ask
+
+Picker: **Add Google Play** / **Skip**. `question` and `description` in
+`outputLanguage`; `label` and `header` (`Google Play`) English. Skip writes
+nothing.
+
+## What the account needs
+
+Say this before asking for the file; a key that authenticates but reaches nothing
+is the common failure.
+
+1. Play Console -> Setup -> API access: link a Google Cloud project, create (or
+   pick) a service account and download its JSON key.
+2. Play Console -> Users and permissions: invite the service account's
+   `client_email` with permissions for the apps it should read.
+3. In that Google Cloud project, enable the **Google Play Android Developer API**
+   and the **Google Play Developer Reporting API**.
+
+## Validate before saving
+
+Ask for the JSON's **path**, never its contents; a file does not go through the
+clipboard or the chat.
+
+```bash
+node "$HOME/.claude/scripts/probe-store-key.mjs" --play --service-account "<path to service-account.json>"
+```
+
+It exchanges a signed assertion at `oauth2.googleapis.com` for the
+`androidpublisher` and `playdeveloperreporting` scopes, reads one page of
+`apps:search` on the reporting API, and prints `{ok, store, status, hint}` with no
+key material. Exit 0 = accepted. On exit 1 show the `hint` and save nothing:
+
+| Status | Meaning | Fix |
+|---|---|---|
+| `403` with `SERVICE_DISABLED` | one of the two APIs is off in the account's Cloud project | enable both APIs (step 3 above), probe again |
+| any other `403` | the account is not invited in Play Console, or holds no app permission | step 2 above |
+| `400` / `401` at the token step | the key was deleted or disabled, or the clock is off | generate a new key for the account |
+
+Exit 2 is a usage problem (wrong path, not a service-account file).
+
+## Save
+
+Map `keychainMapping.google_play` first: the standard name
+`${USER}_GooglePlay_Access_Json`, or the existing mapping when re-onboarding
+(Token Save Flow Step D). `set` resolves a logical key through the mapping, and an
+unmapped one would be stored under the bare logical name. Then:
+
+```bash
+~/.claude/lib/credential-store.sh set google_play - < "<path to service-account.json>"
+node "$HOME/.claude/scripts/write-store-config.mjs"
+```
+
+The writer names the item in `~/.config/multi-agent-toolkit/store.json` (0600,
+directory 0700) after checking it exists without reading it. `store_status` in the
+toolkit then reports Google Play as configured from the Keychain, and
+`store_status({probe: true})` makes one read-only call to confirm it.
+
+The JSON stays on disk unless the user asks otherwise: Google issues a new key on
+request, so the file is not the only copy the way a `.p8` is.

package/pipeline/preferences-template.json

@@ -16,7 +16,9 @@
       "usage_ingest": null,
       "firebase": null,
       "jenkins": null,
-      "vercel": null
+      "vercel": null,
+      "appstore_connect_private_key": null,
+      "google_play": null
     },
     "tokenScripts": {},
     "platformIdentityRouting": {},

package/pipeline/schemas/prefs.schema.json

@@ -208,7 +208,15 @@
             },
             "appstore_connect_issuer_id": {
               "type": ["string", "null"],
-              "description": "App Store Connect API issuer ID. Required alongside appstore_connect_key_id; either alone leaves Tier 1 unusable and the resolver says so instead of silently dropping to Tier 2. The .p8 private key is a FILE and is never stored here - it belongs at ~/.appstoreconnect/private_keys/AuthKey_<keyId>.p8, one of the directories altool searches."
+              "description": "App Store Connect API issuer ID. Required alongside appstore_connect_key_id; either alone leaves Tier 1 unusable and the resolver says so instead of silently dropping to Tier 2. The .p8 private key is stored in the Keychain as well, under appstore_connect_private_key; the store reference file written by write-store-config.mjs names all three items so the toolkit's store_* tools and ios_testflight_validate read the key from there."
+            },
+            "appstore_connect_private_key": {
+              "type": ["string", "null"],
+              "description": "Keychain item holding the App Store Connect API private key: the full PEM text of AuthKey_<keyId>.p8. Stored from the file through credential-store.sh stdin so the key never reaches argv or the clipboard. The toolkit reads it through the store reference file and writes a short-lived 0600 copy only for tools that read a key from disk."
+            },
+            "google_play": {
+              "type": ["string", "null"],
+              "description": "Keychain item holding the Google Play service-account JSON, stored exactly as Google issued it. Read by the toolkit's store_play_* tools through the store reference file. The account must be invited in Play Console with app permissions, and the Google Play Android Developer API and the Google Play Developer Reporting API must be enabled in its Google Cloud project."
             },
             "appstore_connect_apple_id": {
               "type": ["string", "null"],

package/pipeline/schemas/repo-profile.schema.json

@@ -752,7 +752,38 @@
         },
         "registerMethod": {
           "type": "object",
-          "description": "Method a registrar implements.",
+          "description": "Method a registrar implements to perform the registration.",
+          "additionalProperties": false,
+          "required": ["value", "source", "evidence", "confidence"],
+          "properties": {
+            "value": {
+              "anyOf": [
+                {
+                  "type": "string",
+                  "minLength": 1
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "source": {
+              "$ref": "#/$defs/source"
+            },
+            "evidence": {
+              "$ref": "#/$defs/evidence"
+            },
+            "confidence": {
+              "$ref": "#/$defs/confidence"
+            },
+            "note": {
+              "type": "string"
+            }
+          }
+        },
+        "validateMethod": {
+          "type": "object",
+          "description": "Method a registrar implements to check that what its units read is wired (validate, verify, check). Optional: profiles derived before it existed omit it.",
           "additionalProperties": false,
           "required": ["value", "source", "evidence", "confidence"],
           "properties": {

package/pipeline/scripts/doctor.mjs

@@ -49,7 +49,7 @@ import {
   rmSync,
   realpathSync,
 } from "node:fs";
-import { join, dirname } from "node:path";
+import { basename, join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -92,6 +92,7 @@ const CHECK_IDS = [
   "hook-coverage",
   "credential-mapping",
   "credential-liveness",
+  "store-reference",
   "embedded-credentials",
   "task-tools",
   "mcp-registration",
@@ -584,6 +585,94 @@ function checkCredentials(inv) {
   ok("credential-liveness");
 }
 
+// The toolkit's store_* tools find the App Store Connect and Google Play keys
+// through a reference file naming Keychain services, written by
+// write-store-config.mjs from keychainMapping. A mapping the file does not
+// reflect means the keys sit in the Keychain and every store call still says
+// "not onboarded". Nothing mapped is nothing claimed, so that case is OK.
+const STORE_OF_KEY = {
+  appstore_connect_key_id: "appStoreConnect",
+  appstore_connect_issuer_id: "appStoreConnect",
+  appstore_connect_private_key: "appStoreConnect",
+  google_play: "googlePlay",
+};
+const STORE_LABELS = { appStoreConnect: "App Store Connect", googlePlay: "Google Play" };
+
+// The host tree this doctor was installed into (~/.claude, ~/.copilot or
+// ~/.codex); run from a checkout, the Claude tree.
+const HOST_TREE = [".claude", ".copilot", ".codex"].includes(basename(dirname(HERE)))
+  ? dirname(HERE)
+  : CLAUDE;
+
+function checkStoreReference() {
+  const prefsFile = join(CLAUDE, "multi-agent-preferences.json");
+  const km = readJson(prefsFile)?.global?.keychainMapping || {};
+  const mapped = Object.keys(STORE_OF_KEY).filter((k) => typeof km[k] === "string" && km[k].trim());
+  if (!mapped.length) {
+    ok("store-reference");
+    return;
+  }
+  const writer = join(HOST_TREE, "scripts", "write-store-config.mjs");
+  if (!existsSync(writer)) {
+    skip("store-reference", "write-store-config.mjs is not installed");
+    return;
+  }
+  let res;
+  try {
+    const out = execFileSync(process.execPath, [writer, "--check"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      env: {
+        ...process.env,
+        MULTI_AGENT_PREFS: prefsFile,
+        CRED_STORE: join(HOST_TREE, "lib", "credential-store.sh"),
+      },
+    });
+    res = JSON.parse(out);
+  } catch (e) {
+    try {
+      res = JSON.parse(String(e.stdout || ""));
+    } catch {
+      res = null;
+    }
+  }
+  if (!res || res.error) {
+    skip("store-reference", res?.error || "write-store-config.mjs --check produced no verdict");
+    return;
+  }
+  const fix = `run node "$HOME/${basename(HOST_TREE)}/scripts/write-store-config.mjs"`;
+  if (res.state !== "current") {
+    const ready = Object.entries(res.stores || {})
+      .filter(([, v]) => v.included)
+      .map(([k]) => STORE_LABELS[k] || k);
+    report(
+      "store-reference",
+      "WARN",
+      `store keys are in the Keychain but the store reference file ${res.state === "missing" ? "is missing" : "is stale"} (${res.path}), so store_* tools cannot find ${ready.join(" and ") || "them"}`,
+      fix,
+    );
+    return;
+  }
+  const partial = Object.entries(res.stores || {}).filter(
+    ([store, v]) => !v.included && mapped.some((k) => STORE_OF_KEY[k] === store),
+  );
+  if (partial.length) {
+    report(
+      "store-reference",
+      "INFO",
+      partial
+        .map(
+          ([store, v]) =>
+            `${STORE_LABELS[store] || store} is partly onboarded, missing ${v.missing.join(", ")}`,
+        )
+        .join("; "),
+      `run ${hostCommand("setup", HERE)}`,
+    );
+    return;
+  }
+  ok("store-reference");
+}
+
 function checkEmbeddedCredentials() {
   // The value never enters a shell variable or this process's output. What is
   // reported is the repo, the config key, the host, a shape label and a length
@@ -1079,6 +1168,7 @@ function main() {
   checkIdentity();
   checkHookCoverage();
   checkCredentials(credentialInventory());
+  checkStoreReference();
   checkEmbeddedCredentials();
   checkTaskTools();
   checkMcpRegistration();

package/pipeline/scripts/pre-commit-check.sh

@@ -294,6 +294,11 @@ $folded"
         # +0.25. Clipping keeps one unusual pair from outweighing the rest. An
         # all-caps segment of up to five letters inside a token that also has
         # lowercase letters is an acronym (URL, HTTP, JSON) and is not scored.
+        # Version markers (v1, V2), digit runs and "/" separate segments too, so
+        # a versioned API name
+        # (ReportingV1beta1QueryCrashRateMetricSetRequest) or a short REST path
+        # (/v1/inAppPurchaseOfferCodes) is read as the words it is made of; a
+        # token that is mostly digits is never word-shaped.
         BEGIN {
           rows = "06655352403757150767433232 52015000500600400421400010 " \
             "60306006504400600515500040 50026021600313500420301030 " \
@@ -322,13 +327,17 @@ $folded"
             pair_score += PAIR[substr(l, j - 1, 2)];
           }
         }
-        function wordlike(t,    n, i, c, p, nx, seg, nseg, total, maxlen, split_here, has_lower) {
-          if (t !~ /^[A-Za-z_-]+$/) return 0;
+        function wordlike(t,    n, i, c, p, nx, seg, nseg, total, maxlen, split_here, has_lower, digits) {
+          if (t !~ /^[A-Za-z0-9_\/-]+$/) return 0;
+          digits = t; gsub(/[^0-9]/, "", digits);
+          if (length(digits) * 8 > length(t)) return 0;
+          gsub(/[vV][0-9]+/, "_", t);
           has_lower = (t ~ /[a-z]/);
           pairs = 0; pair_score = 0;
           n = length(t); seg = ""; nseg = 0; total = 0; maxlen = 0;
           for (i = 1; i <= n + 1; i++) {
             c = (i <= n) ? substr(t, i, 1) : "_";
+            if (c ~ /[0-9\/]/) c = "_";
             split_here = 0;
             if (c == "_" || c == "-") split_here = 1;
             else if (seg != "" && c ~ /[A-Z]/) {