@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/eval-golden-tasks.mjs

@@ -0,0 +1,223 @@
+#!/usr/bin/env node
+// eval-golden-tasks.mjs — contract regression check for whole-pipeline fixtures.
+//
+// Walks pipeline/eval/golden-tasks/<NN>-<name>/ subdirectories. For each case:
+//   1. Reads task.json (input) + expected/phase-{1,2,4-review,4-triage}.json.
+//   2. Validates each expected/ file against its paired validator script
+//      (validate-analysis.mjs / validate-planning.mjs / validate-reviewer.mjs /
+//      validate-triage.mjs).
+//   3. Cross-file consistency: Phase 2 tasks[].files[] ⊆ Phase 1
+//      touchedAreas[].path. Phase 4 review findings[].file referenced in
+//      Phase 2 planned files (or flagged as deferred in triage).
+//   4. Stack match: phase-1.stack.primary === task.expectedStack.
+//   5. Blocker count match: triage.accepted[].filter(severity=blocking).length
+//      === task.expectedBlockers. Same for deferred bucket.
+//
+// What this catches:
+//   - Schema drift (any of the 4 phase schemas changes in a breaking way).
+//   - Fixture-vs-spec divergence (someone updates a schema without re-syncing
+//     the golden fixtures).
+//   - Coverage gap (a triage that loses findings vs. reviewer input).
+//
+// What this does NOT catch:
+//   - Real model output quality. This is a CONTRACT test, not a model eval.
+//     A separate multi-model harness (with API keys, non-deterministic) is
+//     future work. See pipeline/eval/golden-tasks/README.md.
+//
+// Usage:
+//   node pipeline/scripts/eval-golden-tasks.mjs                # all cases
+//   node pipeline/scripts/eval-golden-tasks.mjs --case 01-...  # one case
+//   node pipeline/scripts/eval-golden-tasks.mjs --json         # CI-friendly
+//
+// Exit codes: 0 all pass, 1 one or more fail, 2 usage/setup error.
+
+import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const root = resolve(here, "..", "..");
+const evalDir = join(root, "pipeline", "eval", "golden-tasks");
+
+const validators = {
+  analysis: join(root, "pipeline", "scripts", "validate-analysis.mjs"),
+  planning: join(root, "pipeline", "scripts", "validate-planning.mjs"),
+  reviewer: join(root, "pipeline", "scripts", "validate-reviewer.mjs"),
+  triage:   join(root, "pipeline", "scripts", "validate-triage.mjs"),
+};
+
+const args = process.argv.slice(2);
+const opts = { json: false, case: null };
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === "--json") opts.json = true;
+  else if (args[i] === "--case") opts.case = args[++i];
+  else if (args[i] === "-h" || args[i] === "--help") {
+    console.log("Usage: eval-golden-tasks.mjs [--case <name>] [--json]");
+    process.exit(0);
+  }
+}
+
+function listCases() {
+  if (!existsSync(evalDir)) return [];
+  return readdirSync(evalDir)
+    .filter((f) => f !== "README.md" && statSync(join(evalDir, f)).isDirectory())
+    .sort();
+}
+
+function runValidator(scriptPath, payloadPath) {
+  // validate-reviewer.mjs reads stdin with `-`; others take a path.
+  // For simplicity, all validators accept either stdin or file path. Pass path.
+  const r = spawnSync("node", [scriptPath, payloadPath], { encoding: "utf-8" });
+  return { code: r.status, stdout: r.stdout || "", stderr: r.stderr || "" };
+}
+
+// eslint-disable-next-line no-unused-vars
+function runReviewerValidator(payloadPath) {
+  // reviewer validator reads stdin — pipe the JSON in.
+  const payload = readFileSync(payloadPath, "utf-8");
+  const r = spawnSync("node", [validators.reviewer, "-"], {
+    input: payload,
+    encoding: "utf-8",
+  });
+  return { code: r.status, stdout: r.stdout || "", stderr: r.stderr || "" };
+}
+
+function runCase(name) {
+  const dir = join(evalDir, name);
+  const errors = [];
+
+  const taskPath = join(dir, "task.json");
+  const analysisPath = join(dir, "expected", "phase-1-analysis.json");
+  const planPath = join(dir, "expected", "phase-2-plan.json");
+  const reviewPath = join(dir, "expected", "phase-4-review.json");
+  const triagePath = join(dir, "expected", "phase-4-triage.json");
+
+  for (const [label, p] of [
+    ["task.json", taskPath],
+    ["phase-1-analysis.json", analysisPath],
+    ["phase-2-plan.json", planPath],
+    ["phase-4-review.json", reviewPath],
+    ["phase-4-triage.json", triagePath],
+  ]) {
+    if (!existsSync(p)) {
+      errors.push(`missing ${label}`);
+    }
+  }
+  if (errors.length) return { name, ok: false, errors };
+
+  let task, analysis, plan, review, triage;
+  try {
+    task = JSON.parse(readFileSync(taskPath, "utf-8"));
+    analysis = JSON.parse(readFileSync(analysisPath, "utf-8"));
+    plan = JSON.parse(readFileSync(planPath, "utf-8"));
+    review = JSON.parse(readFileSync(reviewPath, "utf-8"));
+    triage = JSON.parse(readFileSync(triagePath, "utf-8"));
+  } catch (e) {
+    return { name, ok: false, errors: [`JSON parse: ${e.message}`] };
+  }
+
+  // --- schema checks ---
+  const a = runValidator(validators.analysis, analysisPath);
+  if (a.code !== 0) errors.push(`phase-1-analysis fails validate-analysis (exit ${a.code}): ${a.stderr.trim()}`);
+
+  const p = runValidator(validators.planning, planPath);
+  if (p.code !== 0) errors.push(`phase-2-plan fails validate-planning (exit ${p.code}): ${p.stderr.trim()}`);
+
+  // phase-4-review is an array (one entry per reviewer) — validate each
+  if (!Array.isArray(review)) {
+    errors.push("phase-4-review.json must be a JSON array (one entry per reviewer)");
+  } else {
+    review.forEach((entry, idx) => {
+      // write temp file for each reviewer entry
+      const tmpPayload = JSON.stringify(entry);
+      const r = spawnSync("node", [validators.reviewer, "-"], {
+        input: tmpPayload,
+        encoding: "utf-8",
+      });
+      if (r.status !== 0) errors.push(`phase-4-review[${idx}] fails validate-reviewer (exit ${r.status}): ${(r.stderr || "").trim()}`);
+    });
+  }
+
+  const t = runValidator(validators.triage, triagePath);
+  // validate-triage exit codes: 0 valid+clean, 2 contradiction, 3 correction.
+  // For fixtures we accept 0 only.
+  if (t.code !== 0) errors.push(`phase-4-triage fails validate-triage (exit ${t.code}): ${t.stderr.trim()}`);
+
+  // --- cross-file consistency ---
+
+  // 1. Stack match
+  if (analysis.stack?.primary !== task.expectedStack) {
+    errors.push(`stack mismatch: task.expectedStack=${task.expectedStack}, phase-1.stack.primary=${analysis.stack?.primary}`);
+  }
+
+  // 2. plan files ⊆ analysis touchedAreas paths
+  const touched = new Set((analysis.touchedAreas || []).map((a) => a.path));
+  for (const task of plan.tasks || []) {
+    for (const f of task.files || []) {
+      if (!touched.has(f)) {
+        errors.push(`plan task ${task.id} references file not in Phase 1 touchedAreas: ${f}`);
+      }
+    }
+  }
+
+  // 3. every reviewer finding traces to a planned file OR appears in triage
+  //    (as accepted / deferred / rejected).
+  const plannedFiles = new Set();
+  for (const task of plan.tasks || []) for (const f of task.files || []) plannedFiles.add(f);
+
+  const triageAll = [
+    ...(triage.accepted || []).map((x) => x),
+    ...(triage.deferred || []).map((x) => x.finding),
+    ...(triage.rejected || []).map((x) => x.finding),
+  ];
+  const triageKeys = new Set(triageAll.map((f) => `${f.file}::${f.line}::${f.issue}`));
+
+  for (const rev of (Array.isArray(review) ? review : [])) {
+    for (const f of rev.findings || []) {
+      const key = `${f.file}::${f.line}::${f.issue}`;
+      const inPlan = plannedFiles.has(f.file);
+      const inTriage = triageKeys.has(key);
+      if (!inPlan && !inTriage) {
+        errors.push(`review finding not in plan+triage: ${key}`);
+      }
+    }
+  }
+
+  // 4. blocker + deferral counts match task.expected*
+  const acceptedBlockers = (triage.accepted || []).filter((x) => x.severity === "blocking").length;
+  if (typeof task.expectedBlockers === "number" && acceptedBlockers !== task.expectedBlockers) {
+    errors.push(`expectedBlockers=${task.expectedBlockers}, triage.accepted blocking count=${acceptedBlockers}`);
+  }
+  const deferredCount = (triage.deferred || []).length;
+  if (typeof task.expectedDeferrals === "number" && deferredCount !== task.expectedDeferrals) {
+    errors.push(`expectedDeferrals=${task.expectedDeferrals}, triage.deferred count=${deferredCount}`);
+  }
+
+  return { name, ok: errors.length === 0, errors };
+}
+
+// --- main ---
+
+const cases = opts.case ? [opts.case] : listCases();
+if (cases.length === 0) {
+  console.error("No golden-task fixtures found under pipeline/eval/golden-tasks/");
+  process.exit(2);
+}
+
+const results = cases.map(runCase);
+const passed = results.filter((r) => r.ok).length;
+const failed = results.length - passed;
+
+if (opts.json) {
+  console.log(JSON.stringify({ passed, failed, results }, null, 2));
+} else {
+  for (const r of results) {
+    const mark = r.ok ? "\x1b[32m✓\x1b[0m" : "\x1b[31m✗\x1b[0m";
+    console.log(`${mark} ${r.name.padEnd(38)} ${r.ok ? "" : "FAIL"}`);
+    if (!r.ok) for (const e of r.errors) console.log(`    - ${e}`);
+  }
+  console.log(`\n══ eval-golden-tasks: ${passed}/${results.length} passed ══`);
+}
+
+process.exit(failed > 0 ? 1 : 0);

package/pipeline/scripts/eval-triage.mjs

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+// eval-triage.mjs — semantic regression check for Phase 4 triage.
+//
+// Walks pipeline/eval/triage/<NN>-<name>/ subdirectories. For each case:
+//   1. Reads input.json (rawFindings + scope + diffSummary)
+//   2. Reads expected.json (the spec-defined triage output)
+//   3. Runs validate-triage.mjs against expected.json — must exit cleanly
+//   4. Asserts every rawFinding in input is accounted for in expected
+//      (sum of accepted + deferred[].finding + rejected[].finding == rawFindings)
+//   5. Asserts no inventions: every classified finding traces back to a
+//      raw finding by {file, line, issue} match.
+//
+// What this catches:
+//   - Spec drift: someone changes phase-4-review.md §3 in a way that contradicts
+//     a fixture without updating the fixture.
+//   - Schema drift: validate-triage.mjs starts rejecting fixtures that used
+//     to pass.
+//   - Coverage gap: input has N findings but expected only classifies M < N
+//     (a real triage agent doing the same would silently lose findings).
+//
+// What this does NOT catch:
+//   - Whether a real triage agent would actually produce the expected output.
+//     That requires API keys + nondeterminism. Use a separate eval harness
+//     for that. This is a CONTRACT regression test, not a model-quality eval.
+//
+// Usage:
+//   node pipeline/scripts/eval-triage.mjs                   # all cases
+//   node pipeline/scripts/eval-triage.mjs --case 03-...     # one case
+//   node pipeline/scripts/eval-triage.mjs --json            # CI-friendly output
+//
+// Exit codes: 0 all pass, 1 one or more fail, 2 usage/setup error.
+
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const root = resolve(here, "..", "..");
+const evalDir = join(root, "pipeline", "eval", "triage");
+const validator = join(root, "pipeline", "scripts", "validate-triage.mjs");
+
+const args = process.argv.slice(2);
+const opts = { json: false, case: null };
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === "--json") opts.json = true;
+  else if (args[i] === "--case") opts.case = args[++i];
+  else if (args[i] === "-h" || args[i] === "--help") {
+    console.log("Usage: eval-triage.mjs [--case <name>] [--json]");
+    process.exit(0);
+  }
+}
+
+function listCases() {
+  return readdirSync(evalDir)
+    .filter((f) => f !== "README.md" && statSync(join(evalDir, f)).isDirectory())
+    .sort();
+}
+
+// Compare two finding records by stable-key triple.
+function findingKey(f) {
+  return `${f.file}::${f.line}::${f.issue}`;
+}
+
+function runCase(name) {
+  const dir = join(evalDir, name);
+  const inputPath = join(dir, "input.json");
+  const expectedPath = join(dir, "expected.json");
+  const errors = [];
+
+  let input, expected;
+  try {
+    input = JSON.parse(readFileSync(inputPath, "utf-8"));
+  } catch (e) {
+    return { name, ok: false, errors: [`input.json: ${e.message}`] };
+  }
+  try {
+    expected = JSON.parse(readFileSync(expectedPath, "utf-8"));
+  } catch (e) {
+    return { name, ok: false, errors: [`expected.json: ${e.message}`] };
+  }
+
+  // 1. Structural sanity via validate-triage.mjs.
+  const result = spawnSync("node", [validator, expectedPath], {
+    encoding: "utf-8",
+  });
+  // Validator exit codes: 0 valid+clean, 1 invalid, 2 over-rejection,
+  // 3 contradiction-corrected. For fixtures we expect 0 or 2 (over-rejection
+  // is structurally valid but caller must pause).
+  if (result.status !== 0 && result.status !== 2) {
+    errors.push(
+      `validator failed (exit ${result.status}); fixture must be either clean (0) or over-rejection (2). stderr: ${result.stderr.trim()}`,
+    );
+  }
+
+  // 2. Coverage: every rawFinding in input must appear once in expected.
+  const raw = input.rawFindings || [];
+  const rawKeys = new Set(raw.map(findingKey));
+  const seen = new Set();
+
+  function consume(f, where) {
+    const k = findingKey(f);
+    if (!rawKeys.has(k)) {
+      errors.push(`${where}: invented finding not in input ({${k}})`);
+      return;
+    }
+    if (seen.has(k)) {
+      errors.push(`${where}: duplicate classification of finding ({${k}})`);
+      return;
+    }
+    seen.add(k);
+  }
+
+  (expected.accepted || []).forEach((f) => consume(f, "accepted"));
+  (expected.deferred || []).forEach((d) => consume(d.finding, "deferred"));
+  (expected.rejected || []).forEach((d) => consume(d.finding, "rejected"));
+
+  // Anything in raw but not classified?
+  for (const r of raw) {
+    if (!seen.has(findingKey(r))) {
+      errors.push(`unclassified raw finding (lost): ${findingKey(r)}`);
+    }
+  }
+
+  // 3. Approved consistency: approved===true iff no accepted blocker.
+  const hasBlocker = (expected.accepted || []).some((f) => f.severity === "blocking");
+  if (expected.approved === true && hasBlocker) {
+    errors.push("approved=true but accepted contains a blocking finding");
+  }
+  if (expected.approved === false && !hasBlocker) {
+    errors.push("approved=false but accepted has no blocking finding");
+  }
+
+  return {
+    name,
+    ok: errors.length === 0,
+    errors,
+    rawCount: raw.length,
+    accepted: (expected.accepted || []).length,
+    deferred: (expected.deferred || []).length,
+    rejected: (expected.rejected || []).length,
+    approved: expected.approved,
+    validatorExit: result.status,
+  };
+}
+
+const cases = opts.case ? [opts.case] : listCases();
+if (cases.length === 0) {
+  console.error("No cases found under pipeline/eval/triage/");
+  process.exit(2);
+}
+
+const results = cases.map(runCase);
+const failed = results.filter((r) => !r.ok);
+
+if (opts.json) {
+  console.log(JSON.stringify({ total: results.length, failed: failed.length, results }, null, 2));
+} else {
+  for (const r of results) {
+    const mark = r.ok ? "✓" : "✗";
+    const tally = `raw=${r.rawCount} acc=${r.accepted} def=${r.deferred} rej=${r.rejected} approved=${r.approved} validator=${r.validatorExit}`;
+    console.log(`${mark} ${r.name.padEnd(34)} ${tally}`);
+    if (!r.ok) {
+      for (const e of r.errors) console.log(`    ${e}`);
+    }
+  }
+  console.log("");
+  console.log(`══ eval-triage: ${results.length - failed.length}/${results.length} passed ══`);
+}
+
+process.exit(failed.length === 0 ? 0 : 1);

package/pipeline/scripts/figma-placeholder-map.json

@@ -0,0 +1,191 @@
+{
+  "$comment": "Substitution rules for importing figma skills from an upstream project into pipeline/skills/figma-ios/. Rules are applied in order; LONGEST patterns must come first so we don't accidentally half-substitute. Every personal-data pattern from smoke-personal-data.sh MUST be covered here, or the import smoke fails. Update this file with the placeholder catalog — do NOT hand-edit imported skills after transform.",
+  "version": "1.0.0",
+  "rules": [
+    {
+      "from": "DIJITAL-KANAL-COZUMLERI-DR-IOS/turkish-airlines-ios-uicomponents-wiki",
+      "to": "{github.wikiRepo}",
+      "why": "Org + wiki repo"
+    },
+    {
+      "from": "DIJITAL-KANAL-COZUMLERI-DR-IOS/turkish-airlines-ios-uicomponents",
+      "to": "{github.componentsRepo}",
+      "why": "Org + components repo"
+    },
+    {
+      "from": "DIJITAL-KANAL-COZUMLERI-DR-IOS/turkish-airlines-ios-figma",
+      "to": "{github.mainRepo}",
+      "why": "Org + figma (main) repo"
+    },
+    {
+      "from": "DIJITAL-KANAL-COZUMLERI-DR-IOS/turkish-airlines-mobile-common",
+      "to": "{github.commonRepo}",
+      "why": "Org + common repo"
+    },
+    {
+      "from": "DIJITAL-KANAL-COZUMLERI-DR-IOS",
+      "to": "{github.org}",
+      "why": "Bare org"
+    },
+    {
+      "from": "TurkishAirlinesPackages/Packages/turkish-airlines-ios-uicomponents-wiki",
+      "to": "{repos.wiki.path}",
+      "why": "Wiki submodule path"
+    },
+    {
+      "from": "TurkishAirlinesPackages/Packages/turkish-airlines-ios-uicomponents",
+      "to": "{repos.components.path}",
+      "why": "Components submodule path"
+    },
+    {
+      "from": "TurkishAirlinesPackages/Packages/turkish-airlines-ios-implementation-artifacts",
+      "to": "{repos.artifactsRepo}",
+      "why": "Implementation artifacts submodule path"
+    },
+    {
+      "from": "TurkishAirlinesPackages/Packages/turkish-airlines-mobile-common",
+      "to": "{repos.common.path}",
+      "why": "Common submodule path"
+    },
+    {
+      "from": "TurkishAirlinesPackages",
+      "to": "{repos.packagesContainer}",
+      "why": "Packages container dir"
+    },
+    {
+      "from": "TurkishAirlines.xcodeproj",
+      "to": "{build.xcodeproj}",
+      "why": "Xcode project name"
+    },
+    {
+      "from": "TurkishAirlines-Dev",
+      "to": "{build.scheme}",
+      "why": "Xcode scheme"
+    },
+    {
+      "from": "Turkish Airlines",
+      "to": "{project.name}",
+      "why": "Human-readable brand"
+    },
+    {
+      "from": "turkish-airlines-ios-figma",
+      "to": "{project.slug}",
+      "why": "Project slug — any trailing references"
+    },
+    {
+      "from": "turkish-airlines-ios-uicomponents-wiki",
+      "to": "{project.slug}-wiki",
+      "why": "Wiki slug"
+    },
+    {
+      "from": "turkish-airlines-ios-uicomponents",
+      "to": "{project.slug}-components",
+      "why": "Components slug"
+    },
+    {
+      "from": "turkish-airlines-ios-implementation-artifacts",
+      "to": "{repos.artifactsRepo}",
+      "why": "Implementation artifacts repo (any bare reference)"
+    },
+    {
+      "from": "turkish-airlines-mobile-common",
+      "to": "{project.slug}-common",
+      "why": "Common slug"
+    },
+    {
+      "from": "https://jira.thy.com",
+      "to": "{jira.baseUrl}",
+      "why": "Jira instance"
+    },
+    {
+      "from": "jira.thy.com",
+      "to": "{jira.host}",
+      "why": "Jira host (no scheme)"
+    },
+    {
+      "from": "https://confluence.thy.com",
+      "to": "{confluence.baseUrl}",
+      "why": "Confluence instance"
+    },
+    {
+      "from": "confluence.thy.com",
+      "to": "{confluence.host}",
+      "why": "Confluence host (no scheme)"
+    },
+    {
+      "from": "https://bitbucket.thy.com",
+      "to": "{bitbucket.baseUrl}",
+      "why": "Bitbucket Server instance"
+    },
+    {
+      "from": "bitbucket.thy.com",
+      "to": "{bitbucket.host}",
+      "why": "Bitbucket Server host (no scheme)"
+    },
+    {
+      "from": "mustafaerden@thy.com",
+      "to": "{user.email}",
+      "why": "Author corporate email"
+    },
+    {
+      "from": "DIJITAL-",
+      "to": "{jira.projectKey}-",
+      "why": "Jira project key prefix (matches DIJITAL-12345)"
+    },
+    {
+      "from": "DIJITAL",
+      "to": "{jira.projectKey}",
+      "why": "Jira project key standalone"
+    },
+    {
+      "from": "PVT_kwDOD594Cs4BSatB",
+      "to": "{github.projectV2Id}",
+      "why": "Projects V2 node ID"
+    },
+    {
+      "from": "PVTSSF_lADOD594Cs4BSatBzg_9SbM",
+      "to": "{github.projectV2Fields.status}",
+      "why": "Status field ID"
+    },
+    {
+      "from": "PVTSSF_lADOD594Cs4BSatBzg_9ScY",
+      "to": "{github.projectV2Fields.phase}",
+      "why": "Phase field ID"
+    },
+    {
+      "from": "PVTSSF_lADOD594Cs4BSatBzg_9Scc",
+      "to": "{github.projectV2Fields.figmaPage}",
+      "why": "Figma page field ID"
+    },
+    {
+      "from": "PVTF_lADOD594Cs4BSatBzg_9Sc0",
+      "to": "{github.projectV2Fields.jira}",
+      "why": "Jira field ID"
+    },
+    {
+      "from": "M_ERDEN3_",
+      "to": "{user.username}_",
+      "why": "Author local username prefix in Keychain names"
+    },
+    {
+      "from": "mmerterden.dev",
+      "to": "{user.website}",
+      "why": "Author personal site (shouldn't appear in figma skills but defensive)"
+    },
+    {
+      "from": "mmerterden/remote-control",
+      "to": "{user.remoteControlRepo}",
+      "why": "Author personal repo"
+    }
+  ],
+  "renames": [
+    { "from": "figma-to-swift-ui-code-connect", "to": "figma-component-code-connect" },
+    { "from": "figma-to-swift-ui-confluence-sync", "to": "figma-component-confluence-sync" },
+    { "from": "figma-to-swift-ui-implement", "to": "figma-component-implement" },
+    { "from": "figma-to-swift-ui-start", "to": "figma-component-start" },
+    { "from": "figma-to-swift-ui-status-update", "to": "figma-component-status-update" },
+    { "from": "figma-to-swift-ui-test", "to": "figma-component-test" },
+    { "from": "figma-to-swift-ui-wiki", "to": "figma-component-wiki" },
+    { "from": "figma-to-swiftui", "to": "figma-to-component" }
+  ]
+}

package/pipeline/scripts/fixtures/diff-risk-android.diff

@@ -0,0 +1,40 @@
+diff --git a/app/src/main/java/com/example/auth/AuthRepository.kt b/app/src/main/java/com/example/auth/AuthRepository.kt
+index aaa..bbb 100644
+--- a/app/src/main/java/com/example/auth/AuthRepository.kt
++++ b/app/src/main/java/com/example/auth/AuthRepository.kt
+@@ -10,0 +11,12 @@ class AuthRepository @Inject constructor(
++    open fun login(username: String, password: String): Result<Token> {
++        if (username.isBlank() || password.isBlank()) return Result.failure(IllegalArgumentException())
++        return try {
++            val response = api.login(username, password)
++            if (response.isSuccessful) Result.success(response.body()!!)
++            else Result.failure(HttpException(response))
++        } catch (e: IOException) {
++            Result.failure(e)
++        }
++    }
++
++    open fun logout() { tokenStore.clear() }
+diff --git a/app/src/main/java/com/example/ui/HomeScreen.kt b/app/src/main/java/com/example/ui/HomeScreen.kt
+index ccc..ddd 100644
+--- a/app/src/main/java/com/example/ui/HomeScreen.kt
++++ b/app/src/main/java/com/example/ui/HomeScreen.kt
+@@ -20,0 +21,4 @@ fun HomeScreen(viewModel: HomeViewModel) {
++    @Composable fun ItemRow(item: Item) {
++        Text(item.title, modifier = Modifier.padding(8.dp))
++    }
++
+diff --git a/app/src/main/java/com/example/db/migrations/Migration_3_to_4.kt b/app/src/main/java/com/example/db/migrations/Migration_3_to_4.kt
+new file mode 100644
+index 000..eee
+--- /dev/null
++++ b/app/src/main/java/com/example/db/migrations/Migration_3_to_4.kt
+@@ -0,0 +1,8 @@
++val MIGRATION_3_TO_4 = object : Migration(3, 4) {
++    override fun migrate(database: SupportSQLiteDatabase) {
++        database.execSQL("ALTER TABLE user ADD COLUMN created_at INTEGER NOT NULL DEFAULT 0")
++        if (database.version < 4) {
++            database.execSQL("CREATE INDEX idx_user_created ON user(created_at)")
++        }
++    }
++}

package/pipeline/scripts/fixtures/diff-risk-ios.diff

@@ -0,0 +1,48 @@
+diff --git a/MyApp/Sources/Auth/KeychainStore.swift b/MyApp/Sources/Auth/KeychainStore.swift
+index 1111111..2222222 100644
+--- a/MyApp/Sources/Auth/KeychainStore.swift
++++ b/MyApp/Sources/Auth/KeychainStore.swift
+@@ -10,0 +11,18 @@ public final class KeychainStore {
++    public func save(token: String, account: String) throws {
++        guard !token.isEmpty else { throw KeychainError.emptyToken }
++        let query: [String: Any] = [
++            kSecClass as String: kSecClassGenericPassword,
++            kSecAttrAccount as String: account,
++            kSecValueData as String: Data(token.utf8)
++        ]
++        let status = SecItemAdd(query as CFDictionary, nil)
++        if status == errSecDuplicateItem {
++            let attrs: [String: Any] = [kSecValueData as String: Data(token.utf8)]
++            let updateStatus = SecItemUpdate(query as CFDictionary, attrs as CFDictionary)
++            guard updateStatus == errSecSuccess else { throw KeychainError.update(updateStatus) }
++        } else if status != errSecSuccess {
++            throw KeychainError.add(status)
++        }
++    }
++
++    public func load(account: String) throws -> String { /* impl */ }
+diff --git a/MyApp/Sources/Views/SettingsView.swift b/MyApp/Sources/Views/SettingsView.swift
+index 3333333..4444444 100644
+--- a/MyApp/Sources/Views/SettingsView.swift
++++ b/MyApp/Sources/Views/SettingsView.swift
+@@ -42,0 +43,3 @@ struct SettingsView: View {
++            Text("Hello")
++                .padding()
++                .foregroundColor(.secondary)
+diff --git a/MyApp/Sources/Networking/ApiClient.swift b/MyApp/Sources/Networking/ApiClient.swift
+index 5555555..6666666 100644
+--- a/MyApp/Sources/Networking/ApiClient.swift
++++ b/MyApp/Sources/Networking/ApiClient.swift
+@@ -22,0 +23,5 @@ public class ApiClient {
++    public func fetch<T: Decodable>(_ url: URL) async throws -> T {
++        let (data, _) = try await URLSession.shared.data(from: url)
++        if data.isEmpty { throw ApiError.empty }
++        return try JSONDecoder().decode(T.self, from: data)
++    }
+diff --git a/MyAppTests/SettingsViewTests.swift b/MyAppTests/SettingsViewTests.swift
+index 7777777..8888888 100644
+--- a/MyAppTests/SettingsViewTests.swift
++++ b/MyAppTests/SettingsViewTests.swift
+@@ -10,0 +11,2 @@ final class SettingsViewTests: XCTestCase {
++    func testRenders() throws { /* impl */ }
++