@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/sign-skills.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# sign-skills.sh — v6.2.H
+#
+# Generates a SHA-256 manifest of every SKILL.md under pipeline/skills/.
+# Output: pipeline/skills/.skill-manifest.json (in the authored tree — becomes
+# part of what install.js copies, so the deployed dirs get the manifest too).
+#
+# The manifest is NOT a security boundary. It's a tamper-detection signal:
+# install → verify → flag if anything changed under the user's ~/.claude/skills/
+# between runs. Real attestation would need keys we don't ship.
+#
+# Usage: sign-skills.sh [--root <dir>]   # default: ./pipeline/skills
+#
+# Exit: 0 on success, 1 if skills root missing or sha256sum unavailable.
+
+set -euo pipefail
+
+ROOT_OVERRIDE=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --root) ROOT_OVERRIDE="$2"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+SKILLS_ROOT="${ROOT_OVERRIDE:-$REPO_ROOT/pipeline/skills}"
+MANIFEST="$SKILLS_ROOT/.skill-manifest.json"
+
+[ -d "$SKILLS_ROOT" ] || { echo "sign-skills: $SKILLS_ROOT not a directory" >&2; exit 1; }
+
+hasher=""
+if command -v sha256sum >/dev/null 2>&1; then
+  hasher=sha256sum
+elif command -v shasum >/dev/null 2>&1; then
+  hasher="shasum -a 256"
+else
+  echo "sign-skills: need sha256sum or shasum" >&2
+  exit 1
+fi
+
+command -v jq >/dev/null 2>&1 || { echo "sign-skills: jq required" >&2; exit 1; }
+
+generated_at=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+
+# Build entries: path (relative to skills root) + sha256
+entries=$(find "$SKILLS_ROOT" -type f -name 'SKILL.md' -print0 2>/dev/null \
+  | xargs -0 $hasher 2>/dev/null \
+  | while read -r sum path; do
+      rel="${path#"$SKILLS_ROOT"/}"
+      jq -nc --arg path "$rel" --arg sha "$sum" '{path: $path, sha256: $sha}'
+    done \
+  | jq -s 'sort_by(.path)')
+
+count=$(jq 'length' <<< "$entries")
+
+jq -n --arg v "1.0.0" --arg at "$generated_at" --argjson count "$count" --argjson entries "$entries" '
+  {
+    schemaVersion: $v,
+    generatedAt: $at,
+    skillCount: $count,
+    entries: $entries
+  }
+' > "$MANIFEST"
+
+echo "sign-skills: wrote $MANIFEST ($count skills hashed)"
+exit 0

package/pipeline/scripts/smoke-adapters.sh

@@ -0,0 +1,207 @@
+#!/usr/bin/env bash
+# smoke-adapters.sh — third-party AI tool adapters (cursor + copilot-chat).
+#
+# As of v8.5.4 the supported set narrowed to the two adapters the pipeline
+# owner actually uses: Cursor (knowledge layer) and GitHub Copilot Chat
+# (knowledge layer). Windsurf / Cline / Zed / Continue adapters were removed.
+#
+# Round-trip integrity:
+#   1. Install writes the expected layout (file counts, dir structure)
+#   2. Orchestration skills (multi-agent-*) are NOT exported — knowledge layer only
+#   3. Uninstall removes ONLY pipeline-managed artifacts
+#   4. Marker-wrapped block (copilot-chat) preserves user-authored content
+#   5. Idempotent install — running twice produces identical tree
+#   6. Platform filter (--platform=ios|android) narrows the skill set
+#   7. Default behavior — no flags installs Claude only (backward compat)
+#
+# All work happens in mktemp dirs; the user's actual project root is never
+# touched.
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+INSTALL="$REPO_ROOT/install.js"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
+
+cleanup() {
+  [ -n "${TMP_CURSOR:-}" ] && rm -rf "$TMP_CURSOR"
+  [ -n "${TMP_COPILOTCHAT:-}" ] && rm -rf "$TMP_COPILOTCHAT"
+  [ -n "${TMP_IDEMP:-}" ] && rm -rf "$TMP_IDEMP"
+  [ -n "${TMP_FILTER:-}" ] && rm -rf "$TMP_FILTER"
+}
+trap cleanup EXIT
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 1. Cursor adapter — install + uninstall round-trip"
+TMP_CURSOR=$(mktemp -d)
+node "$INSTALL" --cursor --target="$TMP_CURSOR" >/dev/null 2>&1 || fail "cursor install exited non-zero"
+
+cursor_count=$(find "$TMP_CURSOR" -type f | wc -l | tr -d ' ')
+if [ "$cursor_count" -gt 100 ]; then
+  pass "cursor install wrote $cursor_count files"
+else
+  fail "cursor install produced too few files ($cursor_count, expected > 100)"
+fi
+
+if [ -f "$TMP_CURSOR/.cursorrules" ]; then
+  pass "cursor wrote legacy .cursorrules"
+else
+  fail "cursor missing legacy .cursorrules"
+fi
+
+if [ -d "$TMP_CURSOR/.cursor/rules" ]; then
+  pass "cursor wrote .cursor/rules/ directory"
+else
+  fail "cursor missing .cursor/rules/ directory"
+fi
+
+# Orchestration filter — multi-agent-{dev,review,...} should NOT be exported
+orch_leaked=$(find "$TMP_CURSOR/.cursor/rules" -name "multi-agent-multi-agent*" -o -name "multi-agent-dev.mdc" -o -name "multi-agent-review.mdc" 2>/dev/null | wc -l | tr -d ' ')
+if [ "$orch_leaked" -eq 0 ]; then
+  pass "cursor: orchestration commands correctly filtered out"
+else
+  fail "cursor: $orch_leaked orchestration command(s) leaked into knowledge layer"
+fi
+
+# Round-trip via direct adapter call (CLI uninstall not yet wired into smoke).
+node --input-type=module -e "
+  import('$REPO_ROOT/pipeline/adapters/cursor.mjs').then(m => {
+    m.default.uninstall({ target: '$TMP_CURSOR' });
+  });
+" >/dev/null 2>&1
+
+remaining=$(find "$TMP_CURSOR/.cursor/rules" -name "multi-agent-*" 2>/dev/null | wc -l | tr -d ' ')
+if [ "$remaining" -eq 0 ]; then
+  pass "cursor uninstall: 0 files remain"
+else
+  fail "cursor uninstall left $remaining file(s) behind"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 2. Copilot Chat adapter — marker-wrapped block preservation"
+TMP_COPILOTCHAT=$(mktemp -d)
+mkdir -p "$TMP_COPILOTCHAT/.github"
+USER_CONTENT="# My personal Copilot Chat instructions"
+USER_MARKER="DO_NOT_DELETE_THIS_LINE"
+{
+  echo "$USER_CONTENT"
+  echo ""
+  echo "$USER_MARKER"
+} > "$TMP_COPILOTCHAT/.github/copilot-instructions.md"
+
+node "$INSTALL" --copilot-chat --target="$TMP_COPILOTCHAT" >/dev/null 2>&1
+
+if grep -q "$USER_MARKER" "$TMP_COPILOTCHAT/.github/copilot-instructions.md"; then
+  pass "copilot-chat: user content preserved through install"
+else
+  fail "copilot-chat: user content lost during install"
+fi
+
+if grep -q "multi-agent-pipeline:begin" "$TMP_COPILOTCHAT/.github/copilot-instructions.md"; then
+  pass "copilot-chat: BEGIN marker present"
+else
+  fail "copilot-chat: BEGIN marker missing"
+fi
+
+if grep -q "multi-agent-pipeline:end" "$TMP_COPILOTCHAT/.github/copilot-instructions.md"; then
+  pass "copilot-chat: END marker present"
+else
+  fail "copilot-chat: END marker missing"
+fi
+
+# Per-skill instruction files
+perskill_count=$(find "$TMP_COPILOTCHAT/.github/instructions" -name "multi-agent-*.instructions.md" 2>/dev/null | wc -l | tr -d ' ')
+if [ "$perskill_count" -gt 50 ]; then
+  pass "copilot-chat: $perskill_count per-skill instruction files written"
+else
+  fail "copilot-chat: per-skill instruction count too low ($perskill_count)"
+fi
+
+# Round-trip
+node --input-type=module -e "
+  import('$REPO_ROOT/pipeline/adapters/copilot-chat.mjs').then(m => {
+    m.default.uninstall({ target: '$TMP_COPILOTCHAT' });
+  });
+" >/dev/null 2>&1
+
+if grep -q "$USER_MARKER" "$TMP_COPILOTCHAT/.github/copilot-instructions.md" 2>/dev/null; then
+  pass "copilot-chat uninstall: user content survived"
+else
+  fail "copilot-chat uninstall: user content lost"
+fi
+
+if ! grep -q "multi-agent-pipeline" "$TMP_COPILOTCHAT/.github/copilot-instructions.md" 2>/dev/null; then
+  pass "copilot-chat uninstall: no pipeline content remains"
+else
+  fail "copilot-chat uninstall: pipeline content leaked"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 3. Idempotency — install twice produces identical tree"
+TMP_IDEMP=$(mktemp -d)
+node "$INSTALL" --cursor --target="$TMP_IDEMP" >/dev/null 2>&1
+HASH_ONE=$(find "$TMP_IDEMP" -type f -exec md5 -q {} \; 2>/dev/null | sort | md5 -q 2>/dev/null || \
+           find "$TMP_IDEMP" -type f -exec md5sum {} \; 2>/dev/null | sort | md5sum 2>/dev/null | awk '{print $1}')
+node "$INSTALL" --cursor --target="$TMP_IDEMP" >/dev/null 2>&1
+HASH_TWO=$(find "$TMP_IDEMP" -type f -exec md5 -q {} \; 2>/dev/null | sort | md5 -q 2>/dev/null || \
+           find "$TMP_IDEMP" -type f -exec md5sum {} \; 2>/dev/null | sort | md5sum 2>/dev/null | awk '{print $1}')
+if [ -n "$HASH_ONE" ] && [ "$HASH_ONE" = "$HASH_TWO" ]; then
+  pass "cursor install idempotent (same tree hash on second run)"
+else
+  fail "cursor install NOT idempotent (hash drift: $HASH_ONE vs $HASH_TWO)"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 4. Platform filter — ios vs android narrow the skill set"
+TMP_FILTER=$(mktemp -d)
+node "$INSTALL" --cursor --platform=ios --target="$TMP_FILTER" >/dev/null 2>&1
+ios_count=$(find "$TMP_FILTER/.cursor/rules" -type f 2>/dev/null | wc -l | tr -d ' ')
+rm -rf "$TMP_FILTER" && TMP_FILTER=$(mktemp -d)
+node "$INSTALL" --cursor --platform=android --target="$TMP_FILTER" >/dev/null 2>&1
+android_count=$(find "$TMP_FILTER/.cursor/rules" -type f 2>/dev/null | wc -l | tr -d ' ')
+rm -rf "$TMP_FILTER" && TMP_FILTER=$(mktemp -d)
+node "$INSTALL" --cursor --platform=all --target="$TMP_FILTER" >/dev/null 2>&1
+all_count=$(find "$TMP_FILTER/.cursor/rules" -type f 2>/dev/null | wc -l | tr -d ' ')
+
+if [ "$ios_count" -gt 0 ] && [ "$ios_count" -lt "$all_count" ]; then
+  pass "platform=ios filter narrowed $all_count → $ios_count files"
+else
+  fail "platform=ios did not narrow (ios=$ios_count, all=$all_count)"
+fi
+
+if [ "$android_count" -gt 0 ] && [ "$android_count" -lt "$all_count" ]; then
+  pass "platform=android filter narrowed $all_count → $android_count files"
+else
+  fail "platform=android did not narrow (android=$android_count, all=$all_count)"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 5. Default behavior — no flags installs Claude (backward compat)"
+# We don't actually install to $HOME here; just verify the flag math.
+RESULT=$(node -e "
+  const flags = [];
+  const TOOL_FLAGS = ['--claude', '--copilot', '--cursor', '--copilot-chat'];
+  const isExplicitlyTargeted = flags.some(f => TOOL_FLAGS.includes(f)) || flags.includes('--all') || flags.includes('--all-tools');
+  const forClaude = flags.includes('--claude') || flags.includes('--all') || flags.includes('--all-tools') || !isExplicitlyTargeted;
+  const forCursor = flags.includes('--cursor') || flags.includes('--all-tools');
+  console.log(JSON.stringify({ forClaude, forCursor }));
+")
+if echo "$RESULT" | grep -q '"forClaude":true'; then
+  pass "no-flag default still installs Claude (backward compat)"
+else
+  fail "no-flag default broken: $RESULT"
+fi
+if echo "$RESULT" | grep -q '"forCursor":false'; then
+  pass "no-flag default does NOT install adapter tools"
+else
+  fail "no-flag default leaked into adapter install: $RESULT"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "══ adapters smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-add-detail.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# smoke-add-detail.sh — contract check for the `add-detail` command.
+#
+# Does NOT hit real Bitbucket / Jira / GitHub. Instead:
+#   1. Generates a fake PR diff and body fixture.
+#   2. Runs the body-file + jq --rawfile + curl --data-binary pipeline
+#      against a local `jq` / `python -c` simulator that checks the
+#      resulting JSON payload round-trips with:
+#        - real newlines (no literal "\n")
+#        - no HTML entities (& / < / " / ')
+#        - required Bitbucket PUT fields present: reviewers, fromRef, toRef, draft
+#   3. Returns non-zero if any contract is violated.
+#
+# Intended as a CI guard so regressions like the "23 reviewers wiped" incident
+# cannot land unnoticed.
+
+set -euo pipefail
+
+TMP="$(mktemp -d -t multi-agent-smoke-XXXX)" || { echo "FATAL: mktemp failed" >&2; exit 1; }
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0
+FAIL=0
+
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+need() {
+  command -v "$1" >/dev/null 2>&1 || {
+    echo "error: $1 is required" >&2
+    exit 2
+  }
+}
+need jq
+need python3
+
+echo "→ Writing fixture body with newlines, '&' and Turkish chars"
+cat > "$TMP/body.md" <<'EOF'
+## Özet
+
+- Kök neden: UILabel'e `adjustsFontSizeToFitWidth` eklenmemiş
+- Çözüm: `minimumScaleFactor = 0.7` ile ölçek desteği
+- Etki: İspanyolca & Almanca'da taşma düzeliyor
+
+## Test Senaryoları
+
+| # | Ön koşul | Adımlar | Beklenen |
+|---|----------|---------|----------|
+| 1 | Dil = ES | Check-in Summary aç | Şehir isimleri sığar |
+EOF
+
+echo "→ Building payload with jq --rawfile"
+jq -n \
+  --rawfile body "$TMP/body.md" \
+  --arg title 'fix(checkin): Spanish overflow [PROJ-12345]' \
+  '{
+    title: $title,
+    description: $body,
+    fromRef: { id: "refs/heads/bugfix/PROJ-12345", repository: { slug: "my-app", project: { key: "APP" } } },
+    toRef:   { id: "refs/heads/develop",           repository: { slug: "my-app", project: { key: "APP" } } },
+    reviewers: [{ user: { name: "alice" } }, { user: { name: "bob" } }],
+    draft: false,
+    state: "OPEN", open: true, closed: false, locked: false
+  }' > "$TMP/payload.json"
+
+echo "→ Contract checks"
+
+# Contract 1: payload is valid JSON.
+if jq -e . "$TMP/payload.json" >/dev/null 2>&1; then
+  pass "payload is valid JSON"
+else
+  fail "payload is not valid JSON"
+fi
+
+# Contract 2: description field round-trips with real newlines (not literal \n).
+DESC="$(jq -r .description "$TMP/payload.json")"
+if [[ "$DESC" == *$'\n'* ]]; then
+  pass "description contains real newlines"
+else
+  fail "description is single-line — newlines were escaped"
+fi
+
+# Contract 3: no literal backslash-n sequence survived.
+if grep -q '\\n' <<< "$DESC"; then
+  fail "literal \\n escaped into description"
+else
+  pass "no literal \\n in description"
+fi
+
+# Contract 4: no HTML entities in title or description.
+for field in title description; do
+  VALUE="$(jq -r --arg f "$field" '.[$f]' "$TMP/payload.json")"
+  if grep -Eq '&(amp|lt|gt|quot|#39);' <<< "$VALUE"; then
+    fail "$field contains HTML entities"
+  else
+    pass "$field has no HTML entities"
+  fi
+done
+
+# Contract 5: UTF-8 survives end-to-end (checks 'Ö', 'İ', 'ç').
+for glyph in 'Ö' 'İ' 'ç'; do
+  if grep -q "$glyph" <<< "$DESC"; then
+    pass "UTF-8 glyph '$glyph' preserved"
+  else
+    fail "UTF-8 glyph '$glyph' missing from description"
+  fi
+done
+
+# Contract 6: Bitbucket PUT contract — all of reviewers/fromRef/toRef/draft present.
+for field in reviewers fromRef toRef draft; do
+  if jq -e "has(\"$field\")" "$TMP/payload.json" >/dev/null; then
+    pass "payload has .$field"
+  else
+    fail "payload missing .$field (Bitbucket will wipe it)"
+  fi
+done
+
+# Contract 7: reviewers is a non-empty array for this fixture.
+LEN="$(jq '.reviewers | length' "$TMP/payload.json")"
+if [ "$LEN" -gt 0 ]; then
+  pass "reviewers array preserved ($LEN entries)"
+else
+  fail "reviewers array is empty — would wipe defaults"
+fi
+
+# Contract 8: fromRef / toRef are distinct (PR to self is rejected by Bitbucket).
+FROM="$(jq -r .fromRef.id "$TMP/payload.json")"
+TO="$(jq -r .toRef.id   "$TMP/payload.json")"
+if [ "$FROM" != "$TO" ]; then
+  pass "fromRef ($FROM) ≠ toRef ($TO)"
+else
+  fail "fromRef == toRef — invalid PR"
+fi
+
+echo
+echo "══ add-detail smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-agent-log-cost.sh

@@ -0,0 +1,183 @@
+#!/usr/bin/env bash
+# smoke-agent-log-cost.sh — v8.3.0
+#
+# Verifies the agent-log Cost Breakdown pipeline:
+#   1. render-agent-log-cost.sh exits 2 when no tracker data available
+#   2. Renders 4-column markdown (Phase | Model | Tokens in | Tokens out | Est. USD)
+#      from a hand-built object-shaped phase-tracker.json
+#   3. Renders identical block from the array-shaped phase-tracker.json that
+#      phase-tracker.sh actually writes
+#   4. Unknown model degrades to "—" with footnote, never blocks
+#   5. log-metric.sh forwards tokens + model to tracker when LOG_METRIC_FORWARD_TO_TRACKER=1
+#   6. log-format.md ref doc declares the Tokens column + Cost Breakdown section
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+RENDERER="$ROOT/pipeline/scripts/render-agent-log-cost.sh"
+TRACKER="$ROOT/pipeline/scripts/phase-tracker.sh"
+LOG_METRIC="$ROOT/pipeline/scripts/log-metric.sh"
+TABLE="$ROOT/pipeline/scripts/cost-table.json"
+LOG_FORMAT_DOC="$ROOT/pipeline/commands/multi-agent/refs/phases/log-format.md"
+
+pass=0
+fail=0
+failures=()
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-agent-log-cost (v8.3.0): agent-log Cost Breakdown contract\n'
+
+[ -x "$RENDERER" ] || { record_fail "renderer not executable: $RENDERER"; exit 1; }
+
+# --- 1: missing-data path returns exit 2 ---
+tmp=$(mktemp -d)
+pushd "$tmp" >/dev/null
+set +e
+bash "$RENDERER" GHOST-1 >/dev/null 2>&1
+rc=$?
+set -e
+if [ "$rc" -eq 2 ]; then
+  record_pass "renderer exits 2 when no tracker data"
+else
+  record_fail "renderer should exit 2 with no data (got $rc)"
+fi
+popd >/dev/null
+rm -rf "$tmp"
+
+# --- 2: object-shaped fixture renders 4-column markdown ---
+tmp=$(mktemp -d)
+pushd "$tmp" >/dev/null
+mkdir -p .worktrees/DEMO-1
+cat > .worktrees/DEMO-1/phase-tracker.json <<'JSON'
+{"taskId":"DEMO-1","phases":{
+  "1":{"name":"1. Analysis","model":"opus","tokens_in":12480,"tokens_out":3210},
+  "3":{"name":"3. Dev","model":"sonnet","tokens_in":42310,"tokens_out":9880},
+  "4":{"name":"4. Review","model":"opus","tokens_in":8200,"tokens_out":1500}
+}}
+JSON
+out=$(bash "$RENDERER" DEMO-1 2>/dev/null)
+if grep -qE '^\| Phase \| Model \| Tokens in \| Tokens out \| Est\. USD \|' <<< "$out"; then
+  record_pass "object-shape: header row rendered"
+else
+  record_fail "object-shape: header row missing"
+fi
+if grep -q '## Cost Breakdown' <<< "$out"; then
+  record_pass "object-shape: Cost Breakdown section heading present"
+else
+  record_fail "object-shape: section heading missing"
+fi
+if grep -qE '\| 1\. Analysis \| opus \| 12,480 \| 3,210 \| \$' <<< "$out"; then
+  record_pass "object-shape: Phase 1 row formatted with comma-grouped tokens + USD"
+else
+  record_fail "object-shape: Phase 1 row formatting wrong"
+  printf '%s\n' "$out" | head -10 >&2
+fi
+if grep -qE '\| \*\*Total\*\* .* \| \*\*\$' <<< "$out"; then
+  record_pass "object-shape: Total row rendered"
+else
+  record_fail "object-shape: Total row missing"
+fi
+popd >/dev/null
+rm -rf "$tmp"
+
+# --- 3: array-shaped fixture (the shape phase-tracker.sh actually writes) ---
+tmp=$(mktemp -d)
+pushd "$tmp" >/dev/null
+mkdir -p .worktrees/PROJ-2
+cat > .worktrees/PROJ-2/phase-tracker.json <<'JSON'
+{"task_id":"PROJ-2","started_at":"2026-05-05T10:00:00Z","phases":[
+  {"id":"1","name":"Analysis","status":"completed","model":"opus","tokens_in":10000,"tokens_out":2000,"subs":[]},
+  {"id":"3","name":"Dev","status":"completed","model":"sonnet","tokens_in":50000,"tokens_out":8000,"subs":[]}
+]}
+JSON
+out=$(bash "$RENDERER" PROJ-2 2>/dev/null)
+if grep -qE '\| Analysis \| opus \| 10,000 \| 2,000 \| \$' <<< "$out"; then
+  record_pass "array-shape: Phase 1 row rendered correctly"
+else
+  record_fail "array-shape: Phase 1 row wrong"
+  printf '%s\n' "$out" | head -10 >&2
+fi
+if grep -qE '\| Dev \| sonnet \| 50,000 \| 8,000 \| \$' <<< "$out"; then
+  record_pass "array-shape: Phase 3 row rendered correctly"
+else
+  record_fail "array-shape: Phase 3 row wrong"
+fi
+popd >/dev/null
+rm -rf "$tmp"
+
+# --- 4: unknown model degrades gracefully ---
+tmp=$(mktemp -d)
+pushd "$tmp" >/dev/null
+mkdir -p .worktrees/UNK-1
+cat > .worktrees/UNK-1/phase-tracker.json <<'JSON'
+{"task_id":"UNK-1","phases":[
+  {"id":"3","name":"Dev","model":"made-up-9000","tokens_in":1000,"tokens_out":200,"subs":[]}
+]}
+JSON
+out=$(bash "$RENDERER" UNK-1 2>/dev/null)
+if grep -qF '| made-up-9000 |' <<< "$out" && grep -qF '| — |' <<< "$out"; then
+  record_pass "unknown model row renders with USD as —"
+else
+  record_fail "unknown model handling broken"
+fi
+if grep -q 'cost-table.json' <<< "$out"; then
+  record_pass "unknown model footnote points to cost-table.json"
+else
+  record_fail "unknown model footnote missing"
+fi
+popd >/dev/null
+rm -rf "$tmp"
+
+# --- 5: log-metric forwarder writes to phase-tracker ---
+tmp=$(mktemp -d)
+export METRICS_FILE="$tmp/metrics.jsonl"
+export TRACKER_FILE="$tmp/tracker.json"
+# Bootstrap tracker with one phase
+bash "$TRACKER" init "FWD-1" >/dev/null 2>&1 || true
+# init writes to $HOME/.claude/logs/multi-agent/FWD-1/tracker-state.json — override via TRACKER_FILE
+cat > "$TRACKER_FILE" <<'JSON'
+{"task_id":"FWD-1","started_at":"2026-05-05T00:00:00Z","phases":[
+  {"id":"4","name":"Review","status":"in_progress","subs":[]}
+]}
+JSON
+LOG_METRIC_FORWARD_TO_TRACKER=1 TRACKER_QUIET=1 \
+  bash "$LOG_METRIC" FWD-1 4 review.reviewer_call \
+  model=opus tokens_in=1234 tokens_out=567 duration_ms=1000 >/dev/null 2>&1 || true
+if jq -e '.phases[0].tokens_in == 1234 and .phases[0].tokens_out == 567 and .phases[0].model == "opus"' "$TRACKER_FILE" >/dev/null 2>&1; then
+  record_pass "log-metric forwards tokens + model to tracker"
+else
+  record_fail "log-metric forwarder did not update tracker"
+  cat "$TRACKER_FILE" >&2
+fi
+unset METRICS_FILE TRACKER_FILE
+rm -rf "$tmp"
+
+# --- 6: log-format.md declares Tokens + Cost Breakdown ---
+if grep -q 'Tokens (in/out)' "$LOG_FORMAT_DOC"; then
+  record_pass "log-format.md declares Tokens (in/out) column"
+else
+  record_fail "log-format.md missing Tokens column declaration"
+fi
+if grep -q '## Cost Breakdown' "$LOG_FORMAT_DOC"; then
+  record_pass "log-format.md declares Cost Breakdown section"
+else
+  record_fail "log-format.md missing Cost Breakdown section"
+fi
+if grep -q 'render-agent-log-cost.sh' "$LOG_FORMAT_DOC"; then
+  record_pass "log-format.md references render-agent-log-cost.sh"
+else
+  record_fail "log-format.md does not reference renderer"
+fi
+
+# --- Summary ---
+total=$((pass + fail))
+printf '\n→ smoke-agent-log-cost: %d/%d passed\n' "$pass" "$total"
+if [ "$fail" -ne 0 ]; then
+  printf '\nFailures:\n'
+  for f in "${failures[@]}"; do printf '  - %s\n' "$f"; done
+  exit 1
+fi
+exit 0

package/pipeline/scripts/smoke-agent-model-routing.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# smoke-agent-model-routing.sh — v6.1.D
+#
+# Asserts per-persona model routing contract:
+#   1. Every agent file in pipeline/agents/ has a `preferredModel` frontmatter field.
+#   2. `preferredModel` is one of: opus | sonnet | haiku.
+#   3. `model:` (Claude-Code-native) matches `preferredModel` (single source of truth).
+#   4. Orchestrator docs mention `CLAUDE_CODE_SUBAGENT_MODEL` and `preferredModel`.
+#   5. Phase 4 review doc references the per-dispatch override mechanism.
+#
+# Exit 0 = all assertions pass, 1 = any failure.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+AGENTS_DIR="$ROOT/pipeline/agents"
+ORCH_SKILL="$ROOT/pipeline/skills/shared/core/multi-agent/SKILL.md"
+ORCH_CMD="$ROOT/pipeline/commands/multi-agent.md"
+PHASE4="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-4-review.md"
+
+pass=0
+fail=0
+failures=()
+
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-agent-model-routing (v6.1.D): per-persona model routing contract\n'
+
+# --- 1/2/3: per-agent frontmatter ---
+expected=(code-reviewer explorer ios-architect android-architect backend-architect security-auditor)
+for name in "${expected[@]}"; do
+  f="$AGENTS_DIR/$name.md"
+  if [ ! -f "$f" ]; then
+    record_fail "$name.md missing"
+    continue
+  fi
+  pref=$(awk '/^preferredModel:/ {print $2; exit}' "$f" | tr -d '"'"'")
+  mdl=$(awk '/^model:/ {print $2; exit}' "$f" | tr -d '"'"'")
+  case "$pref" in
+    opus|sonnet|haiku)
+      record_pass "$name has preferredModel=$pref"
+      ;;
+    *)
+      record_fail "$name preferredModel invalid or missing (got '$pref')"
+      ;;
+  esac
+  if [ -n "$pref" ] && [ "$pref" != "$mdl" ]; then
+    record_fail "$name model/preferredModel mismatch (model=$mdl preferredModel=$pref)"
+  elif [ -n "$pref" ]; then
+    record_pass "$name model == preferredModel ($pref)"
+  fi
+  if grep -q '^modelRationale:' "$f"; then
+    record_pass "$name has modelRationale"
+  else
+    record_fail "$name missing modelRationale"
+  fi
+done
+
+# --- 4: orchestrator SKILL.md references ---
+if grep -q 'CLAUDE_CODE_SUBAGENT_MODEL' "$ORCH_SKILL" && grep -q 'preferredModel' "$ORCH_SKILL"; then
+  record_pass "orchestrator SKILL.md documents dispatch contract"
+else
+  record_fail "orchestrator SKILL.md missing dispatch contract"
+fi
+
+# --- 4b: orchestrator command file references ---
+if grep -q 'preferredModel' "$ORCH_CMD"; then
+  record_pass "commands/multi-agent.md references preferredModel"
+else
+  record_fail "commands/multi-agent.md missing preferredModel reference"
+fi
+
+# --- 5: Phase 4 review doc references override ---
+if grep -q 'PHASE_MODEL_OVERRIDE\|preferredModel' "$PHASE4"; then
+  record_pass "phase-4-review.md documents per-reviewer override"
+else
+  record_fail "phase-4-review.md missing per-reviewer override doc"
+fi
+
+printf '\n══ agent-model-routing smoke: %d passed, %d failed ══\n' "$pass" "$fail"
+if [ "$fail" -gt 0 ]; then
+  printf '\nFailures:\n'
+  for msg in "${failures[@]}"; do printf '  - %s\n' "$msg"; done
+  exit 1
+fi
+exit 0