@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/smoke-compliance-skills.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# smoke-compliance-skills.sh — v5.8.0+ store-ready compliance skills contract.
+#
+# Verifies the two compliance skills are consistent with their documentation and
+# that the 4 claimed consumer surfaces actually reference them (not just promise).
+#
+# Covers:
+#   1. apple-archive-compliance/SKILL.md exists, has frontmatter, 17-rule catalog,
+#      EN + TR humanizer blocks, severity table, prerequisite detection.
+#   2. google-play-compliance/SKILL.md exists, has frontmatter, 21-rule catalog
+#      across 4 categories, EN + TR humanizer blocks, severity table, prereq detection.
+#   3. sim-test.md has "store-ready" scenario branch with platform detection.
+#   4. security-auditor.md cites both skills in a cross-reference subsection.
+#   5. review.md + multi-agent-review/SKILL.md cite both skills.
+#   6. channels.md + multi-agent-channels/SKILL.md have auto-augmentation logic
+#      that reads cached JSON reports.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+
+APPLE_SKILL="$ROOT/pipeline/skills/shared/core/apple-archive-compliance/SKILL.md"
+GOOGLE_SKILL="$ROOT/pipeline/skills/shared/core/google-play-compliance/SKILL.md"
+SIM_TEST="$ROOT/pipeline/commands/sim-test.md"
+SEC_AUDITOR="$ROOT/pipeline/agents/security-auditor.md"
+REVIEW_CMD="$ROOT/pipeline/commands/multi-agent/review.md"
+REVIEW_SKILL="$ROOT/pipeline/skills/shared/core/multi-agent-review/SKILL.md"
+CHANNELS_CMD="$ROOT/pipeline/commands/multi-agent/channels.md"
+CHANNELS_SKILL="$ROOT/pipeline/skills/shared/core/multi-agent-channels/SKILL.md"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+for f in "$APPLE_SKILL" "$GOOGLE_SKILL" "$SIM_TEST" "$SEC_AUDITOR" "$REVIEW_CMD" "$REVIEW_SKILL" "$CHANNELS_CMD" "$CHANNELS_SKILL"; do
+  [ -f "$f" ] || { echo "error: missing $f" >&2; exit 1; }
+done
+
+echo "→ 1. apple-archive-compliance SKILL.md frontmatter + catalog shape"
+grep -q "^name: apple-archive-compliance$" "$APPLE_SKILL" && pass "apple frontmatter name" || fail "apple frontmatter name"
+grep -q "^user-invocable: true$" "$APPLE_SKILL" && pass "apple user-invocable" || fail "apple user-invocable"
+grep -q "argument-hint:" "$APPLE_SKILL" && pass "apple argument-hint" || fail "apple argument-hint"
+# Count rule rows in the catalog table (excluding header + separator)
+APPLE_RULES=$(awk '/^## 17-Rule Catalog/,/^## Severity mapping/' "$APPLE_SKILL" | grep -cE '^\| *[0-9]+ *\|' || true)
+[ "$APPLE_RULES" -eq 17 ] && pass "apple catalog has 17 rule rows" || fail "apple catalog has $APPLE_RULES rule rows (want 17)"
+
+echo "→ 2. apple skill humanizer blocks EN + TR + severity table"
+# v8.2 split humanizer language from picker language: gating moved from
+# `promptLanguage == "en"|"tr"` (locked to "en") to the per-run `--lang=` flag.
+grep -qE '^### EN .*--lang=en' "$APPLE_SKILL" && pass "apple EN humanizer block present" || fail "apple EN humanizer missing"
+grep -qE '^### TR .*--lang=tr' "$APPLE_SKILL" && pass "apple TR humanizer block present" || fail "apple TR humanizer missing"
+grep -qE '\| *`error` *\|' "$APPLE_SKILL" && pass "apple severity table has error row" || fail "apple severity error row"
+grep -qE '\| *`warning` *\|' "$APPLE_SKILL" && pass "apple severity table has warning row" || fail "apple severity warning row"
+grep -qE '\| *`info` *\|' "$APPLE_SKILL" && pass "apple severity table has info row" || fail "apple severity info row"
+
+echo "→ 3. apple skill prerequisite detection + archive resolution (v8.4.0+ uses dev-toolkit-mcp)"
+grep -q 'ios_app_store_audit' "$APPLE_SKILL" && pass "apple references ios_app_store_audit MCP tool" || fail "apple ios_app_store_audit reference missing"
+grep -q '.xcarchive' "$APPLE_SKILL" && pass "apple references .xcarchive" || fail "apple .xcarchive missing"
+grep -q '@mmerterden/dev-toolkit-mcp' "$APPLE_SKILL" && pass "apple references @mmerterden/dev-toolkit-mcp package" || fail "apple dev-toolkit-mcp reference missing"
+grep -q 'mcp__dev_toolkit__ios_app_store_audit' "$APPLE_SKILL" && pass "apple shows MCP-call invocation form" || fail "apple MCP-call invocation form missing"
+
+echo "→ 4. google-play-compliance SKILL.md frontmatter + catalog shape"
+grep -q "^name: google-play-compliance$" "$GOOGLE_SKILL" && pass "google frontmatter name" || fail "google frontmatter name"
+grep -q "^user-invocable: true$" "$GOOGLE_SKILL" && pass "google user-invocable" || fail "google user-invocable"
+grep -q "argument-hint:" "$GOOGLE_SKILL" && pass "google argument-hint" || fail "google argument-hint"
+GOOGLE_RULES=$(awk '/^## 21-Rule Policy Catalog/,/^## Severity mapping/' "$GOOGLE_SKILL" | grep -cE '^\| *[0-9]+ *\|' || true)
+[ "$GOOGLE_RULES" -eq 21 ] && pass "google catalog has 21 rule rows" || fail "google catalog has $GOOGLE_RULES rule rows (want 21)"
+
+echo "→ 5. google catalog has 4 categories (A Technical / B Security / C Privacy / D Hygiene)"
+grep -q "^### A\. Technical requirements" "$GOOGLE_SKILL" && pass "google A Technical category" || fail "google A Technical missing"
+grep -q "^### B\. Security" "$GOOGLE_SKILL" && pass "google B Security category" || fail "google B Security missing"
+grep -q "^### C\. Privacy" "$GOOGLE_SKILL" && pass "google C Privacy category" || fail "google C Privacy missing"
+grep -q "^### D\. Release hygiene" "$GOOGLE_SKILL" && pass "google D Hygiene category" || fail "google D Hygiene missing"
+
+echo "→ 6. google skill humanizer blocks EN + TR"
+grep -qE '^### EN .*--lang=en' "$GOOGLE_SKILL" && pass "google EN humanizer block present" || fail "google EN humanizer missing"
+grep -qE '^### TR .*--lang=tr' "$GOOGLE_SKILL" && pass "google TR humanizer block present" || fail "google TR humanizer missing"
+
+echo "→ 7. google skill tool orchestration"
+grep -q 'bundletool' "$GOOGLE_SKILL" && pass "google references bundletool" || fail "google bundletool missing"
+grep -q 'aapt2' "$GOOGLE_SKILL" && pass "google references aapt2" || fail "google aapt2 missing"
+grep -q 'apksigner' "$GOOGLE_SKILL" && pass "google references apksigner" || fail "google apksigner missing"
+grep -q '.aab' "$GOOGLE_SKILL" && pass "google references .aab" || fail "google .aab missing"
+
+echo "→ 8. sim-test.md store-ready scenario branch"
+grep -q 'store-ready' "$SIM_TEST" && pass "sim-test mentions store-ready" || fail "sim-test missing store-ready"
+grep -q 'apple-archive-compliance' "$SIM_TEST" && pass "sim-test dispatches apple skill" || fail "sim-test missing apple dispatch"
+grep -q 'google-play-compliance' "$SIM_TEST" && pass "sim-test dispatches google skill" || fail "sim-test missing google dispatch"
+grep -q '\.xcodeproj' "$SIM_TEST" && pass "sim-test platform-detects .xcodeproj" || fail "sim-test missing .xcodeproj detect"
+grep -q 'build\.gradle' "$SIM_TEST" && pass "sim-test platform-detects build.gradle" || fail "sim-test missing build.gradle detect"
+
+echo "→ 9. consumer wiring — security-auditor (both catalogs)"
+grep -q 'apple-archive-compliance' "$SEC_AUDITOR" && pass "security-auditor references apple skill" || fail "security-auditor apple reference missing"
+grep -q 'google-play-compliance' "$SEC_AUDITOR" && pass "security-auditor references google skill" || fail "security-auditor google reference missing"
+grep -qE 'Info\.plist|PrivacyInfo|entitlements' "$SEC_AUDITOR" && pass "security-auditor lists iOS trigger files" || fail "security-auditor iOS trigger files missing"
+grep -qE 'AndroidManifest|build\.gradle|proguard' "$SEC_AUDITOR" && pass "security-auditor lists Android trigger files" || fail "security-auditor Android trigger files missing"
+
+echo "→ 10. consumer wiring — /multi-agent:review (both CLIs)"
+grep -q 'apple-archive-compliance' "$REVIEW_CMD" && pass "review.md cites apple catalog" || fail "review.md apple reference missing"
+grep -q 'google-play-compliance' "$REVIEW_CMD" && pass "review.md cites google catalog" || fail "review.md google reference missing"
+grep -q 'apple-archive-compliance' "$REVIEW_SKILL" && pass "review SKILL.md cites apple catalog" || fail "review SKILL.md apple missing"
+grep -q 'google-play-compliance' "$REVIEW_SKILL" && pass "review SKILL.md cites google catalog" || fail "review SKILL.md google missing"
+
+echo "→ 11. consumer wiring — /multi-agent:channels auto-augmentation"
+grep -q 'archiveguard-.*\.json' "$CHANNELS_CMD" && pass "channels.md reads cached archiveguard JSON" || fail "channels.md archiveguard cache missing"
+grep -q 'play-compliance-.*\.json' "$CHANNELS_CMD" && pass "channels.md reads cached play-compliance JSON" || fail "channels.md play-compliance cache missing"
+grep -qE 'Store compliance|store compliance' "$CHANNELS_CMD" && pass "channels.md has Store compliance section" || fail "channels.md Store compliance section missing"
+grep -q 'archiveguard-.*\.json' "$CHANNELS_SKILL" && pass "channels SKILL.md reads archiveguard cache" || fail "channels SKILL.md archiveguard cache missing"
+grep -q 'play-compliance-.*\.json' "$CHANNELS_SKILL" && pass "channels SKILL.md reads play-compliance cache" || fail "channels SKILL.md play-compliance cache missing"
+grep -qE 'Store compliance|store compliance' "$CHANNELS_SKILL" && pass "channels SKILL.md has Store compliance section" || fail "channels SKILL.md Store compliance section missing"
+
+echo "→ 12. apple skill writes the cache filename channels.md reads (producer↔consumer agreement)"
+grep -q 'archiveguard-\$\$\.json\|archiveguard-{pid}\.json' "$APPLE_SKILL" && pass "apple skill writes /tmp/archiveguard-*.json (matches channels glob)" || fail "apple skill cache filename does NOT match channels glob — store-compliance auto-augmentation will silently never trigger"
+
+echo ""
+echo "══ compliance-skills smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-cost-summary.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# smoke-cost-summary.sh — v6.1.J
+#
+# Verifies the cost-summary pipeline:
+#   1. cost-table.json parses and has opus/sonnet/haiku entries
+#   2. render-cost-summary.sh exits 2 when no tracker data available
+#   3. render-cost-summary.sh emits a valid markdown table from tracker fixture
+#   4. OTel-spans fallback path renders when tracker JSON is missing
+#   5. Unknown model gracefully renders USD as — with footnote
+#   6. Schema (prefs.schema.json) exposes costSummary toggle
+#   7. channels.md documents Cost Summary content option
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+RENDERER="$ROOT/pipeline/scripts/render-cost-summary.sh"
+TABLE="$ROOT/pipeline/scripts/cost-table.json"
+SCHEMA="$ROOT/pipeline/schemas/prefs.schema.json"
+CHANNELS_DOC="$ROOT/pipeline/commands/multi-agent/channels.md"
+
+pass=0
+fail=0
+failures=()
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-cost-summary (v6.1.J): PR-body Cost Summary renderer contract\n'
+
+# --- 1: cost-table.json shape ---
+if jq -e '.prices.opus.inPerMtok and .prices.sonnet.inPerMtok and .prices.haiku.inPerMtok' "$TABLE" >/dev/null 2>&1; then
+  record_pass "cost-table.json has opus/sonnet/haiku prices"
+else
+  record_fail "cost-table.json missing one of opus/sonnet/haiku"
+fi
+
+# --- 2: missing-data path returns exit 2 ---
+tmp=$(mktemp -d)
+pushd "$tmp" >/dev/null
+set +e
+bash "$RENDERER" GHOST-1 >/dev/null 2>&1
+rc=$?
+set -e
+if [ "$rc" -eq 2 ]; then
+  record_pass "renderer exits 2 when no tracker data"
+else
+  record_fail "renderer should exit 2 with no data (got $rc)"
+fi
+popd >/dev/null
+rm -rf "$tmp"
+
+# --- 3: tracker fixture renders markdown ---
+tmp=$(mktemp -d)
+pushd "$tmp" >/dev/null
+mkdir -p .worktrees/DEMO-1
+cat > .worktrees/DEMO-1/phase-tracker.json <<JSON
+{"taskId":"DEMO-1","phases":{
+  "1":{"name":"1. Analysis","model":"opus","tokens_in":12480,"tokens_out":3210},
+  "3":{"name":"3. Dev","model":"sonnet","tokens_in":42310,"tokens_out":9880}
+}}
+JSON
+out=$(bash "$RENDERER" DEMO-1)
+popd >/dev/null
+rm -rf "$tmp"
+
+if grep -q '^### Cost Summary$' <<< "$out" && \
+   grep -q '1. Analysis' <<< "$out" && \
+   grep -q '3. Dev' <<< "$out" && \
+   grep -q '\*\*Total\*\*' <<< "$out"; then
+  record_pass "tracker fixture renders header/rows/total"
+else
+  record_fail "tracker fixture output missing required rows"
+fi
+
+if grep -qE '\$[0-9]+\.[0-9]{2}' <<< "$out"; then
+  record_pass "USD formatted to 2 dp"
+else
+  record_fail "USD not formatted to 2 dp"
+fi
+
+# --- 4: OTel spans fallback ---
+tmp=$(mktemp -d)
+pushd "$tmp" >/dev/null
+mkdir -p .worktrees/OTEL-1
+cat > /tmp/cost-spans.jsonl <<JSON
+{"name":"phase.tokens.1","attributes":{"phase_id":"1","phase_name":"1. Analysis","model":"opus","tokens_in_delta":5000,"tokens_out_delta":1200}}
+{"name":"phase.tokens.1","attributes":{"phase_id":"1","phase_name":"1. Analysis","model":"opus","tokens_in_delta":3000,"tokens_out_delta":800}}
+JSON
+out2=$(bash "$RENDERER" OTEL-1 --otel-spans /tmp/cost-spans.jsonl || true)
+popd >/dev/null
+rm -rf "$tmp" /tmp/cost-spans.jsonl
+
+if grep -q '1. Analysis' <<< "$out2" && grep -q '8,000' <<< "$out2"; then
+  record_pass "OTel spans fallback aggregates phase tokens"
+else
+  record_fail "OTel fallback did not aggregate tokens (expected 8,000 in, got: $(echo "$out2" | tr '\n' ' ' | cut -c1-200))"
+fi
+
+# --- 5: unknown model → — + footnote ---
+tmp=$(mktemp -d)
+pushd "$tmp" >/dev/null
+mkdir -p .worktrees/UNK-1
+cat > .worktrees/UNK-1/phase-tracker.json <<JSON
+{"taskId":"UNK-1","phases":{
+  "1":{"name":"1. Analysis","model":"mystery-model","tokens_in":1000,"tokens_out":500}
+}}
+JSON
+out3=$(bash "$RENDERER" UNK-1)
+popd >/dev/null
+rm -rf "$tmp"
+
+if grep -q '| —' <<< "$out3" && grep -q 'USD unavailable' <<< "$out3"; then
+  record_pass "unknown model renders dash + footnote"
+else
+  record_fail "unknown model path missing dash or footnote"
+fi
+
+# --- 6: prefs schema exposes costSummary toggle ---
+if jq -e '.properties.global.properties.reportContent.properties.costSummary' "$SCHEMA" >/dev/null 2>&1; then
+  record_pass "prefs schema exposes reportContent.costSummary"
+else
+  record_fail "prefs schema missing reportContent.costSummary"
+fi
+
+# --- 7: channels.md documents the option ---
+if grep -q '^### Cost Summary' "$CHANNELS_DOC" && grep -q 'Cost özeti' "$CHANNELS_DOC"; then
+  record_pass "channels.md documents Cost Summary option"
+else
+  record_fail "channels.md missing Cost Summary docs"
+fi
+
+printf '\n══ cost-summary smoke: %d passed, %d failed ══\n' "$pass" "$fail"
+if [ "$fail" -gt 0 ]; then
+  printf '\nFailures:\n'
+  for msg in "${failures[@]}"; do printf '  - %s\n' "$msg"; done
+  exit 1
+fi
+exit 0

package/pipeline/scripts/smoke-cross-cli-behavior.sh

@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# smoke-cross-cli-behavior.sh — enforces the cross-CLI parity invariant
+# defined in ~/.claude/commands/multi-agent/refs/cross-cli-contract.md.
+#
+# This is a behavioral complement to smoke-sync-parity.sh (which tests the
+# parity checker itself). This script asserts the actual Claude Code and
+# Copilot CLI command trees respect:
+#   1. Command-set identity (17 shared commands present on both sides)
+#   2. Placeholder vocabulary (no deprecated names in Claude source)
+#   3. No personal-data leaks (hardcoded personal keychain keys, etc.)
+#   4. Canonical placeholders present where required (sanity)
+#   5. Canonical project-name vocabulary in user-facing docs
+#
+# Must pass before any `sync` run that touches shared commands.
+
+set -uo pipefail
+
+CLAUDE_CMDS="$HOME/.claude/commands/multi-agent"
+COPILOT_SKILLS="$HOME/.copilot/skills"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 1. Command-set identity (Claude vs Copilot)"
+if [ ! -d "$CLAUDE_CMDS" ]; then
+  fail "Claude commands dir missing: $CLAUDE_CMDS"
+  echo ""
+  echo "══ cross-cli-behavior: aborted (setup invalid) ══"
+  exit 2
+fi
+if [ ! -d "$COPILOT_SKILLS" ]; then
+  fail "Copilot skills dir missing: $COPILOT_SKILLS (install or sync first)"
+  echo ""
+  echo "══ cross-cli-behavior: aborted (setup invalid) ══"
+  exit 2
+fi
+
+# Underscore-prefixed Claude files (e.g. _account-picker.md) are internal
+# fragments lazy-loaded by other commands; they're not invocable on either CLI
+# and intentionally have no Copilot skill counterpart.
+CLAUDE_LIST=$(find "$CLAUDE_CMDS" -maxdepth 1 -name "*.md" ! -name "_*" -type f -exec basename {} \; 2>/dev/null | sed 's/\.md$//' | sort)
+COPILOT_LIST=$(find "$COPILOT_SKILLS" -maxdepth 1 -type d -name "multi-agent-*" -exec basename {} \; 2>/dev/null | sed 's/^multi-agent-//' | sort)
+
+if [ "$CLAUDE_LIST" = "$COPILOT_LIST" ]; then
+  COUNT=$(echo "$CLAUDE_LIST" | grep -c '^..*')
+  pass "command sets identical ($COUNT commands each)"
+else
+  fail "command sets diverged"
+  echo "    Claude only:"
+  comm -23 <(echo "$CLAUDE_LIST") <(echo "$COPILOT_LIST") | sed 's/^/      /'
+  echo "    Copilot only:"
+  comm -13 <(echo "$CLAUDE_LIST") <(echo "$COPILOT_LIST") | sed 's/^/      /'
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "→ 2. No deprecated placeholders in Claude source"
+# Per refs/cross-cli-contract.md Section 2.5
+DEPRECATED=(
+  "{github-username}"
+  "{website-repo}"
+  "{your-website}"
+  "my-project"
+  "my-figma-project"
+  "my-mobile-app"
+)
+for p in "${DEPRECATED[@]}"; do
+  # grep -l returns filenames; empty = no matches
+  FOUND=$(grep -l -F -- "$p" "$CLAUDE_CMDS"/*.md 2>/dev/null || true)
+  if [ -z "$FOUND" ]; then
+    pass "no '$p' in Claude commands"
+  else
+    fail "deprecated '$p' found in: $(echo "$FOUND" | xargs -n1 basename | paste -sd, -)"
+  fi
+done
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "→ 3. No personal-data hardcodes in generic docs"
+# These are patterns that must be placeholders, never literals
+PERSONAL_HARDCODES=(
+  "${USER}_tkgithub"
+)
+for p in "${PERSONAL_HARDCODES[@]}"; do
+  FOUND=$(grep -l -F -- "$p" "$CLAUDE_CMDS"/*.md 2>/dev/null || true)
+  if [ -z "$FOUND" ]; then
+    pass "no '$p' leaked into Claude commands"
+  else
+    fail "personal hardcode '$p' found in: $(echo "$FOUND" | xargs -n1 basename | paste -sd, -)"
+  fi
+done
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "→ 4. Canonical placeholders present (sanity)"
+# These MUST exist (regressions would mean someone undid a drift fix)
+if grep -q -F "{owner}" "$CLAUDE_CMDS/sync.md" 2>/dev/null; then
+  pass "sync.md uses canonical '{owner}'"
+else
+  fail "sync.md missing '{owner}' — drift fix may have regressed"
+fi
+
+if grep -q -F "{website-host}" "$CLAUDE_CMDS/sync.md" 2>/dev/null; then
+  pass "sync.md uses canonical '{website-host}'"
+else
+  fail "sync.md missing '{website-host}' — drift fix may have regressed"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "→ 5. Canonical project-name vocabulary in log.md"
+CANONICAL_PROJECTS=("my-ui-components" "my-figma-app" "my-ios-app")
+for c in "${CANONICAL_PROJECTS[@]}"; do
+  if grep -q -F -- "$c" "$CLAUDE_CMDS/log.md" 2>/dev/null; then
+    pass "log.md references '$c'"
+  else
+    fail "log.md missing canonical '$c'"
+  fi
+done
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "→ 6. Contract doc exists (required source of truth)"
+CONTRACT="$CLAUDE_CMDS/refs/cross-cli-contract.md"
+if [ -f "$CONTRACT" ]; then
+  SIZE=$(wc -l < "$CONTRACT" | tr -d ' ')
+  if [ "$SIZE" -ge 100 ]; then
+    pass "cross-cli-contract.md present ($SIZE lines)"
+  else
+    fail "cross-cli-contract.md suspiciously short ($SIZE lines) — stub?"
+  fi
+else
+  fail "cross-cli-contract.md missing at $CONTRACT"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "→ 7. Figma skill trees deployed to both CLIs (WS-8b, v5.0.1+)"
+
+CLAUDE_SKILLS="$HOME/.claude/skills"
+FIGMA_TREES=(figma-ios figma-android figma-common)
+
+for tree in "${FIGMA_TREES[@]}"; do
+  claude_tree="$CLAUDE_SKILLS/$tree"
+  copilot_tree="$COPILOT_SKILLS/$tree"
+  if [ -d "$claude_tree" ] && [ -d "$copilot_tree" ]; then
+    claude_count=$(find "$claude_tree" -maxdepth 1 -mindepth 1 -type d | wc -l | tr -d ' ')
+    copilot_count=$(find "$copilot_tree" -maxdepth 1 -mindepth 1 -type d | wc -l | tr -d ' ')
+    if [ "$claude_count" -eq "$copilot_count" ]; then
+      pass "$tree deployed to both CLIs ($claude_count skills each)"
+    else
+      fail "$tree count mismatch (claude=$claude_count copilot=$copilot_count)"
+    fi
+  elif [ -d "$claude_tree" ] || [ -d "$copilot_tree" ]; then
+    fail "$tree deployed to only ONE CLI"
+  else
+    echo "    (tree not installed on either CLI — run \`node install.js --all\` to deploy)"
+  fi
+done
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "→ 8. Agent personas deployed to both CLIs"
+
+CLAUDE_AGENTS="$HOME/.claude/agents"
+COPILOT_AGENTS="$HOME/.copilot/agents"
+AGENT_FILES=(code-reviewer.md explorer.md ios-architect.md android-architect.md backend-architect.md security-auditor.md)
+
+if [ -d "$CLAUDE_AGENTS" ] && [ -d "$COPILOT_AGENTS" ]; then
+  missing_on_copilot=0
+  for a in "${AGENT_FILES[@]}"; do
+    [ -f "$COPILOT_AGENTS/$a" ] || missing_on_copilot=$((missing_on_copilot+1))
+  done
+  if [ "$missing_on_copilot" -eq 0 ]; then
+    pass "all 6 reviewer/explorer personas present on both CLIs"
+  else
+    fail "$missing_on_copilot persona file(s) missing from Copilot side"
+  fi
+  claude_count=$(find "$CLAUDE_AGENTS" -maxdepth 1 -type f -name '*.md' | wc -l | tr -d ' ')
+  copilot_count=$(find "$COPILOT_AGENTS" -maxdepth 1 -type f -name '*.md' | wc -l | tr -d ' ')
+  if [ "$claude_count" -eq "$copilot_count" ]; then
+    pass "agents/ file count matches ($claude_count each)"
+  else
+    fail "agents/ count mismatch (claude=$claude_count copilot=$copilot_count)"
+  fi
+elif [ -d "$CLAUDE_AGENTS" ] || [ -d "$COPILOT_AGENTS" ]; then
+  fail "agents/ deployed to only ONE CLI — cross-CLI parity broken"
+else
+  echo "    (agents/ not installed on either CLI — run \`node install.js --all\` to deploy)"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "══ cross-cli-behavior smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-cross-phase-cohesion.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+#
+# smoke-cross-phase-cohesion.sh — assert every Phase N → Phase N+1 hand-off
+# in the multi-agent pipeline references the same schema on both sides.
+#
+# Why this exists (v8.0.0): existing schema-validation smoke proves each
+# JSON schema is itself well-formed. It does NOT prove that Phase 1's
+# reference doc says "I emit analysis-output.schema.json" while Phase 2's
+# reference doc says "I read analysis-output.schema.json". A reference can
+# rename or drop the schema without the validator catching it — phase docs
+# would silently desynchronize from the runtime contract.
+#
+# The contract chain:
+#   Phase 1 (Analysis)  →  analysis-output.schema.json    → Phase 2 (Planning)
+#   Phase 2 (Planning)  →  planning-output.schema.json    → Phase 3 (Dev)
+#   Phase 4 (Review)    →  reviewer-output.schema.json    → Phase 4 triage
+#   Phase 4 (Review)    →  triage-output.schema.json      → Phase 6 (Commit)
+#   Phase 6 (Commit)    →  agent-state.json fields        → Phase 7 (Report)
+#
+# Each schema must (a) exist on disk, (b) be referenced in the producer
+# phase ref doc, (c) be referenced in the consumer phase ref doc.
+#
+# Exit codes: 0=pass, 1=cohesion break detected
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+PHASE_DIR="$REPO_ROOT/pipeline/commands/multi-agent/refs/phases"
+SCHEMA_DIR="$REPO_ROOT/pipeline/schemas"
+
+PASS=0
+FAIL=0
+pass() { echo "  ✓ $*"; PASS=$((PASS + 1)); }
+fail() { echo "  ✗ $*"; FAIL=$((FAIL + 1)); }
+
+assert_schema_exists() {
+  local schema="$1"
+  if [ -f "$SCHEMA_DIR/$schema" ]; then
+    pass "$schema exists in pipeline/schemas/"
+  else
+    fail "$schema MISSING — runtime contract broken"
+  fi
+}
+
+assert_phase_references() {
+  local phase_file="$1" schema="$2" role="$3"
+  local path="$PHASE_DIR/$phase_file"
+  if [ ! -f "$path" ]; then
+    fail "$phase_file not found at $path"
+    return
+  fi
+  if grep -Fq "$schema" "$path"; then
+    pass "$phase_file [$role] references $schema"
+  else
+    fail "$phase_file [$role] does NOT reference $schema — cohesion break"
+  fi
+}
+
+# -----------------------------------------------------------------------------
+echo "→ 1. Pipeline schemas all exist on disk"
+# -----------------------------------------------------------------------------
+assert_schema_exists "analysis-output.schema.json"
+assert_schema_exists "planning-output.schema.json"
+assert_schema_exists "reviewer-output.schema.json"
+assert_schema_exists "triage-output.schema.json"
+assert_schema_exists "agent-state.schema.json"
+assert_schema_exists "prefs.schema.json"
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "→ 2. Phase 1 → Phase 2 hand-off (analysis-output.schema.json)"
+# -----------------------------------------------------------------------------
+assert_phase_references "phase-1-analysis.md" "analysis-output.schema.json" "producer"
+assert_phase_references "phase-2-planning.md" "analysis-output.schema.json" "consumer"
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "→ 3. Phase 2 → Phase 3 hand-off (planning-output.schema.json)"
+# -----------------------------------------------------------------------------
+assert_phase_references "phase-2-planning.md" "planning-output.schema.json" "producer"
+assert_phase_references "phase-3-dev.md" "planning-output.schema.json" "consumer"
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "→ 4. Phase 4 review → triage hand-off (reviewer-output.schema.json)"
+# -----------------------------------------------------------------------------
+assert_phase_references "phase-4-review.md" "reviewer-output.schema.json" "producer"
+# Triage lives inside phase-4-review.md too; same file is producer + consumer for the chain.
+if grep -B 2 -A 60 "reviewer-output.schema.json" "$PHASE_DIR/phase-4-review.md" \
+   | grep -q "triage-output.schema.json"; then
+  pass "phase-4-review.md threads reviewer→triage in the same doc"
+else
+  fail "phase-4-review.md missing triage hand-off block"
+fi
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "→ 5. Phase 4 triage → Phase 6 commit hand-off (triage-output.schema.json)"
+# -----------------------------------------------------------------------------
+assert_phase_references "phase-4-review.md" "triage-output.schema.json" "producer"
+# Phase 6 doesn't always re-state the schema name; instead it references the
+# triage outcome bucket counts. Accept either form.
+if grep -Eq "triage-output\.schema\.json|triage outcome|accepted findings" "$PHASE_DIR/phase-6-commit.md"; then
+  pass "phase-6-commit.md consumes triage output (schema or outcome reference)"
+else
+  fail "phase-6-commit.md does NOT consume Phase 4 triage output"
+fi
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "→ 6. Phase 6 → Phase 7 hand-off (agent-state.json mutations)"
+# -----------------------------------------------------------------------------
+assert_phase_references "phase-6-commit.md" "agent-state" "producer"
+assert_phase_references "phase-7-report.md" "agent-state" "consumer"
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "→ 7. Validator runs the round-trip without errors"
+# -----------------------------------------------------------------------------
+if node "$REPO_ROOT/pipeline/scripts/validate-schemas.mjs" >/dev/null 2>&1; then
+  pass "validate-schemas.mjs reports all schemas valid"
+else
+  fail "validate-schemas.mjs failed — schema integrity broken"
+fi
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "══ smoke-cross-phase-cohesion: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -gt 0 ] && exit 1 || exit 0