@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/smoke-delete-flow.sh

@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+# smoke-delete-flow.sh — v7.7.0 token-preserving uninstall.
+#
+# Round-trip integrity for `multi-agent uninstall`:
+#   1. --dry-run produces a preview without modifying the filesystem
+#   2. Real uninstall removes pipeline-managed files
+#   3. User-authored content survives (CLAUDE.md, preferences, marker-wrapped blocks)
+#   4. Selective targets (--cursor, --copilot-chat) only touch the requested tree
+#   5. Adapter `uninstall()` is invoked and its result reflects in the output
+#   6. (Bonus) Slash command + Copilot skill exist with byte-eq description (parity)
+#
+# We never invoke the uninstaller against $HOME — the test scaffolds an
+# isolated `--target` tree and exercises the adapter portion only. Claude /
+# Copilot uninstall paths are exercised via dry-run (which reports them).
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+INSTALL="$REPO_ROOT/install.js"
+UNINSTALL="$REPO_ROOT/pipeline/scripts/uninstall.mjs"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
+
+cleanup() {
+  [ -n "${TMP:-}" ] && rm -rf "$TMP"
+}
+trap cleanup EXIT
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 1. Slash command + Copilot peer exist"
+if [ -f "$REPO_ROOT/pipeline/commands/multi-agent/delete.md" ]; then
+  pass "pipeline/commands/multi-agent/delete.md present"
+else
+  fail "delete.md missing"
+fi
+if [ -f "$REPO_ROOT/pipeline/skills/shared/core/multi-agent-delete/SKILL.md" ]; then
+  pass "pipeline/skills/shared/core/multi-agent-delete/SKILL.md present"
+else
+  fail "multi-agent-delete SKILL.md missing"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 2. --dry-run produces preview without side effects"
+TMP=$(mktemp -d)
+node "$INSTALL" --cursor --target="$TMP" >/dev/null 2>&1
+pre_count=$(find "$TMP" -type f | wc -l | tr -d ' ')
+
+OUTPUT=$(node "$UNINSTALL" --dry-run --yes --cursor --target="$TMP" 2>&1)
+post_count=$(find "$TMP" -type f | wc -l | tr -d ' ')
+
+if [ "$pre_count" = "$post_count" ] && [ "$post_count" -gt 100 ]; then
+  pass "--dry-run preserved file tree ($post_count files)"
+else
+  fail "--dry-run changed file tree (pre=$pre_count post=$post_count)"
+fi
+
+if echo "$OUTPUT" | grep -q "DRY-RUN"; then
+  pass "--dry-run output mentions DRY-RUN banner"
+else
+  fail "--dry-run banner missing from output"
+fi
+
+if echo "$OUTPUT" | grep -q "Personal access tokens were NOT touched"; then
+  pass "--dry-run output reaffirms token preservation"
+else
+  fail "token-preservation message missing from --dry-run output"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 3. Real uninstall removes pipeline files"
+node "$UNINSTALL" --yes --cursor --target="$TMP" >/dev/null 2>&1
+remaining=$(find "$TMP" -type f | wc -l | tr -d ' ')
+if [ "$remaining" = "0" ]; then
+  pass "real uninstall: 0 pipeline files remain (was $pre_count)"
+else
+  fail "real uninstall left $remaining file(s)"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 4. User content outside markers survives uninstall (copilot-chat)"
+rm -rf "$TMP" && TMP=$(mktemp -d)
+mkdir -p "$TMP/.github"
+USER_LINE="DO_NOT_TOUCH_$(date +%s)"
+echo "$USER_LINE" > "$TMP/.github/copilot-instructions.md"
+node "$INSTALL" --copilot-chat --target="$TMP" >/dev/null 2>&1
+node "$UNINSTALL" --yes --copilot-chat --target="$TMP" >/dev/null 2>&1
+
+if grep -q "$USER_LINE" "$TMP/.github/copilot-instructions.md" 2>/dev/null; then
+  pass "user content outside markers survived uninstall"
+else
+  fail "user content lost during uninstall"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 5. Selective target — --copilot-chat doesn't touch cursor tree"
+rm -rf "$TMP" && TMP=$(mktemp -d)
+node "$INSTALL" --cursor --target="$TMP" >/dev/null 2>&1
+node "$INSTALL" --copilot-chat --target="$TMP" >/dev/null 2>&1
+
+# Now uninstall ONLY copilot-chat; cursor tree should remain
+node "$UNINSTALL" --yes --copilot-chat --target="$TMP" >/dev/null 2>&1
+
+cursor_remaining=$(find "$TMP/.cursor" -type f 2>/dev/null | wc -l | tr -d ' ')
+copilot_remaining=$(find "$TMP/.github/instructions" -name "multi-agent-*" 2>/dev/null | wc -l | tr -d ' ')
+
+if [ "$cursor_remaining" -gt 0 ]; then
+  pass "selective uninstall: cursor tree untouched ($cursor_remaining files)"
+else
+  fail "selective uninstall: cursor tree was deleted"
+fi
+
+if [ "$copilot_remaining" = "0" ]; then
+  pass "selective uninstall: copilot-chat per-skill files cleaned"
+else
+  fail "selective uninstall: $copilot_remaining copilot-chat file(s) remain"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 6. CLI router — 'uninstall' and 'delete' both reach the script"
+OUT_UNINSTALL=$(node "$REPO_ROOT/index.js" uninstall --dry-run --yes --cursor --target=/tmp/fake 2>&1 || true)
+OUT_DELETE=$(node "$REPO_ROOT/index.js" delete --dry-run --yes --cursor --target=/tmp/fake 2>&1 || true)
+
+if echo "$OUT_UNINSTALL" | grep -q "multi-agent-pipeline uninstaller"; then
+  pass "'index.js uninstall' invokes the uninstaller"
+else
+  fail "'index.js uninstall' did not reach uninstaller"
+fi
+
+if echo "$OUT_DELETE" | grep -q "multi-agent-pipeline uninstaller"; then
+  pass "'index.js delete' alias also invokes the uninstaller"
+else
+  fail "'index.js delete' alias did not reach uninstaller"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 7. Token preservation — uninstaller never invokes credential-store"
+# Static check: uninstall.mjs must not import credential-store.sh or call
+# `security delete-generic-password` / `cmdkey /delete` / `secret-tool clear`.
+if grep -qE "credential-store|delete-generic-password|cmdkey /delete|secret-tool clear|secret-tool del" "$UNINSTALL"; then
+  fail "uninstall.mjs references credential-store deletion APIs (token leak risk)"
+else
+  pass "uninstall.mjs has no credential-store deletion references"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "══ delete-flow smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-dev-critic.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# smoke-dev-critic.sh
+#
+# Verifies the Phase 3.5 evaluator-optimizer contract:
+#   1. pipeline/agents/dev-critic.md exists with required frontmatter
+#   2. phase-3-dev.md documents Step 3.5 with loop cap + gates + escalate rule
+#   3. prefs.schema.json exposes global.devCritic.{enabled,maxIterations,model,minDiffLoc}
+#   4. dev-critic-output.schema.json exists and is valid JSON Schema
+#   5. Severity enum + gate enum match the agent doc
+#   6. Loop cap default is 2 (matches "max 2" rule documented in the agent)
+#   7. Off-by-default (no surprise cost on existing users)
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+AGENT="$ROOT/pipeline/agents/dev-critic.md"
+PHASE_DOC="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-3-dev.md"
+PREFS_SCHEMA="$ROOT/pipeline/schemas/prefs.schema.json"
+CRITIC_SCHEMA="$ROOT/pipeline/schemas/dev-critic-output.schema.json"
+
+pass=0
+fail=0
+failures=()
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-dev-critic: Phase 3.5 evaluator-optimizer contract\n'
+
+# 1. Agent file exists with required frontmatter
+if [ ! -f "$AGENT" ]; then
+  record_fail "pipeline/agents/dev-critic.md missing"
+else
+  # Extract frontmatter (between first two --- lines)
+  fm=$(awk '/^---$/{n++; if(n==2) exit; if(n==1) next} n==1{print}' "$AGENT")
+  for key in description model preferredModel; do
+    if grep -qE "^${key}:" <<<"$fm"; then
+      record_pass "agent frontmatter has '${key}'"
+    else
+      record_fail "agent frontmatter missing '${key}'"
+    fi
+  done
+  # Model must be sonnet (the documented default)
+  if grep -qE "^model: sonnet" <<<"$fm"; then
+    record_pass "agent default model is sonnet"
+  else
+    record_fail "agent model default should be sonnet (was: $(grep '^model:' <<<"$fm" || echo missing))"
+  fi
+fi
+
+# 2. Phase doc mentions Step 3.5 with the loop contract
+if [ ! -f "$PHASE_DOC" ]; then
+  record_fail "phase-3-dev.md missing"
+else
+  if grep -qF "Step 3.5" "$PHASE_DOC" && grep -qF "Dev Critic" "$PHASE_DOC"; then
+    record_pass "phase-3-dev.md documents Step 3.5 — Dev Critic"
+  else
+    record_fail "phase-3-dev.md missing Step 3.5 section"
+  fi
+  if grep -qE "max(imum)? (\*\*)?2(\*\*)? iterations?" "$PHASE_DOC"; then
+    record_pass "phase doc documents max 2 iterations"
+  else
+    record_fail "phase doc must state 'max 2 iterations' rule"
+  fi
+  if grep -qF "escalate" "$PHASE_DOC"; then
+    record_pass "phase doc documents escalate path"
+  else
+    record_fail "phase doc must document escalate behavior"
+  fi
+  if grep -qF "dev-critic.md" "$PHASE_DOC"; then
+    record_pass "phase doc cites agents/dev-critic.md"
+  else
+    record_fail "phase doc must reference agents/dev-critic.md"
+  fi
+fi
+
+# 3. Prefs schema exposes devCritic toggle
+if jq -e '.properties.global.properties.devCritic.properties.enabled' "$PREFS_SCHEMA" >/dev/null 2>&1; then
+  record_pass "prefs schema exposes devCritic.enabled"
+else
+  record_fail "prefs schema missing devCritic.enabled"
+fi
+for prop in maxIterations model minDiffLoc; do
+  if jq -e ".properties.global.properties.devCritic.properties.${prop}" "$PREFS_SCHEMA" >/dev/null 2>&1; then
+    record_pass "prefs schema exposes devCritic.${prop}"
+  else
+    record_fail "prefs schema missing devCritic.${prop}"
+  fi
+done
+
+# 4. dev-critic-output schema is valid JSON
+if [ ! -f "$CRITIC_SCHEMA" ]; then
+  record_fail "dev-critic-output.schema.json missing"
+elif ! jq empty "$CRITIC_SCHEMA" 2>/dev/null; then
+  record_fail "dev-critic-output.schema.json is not valid JSON"
+else
+  record_pass "dev-critic-output.schema.json parses"
+fi
+
+# 5. Severity enum matches doc (blocking/important/suggestion)
+if jq -e '.properties.findings.items.properties.severity.enum
+          | (index("blocking") != null
+             and index("important") != null
+             and index("suggestion") != null)' "$CRITIC_SCHEMA" >/dev/null 2>&1; then
+  record_pass "schema severity enum includes blocking/important/suggestion"
+else
+  record_fail "schema severity enum incomplete"
+fi
+
+# Gate keys (build/lint/test/secrets) match doc
+for gate in build lint test secrets; do
+  if jq -e ".properties.gates.properties.${gate}" "$CRITIC_SCHEMA" >/dev/null 2>&1; then
+    record_pass "schema gates expose '${gate}'"
+  else
+    record_fail "schema gates missing '${gate}'"
+  fi
+done
+
+# 6. Loop cap default = 2
+default_iter=$(jq -r '.properties.global.properties.devCritic.properties.maxIterations.default // empty' "$PREFS_SCHEMA")
+if [ "$default_iter" = "2" ]; then
+  record_pass "devCritic.maxIterations defaults to 2"
+else
+  record_fail "devCritic.maxIterations default should be 2 (was: ${default_iter:-missing})"
+fi
+
+# 7. Off by default — preserves existing-user baseline
+# Note: jq's `// empty` treats boolean false as falsy, so use `has("default")` + raw value.
+if jq -e '.properties.global.properties.devCritic.properties.enabled
+          | has("default") and .default == false' "$PREFS_SCHEMA" >/dev/null 2>&1; then
+  record_pass "devCritic.enabled defaults to false (opt-in)"
+else
+  default_enabled=$(jq -c '.properties.global.properties.devCritic.properties.enabled.default' "$PREFS_SCHEMA")
+  record_fail "devCritic.enabled should default to false (was: ${default_enabled})"
+fi
+
+printf '\n══ dev-critic smoke: %d passed, %d failed ══\n' "$pass" "$fail"
+if [ "$fail" -gt 0 ]; then
+  printf '\nFailures:\n'
+  for msg in "${failures[@]}"; do printf '  - %s\n' "$msg"; done
+  exit 1
+fi
+exit 0

package/pipeline/scripts/smoke-diff-explain.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# smoke-diff-explain.sh — v7.8.0 Paket B: Phase 4 triage to diff bridge.
+#
+# Validates:
+#   1. Slash command + Copilot peer present (parity smoke also catches this)
+#   2. Empty triage produces a "no findings" stub without crashing
+#   3. Mixed-classification fixture renders all bucket icons (✅ ⏭️ ❌)
+#   4. Severity icons (🚫 ⚠️ 💡) render correctly
+#   5. Hunk binding: synthetic diff + matching line → diff fence in output
+#   6. Out-of-diff line → fallback message (no crash)
+#   7. --help works without inputs
+#   8. Missing inputs exit 1 with a clear error
+#   9. Read-only contract: script does NOT call git apply / git checkout / write APIs
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+SCRIPT="$REPO_ROOT/pipeline/scripts/diff-explain.mjs"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS + 1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
+
+cleanup() { [ -n "${TMP:-}" ] && rm -rf "$TMP"; }
+trap cleanup EXIT
+TMP=$(mktemp -d)
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 1. Command + skill files exist"
+[ -f "$REPO_ROOT/pipeline/commands/multi-agent/diff-explain.md" ] && pass "diff-explain.md present" || fail "diff-explain.md missing"
+[ -f "$REPO_ROOT/pipeline/skills/shared/core/multi-agent-diff-explain/SKILL.md" ] && pass "multi-agent-diff-explain SKILL.md present" || fail "Copilot peer missing"
+[ -x "$SCRIPT" ] && pass "diff-explain.mjs is executable" || fail "diff-explain.mjs not executable"
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 2. Empty findings stub"
+cat > "$TMP/empty.json" <<'EOF'
+{"accepted": [], "deferred": [], "rejected": [], "approved": true}
+EOF
+OUT=$(node "$SCRIPT" --triage "$TMP/empty.json" --diff /dev/null 2>&1)
+if echo "$OUT" | grep -q "no findings to map"; then
+  pass "empty triage → 'no findings' stub"
+else
+  fail "empty triage did not produce stub message"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 3. Bucket icons render correctly"
+OUT=$(node "$SCRIPT" --triage "$REPO_ROOT/pipeline/eval/triage/05-mixed-classification/expected.json" --diff /dev/null 2>&1)
+echo "$OUT" | grep -q "✅" && pass "accepted bucket icon (✅) rendered" || fail "accepted icon missing"
+echo "$OUT" | grep -q "⏭️" && pass "deferred bucket icon (⏭️) rendered" || fail "deferred icon missing"
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 4. Severity icons render"
+echo "$OUT" | grep -q "🚫" && pass "blocking severity icon (🚫) rendered" || fail "blocking icon missing"
+echo "$OUT" | grep -q "⚠️" && pass "important severity icon (⚠️) rendered" || fail "important icon missing"
+echo "$OUT" | grep -q "💡" && pass "suggestion severity icon (💡) rendered" || fail "suggestion icon missing"
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 5. Hunk binding — synthetic diff matches finding line"
+cat > "$TMP/syn.diff" <<'EOF'
+diff --git a/src/api/checkout.ts b/src/api/checkout.ts
+index a..b 100644
+--- a/src/api/checkout.ts
++++ b/src/api/checkout.ts
+@@ -98,5 +98,7 @@ ...
+   const total = sum(items);
++  const total2 = sum(items);
++  // duplicate
+   await chargeCard(total);
+EOF
+OUT=$(node "$SCRIPT" --triage "$REPO_ROOT/pipeline/eval/triage/05-mixed-classification/expected.json" --diff "$TMP/syn.diff" 2>&1)
+if echo "$OUT" | grep -q '```diff'; then
+  pass "hunk fenced diff block rendered"
+else
+  fail "no diff code fence in output"
+fi
+if echo "$OUT" | grep -q "@@ -98,5 +98,7 @@"; then
+  pass "hunk header preserved in output"
+else
+  fail "hunk header missing in output"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 6. Out-of-diff line fallback"
+# checkout.ts is in the diff but its lines 145, 200 are NOT covered by the
+# single hunk above. Should produce fallback messages, not crash.
+fallback_count=$(echo "$OUT" | grep -c "line not in diff" || true)
+if [ "$fallback_count" -ge 1 ]; then
+  pass "out-of-diff lines produce fallback message ($fallback_count occurrences)"
+else
+  # Acceptable alternative: hunk renderer outputs nothing visible. Both options OK.
+  pass "out-of-diff lines handled (no crash)"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 7. --help works without inputs"
+HELP=$(node "$SCRIPT" --help 2>&1)
+if echo "$HELP" | grep -q "Usage:"; then
+  pass "--help prints usage"
+else
+  fail "--help missing Usage block"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 8. Missing inputs exit non-zero"
+set +e
+node "$SCRIPT" 2>"$TMP/err.txt"
+EC=$?
+set -e
+if [ "$EC" -ne 0 ] && grep -q "required" "$TMP/err.txt"; then
+  pass "no-input exit $EC with 'required' error"
+else
+  fail "no-input did not error correctly (exit=$EC)"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 9. Read-only contract — no destructive git APIs"
+if grep -qE "git apply|git checkout|git reset|git rebase|git push|git commit|writeFileSync" "$SCRIPT"; then
+  fail "diff-explain.mjs references destructive git API or writeFileSync (read-only contract violated)"
+else
+  pass "no destructive git/write API references in diff-explain.mjs"
+fi
+
+# ──────────────────────────────────────────────────────────────────────────
+echo ""
+echo "══ diff-explain smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-diff-risk.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+# smoke-diff-risk.sh — v8.3.0
+#
+# Verifies the Phase 4 advisory diff-risk pipeline:
+#   1. diff-risk-score.mjs runs against the iOS fixture and produces valid JSON
+#   2. KeychainStore (security path) ranks first
+#   3. Tests file ranks last (no security/public_api/migration signal)
+#   4. validate-diff-risk.mjs accepts the output, rejects malformed
+#   5. Android fixture: migration outranks AuthRepository outranks HomeScreen
+#   6. --top truncation honored
+#   7. Empty diff returns exit 2
+#   8. phase-4-review.md ref doc declares Step 1.75 + diff-risk-score.mjs
+#   9. code-reviewer.md agent template carries the priority-files placeholder
+#   10. prefs.schema.json exposes diffRisk advisory toggle
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+SCORE="$ROOT/pipeline/scripts/diff-risk-score.mjs"
+VALIDATE="$ROOT/pipeline/scripts/validate-diff-risk.mjs"
+SCHEMA="$ROOT/pipeline/schemas/diff-risk.schema.json"
+PHASE4="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-4-review.md"
+REVIEWER="$ROOT/pipeline/agents/code-reviewer.md"
+PREFS="$ROOT/pipeline/schemas/prefs.schema.json"
+FIX_IOS="$ROOT/pipeline/scripts/fixtures/diff-risk-ios.diff"
+FIX_AND="$ROOT/pipeline/scripts/fixtures/diff-risk-android.diff"
+
+pass=0
+fail=0
+failures=()
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-diff-risk (v8.3.0): pre-review risk scoring contract\n'
+
+[ -f "$SCHEMA" ]   || { record_fail "schema missing: $SCHEMA"; exit 1; }
+[ -f "$FIX_IOS" ]  || { record_fail "fixture missing: $FIX_IOS"; exit 1; }
+[ -f "$FIX_AND" ]  || { record_fail "fixture missing: $FIX_AND"; exit 1; }
+
+# --- 1: iOS fixture produces JSON ---
+out_ios=$(node "$SCORE" --diff "$FIX_IOS" 2>/dev/null)
+if jq -e '.schemaVersion == "1.0.0"' <<< "$out_ios" >/dev/null 2>&1; then
+  record_pass "iOS fixture renders schema-versioned JSON"
+else
+  record_fail "iOS fixture JSON malformed or missing schemaVersion"
+fi
+
+# --- 2: KeychainStore ranks first ---
+top1=$(jq -r '.files[0].path' <<< "$out_ios")
+if [ "$top1" = "MyApp/Sources/Auth/KeychainStore.swift" ]; then
+  record_pass "iOS top-1 = KeychainStore (security_path + public_api + no_test)"
+else
+  record_fail "iOS top-1 should be KeychainStore, got: $top1"
+fi
+
+# --- 3: Test file ranks last ---
+last=$(jq -r '.files[-1].path' <<< "$out_ios")
+if [ "$last" = "MyAppTests/SettingsViewTests.swift" ]; then
+  record_pass "iOS last = test file (no risk signals beyond loc_changed)"
+else
+  record_fail "iOS last should be test file, got: $last"
+fi
+
+# --- 4: Validator accepts valid output, rejects malformed ---
+set +e
+echo "$out_ios" | node "$VALIDATE" - >/dev/null 2>&1
+rc_ok=$?
+echo '{"schemaVersion":"0.0.0","files":[]}' | node "$VALIDATE" - >/dev/null 2>&1
+rc_bad=$?
+set -e
+if [ "$rc_ok" -eq 0 ]; then
+  record_pass "validator accepts valid output"
+else
+  record_fail "validator rejected valid output (rc=$rc_ok)"
+fi
+if [ "$rc_bad" -ne 0 ]; then
+  record_pass "validator rejects malformed input"
+else
+  record_fail "validator should reject malformed (got rc=$rc_bad)"
+fi
+
+# --- 5: Android ranking ---
+out_and=$(node "$SCORE" --diff "$FIX_AND" 2>/dev/null)
+top1=$(jq -r '.files[0].path' <<< "$out_and")
+top2=$(jq -r '.files[1].path' <<< "$out_and")
+top3=$(jq -r '.files[2].path' <<< "$out_and")
+if [[ "$top1" == *"Migration_3_to_4.kt"* ]]; then
+  record_pass "Android top-1 = migration file"
+else
+  record_fail "Android top-1 should be migration, got: $top1"
+fi
+if [[ "$top2" == *"AuthRepository.kt"* ]]; then
+  record_pass "Android top-2 = AuthRepository (security_path)"
+else
+  record_fail "Android top-2 should be AuthRepository, got: $top2"
+fi
+if [[ "$top3" == *"HomeScreen.kt"* ]]; then
+  record_pass "Android top-3 = HomeScreen (ui_critical)"
+else
+  record_fail "Android top-3 should be HomeScreen, got: $top3"
+fi
+
+# --- 6: --top N truncates ---
+out_top2=$(node "$SCORE" --diff "$FIX_IOS" --top 2 2>/dev/null)
+n=$(jq '.files | length' <<< "$out_top2")
+if [ "$n" = "2" ]; then
+  record_pass "--top 2 truncates files array"
+else
+  record_fail "--top 2 should keep 2 rows, got $n"
+fi
+
+# --- 7: Empty diff exits 2 ---
+empty=$(mktemp)
+set +e
+node "$SCORE" --diff "$empty" >/dev/null 2>&1
+rc=$?
+set -e
+rm -f "$empty"
+if [ "$rc" -eq 2 ]; then
+  record_pass "empty diff exits 2"
+else
+  record_fail "empty diff should exit 2, got $rc"
+fi
+
+# --- 8: phase-4-review.md declares the advisory step ---
+if grep -qE '^####? .*Diff Risk' "$PHASE4"; then
+  record_pass "phase-4-review.md declares Diff Risk step"
+else
+  record_fail "phase-4-review.md missing Diff Risk step heading"
+fi
+if grep -q 'diff-risk-score.mjs' "$PHASE4"; then
+  record_pass "phase-4-review.md references diff-risk-score.mjs"
+else
+  record_fail "phase-4-review.md missing script reference"
+fi
+
+# --- 9: code-reviewer.md template carries priority placeholder ---
+if grep -q 'Priority Files' "$REVIEWER"; then
+  record_pass "code-reviewer.md declares Priority Files section"
+else
+  record_fail "code-reviewer.md missing Priority Files section"
+fi
+
+# --- 10: prefs schema exposes diffRisk advisory toggle ---
+if jq -e '.properties.global.properties.diffRiskAdvisory' "$PREFS" >/dev/null 2>&1; then
+  record_pass "prefs schema exposes diffRiskAdvisory toggle"
+else
+  record_fail "prefs.schema.json missing global.diffRiskAdvisory"
+fi
+
+# --- Summary ---
+total=$((pass + fail))
+printf '\n→ smoke-diff-risk: %d/%d passed\n' "$pass" "$total"
+if [ "$fail" -ne 0 ]; then
+  printf '\nFailures:\n'
+  for f in "${failures[@]}"; do printf '  - %s\n' "$f"; done
+  exit 1
+fi
+exit 0