@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/smoke-figma-credential-store.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# smoke-figma-credential-store.sh — drift gate for figma skill Keychain access.
+#
+# In v8.3.x the figma skill family was migrated off raw `security` calls and
+# routed through the cross-platform credential helper:
+#   ~/.claude/lib/credential-store.sh  (Claude Code installs)
+#   ~/.copilot/lib/credential-store.sh (Copilot CLI installs)
+# Each bash block uses a `CRED_STORE` resolver that picks whichever helper is
+# present so the same source ships to both CLIs.
+#
+# This smoke locks the migration in place. It re-fails the build if anyone
+# reverts a figma skill back to a direct `security find-generic-password` /
+# `add-generic-password` / `delete-generic-password` call against one of OUR
+# managed token names.
+#
+# Two intentional exceptions:
+#   - Subprocess calls that read the `Claude Code-credentials` keychain entry
+#     (Claude Code's own OAuth-token store, not ours).
+#   - Pedagogical references inside CHANGELOG / MIGRATION docs.
+#
+# Exit 0 = no drift, 1 = at least one figma file regressed.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+
+pass=0
+fail=0
+failures=()
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-figma-credential-store: figma skills route Keychain via the helper, not raw `security`\n'
+
+# 1. The 8 figma surfaces that were migrated must keep using "$CRED_STORE" or
+#    `~/.claude/lib/credential-store.sh` / `~/.copilot/lib/credential-store.sh`.
+MIGRATED_FILES=(
+  "pipeline/skills/figma-common/figma-issue/SKILL.md"
+  "pipeline/skills/figma-common/figma-component-confluence-sync/SKILL.md"
+  "pipeline/skills/figma-common/figma-setup/SKILL.md"
+  "pipeline/skills/figma-common/figma-validate/SKILL.md"
+  "pipeline/skills/figma-ios/figma-to-component/phases/phase-6-code-connect.md"
+  "pipeline/skills/figma-ios/figma-to-component/reference/code-connect.md"
+  "pipeline/skills/figma-ios/figma-to-component/reference/rest-api-script.md"
+  "pipeline/skills/figma-ios/figma-to-component/reference/tools.md"
+  "pipeline/skills/figma-ios/figma-to-component/scripts/phase1-gather.py"
+)
+
+for rel in "${MIGRATED_FILES[@]}"; do
+  abs="$ROOT/$rel"
+  base="$(basename "$rel")"
+  if [ ! -f "$abs" ]; then
+    record_fail "$base missing — figma skill set drifted out of inventory"
+    continue
+  fi
+
+  # Each of these must reference the helper at least once (resolver, get/set/delete call,
+  # or python subprocess wrapper). If the helper reference is gone, the file regressed.
+  if grep -qE 'credential-store\.sh|CRED_STORE|keychain\.py' "$abs"; then
+    record_pass "$base references the credential helper"
+  else
+    record_fail "$base lost its credential-store.sh reference"
+  fi
+
+  # Now look for raw `security {find,add,delete}-generic-password` calls
+  # against OUR managed tokens. Anything matching one of these service names
+  # is a regression. (Claude Code's own `Claude Code-credentials` entry is
+  # NOT in this list — the figma-setup wizard is allowed to read it.)
+  managed_tokens='FIGMA_ACCESS_TOKEN|FIGMA_MCP_TOKEN|FIGMA_API_USER|JIRA_TOKEN|CONFLUENCE_TOKEN'
+  bad=$(grep -nE "security (find|add|delete)-generic-password.*-s [\"']?($managed_tokens)[\"']?" "$abs" 2>/dev/null || true)
+  if [ -z "$bad" ]; then
+    record_pass "$base contains no raw security calls against managed tokens"
+  else
+    record_fail "$base regressed to raw security on a managed token:
+$bad"
+  fi
+done
+
+# 2. The cross-CLI contract doc must point callers at credential-store.sh as
+#    the canonical path. If it ever flips back to raw `security` in the
+#    "canonical" column the principle is broken.
+CONTRACT="$ROOT/pipeline/commands/multi-agent/refs/cross-cli-contract.md"
+if [ -f "$CONTRACT" ] && grep -qE 'canonical path is .*credential-store\.sh' "$CONTRACT"; then
+  record_pass "cross-cli-contract.md declares credential-store.sh as canonical"
+else
+  record_fail "cross-cli-contract.md no longer declares credential-store.sh as canonical"
+fi
+
+# 3. The Copilot install template allowlist must list the helper, not just raw `security`.
+TEMPLATE="$ROOT/install/templates/copilot-instructions.md"
+if [ -f "$TEMPLATE" ] && grep -q 'credential-store\.sh' "$TEMPLATE"; then
+  record_pass "install template allowlist references credential-store.sh"
+else
+  record_fail "install template allowlist no longer references credential-store.sh"
+fi
+
+# Summary
+total=$((pass + fail))
+printf '\n→ smoke-figma-credential-store: %d/%d passed\n' "$pass" "$total"
+if [ "$fail" -ne 0 ]; then
+  printf '\nFailures:\n'
+  for f in "${failures[@]}"; do printf '  - %s\n' "$f"; done
+  exit 1
+fi
+exit 0

package/pipeline/scripts/smoke-figma-cross-cli-inventory.sh

@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# smoke-figma-cross-cli-inventory.sh — enforces the cross-CLI parity
+# inventory for the v5.0.0 figma-to-component skill set.
+#
+# Source-tree assertions (does not require install.js to have deployed
+# the skills). Complements smoke-cross-cli-behavior.sh (installed-tree)
+# and smoke-commands-skills-parity.sh (multi-agent commands).
+#
+# Contract source of truth: refs/cross-cli-contract.md §1.1.
+#
+# Verifies:
+#   1. Every platform-specific figma-android skill exists in figma-ios too.
+#   2. Every required figma-* skill from the contract table exists in figma-ios.
+#   3. Every SKILL.md that claims "platform: android" lives under figma-android/.
+#   4. Every SKILL.md that claims "platform: ios" lives under figma-ios/.
+#   5. No orphaned figma skill directories (not in the contract).
+#   6. Contract doc references both figma-ios and figma-android paths.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+IOS_DIR="$ROOT/pipeline/skills/figma-ios"
+ANDROID_DIR="$ROOT/pipeline/skills/figma-android"
+COMMON_DIR="$ROOT/pipeline/skills/figma-common"
+CONTRACT="$ROOT/pipeline/commands/multi-agent/refs/cross-cli-contract.md"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+for d in "$IOS_DIR" "$ANDROID_DIR" "$COMMON_DIR"; do
+  [ -d "$d" ] || { echo "error: $d missing" >&2; exit 1; }
+done
+[ -f "$CONTRACT" ] || { echo "error: $CONTRACT missing" >&2; exit 1; }
+
+# Platform-specific skills (required on BOTH sides per contract)
+PLATFORM_SPECIFIC=(
+  figma-to-component
+  figma-component-implement
+  figma-component-test
+  figma-component-code-connect
+  figma-component-wiki
+)
+
+# Platform-agnostic (required on at least iOS side today — WS-7b moves to figma-common/)
+COMMON_REQUIRED=(
+  figma-component-start
+  figma-component-confluence-sync
+  figma-component-status-update
+  figma-commit
+  figma-iteration-commit
+  figma-issue
+  figma-iterate
+  figma-cli-iterate
+  figma-cli-lean-iterate
+  figma-cli-iterate-mend
+  figma-cli-skip
+  figma-fix
+  figma-mend
+  figma-review
+  figma-validate
+  figma-setup
+  figma-remote-mcp-auth
+  figma-ui-patterns
+  figma-utility
+  figma-skip
+  figma-form-integration
+  figma-price-integration
+)
+
+echo "→ 1. Platform-specific skills exist on BOTH figma-ios and figma-android"
+for skill in "${PLATFORM_SPECIFIC[@]}"; do
+  ios_ok="false"
+  and_ok="false"
+  [ -f "$IOS_DIR/$skill/SKILL.md" ] && ios_ok="true"
+  [ -f "$ANDROID_DIR/$skill/SKILL.md" ] && and_ok="true"
+  if [ "$ios_ok" = "true" ] && [ "$and_ok" = "true" ]; then
+    pass "$skill present on both platforms"
+  else
+    fail "$skill parity broken (ios=$ios_ok android=$and_ok)"
+  fi
+done
+
+echo ""
+echo "→ 2. Platform-agnostic skills live in figma-common/ (WS-7b ✓)"
+for skill in "${COMMON_REQUIRED[@]}"; do
+  if [ -f "$COMMON_DIR/$skill/SKILL.md" ]; then
+    pass "$skill present in figma-common"
+  else
+    fail "$skill missing in figma-common"
+  fi
+done
+
+echo ""
+echo "→ 2b. Platform-agnostic skills are NOT duplicated under figma-ios"
+DUPES=0
+for skill in "${COMMON_REQUIRED[@]}"; do
+  if [ -d "$IOS_DIR/$skill" ]; then
+    fail "duplication: $skill exists in BOTH figma-ios/ and figma-common/"
+    DUPES=$((DUPES+1))
+  fi
+done
+[ "$DUPES" -eq 0 ] && pass "no common-skill duplication in figma-ios"
+
+echo ""
+echo "→ 3. figma-android SKILL.md files stamp platform: android"
+while IFS= read -r -d '' f; do
+  base=$(dirname "$f" | xargs basename)
+  if head -n 1 "$f" | grep -Fxq -- "---"; then
+    if awk '/^---$/{c++; next} c==1' "$f" | grep -Fq "platform: android"; then
+      pass "$base stamps platform: android"
+    else
+      fail "$base missing 'platform: android' stamp"
+    fi
+  fi
+done < <(find "$ANDROID_DIR" -maxdepth 2 -name SKILL.md -print0)
+
+echo ""
+echo "→ 4. figma-ios SKILL.md files do NOT claim platform: android (only ios or none)"
+while IFS= read -r -d '' f; do
+  if awk '/^---$/{c++; next} c==1' "$f" | grep -Fq "platform: android"; then
+    fail "$(dirname "$f" | xargs basename) claims platform: android but lives under figma-ios/"
+  fi
+done < <(find "$IOS_DIR" -maxdepth 2 -name SKILL.md -print0)
+pass "no cross-platform stamp leakage in figma-ios/"
+
+echo ""
+echo "→ 5. No orphaned figma-android directories (contract-table inventory)"
+EXPECTED_ANDROID=("${PLATFORM_SPECIFIC[@]}")
+ORPHANS=0
+for d in "$ANDROID_DIR"/*/; do
+  [ -d "$d" ] || continue
+  name=$(basename "$d")
+  case " ${EXPECTED_ANDROID[*]} " in
+    *" $name "*) ;;
+    *) fail "unexpected dir: figma-android/$name (not in contract)"; ORPHANS=$((ORPHANS+1)) ;;
+  esac
+done
+[ "$ORPHANS" -eq 0 ] && pass "no orphaned figma-android directories"
+
+echo ""
+echo "→ 6. cross-cli-contract.md references both platforms"
+if grep -Fq "pipeline/skills/figma-ios" "$CONTRACT" && grep -Fq "pipeline/skills/figma-android" "$CONTRACT"; then
+  pass "contract references figma-ios + figma-android paths"
+else
+  fail "contract missing one or both figma platform paths"
+fi
+
+echo ""
+echo "→ 7. Contract § 1.1 present (figma subphase skills section)"
+if grep -Fq "1.1 Figma component subphase skills" "$CONTRACT"; then
+  pass "§ 1.1 heading present"
+else
+  fail "§ 1.1 heading missing"
+fi
+
+echo ""
+echo "→ 8. Contract § 1.2 routing rules present"
+if grep -Fq "1.2 Figma-skill routing from multi-agent" "$CONTRACT"; then
+  pass "§ 1.2 heading present"
+else
+  fail "§ 1.2 heading missing"
+fi
+
+echo ""
+echo "→ 9. Contract § 1.3 frontmatter requirements present"
+if grep -Fq "1.3 Figma skill frontmatter" "$CONTRACT"; then
+  pass "§ 1.3 heading present"
+else
+  fail "§ 1.3 heading missing"
+fi
+
+echo ""
+echo "══ figma-cross-cli-inventory smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-figma-dispatch.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# smoke-figma-dispatch.sh — Phase 3 component dispatch contract.
+#
+# Verifies that multi-agent Phase 3 delegates to the figma-to-component
+# orchestrator (WS-4) instead of embedding figma logic inline.
+#
+# Runs offline — scans docs only, no orchestrator invocation.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+PHASE0="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-0-init.md"
+PHASE3="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-3-dev.md"
+DISPATCH="$ROOT/pipeline/commands/multi-agent/refs/component-dispatch.md"
+ORCH_IOS="$ROOT/pipeline/skills/figma-ios/figma-to-component/SKILL.md"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+[ -f "$PHASE0" ] || { echo "error: $PHASE0 missing" >&2; exit 1; }
+[ -f "$PHASE3" ] || { echo "error: $PHASE3 missing" >&2; exit 1; }
+[ -f "$DISPATCH" ] || { echo "error: $DISPATCH missing (WS-4 extracted contract)" >&2; exit 1; }
+[ -f "$ORCH_IOS" ] || { echo "error: orchestrator skill missing at $ORCH_IOS (run WS-2 import first)" >&2; exit 1; }
+
+# Combined scan — both Phase 3 itself and the extracted contract may carry the
+# canonical strings. Use a function so each check reads both.
+has_in_phase3_or_dispatch() {
+  grep -Fq "$1" "$PHASE3" || grep -Fq "$1" "$DISPATCH"
+}
+
+echo "→ 1. Phase 0 classification routes component → figma-to-component"
+if grep -Fq "pipeline/skills/figma-ios/figma-to-component" "$PHASE0"; then
+  pass "Phase 0 references the new orchestrator path"
+else
+  fail "Phase 0 does NOT reference pipeline/skills/figma-ios/figma-to-component"
+fi
+
+if grep -Fq "figma-to-swiftui" "$PHASE0"; then
+  fail "Phase 0 still references legacy 'figma-to-swiftui' (expected 'figma-to-component')"
+else
+  pass "Phase 0 has no legacy figma-to-swiftui reference"
+fi
+
+echo ""
+echo "→ 2. Phase 3 has a component dispatch section"
+if grep -Fq "Component tasks — delegated dispatch" "$PHASE3"; then
+  pass "Phase 3 has 'Component tasks — delegated dispatch' section"
+else
+  fail "Phase 3 missing component dispatch section"
+fi
+
+if grep -Fq 'taskType === "component"' "$DISPATCH"; then
+  pass "dispatch contract mentions taskType guard"
+else
+  fail "dispatch contract missing taskType guard"
+fi
+
+echo ""
+echo "→ 3. dispatch documents platform routing (iOS + Android orchestrator selection)"
+if grep -Fq "figma-ios/figma-to-component" "$DISPATCH" && grep -Fq "figma-android" "$DISPATCH"; then
+  pass "dispatch documents iOS + Android orchestrator routing"
+else
+  fail "dispatch missing platform-aware orchestrator routing"
+fi
+
+echo ""
+echo "→ 4. dispatch delegates subphase tracking to orchestrator"
+if grep -Fq "subphases[]" "$DISPATCH" || grep -Fq 'subphases\[\]' "$DISPATCH"; then
+  pass "dispatch documents state.phases[3].subphases[] report"
+else
+  fail "dispatch missing subphases[] documentation"
+fi
+
+if grep -Fq "phase-tracker" "$DISPATCH"; then
+  pass "dispatch refers to phase-tracker for subphase rendering"
+else
+  fail "dispatch missing phase-tracker reference"
+fi
+
+echo ""
+echo "→ 5. phase docs carry the progress-contract adoption marker"
+if grep -Fq "<!-- progress-contract: applied -->" "$PHASE3"; then
+  pass "Phase 3 carries the adoption marker"
+else
+  fail "Phase 3 missing the adoption marker"
+fi
+
+if grep -Fq "<!-- progress-contract: applied -->" "$PHASE0"; then
+  pass "Phase 0 carries the adoption marker"
+else
+  fail "Phase 0 missing the adoption marker"
+fi
+
+echo ""
+echo "→ 6. Phase 3 emits dispatch progress lines"
+if grep -qE '→ dispatching figma-to-component' "$PHASE3"; then
+  pass "Phase 3 documents '→ dispatching figma-to-component <name>' emission"
+else
+  fail "Phase 3 missing dispatch progress line"
+fi
+
+echo ""
+echo "→ 7. dispatch has failure + retry semantics for orchestrator"
+if grep -Fq "retryCount" "$DISPATCH" && grep -qE '(resume via|resumes instead of restarting)' "$DISPATCH"; then
+  pass "dispatch documents retryCount + orchestrator resume path"
+else
+  fail "dispatch missing retry / resume documentation"
+fi
+
+echo ""
+echo "→ 8. dispatch covers multi-repo report"
+if grep -Fq "state.projects[]" "$DISPATCH" || grep -Fq 'state\.projects\[\]' "$DISPATCH"; then
+  pass "dispatch documents multi-repo report"
+else
+  fail "dispatch missing multi-repo report paragraph"
+fi
+
+echo ""
+echo "══ figma-dispatch smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-figma-skill-import.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# smoke-figma-skill-import.sh — consistency checks on pipeline/skills/figma-ios/.
+#
+# Runs offline — does NOT require the upstream source or re-run the import.
+# Verifies the imported skill tree is well-formed and transforms hit the file.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+IOS_DIR="$ROOT/pipeline/skills/figma-ios"
+COMMON_DIR="$ROOT/pipeline/skills/figma-common"
+# SKILLS_DIR retained for back-compat but queries below cover both trees.
+SKILLS_DIR="$IOS_DIR"
+MAP="$ROOT/pipeline/scripts/figma-placeholder-map.json"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+need() { command -v "$1" >/dev/null 2>&1 || { echo "error: $1 required" >&2; exit 127; }; }
+need jq
+
+[ -d "$SKILLS_DIR" ] || { echo "error: $SKILLS_DIR not present (run import first)" >&2; exit 1; }
+[ -f "$MAP" ] || { echo "error: placeholder map not found at $MAP" >&2; exit 1; }
+
+echo "→ 1. tree not empty"
+SKILL_COUNT=$(find "$SKILLS_DIR" -maxdepth 1 -mindepth 1 -type d | wc -l | tr -d ' ')
+MD_COUNT=$(find "$SKILLS_DIR" -type f -name '*.md' | wc -l | tr -d ' ')
+[ "$SKILL_COUNT" -gt 0 ] && pass "imported $SKILL_COUNT skills" || fail "no skills found"
+[ "$MD_COUNT" -gt 0 ] && pass "imported $MD_COUNT markdown files" || fail "no markdown files found"
+
+echo ""
+echo "→ 2. every skill has a SKILL.md"
+MISSING=0
+for skill in "$SKILLS_DIR"/*/; do
+  [ -d "$skill" ] || continue
+  if [ ! -f "$skill/SKILL.md" ]; then
+    fail "missing SKILL.md in $(basename "$skill")"
+    MISSING=$((MISSING+1))
+  fi
+done
+[ "$MISSING" -eq 0 ] && pass "every skill has SKILL.md"
+
+echo ""
+echo "→ 3. SKILL.md frontmatter presence inventory"
+WITH_FM=0
+WITHOUT_FM=()
+for f in "$SKILLS_DIR"/*/SKILL.md; do
+  [ -f "$f" ] || continue
+  if head -n 1 "$f" | grep -Fxq -- "---"; then
+    WITH_FM=$((WITH_FM+1))
+  else
+    WITHOUT_FM+=("$(dirname "$f" | xargs basename)")
+  fi
+done
+pass "$WITH_FM skills carry YAML frontmatter"
+if [ "${#WITHOUT_FM[@]}" -gt 0 ]; then
+  echo "     (${#WITHOUT_FM[@]} documentation-only skills lack frontmatter: ${WITHOUT_FM[*]})"
+fi
+
+echo ""
+echo "→ 4. every frontmatter-bearing SKILL.md is stamped with status: wip-v5"
+UNSTAMPED=0
+for f in "$SKILLS_DIR"/*/SKILL.md; do
+  [ -f "$f" ] || continue
+  head -n 1 "$f" | grep -Fxq -- "---" || continue
+  if ! grep -q "^status: wip-v5" "$f"; then
+    fail "missing 'status: wip-v5' in $(dirname "$f" | xargs basename)/SKILL.md"
+    UNSTAMPED=$((UNSTAMPED+1))
+  fi
+done
+[ "$UNSTAMPED" -eq 0 ] && pass "every frontmatter skill stamped as WIP for v5"
+
+echo ""
+echo "→ 5. every frontmatter-bearing SKILL.md carries sourced-from provenance"
+NOPROV=0
+for f in "$SKILLS_DIR"/*/SKILL.md; do
+  [ -f "$f" ] || continue
+  head -n 1 "$f" | grep -Fxq -- "---" || continue
+  if ! grep -q "^sourced-from: upstream/" "$f"; then
+    fail "missing 'sourced-from' in $(dirname "$f" | xargs basename)/SKILL.md"
+    NOPROV=$((NOPROV+1))
+  fi
+done
+[ "$NOPROV" -eq 0 ] && pass "every frontmatter skill has upstream provenance"
+
+echo ""
+echo "→ 6. placeholder substitutions landed"
+# Probe for our canonical placeholders across the tree. At least one of these
+# must be present per-skill on average (evidence that sed ran).
+TOTAL_PLACEHOLDERS=$(grep -rE '\{(github|jira|repos|build|confluence|project|user)\.[a-zA-Z0-9_\.-]+\}' \
+  "$SKILLS_DIR" 2>/dev/null | wc -l | tr -d ' ')
+if [ "$TOTAL_PLACEHOLDERS" -ge "$SKILL_COUNT" ]; then
+  pass "placeholder occurrences: $TOTAL_PLACEHOLDERS (≥ one per skill on average)"
+else
+  fail "placeholder occurrences: $TOTAL_PLACEHOLDERS (expected ≥ $SKILL_COUNT)"
+fi
+
+echo ""
+echo "→ 7. renames respected (old names absent from skill folder list)"
+OLD_NAMES=(
+  "figma-to-swift-ui-code-connect"
+  "figma-to-swift-ui-confluence-sync"
+  "figma-to-swift-ui-implement"
+  "figma-to-swift-ui-start"
+  "figma-to-swift-ui-status-update"
+  "figma-to-swift-ui-test"
+  "figma-to-swift-ui-wiki"
+  "figma-to-swiftui"
+)
+LEAK=0
+for old in "${OLD_NAMES[@]}"; do
+  if [ -d "$SKILLS_DIR/$old" ]; then
+    fail "old name still present as directory: $old"
+    LEAK=$((LEAK+1))
+  fi
+done
+[ "$LEAK" -eq 0 ] && pass "all renamed directories use new names"
+
+echo ""
+echo "→ 8. new canonical names present (across figma-ios + figma-common)"
+NEW_NAMES=(
+  "figma-component-code-connect"
+  "figma-component-confluence-sync"
+  "figma-component-implement"
+  "figma-component-start"
+  "figma-component-status-update"
+  "figma-component-test"
+  "figma-component-wiki"
+  "figma-to-component"
+)
+for new in "${NEW_NAMES[@]}"; do
+  if [ -d "$IOS_DIR/$new" ] || [ -d "$COMMON_DIR/$new" ]; then
+    pass "new name present: $new"
+  else
+    fail "new name missing: $new"
+  fi
+done
+
+echo ""
+echo "→ 9. review checklist exists"
+[ -f "$SKILLS_DIR/REVIEW_CHECKLIST.md" ] && pass "REVIEW_CHECKLIST.md present" || fail "REVIEW_CHECKLIST.md missing"
+
+echo ""
+echo "→ 10. WS-2b — scripts landed (Python/shell files from upstream)"
+SCRIPT_COUNT=$(find "$IOS_DIR" "$COMMON_DIR" -type f \( -name '*.py' -o -name '*.sh' \) 2>/dev/null | wc -l | tr -d ' ')
+if [ "$SCRIPT_COUNT" -ge 30 ]; then
+  pass "imported $SCRIPT_COUNT python/shell scripts"
+else
+  fail "only $SCRIPT_COUNT scripts (expected ≥ 30 from upstream)"
+fi
+
+echo ""
+echo "→ 11. Imported scripts have executable bits on .sh + .py entrypoints"
+NONEXEC=0
+while IFS= read -r -d '' f; do
+  # Shebangs indicate entry points — they should be executable.
+  if head -n 1 "$f" 2>/dev/null | grep -q "^#!"; then
+    if [ ! -x "$f" ]; then
+      NONEXEC=$((NONEXEC+1))
+    fi
+  fi
+done < <(find "$IOS_DIR" "$COMMON_DIR" -type f \( -name '*.py' -o -name '*.sh' \) -print0 2>/dev/null)
+if [ "$NONEXEC" -eq 0 ]; then
+  pass "every shebanged script is executable"
+else
+  fail "$NONEXEC shebanged scripts lack +x"
+fi
+
+echo ""
+echo "══ figma-skill-import smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]