@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/smoke-figma-sync.sh

@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# smoke-figma-sync.sh — WS-9 contract for sync-figma-source.sh.
+#
+# Verifies:
+#   1. sync script exists + executable.
+#   2. prefs.schema.json declares global.figmaSource with correct shape.
+#   3. sync script handles missing figmaSource gracefully (exit 0 w/ message).
+#   4. sync script handles missing path file.
+#   5. dry-run mode writes nothing.
+#   6. CHANGELOG note format is correct (includes `### Sync YYYY-MM-DD`).
+#   7. Watermark update logic (lastCommit + lastSyncedAt) runs atomically.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+SYNC="$ROOT/pipeline/scripts/sync-figma-source.sh"
+SCHEMA="$ROOT/pipeline/schemas/prefs.schema.json"
+TMP="$(mktemp -d -t figma-sync-smoke-XXXX)"
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+need() { command -v "$1" >/dev/null 2>&1 || { echo "error: $1 required" >&2; exit 127; }; }
+need jq
+need git
+
+[ -x "$SYNC" ] && pass "sync script exists and is executable" || fail "sync script not executable at $SYNC"
+
+echo ""
+echo "→ 2. prefs schema declares global.figmaSource with correct shape"
+for field in path branch lastSyncedAt lastCommit; do
+  if jq -e ".properties.global.properties.figmaSource.properties.$field" "$SCHEMA" >/dev/null 2>&1; then
+    pass "figmaSource.$field declared"
+  else
+    fail "figmaSource.$field missing from schema"
+  fi
+done
+
+echo ""
+echo "→ 3. missing figmaSource → exit 0 with skip message"
+cat > "$TMP/prefs-no-source.json" <<'EOF'
+{ "schemaVersion": "2.1.0", "global": {}, "projects": {} }
+EOF
+OUT=$(MULTI_AGENT_PREFS="$TMP/prefs-no-source.json" bash "$SYNC" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] && echo "$OUT" | grep -Fq "figmaSource not configured"; then
+  pass "gracefully handles missing figmaSource"
+else
+  fail "did not skip cleanly (rc=$RC, out: $OUT)"
+fi
+
+echo ""
+echo "→ 4. figmaSource.path missing on disk → exit 1 with error"
+cat > "$TMP/prefs-bad-path.json" <<EOF
+{ "schemaVersion": "2.1.0", "global": { "figmaSource": { "path": "$TMP/does-not-exist", "branch": "develop" } }, "projects": {} }
+EOF
+set +e
+OUT=$(MULTI_AGENT_PREFS="$TMP/prefs-bad-path.json" bash "$SYNC" 2>&1)
+RC=$?
+set -e
+if [ "$RC" -ne 0 ] && echo "$OUT" | grep -Fq "does not exist"; then
+  pass "errors cleanly on missing path"
+else
+  fail "did not error on missing path (rc=$RC)"
+fi
+
+echo ""
+echo "→ 5. dry-run mode does not mutate prefs"
+# Build a tiny fake source with .instructions/figma/sample/SKILL.md
+FAKE_SRC="$TMP/fake-src"
+mkdir -p "$FAKE_SRC/.instructions/figma/sample" "$FAKE_SRC/.claude/skills/sample"
+cat > "$FAKE_SRC/.instructions/figma/sample/SKILL.md" <<'EOF'
+---
+name: sample
+description: smoke fixture
+---
+# sample
+EOF
+cat > "$FAKE_SRC/.claude/skills/sample/SKILL.md" <<'EOF'
+---
+name: sample
+description: smoke stub
+---
+# sample stub
+EOF
+(cd "$FAKE_SRC" && git init -q && git -c user.email=t@t -c user.name=t add . && git -c user.email=t@t -c user.name=t commit -q -m init)
+PREFS_BEFORE="$TMP/prefs-dry.json"
+cat > "$PREFS_BEFORE" <<EOF
+{ "schemaVersion": "2.1.0", "global": { "figmaSource": { "path": "$FAKE_SRC", "branch": "main" } }, "projects": {} }
+EOF
+CHECKSUM_BEFORE=$(jq -c '.' "$PREFS_BEFORE" | shasum | awk '{print $1}')
+MULTI_AGENT_PREFS="$PREFS_BEFORE" bash "$SYNC" --dry-run >/dev/null 2>&1 || true
+CHECKSUM_AFTER=$(jq -c '.' "$PREFS_BEFORE" | shasum | awk '{print $1}')
+[ "$CHECKSUM_BEFORE" = "$CHECKSUM_AFTER" ] && pass "dry-run leaves prefs untouched" || fail "dry-run mutated prefs"
+
+echo ""
+echo "→ 6. CHANGELOG heading pattern used by sync (grep shape)"
+if grep -Fq '### Sync $(date' "$SYNC" || grep -Eq '### Sync \$\(date' "$SYNC"; then
+  pass "sync emits '### Sync YYYY-MM-DD' heading"
+else
+  fail "sync script does not emit the canonical CHANGELOG heading"
+fi
+
+echo ""
+echo "→ 7. Watermark update uses atomic rename"
+if grep -Fq "mv \"\$TMP\" \"\$PREFS_FILE\"" "$SYNC"; then
+  pass "atomic rename on prefs update"
+else
+  fail "no atomic rename in sync script"
+fi
+
+echo ""
+echo "→ 8. --force-full flag is recognised"
+if grep -Fq -- "--force-full" "$SYNC"; then
+  pass "force-full flag supported"
+else
+  fail "force-full flag missing"
+fi
+
+echo ""
+echo "→ 9. --plan flag writes a structured JSON plan artifact"
+if grep -Fq -- "--plan" "$SYNC"; then
+  pass "plan flag recognised"
+else
+  fail "plan flag missing"
+fi
+if grep -Fq ".last-figma-sync-plan.json" "$SYNC"; then
+  pass "plan writes to .last-figma-sync-plan.json"
+else
+  fail "plan output path missing"
+fi
+if grep -Fq "overlaySkip" "$SYNC"; then
+  pass "plan records overlay-skip per skill"
+else
+  fail "plan does not record overlaySkip"
+fi
+if grep -Fq "tree" "$SYNC" && grep -Fq "figma-ios" "$SYNC" && grep -Fq "figma-common" "$SYNC"; then
+  pass "plan records destination tree (figma-ios vs figma-common)"
+else
+  fail "plan missing tree routing info"
+fi
+
+echo ""
+echo "══ figma-sync smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-identity-isolation.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# smoke-identity-isolation.sh — asserts identity isolation rules from §18.3
+# of REFACTOR_PLAN_v3.7.md are documented & wired:
+#
+#   • Identity lookup happens via platformIdentityRouting only — NEVER fall
+#     back to "try all PATs"
+#   • If no routing match, prompt user — do not guess
+#   • servicePatMap is checked per-identity — corp identity cannot accidentally
+#     use personal identity's PAT even if the keychain name is discoverable
+#
+# Doc-shape smoke (no fake keychain entries; pure spec assertion).
+
+set -uo pipefail
+
+# Read from source (authoritative) — installed tree may lag behind on
+# machines that haven't re-run install.js after a pipeline update.
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+PHASE0="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-0-init.md"
+SETUP="$ROOT/pipeline/commands/multi-agent/setup.md"
+PREFS_SCHEMA="$ROOT/pipeline/schemas/prefs.schema.json"
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+echo "→ 1. servicePatMap is per-identity (schema)"
+grep -q "servicePatMap" "$PREFS_SCHEMA" \
+  && pass "Schema declares identities[].servicePatMap" \
+  || fail "Schema missing servicePatMap on identities"
+grep -q "Enables cross-identity isolation\|cross-identity isolation" "$PREFS_SCHEMA" \
+  && pass "Schema description articulates cross-identity isolation invariant" \
+  || fail "Schema description missing isolation invariant"
+
+echo ""
+echo "→ 2. Phase 0 routing — no silent fallback to 'try all PATs'"
+grep -q "platformIdentityRouting" "$PHASE0" \
+  && pass "Phase 0 Step 6 references platformIdentityRouting" \
+  || fail "Phase 0 missing platformIdentityRouting reference"
+# Post-10caff1 wording: the resolution order ends with an explicit "ask once"
+# clause for the multi-identity case — same invariant as the older
+# "multi-identity picker" text.
+grep -q "Multiple identities, no routing rule" "$PHASE0" \
+  && pass "Phase 0 handles 'no routing match, multiple identities' branch" \
+  || fail "Phase 0 missing no-match + multi-identity handling"
+grep -q "No identities" "$PHASE0" \
+  && pass "Phase 0 handles 'no identities ever' branch (Token Save Flow)" \
+  || fail "Phase 0 missing 'no identities' branch"
+grep -qE "save routing rule so it never asks again" "$PHASE0" \
+  && pass "Phase 0 persists routing on first ask (no silent guess)" \
+  || fail "Phase 0 missing routing-persistence guarantee"
+
+echo ""
+echo "→ 3. Setup Step 4 wires per-identity service ownership"
+grep -q "servicePatMap" "$SETUP" \
+  && pass "Setup Step 4 documents servicePatMap" \
+  || fail "Setup Step 4 missing servicePatMap"
+grep -qE "own tokens for|owns.*jira|per-identity" "$SETUP" \
+  && pass "Setup Step 4 describes per-identity ownership" \
+  || fail "Setup Step 4 missing per-identity ownership description"
+
+echo ""
+echo "→ 4. Multi-repo: identity routed per-repo (not shared)"
+grep -qE "per repo( independently)?|routed per-repo" "$PHASE0" \
+  && pass "Multi-repo Step 6 routes identity per-repo" \
+  || fail "Multi-repo per-repo identity routing missing"
+
+echo ""
+echo "══ identity-isolation smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-install-layout.sh

@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+#
+# smoke-install-layout.sh — verify install.js shim + install/* modules produce
+# the same on-disk output as the pre-v8.0.0 monolithic installer.
+#
+# v8.0.0 split install.js (1246 LOC) into ./install/{index,claude,copilot,
+# _common,_platform-filter,_telemetry,_adapters,_dev-only-files,
+# _copilot-instructions}.mjs. The legacy install.js stayed as a thin shim
+# that imports install/index.mjs and calls runInstall(process.argv).
+#
+# This smoke runs the live installer into a temp HOME and asserts:
+#   1. install runs without error for --claude, --copilot, and --all
+#   2. expected directory structure under ~/.claude and ~/.copilot is present
+#   3. core file counts match what the source ships
+#   4. settings.json hook + env are written
+#   5. CLAUDE.md / preferences template are written when missing
+#   6. copilot-instructions.md contains the pipeline marker block
+#
+# Failure here means the modular installer drifted from the legacy contract.
+# Fix by aligning install/*.mjs with the source tree, never by relaxing this
+# gate.
+#
+# Exit codes: 0=pass, 1=structural drift, 2=installer crash
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+INSTALL_JS="$REPO_ROOT/install.js"
+INSTALL_DIR="$REPO_ROOT/install"
+
+[ -f "$INSTALL_JS" ] || { echo "FAIL: install.js missing"; exit 2; }
+[ -d "$INSTALL_DIR" ] || { echo "FAIL: install/ directory missing"; exit 2; }
+
+PASS=0
+FAIL=0
+note() { echo "  → $*"; }
+pass() { echo "    ✓ $*"; PASS=$((PASS + 1)); }
+fail() { echo "    ✗ $*"; FAIL=$((FAIL + 1)); }
+
+assert_file() {
+  local path="$1" label="$2"
+  if [ -f "$path" ]; then pass "$label exists"; else fail "$label missing ($path)"; fi
+}
+
+assert_dir() {
+  local path="$1" label="$2"
+  if [ -d "$path" ]; then pass "$label exists"; else fail "$label missing ($path)"; fi
+}
+
+assert_dir_nonempty() {
+  local path="$1" label="$2"
+  if [ -d "$path" ] && [ "$(find "$path" -mindepth 1 -print -quit 2>/dev/null)" ]; then
+    pass "$label populated"
+  else
+    fail "$label empty or missing ($path)"
+  fi
+}
+
+# -----------------------------------------------------------------------------
+note "1. install/ module layout matches v8.0.0 split"
+# -----------------------------------------------------------------------------
+expected_modules=(
+  "index.mjs"
+  "claude.mjs"
+  "copilot.mjs"
+  "_common.mjs"
+  "_platform-filter.mjs"
+  "_telemetry.mjs"
+  "_adapters.mjs"
+  "_copilot-instructions.mjs"
+  "_dev-only-files.mjs"
+)
+for mod in "${expected_modules[@]}"; do
+  assert_file "$INSTALL_DIR/$mod" "install/$mod"
+done
+
+# -----------------------------------------------------------------------------
+note "2. install.js is a thin shim that imports install/index.mjs"
+# -----------------------------------------------------------------------------
+shim_lines=$(wc -l < "$INSTALL_JS" | tr -d ' ')
+if [ "$shim_lines" -lt 50 ]; then
+  pass "install.js is $shim_lines lines (shim, <50)"
+else
+  fail "install.js is $shim_lines lines — expected shim under 50"
+fi
+if grep -q "from \"./install/index.mjs\"" "$INSTALL_JS"; then
+  pass "install.js delegates to install/index.mjs"
+else
+  fail "install.js does not import install/index.mjs"
+fi
+
+# -----------------------------------------------------------------------------
+note "3. Live install --claude into temp HOME"
+# -----------------------------------------------------------------------------
+TMP_CLAUDE=$(mktemp -d)
+trap 'rm -rf "$TMP_CLAUDE" "$TMP_COPILOT" "$TMP_ALL" 2>/dev/null || true' EXIT
+
+if HOME="$TMP_CLAUDE" node "$INSTALL_JS" --claude > /tmp/smoke-install-layout-claude.log 2>&1; then
+  pass "node install.js --claude exited 0"
+else
+  fail "install --claude crashed — see /tmp/smoke-install-layout-claude.log"
+  exit 2
+fi
+
+assert_dir_nonempty "$TMP_CLAUDE/.claude/commands/multi-agent" "~/.claude/commands/multi-agent"
+assert_dir_nonempty "$TMP_CLAUDE/.claude/scripts" "~/.claude/scripts"
+assert_dir_nonempty "$TMP_CLAUDE/.claude/agents" "~/.claude/agents"
+assert_dir_nonempty "$TMP_CLAUDE/.claude/rules" "~/.claude/rules"
+assert_dir_nonempty "$TMP_CLAUDE/.claude/skills" "~/.claude/skills"
+assert_file "$TMP_CLAUDE/.claude/CLAUDE.md" "~/.claude/CLAUDE.md"
+assert_file "$TMP_CLAUDE/.claude/multi-agent-preferences.json" "~/.claude/multi-agent-preferences.json"
+assert_file "$TMP_CLAUDE/.claude/settings.json" "~/.claude/settings.json"
+
+# settings.json must have the secret-detection hook
+if grep -q "Bash(git commit:\*)" "$TMP_CLAUDE/.claude/settings.json"; then
+  pass "settings.json registers PreToolUse git-commit hook"
+else
+  fail "settings.json missing PreToolUse git-commit hook"
+fi
+if grep -q "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE" "$TMP_CLAUDE/.claude/settings.json"; then
+  pass "settings.json sets CLAUDE_AUTOCOMPACT_PCT_OVERRIDE"
+else
+  fail "settings.json missing CLAUDE_AUTOCOMPACT_PCT_OVERRIDE env"
+fi
+
+# Claude side must have the multi-agent skill dirs pruned (slash commands cover
+# them). Confirm by absence of any `multi-agent` directory under skills/.
+if find "$TMP_CLAUDE/.claude/skills" -maxdepth 1 -type d -name 'multi-agent*' | grep -q .; then
+  fail "~/.claude/skills/ still contains multi-agent-* dirs (should be pruned)"
+else
+  pass "~/.claude/skills/ has multi-agent-* skill dirs pruned"
+fi
+
+# -----------------------------------------------------------------------------
+note "4. Live install --copilot into a fresh temp HOME"
+# -----------------------------------------------------------------------------
+TMP_COPILOT=$(mktemp -d)
+if HOME="$TMP_COPILOT" node "$INSTALL_JS" --copilot > /tmp/smoke-install-layout-copilot.log 2>&1; then
+  pass "node install.js --copilot exited 0"
+else
+  fail "install --copilot crashed — see /tmp/smoke-install-layout-copilot.log"
+  exit 2
+fi
+
+assert_file "$TMP_COPILOT/.copilot/copilot-instructions.md" "~/.copilot/copilot-instructions.md"
+assert_dir_nonempty "$TMP_COPILOT/.copilot/scripts" "~/.copilot/scripts"
+assert_dir_nonempty "$TMP_COPILOT/.copilot/agents" "~/.copilot/agents"
+assert_dir_nonempty "$TMP_COPILOT/.copilot/skills" "~/.copilot/skills"
+
+if grep -q "^# Multi-Agent Development Pipeline" "$TMP_COPILOT/.copilot/copilot-instructions.md"; then
+  pass "copilot-instructions.md has pipeline marker"
+else
+  fail "copilot-instructions.md missing pipeline marker"
+fi
+
+# Copilot side keeps multi-agent-* skill dirs (no slash commands there)
+if find "$TMP_COPILOT/.copilot/skills" -maxdepth 1 -type d -name 'multi-agent*' | grep -q .; then
+  pass "~/.copilot/skills/ retains multi-agent-* dirs (Copilot uses skills as commands)"
+else
+  fail "~/.copilot/skills/ missing multi-agent-* dirs (Copilot needs them)"
+fi
+
+# -----------------------------------------------------------------------------
+note "5. Live install --all writes both targets in one pass"
+# -----------------------------------------------------------------------------
+TMP_ALL=$(mktemp -d)
+if HOME="$TMP_ALL" node "$INSTALL_JS" --all > /tmp/smoke-install-layout-all.log 2>&1; then
+  pass "node install.js --all exited 0"
+else
+  fail "install --all crashed — see /tmp/smoke-install-layout-all.log"
+  exit 2
+fi
+assert_dir_nonempty "$TMP_ALL/.claude" "~/.claude (--all)"
+assert_dir_nonempty "$TMP_ALL/.copilot" "~/.copilot (--all)"
+
+# -----------------------------------------------------------------------------
+note "6. Cross-target file-count parity for shared scripts"
+# -----------------------------------------------------------------------------
+claude_scripts=$(find "$TMP_ALL/.claude/scripts" -type f 2>/dev/null | wc -l | tr -d ' ')
+copilot_scripts=$(find "$TMP_ALL/.copilot/scripts" -type f 2>/dev/null | wc -l | tr -d ' ')
+if [ "$claude_scripts" = "$copilot_scripts" ] && [ "$claude_scripts" -gt 0 ]; then
+  pass "scripts file count parity ($claude_scripts files in both)"
+else
+  fail "scripts file count drift: claude=$claude_scripts copilot=$copilot_scripts"
+fi
+
+claude_agents=$(find "$TMP_ALL/.claude/agents" -type f 2>/dev/null | wc -l | tr -d ' ')
+copilot_agents=$(find "$TMP_ALL/.copilot/agents" -type f 2>/dev/null | wc -l | tr -d ' ')
+if [ "$claude_agents" = "$copilot_agents" ] && [ "$claude_agents" -gt 0 ]; then
+  pass "agents file count parity ($claude_agents files in both)"
+else
+  fail "agents file count drift: claude=$claude_agents copilot=$copilot_agents"
+fi
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "→ 7. v8.0.0 layout fingerprint matches the fixture"
+# -----------------------------------------------------------------------------
+# Compare a path → file-count fingerprint against pipeline/scripts/fixtures/
+# install-layout.tsv. This catches structural drift (a directory renamed,
+# a file moved out of the install tree, the skills tree losing a category)
+# while staying robust to legitimate skill content edits.
+#
+# To regenerate the fixture after an intentional layout change:
+#   tmp=$(mktemp -d) && HOME="$tmp" node install.js --all >/dev/null 2>&1
+#   ( cd "$tmp" && find . -type f | awk -F/ '{ print $2"/"$3 }' \
+#     | sort -u | while read d; do
+#         c=$(find "$d" -type f 2>/dev/null | wc -l | tr -d ' ')
+#         printf '%s\t%s\n' "$d" "$c"
+#       done ) > pipeline/scripts/fixtures/install-layout.tsv
+FIXTURE="$REPO_ROOT/pipeline/scripts/fixtures/install-layout.tsv"
+if [ ! -f "$FIXTURE" ]; then
+  fail "install-layout.tsv fixture missing — see header for regeneration recipe"
+else
+  ACTUAL_FP=$(
+    cd "$TMP_ALL" && find . -type f \
+      | awk -F/ '{ print $2"/"$3 }' \
+      | sort -u \
+      | while read d; do
+          c=$(find "$d" -type f 2>/dev/null | wc -l | tr -d ' ')
+          printf '%s\t%s\n' "$d" "$c"
+        done
+  )
+  # Normalize both sides to a trailing newline before hashing — the fixture
+  # is committed with one, the in-shell capture lacks one. Without this, the
+  # smoke would always fail on the byte-level diff.
+  if [ "$(printf '%s\n' "$ACTUAL_FP" | shasum -a 256 | cut -d' ' -f1)" = \
+       "$(shasum -a 256 < "$FIXTURE" | cut -d' ' -f1)" ]; then
+    pass "install layout fingerprint matches fixture"
+  else
+    fail "install layout drift — fingerprint changed"
+    diff <(printf '%s\n' "$ACTUAL_FP") "$FIXTURE" | head -20 | sed 's/^/      /'
+  fi
+fi
+
+# -----------------------------------------------------------------------------
+echo ""
+echo "══ smoke-install-layout: $PASS passed, $FAIL failed ══"
+
+if [ "$FAIL" -gt 0 ]; then exit 1; fi
+exit 0

package/pipeline/scripts/smoke-install-leak-gate.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# smoke-install-leak-gate.sh — runs the actual install.js into a temp HOME,
+# then sweeps the installed tree for personal-data references that must never
+# reach end-user machines.
+#
+# Why this exists: install.js excludes 7 maintainer-only files from the copied
+# scripts/ directory (figma-placeholder-map.json, sync-figma-source.sh,
+# import-figma-skills.sh, smoke-figma-skill-import.sh, smoke-figma-config-schema.sh,
+# smoke-personal-data.sh, README-figma-smokes.md). If anyone accidentally
+# removes that exclude block — or adds a new dev-only file without listing it —
+# the maintainer's private upstream references would ship to end users. This
+# smoke is the regression lock.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+PASS=0; FAIL=0
+ok()   { echo "  ✓ $1"; PASS=$((PASS+1)); }
+fail() { echo "  ✗ $1" >&2; FAIL=$((FAIL+1)); }
+
+INSTALL_JS="$REPO_ROOT/install.js"
+[ -f "$INSTALL_JS" ] || { fail "install.js missing"; exit 2; }
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+mkdir -p "$TMP/.claude" "$TMP/.copilot"
+
+echo "→ 1. install.js --all completes without error"
+if HOME="$TMP" node "$INSTALL_JS" --all >/dev/null 2>&1; then
+  ok "install completes (exit 0)"
+else
+  fail "install exited non-zero"
+  echo "══ aborted — install crashed ══"; exit 1
+fi
+
+echo "→ 2. Excluded dev-only files MUST NOT appear in installed scripts dir"
+EXCLUDED=(
+  "figma-placeholder-map.json"
+  "sync-figma-source.sh"
+  "import-figma-skills.sh"
+  "smoke-figma-skill-import.sh"
+  "smoke-figma-config-schema.sh"
+  "smoke-personal-data.sh"
+  "README-figma-smokes.md"
+)
+leaked=()
+for f in "${EXCLUDED[@]}"; do
+  if [ -e "$TMP/.claude/scripts/$f" ] || [ -e "$TMP/.copilot/scripts/$f" ]; then
+    leaked+=("$f")
+  fi
+done
+if [ ${#leaked[@]} -eq 0 ]; then
+  ok "all 7 dev-only files excluded from both Claude + Copilot trees"
+else
+  fail "leaked files: ${leaked[*]}"
+fi
+
+echo "→ 3. Installed tree is free of personal/corporate identifiers"
+# Patterns mirror smoke-personal-data.sh but applied to the INSTALLED output —
+# the surface end users see after running install.js.
+PATTERNS=(
+  '\bDIJITAL\b'
+  '\bM_ERDEN3_'
+  '\bjira\.thy\.com\b'
+  '\bbitbucket\.thy\.com\b'
+  '\bconfluence\.thy\.com\b'
+  '@thy\.com'
+  'mustafaerden@'
+  '\bDIJITAL-KANAL-COZUMLERI-DR-IOS\b'
+  '\bturkish-airlines'
+)
+hits=0
+for p in "${PATTERNS[@]}"; do
+  match=$(grep -rIE "$p" "$TMP/.claude/" "$TMP/.copilot/" 2>/dev/null | head -3 || true)
+  if [ -n "$match" ]; then
+    hits=$((hits+1))
+    echo "      ✗ pattern '$p' leaked:"
+    echo "$match" | sed 's/^/        /'
+  fi
+done
+if [ $hits -eq 0 ]; then
+  ok "${#PATTERNS[@]} sensitive patterns clean across the installed tree"
+else
+  fail "$hits / ${#PATTERNS[@]} patterns leaked into installed tree"
+fi
+
+echo "→ 4. Smoke files in install ARE invocable (don't break end-user testing)"
+# At minimum, smoke-schema-validation.sh and smoke-lib-scripts.sh should
+# install — they're the contract end users can run locally to verify their
+# own setup.
+ESSENTIAL=(
+  "smoke-schema-validation.sh"
+  "smoke-lib-scripts.sh"
+  "smoke-pref-migration.sh"
+)
+for s in "${ESSENTIAL[@]}"; do
+  if [ -x "$TMP/.claude/scripts/$s" ]; then
+    ok "$s installed + executable"
+  else
+    fail "$s missing or not executable in installed tree"
+  fi
+done
+
+echo "→ 5. End-user smokes run cleanly off the installed tree"
+# Pick a network-free smoke and run it pointing at the installed pipeline.
+# This catches regressions where install copies but breaks paths.
+HOME="$TMP" cd "$TMP" && bash "$TMP/.claude/scripts/smoke-schema-validation.sh" >/dev/null 2>&1
+if [ $? -eq 0 ]; then
+  ok "smoke-schema-validation passes against installed schemas"
+else
+  fail "smoke-schema-validation failed against installed tree"
+fi
+
+# --- Summary ----------------------------------------------------------------
+echo ""
+TOTAL=$((PASS+FAIL))
+if [ $FAIL -eq 0 ]; then
+  echo "══ install-leak-gate smoke: $PASS passed, 0 failed ══"
+  exit 0
+else
+  echo "══ install-leak-gate smoke: $PASS passed, $FAIL failed (of $TOTAL) ══" >&2
+  exit 1
+fi

package/pipeline/scripts/smoke-issue-comment-template.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+#
+# smoke-issue-comment-template.sh
+#
+# Asserts the canonical issue comment template (refs/channels/issue-comment.md)
+# is wired into Phase 7 and that the template file itself contains the required
+# section anchors.
+#
+# This is a lint, not a behavioural test — it does NOT post a real comment.
+# A behavioural drift check (regex against the most recent 5 issue comments by
+# the configured Git identity) lives in the e2e suite.
+
+set -euo pipefail
+
+SELF_DIR=$(cd "$(dirname "$0")" && pwd)
+PIPELINE_ROOT=$(cd "$SELF_DIR/.." && pwd)
+
+cd "$PIPELINE_ROOT"
+
+FAIL=0
+
+TEMPLATE="commands/multi-agent/refs/channels/issue-comment.md"
+PHASE7="commands/multi-agent/refs/phases/phase-7-report.md"
+
+# 1. Template file exists.
+if [ ! -f "$TEMPLATE" ]; then
+  echo "FAIL [smoke-issue-comment-template]: $TEMPLATE missing"
+  exit 1
+fi
+
+# 2. Template contains all canonical section anchors (English versions; the TR
+#    headers map 1:1 via the template's bilingual contract).
+declare -a REQUIRED_ANCHORS=(
+  "Geliştirme Detayı"
+  "Pull Requests / Branches"
+  "Acceptance Criteria"
+  "Build & Test"
+  "Sonraki adımlar"
+  "Ref: #"
+)
+
+for anchor in "${REQUIRED_ANCHORS[@]}"; do
+  if ! grep -qF "$anchor" "$TEMPLATE"; then
+    echo "FAIL [smoke-issue-comment-template]: template missing required anchor: $anchor"
+    FAIL=$((FAIL + 1))
+  fi
+done
+
+# 3. Phase 7 wires the issue channel — must reference both the template and
+#    the progress sync script in the same step.
+if ! grep -qF "refs/channels/issue-comment.md" "$PHASE7"; then
+  echo "FAIL [smoke-issue-comment-template]: $PHASE7 must reference refs/channels/issue-comment.md"
+  FAIL=$((FAIL + 1))
+fi
+
+if ! grep -qF "update-issue-progress.sh" "$PHASE7"; then
+  echo "FAIL [smoke-issue-comment-template]: $PHASE7 must wire update-issue-progress.sh"
+  FAIL=$((FAIL + 1))
+fi
+
+# 4. The two paired actions (comment + flag sync) must appear in the same step
+#    block — comment FIRST, flags SECOND.
+COMMENT_LINE=$(grep -n "gh issue comment" "$PHASE7" | head -1 | cut -d: -f1 || echo "")
+SYNC_LINE=$(grep -n "update-issue-progress.sh" "$PHASE7" | head -1 | cut -d: -f1 || echo "")
+
+if [ -n "$COMMENT_LINE" ] && [ -n "$SYNC_LINE" ]; then
+  if [ "$COMMENT_LINE" -gt "$SYNC_LINE" ]; then
+    echo "FAIL [smoke-issue-comment-template]: comment must precede progress sync in $PHASE7 (comment line $COMMENT_LINE > sync line $SYNC_LINE)"
+    FAIL=$((FAIL + 1))
+  fi
+fi
+
+# 5. update-issue-progress.sh exists and is executable.
+PROGRESS_SCRIPT="scripts/update-issue-progress.sh"
+if [ ! -x "$PROGRESS_SCRIPT" ]; then
+  echo "FAIL [smoke-issue-comment-template]: $PROGRESS_SCRIPT missing or not executable"
+  FAIL=$((FAIL + 1))
+fi
+
+if [ "$FAIL" -gt 0 ]; then
+  echo ""
+  echo "smoke-issue-comment-template: $FAIL violation(s)."
+  exit 1
+fi
+
+echo "smoke-issue-comment-template: ok"