@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/smoke-multi-repo-integration.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# smoke-multi-repo-integration.sh — verify v5.6.0 multi-repo integration-build
+# contract: prefs schema accepts valid entries, rejects malformed ones, and the
+# contract doc ships with the required sections (lookup logic, learn-once
+# prompt, autopilot refuse-to-prompt, autopilot refuse-to-prompt behavior).
+#
+# This smoke validates STRUCTURE + CONTRACT. Integration-build execution logic
+# itself is LLM-orchestrated (the pipeline is the caller), so behavior tests
+# live in the integration-test tier, not smoke.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+SCHEMA="$ROOT/pipeline/schemas/prefs.schema.json"
+DOC="$ROOT/pipeline/commands/multi-agent/refs/multi-repo-integration-build.md"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+command -v jq >/dev/null || { echo "FAIL: jq required" >&2; exit 1; }
+
+echo "→ 1. prefs.schema.json defines multiRepoIntegrationHosts"
+jq -e '.properties.global.properties.multiRepoIntegrationHosts' "$SCHEMA" >/dev/null 2>&1 \
+  && pass "schema has global.multiRepoIntegrationHosts" \
+  || fail "schema missing multiRepoIntegrationHosts"
+
+echo ""
+echo "→ 2. schema item has required fields (repoSet) and proper constraints"
+SCHEMA_ITEM=$(jq '.properties.global.properties.multiRepoIntegrationHosts.items' "$SCHEMA")
+echo "$SCHEMA_ITEM" | jq -e '.required | index("repoSet")' >/dev/null 2>&1 \
+  && pass "item requires repoSet" || fail "item should require repoSet"
+echo "$SCHEMA_ITEM" | jq -e '.properties.repoSet.minItems == 2' >/dev/null 2>&1 \
+  && pass "repoSet minItems=2" || fail "repoSet should enforce minItems=2"
+echo "$SCHEMA_ITEM" | jq -e '.properties.platform.enum | index("ios") and index("android") and index("mixed")' >/dev/null 2>&1 \
+  && pass "platform enum covers ios/android/mixed" || fail "platform enum incomplete"
+echo "$SCHEMA_ITEM" | jq -e '.properties.noHost.type == "boolean"' >/dev/null 2>&1 \
+  && pass "noHost flag supports skip-combo" || fail "noHost flag missing"
+echo "$SCHEMA_ITEM" | jq -e '.properties.lastResult.enum | index("success") and index("failed") and index("skipped")' >/dev/null 2>&1 \
+  && pass "lastResult enum covers all terminal states" || fail "lastResult enum incomplete"
+
+echo ""
+echo "→ 3. contract doc exists and ships with required sections"
+[ -f "$DOC" ] && pass "multi-repo-integration-build.md exists" || { fail "doc missing"; echo "══ smoke: $PASS passed, $FAIL failed ══"; exit 1; }
+grep -q "## Why this exists" "$DOC" && pass "doc has 'Why this exists'" || fail "missing 'Why this exists'"
+grep -q "## When this rule fires" "$DOC" && pass "doc has 'When this rule fires'" || fail "missing trigger section"
+grep -q "Learn-once prompt" "$DOC" && pass "doc has learn-once prompt spec" || fail "missing learn-once prompt"
+grep -q "Autopilot behavior" "$DOC" && pass "doc has autopilot behavior" || fail "missing autopilot behavior"
+grep -q "noHost" "$DOC" && pass "doc documents noHost entries" || fail "missing noHost handling"
+grep -qE "phase-tracker\.sh sub 6 0" "$DOC" && pass "doc wires tracker sub-step" || fail "missing tracker wiring"
+
+echo ""
+echo "→ 4. phase-6-commit.md references the new Step 0"
+PHASE6="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-6-commit.md"
+grep -q "Step 0 — Multi-Repo Integration Build" "$PHASE6" \
+  && pass "phase-6-commit has Step 0 entry" || fail "phase-6-commit missing Step 0"
+grep -q "multi-repo-integration-build.md" "$PHASE6" \
+  && pass "phase-6-commit links the contract doc" || fail "phase-6-commit missing contract link"
+
+echo ""
+echo "→ 5. generateCopilotInstructions includes the generic rule"
+# v8.0.0: install.js is a thin shim; the instruction body lives in
+# install/templates/copilot-instructions.md (Markdown source) and is read by
+# install/_copilot-instructions.mjs. The grep target is the source-of-truth
+# Markdown file.
+INSTALL_TPL="$ROOT/install/templates/copilot-instructions.md"
+[ -f "$INSTALL_TPL" ] || fail "install/templates/copilot-instructions.md missing — v8.0.0 generator template missing"
+grep -q "Post-Development Integration Build (Multi-Repo)" "$INSTALL_TPL" \
+  && pass "generator template includes generic rule heading" || fail "generator template missing generic rule"
+grep -q "multiRepoIntegrationHosts" "$INSTALL_TPL" \
+  && pass "generator template references registry" || fail "generator template missing registry reference"
+
+echo ""
+echo "→ 6. repoSet sorted-equality matching logic (spec check)"
+# Synthesize two entries, confirm match logic shape described by the doc.
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+cat > "$TMP/prefs.json" <<'EOF'
+{
+  "schemaVersion": "2.1.0",
+  "global": {
+    "multiRepoIntegrationHosts": [
+      { "repoSet": ["common-lib", "ui-components"], "hostPath": "/host/proj", "platform": "ios", "hostScheme": "UI", "count": 2, "lastResult": "success" },
+      { "repoSet": ["foo", "bar"], "noHost": true }
+    ]
+  },
+  "projects": {}
+}
+EOF
+
+# Lookup: sort incoming repoSet and compare to each entry's sorted repoSet.
+MATCH=$(jq -r --arg combo "common-lib,ui-components" \
+  '.global.multiRepoIntegrationHosts[]
+   | select((.repoSet | sort | join(",")) == $combo)
+   | .hostPath // "NOHOST"' "$TMP/prefs.json")
+[ "$MATCH" = "/host/proj" ] && pass "sorted-equality lookup returns hostPath" || fail "lookup returned: $MATCH"
+
+# Reversed input order still matches
+MATCH=$(jq -r --arg combo "common-lib,ui-components" \
+  '.global.multiRepoIntegrationHosts[]
+   | select((.repoSet | sort | join(",")) == $combo)
+   | .hostPath // "NOHOST"' "$TMP/prefs.json")
+[ "$MATCH" = "/host/proj" ] && pass "reversed-order input matches same host" || fail "reversed-order did not match"
+
+# noHost combo returns skip-intent
+NOHOST=$(jq -r --arg combo "bar,foo" \
+  '.global.multiRepoIntegrationHosts[]
+   | select((.repoSet | sort | join(",")) == $combo)
+   | .noHost // false' "$TMP/prefs.json")
+[ "$NOHOST" = "true" ] && pass "noHost entry returned for marked combo" || fail "noHost lookup failed: $NOHOST"
+
+echo ""
+echo "══ multi-repo-integration smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ] || exit 1

package/pipeline/scripts/smoke-multi-repo-worktree.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# smoke-multi-repo-worktree.sh — asserts Phase 3 multi-repo dev contract is
+# documented correctly. Doc-shape smoke (no actual git ops).
+
+set -uo pipefail
+
+PHASE3="$HOME/.claude/commands/multi-agent/refs/phases/phase-3-dev.md"
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+if [ ! -f "$PHASE3" ]; then
+  fail "phase-3-dev.md missing"; echo "══ aborted ══"; exit 2
+fi
+
+echo "→ 1. v2.1.0+ Multi-Repo Mode subsection present"
+grep -q "v2.1.0+ Multi-Repo Mode" "$PHASE3" \
+  && pass "Phase 3 has v2.1.0+ Multi-Repo Mode subsection" \
+  || fail "Phase 3 missing v2.1.0+ Multi-Repo Mode subsection"
+
+echo "→ 2. Todo tagging contract"
+grep -q "\"repo\":" "$PHASE3" \
+  && pass "Todo schema includes \"repo\" tag" \
+  || fail "Todo schema missing \"repo\" tag"
+grep -q "Per-todo worktree switch" "$PHASE3" \
+  && pass "Per-todo worktree switch documented" \
+  || fail "Per-todo worktree switch missing"
+grep -q 'cd "\$WT_PATH"' "$PHASE3" \
+  && pass "Documents cd \$WT_PATH for build/test" \
+  || fail "cd \$WT_PATH missing from doc"
+
+echo "→ 3. Single-ticket status update"
+grep -q "exactly \*\*once per todo\*\*" "$PHASE3" \
+  && pass "Status update fires once per todo (not per repo per todo)" \
+  || fail "Single-ticket status-update rule missing"
+
+echo "→ 4. Build serialization"
+grep -q "BUILD_LOCK" "$PHASE3" \
+  && pass "Multi-repo respects BUILD_LOCK" \
+  || fail "BUILD_LOCK reference missing"
+grep -q "dependsOn\|dependency order" "$PHASE3" \
+  && pass "Cross-repo dependency order respected" \
+  || fail "Cross-repo dependency order not documented"
+
+echo "→ 5. Failure isolation"
+grep -q "buildStatus" "$PHASE3" \
+  && pass "Per-repo buildStatus persisted" \
+  || fail "Per-repo buildStatus missing"
+grep -q "do NOT proceed to Phase 4" "$PHASE3" \
+  && pass "Pipeline blocks Phase 4 if any repo unbuilt" \
+  || fail "Phase 4 block rule missing"
+
+echo "→ 6. Telemetry per-repo"
+grep -q 'log-metric.sh.*build.completed.*repo=' "$PHASE3" \
+  && pass "Per-repo build.completed telemetry documented" \
+  || fail "Per-repo telemetry missing"
+
+echo ""
+echo "══ multi-repo-worktree smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-no-token-prompt.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+#
+# smoke-no-token-prompt.sh
+#
+# Asserts the pipeline never asks the user to type a token in chat. Tokens
+# are resolved via credential-store.sh; missing/expired tokens trigger the
+# Setup Wizard, not an inline prompt. See refs/keychain.md Rule 1.
+#
+# Greps shell scripts, markdown adapters, and orchestrator commands for
+# hardcoded prompt patterns. Allowlist for legitimate setup wizard prompts.
+
+set -euo pipefail
+
+SELF_DIR=$(cd "$(dirname "$0")" && pwd)
+PIPELINE_ROOT=$(cd "$SELF_DIR/.." && pwd)
+
+cd "$PIPELINE_ROOT"
+
+FAIL=0
+
+# Pattern: anything that looks like the script asking for a token interactively.
+# Acceptable: setup wizard explicitly tagged with `# allow: token-prompt`.
+PATTERNS=(
+  "read -rp.*[Tt]oken"
+  "read -rp.*[Aa]pi.[Kk]ey"
+  "read -rp.*[Pp]aste.*token"
+  "read -rp.*[Ee]nter.*token"
+  'echo "Enter your.*[Tt]oken'
+  'echo "Paste.*[Tt]oken'
+  "AskUserQuestion.*[Tt]oken"
+)
+
+# Files in scope: shell scripts + adapter markdown.
+TARGET_GLOB=(
+  "scripts/*.sh"
+  "scripts/*.mjs"
+  "commands/multi-agent/refs/channels/*.md"
+  "commands/multi-agent/refs/phases/*.md"
+  "commands/multi-agent/dev.md"
+  "commands/multi-agent/dev-autopilot.md"
+  "commands/multi-agent/autopilot.md"
+)
+
+for pattern in "${PATTERNS[@]}"; do
+  for glob in "${TARGET_GLOB[@]}"; do
+    while IFS= read -r match; do
+      [ -z "$match" ] && continue
+      file="${match%%:*}"
+      # Allowlist: setup.md and setup-related files explicitly handle token entry
+      # via the inline Token Save Flow (clipboard-based, not chat).
+      case "$file" in
+        */setup.md|*setup-token-flow*|*credential-store*) continue ;;
+      esac
+      # Allowlist: explicit `# allow: token-prompt` annotation on the line.
+      if echo "$match" | grep -q '# allow: token-prompt'; then continue; fi
+      echo "FAIL [smoke-no-token-prompt]: token prompt found in $file"
+      echo "  $match"
+      FAIL=$((FAIL + 1))
+    done < <(grep -rEn "$pattern" "pipeline/$glob" 2>/dev/null || true)
+  done
+done
+
+if [ "$FAIL" -gt 0 ]; then
+  echo ""
+  echo "smoke-no-token-prompt: $FAIL violation(s). Tokens must be resolved via credential-store.sh; see refs/keychain.md Rule 1."
+  exit 1
+fi
+
+echo "smoke-no-token-prompt: ok"

package/pipeline/scripts/smoke-pat-audit.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# smoke-pat-audit.sh — exercises audit-log.sh + audit-log-rotate.sh and
+# asserts the §18.2 contract:
+#
+#   • Every PAT lookup writes a structured event to audit.jsonl
+#   • Repo URLs are SHA-256 hashed (no plaintext)
+#   • Identity is logged by name (NOT anonymized — user's own debug)
+#   • Audit log is gitignored
+#   • Daily rotation script preserves history (gzipped) + drops >30d archives
+
+set -uo pipefail
+
+AUDIT_FILE="$HOME/.claude/logs/multi-agent/audit.jsonl"
+TMP_AUDIT="$(mktemp -d -t ma-audit-smoke-XXXX)"
+TMP_FILE="$TMP_AUDIT/audit.jsonl"
+trap 'rm -rf "$TMP_AUDIT"' EXIT
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+LOG="$HOME/.claude/scripts/audit-log.sh"
+ROTATE="$HOME/.claude/scripts/audit-log-rotate.sh"
+
+if [ ! -x "$LOG" ]; then
+  fail "audit-log.sh missing or not executable: $LOG"
+  echo "══ aborted ══"; exit 2
+fi
+
+echo "→ 1. Emit a sample PAT lookup"
+TEST_IDENTITY="smoke-user"
+AUDIT_FILE="$TMP_FILE" "$LOG" pat_lookup bitbucket "$TEST_IDENTITY" \
+  "https://bitbucket.example.com/proj/repo" true scope=REPO_WRITE
+[ -s "$TMP_FILE" ] && pass "audit.jsonl has content after emit" \
+  || fail "audit.jsonl empty after emit"
+
+LINE=$(tail -1 "$TMP_FILE")
+echo "  emitted: $LINE"
+
+echo ""
+echo "→ 2. Repo URL is SHA-256 hashed (not plaintext)"
+echo "$LINE" | grep -q '"repo_url_sha":"[a-f0-9]\{64\}"' \
+  && pass "repo_url_sha is a 64-char hex SHA-256" \
+  || fail "repo_url_sha not in expected SHA-256 form"
+echo "$LINE" | grep -q "bitbucket.example.com" \
+  && fail "PLAINTEXT URL leaked into audit log!" \
+  || pass "Plaintext URL absent (only hash present)"
+
+echo ""
+echo "→ 3. Identity is logged by name (per §18.2.3 — not anonymized)"
+echo "$LINE" | grep -q "\"identity\":\"$TEST_IDENTITY\"" \
+  && pass "identity logged as plaintext name" \
+  || fail "identity not logged or anonymized"
+
+echo ""
+echo "→ 4. Service is captured"
+echo "$LINE" | grep -q '"service":"bitbucket"' \
+  && pass "service field captured" \
+  || fail "service field missing"
+
+echo ""
+echo "→ 5. Success flag is a JSON bool (not string)"
+echo "$LINE" | grep -q '"success":true' \
+  && pass "success is JSON bool" \
+  || fail "success is not bool"
+
+echo ""
+echo "→ 6. Extras (key=value pairs) preserved"
+echo "$LINE" | grep -q '"scope":"REPO_WRITE"' \
+  && pass "extras preserved (scope=REPO_WRITE)" \
+  || fail "extras not preserved"
+
+echo ""
+echo "→ 7. Rotation script exists + executable"
+[ -x "$ROTATE" ] \
+  && pass "audit-log-rotate.sh present + executable" \
+  || fail "audit-log-rotate.sh missing or not executable"
+
+echo ""
+echo "→ 8. Rotation produces a dated archive + truncates live file"
+# Drive a dry rotation in our TMP dir
+AUDIT_DIR="$TMP_AUDIT" bash "$ROTATE" >/dev/null 2>&1
+ROTATED=$(find "$TMP_AUDIT" -name 'audit.*.jsonl*' -type f 2>/dev/null | head -1)
+[ -n "$ROTATED" ] \
+  && pass "rotation produced archive: $(basename "$ROTATED")" \
+  || fail "rotation produced no archive"
+[ -f "$TMP_FILE" ] && [ ! -s "$TMP_FILE" ] \
+  && pass "live audit.jsonl truncated to empty after rotation" \
+  || fail "live audit.jsonl not properly truncated"
+
+echo ""
+echo "→ 9. .gitignore covers audit logs (sensitive — never sync upstream)"
+GITIGNORES=(
+  "$HOME/.claude/.gitignore"
+  "$HOME/multi-agent-pipeline/.gitignore"
+)
+GITIGNORE_OK=false
+for gi in "${GITIGNORES[@]}"; do
+  [ -f "$gi" ] && grep -qE 'audit\.jsonl|logs/multi-agent' "$gi" 2>/dev/null && GITIGNORE_OK=true
+done
+$GITIGNORE_OK \
+  && pass ".gitignore covers audit.jsonl / logs/multi-agent" \
+  || fail ".gitignore does NOT cover audit logs (sensitive!)"
+
+echo ""
+echo "══ pat-audit smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-per-repo-memory.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# smoke-per-repo-memory.sh — v6.2.E
+#
+# Verifies the per-repo memory layer contract:
+#   1. memory-load.sh exits silently when pref is off
+#   2. memory-load.sh prints the wrapped block when pref is on + MEMORY.md exists
+#   3. memory-save.sh writes the file + .gitignore + index entry
+#   4. memory-save.sh overwrites existing slug idempotently (no duplicate index row)
+#   5. memory-save.sh rejects invalid type + invalid slug
+#   6. prefs schema exposes perRepoMemory toggle
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+LOAD="$ROOT/pipeline/scripts/memory-load.sh"
+SAVE="$ROOT/pipeline/scripts/memory-save.sh"
+SCHEMA="$ROOT/pipeline/schemas/prefs.schema.json"
+
+pass=0
+fail=0
+failures=()
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-per-repo-memory (v6.2.E): opt-in memory layer contract\n'
+
+# Fresh sandbox + fake prefs
+sandbox=$(mktemp -d)
+mkdir -p "$sandbox/.claude"
+HOME_SAVE="$HOME"
+export HOME="$sandbox"
+repo="$sandbox/repo"
+mkdir -p "$repo"
+
+# --- 1: pref off → silent exit 0 ---
+printf '{"global":{"perRepoMemory":false}}' > "$HOME/.claude/preferences.json"
+out=$(bash "$LOAD" "$repo" 2>&1 || true)
+if [ -z "$out" ]; then
+  record_pass "load exits silent when pref off"
+else
+  record_fail "load should be silent when pref off (got: $out)"
+fi
+
+# --- 2: pref on + no memory → silent exit 0 ---
+printf '{"global":{"perRepoMemory":true}}' > "$HOME/.claude/preferences.json"
+out=$(bash "$LOAD" "$repo" 2>&1 || true)
+if [ -z "$out" ]; then
+  record_pass "load exits silent when pref on but no memory present"
+else
+  record_fail "load should be silent with pref on + no memory (got: $out)"
+fi
+
+# --- 3: save writes file + index + gitignore ---
+body=$(mktemp)
+cat > "$body" <<'BODY'
+---
+name: audit-exhaustiveness
+description: Audits must grep all surfaces before stating counts
+type: feedback
+---
+
+Lead rule.
+BODY
+
+bash "$SAVE" "$repo" feedback audit-exhaustiveness "$body" >/dev/null
+
+if [ -f "$repo/.multi-agent/memory/feedback_audit-exhaustiveness.md" ]; then
+  record_pass "save wrote memory file"
+else
+  record_fail "save did not create memory file"
+fi
+
+if [ -f "$repo/.multi-agent/.gitignore" ]; then
+  record_pass "save created .gitignore"
+else
+  record_fail "save did not create .gitignore"
+fi
+
+if grep -q 'feedback_audit-exhaustiveness.md' "$repo/.multi-agent/memory/MEMORY.md"; then
+  record_pass "save added index entry to MEMORY.md"
+else
+  record_fail "save did not add index entry"
+fi
+
+# --- 2 (second leg): pref on + memory present → emits block ---
+out=$(bash "$LOAD" "$repo" 2>&1)
+if grep -q '<repo-memory' <<< "$out" && grep -q 'audit-exhaustiveness' <<< "$out"; then
+  record_pass "load emits wrapped block + pointer"
+else
+  record_fail "load should emit wrapped block with pref on + memory present"
+fi
+
+# --- 4: idempotent save (no duplicate index row) ---
+cat > "$body" <<'BODY'
+---
+name: audit-exhaustiveness
+description: Updated rule text (v2)
+type: feedback
+---
+
+Updated body.
+BODY
+bash "$SAVE" "$repo" feedback audit-exhaustiveness "$body" >/dev/null
+
+idx_count=$(grep -c 'feedback_audit-exhaustiveness.md' "$repo/.multi-agent/memory/MEMORY.md" || true)
+if [ "$idx_count" = "1" ]; then
+  record_pass "idempotent save keeps index at 1 entry"
+else
+  record_fail "idempotent save produced $idx_count entries (expected 1)"
+fi
+
+if grep -q 'Updated body' "$repo/.multi-agent/memory/feedback_audit-exhaustiveness.md"; then
+  record_pass "idempotent save overwrote body"
+else
+  record_fail "idempotent save did not update body"
+fi
+
+# --- 5: invalid type / slug rejected ---
+set +e
+bash "$SAVE" "$repo" invalid-type bad-slug "$body" >/dev/null 2>&1
+rc_type=$?
+bash "$SAVE" "$repo" feedback "Bad Slug With Spaces" "$body" >/dev/null 2>&1
+rc_slug=$?
+set -e
+if [ "$rc_type" != "0" ]; then
+  record_pass "save rejects invalid type"
+else
+  record_fail "save should reject invalid type"
+fi
+if [ "$rc_slug" != "0" ]; then
+  record_pass "save rejects invalid slug"
+else
+  record_fail "save should reject invalid slug"
+fi
+
+# --- 6: schema exposes pref ---
+if jq -e '.properties.global.properties.perRepoMemory.default == false' "$SCHEMA" >/dev/null 2>&1; then
+  record_pass "prefs schema exposes perRepoMemory with default false"
+else
+  record_fail "prefs schema missing perRepoMemory or wrong default"
+fi
+
+# cleanup
+rm -f "$body"
+rm -rf "$sandbox"
+export HOME="$HOME_SAVE"
+
+printf '\n══ per-repo-memory smoke: %d passed, %d failed ══\n' "$pass" "$fail"
+if [ "$fail" -gt 0 ]; then
+  printf '\nFailures:\n'
+  for msg in "${failures[@]}"; do printf '  - %s\n' "$msg"; done
+  exit 1
+fi
+exit 0

package/pipeline/scripts/smoke-personal-data.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# smoke-personal-data.sh — guard against personal/project-specific data leaking
+# into the published pipeline. Scans pipeline/ for forbidden patterns that
+# historically slipped in from the author's private projects.
+#
+# Run by CI and `npm test`. Fails with non-zero exit if any forbidden pattern
+# is found in the pipeline/ directory (excluding this script itself).
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PIPELINE_DIR="$REPO_ROOT/pipeline"
+
+if [ ! -d "$PIPELINE_DIR" ]; then
+  echo "FAIL: pipeline/ not found at $PIPELINE_DIR" >&2
+  exit 1
+fi
+
+# Forbidden patterns — strings that must never appear in the generic pipeline
+# because they identify a specific user, org, or private project.
+#
+# Use ERE syntax (grep -E). Word-boundary `\b` is required for short keys
+# like "DIJITAL" so we don't false-positive on words like "DIGITAL".
+FORBIDDEN=(
+  # Private Jira project keys from author's day job
+  '\bDIJITAL\b'
+  # Private project directory names
+  '\bsmart-mobile(-ios)?\b'
+  '\bturkish-airlines(-ios)?-(figma|uicomponents|wiki|implementation-artifacts|mobile-common)\b'
+  '\bTurkish Airlines\b'
+  # Private GitHub org
+  'DIJITAL-KANAL-COZUMLERI-DR-IOS'
+  # Employer hostnames that leak through as defaults or examples
+  '\bjira\.thy\.com\b'
+  '\bconfluence\.thy\.com\b'
+  '\bbitbucket\.thy\.com\b'
+  '[a-zA-Z0-9._%+-]+@thy\.com'
+  # Author's personal websites / repos that wouldn't exist for downstream users
+  'mmerterden\.dev'
+  'mmerterden/remote-control'
+  'mmerterden/mmerterden\.dev'
+  # Author's macOS username in keychain lookups
+  'M_ERDEN3_'
+)
+
+PASS=0
+FAIL=0
+
+echo "→ Scanning $PIPELINE_DIR for personal-data leaks..."
+
+for pattern in "${FORBIDDEN[@]}"; do
+  # Exclude this script itself and the figma placeholder map (both legitimately
+  # enumerate the forbidden patterns as the rule catalog, not as leaks).
+  matches=$(grep -rEni \
+    --exclude="smoke-personal-data.sh" \
+    --exclude="smoke-install-leak-gate.sh" \
+    --exclude="figma-placeholder-map.json" \
+    --exclude=".last-figma-sync-plan.json" \
+    --exclude="REVIEW_CHECKLIST.md" \
+    "$pattern" "$PIPELINE_DIR" 2>/dev/null || true)
+  if [ -n "$matches" ]; then
+    echo "  ✗ Forbidden pattern found: $pattern"
+    echo "$matches" | sed 's/^/      /' | head -5
+    FAIL=$((FAIL+1))
+  else
+    PASS=$((PASS+1))
+  fi
+done
+
+echo ""
+echo "→ Result: $PASS patterns clean, $FAIL patterns leaking"
+
+if [ "$FAIL" -gt 0 ]; then
+  echo ""
+  echo "FAIL: personal-data patterns leaked into pipeline/" >&2
+  echo "Genericize to placeholders (e.g. {JIRA_KEY}, my-ios-app, {owner}) before committing." >&2
+  exit 1
+fi
+
+echo "PASS: no personal-data leaks in pipeline/"
+exit 0