@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/scripts/smoke-tracker-tokens-invocation.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+#
+# smoke-tracker-tokens-invocation.sh
+#
+# Asserts every LLM-heavy phase doc invokes `phase-tracker.sh tokens <N> <in> <out>`
+# at least once, so the per-phase + cumulative token counter in the tracker's
+# render output stays accurate for every run. Without this gate, phase docs
+# tend to drop the token call as they get edited and the user loses cost
+# visibility — exactly Defect 5 from the GH1241 review.
+#
+# Phase 3 (Dev) and Phase 4 (Review) are the LLM-intensive ones. Phase 1+2
+# also do LLM work. Phase 0/5/6/7 are mostly orchestration.
+
+set -euo pipefail
+
+SELF_DIR=$(cd "$(dirname "$0")" && pwd)
+PIPELINE_ROOT=$(cd "$SELF_DIR/.." && pwd)
+
+cd "$PIPELINE_ROOT"
+
+FAIL=0
+
+# Every phase doc that runs LLM calls MUST mention `phase-tracker.sh tokens`
+# at least once (either in a code fence or inline).
+declare -a LLM_PHASES=(
+  "commands/multi-agent/refs/phases/phase-1-analysis.md:1"
+  "commands/multi-agent/refs/phases/phase-2-planning.md:2"
+  "commands/multi-agent/refs/phases/phase-3-dev.md:3"
+  "commands/multi-agent/refs/phases/phase-4-review.md:4"
+)
+
+for entry in "${LLM_PHASES[@]}"; do
+  doc="${entry%:*}"
+  phase_id="${entry##*:}"
+  full="$doc"
+  if [ ! -f "$full" ]; then
+    echo "FAIL [smoke-tracker-tokens-invocation]: $doc missing"
+    FAIL=$((FAIL + 1))
+    continue
+  fi
+  if ! grep -qE "phase-tracker\.sh tokens" "$full"; then
+    echo "FAIL [smoke-tracker-tokens-invocation]: $doc must invoke 'phase-tracker.sh tokens $phase_id <in> <out>' after every LLM call"
+    FAIL=$((FAIL + 1))
+  fi
+done
+
+# tracker-contract.md is the canonical location for the tokens API. Make sure
+# it documents the invocation pattern with both args.
+CONTRACT="commands/multi-agent/refs/tracker-contract.md"
+if [ ! -f "$CONTRACT" ]; then
+  echo "FAIL [smoke-tracker-tokens-invocation]: $CONTRACT missing"
+  FAIL=$((FAIL + 1))
+elif ! grep -qE "phase-tracker\.sh tokens .*<in>.*<out>|phase-tracker\.sh tokens .*<input.*<output" "$CONTRACT"; then
+  echo "FAIL [smoke-tracker-tokens-invocation]: $CONTRACT must document the tokens <N> <in> <out> signature"
+  FAIL=$((FAIL + 1))
+fi
+
+if [ "$FAIL" -gt 0 ]; then
+  echo ""
+  echo "smoke-tracker-tokens-invocation: $FAIL violation(s)."
+  echo "Defect 5: phase docs must invoke 'phase-tracker.sh tokens <N> <in> <out>' after every LLM call so the tracker render shows live cost."
+  exit 1
+fi
+
+echo "smoke-tracker-tokens-invocation: ok"

package/pipeline/scripts/smoke-triage-memory.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# smoke-triage-memory.sh — v8.3.0
+#
+# Verifies the triage-memory persistence layer:
+#   1. ingest writes JSONL rows for accepted/deferred/rejected and tags
+#      task_id, classification, severity, file, issue, reason
+#   2. ingest is idempotent — re-running with the same input writes 0 rows
+#   3. stats reports correct row counts grouped by classification
+#   4. query ranks rows by token overlap, returns top-N hits
+#   5. query --file-glob filters by path
+#   6. path subcommand resolves to <slug>/triage-corpus.jsonl under HOME
+#   7. empty corpus query returns total=0 + exit 2
+#   8. validate-schemas accepts triage-corpus.schema.json
+#   9. phase-7-report.md ref doc declares the ingest call
+#  10. phase-4-review.md ref doc declares prior-art lookup
+#  11. prefs.schema.json exposes priorArtEnrichment toggle
+#
+# Uses HOME override so we never touch the user's real ~/.claude/memory.
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+TM="$ROOT/pipeline/scripts/triage-memory.mjs"
+PHASE7="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-7-report.md"
+PHASE4="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-4-review.md"
+PREFS="$ROOT/pipeline/schemas/prefs.schema.json"
+SCHEMA="$ROOT/pipeline/schemas/triage-corpus.schema.json"
+
+pass=0
+fail=0
+failures=()
+record_pass() { pass=$((pass + 1)); printf '  \033[0;32mPASS\033[0m %s\n' "$1"; }
+record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\033[0m %s\n' "$1"; }
+
+printf '→ smoke-triage-memory (v8.3.0): semantic memory contract\n'
+
+[ -f "$SCHEMA" ] || { record_fail "schema missing: $SCHEMA"; exit 1; }
+
+TMP_HOME=$(mktemp -d)
+trap 'rm -rf "$TMP_HOME"' EXIT
+export HOME="$TMP_HOME"
+export MULTI_AGENT_REPO_SLUG="smoke-corpus"
+
+# Build a fixture triage JSON
+TRIAGE_FIXTURE="$TMP_HOME/triage.json"
+cat > "$TRIAGE_FIXTURE" <<'JSON'
+{
+  "accepted": [
+    {"severity":"blocking","file":"Auth/KeychainStore.swift","line":42,"issue":"Force-unwrap on optional token","fix":"Use guard let","reviewer":"opus"},
+    {"severity":"important","file":"Networking/ApiClient.swift","line":11,"issue":"Missing timeout configuration","fix":"Set request timeout","reviewer":"sonnet"}
+  ],
+  "deferred": [
+    {"finding":{"severity":"suggestion","file":"Views/SettingsView.swift","line":50,"issue":"Could extract subview","fix":"refactor"},"reason":"out of scope"}
+  ],
+  "rejected": [
+    {"finding":{"severity":"important","file":"Auth/KeychainStore.swift","line":99,"issue":"Use Sendable annotation","fix":"add Sendable"},"reason":"requires Swift 6 migration"}
+  ],
+  "approved": false
+}
+JSON
+
+# --- 1: first ingest writes rows ---
+out1=$(node "$TM" ingest --triage "$TRIAGE_FIXTURE" --task-id PROJ-100 --task-title "Auth refactor" --stack ios 2>/dev/null)
+ingested=$(echo "$out1" | jq -r '.ingested')
+if [ "$ingested" = "4" ]; then
+  record_pass "ingest writes 4 rows (2 accepted + 1 deferred + 1 rejected)"
+else
+  record_fail "ingest expected 4, got $ingested"
+fi
+
+# --- 2: idempotent re-ingest writes 0 rows ---
+out2=$(node "$TM" ingest --triage "$TRIAGE_FIXTURE" --task-id PROJ-100 --task-title "Auth refactor" --stack ios 2>/dev/null; echo "EC=$?")
+ingested2=$(echo "$out2" | grep -v EC= | jq -r '.ingested')
+ec2=$(echo "$out2" | grep "EC=" | sed 's/.*EC=//')
+if [ "$ingested2" = "0" ] && [ "$ec2" = "2" ]; then
+  record_pass "re-ingest is idempotent (0 rows + exit 2)"
+else
+  record_fail "re-ingest should write 0 rows + exit 2, got rows=$ingested2 ec=$ec2"
+fi
+
+# --- 3: stats counts ---
+stats=$(node "$TM" stats 2>/dev/null)
+acc=$(echo "$stats" | jq -r '.counts.accepted')
+def=$(echo "$stats" | jq -r '.counts.deferred')
+rej=$(echo "$stats" | jq -r '.counts.rejected')
+if [ "$acc" = "2" ] && [ "$def" = "1" ] && [ "$rej" = "1" ]; then
+  record_pass "stats reports accepted=2 deferred=1 rejected=1"
+else
+  record_fail "stats wrong: accepted=$acc deferred=$def rejected=$rej"
+fi
+
+# --- 4: query ranks by token overlap ---
+q1=$(node "$TM" query --issue "force unwrap optional" --top 2 2>/dev/null)
+top1=$(echo "$q1" | jq -r '.hits[0].file')
+top1_issue=$(echo "$q1" | jq -r '.hits[0].issue')
+if [[ "$top1" == *"KeychainStore.swift" ]] && [[ "$top1_issue" == *"Force-unwrap"* ]]; then
+  record_pass "query: 'force unwrap optional' top hit = KeychainStore force-unwrap finding"
+else
+  record_fail "query top hit wrong: $top1 / $top1_issue"
+fi
+
+# --- 5: file-glob filter ---
+q2=$(node "$TM" query --issue "timeout" --file-glob "Networking/*" 2>/dev/null)
+n2=$(echo "$q2" | jq -r '.hits | length')
+top2=$(echo "$q2" | jq -r '.hits[0].file' 2>/dev/null || echo "")
+if [ "$n2" = "1" ] && [[ "$top2" == "Networking/ApiClient.swift" ]]; then
+  record_pass "query: --file-glob narrows to Networking/* path"
+else
+  record_fail "file-glob narrow wrong: hits=$n2 top=$top2"
+fi
+
+# --- 6: path subcommand ---
+p=$(node "$TM" path 2>/dev/null)
+expected="$TMP_HOME/.claude/memory/multi-agent/smoke-corpus/triage-corpus.jsonl"
+if [ "$p" = "$expected" ]; then
+  record_pass "path resolves to <HOME>/.claude/memory/multi-agent/<slug>/triage-corpus.jsonl"
+else
+  record_fail "path wrong: $p (expected $expected)"
+fi
+
+# --- 7: empty-corpus query exits 2 with empty hits ---
+export MULTI_AGENT_REPO_SLUG="empty-corpus"
+set +e
+empty_out=$(node "$TM" query --issue "anything" 2>/dev/null)
+ec=$?
+set -e
+hits=$(echo "$empty_out" | jq -r '.hits | length')
+total=$(echo "$empty_out" | jq -r '.total')
+if [ "$ec" = "2" ] && [ "$hits" = "0" ] && [ "$total" = "0" ]; then
+  record_pass "empty-corpus query: exit 2, hits=[], total=0"
+else
+  record_fail "empty-corpus wrong: ec=$ec hits=$hits total=$total"
+fi
+export MULTI_AGENT_REPO_SLUG="smoke-corpus"
+
+# --- 8: schema present + valid JSON ---
+if jq -e '.title and .properties.classification' "$SCHEMA" >/dev/null 2>&1; then
+  record_pass "triage-corpus schema present and well-formed"
+else
+  record_fail "triage-corpus schema malformed"
+fi
+
+# --- 9: phase-7-report.md declares ingest ---
+if grep -q 'triage-memory.mjs' "$PHASE7"; then
+  record_pass "phase-7-report.md references triage-memory.mjs"
+else
+  record_fail "phase-7-report.md missing triage-memory.mjs reference"
+fi
+
+# --- 10: phase-4-review.md declares prior-art lookup ---
+if grep -qE 'prior.art|triage-memory' "$PHASE4"; then
+  record_pass "phase-4-review.md declares prior-art lookup"
+else
+  record_fail "phase-4-review.md missing prior-art lookup"
+fi
+
+# --- 11: prefs schema exposes priorArtEnrichment ---
+if jq -e '.properties.global.properties.priorArtEnrichment' "$PREFS" >/dev/null 2>&1; then
+  record_pass "prefs schema exposes priorArtEnrichment toggle"
+else
+  record_fail "prefs.schema.json missing global.priorArtEnrichment"
+fi
+
+# --- Summary ---
+total=$((pass + fail))
+printf '\n→ smoke-triage-memory: %d/%d passed\n' "$pass" "$total"
+if [ "$fail" -ne 0 ]; then
+  printf '\nFailures:\n'
+  for f in "${failures[@]}"; do printf '  - %s\n' "$f"; done
+  exit 1
+fi
+exit 0

package/pipeline/scripts/smoke-url-enrichment.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Smoke: Phase 0 Step 1b URL enrichment — Crashlytics + Fortify
+#   Verifies that:
+#     1. phase-0-init.md documents Step 1b with both URL patterns
+#     2. state.crashContext and state.fortifyFinding shapes are specified
+#     3. prefs.schema.json has hosts.fortify
+#     4. setup.md Step 3.5 prompts for fortify host (and skips firebase)
+#     5. Token Save Flow routing includes fortify
+
+set -u
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+PASS=0
+FAIL=0
+
+check() {
+  local label="$1" cmd="$2"
+  if eval "$cmd" > /dev/null 2>&1; then
+    printf "  ✓ %s\n" "$label"
+    PASS=$((PASS+1))
+  else
+    printf "  ✗ %s\n" "$label"
+    FAIL=$((FAIL+1))
+  fi
+}
+
+PHASE0="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-0-init.md"
+SETUP="$ROOT/pipeline/commands/multi-agent/setup.md"
+SCHEMA="$ROOT/pipeline/schemas/prefs.schema.json"
+
+echo "→ 1. phase-0-init.md documents Step 1b URL Enrichment"
+check "Step 1b section present"                  "grep -Fq 'Step 1b — URL Enrichment' '$PHASE0'"
+check "Crashlytics pattern block present"        "grep -Fq 'console.firebase.google.com' '$PHASE0'"
+check "Fortify pattern block present"            "grep -Eq 'hosts\.fortify.*ssc/html|ssc/html.*version' '$PHASE0'"
+
+echo
+echo "→ 2. state enrichment shapes specified"
+check "state.crashContext documented"            "grep -Fq 'state.crashContext' '$PHASE0'"
+check "state.fortifyFinding documented"          "grep -Fq 'state.fortifyFinding' '$PHASE0'"
+check "Phase 1 prepend mention for crash"        "grep -Fq 'Known Crash Context' '$PHASE0'"
+check "Phase 2 inject mention for fortify"       "grep -Fq 'Known Security Finding' '$PHASE0'"
+
+echo
+echo "→ 3. Progress contract line documented"
+check "URL context log line shape"               "grep -Fq 'URL context: crashlytics=' '$PHASE0'"
+
+echo
+echo "→ 4. prefs.schema.json has hosts.fortify"
+check "hosts.fortify field exists"               "grep -Fq '\"fortify\":' '$SCHEMA' && grep -Fq 'Fortify SSC host' '$SCHEMA'"
+check "FORTIFY_HOST placeholder referenced"      "grep -Fq '{FORTIFY_HOST}' '$SCHEMA'"
+
+echo
+echo "→ 5. Firebase description = 'Firebase JSON' (not 'SA JSON')"
+check "schema firebase (servicePatMap) renamed"  "! grep -F 'Firebase Service Account JSON' '$SCHEMA'"
+check "schema firebase (keychainMapping) renamed" "grep -c '\"Firebase JSON' '$SCHEMA' | grep -q '[2-9]'"
+
+echo
+echo "→ 6. setup.md Step 3.5 routes fortify (not firebase)"
+check "Step 3.5 lists fortify"                   "grep -Eq 'jira.*confluence.*bitbucket.*fortify|fortify.*host' '$SETUP'"
+check "firebase skip note in Step 3.5"           "grep -Fiq 'firebase is skipped' '$SETUP' || grep -Fiq 'Firebase tokens skip' '$SETUP'"
+check "Resulting shape has fortify host"         "grep -Fq '\"fortify\":' '$SETUP'"
+check "FORTIFY_HOST placeholder listed"          "grep -Fq '{FORTIFY_HOST}' '$SETUP'"
+
+echo
+echo "→ 7. Token Source Mapping shows 'Firebase JSON' label"
+check "setup.md Token Source Mapping renamed"    "grep -Fq 'Firebase JSON (base64)' '$SETUP'"
+check "multi-agent-setup SKILL.md renamed"       "grep -Fq 'Firebase JSON (base64)' '$ROOT/pipeline/skills/shared/core/multi-agent-setup/SKILL.md'"
+
+echo
+echo "══ url-enrichment smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-validator-contradiction.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# smoke-validator-contradiction.sh — verify bidirectional approved↔blocking auto-correction.
+# Tests both directions of the triage validator's contradiction detection.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+VALIDATOR="$SCRIPT_DIR/validate-triage.mjs"
+
+PASS=0
+FAIL=0
+
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+echo "→ 1. approved=false but no blocking items → auto-correct to true (exit 3)"
+RESULT=$(echo '{"accepted":[{"severity":"suggestion","file":"x.ts","line":1,"issue":"naming convention","fix":"rename to camelCase","reviewer":"opus"}],"deferred":[],"rejected":[],"approved":false}' | node "$VALIDATOR" -)
+CODE=$?
+if [ "$CODE" -eq 3 ]; then pass "exit code 3 (contradiction corrected)"; else fail "expected exit 3, got $CODE"; fi
+CORRECTED=$(echo "$RESULT" | jq -r '.corrected.approved')
+if [ "$CORRECTED" = "true" ]; then pass "corrected.approved == true"; else fail "corrected.approved = $CORRECTED, expected true"; fi
+
+echo ""
+echo "→ 2. approved=true but has blocking item → auto-correct to false (exit 3)"
+RESULT=$(echo '{"accepted":[{"severity":"blocking","file":"auth.ts","line":42,"issue":"SQL injection vulnerability","fix":"use parameterized query","reviewer":"opus"}],"deferred":[],"rejected":[],"approved":true}' | node "$VALIDATOR" -)
+CODE=$?
+if [ "$CODE" -eq 3 ]; then pass "exit code 3 (contradiction corrected)"; else fail "expected exit 3, got $CODE"; fi
+CORRECTED=$(echo "$RESULT" | jq -r '.corrected.approved')
+if [ "$CORRECTED" = "false" ]; then pass "corrected.approved == false"; else fail "corrected.approved = $CORRECTED, expected false"; fi
+
+echo ""
+echo "→ 3. approved=true with no blocking → valid (exit 0)"
+RESULT=$(echo '{"accepted":[{"severity":"important","file":"x.ts","line":1,"issue":"missing null check","fix":"add guard clause","reviewer":"sonnet"}],"deferred":[],"rejected":[],"approved":true}' | node "$VALIDATOR" -)
+CODE=$?
+if [ "$CODE" -eq 0 ]; then pass "exit code 0 (valid, no contradiction)"; else fail "expected exit 0, got $CODE"; fi
+OK=$(echo "$RESULT" | jq -r '.ok')
+if [ "$OK" = "true" ]; then pass "ok == true"; else fail "ok = $OK, expected true"; fi
+
+echo ""
+echo "→ 4. approved=false with blocking → valid (exit 0)"
+RESULT=$(echo '{"accepted":[{"severity":"blocking","file":"x.ts","line":1,"issue":"memory leak in closure","fix":"add [weak self]","reviewer":"opus"}],"deferred":[],"rejected":[],"approved":false}' | node "$VALIDATOR" -)
+CODE=$?
+if [ "$CODE" -eq 0 ]; then pass "exit code 0 (valid, correct state)"; else fail "expected exit 0, got $CODE"; fi
+OK=$(echo "$RESULT" | jq -r '.ok')
+if [ "$OK" = "true" ]; then pass "ok == true"; else fail "ok = $OK, expected true"; fi
+
+echo ""
+echo "→ 5. empty accepted + approved=true → valid (exit 0)"
+RESULT=$(echo '{"accepted":[],"deferred":[],"rejected":[],"approved":true}' | node "$VALIDATOR" -)
+CODE=$?
+if [ "$CODE" -eq 0 ]; then pass "exit code 0 (empty, approved=true is correct)"; else fail "expected exit 0, got $CODE"; fi
+
+echo ""
+echo "→ 6. all suggestions + approved=false → auto-correct (exit 3)"
+RESULT=$(echo '{"accepted":[{"severity":"suggestion","file":"a.ts","line":1,"issue":"test name convention","fix":"rename test","reviewer":"sonnet"},{"severity":"suggestion","file":"b.ts","line":2,"issue":"unused import","fix":"remove import","reviewer":"opus"}],"deferred":[],"rejected":[],"approved":false}' | node "$VALIDATOR" -)
+CODE=$?
+if [ "$CODE" -eq 3 ]; then pass "exit code 3 (no blockers, corrected to true)"; else fail "expected exit 3, got $CODE"; fi
+
+echo ""
+echo "→ 7. mixed blocking+suggestion + approved=true → auto-correct to false (exit 3)"
+RESULT=$(echo '{"accepted":[{"severity":"blocking","file":"a.ts","line":1,"issue":"auth bypass","fix":"add auth check","reviewer":"opus"},{"severity":"suggestion","file":"b.ts","line":2,"issue":"naming","fix":"rename","reviewer":"sonnet"}],"deferred":[],"rejected":[],"approved":true}' | node "$VALIDATOR" -)
+CODE=$?
+if [ "$CODE" -eq 3 ]; then pass "exit code 3 (has blocker, corrected to false)"; else fail "expected exit 3, got $CODE"; fi
+
+echo ""
+echo "══ validator-contradiction smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-vercel-deploy-redact.sh

@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+#
+# smoke-vercel-deploy-redact.sh — verify pipeline/lib/vercel-deploy.sh
+# scrubs every known token-leak shape from CLI output.
+#
+# Background: v7.9.1 production deploy failed with the Vercel CLI
+# printing `vercel deploy --token=vcp_…` in the retry hint. The token leaked
+# into the conversation transcript and required rotation. v8.0.0 added
+# vercel-deploy.sh as the safe wrapper. This smoke is the regression gate —
+# any future change to the redact filter must keep these patterns covered.
+#
+# Patterns under test:
+#   - --token=vcp_<hex>           (the original 7.9.1 leak shape)
+#   - --token vcp_<hex>           (space-separated argv)
+#   - vcp_<bare>                  (token-only mention)
+#   - Bearer <jwt-ish>            (HTTP auth header)
+#   - "token":"<val>"             (JSON body)
+#   - "VERCEL_TOKEN":"<val>"      (env-dump JSON)
+#
+# Exit codes: 0=pass, 1=at least one pattern survived redaction
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+WRAPPER="$REPO_ROOT/pipeline/lib/vercel-deploy.sh"
+
+[ -x "$WRAPPER" ] || chmod +x "$WRAPPER" 2>/dev/null || true
+[ -f "$WRAPPER" ] || { echo "FAIL: vercel-deploy.sh missing"; exit 2; }
+
+PASS=0
+FAIL=0
+pass() { echo "  ✓ $*"; PASS=$((PASS + 1)); }
+fail() { echo "  ✗ $*"; FAIL=$((FAIL + 1)); }
+
+assert_redacts() {
+  local label="$1"
+  local input="$2"
+  local must_not_contain="$3"
+  local out
+  out=$(printf '%s' "$input" | bash "$WRAPPER" redact)
+  if echo "$out" | grep -qE "$must_not_contain"; then
+    fail "$label — leak survived: $(echo "$out" | grep -oE "$must_not_contain" | head -1)"
+  else
+    pass "$label"
+  fi
+}
+
+# --- Pattern 1: --token=vcp_… (original v7.9.1 leak) ---
+assert_redacts "--token=vcp_… argv form scrubbed" \
+  'Run `vercel deploy --token=vcp_AbCdEf123456789abcdef --prod` to retry' \
+  'vcp_AbCdEf123456789abcdef'
+
+# --- Pattern 2: --token <space> vcp_… ---
+assert_redacts "--token <space> argv form scrubbed" \
+  'next.command: vercel deploy --token vcp_QwertyUiopASDFghj1234' \
+  'vcp_QwertyUiopASDFghj1234'
+
+# --- Pattern 3: bare vcp_… token mention ---
+assert_redacts "bare vcp_… token mention scrubbed" \
+  'Authentication failed for token vcp_BareLeak987654321xyz on retry.' \
+  'vcp_BareLeak987654321xyz'
+
+# --- Pattern 4: Bearer <jwt-ish> auth header ---
+assert_redacts "Bearer <jwt> auth header scrubbed" \
+  'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0In0.signature' \
+  'eyJhbGciOiJIUzI1NiJ9'
+
+# --- Pattern 5: "token":"<val>" JSON body ---
+assert_redacts '"token":"<val>" JSON body scrubbed' \
+  '{"token":"vcp_JsonBodyLeak555","scope":"deploy"}' \
+  'vcp_JsonBodyLeak555'
+
+# --- Pattern 6: "VERCEL_TOKEN":"<val>" env-dump JSON ---
+assert_redacts '"VERCEL_TOKEN":"<val>" env-dump scrubbed' \
+  'env: { "VERCEL_TOKEN":"vcp_EnvDumpLeak777", "NODE_ENV":"production" }' \
+  'vcp_EnvDumpLeak777'
+
+# --- Pattern 7: multi-line CLI failure dump (real-world shape from v7.9.1) ---
+multiline=$'Error: failed to deploy\n  next.command: vercel deploy --token=vcp_RealDumpLeak888 --prod\n  retry: yes'
+assert_redacts "multi-line CLI failure dump scrubbed" \
+  "$multiline" \
+  'vcp_RealDumpLeak888'
+
+# --- Negative: non-token text passes through unchanged ---
+echo ""
+echo "→ Negative cases — non-token text MUST pass through verbatim"
+sample='Deployment URL: https://example.vercel.app/page (200 OK)'
+roundtrip=$(printf '%s' "$sample" | bash "$WRAPPER" redact)
+if [ "$roundtrip" = "$sample" ]; then
+  pass "innocuous output unchanged"
+else
+  fail "redactor mangled innocuous output: '$roundtrip' != '$sample'"
+fi
+
+# --- Wrapper guard: refuses --token argv ---
+echo ""
+echo "→ Wrapper guard — refuses to deploy with --token argv"
+guard_out=$(VERCEL_TOKEN=vcp_GuardCheck111 bash "$WRAPPER" deploy --token=vcp_BadArg 2>&1 || true)
+if echo "$guard_out" | grep -q "refused to deploy with --token argv"; then
+  pass "wrapper rejects --token argv with explicit error"
+else
+  fail "wrapper did not reject --token argv (output: $guard_out)"
+fi
+# Verify the refusal message itself doesn't leak the bad token
+if echo "$guard_out" | grep -q "vcp_BadArg"; then
+  fail "refusal message leaked the bad token (vcp_BadArg)"
+else
+  pass "refusal message does not echo the offending token"
+fi
+
+# --- Doctor mode runs without VERCEL_TOKEN crashing ---
+echo ""
+echo "→ doctor subcommand"
+doctor_out=$(VERCEL_TOKEN= bash "$WRAPPER" doctor 2>&1 || true)
+if echo "$doctor_out" | grep -q "VERCEL_TOKEN: unset"; then
+  pass "doctor reports unset token clearly"
+else
+  fail "doctor did not handle unset VERCEL_TOKEN gracefully"
+fi
+
+doctor_set_out=$(VERCEL_TOKEN=vcp_DoctorTokenABCDEF12345 bash "$WRAPPER" doctor 2>&1 || true)
+if echo "$doctor_set_out" | grep -q "vcp_DoctorTokenABCDEF12345"; then
+  fail "doctor leaked the token in set-mode output"
+else
+  pass "doctor masks the token in set-mode output"
+fi
+
+echo ""
+echo "══ smoke-vercel-deploy-redact: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -gt 0 ] && exit 1 || exit 0

package/pipeline/scripts/smoke-wiki-integration.sh

@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+# smoke-wiki-integration.sh — v5.7+ wiki channel adapter contract.
+#
+# Verifies:
+#   1. prefs.schema.json declares global.wikiScope (array of enum) + reportChannels.wiki (boolean).
+#   2. figma-project-config schema declares wiki.mode enum with 4 adapters.
+#   3. Wiki adapter surface (channels.md + wiki-capture.md) documents:
+#      - Case A (preconditions met) scope multi-select
+#      - Case B (preconditions missing) actionable menu
+#      - taskType === "component" gate
+#      - wiki.enabled gate
+#      - 4 adapter modes (submodule / in-repo / github-wiki / separate-repo)
+#      - Writing wiki progress line
+#   4. figma-component-wiki SKILL.md has dispatch contract + 4 adapters.
+
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+PREFS="$ROOT/pipeline/schemas/prefs.schema.json"
+FIGMA_SCHEMA="$ROOT/pipeline/schemas/figma-project-config.schema.json"
+CHANNELS="$ROOT/pipeline/commands/multi-agent/channels.md"
+WIKI_REF="$ROOT/pipeline/commands/multi-agent/refs/wiki-capture.md"
+PHASE7="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-7-report.md"
+MODES="$ROOT/pipeline/commands/multi-agent/refs/phases/modes.md"
+WIKI_SKILL="$ROOT/pipeline/skills/figma-ios/figma-component-wiki/SKILL.md"
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+need() { command -v "$1" >/dev/null 2>&1 || { echo "error: $1 required" >&2; exit 127; }; }
+need jq
+
+for f in "$PREFS" "$FIGMA_SCHEMA" "$CHANNELS" "$WIKI_REF" "$PHASE7" "$MODES" "$WIKI_SKILL"; do
+  [ -f "$f" ] || { echo "error: missing $f" >&2; exit 1; }
+done
+
+# Combined surface — channels.md + wiki-capture.md + phase-7-report.md + modes.md. Any may carry assertion.
+WIKI_SURFACE="$(mktemp)"
+trap 'rm -f "$WIKI_SURFACE"' EXIT
+cat "$CHANNELS" "$WIKI_REF" "$PHASE7" "$MODES" > "$WIKI_SURFACE"
+
+echo "→ 1. prefs schema declares wikiScope (array) + reportChannels.wiki (boolean)"
+SCOPE_TYPE=$(jq -r '.properties.global.properties.wikiScope.type // "missing"' "$PREFS")
+[ "$SCOPE_TYPE" = "array" ] && pass "wikiScope is array" || fail "wikiScope type = '$SCOPE_TYPE' (want array)"
+SCOPE_ENUM=$(jq -c '.properties.global.properties.wikiScope.items.enum // []' "$PREFS")
+EXPECTED_ENUM='["main","ios","screenshots","index"]'
+[ "$SCOPE_ENUM" = "$EXPECTED_ENUM" ] && pass "wikiScope enum = [main,ios,screenshots,index]" || fail "wikiScope enum mismatch: $SCOPE_ENUM"
+
+CHAN_WIKI_TYPE=$(jq -r '.properties.global.properties.reportChannels.properties.wiki.type // "missing"' "$PREFS")
+[ "$CHAN_WIKI_TYPE" = "boolean" ] && pass "reportChannels.wiki is boolean" || fail "reportChannels.wiki type = '$CHAN_WIKI_TYPE'"
+
+echo ""
+echo "→ 2. figma-project-config schema declares wiki.mode with 4 adapters"
+MODE_ENUM=$(jq -c '.properties.wiki.properties.mode.enum' "$FIGMA_SCHEMA")
+EXPECTED='["submodule","in-repo","github-wiki","separate-repo"]'
+[ "$MODE_ENUM" = "$EXPECTED" ] && pass "wiki.mode enum = 4 adapters" || fail "wiki.mode enum mismatch: $MODE_ENUM"
+
+echo ""
+echo "→ 3. Wiki adapter (channels.md + wiki-capture.md) has Case A + Case B"
+if grep -Fq "Case A" "$WIKI_REF" || grep -Fq "preconditions met" "$WIKI_REF"; then
+  pass "Case A (preconditions met) documented"
+else
+  fail "Case A not documented"
+fi
+if grep -Fq "Case B" "$WIKI_REF" || grep -Fq "preconditions missing" "$WIKI_REF"; then
+  pass "Case B (preconditions missing) documented"
+else
+  fail "Case B not documented"
+fi
+
+echo ""
+echo "→ 4. Wiki surface gates on taskType === component"
+if grep -Fq 'state.taskType === "component"' "$WIKI_SURFACE" || grep -Fq 'taskType=component' "$WIKI_SURFACE"; then
+  pass "taskType gate documented"
+else
+  fail "taskType gate missing"
+fi
+
+echo ""
+echo "→ 5. Wiki surface references wiki.enabled"
+if grep -Fq "wiki.enabled" "$WIKI_SURFACE"; then
+  pass "wiki.enabled gate documented"
+else
+  fail "wiki.enabled gate missing"
+fi
+
+echo ""
+echo "→ 6. Wiki surface lists all 4 adapter modes"
+MODES_HIT=0
+for mode in submodule in-repo github-wiki separate-repo; do
+  if grep -Fq "\`$mode\`" "$WIKI_SURFACE"; then
+    MODES_HIT=$((MODES_HIT+1))
+  fi
+done
+[ "$MODES_HIT" -eq 4 ] && pass "all 4 modes listed" || fail "wiki surface lists $MODES_HIT/4 modes"
+
+echo ""
+echo "→ 7. Wiki surface emits wiki progress line"
+if grep -qE '→ writing wiki' "$WIKI_SURFACE"; then
+  pass "progress line shape documented"
+else
+  fail "missing progress line"
+fi
+
+echo ""
+echo "→ 8. Wiki surface documents autopilot always-pause behaviour"
+if grep -qiE 'autopilot.*pause|ALWAYS pauses|Phase 7 autopilot exception' "$WIKI_SURFACE"; then
+  pass "autopilot always-pause documented"
+else
+  fail "autopilot always-pause not documented"
+fi
+
+echo ""
+echo "→ 9. figma-component-wiki SKILL.md has dispatch contract + 4 adapters"
+if grep -Fq "Dispatch contract (Phase 7 Report Step 2)" "$WIKI_SKILL" \
+  || grep -Fq "Dispatch contract" "$WIKI_SKILL"; then
+  pass "SKILL.md documents dispatch contract"
+else
+  fail "SKILL.md missing dispatch contract"
+fi
+if grep -Fq "Adapter selection" "$WIKI_SKILL"; then
+  pass "SKILL.md has 'Adapter selection' table"
+else
+  fail "SKILL.md missing 'Adapter selection' table"
+fi
+
+ADAPTERS=0
+for mode in submodule in-repo github-wiki separate-repo; do
+  grep -Fq "\`$mode\`" "$WIKI_SKILL" && ADAPTERS=$((ADAPTERS+1)) || true
+done
+[ "$ADAPTERS" -eq 4 ] && pass "all 4 adapters named in SKILL.md" || fail "SKILL.md names $ADAPTERS/4 adapters"
+
+echo ""
+echo "→ 10. SKILL.md has frontmatter"
+if head -n 1 "$WIKI_SKILL" | grep -Fxq -- "---"; then
+  pass "SKILL.md has frontmatter"
+else
+  fail "SKILL.md missing frontmatter"
+fi
+
+echo ""
+echo "══ wiki-integration smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]