@mmerterden/multi-agent-pipeline 8.6.1 → 10.0.6

package/pipeline/scripts/smoke-diff-explain.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-diff-explain.sh — v7.8.0 Paket B: Phase 4 triage to diff bridge.
+# smoke-diff-explain.sh  -  v7.8.0 Paket B: Phase 4 triage to diff bridge.
 #
 # Validates:
 #   1. Slash command + Copilot peer present (parity smoke also catches this)
@@ -57,7 +57,7 @@ echo "$OUT" | grep -q "⚠️" && pass "important severity icon (⚠️) rendere
 echo "$OUT" | grep -q "💡" && pass "suggestion severity icon (💡) rendered" || fail "suggestion icon missing"
 
 # ──────────────────────────────────────────────────────────────────────────
-echo "→ 5. Hunk binding — synthetic diff matches finding line"
+echo "→ 5. Hunk binding  -  synthetic diff matches finding line"
 cat > "$TMP/syn.diff" <<'EOF'
 diff --git a/src/api/checkout.ts b/src/api/checkout.ts
 index a..b 100644
@@ -115,13 +115,32 @@ else
 fi
 
 # ──────────────────────────────────────────────────────────────────────────
-echo "→ 9. Read-only contract — no destructive git APIs"
+echo "→ 9. Read-only contract  -  no destructive git APIs"
 if grep -qE "git apply|git checkout|git reset|git rebase|git push|git commit|writeFileSync" "$SCRIPT"; then
   fail "diff-explain.mjs references destructive git API or writeFileSync (read-only contract violated)"
 else
   pass "no destructive git/write API references in diff-explain.mjs"
 fi
 
+# ──────────────────────────────────────────────────────────────────────────
+echo "→ 10. Injection-safe  -  shell metacharacters in --base are not executed"
+SENTINEL="$TMP/PWNED"
+set +e
+node "$SCRIPT" \
+  --triage "$REPO_ROOT/pipeline/eval/triage/05-mixed-classification/expected.json" \
+  --base "main; touch $SENTINEL" --branch HEAD >/dev/null 2>&1
+set -e
+if [ -f "$SENTINEL" ]; then
+  fail "command injection: --base executed arbitrary shell (sentinel created)"
+else
+  pass "shell metacharacters in --base not executed (execFileSync)"
+fi
+if grep -q "execSync" "$SCRIPT"; then
+  fail "diff-explain.mjs still uses execSync (shell interpolation risk)"
+else
+  pass "diff-explain.mjs uses execFileSync only"
+fi
+
 # ──────────────────────────────────────────────────────────────────────────
 echo ""
 echo "══ diff-explain smoke: $PASS passed, $FAIL failed ══"

package/pipeline/scripts/smoke-diff-risk.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-diff-risk.sh — v8.3.0
+# smoke-diff-risk.sh  -  v8.3.0
 #
 # Verifies the Phase 4 advisory diff-risk pipeline:
 #   1. diff-risk-score.mjs runs against the iOS fixture and produces valid JSON

package/pipeline/scripts/smoke-dynamic-skill-loading.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-dynamic-skill-loading.sh — v7.0.I
+# smoke-dynamic-skill-loading.sh  -  v7.0.I
 #
 # Verifies the index + matcher contract:
 #   1. build-skills-index.mjs produces valid JSON with schemaVersion + entries

package/pipeline/scripts/smoke-eval-live.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-eval-live.sh — v7.8.0 Paket A: opt-in live golden-task runner.
+# smoke-eval-live.sh  -  v7.8.0 Paket A: opt-in live golden-task runner.
 #
 # Validates the cost-guarding contract WITHOUT making any model calls. Live
 # mode is gated behind two independent signals (--live flag AND
@@ -42,7 +42,7 @@ fi
 
 # ──────────────────────────────────────────────────────────────────────────
 echo "→ 3. Dry-run does not invoke model"
-# All cases must end with status "skipped-dry-run" — i.e. no live call
+# All cases must end with status "skipped-dry-run"  -  i.e. no live call
 SKIPPED_COUNT=$(echo "$OUT" | grep -c '"pass": "skipped-dry-run"' || true)
 if [ "$SKIPPED_COUNT" -ge 1 ]; then
   pass "dry-run skipped all cases ($SKIPPED_COUNT) without invoking model"
@@ -61,7 +61,7 @@ else
 fi
 
 # ──────────────────────────────────────────────────────────────────────────
-echo "→ 5. Static check — no fall-through past cost gate"
+echo "→ 5. Static check  -  no fall-through past cost gate"
 # The cost gate must be the first thing checked after flag parsing. If --live
 # is set without env, no model call should be reachable. Verify by static
 # grep: spawnSync("claude", ...) must come AFTER the env-check block.
@@ -74,7 +74,7 @@ else
 fi
 
 # ──────────────────────────────────────────────────────────────────────────
-echo "→ 6. Budget cap honored — total-budget < single case budget skips all"
+echo "→ 6. Budget cap honored  -  total-budget < single case budget skips all"
 OUT=$(node "$SCRIPT" --max-cases=5 --budget=0.5 --total-budget=0.1 --json 2>/dev/null)
 RUN_COUNT=$(echo "$OUT" | grep -oE '"cases_run":[[:space:]]*[0-9]+' | grep -oE '[0-9]+')
 SKIPPED=$(echo "$OUT" | grep -c '"skipped-budget-exhausted"' || true)

package/pipeline/scripts/smoke-evidence-gate.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# smoke-evidence-gate.sh  -  contract check for the default-FAIL evidence gate.
+#
+# The gate must fail CLOSED: a "passed" claim with no / empty / contradicting
+# evidence is blocked; only a log that actually shows success lets the claim
+# through. Non-pass statuses pass through untouched.
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+GATE="$ROOT/pipeline/scripts/evidence-gate.mjs"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0
+FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+
+command -v node >/dev/null 2>&1 || { echo "error: node required" >&2; exit 127; }
+[ -f "$GATE" ] || { echo "FAIL: evidence-gate.mjs missing" >&2; exit 1; }
+
+printf '** BUILD SUCCEEDED **\nCompiling 12 files\n' > "$TMP/build-ok.log"
+printf '** BUILD FAILED **\nerror: cannot find type Foo\n' > "$TMP/build-fail.log"
+printf 'Test Suite All passed\n0 failures\n' > "$TMP/test-ok.log"
+printf 'Test Suite failed\n3 failures\n' > "$TMP/test-fail.log"
+: > "$TMP/empty.log"
+
+expect_exit() {
+  local want="$1"; shift
+  local desc="$1"; shift
+  local got=0
+  node "$GATE" "$@" >/dev/null 2>&1 || got=$?
+  if [ "$got" = "$want" ]; then
+    pass "$desc (exit=$got)"
+  else
+    fail "$desc (expected $want, got $got)"
+  fi
+}
+
+echo "→ 1. Substantiated pass claims (exit 0)"
+expect_exit 0 "build passed + SUCCEEDED log" --claim build --status passed --evidence "$TMP/build-ok.log"
+expect_exit 0 "test passed + passing log" --claim test --status passed --evidence "$TMP/test-ok.log"
+
+echo ""
+echo "→ 2. Default-FAIL: unverified pass claims (exit 1)"
+expect_exit 1 "build passed + no evidence flag" --claim build --status passed
+expect_exit 1 "build passed + missing file" --claim build --status passed --evidence "$TMP/nope.log"
+expect_exit 1 "build passed + empty log" --claim build --status passed --evidence "$TMP/empty.log"
+expect_exit 1 "build passed + FAILED log (contradicted)" --claim build --status passed --evidence "$TMP/build-fail.log"
+expect_exit 1 "test passed + failing log (contradicted)" --claim test --status passed --evidence "$TMP/test-fail.log"
+
+echo ""
+echo "→ 3. Non-pass statuses pass through (exit 0)"
+expect_exit 0 "status=failed passes through" --claim build --status failed --evidence "$TMP/build-fail.log"
+expect_exit 0 "status=pending passes through" --claim build --status pending
+
+echo ""
+echo "→ 4. Custom success pattern override"
+printf 'CUSTOM_OK marker here\n' > "$TMP/custom.log"
+expect_exit 0 "custom success pattern matches" --claim test --status passed --evidence "$TMP/custom.log" --success-pattern 'CUSTOM_OK'
+expect_exit 1 "custom success pattern absent" --claim test --status passed --evidence "$TMP/build-ok.log" --success-pattern 'CUSTOM_OK'
+
+echo ""
+echo "→ 4b. Failure is decisive (closes the SUCCESS-substring bypass)"
+printf '** BUILD FAILED **\nnote: previous step SUCCESS (cached)\n' > "$TMP/bypass.log"
+expect_exit 1 "failing log that also says SUCCESS still fails" --claim build --status passed --evidence "$TMP/bypass.log"
+printf 'BUILD SUCCEEDED\nwarning: deprecated API used\n' > "$TMP/warn.log"
+expect_exit 0 "success log with a warning still passes" --claim build --status passed --evidence "$TMP/warn.log"
+
+echo ""
+echo "→ 4c. Bad/oversized custom patterns are a clean usage error (no crash)"
+expect_exit 2 "invalid regex pattern -> usage exit 2" --claim test --status passed --evidence "$TMP/test-ok.log" --success-pattern '('
+OVERLONG=$(printf 'a%.0s' $(seq 1 250))
+expect_exit 2 "overlong pattern -> usage exit 2" --claim test --status passed --evidence "$TMP/test-ok.log" --success-pattern "$OVERLONG"
+
+echo ""
+echo "→ 5. Wiring: phase docs reference the gate"
+GREP_HITS=0
+for doc in phase-3-dev phase-4-review phase-6-commit; do
+  grep -q "evidence-gate" "$ROOT/pipeline/commands/multi-agent/refs/phases/$doc.md" && GREP_HITS=$((GREP_HITS+1))
+done
+if [ "$GREP_HITS" -ge 2 ]; then
+  pass "evidence-gate referenced in $GREP_HITS phase docs"
+else
+  fail "evidence-gate referenced in only $GREP_HITS phase docs (expected >= 2)"
+fi
+
+echo ""
+echo "══ evidence-gate smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-existing-discovery-gate.sh

@@ -64,7 +64,7 @@ fi
 if [ "$FAIL" -gt 0 ]; then
   echo ""
   echo "smoke-existing-discovery-gate: $FAIL violation(s)."
-  echo "Defect 10 contract — see docs/STABILITY-FIX-PLAN.md."
+  echo "Defect 10 contract  -  see docs/STABILITY-FIX-PLAN.md."
   exit 1
 fi
 

package/pipeline/scripts/smoke-extract-conventions.sh

@@ -0,0 +1,163 @@
+#!/usr/bin/env bash
+# smoke-extract-conventions.sh  -  offline sanity checks for extract-conventions.sh.
+# Builds a throwaway iOS-shaped fixture repo, runs the extractor, and asserts the
+# emitted JSON honours pipeline/schemas/conventions-output.schema.json: all 12
+# convention fields present, every bucket carries the 5-field shape, confidence
+# stays inside its enum, and evidenceFiles is capped at 5. Also covers the
+# invalid-platform and missing-args error paths. No network, no credentials.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+EXTRACT="$REPO_ROOT/pipeline/lib/extract-conventions.sh"
+
+PASS=0
+FAIL=0
+
+ok()   { echo "  ✓ $1"; PASS=$((PASS+1)); }
+fail() { echo "  ✗ $1" >&2; FAIL=$((FAIL+1)); }
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "smoke-extract-conventions: jq not found; skipping (install jq to enable)" >&2
+  exit 0
+fi
+
+if [ ! -x "$EXTRACT" ]; then
+  fail "extract-conventions.sh missing or not executable at $EXTRACT"
+  echo "══ extract-conventions smoke: $PASS passed, $FAIL failed ══" >&2
+  exit 1
+fi
+
+# --- Error paths ---------------------------------------------------------------
+echo "→ error paths"
+
+if "$EXTRACT" >/dev/null 2>&1; then
+  fail "missing args should exit non-zero"
+else
+  ok "missing args exits non-zero"
+fi
+
+if "$EXTRACT" /tmp "bogus-platform" >/dev/null 2>&1; then
+  fail "invalid platform should exit non-zero"
+else
+  ok "invalid platform exits non-zero"
+fi
+
+# --- Fixture repo ----------------------------------------------------------------
+echo "→ ios fixture extraction"
+
+FIXTURE="$(mktemp -d "${TMPDIR:-/tmp}/conv-smoke.XXXXXX")"
+trap 'rm -rf "$FIXTURE"' EXIT
+
+mkdir -p "$FIXTURE/Domains/Sample/Presentation/ViewModel" \
+         "$FIXTURE/Domains/Sample/Presentation/View" \
+         "$FIXTURE/Domains/Sample/Domain/UseCases" \
+         "$FIXTURE/Domains/Sample/Tests"
+
+for n in One Two Three Four Five; do
+  cat > "$FIXTURE/Domains/Sample/Presentation/ViewModel/Sample${n}ViewModel.swift" <<EOF
+import SwiftUI
+
+@MainActor
+final class Sample${n}ViewModel: ObservableObject {
+    @Published private(set) var state: Sample${n}UIState = .loading
+}
+
+enum Sample${n}UIState {
+    case loading
+    case idle
+    case error
+}
+EOF
+  cat > "$FIXTURE/Domains/Sample/Presentation/View/Sample${n}View.swift" <<EOF
+import SwiftUI
+
+struct Sample${n}View: View {
+    var body: some View { Text("sample") }
+}
+EOF
+  cat > "$FIXTURE/Domains/Sample/Domain/UseCases/Fetch${n}UseCase.swift" <<EOF
+protocol Fetch${n}UseCaseProtocol {
+    func execute() async throws
+}
+EOF
+done
+
+OUTPUT="$("$EXTRACT" "$FIXTURE" ios 2>/dev/null)" || OUTPUT=""
+
+if [ -z "$OUTPUT" ]; then
+  fail "extractor produced no output on fixture repo"
+else
+  if printf '%s' "$OUTPUT" | jq -e . >/dev/null 2>&1; then
+    ok "output parses as JSON"
+  else
+    fail "output is not valid JSON"
+  fi
+
+  EXPECTED_KEYS="folderStructure stateHolderNaming viewNaming navigatorNaming useCaseNaming repositoryNaming dtoNaming uiStateModel testMethodNaming accessibilityIdentifier localizationKey diRegistration"
+
+  MISSING=""
+  for key in $EXPECTED_KEYS; do
+    if ! printf '%s' "$OUTPUT" | jq -e --arg k "$key" 'has($k)' >/dev/null 2>&1; then
+      MISSING="$MISSING $key"
+    fi
+  done
+  if [ -z "$MISSING" ]; then
+    ok "all 12 convention fields present"
+  else
+    fail "missing convention fields:$MISSING"
+  fi
+
+  BAD_SHAPE=$(printf '%s' "$OUTPUT" | jq -r '
+    to_entries[]
+    | select(
+        (.value | type) != "object"
+        or ((.value | keys | sort) != ["alternativeCandidates","confidence","evidenceFiles","example","pattern"])
+      )
+    | .key' 2>/dev/null)
+  if [ -z "$BAD_SHAPE" ]; then
+    ok "every bucket carries the 5-field shape"
+  else
+    fail "buckets with wrong shape: $(printf '%s' "$BAD_SHAPE" | tr '\n' ' ')"
+  fi
+
+  BAD_CONF=$(printf '%s' "$OUTPUT" | jq -r '
+    to_entries[]
+    | select(.value.confidence as $c | ["high","medium","low","none"] | index($c) | not)
+    | .key' 2>/dev/null)
+  if [ -z "$BAD_CONF" ]; then
+    ok "confidence values stay inside the enum"
+  else
+    fail "out-of-enum confidence in: $(printf '%s' "$BAD_CONF" | tr '\n' ' ')"
+  fi
+
+  OVER_CAP=$(printf '%s' "$OUTPUT" | jq -r '
+    to_entries[]
+    | select((.value.evidenceFiles | length) > 5)
+    | .key' 2>/dev/null)
+  if [ -z "$OVER_CAP" ]; then
+    ok "evidenceFiles capped at 5"
+  else
+    fail "evidenceFiles over cap in: $(printf '%s' "$OVER_CAP" | tr '\n' ' ')"
+  fi
+
+  VM_CONF=$(printf '%s' "$OUTPUT" | jq -r '.stateHolderNaming.confidence' 2>/dev/null)
+  case "$VM_CONF" in
+    high|medium)
+      ok "fixture ViewModels detected (stateHolderNaming confidence: $VM_CONF)" ;;
+    *)
+      fail "expected stateHolderNaming confidence high|medium on 5-example fixture, got: $VM_CONF" ;;
+  esac
+fi
+
+# --- Summary -----------------------------------------------------------------
+echo ""
+TOTAL=$((PASS+FAIL))
+if [ $FAIL -eq 0 ]; then
+  echo "══ extract-conventions smoke: $PASS passed, 0 failed ══"
+  exit 0
+else
+  echo "══ extract-conventions smoke: $PASS passed, $FAIL failed (of $TOTAL) ══" >&2
+  exit 1
+fi

package/pipeline/scripts/smoke-figma-android-parity.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-figma-android-parity.sh — WS-7 contract.
+# smoke-figma-android-parity.sh  -  WS-7 contract.
 #
 # Verifies the Android platform skill tree under pipeline/skills/figma-android/
 # mirrors the iOS peer for every platform-specific skill required by the

package/pipeline/scripts/smoke-figma-credential-store.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-figma-credential-store.sh — drift gate for figma skill Keychain access.
+# smoke-figma-credential-store.sh  -  drift gate for figma skill Keychain access.
 #
 # In v8.3.x the figma skill family was migrated off raw `security` calls and
 # routed through the cross-platform credential helper:
@@ -50,7 +50,7 @@ for rel in "${MIGRATED_FILES[@]}"; do
   abs="$ROOT/$rel"
   base="$(basename "$rel")"
   if [ ! -f "$abs" ]; then
-    record_fail "$base missing — figma skill set drifted out of inventory"
+    record_fail "$base missing  -  figma skill set drifted out of inventory"
     continue
   fi
 
@@ -65,7 +65,7 @@ for rel in "${MIGRATED_FILES[@]}"; do
   # Now look for raw `security {find,add,delete}-generic-password` calls
   # against OUR managed tokens. Anything matching one of these service names
   # is a regression. (Claude Code's own `Claude Code-credentials` entry is
-  # NOT in this list — the figma-setup wizard is allowed to read it.)
+  # NOT in this list  -  the figma-setup wizard is allowed to read it.)
   managed_tokens='FIGMA_ACCESS_TOKEN|FIGMA_MCP_TOKEN|FIGMA_API_USER|JIRA_TOKEN|CONFLUENCE_TOKEN'
   bad=$(grep -nE "security (find|add|delete)-generic-password.*-s [\"']?($managed_tokens)[\"']?" "$abs" 2>/dev/null || true)
   if [ -z "$bad" ]; then

package/pipeline/scripts/smoke-figma-cross-cli-inventory.sh

@@ -1,12 +1,12 @@
 #!/usr/bin/env bash
-# smoke-figma-cross-cli-inventory.sh — enforces the cross-CLI parity
+# smoke-figma-cross-cli-inventory.sh  -  enforces the cross-CLI parity
 # inventory for the v5.0.0 figma-to-component skill set.
 #
 # Source-tree assertions (does not require install.js to have deployed
 # the skills). Complements smoke-cross-cli-behavior.sh (installed-tree)
 # and smoke-commands-skills-parity.sh (multi-agent commands).
 #
-# Contract source of truth: refs/cross-cli-contract.md §1.1.
+# Contract source of truth: refs/cross-cli-contract.md section1.1.
 #
 # Verifies:
 #   1. Every platform-specific figma-android skill exists in figma-ios too.
@@ -44,7 +44,7 @@ PLATFORM_SPECIFIC=(
   figma-component-wiki
 )
 
-# Platform-agnostic (required on at least iOS side today — WS-7b moves to figma-common/)
+# Platform-agnostic (required on at least iOS side today  -  WS-7b moves to figma-common/)
 COMMON_REQUIRED=(
   figma-component-start
   figma-component-confluence-sync
@@ -149,27 +149,27 @@ else
 fi
 
 echo ""
-echo "→ 7. Contract § 1.1 present (figma subphase skills section)"
+echo "→ 7. Contract section 1.1 present (figma subphase skills section)"
 if grep -Fq "1.1 Figma component subphase skills" "$CONTRACT"; then
-  pass "§ 1.1 heading present"
+  pass "section 1.1 heading present"
 else
-  fail "§ 1.1 heading missing"
+  fail "section 1.1 heading missing"
 fi
 
 echo ""
-echo "→ 8. Contract § 1.2 routing rules present"
+echo "→ 8. Contract section 1.2 routing rules present"
 if grep -Fq "1.2 Figma-skill routing from multi-agent" "$CONTRACT"; then
-  pass "§ 1.2 heading present"
+  pass "section 1.2 heading present"
 else
-  fail "§ 1.2 heading missing"
+  fail "section 1.2 heading missing"
 fi
 
 echo ""
-echo "→ 9. Contract § 1.3 frontmatter requirements present"
+echo "→ 9. Contract section 1.3 frontmatter requirements present"
 if grep -Fq "1.3 Figma skill frontmatter" "$CONTRACT"; then
-  pass "§ 1.3 heading present"
+  pass "section 1.3 heading present"
 else
-  fail "§ 1.3 heading missing"
+  fail "section 1.3 heading missing"
 fi
 
 echo ""

package/pipeline/scripts/smoke-figma-dispatch.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# smoke-figma-dispatch.sh — Phase 3 component dispatch contract.
+# smoke-figma-dispatch.sh  -  Phase 3 component dispatch contract.
 #
 # Verifies that multi-agent Phase 3 delegates to the figma-to-component
 # orchestrator (WS-4) instead of embedding figma logic inline.
 #
-# Runs offline — scans docs only, no orchestrator invocation.
+# Runs offline  -  scans docs only, no orchestrator invocation.
 
 set -euo pipefail
 
@@ -25,7 +25,7 @@ fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
 [ -f "$DISPATCH" ] || { echo "error: $DISPATCH missing (WS-4 extracted contract)" >&2; exit 1; }
 [ -f "$ORCH_IOS" ] || { echo "error: orchestrator skill missing at $ORCH_IOS (run WS-2 import first)" >&2; exit 1; }
 
-# Combined scan — both Phase 3 itself and the extracted contract may carry the
+# Combined scan  -  both Phase 3 itself and the extracted contract may carry the
 # canonical strings. Use a function so each check reads both.
 has_in_phase3_or_dispatch() {
   grep -Fq "$1" "$PHASE3" || grep -Fq "$1" "$DISPATCH"
@@ -46,8 +46,8 @@ fi
 
 echo ""
 echo "→ 2. Phase 3 has a component dispatch section"
-if grep -Fq "Component tasks — delegated dispatch" "$PHASE3"; then
-  pass "Phase 3 has 'Component tasks — delegated dispatch' section"
+if grep -Fq "Component tasks  -  delegated dispatch" "$PHASE3"; then
+  pass "Phase 3 has 'Component tasks  -  delegated dispatch' section"
 else
   fail "Phase 3 missing component dispatch section"
 fi

package/pipeline/scripts/smoke-figma-sync.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-figma-sync.sh — WS-9 contract for sync-figma-source.sh.
+# smoke-figma-sync.sh  -  WS-9 contract for sync-figma-source.sh.
 #
 # Verifies:
 #   1. sync script exists + executable.

package/pipeline/scripts/smoke-gate-hooks.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# smoke-gate-hooks.sh  -  the recommended Claude Code hooks template must be
+# valid JSON, wire the secret scan as a PreToolUse hook on git commit, and point
+# at the installed pre-commit-check.sh. This is the one gate that is OS-enforced
+# (a non-zero exit blocks the commit); the template is what makes it real for
+# end users instead of only the maintainer's local settings.
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+TMPL="$ROOT/install/templates/claude-hooks.json"
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+command -v node >/dev/null 2>&1 || { echo "error: node required" >&2; exit 127; }
+
+[ -f "$TMPL" ] || { echo "FAIL: hooks template missing at $TMPL" >&2; exit 1; }
+
+# 1. valid JSON
+if node -e 'JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"))' "$TMPL" 2>/dev/null; then
+  pass "hooks template is valid JSON"
+else
+  fail "hooks template is not valid JSON"
+fi
+
+# 2. wires a PreToolUse hook on git commit -> pre-commit-check.sh
+node -e '
+  const t = JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
+  const pre = t.hooks && t.hooks.PreToolUse;
+  if (!Array.isArray(pre) || pre.length === 0) { console.error("no PreToolUse"); process.exit(1); }
+  const onCommit = pre.find(h => /git commit/.test(h.matcher || ""));
+  if (!onCommit) { console.error("no git-commit matcher"); process.exit(1); }
+  const cmds = (onCommit.hooks || []).map(h => h.command || "").join(" ");
+  if (!/pre-commit-check\.sh/.test(cmds)) { console.error("does not call pre-commit-check.sh"); process.exit(1); }
+' "$TMPL" 2>/dev/null && pass "template wires secret scan as PreToolUse on git commit" || fail "template does not wire the secret-scan hook"
+
+# 3. the referenced script exists in the source tree
+if [ -f "$ROOT/pipeline/scripts/pre-commit-check.sh" ]; then
+  pass "pre-commit-check.sh exists to back the hook"
+else
+  fail "pre-commit-check.sh missing"
+fi
+
+# 4. picker-contract documents the hook template + the phase-enforced caveat
+PC="$ROOT/pipeline/commands/multi-agent/refs/picker-contract.md"
+if grep -q "claude-hooks.json" "$PC" && grep -q "phase-enforced" "$PC"; then
+  pass "picker-contract references the template + the phase-enforced gates caveat"
+else
+  fail "picker-contract does not document the hooks template honestly"
+fi
+
+echo ""
+echo "══ gate-hooks smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-gc-tmp.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# smoke-gc-tmp.sh  -  gc-tmp.sh sweeps only known scratch prefixes, is dry-run
+# by default, and never touches unrelated files.
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+GC="$ROOT/pipeline/scripts/gc-tmp.sh"
+PASS=0
+FAIL=0
+pass() {
+  PASS=$((PASS + 1))
+  echo "  ✓ $1"
+}
+fail() {
+  FAIL=$((FAIL + 1))
+  echo "  ✗ $1"
+}
+[ -f "$GC" ] || {
+  echo "FAIL: gc-tmp.sh missing" >&2
+  exit 1
+}
+
+SB="$(mktemp -d)"
+trap 'rm -rf "$SB"' EXIT
+
+seed() {
+  rm -rf "${SB:?}"/*
+  mkdir -p "$SB/multi-agent-review-PROJ-1-x" "$SB/analysis-foo-123"
+  touch "$SB/multi-agent-picker-PROJ-1.json" \
+    "$SB/issue-progress-PROJ-1-ab.md" \
+    "$SB/channels-PROJ-1-pr.md" \
+    "$SB/context-links-PROJ-1.json" \
+    "$SB/context-by-type-PROJ-1.json" \
+    "$SB/unrelated-file.txt"
+}
+
+echo "→ 1. dry-run lists matches and deletes nothing"
+seed
+before=$(find "$SB" -mindepth 1 | wc -l | tr -d ' ')
+out=$(GC_TMP_ROOT="$SB" bash "$GC" 2>&1)
+after=$(find "$SB" -mindepth 1 | wc -l | tr -d ' ')
+echo "$out" | grep -q "DRY-RUN" && pass "dry-run banner shown" || fail "dry-run banner missing"
+[ "$before" = "$after" ] && pass "dry-run deleted nothing ($after entries intact)" || fail "dry-run changed the tree ($before -> $after)"
+echo "$out" | grep -q "unrelated-file.txt" && fail "dry-run matched an unrelated file" || pass "unrelated file not matched"
+
+echo ""
+echo "→ 2. --yes removes only matched scratch"
+seed
+GC_TMP_ROOT="$SB" bash "$GC" --yes >/dev/null 2>&1
+[ -f "$SB/unrelated-file.txt" ] && pass "unrelated file preserved" || fail "unrelated file was deleted"
+[ ! -e "$SB/multi-agent-picker-PROJ-1.json" ] && pass "multi-agent-* file removed" || fail "multi-agent-* file survived"
+[ ! -e "$SB/multi-agent-review-PROJ-1-x" ] && pass "scratch dir removed" || fail "scratch dir survived"
+[ ! -e "$SB/analysis-foo-123" ] && pass "analysis draft dir removed" || fail "analysis draft survived"
+[ ! -e "$SB/channels-PROJ-1-pr.md" ] && pass "channels payload removed" || fail "channels payload survived"
+remaining=$(find "$SB" -mindepth 1 | wc -l | tr -d ' ')
+[ "$remaining" = "1" ] && pass "exactly the 1 unrelated entry remains" || fail "expected 1 survivor, got $remaining"
+
+echo ""
+echo "→ 3. --older-than excludes fresh scratch"
+seed
+out=$(GC_TMP_ROOT="$SB" bash "$GC" --older-than=1 2>&1)
+echo "$out" | grep -q "nothing to do" && pass "freshly-created scratch excluded by --older-than=1" || fail "--older-than did not exclude fresh files"
+
+echo ""
+echo "→ 4. usage errors exit 2"
+GC_TMP_ROOT="$SB" bash "$GC" --bogus >/dev/null 2>&1
+[ "$?" = "2" ] && pass "unknown argument exits 2" || fail "unknown argument did not exit 2"
+GC_TMP_ROOT="$SB" bash "$GC" --older-than=abc >/dev/null 2>&1
+[ "$?" = "2" ] && pass "non-numeric --older-than exits 2" || fail "bad --older-than did not exit 2"
+
+echo ""
+echo "→ 5. empty root is a clean no-op"
+EMPTY="$(mktemp -d)"
+out=$(GC_TMP_ROOT="$EMPTY" bash "$GC" 2>&1)
+rc=$?
+rm -rf "$EMPTY"
+{ [ "$rc" = "0" ] && echo "$out" | grep -q "nothing to do"; } && pass "empty root exits 0 with no-op message" || fail "empty root not a clean no-op"
+
+echo ""
+echo "══ gc-tmp smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]