@mmerterden/multi-agent-pipeline 8.6.2 → 10.0.6

package/pipeline/scripts/smoke-metrics-cache-ratio.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# smoke-metrics-cache-ratio.sh  -  aggregate-metrics.mjs surfaces prompt-cache
+# reuse. The data path (log-metric.sh accepts tokens_cached) already exists; this
+# guards that the aggregator actually reads and reports it per model + overall,
+# in all three output modes (json / markdown / text).
+#
+# Exit 0 = all pass, 1 = any failure.
+
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+AGG="$ROOT/pipeline/scripts/aggregate-metrics.mjs"
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
+command -v node >/dev/null 2>&1 || { echo "error: node required" >&2; exit 127; }
+[ -f "$AGG" ] || { echo "FAIL: aggregate-metrics.mjs missing" >&2; exit 1; }
+
+cleanup() { [ -n "${TMP:-}" ] && rm -rf "$TMP"; }
+trap cleanup EXIT
+TMP=$(mktemp -d)
+
+FIX="$TMP/metrics.jsonl"
+# opus: 80k fresh input + 20k cached = cache_ratio 0.20
+# sonnet: 50k fresh input + 50k cached = cache_ratio 0.50
+# overall: 30k cached / (130k in + 30k... ) -> computed below by the script.
+{
+  echo '{"ts":"2026-06-19T10:00:00Z","task_id":"T-1","phase":"4","event":"review.completed","details":{"model":"opus","tokens_in":80000,"tokens_out":4000,"tokens_cached":20000}}'
+  echo '{"ts":"2026-06-19T10:01:00Z","task_id":"T-1","phase":"3","event":"dev.completed","details":{"model":"sonnet","tokens_in":50000,"tokens_out":6000,"tokens_cached":50000}}'
+} > "$FIX"
+
+echo "→ 1. JSON: per-model cache_ratio computed"
+out=$(METRICS_FILE="$FIX" node "$AGG" --json 2>/dev/null)
+check_json() { if node -e "const s=require('$TMP/out.json'); process.exit($1?0:1)" 2>/dev/null; then pass "$2"; else fail "$2"; fi; }
+printf '%s' "$out" > "$TMP/out.json"
+check_json 's.cost_per_model.opus.tokens_cached===20000' "opus cached tokens summed"
+check_json 's.cost_per_model.opus.cache_ratio===0.2' "opus cache_ratio = 0.20 (20k/100k)"
+check_json 's.cost_per_model.sonnet.cache_ratio===0.5' "sonnet cache_ratio = 0.50 (50k/100k)"
+
+echo ""
+echo "→ 2. JSON: overall cache_reuse block"
+check_json 's.cache_reuse.tokens_cached===70000' "overall cached = 70k"
+check_json 's.cache_reuse.tokens_in===130000' "overall fresh input = 130k"
+check_json 's.cache_reuse.cache_ratio===0.35' "overall cache_ratio = 0.35 (70k/200k)"
+
+echo ""
+echo "→ 3. markdown + text modes render cache column"
+md=$(METRICS_FILE="$FIX" node "$AGG" --markdown 2>/dev/null)
+case "$md" in *"Cache %"*) pass "markdown has Cache % column" ;; *) fail "markdown missing Cache % column" ;; esac
+case "$md" in *"prompt-cache reuse"*) pass "markdown has overall reuse line" ;; *) fail "markdown missing overall reuse line" ;; esac
+txt=$(METRICS_FILE="$FIX" node "$AGG" 2>/dev/null)
+case "$txt" in *"cache%"*) pass "text has cache% column" ;; *) fail "text missing cache% column" ;; esac
+case "$txt" in *"overall prompt-cache reuse"*) pass "text has overall reuse line" ;; *) fail "text missing overall reuse line" ;; esac
+
+echo ""
+echo "→ 4. no-cache data: ratio is 0% (input but no cache), null only when no input"
+NOFIX="$TMP/nocache.jsonl"
+{
+  # has input, zero cache -> ratio 0.00 (meaningful: 0% cache hit)
+  echo '{"ts":"2026-06-19T10:00:00Z","task_id":"T-2","phase":"4","event":"review.completed","details":{"model":"haiku","tokens_in":1000,"tokens_out":100}}'
+  # model tagged but no token counts at all -> denom 0 -> ratio null (not NaN)
+  echo '{"ts":"2026-06-19T10:00:01Z","task_id":"T-2","phase":"0","event":"init.completed","details":{"model":"none"}}'
+} > "$NOFIX"
+nout=$(METRICS_FILE="$NOFIX" node "$AGG" --json 2>/dev/null)
+printf '%s' "$nout" > "$TMP/out.json"
+check_json 's.cost_per_model.haiku.tokens_cached===0' "absent cached defaults to 0"
+check_json 's.cost_per_model.haiku.cache_ratio===0' "input-but-no-cache ratio is 0 (0% hit)"
+check_json 's.cost_per_model.none.cache_ratio===null' "no-input model ratio is null (not NaN)"
+
+echo ""
+echo "══ metrics cache-ratio smoke: $PASS passed, $FAIL failed ══"
+[ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-migrate-state.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# smoke-migrate-state.sh — verify migrate-state.mjs behavior with synthetic
-# migrations. Does not depend on any real migration file existing — it lays
+# smoke-migrate-state.sh  -  verify migrate-state.mjs behavior with synthetic
+# migrations. Does not depend on any real migration file existing  -  it lays
 # one down in a temp dir and points the runner at a fixture.
 
 set -uo pipefail
@@ -21,7 +21,7 @@ fail() { FAIL=$((FAIL+1)); echo "  ✗ $1"; }
 TMPDIR=$(mktemp -d) || { echo "FAIL: mktemp" >&2; exit 1; }
 trap 'rm -rf "$TMPDIR"' EXIT
 
-# Test 1 — file at current version exits 0, no migration needed
+# Test 1  -  file at current version exits 0, no migration needed
 cat > "$TMPDIR/agent-state.json" <<'EOF'
 {"schemaVersion":"2.1.0","foo":"bar"}
 EOF
@@ -32,7 +32,7 @@ else
   fail "current-version file should be a no-op (got: $OUT)"
 fi
 
-# Test 2 — missing schemaVersion exits 1
+# Test 2  -  missing schemaVersion exits 1
 echo '{"foo":"bar"}' > "$TMPDIR/bad.json"
 node "$RUNNER" --type=state "$TMPDIR/bad.json" 2>/dev/null
 if [ $? -eq 1 ]; then
@@ -41,7 +41,7 @@ else
   fail "missing schemaVersion did not exit 1"
 fi
 
-# Test 3 — invalid JSON exits 1
+# Test 3  -  invalid JSON exits 1
 echo 'not-json' > "$TMPDIR/junk.json"
 node "$RUNNER" --type=state "$TMPDIR/junk.json" 2>/dev/null
 if [ $? -eq 1 ]; then
@@ -50,7 +50,7 @@ else
   fail "invalid JSON did not exit 1"
 fi
 
-# Test 4 — missing file exits 1
+# Test 4  -  missing file exits 1
 node "$RUNNER" --type=state "$TMPDIR/does-not-exist.json" 2>/dev/null
 if [ $? -eq 1 ]; then
   pass "missing file exits 1"
@@ -58,7 +58,7 @@ else
   fail "missing file did not exit 1"
 fi
 
-# Test 5 — no migration path (older version than any migration)
+# Test 5  -  no migration path (older version than any migration)
 echo '{"schemaVersion":"0.1.0"}' > "$TMPDIR/ancient.json"
 node "$RUNNER" --type=state "$TMPDIR/ancient.json" 2>/dev/null
 if [ $? -eq 2 ]; then
@@ -67,7 +67,7 @@ else
   fail "no migration path did not exit 2"
 fi
 
-# Test 6 — unknown flag exits 1
+# Test 6  -  unknown flag exits 1
 node "$RUNNER" --nonsense "$TMPDIR/agent-state.json" 2>/dev/null
 if [ $? -eq 1 ]; then
   pass "unknown flag exits 1"
@@ -75,7 +75,7 @@ else
   fail "unknown flag did not exit 1"
 fi
 
-# Test 7 — type auto-detection works
+# Test 7  -  type auto-detection works
 cat > "$TMPDIR/multi-agent-preferences.json" <<'EOF'
 {"schemaVersion":"2.3.0","global":{"identities":[],"keychainMapping":{},"recentAccounts":[],"accounts":[]},"projects":{}}
 EOF
@@ -86,7 +86,7 @@ else
   fail "prefs auto-detection failed (got: $OUT)"
 fi
 
-# Test 8 — ambiguous path requires --type
+# Test 8  -  ambiguous path requires --type
 cat > "$TMPDIR/ambig.json" <<'EOF'
 {"schemaVersion":"2.0.0"}
 EOF

package/pipeline/scripts/smoke-mode-dispatch-drift.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# smoke-mode-dispatch-drift.sh — assert each mode dispatch file's tracker
+# smoke-mode-dispatch-drift.sh  -  assert each mode dispatch file's tracker
 # section is consistent with the canonical generator output.
 #
 # Each mode dispatch file (dev.md, dev-autopilot.md, dev-local.md,
@@ -95,9 +95,12 @@ for f in "${MODE_FAST_NO_TEST[@]}"; do
 done
 
 echo ""
-echo "→ 3. Full-mode files (autopilot/local) declare all 8 phases"
+echo "→ 3. Autopilot/local full-pipeline files declare 7 phases (skip User Test)"
+# Phase 5 (User Test) needs an interactive prompt AND a worktree checkout, so it
+# runs only in the interactive worktree-backed modes (dev, full). Every autopilot
+# or local variant drops it.
 for f in "${MODE_FULL[@]}"; do
-  assert_phases "$f" "0:Init" "1:Analysis" "2:Planning" "3:Dev" "4:Review" "5:Test" "6:Commit" "7:Report"
+  assert_phases "$f" "0:Init" "1:Analysis" "2:Planning" "3:Dev" "4:Review" "6:Commit" "7:Report"
 done
 
 echo ""
@@ -117,7 +120,7 @@ for mode in dev dev-autopilot dev-local dev-local-autopilot autopilot full local
 done
 
 if node "$GEN" --mode=bogus >/dev/null 2>&1; then
-  fail "gen-mode-dispatch.mjs accepted unknown mode 'bogus' — exit guard missing"
+  fail "gen-mode-dispatch.mjs accepted unknown mode 'bogus'  -  exit guard missing"
 else
   pass "gen-mode-dispatch.mjs rejects unknown mode (exit 2)"
 fi

package/pipeline/scripts/smoke-model-fallback.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# smoke-model-fallback.sh  -  lint the model fallback contract wiring (v9.10.1).
+# The contract lets fable-personas degrade to opus on a plan-window date gate,
+# a dispatch error, or a budget ceiling - via PHASE_MODEL_OVERRIDE, never by
+# editing persona files. This smoke asserts the doc, the prefs knob, and the
+# phase wiring all exist and agree. No network, no credentials.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+DOC="$REPO_ROOT/pipeline/commands/multi-agent/refs/features/model-fallback.md"
+TEMPLATE="$REPO_ROOT/pipeline/preferences-template.json"
+P0="$REPO_ROOT/pipeline/commands/multi-agent/refs/phases/phase-0-init.md"
+P4="$REPO_ROOT/pipeline/commands/multi-agent/refs/phases/phase-4-review.md"
+
+PASS=0
+FAIL=0
+ok()   { PASS=$((PASS+1)); echo "  ✓ $1"; }
+fail() { FAIL=$((FAIL+1)); echo "  ✗ $1" >&2; }
+
+echo "→ 1. Contract doc exists and covers the three triggers"
+if [ -f "$DOC" ]; then
+  ok "model-fallback.md present"
+  grep -q "premiumTierUntil" "$DOC" && ok "doc documents premiumTierUntil date gate" || fail "doc missing premiumTierUntil"
+  grep -q "onDispatchError" "$DOC" && ok "doc documents dispatch-error retry" || fail "doc missing onDispatchError"
+  grep -q "cost-budget-check" "$DOC" && ok "doc documents budget-ceiling trigger" || fail "doc missing budget trigger"
+  grep -q "PHASE_MODEL_OVERRIDE" "$DOC" && ok "doc uses the existing override mechanism" || fail "doc missing PHASE_MODEL_OVERRIDE"
+  grep -q "fable -> opus -> sonnet" "$DOC" && ok "tier ladder declared" || fail "tier ladder missing"
+else
+  fail "model-fallback.md missing"
+fi
+
+echo "→ 2. Prefs template carries the knob with safe defaults"
+if command -v python3 >/dev/null 2>&1; then
+  RESULT=$(python3 - "$TEMPLATE" <<'PYEOF'
+import json, sys
+t = json.load(open(sys.argv[1]))
+mf = t.get("global", {}).get("modelFallback")
+if not isinstance(mf, dict):
+    print("missing"); raise SystemExit
+checks = [
+    mf.get("enabled") is True,
+    "premiumTierUntil" in mf and mf["premiumTierUntil"] is None,
+    mf.get("fallbackModel") == "opus",
+    mf.get("onDispatchError") is True,
+]
+print("ok" if all(checks) else "bad-defaults")
+PYEOF
+)
+  case "$RESULT" in
+    ok) ok "template modelFallback knob present with safe defaults" ;;
+    missing) fail "template missing global.modelFallback" ;;
+    *) fail "template modelFallback defaults wrong ($RESULT)" ;;
+  esac
+else
+  echo "  (python3 unavailable - template check skipped)"
+fi
+
+echo "→ 3. Phase wiring references the contract"
+grep -q "model-fallback.md" "$P0" && ok "phase-0-init wires the date gate" || fail "phase-0-init missing fallback wiring"
+grep -q "model-fallback.md" "$P4" && ok "phase-4-review wires the per-dispatch triggers" || fail "phase-4-review missing fallback wiring"
+
+echo "→ 4. Personas keep fable as preferred (fallback is dispatch-time, not file-time)"
+FABLE_COUNT=$(grep -l "^preferredModel: fable" "$REPO_ROOT"/pipeline/agents/*.md 2>/dev/null | wc -l | tr -d ' ')
+if [ "$FABLE_COUNT" -ge 5 ]; then
+  ok "fable personas intact ($FABLE_COUNT files)"
+else
+  fail "expected >=5 fable personas, found $FABLE_COUNT"
+fi
+
+echo ""
+TOTAL=$((PASS+FAIL))
+if [ $FAIL -eq 0 ]; then
+  echo "══ model-fallback smoke: $PASS passed, 0 failed ══"
+  exit 0
+else
+  echo "══ model-fallback smoke: $PASS passed, $FAIL failed (of $TOTAL) ══" >&2
+  exit 1
+fi

package/pipeline/scripts/smoke-multi-repo-integration.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-multi-repo-integration.sh — verify v5.6.0 multi-repo integration-build
+# smoke-multi-repo-integration.sh  -  verify v5.6.0 multi-repo integration-build
 # contract: prefs schema accepts valid entries, rejects malformed ones, and the
 # contract doc ships with the required sections (lookup logic, learn-once
 # prompt, autopilot refuse-to-prompt, autopilot refuse-to-prompt behavior).
@@ -54,7 +54,7 @@ grep -qE "phase-tracker\.sh sub 6 0" "$DOC" && pass "doc wires tracker sub-step"
 echo ""
 echo "→ 4. phase-6-commit.md references the new Step 0"
 PHASE6="$ROOT/pipeline/commands/multi-agent/refs/phases/phase-6-commit.md"
-grep -q "Step 0 — Multi-Repo Integration Build" "$PHASE6" \
+grep -q "Step 0  -  Multi-Repo Integration Build" "$PHASE6" \
   && pass "phase-6-commit has Step 0 entry" || fail "phase-6-commit missing Step 0"
 grep -q "multi-repo-integration-build.md" "$PHASE6" \
   && pass "phase-6-commit links the contract doc" || fail "phase-6-commit missing contract link"
@@ -66,7 +66,7 @@ echo "→ 5. generateCopilotInstructions includes the generic rule"
 # install/_copilot-instructions.mjs. The grep target is the source-of-truth
 # Markdown file.
 INSTALL_TPL="$ROOT/install/templates/copilot-instructions.md"
-[ -f "$INSTALL_TPL" ] || fail "install/templates/copilot-instructions.md missing — v8.0.0 generator template missing"
+[ -f "$INSTALL_TPL" ] || fail "install/templates/copilot-instructions.md missing  -  v8.0.0 generator template missing"
 grep -q "Post-Development Integration Build (Multi-Repo)" "$INSTALL_TPL" \
   && pass "generator template includes generic rule heading" || fail "generator template missing generic rule"
 grep -q "multiRepoIntegrationHosts" "$INSTALL_TPL" \

package/pipeline/scripts/smoke-multi-repo-worktree.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-multi-repo-worktree.sh — asserts Phase 3 multi-repo dev contract is
+# smoke-multi-repo-worktree.sh  -  asserts Phase 3 multi-repo dev contract is
 # documented correctly. Doc-shape smoke (no actual git ops).
 
 set -uo pipefail

package/pipeline/scripts/smoke-no-mcp-in-dev-phases.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+#
+# smoke-no-mcp-in-dev-phases.sh
+#
+# Gate: pipeline run telemetry must not contain MCP calls outside Phase 1
+# (Analysis). Per Locked decision 30, MCP usage is permitted only during
+# Phase 1; any entry in state.telemetry.mcpCalls[] with phase >= 2 is a
+# violation.
+#
+# Inputs
+#   --state-file <path>   Optional override (default: ~/.claude/state/run/latest.json)
+#
+# Outcomes
+#   - State file missing      -> WARN, exit 0 (no run to check)
+#   - telemetry.mcpCalls field absent -> PASS, exit 0 (older run, no telemetry)
+#   - All entries phase < 2   -> PASS, exit 0
+#   - One or more violations  -> FAIL summary on stdout, exit 1
+#
+# stdout: human-readable summary only. stderr: empty in normal operation.
+
+set -euo pipefail
+
+STATE_FILE="${HOME}/.claude/state/run/latest.json"
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --state-file)
+      shift
+      if [ "$#" -eq 0 ]; then
+        echo "FAIL: --state-file requires a path argument"
+        exit 2
+      fi
+      STATE_FILE="$1"
+      shift
+      ;;
+    --state-file=*)
+      STATE_FILE="${1#--state-file=}"
+      shift
+      ;;
+    -h|--help)
+      echo "Usage: $0 [--state-file <path>]"
+      echo ""
+      echo "Default state file: ~/.claude/state/run/latest.json"
+      exit 0
+      ;;
+    *)
+      echo "FAIL: unknown argument: $1"
+      exit 2
+      ;;
+  esac
+done
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "FAIL: jq is required but not installed"
+  exit 2
+fi
+
+if [ ! -f "$STATE_FILE" ]; then
+  echo "WARN: state file not found at $STATE_FILE - no run to check"
+  exit 0
+fi
+
+# Validate JSON parse first; corrupt state cannot be silently passed.
+if ! jq empty "$STATE_FILE" >/dev/null 2>&1; then
+  echo "FAIL: state file is not valid JSON: $STATE_FILE"
+  exit 2
+fi
+
+# If telemetry.mcpCalls is absent or not an array, this is an older state
+# format that did not record MCP usage. PASS by contract.
+HAS_FIELD=$(jq -r '
+  if (.telemetry // empty) | type == "object"
+  then
+    if (.telemetry.mcpCalls // empty) | type == "array" then "yes" else "no" end
+  else "no" end
+' "$STATE_FILE")
+
+if [ "$HAS_FIELD" != "yes" ]; then
+  echo "PASS: telemetry.mcpCalls field absent - no MCP usage recorded"
+  exit 0
+fi
+
+# Count total entries and violations (phase >= 2).
+TOTAL=$(jq -r '.telemetry.mcpCalls | length' "$STATE_FILE")
+VIOLATIONS=$(jq -r '
+  .telemetry.mcpCalls
+  | map(select((.phase // 0) >= 2))
+  | length
+' "$STATE_FILE")
+
+if [ "$VIOLATIONS" -eq 0 ]; then
+  if [ "$TOTAL" -eq 0 ]; then
+    echo "PASS: no MCP calls outside Phase 1 (Analysis) - 0 entries"
+  else
+    echo "PASS: no MCP calls outside Phase 1 (Analysis) - ${TOTAL} entries, all in Phase 1"
+  fi
+  exit 0
+fi
+
+# Emit FAIL summary with up to first 5 offenders.
+echo "FAIL: ${VIOLATIONS} MCP call(s) outside Phase 1 (Analysis) - Locked decision 30 violation"
+echo ""
+echo "First $([ "$VIOLATIONS" -lt 5 ] && echo "$VIOLATIONS" || echo 5) violation(s):"
+
+jq -r '
+  .telemetry.mcpCalls
+  | map(select((.phase // 0) >= 2))
+  | .[0:5]
+  | .[]
+  | "  FAIL: MCP call \(.tool // "<unknown>") in Phase \(.phase) at \(.timestamp // "<no timestamp>") - Locked decision 30 violation"
+' "$STATE_FILE"
+
+echo ""
+echo "Total violations: ${VIOLATIONS} of ${TOTAL} entries"
+exit 1

package/pipeline/scripts/smoke-no-token-prompt.sh

@@ -41,25 +41,41 @@ TARGET_GLOB=(
   "commands/multi-agent/autopilot.md"
 )
 
+# Build a single grep invocation: all patterns via repeated -e flags,
+# all target globs expanded once. Drops 7x7=49 grep subprocesses down to 1.
+GREP_PATTERN_ARGS=()
 for pattern in "${PATTERNS[@]}"; do
-  for glob in "${TARGET_GLOB[@]}"; do
-    while IFS= read -r match; do
-      [ -z "$match" ] && continue
-      file="${match%%:*}"
-      # Allowlist: setup.md and setup-related files explicitly handle token entry
-      # via the inline Token Save Flow (clipboard-based, not chat).
-      case "$file" in
-        */setup.md|*setup-token-flow*|*credential-store*) continue ;;
-      esac
-      # Allowlist: explicit `# allow: token-prompt` annotation on the line.
-      if echo "$match" | grep -q '# allow: token-prompt'; then continue; fi
-      echo "FAIL [smoke-no-token-prompt]: token prompt found in $file"
-      echo "  $match"
-      FAIL=$((FAIL + 1))
-    done < <(grep -rEn "$pattern" "pipeline/$glob" 2>/dev/null || true)
+  GREP_PATTERN_ARGS+=(-e "$pattern")
+done
+
+# Expand all target globs to actual paths once. Globs that don't match are
+# silently dropped so the single grep call sees only existing files.
+TARGET_PATHS=()
+for glob in "${TARGET_GLOB[@]}"; do
+  for path in pipeline/$glob; do
+    [ -e "$path" ] && TARGET_PATHS+=("$path")
   done
 done
 
+if [ "${#TARGET_PATHS[@]}" -gt 0 ]; then
+  while IFS= read -r match; do
+    [ -z "$match" ] && continue
+    file="${match%%:*}"
+    # Allowlist: setup.md and setup-related files explicitly handle token entry
+    # via the inline Token Save Flow (clipboard-based, not chat).
+    case "$file" in
+      */setup.md|*setup-token-flow*|*credential-store*) continue ;;
+    esac
+    # Allowlist: explicit `# allow: token-prompt` annotation on the line.
+    case "$match" in
+      *'# allow: token-prompt'*) continue ;;
+    esac
+    echo "FAIL [smoke-no-token-prompt]: token prompt found in $file"
+    echo "  $match"
+    FAIL=$((FAIL + 1))
+  done < <(grep -rEn "${GREP_PATTERN_ARGS[@]}" "${TARGET_PATHS[@]}" 2>/dev/null || true)
+fi
+
 if [ "$FAIL" -gt 0 ]; then
   echo ""
   echo "smoke-no-token-prompt: $FAIL violation(s). Tokens must be resolved via credential-store.sh; see refs/keychain.md Rule 1."

package/pipeline/scripts/smoke-pat-audit.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# smoke-pat-audit.sh — exercises audit-log.sh + audit-log-rotate.sh and
-# asserts the §18.2 contract:
+# smoke-pat-audit.sh  -  exercises audit-log.sh + audit-log-rotate.sh and
+# asserts the section18.2 contract:
 #
 #   • Every PAT lookup writes a structured event to audit.jsonl
 #   • Repo URLs are SHA-256 hashed (no plaintext)
-#   • Identity is logged by name (NOT anonymized — user's own debug)
+#   • Identity is logged by name (NOT anonymized  -  user's own debug)
 #   • Audit log is gitignored
 #   • Daily rotation script preserves history (gzipped) + drops >30d archives
 
@@ -47,7 +47,7 @@ echo "$LINE" | grep -q "bitbucket.example.com" \
   || pass "Plaintext URL absent (only hash present)"
 
 echo ""
-echo "→ 3. Identity is logged by name (per §18.2.3 — not anonymized)"
+echo "→ 3. Identity is logged by name (per section18.2.3  -  not anonymized)"
 echo "$LINE" | grep -q "\"identity\":\"$TEST_IDENTITY\"" \
   && pass "identity logged as plaintext name" \
   || fail "identity not logged or anonymized"
@@ -89,9 +89,11 @@ ROTATED=$(find "$TMP_AUDIT" -name 'audit.*.jsonl*' -type f 2>/dev/null | head -1
   || fail "live audit.jsonl not properly truncated"
 
 echo ""
-echo "→ 9. .gitignore covers audit logs (sensitive — never sync upstream)"
+echo "→ 9. .gitignore covers audit logs (sensitive  -  never sync upstream)"
+SMOKE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 GITIGNORES=(
   "$HOME/.claude/.gitignore"
+  "$SMOKE_DIR/../../.gitignore"
   "$HOME/multi-agent-pipeline/.gitignore"
 )
 GITIGNORE_OK=false
@@ -102,6 +104,25 @@ $GITIGNORE_OK \
   && pass ".gitignore covers audit.jsonl / logs/multi-agent" \
   || fail ".gitignore does NOT cover audit logs (sensitive!)"
 
+echo ""
+echo "→ 10. Quote-bearing fields are JSON-escaped (no malformed lines)"
+REPO_LOG="$(cd "$(dirname "$0")" && pwd)/audit-log.sh"
+ESC_FILE="$TMP_AUDIT/escape.jsonl"
+AUDIT_FILE="$ESC_FILE" bash "$REPO_LOG" \
+  'pat_"lookup' 'bit"bucket' 'evil" ,"injected":"x' \
+  "https://x.example/r" true 'rea"son=quote'
+ESC_LINE=$(tail -1 "$ESC_FILE")
+if printf '%s' "$ESC_LINE" | python3 -c 'import json,sys; json.loads(sys.stdin.read())' 2>/dev/null; then
+  pass "line with embedded double-quotes parses as valid JSON"
+else
+  fail "embedded quotes produced malformed JSON: $ESC_LINE"
+fi
+if printf '%s' "$ESC_LINE" | python3 -c 'import json,sys; d=json.load(sys.stdin); sys.exit(0 if "injected" not in d else 1)' 2>/dev/null; then
+  pass "quote in field value did not inject a sibling JSON key"
+else
+  fail "quote in field value injected an extra top-level key"
+fi
+
 echo ""
 echo "══ pat-audit smoke: $PASS passed, $FAIL failed ══"
 [ "$FAIL" -eq 0 ]

package/pipeline/scripts/smoke-per-repo-memory.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-per-repo-memory.sh — v6.2.E
+# smoke-per-repo-memory.sh  -  v6.2.E
 #
 # Verifies the per-repo memory layer contract:
 #   1. memory-load.sh exits silently when pref is off

package/pipeline/scripts/smoke-phase-0-multi-repo.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-phase-0-multi-repo.sh — asserts the v2.1.0+ multi-repo + identity-routing
+# smoke-phase-0-multi-repo.sh  -  asserts the v2.1.0+ multi-repo + identity-routing
 # + fetch-fail contract is fully documented in phase-0-init.md.
 #
 # This is a doc-shape smoke (Phase 0 is spec-driven; the executable behavior

package/pipeline/scripts/smoke-phase-6-multi.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-phase-6-multi.sh — asserts Phase 6 multi-repo commit + per-repo PR
+# smoke-phase-6-multi.sh  -  asserts Phase 6 multi-repo commit + per-repo PR
 # + cross-link contract is documented.
 
 set -uo pipefail
@@ -47,7 +47,7 @@ grep -q "gh pr edit --body-file" "$PHASE6" \
   && pass "GitHub gh pr edit for sibling-link update" \
   || fail "GitHub PR update command missing"
 
-echo "→ 4. GitHub issue body — multi-repo PR list"
+echo "→ 4. GitHub issue body  -  multi-repo PR list"
 grep -q "one row per repo" "$PHASE6" \
   && pass "Issue body lists one row per repo" \
   || fail "Issue body multi-repo expansion missing"

package/pipeline/scripts/smoke-phase-banner.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-phase-banner.sh — contract check for phase-banner.sh.
+# smoke-phase-banner.sh  -  contract check for phase-banner.sh.
 #
 # Verifies:
 #   1. start/end/sub render with phase + name

package/pipeline/scripts/smoke-phase-tracker.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# smoke-phase-tracker.sh — contract check for phase-tracker.sh.
+# smoke-phase-tracker.sh  -  contract check for phase-tracker.sh.
 #
 # Verifies state file shape, status transitions, sub-phase add/update,
 # enum enforcement, render output structure, and that the .tracker-current

package/pipeline/scripts/smoke-phase0-bridge-contract.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-# smoke-phase0-bridge-contract.sh — verify the agent-state.json produced by
+# smoke-phase0-bridge-contract.sh  -  verify the agent-state.json produced by
 # `multi-repo-pipeline.sh bridge` satisfies every field that Phase 0 (and the
 # downstream phases) read from it.
 #
 # Without this gate, a bridge schema bump could leave Phase 0 reading
-# undefined fields silently — the picker → Phase 0 handoff is the seam where
+# undefined fields silently  -  the picker → Phase 0 handoff is the seam where
 # multi-repo state changes from the picker world to the pipeline runtime.
 #
 # Live multi-repo E2E (real branch, real PR) cannot run in CI, so this
@@ -31,7 +31,7 @@ MRP="$LIB_DIR/multi-repo-pipeline.sh"
 [ -x "$MRP" ] || { fail "multi-repo-pipeline.sh not executable"; exit 2; }
 [ -f "$SCHEMA" ] || { fail "agent-state.schema.json missing"; exit 2; }
 
-# Need jsonschema for full validation — fall back to shape check if unavailable.
+# Need jsonschema for full validation  -  fall back to shape check if unavailable.
 HAS_JSONSCHEMA=0
 python3 -c "import jsonschema" 2>/dev/null && HAS_JSONSCHEMA=1
 
@@ -89,7 +89,7 @@ print("VALID")
     fail "schema validation failed: $out"
   fi
 else
-  echo "  (skipping — jsonschema not installed)"
+  echo "  (skipping  -  jsonschema not installed)"
 fi
 
 echo "→ 3. Phase 0 required-field contract"