shipwright-cli 2.2.1 → 2.3.0

package/scripts/sw-quality.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-reaper.sh

@@ -11,7 +11,7 @@
 # ║    shipwright reaper --watch      Continuous loop (default: 5s)         ║
 # ║    shipwright reaper --dry-run    Preview what would be reaped          ║
 # ╚═══════════════════════════════════════════════════════════════════════════╝
-VERSION="2.2.1"
+VERSION="2.3.0"
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 

package/scripts/sw-recruit.sh

@@ -284,7 +284,16 @@ initialize_builtin_roles() {
 }
 EOF
 )
-    echo "$roles_json" | jq '.' > "$ROLES_DB"
+    local _tmp_roles
+    _tmp_roles=$(mktemp)
+    trap "rm -f '$_tmp_roles'" RETURN
+    if echo "$roles_json" | jq '.' > "$_tmp_roles" 2>/dev/null && [[ -s "$_tmp_roles" ]]; then
+        mv "$_tmp_roles" "$ROLES_DB"
+    else
+        rm -f "$_tmp_roles"
+        error "Failed to initialize roles DB"
+        return 1
+    fi
     success "Initialized 10 built-in agent roles"
 }
 
@@ -418,6 +427,7 @@ _recruit_record_match() {
     if [[ "$current_lines" -gt "$max_history" ]]; then
         local tmp_trunc
         tmp_trunc=$(mktemp)
+        trap "rm -f '$tmp_trunc'" RETURN
         tail -n "$max_history" "$MATCH_HISTORY" > "$tmp_trunc" && _recruit_locked_write "$MATCH_HISTORY" "$tmp_trunc" || rm -f "$tmp_trunc"
     fi
 
@@ -484,6 +494,7 @@ Return JSON only."
             # Persist to roles DB
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
             if jq --arg key "$role_key" --argjson role "$(echo "$result" | jq 'del(.key)')" '.[$key] = $role' "$ROLES_DB" > "$tmp_file"; then
                 _recruit_locked_write "$ROLES_DB" "$tmp_file"
             else
@@ -536,6 +547,7 @@ Return JSON only."
 
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     if jq --arg key "$role_key" --argjson role "$role_json" '.[$key] = $role' "$ROLES_DB" > "$tmp_file"; then
         _recruit_locked_write "$ROLES_DB" "$tmp_file"
     else
@@ -614,6 +626,7 @@ cmd_record_outcome() {
 
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     jq --arg id "$agent_id" \
        --argjson tc "$tasks_completed" \
        --argjson sc "$success_count" \
@@ -651,6 +664,7 @@ cmd_record_outcome() {
     if [[ -f "$MATCH_HISTORY" ]]; then
         local tmp_mh
         tmp_mh=$(mktemp)
+        trap "rm -f '$tmp_mh'" RETURN
         # Find the most recent match for this agent_id with null outcome, and backfill
         awk -v agent="$agent_id" -v outcome="$outcome" '
         BEGIN { found = 0 }
@@ -745,6 +759,7 @@ _recruit_track_role_usage() {
 
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     jq --arg role "$role" --arg event "$event" --arg ts "$(now_iso)" '
         .[$role] = (.[$role] // {matches: 0, successes: 0, failures: 0, last_used: ""}) |
         .[$role].last_used = $ts |
@@ -1213,6 +1228,7 @@ _recruit_meta_learning_check() {
 
         local tmp_file
         tmp_file=$(mktemp)
+        trap "rm -f '$tmp_file'" RETURN
         jq --argjson corr "$correction" '
             .corrections = ((.corrections // []) + [$corr] | .[-100:])
         ' "$META_LEARNING_DB" > "$tmp_file" && _recruit_locked_write "$META_LEARNING_DB" "$tmp_file" || rm -f "$tmp_file"
@@ -1259,6 +1275,7 @@ _recruit_reflect() {
     # Track accuracy trend
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     jq --argjson acc "$accuracy" --arg ts "$(now_iso)" '
         .accuracy_trend = ((.accuracy_trend // []) + [{accuracy: $acc, ts: $ts}] | .[-50:]) |
         .last_reflection = $ts
@@ -1347,6 +1364,7 @@ _recruit_meta_validate_self_tune() {
             # Reset heuristics to empty (forces fallback to keyword_match defaults)
             local tmp_heur
             tmp_heur=$(mktemp)
+            trap "rm -f '$tmp_heur'" RETURN
             echo '{"keyword_weights": {}, "meta_reverted_at": "'"$(now_iso)"'", "revert_reason": "accuracy_below_floor"}' > "$tmp_heur"
             _recruit_locked_write "$HEURISTICS_DB" "$tmp_heur" || rm -f "$tmp_heur"
             emit_event "recruit_meta_revert" "accuracy=${current_accuracy}" "floor=${accuracy_floor}" "reason=declining_below_floor"
@@ -1446,6 +1464,7 @@ Return JSON only."
 
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
             jq --arg key "$role_key" --argjson role "$role_json" '.[$key] = $role' "$ROLES_DB" > "$tmp_file" && _recruit_locked_write "$ROLES_DB" "$tmp_file" || rm -f "$tmp_file"
 
             # Update heuristics with trigger keywords
@@ -1454,6 +1473,7 @@ Return JSON only."
             if [[ -n "$keywords" ]]; then
                 local heur_tmp
                 heur_tmp=$(mktemp)
+                trap "rm -f '$heur_tmp'" RETURN
                 while IFS= read -r kw; do
                     [[ -z "$kw" ]] && continue
                     jq --arg kw "$kw" --arg role "$role_key" \
@@ -1580,6 +1600,7 @@ Return JSON only."
             # Save the LLM-generated mind profile
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
             jq --arg id "$agent_id" --argjson mind "$result" '.[$id] = ($mind + {updated: (now | todate)})' "$AGENT_MINDS_DB" > "$tmp_file" && _recruit_locked_write "$AGENT_MINDS_DB" "$tmp_file" || rm -f "$tmp_file"
 
             success "Mind profile generated:"
@@ -1621,6 +1642,7 @@ Return JSON only."
 
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
     jq --arg id "$agent_id" --argjson mind "$mind_json" '.[$id] = $mind' "$AGENT_MINDS_DB" > "$tmp_file" && _recruit_locked_write "$AGENT_MINDS_DB" "$tmp_file" || rm -f "$tmp_file"
 
     local strengths_display="none detected"
@@ -1807,6 +1829,7 @@ cmd_self_tune() {
 
     local tmp_heuristics
     tmp_heuristics=$(mktemp)
+    trap "rm -f '$tmp_heuristics'" RETURN
     cp "$HEURISTICS_DB" "$tmp_heuristics"
 
     local i=0
@@ -2553,6 +2576,7 @@ cmd_audit() {
     if [[ -f "$META_LEARNING_DB" ]]; then
         local tmp_audit
         tmp_audit=$(mktemp)
+        trap "rm -f '$tmp_audit'" RETURN
         jq --argjson score "$score" --arg ts "$(now_iso)" --argjson fails "$fail_count" '
             .audit_trend = ((.audit_trend // []) + [{score: $score, ts: $ts, failures: $fails}] | .[-50:])
         ' "$META_LEARNING_DB" > "$tmp_audit" && _recruit_locked_write "$META_LEARNING_DB" "$tmp_audit" || rm -f "$tmp_audit"

package/scripts/sw-regression.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -198,6 +198,7 @@ cmd_baseline() {
 
     local tmp_file
     tmp_file=$(mktemp "${baseline_file}.tmp.XXXXXX")
+    trap "rm -f '$tmp_file'" RETURN
 
     echo "$metrics" > "$tmp_file"
     mv "$tmp_file" "$baseline_file"

package/scripts/sw-release-manager.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-release.sh

@@ -5,8 +5,9 @@
 # ╚═══════════════════════════════════════════════════════════════════════════╝
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
+trap 'rm -f "${tmp_file:-}"' EXIT
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -258,7 +259,7 @@ generate_changelog_md() {
         echo ""
         echo "$breaking_commits" | while IFS='|' read -r hash subject; do
             [[ -z "$hash" ]] && continue
-            echo "- $subject ([\`$hash\`](https://github.com/sethdford/shipwright/commit/$hash))"
+            echo "- $subject ([\`$hash\`]($(_sw_github_url)/commit/$hash))"
         done
         echo ""
     fi
@@ -269,7 +270,7 @@ generate_changelog_md() {
         echo ""
         echo "$features_commits" | while IFS='|' read -r hash subject; do
             [[ -z "$hash" ]] && continue
-            echo "- $subject ([\`$hash\`](https://github.com/sethdford/shipwright/commit/$hash))"
+            echo "- $subject ([\`$hash\`]($(_sw_github_url)/commit/$hash))"
         done
         echo ""
     fi
@@ -280,7 +281,7 @@ generate_changelog_md() {
         echo ""
         echo "$fixes_commits" | while IFS='|' read -r hash subject; do
             [[ -z "$hash" ]] && continue
-            echo "- $subject ([\`$hash\`](https://github.com/sethdford/shipwright/commit/$hash))"
+            echo "- $subject ([\`$hash\`]($(_sw_github_url)/commit/$hash))"
         done
         echo ""
     fi
@@ -291,7 +292,7 @@ generate_changelog_md() {
         echo ""
         echo "$docs_commits" | while IFS='|' read -r hash subject; do
             [[ -z "$hash" ]] && continue
-            echo "- $subject ([\`$hash\`](https://github.com/sethdford/shipwright/commit/$hash))"
+            echo "- $subject ([\`$hash\`]($(_sw_github_url)/commit/$hash))"
         done
         echo ""
     fi
@@ -346,6 +347,7 @@ update_version_in_files() {
             # This is shell-safe: VERSION="1.11.0" → VERSION="1.12.0"
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
             sed 's/^VERSION="[^"]*"$/VERSION="'"$version_num"'"/' "$file" > "$tmp_file"
             mv "$tmp_file" "$file"
             success "Updated VERSION in $(basename "$file")"

package/scripts/sw-remote.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-replay.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 EVENTS_FILE="${HOME}/.shipwright/events.jsonl"
 

package/scripts/sw-retro.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Cross-platform compatibility ──────────────────────────────────────────

package/scripts/sw-scale.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # ─── Dependency check ─────────────────────────────────────────────────────────
@@ -64,6 +64,7 @@ init_rules() {
     if [[ ! -f "$SCALE_RULES_FILE" ]]; then
         local tmp_file
         tmp_file=$(mktemp)
+        trap "rm -f '$tmp_file'" RETURN
         cat > "$tmp_file" << 'JSON'
 {
   "iteration_threshold": 3,
@@ -105,10 +106,15 @@ in_cooldown() {
 update_scale_state() {
     local tmp_file
     tmp_file=$(mktemp)
+    trap "rm -f '$tmp_file'" RETURN
 
     if [[ -f "$SCALE_STATE_FILE" ]]; then
         # Update existing state
-        jq --arg now "$(now_epoch)" '.last_scale_time = ($now | tonumber)' "$SCALE_STATE_FILE" > "$tmp_file"
+        if ! jq --arg now "$(now_epoch)" '.last_scale_time = ($now | tonumber)' "$SCALE_STATE_FILE" > "$tmp_file" 2>/dev/null || [[ ! -s "$tmp_file" ]]; then
+            rm -f "$tmp_file"
+            warn "Failed to update scale state"
+            return 1
+        fi
     else
         # Create new state
         cat > "$tmp_file" << JSON
@@ -237,15 +243,15 @@ cmd_rules() {
 
             local tmp_file
             tmp_file=$(mktemp)
+            trap "rm -f '$tmp_file'" RETURN
 
             jq --arg key "$key" --arg value "$value" \
                 'if ($value | test("^[0-9]+$")) then
                     .[$key] = ($value | tonumber)
                 else
                     .[$key] = $value
-                end' "$SCALE_RULES_FILE" > "$tmp_file"
-
-            mv "$tmp_file" "$SCALE_RULES_FILE"
+                end' "$SCALE_RULES_FILE" > "$tmp_file" && [[ -s "$tmp_file" ]] && \
+            mv "$tmp_file" "$SCALE_RULES_FILE" || { rm -f "$tmp_file"; error "Failed to update config"; return 1; }
             success "Updated: ${key} = ${value}"
             ;;
         reset)

package/scripts/sw-security-audit.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 

package/scripts/sw-self-optimize.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
@@ -139,6 +139,7 @@ optimize_analyze_outcome() {
     # Build outcome record using jq for proper escaping
     local tmp_outcome
     tmp_outcome=$(mktemp)
+    trap "rm -f '$tmp_outcome'" RETURN
     jq -c -n \
         --arg ts "$(now_iso)" \
         --arg issue "${issue_number:-unknown}" \
@@ -228,6 +229,7 @@ optimize_tune_templates() {
     local tmp_stats tmp_weights
     tmp_stats=$(mktemp)
     tmp_weights=$(mktemp)
+    trap "rm -f '$tmp_stats' '$tmp_weights'" RETURN
 
     # Extract template, labels, result from each outcome line
     while IFS= read -r line; do
@@ -334,6 +336,7 @@ optimize_tune_templates() {
         # Atomic write
         local tmp_cw
         tmp_cw=$(mktemp "${TEMPLATE_WEIGHTS_FILE}.tmp.XXXXXX")
+        trap "rm -f '$tmp_cw'" RETURN
         echo "$consumer_weights" > "$tmp_cw" && mv "$tmp_cw" "$TEMPLATE_WEIGHTS_FILE" || rm -f "$tmp_cw"
     fi
 
@@ -380,6 +383,7 @@ optimize_learn_iterations() {
     tmp_med=$(mktemp)
     tmp_high=$(mktemp)
     tmp_all_pairs=$(mktemp)
+    trap "rm -f '$tmp_low' '$tmp_med' '$tmp_high' '$tmp_all_pairs'" RETURN
 
     while IFS= read -r line; do
         local complexity iterations
@@ -440,6 +444,7 @@ optimize_learn_iterations() {
                 # Write boundaries back to config (atomic)
                 local tmp_clusters
                 tmp_clusters=$(mktemp "${TMPDIR:-/tmp}/sw-clusters.XXXXXX")
+                trap "rm -f '$tmp_clusters'" RETURN
                 jq -n \
                     --argjson low_max "$new_low" \
                     --argjson med_max "$new_med" \
@@ -485,20 +490,19 @@ optimize_learn_iterations() {
     med_stats=$(calc_stats "$tmp_med")
     high_stats=$(calc_stats "$tmp_high")
 
-    # Build iteration model with predictions wrapper
+    # Build iteration model (flat format for readers: .low, .medium, .high)
     local tmp_model
     tmp_model=$(mktemp "${ITERATION_MODEL_FILE}.tmp.XXXXXX")
+    trap "rm -f '$tmp_model'" RETURN
     jq -n \
         --argjson low "$low_stats" \
         --argjson medium "$med_stats" \
         --argjson high "$high_stats" \
         --arg updated "$(now_iso)" \
         '{
-            predictions: {
-                low: {max_iterations: (if $low.mean > 0 then (($low.mean + $low.stddev) | floor | if . < 5 then 5 else . end) else 10 end), confidence: (if $low.samples >= 10 then 0.8 elif $low.samples >= 5 then 0.6 else 0.4 end), mean: $low.mean, stddev: $low.stddev, samples: $low.samples},
-                medium: {max_iterations: (if $medium.mean > 0 then (($medium.mean + $medium.stddev) | floor | if . < 10 then 10 else . end) else 20 end), confidence: (if $medium.samples >= 10 then 0.8 elif $medium.samples >= 5 then 0.6 else 0.4 end), mean: $medium.mean, stddev: $medium.stddev, samples: $medium.samples},
-                high: {max_iterations: (if $high.mean > 0 then (($high.mean + $high.stddev) | floor | if . < 15 then 15 else . end) else 30 end), confidence: (if $high.samples >= 10 then 0.8 elif $high.samples >= 5 then 0.6 else 0.4 end), mean: $high.mean, stddev: $high.stddev, samples: $high.samples}
-            },
+            low: {max_iterations: (if $low.mean > 0 then (($low.mean + $low.stddev) | floor | if . < 5 then 5 else . end) else 10 end), confidence: (if $low.samples >= 10 then 0.8 elif $low.samples >= 5 then 0.6 else 0.4 end), mean: $low.mean, stddev: $low.stddev, samples: $low.samples},
+            medium: {max_iterations: (if $medium.mean > 0 then (($medium.mean + $medium.stddev) | floor | if . < 10 then 10 else . end) else 20 end), confidence: (if $medium.samples >= 10 then 0.8 elif $medium.samples >= 5 then 0.6 else 0.4 end), mean: $medium.mean, stddev: $medium.stddev, samples: $medium.samples},
+            high: {max_iterations: (if $high.mean > 0 then (($high.mean + $high.stddev) | floor | if . < 15 then 15 else . end) else 30 end), confidence: (if $high.samples >= 10 then 0.8 elif $high.samples >= 5 then 0.6 else 0.4 end), mean: $high.mean, stddev: $high.stddev, samples: $high.samples},
             updated_at: $updated
         }' \
         > "$tmp_model" && mv "$tmp_model" "$ITERATION_MODEL_FILE" || rm -f "$tmp_model"
@@ -506,6 +510,81 @@ optimize_learn_iterations() {
     rm -f "$tmp_low" "$tmp_med" "$tmp_high" 2>/dev/null || true
 
     success "Iteration model updated"
+
+    # Apply prediction error bias correction from validation data
+    _optimize_apply_prediction_bias
+}
+
+# _optimize_apply_prediction_bias
+# Reads prediction-validation.jsonl and applies bias correction to iteration model.
+# If predictions consistently over/under-estimate, shift the model's means.
+_optimize_apply_prediction_bias() {
+    local validation_file="${HOME}/.shipwright/optimization/prediction-validation.jsonl"
+    [[ ! -f "$validation_file" ]] && return 0
+
+    local model_file="$ITERATION_MODEL_FILE"
+    [[ ! -f "$model_file" ]] && return 0
+
+    # Compute mean delta (predicted - actual) from recent validations
+    local recent_count=50
+    local bias_data
+    bias_data=$(tail -n "$recent_count" "$validation_file" | jq -s '
+        if length == 0 then empty
+        else
+            group_by(
+                if .predicted_complexity <= 3 then "low"
+                elif .predicted_complexity <= 6 then "medium"
+                else "high" end
+            ) | map({
+                bucket: (.[0] | if .predicted_complexity <= 3 then "low" elif .predicted_complexity <= 6 then "medium" else "high" end),
+                mean_delta: ([.[].delta] | add / length),
+                count: length
+            })
+        end' 2>/dev/null || true)
+
+    [[ -z "$bias_data" || "$bias_data" == "null" ]] && return 0
+
+    # Apply bias correction: if mean_delta > 0, predictions are too high → increase model mean
+    # (model mean drives estimates, and positive delta = predicted > actual = model underestimates actual iterations needed)
+    local updated_model
+    updated_model=$(cat "$model_file")
+    local changed=false
+
+    for bucket in low medium high; do
+        local bucket_bias count
+        bucket_bias=$(echo "$bias_data" | jq -r --arg b "$bucket" '.[] | select(.bucket == $b) | .mean_delta // 0' 2>/dev/null || echo "0")
+        count=$(echo "$bias_data" | jq -r --arg b "$bucket" '.[] | select(.bucket == $b) | .count // 0' 2>/dev/null || echo "0")
+
+        # Only correct if enough samples and significant bias (|delta| > 1)
+        if [[ "${count:-0}" -ge 5 ]]; then
+            local abs_bias
+            abs_bias=$(awk -v b="$bucket_bias" 'BEGIN { v = b < 0 ? -b : b; printf "%.1f", v }')
+            if awk -v ab="$abs_bias" 'BEGIN { exit !(ab > 1.0) }' 2>/dev/null; then
+                # Correction = -delta * 0.3 (partial correction to avoid overshooting)
+                local correction
+                correction=$(awk -v d="$bucket_bias" 'BEGIN { printf "%.2f", -d * 0.3 }')
+                updated_model=$(echo "$updated_model" | jq --arg b "$bucket" --argjson c "$correction" \
+                    '.[$b].mean = ((.[$b].mean // 0) + $c) | .[$b].bias_correction = $c' 2>/dev/null || echo "$updated_model")
+                changed=true
+                info "Prediction bias correction for $bucket: delta=${bucket_bias}, correction=${correction} (${count} samples)"
+            fi
+        fi
+    done
+
+    if [[ "$changed" == true ]]; then
+        local tmp_model
+        tmp_model=$(mktemp)
+        trap "rm -f '$tmp_model'" RETURN
+        if echo "$updated_model" | jq '.' > "$tmp_model" 2>/dev/null && [[ -s "$tmp_model" ]]; then
+            mv "$tmp_model" "$model_file"
+            emit_event "optimize.prediction_bias_corrected"
+        else
+            rm -f "$tmp_model"
+        fi
+    fi
+
+    # Rotate validation file
+    type rotate_jsonl &>/dev/null 2>&1 && rotate_jsonl "$validation_file" 5000
 }
 
 # ═════════════════════════════════════════════════════════════════════════════
@@ -537,6 +616,7 @@ optimize_route_models() {
     # Collect per-stage, per-model stats
     local tmp_stage_stats
     tmp_stage_stats=$(mktemp)
+    trap "rm -f '$tmp_stage_stats'" RETURN
 
     while IFS= read -r line; do
         local model result stages_arr
@@ -652,6 +732,7 @@ optimize_route_models() {
     # Atomic write
     local tmp_routing
     tmp_routing=$(mktemp "${MODEL_ROUTING_FILE}.tmp.XXXXXX")
+    trap "rm -f '$tmp_routing'" RETURN
     echo "$consumer_routing" > "$tmp_routing" && mv "$tmp_routing" "$MODEL_ROUTING_FILE" || rm -f "$tmp_routing"
 
     rm -f "$tmp_stage_stats" 2>/dev/null || true
@@ -659,6 +740,85 @@ optimize_route_models() {
     success "Model routing updated"
 }
 
+# ═════════════════════════════════════════════════════════════════════════════
+# RISK KEYWORD LEARNING
+# ═════════════════════════════════════════════════════════════════════════════
+
+# optimize_learn_risk_keywords [outcomes_file]
+# Learns keyword→risk-weight mapping from pipeline outcomes for predictive risk scoring.
+# Failed pipelines with labels/keywords get positive weights; successful ones get negative.
+optimize_learn_risk_keywords() {
+    local outcomes_file="${1:-$OUTCOMES_FILE}"
+
+    if [[ ! -f "$outcomes_file" ]]; then
+        return 0
+    fi
+
+    ensure_optimization_dir
+
+    info "Learning risk keywords from outcomes..."
+
+    local risk_file="${OPTIMIZATION_DIR}/risk-keywords.json"
+    local keywords='{}'
+    if [[ -f "$risk_file" ]]; then
+        keywords=$(jq '.' "$risk_file" 2>/dev/null || echo '{}')
+    fi
+
+    local decay=0.95
+    local learn_rate=5
+
+    # Read outcomes and extract keywords from labels
+    local updated=false
+    while IFS= read -r line; do
+        local result labels
+        result=$(echo "$line" | jq -r '.result // "unknown"' 2>/dev/null) || continue
+        labels=$(echo "$line" | jq -r '.labels // ""' 2>/dev/null) || continue
+        [[ -z "$labels" || "$labels" == "null" ]] && continue
+
+        # Split labels on comma/space and learn from each keyword
+        local IFS=', '
+        for kw in $labels; do
+            kw=$(echo "$kw" | tr '[:upper:]' '[:lower:]' | tr -cd '[:alnum:]-')
+            [[ -z "$kw" || ${#kw} -lt 3 ]] && continue
+
+            local current_weight
+            current_weight=$(echo "$keywords" | jq -r --arg k "$kw" '.[$k] // 0' 2>/dev/null || echo "0")
+
+            local delta=0
+            if [[ "$result" == "failed" || "$result" == "error" ]]; then
+                delta=$learn_rate
+            elif [[ "$result" == "success" || "$result" == "complete" ]]; then
+                delta=$((-learn_rate / 2))
+            fi
+
+            if [[ "$delta" -ne 0 ]]; then
+                local new_weight
+                new_weight=$(awk -v cw="$current_weight" -v d="$decay" -v dw="$delta" 'BEGIN { printf "%.0f", (cw * d) + dw }')
+                # Clamp to -50..50
+                new_weight=$(awk -v w="$new_weight" 'BEGIN { if(w>50) w=50; if(w<-50) w=-50; printf "%.0f", w }')
+                keywords=$(echo "$keywords" | jq --arg k "$kw" --argjson w "$new_weight" '.[$k] = $w' 2>/dev/null || echo "$keywords")
+                updated=true
+            fi
+        done
+    done < "$outcomes_file"
+
+    if [[ "$updated" == true ]]; then
+        # Prune zero-weight keywords
+        keywords=$(echo "$keywords" | jq 'to_entries | map(select(.value != 0)) | from_entries' 2>/dev/null || echo "$keywords")
+        local tmp_risk
+        tmp_risk=$(mktemp)
+        trap "rm -f '$tmp_risk'" RETURN
+        if echo "$keywords" | jq '.' > "$tmp_risk" 2>/dev/null && [[ -s "$tmp_risk" ]]; then
+            mv "$tmp_risk" "$risk_file"
+            success "Risk keywords updated ($(echo "$keywords" | jq 'length' 2>/dev/null || echo '?') keywords)"
+        else
+            rm -f "$tmp_risk"
+        fi
+    else
+        info "No label data in outcomes — risk keywords unchanged"
+    fi
+}
+
 # ═════════════════════════════════════════════════════════════════════════════
 # MEMORY EVOLUTION
 # ═════════════════════════════════════════════════════════════════════════════
@@ -724,6 +884,7 @@ optimize_evolve_memory() {
 
         local tmp_file
         tmp_file=$(mktemp)
+        trap "rm -f '$tmp_file'" RETURN
 
         # Prune entries not seen within prune window
         local pruned_json
@@ -761,6 +922,7 @@ optimize_evolve_memory() {
     # Collect all patterns across repos
     local tmp_all_patterns
     tmp_all_patterns=$(mktemp)
+    trap "rm -f '$tmp_all_patterns'" RETURN
     for repo_dir in "$memory_root"/*/; do
         [[ -d "$repo_dir" ]] || continue
         local failures_file="${repo_dir}failures.json"
@@ -776,6 +938,7 @@ optimize_evolve_memory() {
         if [[ -n "$promoted_patterns" ]]; then
             local tmp_global
             tmp_global=$(mktemp)
+            trap "rm -f '$tmp_global'" RETURN
             local pcount=0
             while IFS= read -r pattern; do
                 [[ -z "$pattern" ]] && continue
@@ -821,6 +984,7 @@ optimize_full_analysis() {
     optimize_tune_templates
     optimize_learn_iterations
     optimize_route_models
+    optimize_learn_risk_keywords
     optimize_evolve_memory
     optimize_report >> "${OPTIMIZATION_DIR}/last-report.txt" 2>/dev/null || true
     optimize_adjust_audit_intensity 2>/dev/null || true
@@ -981,6 +1145,7 @@ optimize_adjust_audit_intensity() {
         info "Quality trend: ${trend} (avg: ${avg_quality}) — increasing audit intensity"
         local tmp_dc
         tmp_dc=$(mktemp "${daemon_config}.tmp.XXXXXX")
+        trap "rm -f '$tmp_dc'" RETURN
         jq '.intelligence.adversarial_enabled = true | .intelligence.architecture_enabled = true' \
             "$daemon_config" > "$tmp_dc" 2>/dev/null && mv "$tmp_dc" "$daemon_config" || rm -f "$tmp_dc"
         emit_event "optimize.audit_intensity" \

package/scripts/sw-session.sh

@@ -8,7 +8,7 @@
 # ║  Supports --template to scaffold from a team template and --terminal    ║
 # ║  to select a terminal adapter (tmux, iterm2, wezterm).                  ║
 # ╚═══════════════════════════════════════════════════════════════════════════╝
-VERSION="2.2.1"
+VERSION="2.3.0"
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 

package/scripts/sw-setup.sh

@@ -10,7 +10,7 @@
 set -euo pipefail
 trap 'echo "ERROR: $BASH_SOURCE:$LINENO exited with status $?" >&2' ERR
 
-VERSION="2.2.1"
+VERSION="2.3.0"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"