commit aff689644b45863d29bab3c4770b4b8ef5395b2d
Author: Claude (supervisor) <noreply@anthropic.com>
Date:   Thu Oct 15 09:41:34 2026 +1300

    smoke: scripts/hello for the custom scripts milestone (f7836bef)
    
    Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..a3c182c
--- /dev/null
+++ b/README.md
@@ -0,0 +1,3 @@
+# csw-smoke-scripts
+
+Smoke-test bundle for the custom scripts and workflows milestone (f7836bef). `scripts/hello` is the only script. Not production.
diff --git a/scripts/hello b/scripts/hello
new file mode 100755
index 0000000..c03abce
--- /dev/null
+++ b/scripts/hello
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Smoke test for the custom scripts milestone (f7836bef). Not production.
+# Proves: the platform fetched THIS script at a pinned sha, verified its
+# bundle digest, installed it read-only and executed it. Prints no secrets.
+set -eu
+echo "csw-smoke: custom script executed"
+echo "csw-smoke: cwd=$(pwd) uid=$(id -u)"
+echo "csw-smoke: script=$0"
+# count (never print) credential-looking environment variable NAMES
+n=$(env | cut -d= -f1 | grep -ciE 'token|secret|password|api_key' || true)
+echo "csw-smoke: credential-looking env var names visible to the script: ${n}"
+echo "csw-smoke: OK"