From aff689644b45863d29bab3c4770b4b8ef5395b2d Mon Sep 17 00:00:00 2001
From: "Claude (supervisor)" <noreply@anthropic.com>
Date: Thu, 15 Oct 2026 09:41:34 +1300
Subject: [PATCH] smoke: scripts/hello for the custom scripts milestone
 (f7836bef)

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF
---
 README.md     |  3 +++
 scripts/hello | 12 ++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 README.md
 create mode 100755 scripts/hello

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..a3c182c
--- /dev/null
+++ b/README.md
@@ -0,0 +1,3 @@
+# csw-smoke-scripts
+
+Smoke-test bundle for the custom scripts and workflows milestone (f7836bef). `scripts/hello` is the only script. Not production.
diff --git a/scripts/hello b/scripts/hello
new file mode 100755
index 0000000..c03abce
--- /dev/null
+++ b/scripts/hello
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Smoke test for the custom scripts milestone (f7836bef). Not production.
+# Proves: the platform fetched THIS script at a pinned sha, verified its
+# bundle digest, installed it read-only and executed it. Prints no secrets.
+set -eu
+echo "csw-smoke: custom script executed"
+echo "csw-smoke: cwd=$(pwd) uid=$(id -u)"
+echo "csw-smoke: script=$0"
+# count (never print) credential-looking environment variable NAMES
+n=$(env | cut -d= -f1 | grep -ciE 'token|secret|password|api_key' || true)
+echo "csw-smoke: credential-looking env var names visible to the script: ${n}"
+echo "csw-smoke: OK"