Smart-Kickoff Gates & Credential Discipline is the enforcement layer of 📝Smart-Kickoff: a test gate with a syntax floor and offline behavior tests that needs no network and no credential, paired with the rule that a secret is consumed at run time and never appears in a command-line argument, a shell trace, or a transcript.
The gate has two stages because the scripts it protects are sourced into every interactive shell and run by every agent session. A parse error in the orchestration file does not fail one task; it breaks session creation everywhere at once, so a parse-only check over every script is the floor before anything merges. Behavior tests run second, and they are offline by design: the resolver is exercised through a local-file mode rather than the live store, and git behavior runs against a throwaway repository under a sandboxed home. A suite that depended on a credential would fail whenever that credential was unreliable, and a suite that fails for reasons unrelated to the code teaches people to ignore red. Worse, it fails open — green comes to mean "not run where it matters."
The credential rule follows from the same instinct that a guard is a mechanism, not a reminder. A key read from the environment is handed to the HTTP client through a configuration on standard input, never as an argument, because process arguments are world-readable for the lifetime of the call. Shell tracing is suspended across the key's expansion, because running a script under trace otherwise prints the key in full to whatever log captures it. Test output is scrubbed of credential-shaped strings before it reaches a transcript — damage limitation, not protection; the protection is neutralizing the environment so no real credential can reach the suite. The 📝Smart-Kickoff — Agent Buildbook asks an adopting agent to locate each of these surfaces in its own stack.
local xt=""; case "$-" in *x*) xt=1; set +x ;; esac # suspend tracing across the key
code=$(printf 'header = "x-api-key: %s"\n' "$key" \
| curl -s -K - -o "$tmp" -w '%{http_code}' "$url"); rc=$? # key via stdin config, never argv
[ -n "$xt" ] && set -x