fix(migration): close silent-pass, false-positive and wrong-guidance defects across the skill

Found by external review (Codex bot, a full-PR rubric pass, and a sweep of the
38 PR files no prior review round had opened). All thirteen sit OUTSIDE
lint-required-messaging-profile.py, which is the only file earlier rounds
examined.

Discovery and validation could not see what they claimed to check:
- scan-twilio-usage.sh matched PHP with a doubled backslash under `grep -F`,
  where it means two literal backslashes. No PHP project has ever been
  detected: every one scanned as zero files and passed discovery silently.
- run-validation.sh skipped a dedicated .twiml/.texml file whose root element
  is not <Response>, so a broken or unconverted document was never validated.
  A generic .xml stays exempt.
- validate-migration.sh reported PASS on files it could not read; every grep
  ends `2>/dev/null || true`, so an unreadable file contributes no matches.
  It now fails: what cannot be read cannot be certified.
- lint-telnyx-correctness.sh lexed alias suffixes (.phtml, .kt, .bash) without
  canonicalising, so their comments were never masked and dead code blocked
  valid migrations. The sibling scanners already canonicalised.
- lint-telnyx-correctness.sh downgraded EVERY issue to a warning whenever any
  product was hybrid, so a leftover Twilio messaging import was waived because
  voice was kept. The waiver is now scoped to the product actually kept.
- post-test-diagnostic.sh read count keys at the top level (they live under
  `summary`) and compared uppercase status values against lowercase ones, so it
  reported "Fails: 0 / All clear" while validation was failing.
- smoke-test.sh appended a second "000" to curl's own output, making the
  variable "000000" and the unreachable-webhook branch dead code.

Guidance that does not work, verified against the real SDKs:
- Ruby examples called Telnyx::Webhook.construct_event, which does not exist
  (checked against telnyx 5.158.0). NameError is a StandardError, so the usual
  rescue swallowed it and every webhook was rejected with 403. Five call sites
  across two skills now use client.webhooks.unwrap(payload, headers:, key:).
- The Go verifier accepted any signed payload regardless of age and consumed
  the request body without restoring it. It now enforces the documented
  5-minute tolerance, restores the body, and checks the key length before
  ed25519.Verify, which panics on a wrong-length key.
- test-webhooks-local.py sends a deliberately INVALID signature, yet scored a
  2xx as PASS. It passed handlers with no signature verification and failed
  every handler that verified one. 401/403 is now the pass, and a 2xx is
  reported as INSECURE.
- webrtc-migration.md told readers to write <Dial supervisorRole>, which is a
  Conference REST API parameter, not a TeXML attribute. The skill's own
  validator rejects it and the runtime drops it silently.

Verified: 250 tests pass; a 366-case contract corpus passes with no known gaps;
each fix carries a control proving it does not over-correct, and each new
contract was mutation-checked against the pre-fix code.

Author: Vijaypepakayala

providers/claude/plugins/telnyx-platform/skills/telnyx-twilio-migration/SKILL.md

@@ -10,7 +10,7 @@ user_invocable: true
 metadata:
   author: telnyx
   product: migration
-  compatibility: "Requires bash 4+, jq, curl. macOS ships bash 3.2 — scripts auto-upgrade via Homebrew bash if available (brew install bash)."
+  compatibility: "Requires bash 4+, jq, curl, python3. macOS ships bash 3.2 — scripts auto-upgrade via Homebrew bash if available (brew install bash). python3 is mandatory: the scanners and the correctness linter exit 2 without it."
 ---
 
 # Twilio to Telnyx Migration

providers/claude/plugins/telnyx-platform/skills/telnyx-twilio-migration/references/messaging-migration.md

@@ -359,6 +359,17 @@ client = Telnyx(
     public_key=os.environ['TELNYX_PUBLIC_KEY'],
 )
 
+def seen_event(event_id):
+    """Claim an event id exactly once. Truthy only for a FIRST delivery.
+
+    Shown with Redis because the claim must be atomic and shared across every
+    worker and instance; a module-level set silently stops deduplicating the
+    moment you run more than one worker. `NX` makes SET succeed only when the
+    key is absent, so two concurrent retries cannot both win. The 24h TTL keeps
+    the key space bounded while comfortably outlasting the retry window.
+    """
+    return redis.set(f'telnyx:event:{event_id}', '1', nx=True, ex=86400)
+
 def verified_telnyx_data():
     raw_body = request.get_data(as_text=True)  # original body, before parsing
     try:
@@ -372,6 +383,21 @@ def sms():
     event = verified_telnyx_data()
     if event.get('event_type') != 'message.received':
         return '', 200
+
+    # DEDUPLICATE BEFORE REPLYING. Telnyx retries a webhook until it gets a
+    # 2xx, so a slow handler, a timeout or a deploy mid-request delivers the
+    # SAME event again. The reply below is a BILLABLE outbound SMS: without
+    # this guard a retry sends the customer a second message and bills you for
+    # it. Every webhook carries a stable `id`; record it FIRST and drop the
+    # event if it is already known.
+    #
+    # `seen_event` must be atomic and shared across every worker and instance —
+    # an in-process set does not deduplicate behind more than one worker.
+    # Redis: `SET <id> 1 NX EX 86400` returns falsy when the key already
+    # exists. A unique index on an events table works equally well.
+    if not seen_event(event['id']):        # falsy => already processed
+        return '', 200
+
     payload = event['payload']
     from_number = payload['from']['phone_number']       # the person who texted us
     to_number   = payload['to'][0]['phone_number']      # our number they texted

providers/claude/plugins/telnyx-platform/skills/telnyx-twilio-migration/references/voice-migration.md

@@ -406,21 +406,50 @@ try {
 // Telnyx webhook signature validation in Go
 // Use the telnyx-go SDK or verify Ed25519 manually:
 import (
+    "bytes"
     "crypto/ed25519"
     "encoding/base64"
     "io"
     "net/http"
+    "strconv"
+    "time"
 )
 
-func verifyWebhook(r *http.Request, publicKeyBase64 string) bool {
-    bodyBytes, _ := io.ReadAll(r.Body)
+// Returns the verified body. The caller must use THIS slice - reading r.Body
+// again yields nothing, because io.ReadAll consumes it.
+func verifyWebhook(r *http.Request, publicKeyBase64 string) ([]byte, bool) {
+    bodyBytes, err := io.ReadAll(r.Body)
+    if err != nil {
+        return nil, false
+    }
+    // Restore the body so a handler that decodes r.Body still works. Without
+    // this the handler reads zero bytes and fails on every request.
+    r.Body = io.NopCloser(bytes.NewReader(bodyBytes))
+
     signature := r.Header.Get("telnyx-signature-ed25519")
     timestamp := r.Header.Get("telnyx-timestamp")
-    // Concatenate timestamp + "|" + payload, verify with Ed25519 public key
-    pubKeyBytes, _ := base64.StdEncoding.DecodeString(publicKeyBase64)
-    sigBytes, _ := base64.StdEncoding.DecodeString(signature)
+
+    // REJECT STALE DELIVERIES. Without a freshness check any captured signed
+    // payload - from a log dump, a proxy trace, a shared staging endpoint -
+    // verifies forever, so an attacker can replay it indefinitely. Telnyx
+    // documents a 5-minute tolerance.
+    ts, err := strconv.ParseInt(timestamp, 10, 64)
+    if err != nil || time.Since(time.Unix(ts, 0)) > 5*time.Minute {
+        return nil, false
+    }
+
+    pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyBase64)
+    // ed25519.Verify PANICS on a wrong-length key, so a misconfigured
+    // TELNYX_PUBLIC_KEY would crash the handler instead of rejecting.
+    if err != nil || len(pubKeyBytes) != ed25519.PublicKeySize {
+        return nil, false
+    }
+    sigBytes, err := base64.StdEncoding.DecodeString(signature)
+    if err != nil {
+        return nil, false
+    }
     message := []byte(timestamp + "|" + string(bodyBytes))
-    return ed25519.Verify(ed25519.PublicKey(pubKeyBytes), message, sigBytes)
+    return bodyBytes, ed25519.Verify(ed25519.PublicKey(pubKeyBytes), message, sigBytes)
 }
 ```
 
@@ -435,7 +464,10 @@ post '/webhook' do
   signature = request.env['HTTP_TELNYX_SIGNATURE_ED25519']
   timestamp = request.env['HTTP_TELNYX_TIMESTAMP']
   begin
-    Telnyx::Webhook.construct_event(payload, signature, timestamp, public_key: 'YOUR_PUBLIC_KEY')
+    # Verification lives on the CLIENT. There is no Telnyx::Webhook module -
+    # naming one raises NameError, which `rescue` swallows, so every webhook
+    # would be rejected with 403.
+    client.webhooks.unwrap(payload, headers: request.env, key: ENV['TELNYX_PUBLIC_KEY'])
     # Signature valid
   rescue Telnyx::SignatureVerificationError
     halt 403, 'Forbidden'

providers/claude/plugins/telnyx-platform/skills/telnyx-twilio-migration/references/webhook-migration.md

@@ -171,7 +171,11 @@ func verifyWebhook(payload, signature, timestamp, publicKeyBase64 string) bool {
 ```ruby
 require 'telnyx'
 client = Telnyx::Client.new(api_key: 'YOUR_API_KEY')
-Telnyx::Webhook.construct_event(payload, signature, timestamp, public_key: 'YOUR_PUBLIC_KEY')
+# Verification lives on the CLIENT: client.webhooks.unwrap(payload, headers:).
+# There is no Telnyx::Webhook module - referencing one raises NameError, and
+# because NameError is a StandardError the usual `rescue StandardError` around
+# it swallows the error and rejects EVERY webhook with 403.
+client.webhooks.unwrap(payload, headers: request.env, key: ENV['TELNYX_PUBLIC_KEY'])
 ```
 
 ## Framework-Specific Examples
@@ -282,11 +286,10 @@ post '/webhooks/messaging' do
 
   # Verify signature
   begin
-    Telnyx::Webhook.construct_event(
+    client.webhooks.unwrap(
       payload,
-      request.env['HTTP_TELNYX_SIGNATURE_ED25519'],
-      request.env['HTTP_TELNYX_TIMESTAMP'],
-      public_key: ENV['TELNYX_PUBLIC_KEY']
+      headers: request.env,
+      key: ENV['TELNYX_PUBLIC_KEY']
     )
   rescue StandardError
     halt 403, 'Forbidden'
@@ -382,7 +385,7 @@ class WebhooksController < ApplicationController
                 request.headers['telnyx-timestamp']
 
     begin
-      Telnyx::Webhook.construct_event(
+      client.webhooks.unwrap(
         payload,
         signature,
         timestamp,

providers/claude/plugins/telnyx-platform/skills/telnyx-twilio-migration/references/webrtc-migration.md

@@ -592,7 +592,15 @@ These patterns apply when migrating Twilio-based contact centers, PBX systems, o
 
 **Twilio pattern**: Conferences are required for any scenario with more than 2 call legs or where you need supervisor features (listen, whisper, barge). Even simple call transfers often use conferences.
 
-**Telnyx pattern**: Conferences are only needed for true multi-party audio (3+ participants). For two-party calls with supervisor features, use `<Dial>` with `supervisorRole`:
+**Telnyx pattern**: Conferences are only needed for true multi-party audio (3+ participants).
+
+> **`supervisorRole` is a Conference REST API parameter, not a TeXML attribute.**
+> It is set when joining a participant to a conference via the API
+> (`supervisor_role: barge | whisper | monitor`), and there is no
+> `<Dial supervisorRole="...">` in TeXML — the skill's own validator rejects the
+> attribute and the runtime silently drops it, so a migration written that way
+> loses supervisor behaviour with no error. Supervisor features therefore still
+> require a conference; only plain two-party calls avoid one.
 
 ```javascript
 // Twilio: requires conference for supervisor

providers/claude/plugins/telnyx-platform/skills/telnyx-twilio-migration/scripts/lint-telnyx-correctness.sh

@@ -406,8 +406,33 @@ elif [ -n "$STATE_FILE" ] && [ ! -f "$STATE_FILE" ]; then
   echo "Warning: --state-file '$STATE_FILE' not found, ignoring" >&2
 fi
 
+# Waive only for the product that is actually KEPT on Twilio.
+#
+# Testing `-n "$KEPT_ON_TWILIO"` alone made ANY hybrid state a GLOBAL waiver: in
+# a `--product messaging` run, a leftover Twilio messaging import was downgraded
+# to a warning - and the linter exited clean - merely because an unrelated
+# product such as voice was kept on Twilio. That is a silent pass on exactly the
+# residue the check exists to find.
+#
+# The product is passed per call site because these checks are not all inside a
+# product-scoped block; the global ones (residual imports, client instantiation,
+# directory names, docs) legitimately span products and pass "any", which waives
+# whenever ANY product is kept - the original behaviour, but now stated at the
+# call site rather than applied silently everywhere.
+kept_on_twilio() {
+  local product="$1"
+  [ -n "$KEPT_ON_TWILIO" ] || return 1
+  [ "$product" = "any" ] && return 0
+  case ",$KEPT_ON_TWILIO," in
+    *",$product,"*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 lint_issue_or_hybrid_warn() {
-  if [ -n "$KEPT_ON_TWILIO" ]; then
+  local product="$1"
+  shift
+  if kept_on_twilio "$product"; then
     lint_warn "$1" "$2 (hybrid deployment — $KEPT_ON_TWILIO kept on Twilio)" "$3" "${4:-}"
   else
     lint_issue "$1" "$2" "$3" "${4:-}"
@@ -454,7 +479,7 @@ if product_applies "messaging"; then
   fi
   count=$(count_matches "$twilio_create_calls")
   if [ "$count" -gt 0 ]; then
-    lint_issue_or_hybrid_warn "twilio_messages_create" \
+    lint_issue_or_hybrid_warn "messaging" "twilio_messages_create" \
       "Twilio .messages.create() request using body found at $count call site(s)" \
       "Use telnyx.messages.send() (Python) or telnyx.messages.create() with the text parameter (JavaScript/Ruby)" \
       "$(matches_to_json "$twilio_create_calls")"
@@ -595,8 +620,14 @@ for directory, child_dirs, filenames in os.walk(root):
         source = path.read_text(encoding="utf-8", errors="replace")
         # Keep string/template contents (where live TeXML is commonly stored),
         # while blanking host-language comments without shifting line numbers.
+        # CANONICALISE first. lex_source only treats canonical suffixes as
+        # comment-bearing, so an alias (.phtml, .kt, .kts, .scala, .bash, ...)
+        # was lexed as an unknown language and its comments were never masked -
+        # a commented-out <Gather speechModel> then blocked a valid migration.
+        # The sibling scanners already call canonical_suffix here; this was the
+        # only consumer passing the raw suffix through.
         scan_source = analyzer.lex_source(
-            source, path.suffix.lower()
+            source, analyzer.canonical_suffix(path)
         ).without_comments
         scan_source = re.sub(
             r"<!--.*?-->|<!\[CDATA\[.*?\]\]>",
@@ -789,7 +820,7 @@ if product_applies "all"; then
   twilio_webhook_mw=$(search_files "(twilio\.webhook\(|@validate_twilio_request|RequestValidator\(|twilio.*validateRequest|validateExpressRequest)" "*.py" "*.js" "*.ts" "*.rb")
   twilio_mw_count=$(count_matches "$twilio_webhook_mw")
   if [ "$twilio_mw_count" -gt 0 ]; then
-    lint_issue_or_hybrid_warn "twilio_webhook_middleware" \
+    lint_issue_or_hybrid_warn "any" "twilio_webhook_middleware" \
       "Twilio webhook middleware/validator still present in $twilio_mw_count file(s)" \
       "Remove if original had validate:false (it was a no-op). Replace with Ed25519 if original actually validated." \
       "$(matches_to_json "$twilio_webhook_mw")"
@@ -833,7 +864,7 @@ done
 doc_files=$(echo "$doc_files" | sed '/^$/d')
 doc_count=$(echo "$doc_files" | sed '/^$/d' | wc -l | tr -d ' ')
 if [ "$doc_count" -gt 0 ]; then
-  lint_issue_or_hybrid_warn "docs_still_twilio" \
+  lint_issue_or_hybrid_warn "any" "docs_still_twilio" \
     "Documentation files still reference Twilio (not migration-related references) in $doc_count file(s)" \
     "Update README/docs: replace Twilio service names, env vars, setup instructions, and URLs with Telnyx equivalents" \
     "$(echo "$doc_files" | sed '/^$/d' | head -10 | jq -R -s '{files: (split("\n") | map(select(length > 0)))}' 2>/dev/null || echo '{"files":[]}')"
@@ -850,7 +881,7 @@ section_header "Residual Twilio Patterns"
 matches=$(search_live_files comments '(from twilio|import[ (].*twilio|require.*twilio|using Twilio|import com\.twilio|use[[:space:]]+\\?Twilio|new[[:space:]]+\\?Twilio)' "*.py" "*.js" "*.ts" "*.rb" "*.go" "*.java" "*.php" "*.cs")
 count=$(count_matches "$matches")
 if [ "$count" -gt 0 ]; then
-  lint_issue_or_hybrid_warn "residual_twilio_imports" \
+  lint_issue_or_hybrid_warn "any" "residual_twilio_imports" \
     "Residual Twilio imports found in $count file(s)" \
     "Remove Twilio imports — migration should replace them with Telnyx equivalents" \
     "$(matches_to_json "$matches")"
@@ -862,7 +893,7 @@ fi
 matches=$(search_live_files code '(Client\(.*account_sid|Twilio\(|twilio\.Twilio\(|new Twilio\.)' "*.py" "*.js" "*.ts" "*.rb" "*.go" "*.java" "*.php")
 count=$(count_matches "$matches")
 if [ "$count" -gt 0 ]; then
-  lint_issue_or_hybrid_warn "twilio_client_instantiation" \
+  lint_issue_or_hybrid_warn "any" "twilio_client_instantiation" \
     "Twilio client instantiation found in $count file(s)" \
     "Replace with Telnyx client: from telnyx import Telnyx; client = Telnyx(api_key=...) (Python) or new Telnyx({ apiKey: ... }) (JS)" \
     "$(matches_to_json "$matches")"
@@ -877,7 +908,7 @@ twilio_dirs=$(find "$PROJECT_ROOT" -mindepth 1 \
   -o -type d -iname '*twilio*' -print 2>/dev/null || true)
 twilio_dir_count=$(echo "$twilio_dirs" | sed '/^$/d' | wc -l | tr -d ' ')
 if [ "$twilio_dir_count" -gt 0 ] && [ -n "$(echo "$twilio_dirs" | sed '/^$/d')" ]; then
-  lint_issue_or_hybrid_warn "twilio_directory_names" \
+  lint_issue_or_hybrid_warn "any" "twilio_directory_names" \
     "Found $twilio_dir_count directory name(s) containing 'twilio'" \
     "Rename directories: replace 'twilio' with 'telnyx' in directory names (e.g., feature/twilio/ → feature/telnyx/)" \
     "$(echo "$twilio_dirs" | sed '/^$/d' | head -10 | jq -R -s '{directories: (split("\n") | map(select(length > 0)))}' 2>/dev/null || echo '{"directories":[]}')"

providers/claude/plugins/telnyx-platform/skills/telnyx-twilio-migration/scripts/post-test-diagnostic.sh

@@ -214,9 +214,9 @@ if [ -f "$LINT_SCRIPT" ]; then
   [ -f "$PROJECT_ROOT/twilio-scan.json" ] && SCAN_ARG="--scan-json $PROJECT_ROOT/twilio-scan.json"
   LINT_JSON=$(bash "$LINT_SCRIPT" --json $SCAN_ARG "$PROJECT_ROOT" 2>/dev/null || echo "")
   if [ -n "$LINT_JSON" ]; then
-    LINT_ISSUES=$(echo "$LINT_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('issues',0))" 2>/dev/null || echo "?")
-    LINT_WARNS=$(echo "$LINT_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('warnings',0))" 2>/dev/null || echo "?")
-    LINT_PASSES=$(echo "$LINT_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('passes',0))" 2>/dev/null || echo "?")
+    LINT_ISSUES=$(echo "$LINT_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('summary',{}).get('issues',0))" 2>/dev/null || echo "?")
+    LINT_WARNS=$(echo "$LINT_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('summary',{}).get('warnings',0))" 2>/dev/null || echo "?")
+    LINT_PASSES=$(echo "$LINT_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('summary',{}).get('passes',0))" 2>/dev/null || echo "?")
     echo "  Issues: $LINT_ISSUES  Warnings: $LINT_WARNS  Passes: $LINT_PASSES"
 
     # Show issue details
@@ -247,18 +247,18 @@ if [ -f "$VALIDATE_SCRIPT" ]; then
   [ -f "$PROJECT_ROOT/twilio-scan.json" ] && SCAN_ARG="--scan-json $PROJECT_ROOT/twilio-scan.json"
   VALIDATE_JSON=$(bash "$VALIDATE_SCRIPT" --json $SCAN_ARG "$PROJECT_ROOT" 2>/dev/null || echo "")
   if [ -n "$VALIDATE_JSON" ]; then
-    VAL_FAILS=$(echo "$VALIDATE_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('fail_count',0))" 2>/dev/null || echo "?")
-    VAL_WARNS=$(echo "$VALIDATE_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('warn_count',0))" 2>/dev/null || echo "?")
-    VAL_PASSES=$(echo "$VALIDATE_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('pass_count',0))" 2>/dev/null || echo "?")
+    VAL_FAILS=$(echo "$VALIDATE_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('summary',{}).get('fail',0))" 2>/dev/null || echo "?")
+    VAL_WARNS=$(echo "$VALIDATE_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('summary',{}).get('warn',0))" 2>/dev/null || echo "?")
+    VAL_PASSES=$(echo "$VALIDATE_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('summary',{}).get('pass',0))" 2>/dev/null || echo "?")
     echo "  Fails: $VAL_FAILS  Warnings: $VAL_WARNS  Passes: $VAL_PASSES"
 
     echo "$VALIDATE_JSON" | python3 -c "
 import sys, json
 d = json.load(sys.stdin)
 for check in d.get('checks', []):
-    if check.get('status') == 'FAIL':
+    if str(check.get('status','')).lower() in ('fail', 'issue'):
         print(f\"    FAIL: {check.get('name', '?')}\")
-    elif check.get('status') == 'WARN':
+    elif str(check.get('status','')).lower() == 'warn':
         print(f\"    WARN: {check.get('name', '?')}\")
 " 2>/dev/null || true
   else

providers/claude/plugins/telnyx-platform/skills/telnyx-twilio-migration/scripts/run-validation.sh

@@ -149,6 +149,7 @@ if [ "$INCLUDE_TEXML" = true ]; then
   # failed the run on a stale bundle inside it - one run contradicting
   # itself on the same tree.
   TEXML_FILES=()
+  TEXML_INVALID_ROOTS=()
   while IFS= read -r -d '' file; do
     # Only TeXML documents belong in validate-texml.sh. Every *.xml went in
     # before, so a Maven pom.xml or Android layout was "validated" as TeXML
@@ -178,14 +179,33 @@ PYEOF
 )
     if [ "$root" = "Response" ]; then
       TEXML_FILES+=("$file")
+    else
+      # A DEDICATED .twiml/.texml extension declares the file's intent: it is
+      # meant to be a TeXML document, so a root that is not <Response> is a
+      # BROKEN document, not someone else's XML. Skipping it silently meant a
+      # misspelled or unconverted root (<Respones>, or a left-behind TwiML
+      # wrapper) was never validated and the migration certified clean.
+      # A generic .xml stays exempt - a pom.xml or an Android layout genuinely
+      # is not ours to judge.
+      case "${file,,}" in
+        *.twiml|*.texml) TEXML_INVALID_ROOTS+=("$file:${root:-<no element>}") ;;
+      esac
     fi
   done < <(find "$PROJECT_ROOT" \
     \( -name node_modules -o -name .git -o -name vendor -o -name __pycache__ \
        -o -name venv -o -name .venv -o -name dist -o -name build \
        -o -name .next -o -name .nuxt -o -name coverage -o -name .tox \) -prune \
     -o \( -iname "*.xml" -o -iname "*.twiml" -o -iname "*.texml" \) -print0 2>/dev/null)
 
-  if [ ${#TEXML_FILES[@]} -eq 0 ]; then
+  # Reported BEFORE the "no documents found" branch: a tree whose only TeXML
+  # files all have broken roots would otherwise print "none found - skipping"
+  # and pass, which is the silent certification this check exists to prevent.
+  if [ ${#TEXML_INVALID_ROOTS[@]} -gt 0 ]; then
+    for entry in "${TEXML_INVALID_ROOTS[@]}"; do
+      echo -e "  ${RED}FAIL${NC}  $(basename "${entry%:*}") — root element is <${entry##*:}>, expected <Response>"
+    done
+    RESULTS="${RESULTS}texml:fail,"
+  elif [ ${#TEXML_FILES[@]} -eq 0 ]; then
     echo -e "  ${BLUE}INFO${NC}  No TeXML documents found — skipping TeXML validation"
     RESULTS="${RESULTS}texml:skip,"
   else

providers/claude/plugins/telnyx-platform/skills/telnyx-twilio-migration/scripts/scan-twilio-usage.sh

@@ -318,9 +318,14 @@ SDK_PATTERNS=(
   # Java
   'import com.twilio'
   'com.twilio.'
-  # PHP
-  'use Twilio\\'
-  'Twilio\\'
+  # PHP. ONE backslash: this array is searched with `grep -F` (fixed string),
+  # where '\\' means two LITERAL backslashes and matches nothing real - PHP
+  # namespaces are written `use Twilio\Rest\Client`. Every PHP Twilio project
+  # therefore scanned as zero files and the whole language passed discovery
+  # silently. The doubling reads as correct next to the regex patterns below,
+  # which is why it survived: only the -F consumer makes it wrong.
+  'use Twilio\'
+  'Twilio\'
   # C# / .NET
   'using Twilio'
   'Twilio.'