chore: remove local Keychain repair wrapper

.github/workflows/ci.yml

@@ -58,12 +58,6 @@ jobs:
         with:
           go-version-file: go.mod
 
-  test-scripts:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: make test-scripts
-
   static-smoke:
     runs-on: ubuntu-latest
     env:

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all build test test-cover test-scripts test-static-smoke lint fmt tidy deps check install snapshot package-render-check release clean
+.PHONY: all build test test-cover test-static-smoke lint fmt tidy deps check install snapshot package-render-check release clean
 
 # Standard keyring tags: enable 1Password support, keep passage disabled.
 GOFLAGS ?= -tags=keyring_nopassage
@@ -12,9 +12,6 @@ build:
 test:
 	go test -v ./...
 
-test-scripts:
-	scripts/repair-codereview-keychain-acl.sh --self-test
-
 test-cover:
 	go test -coverprofile=coverage.out ./...
 
@@ -41,7 +38,7 @@ deps:
 	go mod download
 	go mod verify
 
-check: tidy fmt lint test test-scripts build
+check: tidy fmt lint test build
 
 install:
 	go install ./cmd/cr

docs/development.md

@@ -62,11 +62,10 @@ progress interface rather than importing Cobra or root options.
 ```bash
 make build   # compile the binary
 make test    # go test ./...
-make test-scripts # run script self-tests
 make lint    # golangci-lint run
 make tidy    # go mod tidy and verify go.mod is unchanged
 make deps    # download and verify Go modules
-make check   # tidy + fmt + lint + test + test-scripts + build
+make check   # tidy + fmt + lint + test + build
 make clean   # remove build artifacts
 ```
 

scripts/README.md

@@ -1,40 +1,26 @@
 # Scripts
 
-This directory contains repository support and verification tools. These scripts
-are not part of the shipped `cr` command surface.
+Repository support and verification tools. These scripts are not part of the
+shipped `cr` command surface.
 
-## `repair-codereview-keychain-acl.sh`
+macOS Keychain credential ACL repair is shared across the Open CLI Collective
+tool family. The canonical helper lives in
+`open-cli-collective/cli-common`:
 
-Repairs macOS Keychain generic-password ACLs for the `codereview` service when
-older items still trust only ad-hoc or per-build `cdhash` identities instead of
-the stable-signed `cr` release binary.
-
-Use it when `cr` repeatedly prompts for the same Keychain items after upgrading
-from older unsigned or ad-hoc-signed builds. Run it as the normal macOS user who
-owns the login Keychain, not with `sudo`.
-
-Default mode is a dry-run:
+- Source of truth:
+  <https://github.com/open-cli-collective/cli-common/blob/main/scripts/repair-macos-keychain-credentials.sh>
+- If you already have `../cli-common` checked out locally, you can run it from
+  the sibling checkout:
 
 ```bash
-./scripts/repair-codereview-keychain-acl.sh
+../cli-common/scripts/repair-macos-keychain-credentials.sh --tool cr
 ```
 
-Apply repairs explicitly:
+Preview and apply the additive heal path:
 
 ```bash
-./scripts/repair-codereview-keychain-acl.sh --apply
+../cli-common/scripts/repair-macos-keychain-credentials.sh --tool cr --heal
+../cli-common/scripts/repair-macos-keychain-credentials.sh --tool cr --heal --apply
 ```
 
-The script does not read or print secret values. In `--apply` mode it updates
-only `cdhash-only` generic-password items for the selected service and keychain
-so they trust the current stable-signed `cr` binary. Items classified as
-`missing-current-cr` are reported for manual inspection rather than changed.
-
-Apply mode is intentionally additive. For explicit app-list ACL entries, the
-helper appends current `cr` trust while preserving existing trusted applications.
-It skips decrypt ACLs with `NULL` or non-explicit app lists instead of narrowing
-their meaning to one trusted application.
-
-`stable+stale-cdhash` means current `cr` is already trusted. macOS may still
-report older cdhash grants or partition metadata for that item; the script treats
-that state as repaired and does not try to purge historical metadata.
+The heavier cleanup and rebuild paths also live in that shared helper.