Sync public scripts to 8ac7413

scripts/cli-first-contract-smoke.js

@@ -66,6 +66,21 @@ expect(
   "billing plan flags are placeholders",
   /Design-document references to billing, paid plans, or plan flags are future metadata placeholders; they do not require MVP CLI commands, coordinator routes, schemas, migrations, website controls, or service logic/
 );
+expect(
+  criteria,
+  "hosted signup remains private Authentik-backed flow",
+  /Hosted account creation is available only through the private hosted identity flow, backed by Authentik[\s\S]*first-login account\/project creation stays inside/
+);
+expect(
+  criteria,
+  "hosted signup provider and password policy criteria",
+  /approved external identity-provider requirement[\s\S]*disasmer_native_password_signup_allowed: false/
+);
+expect(
+  criteria,
+  "hosted signup sanitized failure criteria",
+  /Signup failures do not disclose moderation, abuse-scoring, or allow\/deny internals[\s\S]*stripping issuer, allowlist, abuse-score, moderation-note, and provider-secret details/
+);
 
 const lines = criterionLines(criteria);
 assert(lines.length > 0, "CLI-first criteria must contain criteria lines");