@cxi-lmai/ci-agent-platform 3.0.1 → 3.1.1

package/README.md

@@ -8,7 +8,8 @@ checks the result. The input is a spec, the output is code. Details in
 [docs/issue-to-code.md](https://gitlab.com/cxi-lmai/ci-agent-platform/-/blob/main/docs/issue-to-code.md).
 
 - **15 generic agents**: triage, coding, review, tests, docs, release.
-- **7 skills**, configured per project.
+- **12 skills**, configured per project.
+- **13 top-level runner scripts** and **65 CI `PIPE_*` variables**.
 - **Project specifics live outside the agents**, in `.claude/pipeline-config.md` and `PIPE_*` variables.
 
 > [!NOTE]
@@ -16,7 +17,11 @@ checks the result. The input is a spec, the output is code. Details in
 > - the **review loop** (`review`, `review-fix`, `test-fix`, and the shared escalation `/postmortem-mr`),
 > - the **issue-to-code loop** (`orchestrate`, `code`, skills `triage-issue` and `implement-issue`).
 >
-> The other agents are installed too but have no CI job of their own. You invoke them by hand from the command line.
+> Seven opt-in jobs are wired by the GitLab CI template and are off by default:
+> `docs-sync`, `coverage-ratchet`, `cve-fix`, `e2e-test-gen`, `codebase-audit`,
+> `agent-architect`, and `metrics-snapshot`.
+> The other agents are installed too but have no CI job of their own. You invoke
+> them by hand from the command line.
 
 > [!CAUTION]
 > The coder runs with `--dangerously-skip-permissions` and treats issue content
@@ -44,6 +49,7 @@ checks the result. The input is a spec, the output is code. Details in
 - [How it fits together](#how-it-fits-together)
 - [Possible extensions: changing agents and skills](#possible-extensions-changing-agents-and-skills)
 - [Reference: secrets and variables](https://gitlab.com/cxi-lmai/ci-agent-platform/-/blob/main/docs/reference-variables.md)
+- [Reference: metrics and snapshots](https://gitlab.com/cxi-lmai/ci-agent-platform/-/blob/main/docs/metrics.md)
 
 ## The full cycle
 
@@ -67,15 +73,17 @@ untouched file from one the project has edited.
 ├── payload/                              # everything that ships into your repo
 │   ├── INSTALL.md                        #   instructions for Claude, copied to your root
 │   ├── agents/                           #   15 agent definitions (.md)
-│   ├── skills/                           #   7 skills (folder with a SKILL.md)
+│   ├── agents-omp/                       #   15 omp-native agent definitions (.md)
+│   ├── skills/                           #   12 skills (folder with a SKILL.md)
 │   ├── templates/                        #   3 templates: config, spec issue, suppressions
 │   └── ci-templates/                     #   CI jobs and runner scripts (wired by the wizard)
 │       ├── claude-pipeline.gitlab-ci.yml #     GitLab CI template
 │       ├── github/                       #     GitHub Actions workflows
-│       └── scripts/                      #     shared runner scripts (both platforms)
+│       └── scripts/                      #     13 top-level runner scripts (both platforms)
 ├── docs/                                 # supplementary documentation, not shipped
 │   ├── diagrams/
 │   ├── issue-to-code.md
+│   ├── metrics.md
 │   ├── reference-variables.md
 │   └── superpowers/                      #   this repository's own plans and specs
 ├── examples/unitconv/                    # a filled-in example config, not shipped

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cxi-lmai/ci-agent-platform",
-  "version": "3.0.1",
+  "version": "3.1.1",
   "description": "Autonomous dev pipeline on plain GitLab CI or GitHub Actions, driven by Claude Code. A labeled issue goes in, an open merge request comes out.",
   "keywords": [
     "claude",
@@ -41,7 +41,7 @@
   "scripts": {
     "test": "npm run test:lint && npm run test:gates && npm run test:unit",
     "test:lint": "shellcheck -S warning test/*.sh payload/ci-templates/scripts/*.sh payload/ci-templates/scripts/lib/*.sh",
-    "test:gates": "bash test/coherence-gate.sh all && bash test/restructure-invariants.sh verify && bash test/harness-dispatch.sh all",
+    "test:gates": "bash test/coherence-gate.sh all && bash test/restructure-invariants.sh verify && bash test/harness-dispatch.sh all && bash test/failure-notice.sh && bash test/decompose-validation.sh && bash test/platform-helpers.sh && bash test/coverage-ratchet.sh && bash test/cve-fix.sh && bash test/e2e-test-gen.sh && bash test/agent-architect.sh",
     "test:unit": "node --test \"test/*.test.mjs\""
   }
 }

package/payload/INSTALL.md

@@ -56,7 +56,13 @@ never has to enter this conversation.
    The reviewer agents read it on every run, and without the file they read a
    missing path on a repository that has just been told the pipeline is
    installed.
-4. Copy the CI template and runner scripts. The runner scripts go to the same
+4. Create `.claude/memory/MEMORY.md` from
+   `<src>/templates/memory-index.template.md` **when it does not already
+   exist**, and never touch it when it does: it is a project-owned index.
+   The three tiers are `CLAUDE.md` for hardwired instructions and an index,
+   `docs/` for long-term patterns and architecture, and `.claude/memory/` for
+   active project state and cross-agent signals.
+5. Copy the CI template and runner scripts. The runner scripts go to the same
    place on both platforms, `.claude-pipeline/scripts/`, which is the default
    `PIPE_SCRIPTS_DIR` the CI template already points at. Only the CI definition
    differs:
@@ -67,7 +73,7 @@ never has to enter this conversation.
      `<src>/ci-templates/scripts/` to `.claude-pipeline/scripts/`. Ask before
      replacing a workflow file that already exists; `claude-pipeline.yml` is an
      ordinary enough name to collide.
-5. Check `.gitignore`. The bootstrapper already added `.ci-agent-platform-src/`,
+6. Check `.gitignore`. The bootstrapper already added `.ci-agent-platform-src/`,
    `.claude/onboarding-state.md` (the wizard's progress marker, see the skill's
    ground rules) and `build/pipeline/` (the default `PIPE_CONTEXT_DIR`, the
    runner's working files). Add any that are missing. The source folder is a

package/payload/agents/agent-architect.md

@@ -2,7 +2,7 @@
 name: agent-architect
 description: Weekly agent-improvement lab. Reads recently merged MRs/PRs, review comments, and stuck-MR postmortems, then proposes improvements to .claude/agents/*.md files as actionable platform issues (auto-filed with the pipeline's ready label). Output is a structured markdown report consumed by the CI script. Never auto-applies changes to CLAUDE.md or .claude/settings.json.
 tools: Glob, Grep, LS, Read
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 ---
 
 You are the Agent Lab for this project's autonomous development pipeline.

package/payload/agents/code-reviewer.md

@@ -2,7 +2,7 @@
 name: code-reviewer
 description: Reviews code for bugs, logic errors, security vulnerabilities, code quality issues, and adherence to project conventions, using confidence-based filtering to report only high-priority issues that truly matter
 tools: Glob, Grep, LS, Read, Write, NotebookRead, WebFetch, TodoWrite, WebSearch, KillShell, BashOutput, mcp__context7__resolve-library-id, mcp__context7__get-library-docs
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 color: red
 ---
 

package/payload/agents/codebase-auditor.md

@@ -2,7 +2,7 @@
 name: codebase-auditor
 description: Periodic codebase auditor. Reads project conventions and docs, reads recently merged MR/PR file changes, and produces a focused report of critical convention violations and genuinely new undocumented patterns. Uses confidence-based filtering to report only issues that truly matter.
 tools: Glob, Grep, LS, Read
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 ---
 
 You are the codebase auditor. You produce a periodic report of critical convention violations and genuinely new, reusable patterns worth documenting.

package/payload/agents/coder.md

@@ -2,7 +2,7 @@
 name: coder
 description: Autonomous implementation agent. Given an issue description, explores existing patterns, implements the feature or fix, writes tests, runs the build in a self-correcting loop (up to 3 retries), and commits. Never pushes.
 tools: Agent, Bash, Edit, Glob, Grep, LS, MultiEdit, NotebookRead, Read, TodoWrite, WebFetch, WebSearch, Write, mcp__context7__resolve-library-id, mcp__context7__get-library-docs
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 ---
 
 You are the autonomous coder agent for this project.

package/payload/agents/decomposer.md

@@ -1,7 +1,7 @@
 ---
 name: decomposer
 description: Decomposes a too-large issue into a dependency-ordered chain of spec-compliant sub-issues. Returns structured JSON with confidence verdict, reason, and fully authored sub-issue bodies ready for creation on the project platform.
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 ---
 
 You are the decomposer for the autonomous development pipeline.

package/payload/agents/docs-sync.md

@@ -2,7 +2,7 @@
 name: docs-sync
 description: Checks whether MR/PR code changes require updates to project docs, CLAUDE.md, or .claude/memory/. On autonomous MRs it applies the updates directly; on human MRs it reports the gaps for a comment.
 tools: Glob, Grep, LS, Read, Write, Edit
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 color: blue
 ---
 

package/payload/agents/e2e-test-writer.md

@@ -1,7 +1,7 @@
 ---
 name: e2e-test-writer
 description: Generates a single end-to-end (E2E) test spec file for a frontend issue, following the project's configured E2E framework, test directory, fixtures, test-data prefix, cleanup rules, and tags
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 ---
 
 You are an end-to-end (E2E) test writer. Given an issue, you produce one E2E test spec file that follows the project's configured E2E framework and conventions.

package/payload/agents/performance-reviewer.md

@@ -2,7 +2,7 @@
 name: performance-reviewer
 description: Reviews changed data-access and hot-path code for confirmed scalability regressions such as repeated I/O, unbounded work, excessive loading, and missing batching or pagination
 tools: Glob, Grep, Read, NotebookRead, WebFetch, TodoWrite, WebSearch, KillShell, BashOutput
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 color: yellow
 ---
 

package/payload/agents/release-mr.md

@@ -2,7 +2,7 @@
 name: release-mr
 description: Creates a release MR/PR from the integration branch to the production branch with a structured description listing changes, migrations, env changes, and a deploy checklist. Use when the user wants to prepare a release or merge the integration branch into production.
 tools: Bash, Glob, Grep, Read, TodoWrite
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 ---
 
 You are the release MR/PR agent. Your job is to analyze everything that changed on the integration branch since the last release to the production branch, then create (or update) a well-structured release request.

package/payload/agents/security-reviewer.md

@@ -2,7 +2,7 @@
 name: security-reviewer
 description: Reviews code for security vulnerabilities (authentication bypass, authorization flaws, injection, tenant/data isolation leaks, CSRF misconfiguration, sensitive data exposure) using confidence-based filtering to report only confirmed issues
 tools: Glob, Grep, LS, Read, NotebookRead, WebFetch, TodoWrite, WebSearch, KillShell, BashOutput
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 color: red
 ---
 

package/payload/agents/test-fix.md

@@ -2,7 +2,7 @@
 name: test-fix
 description: Fixes failing tests in pipeline merge requests. Reads failing test files and their production source classes, determines root cause, fixes implementation or test as needed, verifies compilation, and commits. Never pushes.
 tools: Agent, Bash, Edit, Glob, Grep, LS, MultiEdit, NotebookRead, Read, TodoWrite, Write
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 ---
 
 You are the test-fix agent. Your job is to fix failing tests in a merge request, not to rewrite features.

package/payload/agents/test-writer.md

@@ -2,7 +2,7 @@
 name: test-writer
 description: Generates integration and unit tests that increase coverage for new or changed code, following the project's documented testing patterns, with a self-correcting compilation loop
 tools: Agent, Bash, Edit, Glob, Grep, LS, MultiEdit, NotebookRead, Read, TodoWrite, Write
-model: claude-sonnet-5-0
+model: claude-sonnet-5
 color: green
 ---
 

package/payload/agents-omp/agent-architect.md

@@ -2,7 +2,7 @@
 name: agent-architect
 description: Weekly agent-improvement lab. Reads recently merged MRs/PRs, review comments, and stuck-MR postmortems, then proposes improvements to .claude/agents/*.md files as actionable platform issues (auto-filed with the pipeline's ready label). Output is a structured markdown report consumed by the CI script. Never auto-applies changes to CLAUDE.md or .claude/settings.json.
 tools: glob, grep, read
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are the Agent Lab for this project's autonomous development pipeline.

package/payload/agents-omp/code-reviewer.md

@@ -2,7 +2,7 @@
 name: code-reviewer
 description: Reviews code for bugs, logic errors, security vulnerabilities, code quality issues, and adherence to project conventions, using confidence-based filtering to report only high-priority issues that truly matter
 tools: glob, grep, read, write, todo, web_search, mcp__context7__resolve-library-id, mcp__context7__get-library-docs
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are an expert code reviewer specializing in modern software development across multiple languages and frameworks. Your primary responsibility is to review code against project guidelines in CLAUDE.md with high precision to minimize false positives.

package/payload/agents-omp/codebase-auditor.md

@@ -2,7 +2,7 @@
 name: codebase-auditor
 description: Periodic codebase auditor. Reads project conventions and docs, reads recently merged MR/PR file changes, and produces a focused report of critical convention violations and genuinely new undocumented patterns. Uses confidence-based filtering to report only issues that truly matter.
 tools: glob, grep, read
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are the codebase auditor. You produce a periodic report of critical convention violations and genuinely new, reusable patterns worth documenting.

package/payload/agents-omp/coder.md

@@ -3,7 +3,7 @@ name: coder
 description: Autonomous implementation agent. Given an issue description, explores existing patterns, implements the feature or fix, writes tests, runs the build in a self-correcting loop (up to 3 retries), and commits. Never pushes.
 tools: task, bash, edit, glob, grep, read, todo, web_search, write, mcp__context7__resolve-library-id, mcp__context7__get-library-docs
 spawns: test-writer, docs-sync
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are the autonomous coder agent for this project.

package/payload/agents-omp/decomposer.md

@@ -1,7 +1,7 @@
 ---
 name: decomposer
 description: Decomposes a too-large issue into a dependency-ordered chain of spec-compliant sub-issues. Returns structured JSON with confidence verdict, reason, and fully authored sub-issue bodies ready for creation on the project platform.
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are the decomposer for the autonomous development pipeline.

package/payload/agents-omp/docs-sync.md

@@ -2,7 +2,7 @@
 name: docs-sync
 description: Checks whether MR/PR code changes require updates to project docs, CLAUDE.md, or .claude/memory/. On autonomous MRs it applies the updates directly; on human MRs it reports the gaps for a comment.
 tools: glob, grep, read, write, edit
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are the documentation sync agent.

package/payload/agents-omp/e2e-test-writer.md

@@ -1,7 +1,7 @@
 ---
 name: e2e-test-writer
 description: Generates a single end-to-end (E2E) test spec file for a frontend issue, following the project's configured E2E framework, test directory, fixtures, test-data prefix, cleanup rules, and tags
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are an end-to-end (E2E) test writer. Given an issue, you produce one E2E test spec file that follows the project's configured E2E framework and conventions.

package/payload/agents-omp/migration-reviewer.md

@@ -2,7 +2,7 @@
 name: migration-reviewer
 description: Reviews database and data migrations for execution failures, unsafe or destructive operations, compatibility risks, and violations of the project's documented migration conventions
 tools: glob, grep, read
-model: openrouter/anthropic/claude-haiku-4-5
+model: openrouter/anthropic/claude-haiku-4.5
 ---
 
 You are a database migration reviewer. Work with the migration technology and

package/payload/agents-omp/orchestrator.md

@@ -1,7 +1,7 @@
 ---
 name: orchestrator
 description: Analyzes issues on the project platform for actionability and scope. Returns structured JSON classifying whether an issue has sufficient detail and fits within one coder agent session.
-model: openrouter/anthropic/claude-haiku-4-5
+model: openrouter/anthropic/claude-haiku-4.5
 ---
 
 You are the orchestrator for the autonomous development pipeline.

package/payload/agents-omp/performance-reviewer.md

@@ -2,7 +2,7 @@
 name: performance-reviewer
 description: Reviews changed data-access and hot-path code for confirmed scalability regressions such as repeated I/O, unbounded work, excessive loading, and missing batching or pagination
 tools: glob, grep, read, todo, web_search
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are a performance reviewer. Work with the language, framework, storage

package/payload/agents-omp/postmortem.md

@@ -2,7 +2,7 @@
 name: postmortem
 description: Analyzes failed in-progress MRs/PRs and produces structured diagnostics when the pipeline labels an MR as stuck
 tools: glob, grep, read
-model: openrouter/anthropic/claude-haiku-4-5
+model: openrouter/anthropic/claude-haiku-4.5
 ---
 
 You are a diagnostic specialist analyzing failed automated CI fix attempts.

package/payload/agents-omp/release-mr.md

@@ -2,7 +2,7 @@
 name: release-mr
 description: Creates a release MR/PR from the integration branch to the production branch with a structured description listing changes, migrations, env changes, and a deploy checklist. Use when the user wants to prepare a release or merge the integration branch into production.
 tools: bash, glob, grep, read, todo
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are the release MR/PR agent. Your job is to analyze everything that changed on the integration branch since the last release to the production branch, then create (or update) a well-structured release request.

package/payload/agents-omp/security-reviewer.md

@@ -2,7 +2,7 @@
 name: security-reviewer
 description: Reviews code for security vulnerabilities (authentication bypass, authorization flaws, injection, tenant/data isolation leaks, CSRF misconfiguration, sensitive data exposure) using confidence-based filtering to report only confirmed issues
 tools: glob, grep, read, todo, web_search
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are an expert security reviewer. Your primary responsibility is to identify security vulnerabilities with high precision. False positives waste developer time and erode trust in the review process.

package/payload/agents-omp/test-fix.md

@@ -2,7 +2,7 @@
 name: test-fix
 description: Fixes failing tests in pipeline merge requests. Reads failing test files and their production source classes, determines root cause, fixes implementation or test as needed, verifies compilation, and commits. Never pushes.
 tools: task, bash, edit, glob, grep, read, todo, write
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are the test-fix agent. Your job is to fix failing tests in a merge request, not to rewrite features.

package/payload/agents-omp/test-writer.md

@@ -2,7 +2,7 @@
 name: test-writer
 description: Generates integration and unit tests that increase coverage for new or changed code, following the project's documented testing patterns, with a self-correcting compilation loop
 tools: task, bash, edit, glob, grep, read, todo, write
-model: openrouter/anthropic/claude-sonnet-5-0
+model: openrouter/anthropic/claude-sonnet-5
 ---
 
 You are the test-writer agent. Your job is to write tests that increase coverage for new or changed code.

package/payload/ci-templates/claude-pipeline.gitlab-ci.yml

@@ -82,12 +82,71 @@ variables:
   PIPE_VERIFY_CMD: ""                   # compile + unit tests, run after a fix
   PIPE_COMPILE_CMD: ""                  # compile only (defaults to PIPE_VERIFY_CMD)
   PIPE_TEST_REPORT_GLOB: ""             # e.g. build/test-results/**/TEST-*.xml
+  PIPE_COVERAGE_RATCHET: "0"            # set to "1" to gate MR coverage against the target branch
+  PIPE_COVERAGE_REPORT: ""              # path to the coverage report generated by the project
+  PIPE_COVERAGE_REPORT_KIND: "jacoco"   # report parser; only jacoco is currently supported
   PIPE_COVERAGE_SIGNAL: ""              # path to a coverage-drop signal file
+  # To enable the gate, configure both report and signal paths. Its baseline is
+  # the target branch's latest successful pipeline `coverage` value; the
+  # project's test job must publish that value (through `coverage:` or a report)
+  # or the baseline is 0 and no drop can fire.
+
+
+  # --- CVE remediation (optional) -------------------------------------------
+  # A project-local security scanner supplies PIPE_CVE_LIST. The platform does
+  # not select a scanner or prescribe its severity filtering.
+  PIPE_CVE_FIX: "0"                     # set to "1" to enable CVE remediation on MR/PR pipelines
+  PIPE_DEPENDENCY_MANIFEST: "build.gradle"
+  PIPE_CVE_SUPPRESSIONS: "owasp-suppressions.xml"
+
+  # --- Issue-driven E2E test generation (optional) --------------------------
+  # A scheduled run selects test-ready issues. PIPE_E2E_VERIFY_CMD must be the
+  # project's explicit E2E command and accept the generated test path as its
+  # final argument. This generic template does not choose a framework, runtime
+  # image, install command, credentials, or URL.
+  PIPE_E2E_TEST_GEN: "0"
+  PIPE_LABEL_TESTREADY: "test-ready"
+  PIPE_LABEL_E2E_SCOPE: ""
+  PIPE_E2E_TEST_DIR: "e2e/tests"
+  PIPE_E2E_BASE_URL: ""
+  PIPE_E2E_VERIFY_CMD: ""
+
+  # --- Documentation sync (optional) ----------------------------------------
+  PIPE_DOCS_SYNC: "0"                   # set to "1" to enable the docs-sync job
+  PIPE_DOCS_ROOTS: "docs,CLAUDE.md,.claude/memory"   # paths docs-sync may edit and commit
+
+  # --- Codebase audit (optional) ---------------------------------------------
+  PIPE_CODEBASE_AUDIT: "0"              # set to "1" in a schedule to run the periodic audit
+  PIPE_LABEL_AUDIT: "codebase-audit"    # label on the findings issue and its auto-fix MR/PR
+
+  # --- Agent architect (optional) --------------------------------------------
+  # A scheduled evidence-backed review of agent definitions. Default to
+  # report-only; set this false or 0 only after reviewing a dry-run report.
+  PIPE_AGENT_ARCHITECT: "0"
+  PIPE_ARCHITECT_WINDOW_DAYS: "7"
+  PIPE_ARCHITECT_DRY_RUN: "true"
+  PIPE_LABEL_IMPROVEMENT: "pipe-improvement"
+
+  # --- Metrics aggregation (optional) ---------------------------------------
+  PIPE_METRICS_SNAPSHOT: "0"            # set to "1" in a schedule to aggregate
+  PIPE_METRICS_OUTPUT_DIR: "data/metrics/snapshots"
+  PIPE_METRICS_WINDOW_DAYS: "1"
+  PIPE_METRICS_COMMIT_REPO: "false"     # "true" also commits the snapshot
+  PIPE_METRICS_REVIEW_AGENTS: "code-reviewer,review-verdict,review-fix"
+  PIPE_METRICS_DEFECT_REVERT: "Reverts !"
+  PIPE_METRICS_DEFECT_REGRESSION: "Fixes regression from !"
+  PIPE_METRICS_DEFECT_REINTRODUCE: "Reintroduces work from !"
+  PIPE_METRICS_SNAPSHOT_DATE: ""        # override the snapshot date, replay only
+  PIPE_METRICS_RAW_DIR: ""              # OFFLINE only: pre-staged records
+  PIPE_METRICS_MRS_FILE: ""             # OFFLINE only: merge request list
 
   # --- Commit subjects (drive the fix-loop cap counters) ---------------------
   PIPE_COMMIT_TESTFIX: "Fix test errors"
   PIPE_COMMIT_REVIEWFIX: "Fix review findings"
   PIPE_COMMIT_COVERAGE: "Add coverage tests"
+  PIPE_COMMIT_DOCSSYNC: "Update docs per docs-sync findings"
+  PIPE_COMMIT_AUDIT: "docs: apply convention audit findings"
+  PIPE_COMMIT_CVEFIX: "Update dependencies to resolve CVEs"
 
   # --- Caps + models ---------------------------------------------------------
   PIPE_FIX_LOOP_CAP: "2"
@@ -99,6 +158,7 @@ variables:
   # --- Result files (defaults live under PIPE_CONTEXT_DIR) --------------------
   PIPE_RESULT_REVIEW: "$PIPE_CONTEXT_DIR/code-review-result.txt"
   PIPE_RESULT_REVIEWFIX: "$PIPE_CONTEXT_DIR/review-fix-result.json"
+  PIPE_RESULT_DOCSSYNC: "$PIPE_CONTEXT_DIR/docs-sync.json"
 
 # --- Hidden base job: shared config + runtime variable mapping ---------------
 # Maps GitLab's CI_ runtime variables onto the PIPE_ names the scripts read, and
@@ -123,6 +183,14 @@ variables:
     # ship it, plain docker images (node:22-bookworm) do not, so install it
     # here (finding from the GitLab pilot: silent HTTP 400s + exit 127).
     - command -v jq >/dev/null 2>&1 || (apt-get update -qq && apt-get install -y -qq jq)
+    # node:22-bookworm does not include xmllint. Install it only for the
+    # opt-in ratchet. Unsupported custom-image installation stays non-fatal so
+    # coverage-ratchet can issue its explicit missing-tool error when it runs.
+    - |
+      if [ "$PIPE_COVERAGE_RATCHET" = "1" ] && ! command -v xmllint >/dev/null 2>&1; then
+        command -v apt-get >/dev/null 2>&1 &&
+          (apt-get update -qq && apt-get install -y -qq libxml2-utils) || true
+      fi
     - |
       if [ "$PIPE_HARNESS" = "omp" ]; then
         command -v omp >/dev/null 2>&1 || npm install -g @oh-my-pi/pi-coding-agent
@@ -176,6 +244,42 @@ review-fix:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PIPE_TARGET_BRANCH && $CI_MERGE_REQUEST_LABELS =~ $PIPE_LABEL_WIP'
       when: on_failure
 
+# =============================================================================
+# docs-sync: check whether the MR's code changes need documentation updates.
+# Optional and off by default, because it spends tokens on every MR: enable it
+# by setting PIPE_DOCS_SYNC=1. On a wip MR the agent applies the updates and
+# this job commits and pushes them; on any other MR it posts an advisory
+# comment only. It never gates the pipeline.
+# =============================================================================
+docs-sync:
+  extends: .claude-base
+  stage: review
+  timeout: 30m
+  variables:
+    GIT_STRATEGY: clone
+  script:
+    - bash "$PIPE_SCRIPTS_DIR/docs-sync.sh"
+  allow_failure: true
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PIPE_TARGET_BRANCH && $PIPE_DOCS_SYNC == "1"'
+
+# =============================================================================
+# cve-fix: optionally remediate HIGH/CRITICAL vulnerabilities supplied by a
+# project-local scanner in PIPE_CVE_LIST. The coder only runs on an autonomous
+# MR/PR; human-authored MRs receive a manual-update comment instead.
+# =============================================================================
+cve-fix:
+  extends: .claude-base
+  stage: review
+  timeout: 45m
+  variables:
+    GIT_STRATEGY: clone
+  script:
+    - bash "$PIPE_SCRIPTS_DIR/cve-fix.sh"
+  allow_failure: true
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PIPE_TARGET_BRANCH && $PIPE_CVE_FIX == "1"'
+
 # =============================================================================
 # orchestrate: triage ready issues and fire the coder (issue -> code loop).
 # Runs on a scheduled pipeline that sets PIPE_ORCHESTRATE=1 (kept off by default
@@ -198,6 +302,45 @@ orchestrate:
     - if: '$CI_PIPELINE_SOURCE == "web" && $PIPE_ORCHESTRATE == "1"'
 
 # =============================================================================
+# codebase-audit: periodic convention-drift scan. Scans recently merged MRs/PRs
+# and compares patterns against documented conventions via the codebase-auditor
+# agent. Posts findings as an issue labeled $PIPE_LABEL_AUDIT. If the report
+# suggests documentation updates and a push-capable identity is configured,
+# spawns the coder agent to implement them and opens an MR/PR.
+# Opt-in and off by default: enable by setting PIPE_CODEBASE_AUDIT=1 on a
+# separate scheduled pipeline (e.g. monthly).
+# =============================================================================
+codebase-audit:
+  extends: .claude-base
+  stage: orchestrate
+  timeout: 30m
+  variables:
+    GIT_STRATEGY: clone
+  script:
+    - bash "$PIPE_SCRIPTS_DIR/codebase-audit.sh"
+  allow_failure: true
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule" && $PIPE_CODEBASE_AUDIT == "1"'
+
+
+# =============================================================================
+# agent-architect: weekly, evidence-backed improvement proposals for shipped
+# agent definitions. Schedule-only and opt-in because it spends model tokens;
+# set DRY_RUN=true for an initial report-only trial.
+# =============================================================================
+agent-architect:
+  extends: .claude-base
+  stage: review
+  timeout: 30m
+  variables:
+    GIT_STRATEGY: clone
+    DRY_RUN: "$PIPE_ARCHITECT_DRY_RUN"
+  script:
+    - bash "$PIPE_SCRIPTS_DIR/agent-architect.sh"
+  allow_failure: true
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule" && $PIPE_AGENT_ARCHITECT == "1"'
+# =============================================================================
 # code: implement one issue and open the MR (issue -> code loop).
 # Triggered by orchestrate via the Pipeline Trigger API with CODER_ISSUE and
 # CODER_BRANCH set. The coder agent runs with --dangerously-skip-permissions on
@@ -214,6 +357,48 @@ code:
   rules:
     - if: '$CODER_ISSUE && $CODER_BRANCH'
 
+# =============================================================================
+# e2e-test-gen: scheduled, opt-in generation for issues carrying the configured
+# test-ready label (and optional E2E scope label). The project supplies the
+# verification command and any framework/runtime setup through its own CI.
+# =============================================================================
+e2e-test-gen:
+  extends: .claude-base
+  stage: test
+  timeout: 45m
+  variables:
+    GIT_STRATEGY: clone
+  script:
+    - bash "$PIPE_SCRIPTS_DIR/e2e-test-gen.sh"
+  allow_failure: true
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule" && $PIPE_E2E_TEST_GEN == "1"'
+
+# =============================================================================
+# coverage-ratchet: optional MR coverage gate. Reads the project's coverage
+# artifact and, for a wip coverage drop, fails into test-fix with its signal.
+# =============================================================================
+coverage-ratchet:
+  extends: .claude-base
+  stage: test
+  needs:
+    - job: test
+      artifacts: true
+      optional: true
+  variables:
+    GIT_STRATEGY: clone
+  script:
+    - bash "$PIPE_SCRIPTS_DIR/coverage-ratchet.sh"
+  artifacts:
+    paths:
+      - $PIPE_CONTEXT_DIR/metrics/
+      - $PIPE_COVERAGE_SIGNAL
+    when: always
+    expire_in: 60 days
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PIPE_TARGET_BRANCH && $PIPE_COVERAGE_RATCHET == "1"'
+      when: always
+
 # =============================================================================
 # test-fix: on failure of YOUR project's `test` job, on a wip MR, fix tests /
 # compilation / coverage. Consumes the test job's artifacts via needs.
@@ -226,6 +411,9 @@ test-fix:
     - job: test
       artifacts: true
       optional: true
+    - job: coverage-ratchet
+      artifacts: true
+      optional: true
   variables:
     GIT_STRATEGY: clone
   script:
@@ -234,3 +422,25 @@ test-fix:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $PIPE_TARGET_BRANCH && $CI_MERGE_REQUEST_LABELS =~ $PIPE_LABEL_WIP'
       when: on_failure
+
+# =============================================================================
+# metrics-snapshot: aggregates one day of pipeline metrics into a JSON snapshot.
+# Optional and off by default. Enable by setting PIPE_METRICS_SNAPSHOT=1 on a
+# scheduled pipeline. Writes an artifact; set PIPE_METRICS_COMMIT_REPO=true to
+# also commit the snapshot to the target branch.
+# =============================================================================
+metrics-snapshot:
+  extends: .claude-base
+  stage: orchestrate
+  timeout: 30m
+  variables:
+    GIT_DEPTH: "0"
+  script:
+    - bash "$PIPE_SCRIPTS_DIR/metrics-snapshot.sh"
+  artifacts:
+    paths:
+      - $PIPE_METRICS_OUTPUT_DIR/
+    when: always
+    expire_in: 90 days
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule" && $PIPE_METRICS_SNAPSHOT == "1"'