@event4u/agent-config 1.39.0 → 1.40.0

package/.agent-src/commands/orchestrate.md

@@ -0,0 +1,123 @@
+---
+name: orchestrate
+cluster: orchestrate
+skills: [subagent-orchestration]
+description: Run a YAML pipeline defined under `.agent-config/orchestrations/` — chains personas / skills / commands / sub-agents per the orchestration-dsl-v1 contract
+disable-model-invocation: true
+suggestion:
+  eligible: true
+  trigger_description: "run a saved orchestration / pipeline / chain"
+  trigger_context: "user names a pipeline file or asks to replay a chain"
+---
+
+# orchestrate
+
+## Instructions
+
+Execute a YAML pipeline file from `.agent-config/orchestrations/`
+against the current workspace. Pipelines are deterministic chains of
+personas, skills, commands, and sub-agents pinned by the
+[`orchestration-dsl-v1`](../docs/contracts/orchestration-dsl-v1.md)
+contract.
+
+This command is the **runtime** side of the contract. The schema and
+the linter (`scripts/lint_orchestration_dsl.py`) live on the authoring
+side; this command reads the same shape and dispatches each step.
+
+### 1. Resolve the pipeline file
+
+- The user passes either a pipeline name (`pr-readiness-check`) or a
+  path (`.agent-config/orchestrations/pr-readiness-check.yaml`).
+- Resolve to a path under `.agent-config/orchestrations/`. Refuse
+  paths outside that directory — pipelines live in one place.
+- If the file does not exist, list the available pipelines and stop.
+
+### 2. Validate before run
+
+Run the linter against the resolved file:
+
+```
+python3 scripts/lint_orchestration_dsl.py --file <path>
+```
+
+Exit code ≠ 0 → surface the linter output and stop. **Never** run
+a pipeline that fails its own schema check.
+
+### 3. Collect inputs
+
+For each `inputs[]` entry in the pipeline:
+
+- If the user supplied a value on invocation (`/orchestrate pr-readiness-check diff_target=feature/x`)
+  use it.
+- Else use the `default` field.
+- Else ask **one** question per missing input, in order. Stop after
+  the first unanswered required input — pipelines are batch-friendly
+  by design, but `ask-when-uncertain` still applies.
+
+### 4. Dispatch the steps
+
+Walk `steps[]` in order. For each step:
+
+| `kind` | Dispatch path |
+|---|---|
+| `skill` | Invoke the skill identified by `ref` with the resolved `with` block. |
+| `command` | Run the slash-command identified by `ref` as if the user had typed it. |
+| `persona` | Set `roles.active_role` to `ref` for the next dependent step; does not produce its own `output`. |
+| `subagent` | Delegate to [`subagent-orchestration`](../skills/subagent-orchestration/SKILL.md) using `ref` as the mode name. |
+
+Capture each step's output in an in-memory `outputs[step.id]` map.
+`${{ inputs.X }}` and `${{ steps.Y.output }}` are substituted via
+string replacement only — no expressions, no shell-out.
+
+### 5. Honour `when`
+
+If a step has a `when` field, evaluate it as one of:
+
+- `${{ steps.X.output }} == "<literal>"`
+- `steps.X.success` / `steps.X.failure`
+
+Anything else → stop the run with a clear error. The DSL is
+deliberately tiny; richer logic belongs in a skill, not in the
+pipeline file.
+
+### 6. Halt on hard failure
+
+A step failure ends the pipeline immediately. Surface:
+
+- the failing step id and kind/ref
+- the error or non-zero exit
+- the steps that ran cleanly before it
+
+Do **not** continue past a failure unless a downstream step has a
+`when: steps.X.failure` guard explicitly authorizing it.
+
+### 7. Produce the delivery report
+
+When the pipeline reaches the end of `steps[]`:
+
+- Resolve every `outputs[name]` entry by substituting the captured
+  step outputs.
+- Print a Markdown delivery report:
+  - pipeline name + resolved input values
+  - per-step verdict (✅ / ❌, ref, one-line summary)
+  - the resolved `outputs:` map at the bottom
+
+### 8. Audit trail
+
+Per [`audit-log-v1`](../docs/contracts/audit-log-v1.md), append
+one JSONL entry per step boundary to the current month's audit file
+under `agents/state/audit/`. Counts + ids only — never the step's
+output body.
+
+### 9. What this command does NOT do
+
+- Edit the pipeline file. Authoring is human or skill-driven.
+- Commit, push, or open PRs. Those gates live elsewhere.
+- Branch or invent steps. The pipeline file is the source of truth.
+
+## See also
+
+- Contract: [`orchestration-dsl-v1.md`](../docs/contracts/orchestration-dsl-v1.md)
+- Linter: `scripts/lint_orchestration_dsl.py`
+- Subagent runtime: [`subagent-orchestration`](../skills/subagent-orchestration/SKILL.md)
+- Audit emission: [`audit-log-v1.md`](../docs/contracts/audit-log-v1.md)

package/.agent-src/commands/sync-gitignore/fix.md

@@ -0,0 +1,135 @@
+---
+name: sync-gitignore:fix
+cluster: sync-gitignore
+sub: fix
+description: Scrub legacy pre-`/agents/` patterns from the consumer's .gitignore (inside or outside the managed block) and re-sync the canonical entries
+disable-model-invocation: true
+suggestion:
+  eligible: true
+  trigger_description: "fix .gitignore garbage, clean up legacy agent-config entries, my .gitignore has stale agent entries, /sync-gitignore is not picking up the right paths"
+  trigger_context: "consumer project carries pre-/agents/ runtime patterns (.agent-chat-history, .agent-prices.md) at the root from an older install"
+---
+
+# /sync-gitignore:fix
+
+Cleanup sibling of [`/sync-gitignore`](../sync-gitignore.md). Strips
+legacy root-level patterns (pre-`/agents/` runtime artefacts —
+`.agent-chat-history`, `.agent-chat-history.bak`,
+`.agent-chat-history.*.bak`, `.agent-prices.md`, `.council-tmp/`) from
+**anywhere** in the consumer's `.gitignore` — inside or outside the
+managed block — then re-runs the regular sync so the current canonical
+`/agents/`-prefixed entries land in the block.
+
+Use when:
+
+- An older installer (pre-May 2026) dropped root-level `.agent-chat-history`
+  / `.agent-prices.md` lines that the current scripts no longer recognise.
+- A hand-edit added one of those legacy paths and it now conflicts with
+  the managed `/agents/...` entry.
+- `/sync-gitignore` reports "already in sync" but git is still ignoring
+  files at the wrong paths.
+
+## When NOT to use
+
+- To remove **user-added** lines from inside the block → that is
+  `--replace` on the base command, and it is destructive. This
+  sub-command only touches the legacy pattern list — nothing else.
+- To delete the entire managed block → do it by hand.
+- To migrate runtime files themselves (move `.agent-chat-history` →
+  `agents/.agent-chat-history`) → the installer's
+  `migrate_legacy_root_infra` step handles that. This sub-command only
+  fixes `.gitignore`.
+
+## Steps
+
+### 1. Locate script and target
+
+Same resolution order as [`/sync-gitignore`](../sync-gitignore.md):
+
+1. `./agent-config/scripts/sync_gitignore.py`
+2. `vendor/event4u/agent-config/scripts/sync_gitignore.py`
+3. `node_modules/@event4u/agent-config/scripts/sync_gitignore.py`
+
+Target is `<project_root>/.gitignore`. If no `.gitignore` exists,
+stop — there is nothing to fix:
+
+```
+> 📝 No .gitignore found at <project_root>. Nothing to clean up.
+```
+
+### 2. Dry-run with cleanup
+
+Run:
+
+```bash
+python3 <script> --cleanup-legacy --dry-run
+```
+
+Capture stdout (unified diff) and stderr (summary line listing the
+legacy entries that would be removed). Three outcomes:
+
+- **Nothing legacy + block in sync** → tell the user and stop:
+  ```
+  > ✅ .gitignore already clean — no legacy patterns, block in sync.
+  ```
+- **Diff produced** → show it and ask:
+  ```
+  > 🧹 /sync-gitignore:fix would clean up .gitignore:
+  >
+  > {diff}
+  >
+  > Summary: would remove {N} legacy entr{y|ies}: {names}
+  >          would add {M} entr{y|ies} to the managed block
+  >
+  > 1. Apply — write the changes
+  > 2. Skip — leave .gitignore untouched
+  ```
+- **Script error** (exit 2) → print the error and stop; do not prompt.
+
+### 3. Act on the choice
+
+- `1` (Apply) → re-run **without** `--dry-run`:
+  ```bash
+  python3 <script> --cleanup-legacy
+  ```
+  Confirm with the script's own summary lines (removed-legacy count and
+  added-entries count both surface there).
+- `2` (Skip) → stop. No changes made.
+
+Free-text replies (`"nö"`, `"leave it"`, unrecognized input) count as
+`2`. Never write on ambiguous input.
+
+### 4. Suggest the migration check (informational, do NOT auto-run)
+
+If the cleanup removed `.agent-chat-history` or `.agent-prices.md`,
+mention that the **file** at the root (if still present) may need to
+move to `agents/`. The installer does this automatically via
+[`migrate_legacy_root_infra`](../../../scripts/install.sh); the
+agent does not run it from this command. One line of guidance is
+enough:
+
+```
+> ℹ️  If `.agent-chat-history` still sits at the project root, re-run the installer (or move it to `agents/.agent-chat-history` by hand) so the runtime can find it again.
+```
+
+## Rules
+
+- **Append-only by default** — `--cleanup-legacy` removes legacy
+  patterns only. User-added non-legacy lines (inside or outside the
+  block) survive untouched.
+- **Never combine with `--replace`** — the destructive full-block
+  rewrite is a separate concern; mixing the two surprises users.
+- **Dry-run first, always** — the user must see the diff before any
+  write.
+- **Do NOT push, commit, or modify other files** — this command writes
+  to `.gitignore` only.
+
+## See also
+
+- [`/sync-gitignore`](../sync-gitignore.md) — append-only sync of the
+  managed block (no legacy cleanup)
+- [`scripts/sync_gitignore.py`](../../../scripts/sync_gitignore.py) —
+  the helper (`--cleanup-legacy` flag)
+- [`scripts/install.sh`](../../../scripts/install.sh) —
+  `migrate_legacy_root_infra` (moves the **files**, complement to this
+  command which fixes the **ignore rules**)

package/.agent-src/commands/sync-gitignore.md

@@ -1,5 +1,6 @@
 ---
 name: sync-gitignore
+cluster: sync-gitignore
 description: Sync the `event4u/agent-config` block in the consumer project's .gitignore — adds missing entries, preserves user-added lines, shows a diff before writing
 disable-model-invocation: true
 suggestion:
@@ -9,6 +10,28 @@ suggestion:
 
 # /sync-gitignore
 
+Top-level entry point for the `/sync-gitignore` family. Bare `/sync-gitignore`
+runs the interactive append-only sync described below. The `:fix`
+sub-command additionally scrubs legacy patterns (pre-`/agents/` layout)
+from anywhere in the consumer's `.gitignore` before re-syncing.
+
+## Sub-commands
+
+| Sub-command | Routes to | Purpose |
+|---|---|---|
+| `/sync-gitignore` (bare) | this file (`## Default flow`) | Interactive — append-only sync of the managed block, dry-run preview, confirm before write |
+| `/sync-gitignore:fix` | `commands/sync-gitignore/fix.md` | Cleanup — strip legacy root-level patterns (pre-`/agents/` layout) wherever they appear, then sync |
+
+## Dispatch
+
+1. Parse the user's argument: `/sync-gitignore[:<sub>] [args]`.
+2. Bare `/sync-gitignore` → run the `## Default flow` below verbatim.
+3. `/sync-gitignore:fix` → load `commands/sync-gitignore/fix.md` and follow
+   its `## Steps` section verbatim.
+4. Unknown sub-command → print the table above and ask which one.
+
+## Default flow
+
 Ensures the consumer project's `.gitignore` contains every entry the
 package expects to be ignored (symlinked `.augment/` subdirectories,
 `/agent-config` CLI wrapper, `.agent-settings*`, `agents/.agent-chat-history*`).
@@ -23,7 +46,7 @@ Use when:
   setup, or installer ran with `--skip-gitignore`).
 - You want to audit what the block **should** look like without writing.
 
-## When NOT to use
+### When NOT to use
 
 - To disable logging or change what is logged → that is
   `chat_history.enabled` in `.agent-settings.yml`, not `.gitignore`.
@@ -31,8 +54,8 @@ Use when:
   re-remove its own entries.
 - To change what the block contains → edit
   `config/gitignore-block.txt` in the package repo and re-release.
-
-## Steps
+- To clean up legacy garbage from older installs → use
+  [`/sync-gitignore:fix`](sync-gitignore/fix.md) instead.
 
 ### 1. Locate script and target
 
@@ -88,9 +111,11 @@ Free-text replies (`"nö"`, `"leave it"`, unrecognized input) count as
 Do **not** suggest `--replace` by default. It rewrites the block in
 full and drops user-added lines inside the block — destructive.
 Mention it only if the user explicitly asks to clean up or reset the
-block, and confirm once more before running it.
+block, and confirm once more before running it. For removing legacy
+root-level patterns (not user-added lines), prefer
+[`/sync-gitignore:fix`](sync-gitignore/fix.md).
 
-## Gotchas
+## Rules
 
 - The script honors the explicit `# event4u/agent-config — END` marker.
   Legacy blocks without it get the marker added automatically on the
@@ -99,6 +124,7 @@ block, and confirm once more before running it.
   They do not survive `--replace`.
 - Changes to `config/gitignore-block.txt` require a package update in
   the consumer project before this command can apply them.
+- **Do NOT chain sub-commands.** One `/sync-gitignore <sub>` per turn.
 
 ## See also
 

package/.agent-src/skills/learning-to-rule-or-skill/SKILL.md

@@ -21,6 +21,11 @@ Use this skill when:
 * Reviewing post-task learnings or retrospectives
 * Deciding whether a learning belongs in a rule or a skill
 * After completing a task — reflecting on what worked or caused friction
+* Mining the audit log (`agents/state/audit/<YYYY-MM>.jsonl`,
+  [`audit-log-v1`](../../../docs/contracts/audit-log-v1.md)) surfaced
+  a repeated phase pattern via
+  [`extract_audit_patterns.py`](../../../scripts/extract_audit_patterns.py)
+  — the pattern's `count` ≥ 2 already satisfies the repetition gate
 
 Do not use this skill when:
 
@@ -206,8 +211,10 @@ Mandatory fields the draft MUST fill:
 * `source_learning` — path to the `agents/learnings/<date>-<slug>.md`
   file this proposal was captured from
 * `evidence` — **at least two independent** references (PR, issue,
-  incident, review-comment, test-failure); entries that all resolve
-  to the same PR are rejected by the gate
+  incident, review-comment, test-failure, **or audit-log line ids**
+  per [`audit-log-v1`](../../../docs/contracts/audit-log-v1.md));
+  entries that all resolve to the same PR or the same audit-log
+  `run_id` are rejected by the gate (independence floor)
 * `Proposed artefact` (§4) — the full draft body, no `TODO` / `TBD`
 * `Success signal` (§7) — one metric, one baseline, one target, one
   evaluation date
@@ -295,6 +302,27 @@ audio) goes through the upstream `markitdown-mcp` server first; only
 write a custom extractor if `markitdown` cannot handle the format and
 the gap is documented in its skill body.
 
+## Audit-derived learnings (optional source)
+
+When the input is a pattern surfaced by
+[`extract_audit_patterns.py`](../../../scripts/extract_audit_patterns.py)
+mining `agents/state/audit/<YYYY-MM>.jsonl`
+([`audit-log-v1`](../../../docs/contracts/audit-log-v1.md)):
+
+1. Treat the script's pattern record as the **State the learning**
+   step input (§1) — `pattern.summary` is the one-sentence
+   statement, `pattern.line_ids` is the evidence.
+2. The repetition gate is already satisfied for `count ≥ 2`. Skip
+   to §3 (decide the target) — overlap check (§4) and proposal
+   draft (§8) remain mandatory.
+3. Independence floor still applies: two line ids from the same
+   `run_id` count as **one** piece of evidence. The mining script
+   already de-duplicates by `run_id`; the gate trusts that output.
+4. Audit-derived proposals MUST set
+   `source_learning: agents/state/audit/<YYYY-MM>.jsonl#<line_ids>`
+   and link the mining-script run id, so the human reviewer can
+   reproduce the pattern from the raw audit log.
+
 ## Environment notes
 
 Prefer updating existing rule/skill when possible.

package/.agent-src/skills/subagent-orchestration/SKILL.md

@@ -240,6 +240,15 @@ prefer the cheaper one (`do-and-judge` < `do-and-judge-two-stage` <
 `do-in-steps` < `do-in-parallel` < `do-competitively` <
 `judge-with-debate` < `do-in-worktrees`).
 
+**Mode 6 (`do-in-worktrees`) is gated by `worktrees.mode`** from
+`.agent-settings.yml` (default: `ask`). Resolve before picking:
+
+| `worktrees.mode` | Mode 6 |
+|---|---|
+| `ask` | Eligible. `using-git-worktrees` will run the per-creation permission ask. |
+| `on` | Eligible. Per-creation ask suppressed. |
+| `off` | **Not eligible.** Fall back to mode 3 (`do-in-steps`) — same step-by-step chain, in-place on the current branch. Unless the user **explicitly asked this turn** for a worktree chain, in which case proceed with mode 6 and acknowledge the override per [`using-git-worktrees § Pre-flight`](../using-git-worktrees/SKILL.md). |
+
 ### 4. Dispatch
 
 Hand off to the matching command:

package/.agent-src/skills/using-git-worktrees/SKILL.md

@@ -44,6 +44,31 @@ work and makes it impossible to tell what you broke.
 
 ## Procedure
 
+### 0. Pre-flight — read `worktrees.mode`
+
+Before anything else, read `worktrees.mode` from `.agent-settings.yml`
+(default: `ask`). The setting is a **mechanical layer on top of**
+`scope-control`'s permission gate — it narrows, never widens.
+
+| `worktrees.mode` | Behaviour |
+|---|---|
+| `ask` | Status quo. Continue to step 1; `scope-control` permission gate applies for every worktree creation. |
+| `on` | Standing permission. Skip the per-creation permission ask; continue to step 1. Iron-Law gates (ignore-check, clean baseline) still apply. |
+| `off` | No autonomous worktree creation. **Refuse** unless the user explicitly asked **this turn** for a worktree ("do this in a worktree", "use mode 6", "spawn a worktree for X"). |
+
+**Off, no explicit request** → stop. Tell the user the setting is `off`,
+suggest the in-place alternative (`subagent-orchestration` mode 3
+`do-in-steps`, or just stay on the current branch). Do not re-ask on
+the same task.
+
+**Off, with explicit request this turn** → acknowledge once
+("`worktrees.mode` is `off`; running this on your explicit request
+for this task") and continue to step 1. The override is for this one
+task — it does not flip the setting.
+
+The setting only suppresses **unprompted** usage. The tool stays
+available when the user wants it.
+
 ### 1. Inspect current state
 
 Before creating anything, check existing conventions — do not assume:

package/.agent-src/templates/agent-settings.md

@@ -230,6 +230,14 @@ subagents:
   # Set to 1 to serialize. Hard cap enforced by runtime.
   max_parallel: 3
 
+# --- Git worktrees ---
+worktrees:
+  # off | on | ask  (default: ask)
+  # off = no autonomous worktree creation (explicit user request overrides)
+  # on  = standing permission (skill skips the per-creation ask)
+  # ask = status quo — skill asks before creating
+  mode: ask
+
 # --- Role modes (see guidelines/agent-infra/role-contracts.md) ---
 roles:
   # Role the agent defaults to at the start of a session.
@@ -442,6 +450,7 @@ the canonical narrative lives in
 | `subagents.implementer_model` | model alias or empty | _(empty)_ | Model for implementer subagents. Empty = same tier as session model. See [subagent-configuration](../contexts/subagent-configuration.md). |
 | `subagents.judge_model` | model alias or empty | _(empty)_ | Model for judge subagents. Empty = one tier above implementer (opus if sonnet, sonnet if haiku). |
 | `subagents.max_parallel` | integer | `3` | Maximum parallel subagent invocations. `1` serializes. |
+| `worktrees.mode` | `off`, `on`, `ask` | `ask` | Controls autonomous `git worktree` usage. `off` = skill refuses unless the user explicitly asks for a worktree that turn (then it runs); `subagent-orchestration` mode 6 falls back to mode 3. `on` = standing permission (skill skips the per-creation ask; ignore-check and clean-baseline gates still apply). `ask` = status quo — `scope-control` permission gate runs every time. |
 | `roles.default_role` | `""`, `developer`, `reviewer`, `tester`, `po`, `incident`, `planner` | _(empty)_ | Role the agent defaults to at the start of a session. See [`role-contracts`](../docs/guidelines/agent-infra/role-contracts.md). |
 | `roles.active_role` | same as `default_role` | _(empty)_ | Role currently active; set by `/mode <name>`, cleared by `/mode none`. Enables the `role-mode-adherence` rule. |
 | `personas.override` | list of persona ids | `[]` | Developer-local override of the team default lens cast. Empty = inherit `personas.default` from `.agent-project-settings.yml`. See [`layered-settings`](../docs/guidelines/agent-infra/layered-settings.md). |

package/.agent-src/templates/scripts/work_engine/orchestration.py

@@ -0,0 +1,168 @@
+"""State machine stub for the ``/orchestrate`` command.
+
+Reads a pipeline file conforming to
+``docs/contracts/orchestration-dsl-v1.md`` and produces an ordered
+sequence of step descriptors the agent dispatches one at a time.
+The runtime itself is **not** in Python — each step is executed by the
+agent via skill / command / persona / subagent dispatch. This module
+holds the deterministic bookkeeping:
+
+- load + interpolate
+- step iteration with success / failure / when-guard tracking
+- output-map resolution at the end
+
+Design constraints (R1 carve-outs from
+``road-to-distribution-and-adoption.md``):
+
+- No external dependencies. YAML loading reuses the dispatcher's
+  loader so the runtime sees what the linter sees.
+- No side effects. The state machine never edits files, runs commands,
+  or emits hooks of its own. Audit emission is the caller's job.
+- Forward-ref free. ``steps[].with`` references can only reach
+  earlier steps; this is enforced both by the linter and at runtime.
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Iterator
+
+_INTERP_RE = re.compile(
+    r"\$\{\{\s*(inputs|steps)\.([a-z0-9_-]+)(?:\.output)?\s*\}\}"
+)
+
+
+@dataclass
+class StepResult:
+    """One step's record after dispatch."""
+    step_id: str
+    kind: str
+    ref: str
+    success: bool = False
+    output: str = ""
+    error: str | None = None
+
+
+@dataclass
+class PipelineState:
+    """Bookkeeping for a single ``/orchestrate`` run."""
+    name: str
+    inputs: dict[str, str]
+    results: dict[str, StepResult] = field(default_factory=dict)
+    halted: bool = False
+    halt_reason: str | None = None
+
+
+def _load_pipeline(path: Path) -> dict[str, Any]:
+    """Reuse the linter's loader so the runtime accepts the same shape.
+
+    Walks parents to find a directory containing ``scripts/hooks/``
+    so the loader is reachable both when this module runs from the
+    consumer projection (``.agent-src/templates/scripts/work_engine/``)
+    and from the source-of-truth tree
+    (``.agent-src.uncompressed/templates/scripts/work_engine/``).
+    """
+    import sys
+    here = Path(__file__).resolve()
+    for parent in here.parents:
+        candidate = parent / "scripts" / "hooks" / "dispatch_hook.py"
+        if candidate.is_file():
+            sys.path.insert(0, str(parent / "scripts"))
+            break
+    from hooks.dispatch_hook import _load_yaml  # noqa: E402
+    doc = _load_yaml(path)
+    if not isinstance(doc, dict):
+        raise ValueError(f"{path}: top-level must be a mapping")
+    return doc
+
+
+def _interpolate(value: Any, state: PipelineState) -> Any:
+    """Substitute ``${{ inputs.X }}`` / ``${{ steps.Y.output }}`` in a
+    nested value. Unknown references raise — the linter should have
+    caught them, but the runtime double-checks."""
+    if isinstance(value, str):
+        def replace(match: re.Match[str]) -> str:
+            ns, ident = match.group(1), match.group(2)
+            if ns == "inputs":
+                if ident not in state.inputs:
+                    raise KeyError(f"unknown input '{ident}'")
+                return state.inputs[ident]
+            if ident not in state.results:
+                raise KeyError(f"unknown step '{ident}'")
+            return state.results[ident].output
+        return _INTERP_RE.sub(replace, value)
+    if isinstance(value, dict):
+        return {k: _interpolate(v, state) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_interpolate(v, state) for v in value]
+    return value
+
+
+def _when_passes(when: str | None, state: PipelineState) -> bool:
+    """Evaluate the limited ``when`` mini-language. Supports
+    ``steps.X.success`` / ``steps.X.failure`` and equality on a
+    single ``${{ steps.X.output }}`` template against a literal."""
+    if not when:
+        return True
+    when = when.strip()
+    m = re.fullmatch(r"steps\.([a-z0-9_-]+)\.(success|failure)", when)
+    if m:
+        sid, kind = m.group(1), m.group(2)
+        if sid not in state.results:
+            return False
+        return state.results[sid].success if kind == "success" else not state.results[sid].success
+    m = re.fullmatch(r'\$\{\{\s*steps\.([a-z0-9_-]+)\.output\s*\}\}\s*==\s*"([^"]*)"', when)
+    if m:
+        sid, literal = m.group(1), m.group(2)
+        return state.results.get(sid, StepResult(sid, "", "")).output == literal
+    raise ValueError(f"unsupported when expression: {when!r}")
+
+
+def iter_steps(path: Path, inputs: dict[str, str]) -> Iterator[dict[str, Any]]:
+    """Yield interpolated step descriptors in order.
+
+    Caller dispatches each descriptor via skill / command / persona /
+    subagent and feeds the result back via :func:`record_result`.
+    """
+    doc = _load_pipeline(path)
+    merged_inputs = {
+        inp["id"]: inputs.get(inp["id"], inp.get("default", ""))
+        for inp in (doc.get("inputs") or [])
+        if isinstance(inp, dict) and isinstance(inp.get("id"), str)
+    }
+    state = PipelineState(name=doc.get("name", ""), inputs=merged_inputs)
+    for step in doc.get("steps") or []:
+        if state.halted:
+            break
+        if not _when_passes(step.get("when"), state):
+            continue
+        yield {
+            "id": step["id"],
+            "kind": step["kind"],
+            "ref": step["ref"],
+            "with": _interpolate(step.get("with") or {}, state),
+            "_state": state,
+        }
+
+
+def record_result(descriptor: dict[str, Any], *, success: bool, output: str = "", error: str | None = None) -> None:
+    """Caller hands the descriptor + outcome back so subsequent steps
+    can see ``${{ steps.<id>.output }}``."""
+    state: PipelineState = descriptor["_state"]
+    state.results[descriptor["id"]] = StepResult(
+        step_id=descriptor["id"], kind=descriptor["kind"], ref=descriptor["ref"],
+        success=success, output=output, error=error,
+    )
+    if not success:
+        state.halted = True
+        state.halt_reason = f"step {descriptor['id']} failed"
+
+
+def resolve_outputs(path: Path, state: PipelineState) -> dict[str, str]:
+    """Resolve the pipeline's ``outputs:`` map against the captured
+    step outputs. Returns an empty map if the pipeline declares no
+    outputs."""
+    doc = _load_pipeline(path)
+    raw = doc.get("outputs") or {}
+    return {k: _interpolate(v, state) for k, v in raw.items()}

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Shared agent configuration \u2014 skills for AI coding tools (Claude Code, Augment, Cursor, Cline, Windsurf, Gemini CLI).",
-    "version": "1.39.0"
+    "version": "1.40.0"
   },
   "plugins": [
     {
@@ -184,6 +184,7 @@
         "./.claude/skills/optimize-prompt",
         "./.claude/skills/optimize-rtk",
         "./.claude/skills/optimize-skills",
+        "./.claude/skills/orchestrate",
         "./.claude/skills/override",
         "./.claude/skills/override-create",
         "./.claude/skills/override-manage",
@@ -262,6 +263,7 @@
         "./.claude/skills/subagent-orchestration",
         "./.claude/skills/sync-agent-settings",
         "./.claude/skills/sync-gitignore",
+        "./.claude/skills/sync-gitignore-fix",
         "./.claude/skills/systematic-debugging",
         "./.claude/skills/tailwind-engineer",
         "./.claude/skills/tech-debt-tracker",